Server crashes in st_select_lex_unit::optimize

create table t1 (f1 int , f2 int, f3 int, f4 int) engine=Innodb;

insert into t1 values (1,1,1,1),(2,2,2,2);

create view v1 as (select * from t1) union (select * from t1);

create view v2 as select f1, f2, f3, f4 from 

  (select t1.f1, v1.f2, t1.f3, t1.f4 from v1 join t1 on v1.f3 = t1.f1 where 1=0) dt;

replace into t1 (f1, f2, f3, f4) select v2.f1, v1.f2, v1.f3, v2.f4 

    from v1 join v2 on v1.f2 = v2.f2 ;

#3  <signal handler called>

#4  0x000055ce4e1b3868 in st_select_lex_unit::optimize (this=0x7f663406eda8) at /10.4/sql/sql_union.cc:1366

#5  0x000055ce4e05ab04 in mysql_derived_optimize (thd=0x7f6634000a98, lex=0x7f6634004908, derived=0x7f663406a4d0) at /10.4/sql/sql_derived.cc:956

#6  0x000055ce4e0588ac in mysql_handle_single_derived (lex=0x7f6634004908, derived=0x7f663406a4d0, phases=4) at /10.4/sql/sql_derived.cc:203

#7  0x000055ce4e1e3324 in TABLE_LIST::handle_derived (this=0x7f663406a4d0, lex=0x7f6634004908, phases=4) at /10.4/sql/table.cc:8647

#8  0x000055ce4e0728da in LEX::handle_list_of_derived (this=0x7f6634004908, table_list=0x7f663406a4d0, phases=4) at /10.4/sql/sql_lex.h:4337

#9  0x000055ce4e07ee78 in st_select_lex::handle_derived (this=0x7f6634061a50, lex=0x7f6634004908, phases=4) at /10.4/sql/sql_lex.cc:4209

#10 0x000055ce4e1e32ea in TABLE_LIST::handle_derived (this=0x7f663406d1d0, lex=0x7f6634004908, phases=4) at /10.4/sql/table.cc:8644

#11 0x000055ce4e0728da in LEX::handle_list_of_derived (this=0x7f6634004908, table_list=0x7f663406d1d0, phases=4) at /10.4/sql/sql_lex.h:4337

#12 0x000055ce4e07ee78 in st_select_lex::handle_derived (this=0x7f6634060ac0, lex=0x7f6634004908, phases=4) at /10.4/sql/sql_lex.cc:4209

#13 0x000055ce4e1e32ea in TABLE_LIST::handle_derived (this=0x7f6634057ff0, lex=0x7f6634004908, phases=4) at /10.4/sql/table.cc:8644

#14 0x000055ce4e0728da in LEX::handle_list_of_derived (this=0x7f6634004908, table_list=0x7f663405a170, phases=4) at /10.4/sql/sql_lex.h:4337

#15 0x000055ce4e07ee78 in st_select_lex::handle_derived (this=0x7f663408dcb0, lex=0x7f6634004908, phases=4) at /10.4/sql/sql_lex.cc:4209

#16 0x000055ce4e0fa1eb in JOIN::optimize_stage2 (this=0x7f66341a9db0) at /10.4/sql/sql_select.cc:2227

#17 0x000055ce4e0f9fc8 in JOIN::optimize_inner (this=0x7f66341a9db0) at /10.4/sql/sql_select.cc:2200

#18 0x000055ce4e0f79d6 in JOIN::optimize (this=0x7f66341a9db0) at /10.4/sql/sql_select.cc:1551

#19 0x000055ce4e1029fe in mysql_select (thd=0x7f6634000a98, tables=0x7f663405a170, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=3489925888, result=0x7f66341a9cd0, unit=0x7f66340049d0, select_lex=0x7f663408dcb0) at /10.4/sql/sql_select.cc:4571

#20 0x000055ce4e0f2ede in handle_select (thd=0x7f6634000a98, lex=0x7f6634004908, result=0x7f66341a9cd0, setup_tables_done_option=1073741824) at /10.4/sql/sql_select.cc:424

#21 0x000055ce4e0b3d42 in mysql_execute_command (thd=0x7f6634000a98) at /10.4/sql/sql_parse.cc:4896

#22 0x000055ce4e0bf61c in mysql_parse (thd=0x7f6634000a98, rawbuf=0x7f6634059cc0 "replace into t1 (f1, f2, f3, f4) select v2.f1, v1.f2, v1.f3, v2.f4 \nfrom v1 join v2 on v1.f2 = v2.f2", length=100, parser_state=0x7f668152cff0, is_com_multi=false, is_next_command=false) at /10.4/sql/sql_parse.cc:8154

#23 0x000055ce4e0aa8ec in dispatch_command (command=COM_QUERY, thd=0x7f6634000a98, packet=0x7f6634009da9 "replace into t1 (f1, f2, f3, f4) select v2.f1, v1.f2, v1.f3, v2.f4 \nfrom v1 join v2 on v1.f2 = v2.f2 ", packet_length=101, is_com_multi=false, is_next_command=false) at /10.4/sql/sql_parse.cc:1832

#24 0x000055ce4e0a9080 in do_command (thd=0x7f6634000a98) at /10.4/sql/sql_parse.cc:1365

#25 0x000055ce4e228f1b in do_handle_one_connection (connect=0x55ce525e4938) at /10.4/sql/sql_connect.cc:1398

#26 0x000055ce4e228c59 in handle_one_connection (arg=0x55ce525e4938) at /10.4/sql/sql_connect.cc:1301

#27 0x000055ce4ebb7227 in pfs_spawn_thread (arg=0x55ce525991c8) at /10.4/storage/perfschema/pfs.cc:1862

#28 0x00007f6689e4d6ba in start_thread (arg=0x7f668152e700) at pthread_create.c:333

#29 0x00007f66890de41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109