Server crashes in TABLE::insert_portion_of_time upon DELETE FOR PORTION via trigger

--disable_abort_on_error

CREATE TABLE t1 (a INT);

CREATE TABLE t2 (b INT);

INSERT INTO t2 (b) VALUES (0);

CREATE TRIGGER tr AFTER INSERT ON t1 FOR EACH ROW DELETE FROM t2 FOR PORTION OF app FROM '2012-12-12' TO '2013-12-12' WHERE b < 2;

INSERT INTO t1 VALUES (1);

INSERT INTO t1 VALUES (2);

# Cleanup

DROP TABLE t1, t2;

#3  <signal handler called>

#4  0x0000560b94deca47 in TABLE::insert_portion_of_time (this=0x7fbd78138c80, thd=0x7fbd78000b00, period_conds=..., rows_inserted=0x7fbd8a923ff0) at /data/src/10.4/sql/table.cc:8404

#5  0x0000560b951d8319 in mysql_delete (thd=0x7fbd78000b00, table_list=0x7fbd7807f150, conds=0x7fbd7807fb40, order_list=0x7fbd780646c0, limit=18446744073709551615, options=0, result=0x0) at /data/src/10.4/sql/sql_delete.cc:839

#6  0x0000560b94cb6819 in mysql_execute_command (thd=0x7fbd78000b00) at /data/src/10.4/sql/sql_parse.cc:4723

#7  0x0000560b94bc5543 in sp_instr_stmt::exec_core (this=0x7fbd7807fd78, thd=0x7fbd78000b00, nextp=0x7fbd8a925844) at /data/src/10.4/sql/sp_head.cc:3607

#8  0x0000560b94bc487d in sp_lex_keeper::reset_lex_and_exec_core (this=0x7fbd7807fdc0, thd=0x7fbd78000b00, nextp=0x7fbd8a925844, open_tables=false, instr=0x7fbd7807fd78) at /data/src/10.4/sql/sp_head.cc:3335

#9  0x0000560b94bc50e8 in sp_instr_stmt::execute (this=0x7fbd7807fd78, thd=0x7fbd78000b00, nextp=0x7fbd8a925844) at /data/src/10.4/sql/sp_head.cc:3513

#10 0x0000560b94bbeb4f in sp_head::execute (this=0x7fbd7807e2b8, thd=0x7fbd78000b00, merge_da_on_success=false) at /data/src/10.4/sql/sp_head.cc:1346

#11 0x0000560b94bbfd23 in sp_head::execute_trigger (this=0x7fbd7807e2b8, thd=0x7fbd78000b00, db_name=0x7fbd7806b5e8, table_name=0x7fbd7806b5f8, grant_info=0x7fbd7807df00) at /data/src/10.4/sql/sp_head.cc:1755

#12 0x0000560b94db369a in Table_triggers_list::process_triggers (this=0x7fbd7807d9f8, thd=0x7fbd78000b00, event=TRG_EVENT_INSERT, time_type=TRG_ACTION_AFTER, old_row_is_record1=true) at /data/src/10.4/sql/sql_trigger.cc:2202

#13 0x0000560b94c6ac6d in write_record (thd=0x7fbd78000b00, table=0x7fbd7806d960, info=0x7fbd8a9264a0) at /data/src/10.4/sql/sql_insert.cc:2052

#14 0x0000560b94c67bb0 in mysql_insert (thd=0x7fbd78000b00, table_list=0x7fbd78013208, fields=..., values_list=..., update_fields=..., update_values=..., duplic=DUP_ERROR, ignore=false) at /data/src/10.4/sql/sql_insert.cc:1076

#15 0x0000560b94cb58cc in mysql_execute_command (thd=0x7fbd78000b00) at /data/src/10.4/sql/sql_parse.cc:4524

#16 0x0000560b94cc2057 in mysql_parse (thd=0x7fbd78000b00, rawbuf=0x7fbd78013128 "INSERT INTO t1 VALUES (2)", length=25, parser_state=0x7fbd8a927170, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:7912

#17 0x0000560b94cad2ea in dispatch_command (command=COM_QUERY, thd=0x7fbd78000b00, packet=0x7fbd78008331 "INSERT INTO t1 VALUES (2)", packet_length=25, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1841

#18 0x0000560b94cab977 in do_command (thd=0x7fbd78000b00) at /data/src/10.4/sql/sql_parse.cc:1359

#19 0x0000560b94e32df7 in do_handle_one_connection (connect=0x560b97449aa0) at /data/src/10.4/sql/sql_connect.cc:1412

#20 0x0000560b94e32b46 in handle_one_connection (arg=0x560b97449aa0) at /data/src/10.4/sql/sql_connect.cc:1316

#21 0x0000560b95831aa1 in pfs_spawn_thread (arg=0x560b974654f0) at /data/src/10.4/storage/perfschema/pfs.cc:1862

#22 0x00007fbd922ca4a4 in start_thread (arg=0x7fbd8a928700) at pthread_create.c:456

#23 0x00007fbd90812d0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97