Server crashes in Bitmap<64u>::intersect

create table t1 (v1 varchar(1)) engine=myisam ;

create table t2 (v1 varchar(1)) engine=myisam ;

select 1 from t1 where exists 

	(select 1 from t1 where t1.v1 in (select t2.v1 from t2 having t2.v1 < 'j')) ;

#4  0x00000000006017c8 in Bitmap<64u>::intersect (this=0x8f8f8f8f8f8f8ff7, map2=...) at /git/10.0/sql/sql_bitmap.h:154

#5  0x0000000000896d93 in Item_field::update_table_bitmaps (this=0x7fde84d46c30) at /git/10.0/sql/item.h:2312

#6  0x0000000000896e4c in Item_field::update_used_tables (this=0x7fde84d46c30) at /git/10.0/sql/item.h:2326

#7  0x00000000008afe05 in Item_equal::update_used_tables (this=0x7fde84d478c0) at /git/10.0/sql/item_cmpfunc.cc:6444

#8  0x000000000064e379 in st_select_lex::update_used_tables (this=0x7fde84cf88b8) at /git/10.0/sql/sql_lex.cc:3934

#9  0x000000000064d663 in st_select_lex::optimize_unflattened_subqueries (this=0x7fde8d6540f8, const_only=false) at /git/10.0/sql/sql_lex.cc:3554

#10 0x00000000007dd596 in JOIN::optimize_unflattened_subqueries (this=0x7fde84f644a0) at /git/10.0/sql/opt_subselect.cc:5301

#11 0x00000000006958c5 in JOIN::optimize_inner (this=0x7fde84f644a0) at /git/10.0/sql/sql_select.cc:1953

#12 0x0000000000692432 in JOIN::optimize (this=0x7fde84f644a0) at /git/10.0/sql/sql_select.cc:1041

#13 0x000000000069a95e in mysql_select (thd=0x7fde8d650070, rref_pointer_array=0x7fde8d6543a0, tables=0x7fde84cf82c0, wild_num=0, fields=..., conds=0x7fde84f64238, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7fde84f64480, unit=0x7fde8d653a08, select_lex=0x7fde8d6540f8) at /git/10.0/sql/sql_select.cc:3334

#14 0x0000000000690374 in handle_select (thd=0x7fde8d650070, lex=0x7fde8d653940, result=0x7fde84f64480, setup_tables_done_option=0) at /git/10.0/sql/sql_select.cc:377

#15 0x0000000000660fb3 in execute_sqlcom_select (thd=0x7fde8d650070, all_tables=0x7fde84cf82c0) at /git/10.0/sql/sql_parse.cc:5308

#16 0x0000000000658f9e in mysql_execute_command (thd=0x7fde8d650070) at /git/10.0/sql/sql_parse.cc:2558

#17 0x0000000000664194 in mysql_parse (thd=0x7fde8d650070, rawbuf=0x7fde84cf8088 "select 1 from t1 where exists \n(select 1 from t1 where t1.v1 in (select t2.v1 from t2 having t2.v1 < 'j'))", length=106, parser_state=0x7fde9a6b7670) at /git/10.0/sql/sql_parse.cc:6644

#18 0x0000000000655ff8 in dispatch_command (command=COM_QUERY, thd=0x7fde8d650070, packet=0x7fde92973071 "select 1 from t1 where exists \n(select 1 from t1 where t1.v1 in (select t2.v1 from t2 having t2.v1 < 'j')) ", packet_length=107) at /git/10.0/sql/sql_parse.cc:1301

#19 0x000000000065525f in do_command (thd=0x7fde8d650070) at /git/10.0/sql/sql_parse.cc:1003

#20 0x000000000078ba38 in do_handle_one_connection (thd_arg=0x7fde8d650070) at /git/10.0/sql/sql_connect.cc:1377

#21 0x000000000078b786 in handle_one_connection (arg=0x7fde8d650070) at /git/10.0/sql/sql_connect.cc:1292

#22 0x0000000000e4ae4e in pfs_spawn_thread (arg=0x7fde8d3fa3f0) at /git/10.0/storage/perfschema/pfs.cc:1861

#23 0x00007fde998626ba in start_thread (arg=0x7fde9a6b8700) at pthread_create.c:333

#24 0x00007fde98f0d41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109