Server crashes in Item_field::used_tables / Item_field::exclusive_dependence_on_table_processor

CREATE TABLE t (pk INT PRIMARY KEY, f INT) ENGINE=MyISAM;

CREATE ALGORITHM=TEMPTABLE VIEW v AS SELECT * FROM t;

INSERT INTO t VALUES (1,1),(2,2);

SELECT * FROM v AS v1, v AS v2

WHERE v2.pk > v1.f AND v1.f IN ( SELECT COUNT(pk) FROM t );

#3  <signal handler called>

#4  0x00007f6c6780b0cb in Item_field::used_tables (this=0x7f6c5c065f18) at /data/src/10.2-bug/sql/item.cc:2814

#5  0x00007f6c67820d5e in Item_field::exclusive_dependence_on_table_processor (this=0x7f6c5c065f18, map=0x7f6c686958b0) at /data/src/10.2-bug/sql/item.cc:10213

#6  0x00007f6c674d1e49 in Item::walk (this=0x7f6c5c065f18, processor=&virtual table offset 920, walk_subquery=false, arg=0x7f6c686958b0) at /data/src/10.2-bug/sql/item.h:1413

#7  0x00007f6c674cfdf7 in Item_args::walk_args (this=0x7f6c5c066098, processor=&virtual table offset 920, walk_subquery=false, arg=0x7f6c686958b0) at /data/src/10.2-bug/sql/item.h:3679

#8  0x00007f6c674d0045 in Item_func_or_sum::walk (this=0x7f6c5c066010, processor=&virtual table offset 920, walk_subquery=false, arg=0x7f6c686958b0) at /data/src/10.2-bug/sql/item.h:3942

#9  0x00007f6c67825972 in Item_cache::walk (this=0x7f6c5c11d8b8, processor=&virtual Item::exclusive_dependence_on_table_processor(void*), walk_subquery=false, arg=0x7f6c686958b0) at /data/src/10.2-bug/sql/item.h:5261

#10 0x00007f6c674cfdf7 in Item_args::walk_args (this=0x7f6c5c065220, processor=&virtual table offset 920, walk_subquery=false, arg=0x7f6c686958b0) at /data/src/10.2-bug/sql/item.h:3679

#11 0x00007f6c674d0045 in Item_func_or_sum::walk (this=0x7f6c5c065198, processor=&virtual table offset 920, walk_subquery=false, arg=0x7f6c686958b0) at /data/src/10.2-bug/sql/item.h:3942

#12 0x00007f6c67695eee in TABLE_LIST::check_pushable_cond_for_table (this=0x7f6c5c064968, cond=0x7f6c5c065198) at /data/src/10.2-bug/sql/table.cc:7954

#13 0x00007f6c67695e03 in TABLE_LIST::check_pushable_cond_for_table (this=0x7f6c5c064968, cond=0x7f6c5c11dae0) at /data/src/10.2-bug/sql/table.cc:7939

#14 0x00007f6c67560ce3 in pushdown_cond_for_derived (thd=0x7f6c5c016070, cond=0x7f6c5c11dae0, derived=0x7f6c5c064968) at /data/src/10.2-bug/sql/sql_derived.cc:1163

#15 0x00007f6c675cdc7d in JOIN::optimize_inner (this=0x7f6c5c119b58) at /data/src/10.2-bug/sql/sql_select.cc:1282

#16 0x00007f6c675cd158 in JOIN::optimize (this=0x7f6c5c119b58) at /data/src/10.2-bug/sql/sql_select.cc:1076

#17 0x00007f6c675d59d2 in mysql_select (thd=0x7f6c5c016070, tables=0x7f6c5c064300, wild_num=1, fields=..., conds=0x7f6c5c066a00, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7f6c5c069c78, unit=0x7f6c5c019b18, select_lex=0x7f6c5c01a250) at /data/src/10.2-bug/sql/sql_select.cc:3553

#18 0x00007f6c675cabb7 in handle_select (thd=0x7f6c5c016070, lex=0x7f6c5c019a50, result=0x7f6c5c069c78, setup_tables_done_option=0) at /data/src/10.2-bug/sql/sql_select.cc:373

#19 0x00007f6c67598795 in execute_sqlcom_select (thd=0x7f6c5c016070, all_tables=0x7f6c5c064300) at /data/src/10.2-bug/sql/sql_parse.cc:6345

#20 0x00007f6c6758e2e3 in mysql_execute_command (thd=0x7f6c5c016070) at /data/src/10.2-bug/sql/sql_parse.cc:3376

#21 0x00007f6c6759c154 in mysql_parse (thd=0x7f6c5c016070, rawbuf=0x7f6c5c064088 "SELECT * FROM v AS v1, v AS v2\nWHERE v2.pk > v1.f AND v1.f IN ( SELECT COUNT(pk) FROM t )", length=89, parser_state=0x7f6c68696dd0, is_com_multi=false, is_next_command=false) at /data/src/10.2-bug/sql/sql_parse.cc:7788

#22 0x00007f6c67589f39 in dispatch_command (command=COM_QUERY, thd=0x7f6c5c016070, packet=0x7f6c5c058071 "SELECT * FROM v AS v1, v AS v2\nWHERE v2.pk > v1.f AND v1.f IN ( SELECT COUNT(pk) FROM t )", packet_length=89, is_com_multi=false, is_next_command=false) at /data/src/10.2-bug/sql/sql_parse.cc:1805

#23 0x00007f6c67588913 in do_command (thd=0x7f6c5c016070) at /data/src/10.2-bug/sql/sql_parse.cc:1365

#24 0x00007f6c676ce1f8 in do_handle_one_connection (connect=0x7f6c64470410) at /data/src/10.2-bug/sql/sql_connect.cc:1354

#25 0x00007f6c676cdf85 in handle_one_connection (arg=0x7f6c64470410) at /data/src/10.2-bug/sql/sql_connect.cc:1260

#26 0x00007f6c679f8b66 in pfs_spawn_thread (arg=0x7f6c644519f0) at /data/src/10.2-bug/storage/perfschema/pfs.cc:1862

#27 0x00007f6c66c020a4 in start_thread (arg=0x7f6c68698300) at pthread_create.c:309

#28 0x00007f6c64dba87d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111