Server crashes in JOIN::optimize_inner upon 2nd execution of PS with semijoin and condition_pushdown_for_subquery

CREATE TABLE t1 (pk INT NOT NULL PRIMARY KEY, a VARCHAR(1));

INSERT INTO t1 VALUES (1,'t'),(2,'h');

CREATE TABLE t2 (b VARCHAR(1), KEY(b));

INSERT INTO t2 VALUES ('x'),('d');

PREPARE stmt FROM "SELECT * FROM t1 WHERE a IN ( SELECT MIN(b) FROM t2 ) AND a IN ('b', 'g') AND pk = 3";

EXECUTE stmt;

EXECUTE stmt;

# Cleanup

DROP TABLE t1, t2;

#3  <signal handler called>

#4  0x00005563e3de467f in JOIN::optimize_inner (this=0x7feca80156e8) at /data/src/10.4-travis/sql/sql_select.cc:1690

#5  0x00005563e3de384d in JOIN::optimize (this=0x7feca80156e8) at /data/src/10.4-travis/sql/sql_select.cc:1451

#6  0x00005563e417dcba in Item_in_subselect::optimize (this=0x7feca806c558, out_rows=0x7fecba36aaa8, cost=0x7fecba36aab0) at /data/src/10.4-travis/sql/item_subselect.cc:770

#7  0x00005563e3f68275 in setup_jtbm_semi_joins (join=0x7feca8015158, join_list=0x7feca806a548, eq_list=...) at /data/src/10.4-travis/sql/opt_subselect.cc:5964

#8  0x00005563e3de48c4 in JOIN::optimize_inner (this=0x7feca8015158) at /data/src/10.4-travis/sql/sql_select.cc:1719

#9  0x00005563e3de384d in JOIN::optimize (this=0x7feca8015158) at /data/src/10.4-travis/sql/sql_select.cc:1451

#10 0x00005563e3ded9df in mysql_select (thd=0x7feca8000b00, tables=0x7feca806a928, wild_num=0, fields=..., conds=0x7feca8014ef8, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2416184064, result=0x7feca806d7b0, unit=0x7feca80689e8, select_lex=0x7feca806a3a0) at /data/src/10.4-travis/sql/sql_select.cc:4279

#11 0x00005563e3ddf387 in handle_select (thd=0x7feca8000b00, lex=0x7feca8068920, result=0x7feca806d7b0, setup_tables_done_option=0) at /data/src/10.4-travis/sql/sql_select.cc:385

#12 0x00005563e3da95b1 in execute_sqlcom_select (thd=0x7feca8000b00, all_tables=0x7feca806a928) at /data/src/10.4-travis/sql/sql_parse.cc:6566

#13 0x00005563e3d9fbac in mysql_execute_command (thd=0x7feca8000b00) at /data/src/10.4-travis/sql/sql_parse.cc:3775

#14 0x00005563e3dcb3d8 in Prepared_statement::execute (this=0x7feca80684c0, expanded_query=0x7fecba36bc50, open_cursor=false) at /data/src/10.4-travis/sql/sql_prepare.cc:4790

#15 0x00005563e3dc979e in Prepared_statement::execute_loop (this=0x7feca80684c0, expanded_query=0x7fecba36bc50, open_cursor=false, packet=0x0, packet_end=0x0) at /data/src/10.4-travis/sql/sql_prepare.cc:4218

#16 0x00005563e3dc73a7 in mysql_sql_stmt_execute (thd=0x7feca8000b00) at /data/src/10.4-travis/sql/sql_prepare.cc:3326

#17 0x00005563e3d9fbf1 in mysql_execute_command (thd=0x7feca8000b00) at /data/src/10.4-travis/sql/sql_parse.cc:3791

#18 0x00005563e3dad3bc in mysql_parse (thd=0x7feca8000b00, rawbuf=0x7feca8014db8 "EXECUTE stmt", length=12, parser_state=0x7fecba36c600, is_com_multi=false, is_next_command=false) at /data/src/10.4-travis/sql/sql_parse.cc:8103

#19 0x00005563e3d9a5e6 in dispatch_command (command=COM_QUERY, thd=0x7feca8000b00, packet=0x7feca800b421 "EXECUTE stmt", packet_length=12, is_com_multi=false, is_next_command=false) at /data/src/10.4-travis/sql/sql_parse.cc:1850

#20 0x00005563e3d9900a in do_command (thd=0x7feca8000b00) at /data/src/10.4-travis/sql/sql_parse.cc:1395

#21 0x00005563e3f04dd6 in do_handle_one_connection (connect=0x5563e7fbaf90) at /data/src/10.4-travis/sql/sql_connect.cc:1402

#22 0x00005563e3f04b5a in handle_one_connection (arg=0x5563e7fbaf90) at /data/src/10.4-travis/sql/sql_connect.cc:1308

#23 0x00005563e43bd890 in pfs_spawn_thread (arg=0x5563e7f1b080) at /data/src/10.4-travis/storage/perfschema/pfs.cc:1862

#24 0x00007fecc1c96494 in start_thread (arg=0x7fecba36d700) at pthread_create.c:333

#25 0x00007fecc029793f in clone () from /lib/x86_64-linux-gnu/libc.so.6