Server crashes in Item_ref::used_tables on subquery from a view

CREATE TABLE t (i INT);

INSERT INTO t VALUES (1),(2); # Unimportant, can also be an empty table

CREATE VIEW v AS SELECT MAX(i) AS f FROM t;

SELECT * FROM ( SELECT * FROM v ) AS sq WHERE f > 0;

#3  <signal handler called>

#4  0x000056381e7f932a in Item_ref::used_tables (this=0x7f1c480378b8) at /data/src/10.2/sql/item.cc:10573

#5  0x000056381e7f94b5 in Item_direct_view_ref::used_tables (this=0x7f1c480376b8) at /data/src/10.2/sql/item.cc:10599

#6  0x000056381e7ee9cc in Item_direct_view_ref::derived_field_transformer_for_having (this=0x7f1c480376b8, thd=0x7f1c48000b00, arg=0x7f1c48014ab8 "\220\037|\037\070V") at /data/src/10.2/sql/item.cc:7178

#7  0x000056381e7f0003 in Item_ref::transform (this=0x7f1c480376b8, thd=0x7f1c48000b00, transformer=&virtual Item::derived_field_transformer_for_having(THD*, unsigned char*), arg=0x7f1c48014ab8 "\220\037|\037\070V") at /data/src/10.2/sql/item.cc:7745

#8  0x000056381e83e106 in Item_args::transform_args (this=0x7f1c480375e0, thd=0x7f1c48000b00, transformer=&virtual table offset 1208, arg=0x7f1c48014ab8 "\220\037|\037\070V") at /data/src/10.2/sql/item_func.cc:328

#9  0x000056381e83e1ed in Item_func::transform (this=0x7f1c48037558, thd=0x7f1c48000b00, transformer=&virtual table offset 1208, argument=0x7f1c48014ab8 "\220\037|\037\070V") at /data/src/10.2/sql/item_func.cc:364

#10 0x000056381e52cdea in pushdown_cond_for_derived (thd=0x7f1c48000b00, cond=0x7f1c48013fc0, derived=0x7f1c480131a0) at /data/src/10.2/sql/sql_derived.cc:1284

#11 0x000056381e59be1a in JOIN::optimize_inner (this=0x7f1c48016798) at /data/src/10.2/sql/sql_select.cc:1334

#12 0x000056381e59b0a5 in JOIN::optimize (this=0x7f1c48016798) at /data/src/10.2/sql/sql_select.cc:1085

#13 0x000056381e5a3fc2 in mysql_select (thd=0x7f1c48000b00, tables=0x7f1c48013808, wild_num=1, fields=..., conds=0x7f1c48013fc0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7f1c48016778, unit=0x7f1c480045e0, select_lex=0x7f1c48004d18) at /data/src/10.2/sql/sql_select.cc:3654

#14 0x000056381e5989d6 in handle_select (thd=0x7f1c48000b00, lex=0x7f1c48004518, result=0x7f1c48016778, setup_tables_done_option=0) at /data/src/10.2/sql/sql_select.cc:373

#15 0x000056381e564946 in execute_sqlcom_select (thd=0x7f1c48000b00, all_tables=0x7f1c48013808) at /data/src/10.2/sql/sql_parse.cc:6438

#16 0x000056381e55a985 in mysql_execute_command (thd=0x7f1c48000b00) at /data/src/10.2/sql/sql_parse.cc:3453

#17 0x000056381e568318 in mysql_parse (thd=0x7f1c48000b00, rawbuf=0x7f1c48012368 "SELECT * FROM ( SELECT * FROM v ) AS sq WHERE f > 0", length=51, parser_state=0x7f1c5f7fd200, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:7875

#18 0x000056381e5563f1 in dispatch_command (command=COM_QUERY, thd=0x7f1c48000b00, packet=0x7f1c480087c1 "SELECT * FROM ( SELECT * FROM v ) AS sq WHERE f > 0", packet_length=51, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1817

#19 0x000056381e554d32 in do_command (thd=0x7f1c48000b00) at /data/src/10.2/sql/sql_parse.cc:1362

#20 0x000056381e6a03ad in do_handle_one_connection (connect=0x5638207e2340) at /data/src/10.2/sql/sql_connect.cc:1354

#21 0x000056381e6a013a in handle_one_connection (arg=0x5638207e2340) at /data/src/10.2/sql/sql_connect.cc:1260

#22 0x000056381eabad78 in pfs_spawn_thread (arg=0x56382081abb0) at /data/src/10.2/storage/perfschema/pfs.cc:1862

#23 0x00007f1c6b49c494 in start_thread (arg=0x7f1c5f7fe700) at pthread_create.c:333

#24 0x00007f1c6961493f in clone () from /lib/x86_64-linux-gnu/libc.so.6

commit 9f3622191df074d9f4e512320effe86f06b250fb

Author: Igor Babaev <igor@askmonty.org>

Date:   Thu Jun 22 00:41:44 2017 -0700

    Fixed the bug mdev-12845.