Server crashes in Item_field::used_tables upon 2nd execution of SP with UPDATE on app-versioned table

CREATE TABLE t1 (a INT, s DATE, e DATE, PERIOD FOR app(s,e));

CREATE  PROCEDURE pr() UPDATE t1 FOR PORTION OF unknown_period FROM '2012-01-01' TO unknown_field SET a = 1 WHERE a = 2;

--error ER_PERIOD_NOT_FOUND

CALL pr;

--error ER_PERIOD_NOT_FOUND

CALL pr;

# Cleanup

DROP PROCEDURE pr;

DROP TABLE t1;

#3  <signal handler called>

#4  0x000055a1fea2ab83 in Item_field::used_tables (this=0x7fa84412cb50) at /data/src/10.4/sql/item.cc:3324

#5  0x000055a1fe57d361 in Item::const_item (this=0x7fa84412cb50) at /data/src/10.4/sql/item.h:1624

#6  0x000055a1fe7b15d6 in mysql_update (thd=0x7fa844000b00, table_list=0x7fa84412cc68, fields=..., values=..., conds=0x7fa84412d6a8, order_num=0, order=0x0, limit=18446744073709551615, ignore=false, found_return=0x7fa8545c38e0, updated_return=0x7fa8545c39a0) at /data/src/10.4/sql/sql_update.cc:453

#7  0x000055a1fe6a37fb in mysql_execute_command (thd=0x7fa844000b00) at /data/src/10.4/sql/sql_parse.cc:4377

#8  0x000055a1fe5b197f in sp_instr_stmt::exec_core (this=0x7fa84412d8e8, thd=0x7fa844000b00, nextp=0x7fa8545c46b4) at /data/src/10.4/sql/sp_head.cc:3607

#9  0x000055a1fe5b0c96 in sp_lex_keeper::reset_lex_and_exec_core (this=0x7fa84412d930, thd=0x7fa844000b00, nextp=0x7fa8545c46b4, open_tables=false, instr=0x7fa84412d8e8) at /data/src/10.4/sql/sp_head.cc:3335

#10 0x000055a1fe5b1524 in sp_instr_stmt::execute (this=0x7fa84412d8e8, thd=0x7fa844000b00, nextp=0x7fa8545c46b4) at /data/src/10.4/sql/sp_head.cc:3513

#11 0x000055a1fe5aaf00 in sp_head::execute (this=0x7fa84412bbc8, thd=0x7fa844000b00, merge_da_on_success=true) at /data/src/10.4/sql/sp_head.cc:1346

#12 0x000055a1fe5ad9b9 in sp_head::execute_procedure (this=0x7fa84412bbc8, thd=0x7fa844000b00, args=0x7fa8440058e8) at /data/src/10.4/sql/sp_head.cc:2288

#13 0x000055a1fe69effc in do_execute_sp (thd=0x7fa844000b00, sp=0x7fa84412bbc8) at /data/src/10.4/sql/sql_parse.cc:3019

#14 0x000055a1fe69fd32 in Sql_cmd_call::execute (this=0x7fa8440131c0, thd=0x7fa844000b00) at /data/src/10.4/sql/sql_parse.cc:3261

#15 0x000055a1fe6ab1a3 in mysql_execute_command (thd=0x7fa844000b00) at /data/src/10.4/sql/sql_parse.cc:6099

#16 0x000055a1fe6b08ec in mysql_parse (thd=0x7fa844000b00, rawbuf=0x7fa844013118 "CALL pr", length=7, parser_state=0x7fa8545c6170, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:7909

#17 0x000055a1fe69b8ec in dispatch_command (command=COM_QUERY, thd=0x7fa844000b00, packet=0x7fa844008321 "CALL pr", packet_length=7, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1843

#18 0x000055a1fe699f36 in do_command (thd=0x7fa844000b00) at /data/src/10.4/sql/sql_parse.cc:1360

#19 0x000055a1fe823c47 in do_handle_one_connection (connect=0x55a20251bf00) at /data/src/10.4/sql/sql_connect.cc:1412

#20 0x000055a1fe823996 in handle_one_connection (arg=0x55a20251bf00) at /data/src/10.4/sql/sql_connect.cc:1316

#21 0x000055a1ff259da3 in pfs_spawn_thread (arg=0x55a202551310) at /data/src/10.4/storage/perfschema/pfs.cc:1862

#22 0x00007fa85bf694a4 in start_thread (arg=0x7fa8545c7700) at pthread_create.c:456

#23 0x00007fa85a4b1d0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97