Server crashes in Time_and_counter_tracker::incr_loops

CREATE TABLE t1 (i INT);

CREATE VIEW v1 AS SELECT * FROM t1 WHERE RAND() > 0.5;

CREATE FUNCTION f1() RETURNS INT RETURN ( SELECT MAX(i) FROM v1 );

--error ER_NON_INSERTABLE_TABLE

REPLACE INTO v1 VALUES (f1());

SET @aux = f1();

# Cleanup

DROP FUNCTION f1;

DROP VIEW v1;

DROP TABLE t1;

#3  <signal handler called>

#4  0x00005557badb33f2 in Time_and_counter_tracker::incr_loops (this=0x78) at /data/src/10.1/sql/sql_analyze_stmt.h:97

#5  0x00005557bad76425 in JOIN::exec (this=0x7f1acda67848) at /data/src/10.1/sql/sql_select.cc:2510

#6  0x00005557bb01ea20 in subselect_single_select_engine::exec (this=0x7f1acd9d5600) at /data/src/10.1/sql/item_subselect.cc:3842

#7  0x00005557bb01497f in Item_subselect::exec (this=0x7f1acd9d54f0) at /data/src/10.1/sql/item_subselect.cc:711

#8  0x00005557bb0163df in Item_singlerow_subselect::val_int (this=0x7f1acd9d54f0) at /data/src/10.1/sql/item_subselect.cc:1309

#9  0x00005557baf92cab in Item::save_in_field (this=0x7f1acd9d54f0, field=0x7f1acd847048, no_conversions=false) at /data/src/10.1/sql/item.cc:6070

#10 0x00005557bb0bd586 in sp_eval_expr (thd=0x7f1acf4d5070, result_field=0x7f1acd847048, expr_item_ptr=0x7f1acd9d5670) at /data/src/10.1/sql/sp_head.cc:449

#11 0x00005557bb0c9f17 in sp_rcontext::set_return_value (this=0x7f1acd9e0088, thd=0x7f1acf4d5070, return_value_item=0x7f1acd9d5670) at /data/src/10.1/sql/sp_rcontext.cc:154

#12 0x00005557bb0c4d32 in sp_instr_freturn::exec_core (this=0x7f1acd9d5640, thd=0x7f1acf4d5070, nextp=0x7f1ad88c81f4) at /data/src/10.1/sql/sp_head.cc:3540

#13 0x00005557bb0c38d0 in sp_lex_keeper::reset_lex_and_exec_core (this=0x7f1acd9d5680, thd=0x7f1acf4d5070, nextp=0x7f1ad88c81f4, open_tables=true, instr=0x7f1acd9d5640) at /data/src/10.1/sql/sp_head.cc:2996

#14 0x00005557bb0c4cad in sp_instr_freturn::execute (this=0x7f1acd9d5640, thd=0x7f1acf4d5070, nextp=0x7f1ad88c81f4) at /data/src/10.1/sql/sp_head.cc:3510

#15 0x00005557bb0bf726 in sp_head::execute (this=0x7f1acd9ce088, thd=0x7f1acf4d5070, merge_da_on_success=true) at /data/src/10.1/sql/sp_head.cc:1316

#16 0x00005557bb0c09f4 in sp_head::execute_function (this=0x7f1acd9ce088, thd=0x7f1acf4d5070, argp=0x0, argcount=0, return_value_fld=0x7f1acd847048) at /data/src/10.1/sql/sp_head.cc:1857

#17 0x00005557bafea5b1 in Item_func_sp::execute_impl (this=0x7f1acd843338, thd=0x7f1acf4d5070) at /data/src/10.1/sql/item_func.cc:6712

#18 0x00005557bafea340 in Item_func_sp::execute (this=0x7f1acd843338) at /data/src/10.1/sql/item_func.cc:6645

#19 0x00005557bafed874 in Item_func_sp::val_int (this=0x7f1acd843338) at /data/src/10.1/sql/item_func.h:2130

#20 0x00005557bafe54c1 in Item_func_set_user_var::check (this=0x7f1acd8444d8, use_result_field=false) at /data/src/10.1/sql/item_func.cc:5058

#21 0x00005557bac8836d in set_var_user::check (this=0x7f1acd844938, thd=0x7f1acf4d5070) at /data/src/10.1/sql/set_var.cc:830

#22 0x00005557bac87d21 in sql_set_variables (thd=0x7f1acf4d5070, var_list=0x7f1acf4d9828, free=true) at /data/src/10.1/sql/set_var.cc:689

#23 0x00005557bad3967e in mysql_execute_command (thd=0x7f1acf4d5070) at /data/src/10.1/sql/sql_parse.cc:4323

#24 0x00005557bad429cb in mysql_parse (thd=0x7f1acf4d5070, rawbuf=0x7f1acd843088 "SET @aux = f1()", length=15, parser_state=0x7f1ad88c95e0) at /data/src/10.1/sql/sql_parse.cc:7333

#25 0x00005557bad315d0 in dispatch_command (command=COM_QUERY, thd=0x7f1acf4d5070, packet=0x7f1ad1ff9071 "SET @aux = f1()", packet_length=15) at /data/src/10.1/sql/sql_parse.cc:1484

#26 0x00005557bad3036d in do_command (thd=0x7f1acf4d5070) at /data/src/10.1/sql/sql_parse.cc:1106

#27 0x00005557bae68dd1 in do_handle_one_connection (thd_arg=0x7f1acf4d5070) at /data/src/10.1/sql/sql_connect.cc:1349

#28 0x00005557bae68b35 in handle_one_connection (arg=0x7f1acf4d5070) at /data/src/10.1/sql/sql_connect.cc:1261

#29 0x00005557bb221654 in pfs_spawn_thread (arg=0x7f1ad5c39ef0) at /data/src/10.1/storage/perfschema/pfs.cc:1860

#30 0x00007f1ad8549494 in start_thread (arg=0x7f1ad88cab00) at pthread_create.c:333

#31 0x00007f1ad669493f in clone () from /lib/x86_64-linux-gnu/libc.so.6