Server crashes in embedding_sjm

--source include/have_innodb.inc

CREATE TABLE t1 (i2 int, v1 varchar(1))engine=innodb;

CREATE TABLE t2 (i2 int)engine=innodb;

SELECT dtb.v1 

FROM (SELECT t1.* FROM (t1 JOIN t2 ON (t2.i2 = t1.i2))) dtb

HAVING dtb.v1 != 112 AND dtb.v1 = 'x' AND dtb.v1 != 'a';

==23519==ERROR: AddressSanitizer: SEGV on unknown address 0x000834b434be (pc 0x560908eb98b3 bp 0x7f3488b13d40 sp 0x7f3488b13d20 T27)

    #0 0x560908eb98b2 in embedding_sjm /10.4/sql/sql_select.cc:15070

    #1 0x560908eba1da in eliminate_item_equal(THD*, Item*, COND_EQUAL*, Item_equal*) /10.4/sql/sql_select.cc:15186

    #2 0x560908ebb1f6 in substitute_for_best_equal_field /10.4/sql/sql_select.cc:15429

    #3 0x560908e5ec23 in JOIN::optimize_stage2() /10.4/sql/sql_select.cc:2280

    #4 0x560908e5d5b7 in JOIN::optimize_inner() /10.4/sql/sql_select.cc:2147

    #5 0x560908e57562 in JOIN::optimize() /10.4/sql/sql_select.cc:1508

    #6 0x560908e74570 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.4/sql/sql_select.cc:4518

    #7 0x560908e4c647 in handle_select(THD*, LEX*, select_result*, unsigned long) /10.4/sql/sql_select.cc:423

    #8 0x560908dd1221 in execute_sqlcom_select /10.4/sql/sql_parse.cc:6588

    #9 0x560908dbdfd3 in mysql_execute_command(THD*) /10.4/sql/sql_parse.cc:3825

    #10 0x560908dd96fe in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/sql/sql_parse.cc:8141

    #11 0x560908db2290 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/sql/sql_parse.cc:1820

    #12 0x560908daf2b2 in do_command(THD*) /10.4/sql/sql_parse.cc:1358

    #13 0x5609091196f7 in do_handle_one_connection(CONNECT*) /10.4/sql/sql_connect.cc:1399

    #14 0x5609091190c1 in handle_one_connection /10.4/sql/sql_connect.cc:1302

    #15 0x56090a4ce92c in pfs_spawn_thread /10.4/storage/perfschema/pfs.cc:1862

    #16 0x7f34a02906b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

    #17 0x7f349f52141c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)