The test case for bug mdev-16765 crashes the server in the tree bb-10.4-mdev7486

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x00007f925199a0d1 in pthread_kill () from /lib64/libpthread.so.0

[Current thread is 1 (Thread 0x7f92499e4700 (LWP 1328))]

#0  0x00007f925199a0d1 in pthread_kill () from /lib64/libpthread.so.0

#1  0x000055b29a9ab508 in my_write_core (sig=11) at /home/igor/maria-git/10.4-mdev7486-test/mysys/stacktrace.c:481

#2  0x000055b29a1e34fd in handle_fatal_signal (sig=11) at /home/igor/maria-git/10.4-mdev7486-test/sql/signal_handler.cc:305

#3  <signal handler called>

#4  0x000055b29a9b7d85 in sf_malloc_usable_size (ptr=0x8f8f8f8f8f8f8f8f, is_thread_specific=0x7f92499e16b7 "") at /home/igor/maria-git/10.4-mdev7486-test/mysys/safemalloc.c:215

#5  0x000055b29a9a5a7e in my_free (ptr=0x8f8f8f8f8f8f8f8f) at /home/igor/maria-git/10.4-mdev7486-test/mysys/my_malloc.c:212

#6  0x000055b299d7aee3 in Binary_string::free (this=0x7f923826e9d0) at /home/igor/maria-git/10.4-mdev7486-test/sql/sql_string.h:604

#7  0x000055b299d7ae4e in Binary_string::~Binary_string (this=0x7f923826e9d0, __in_chrg=<optimized out>) at /home/igor/maria-git/10.4-mdev7486-test/sql/sql_string.h:415

#8  0x000055b299d7afe8 in String::~String (this=0x7f923826e9c8, __in_chrg=<optimized out>) at /home/igor/maria-git/10.4-mdev7486-test/sql/sql_string.h:721

#9  0x000055b29a23ff8e in Arg_comparator::~Arg_comparator (this=0x7f923826e878, __in_chrg=<optimized out>) at /home/igor/maria-git/10.4-mdev7486-test/sql/item_cmpfunc.h:47

#10 0x000055b29a2d7832 in Item_sum_hybrid::cleanup (this=0x7f9238271ca0) at /home/igor/maria-git/10.4-mdev7486-test/sql/item_sum.cc:2398

#11 0x000055b29a1ffcc0 in Item::cleanup_processor (this=0x7f9238271ca0, arg=0x0) at /home/igor/maria-git/10.4-mdev7486-test/sql/item.cc:497

#12 0x000055b299d8c47a in Item::cleanup_excluding_const_fields_processor (this=0x7f9238271ca0, arg=0x0) at /home/igor/maria-git/10.4-mdev7486-test/sql/item.h:1821

#13 0x000055b299e17b91 in Item_func_or_sum::walk (this=0x7f9238271ca0, processor=&virtual table offset 816, walk_subquery=false, arg=0x0) at /home/igor/maria-git/10.4-mdev7486-test/sql/item.h:5097

#14 0x000055b299e174cb in Item_args::walk_args (this=0x7f9238271ae8, processor=&virtual table offset 816, walk_subquery=false, arg=0x0) at /home/igor/maria-git/10.4-mdev7486-test/sql/item.h:2477

#15 0x000055b299e17b41 in Item_func_or_sum::walk (this=0x7f9238271a60, processor=&virtual table offset 816, walk_subquery=false, arg=0x0) at /home/igor/maria-git/10.4-mdev7486-test/sql/item.h:5095

#16 0x000055b29a237e60 in Item_cond::walk (this=0x7f9238271428, processor=&virtual table offset 816, walk_subquery=false, arg=0x0) at /home/igor/maria-git/10.4-mdev7486-test/sql/item_cmpfunc.cc:4969

#17 0x000055b299e174cb in Item_args::walk_args (this=0x7f9238271398, processor=&virtual table offset 816, walk_subquery=false, arg=0x0) at /home/igor/maria-git/10.4-mdev7486-test/sql/item.h:2477

#18 0x000055b299e17b41 in Item_func_or_sum::walk (this=0x7f9238271310, processor=&virtual table offset 816, walk_subquery=false, arg=0x0) at /home/igor/maria-git/10.4-mdev7486-test/sql/item.h:5095

#19 0x000055b299e174cb in Item_args::walk_args (this=0x7f9238271158, processor=&virtual table offset 816, walk_subquery=false, arg=0x0) at /home/igor/maria-git/10.4-mdev7486-test/sql/item.h:2477

#20 0x000055b299e17b41 in Item_func_or_sum::walk (this=0x7f92382710d0, processor=&virtual table offset 816, walk_subquery=false, arg=0x0) at /home/igor/maria-git/10.4-mdev7486-test/sql/item.h:5095

#21 0x000055b299e86914 in cleanup_inequalities_for_having_pushdown (thd=0x7f9238000b00, cond=0x7f92382710d0) at /home/igor/maria-git/10.4-mdev7486-test/sql/sql_lex.cc:9973

#22 0x000055b299e86e0f in st_select_lex::pushdown_from_having_into_where (this=0x7f9238016ac8, thd=0x7f9238000b00, having=0x0) at /home/igor/