SELECT COUNT(DISTINCT) returns the wrong value when tmp_table_size is limited

CREATE OR REPLACE TABLE test.test_distinct( user_id CHAR(64) CHARACTER SET utf8 ) ENGINE=MyISAM;

INSERT INTO test.test_distinct VALUES(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17);

SET @@tmp_table_size = 1024;

SHOW STATUS LIKE 'created%';

| Created_tmp_disk_tables | 0     |

| Created_tmp_files       | 1     |

| Created_tmp_tables      | 3     |

SELECT COUNT( DISTINCT user_id ) FROM test.test_distinct;

+---------------------------+

| COUNT( DISTINCT user_id ) |

+---------------------------+

|                         0 |

+---------------------------+

1 row in set (0.00 sec)

SHOW STATUS LIKE 'created%';

| Created_tmp_disk_tables | 0     |

| Created_tmp_files       | 2     |

| Created_tmp_tables      | 4     |

CREATE OR REPLACE TABLE test.test_distinct( user_id CHAR(255) CHARACTER SET utf8 ) ENGINE=MyISAM;

INSERT INTO test.test_distinct VALUES(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17);

SET @@tmp_table_size = 1024;

SELECT COUNT( DISTINCT user_id ) FROM test.test_distinct;

ERROR 2013 (HY000): Lost connection to MySQL server during query

170214 13:03:12 [ERROR] mysqld got signal 11 ;

This could be because you hit a bug. It is also possible that this binary

or one of the libraries it was linked against is corrupt, improperly built,

or misconfigured. This error can also be caused by malfunctioning hardware.

To report this bug, see https://mariadb.com/kb/en/reporting-bugs

We will try our best to scrape up some info that will hopefully help

diagnose the problem, but since we have already crashed, 

something is definitely wrong and this may fail.

Server version: 10.1.17-MariaDB

key_buffer_size=4294967296

read_buffer_size=2147479552

max_used_connections=4

max_threads=18

thread_count=4

It is possible that mysqld could use up to 

key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 117440789 K  bytes of memory

Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x0x7ff457674008

Attempting backtrace. You can use the following information to find out

where mysqld died. If you see no messages after this, something went

terribly wrong...

stack_bottom = 0x7ff665d63d80 thread_stack 0x30000

/usr/sbin/mysqld(my_print_stacktrace+0x2b)[0x5569e01e716b]

/usr/sbin/mysqld(handle_fatal_signal+0x475)[0x5569dfd43375]

/lib64/libpthread.so.0(+0xf100)[0x7ff6659b2100]

/usr/sbin/mysqld(+0xa9eb59)[0x5569e0216b59]

/usr/sbin/mysqld(my_charpos_mb+0x50)[0x5569e0203460]

/usr/sbin/mysqld(_ZN12Field_string3cmpEPKhS1_+0x90)[0x5569dfd27850]

/usr/sbin/mysqld(_downheap+0xe9)[0x5569e01e6d89]

/usr/sbin/mysqld(queue_remove+0x26)[0x5569e01e6f46]

/usr/sbin/mysqld(_Z13merge_buffersP10Sort_paramP11st_io_cacheS2_PhP10st_buffpekS5_S5_i+0x849)[0x5569dfd404d9]

/usr/sbin/mysqld(_Z11merge_indexP10Sort_paramPhP10st_buffpekjP11st_io_cacheS5_+0x3c)[0x5569dfd4083c]

/usr/sbin/mysqld(_ZN6Unique5mergeEP5TABLEPhb+0x266)[0x5569dfc7ee66]

/usr/sbin/mysqld(_ZN6Unique4walkEP5TABLEPFiPvjS2_ES2_+0x204)[0x5569dfc7f074]

/usr/sbin/mysqld(_ZN19Aggregator_distinct5endupEv+0xc8)[0x5569dfdd54a8]

/usr/sbin/mysqld(_ZN14Item_sum_count7val_intEv+0x1e)[0x5569dfdd394e]

/usr/sbin/mysqld(_ZN4Item4sendEP8ProtocolP6String+0x17c)[0x5569dfd556bc]

/usr/sbin/mysqld(_ZN8Protocol19send_result_set_rowEP4ListI4ItemE+0x104)[0x5569dfb4d094]

/usr/sbin/mysqld(_ZN11select_send9send_dataER4ListI4ItemE+0x58)[0x5569dfba4278]

/usr/sbin/mysqld(_Z14end_send_groupP4JOINP13st_join_tableb+0x460)[0x5569dfc17790]

/usr/sbin/mysqld(+0x49998e)[0x5569dfc1198e]

/usr/sbin/mysqld(_ZN4JOIN10exec_innerEv+0xb50)[0x5569dfc24b10]

/usr/sbin/mysqld(_ZN4JOIN4execEv+0x5d)[0x5569dfc26a8d]

/usr/sbin/mysqld(_Z12mysql_selectP3THDPPP4ItemP10TABLE_LISTjR4ListIS1_ES2_jP8st_orderSB_S2_SB_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x12a)[0x5569dfc2345a]

/usr/sbin/mysqld(_Z13handle_selectP3THDP3LEXP13select_resultm+0x25d)[0x5569dfc26d6d]

/usr/sbin/mysqld(+0x44e982)[0x5569dfbc6982]

/usr/sbin/mysqld(_Z21mysql_execute_commandP3THD+0x5d7f)[0x5569dfbd2c3f]

/usr/sbin/mysqld(_Z11mysql_parseP3THDPcjP12Parser_state+0x28d)[0x5569dfbd617d]

/usr/sbin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0x2293)[0x5569dfbd8c33]

/usr/sbin/mysqld(_Z10do_commandP3THD+0x16b)[0x5569dfbd91cb]

/usr/sbin/mysqld(_Z24do_handle_one_connectionP3THD+0x17f)[0x5569dfc97a5f]

/usr/sbin/mysqld(handle_one_connection+0x47)[0x5569dfc97bb7]

/lib64/libpthread.so.0(+0x7dc5)[0x7ff6659aadc5]

/lib64/libc.so.6(clone+0x6d)[0x7ff663de0c9d]

Trying to get some variables.

Some pointers may be invalid and cause the dump to abort.

Query (0x7ff45611b020): is an invalid pointer

Connection ID (thread ID): 4

Status: NOT_KILLED

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=off,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=off

The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains

information that should help you find out what is causing the crash.

We think the query pointer is invalid, but we will try to print it anyway. 

Query: SELECT SQL_NO_CACHE COUNT( DISTINCT user_id ) FROM test.test_distinct