server crashes in base_list::head

--source include/have_innodb.inc

CREATE TABLE t1 (id int PRIMARY KEY) ENGINE=InnoDB;

CREATE TABLE t2 (id int PRIMARY KEY) ENGINE=InnoDB;

CREATE TABLE t3 (id int PRIMARY KEY, d1 int, d2 int , d3 int) ENGINE=InnoDB;

select 1 

FROM  t1 JOIN t2 ON (t1.id = t2.id)

WHERE t1.id IN

    (SELECT t3.id FROM t3 AS tbl JOIN t3 ON (tbl.d2 <> t3.d1) ORDER BY t3.d3);

Thread 1 (Thread 0x7f87882de700 (LWP 26536)):

#0  __pthread_kill (threadid=<optimized out>, signo=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:62

#1  0x000055e745527761 in my_write_core (sig=11) at /home/alice/git/10.4/mysys/stacktrace.c:481

#2  0x000055e744d6a0d1 in handle_fatal_signal (sig=11) at /home/alice/git/10.4/sql/signal_handler.cc:305

#3  <signal handler called>

#4  0x000055e7449a6931 in base_list::head (this=0x7f87882dc550) at /home/alice/git/10.4/sql/sql_list.h:287

#5  0x000055e744b0d0e4 in List<Item_equal>::head (this=0x7f87882dc550) at /home/alice/git/10.4/sql/sql_list.h:497

#6  0x000055e744acab0a in make_join_statistics (join=0x7f873c019fe0, tables_list=..., keyuse_array=0x7f873c01a2d0) at /home/alice/git/10.4/sql/sql_select.cc:5010

#7  0x000055e744abfad3 in JOIN::optimize_inner (this=0x7f873c019fe0) at /home/alice/git/10.4/sql/sql_select.cc:1926

#8  0x000055e744abdf33 in JOIN::optimize (this=0x7f873c019fe0) at /home/alice/git/10.4/sql/sql_select.cc:1448

#9  0x000055e744ac7e43 in mysql_select (thd=0x7f873c000b00, tables=0x7f873c015508, wild_num=0, fields=..., conds=0x7f873c0194e0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7f873c019fc0, unit=0x7f873c0049a8, select_lex=0x7f873c014ff8) at /home/alice/git/10.4/sql/sql_select.cc:4261

#10 0x000055e744ab99d6 in handle_select (thd=0x7f873c000b00, lex=0x7f873c0048e0, result=0x7f873c019fc0, setup_tables_done_option=0) at /home/alice/git/10.4/sql/sql_select.cc:382

#11 0x000055e744a84315 in execute_sqlcom_select (thd=0x7f873c000b00, all_tables=0x7f873c015508) at /home/alice/git/10.4/sql/sql_parse.cc:6545

#12 0x000055e744a7a76e in mysql_execute_command (thd=0x7f873c000b00) at /home/alice/git/10.4/sql/sql_parse.cc:3768

#13 0x000055e744a8804d in mysql_parse (thd=0x7f873c000b00, rawbuf=0x7f873c014e88 "select 1 \nFROM  t1 JOIN t2 ON (t1.id = t2.id)\nWHERE t1.id IN\n(SELECT t3.id FROM t3 AS tbl JOIN t3 ON (tbl.d2 <> t3.d1) ORDER BY t3.d3)", length=134, parser_state=0x7f87882dd5f0, is_com_multi=false, is_next_command=false) at /home/alice/git/10.4/sql/sql_parse.cc:8063

#14 0x000055e744a751d0 in dispatch_command (command=COM_QUERY, thd=0x7f873c000b00, packet=0x7f873c12e011 "select 1 \nFROM  t1 JOIN t2 ON (t1.id = t2.id)\nWHERE t1.id IN\n(SELECT t3.id FROM t3 AS tbl JOIN t3 ON (tbl.d2 <> t3.d1) ORDER BY t3.d3)", packet_length=134, is_com_multi=false, is_next_command=false) at /home/alice/git/10.4/sql/sql_parse.cc:1847

#15 0x000055e744a73bed in do_command (thd=0x7f873c000b00) at /home/alice/git/10.4/sql/sql_parse.cc:1392

#16 0x000055e744bda613 in do_handle_one_connection (connect=0x55e748d58ad0) at /home/alice/git/10.4/sql/sql_connect.cc:1402

#17 0x000055e744bda364 in handle_one_connection (arg=0x55e748d58ad0) at /home/alice/git/10.4/sql/sql_connect.cc:1308

#18 0x000055e7454b7baa in pfs_spawn_thread (arg=0x55e748d6c1e0) at /home/alice/git/10.4/storage/perfschema/pfs.cc:1862

#19 0x00007f879676c6ba in start_thread (arg=0x7f87882de700) at pthread_create.c:333

#20 0x00007f8795c0141d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109