LP:611704 - Crash in replace_where_subcondition with nested subquery and semijoin=on

The following query crashes maria 5.3 when executed as a prepared statement or a stored procedure:

SELECT `col_varchar_key`
FROM (
SELECT SUBQUERY1_t1 .*
FROM BB SUBQUERY1_t1 STRAIGHT_JOIN ( CC SUBQUERY1_t2 JOIN C ON SUBQUERY1_t2 .`col_varchar_key` ) ON SUBQUERY1_t2 .`col_varchar_key` AND ( 's' , 'r' ) IN (
SELECT CHILD_SUBQUERY1_t1 .`col_varchar_nokey` , CHILD_SUBQUERY1_t2 .`col_varchar_nokey`
FROM C CHILD_SUBQUERY1_t1 JOIN C CHILD_SUBQUERY1_t2 ON CHILD_SUBQUERY1_t1 .`col_int_nokey` ) ) table3 ;

backtrace:

#3 0x0827e9e0 in handle_segfault (sig=11) at mysqld.cc:2703
#4 <signal handler called>
#5 0x083b541b in replace_where_subcondition (join=0xb5d93ee0, expr=0xb5d72ddc, old_cond=0xb5d74320, new_cond=0xb5d8d070, do_fix_fields=false)
at opt_subselect.cc:550
#6 0x083b5303 in convert_join_subqueries_to_semijoins (join=0xb5d93ee0) at opt_subselect.cc:508
#7 0x082fd3de in JOIN::optimize (this=0xb5d93ee0) at sql_select.cc:740
#8 0x08303865 in mysql_select (thd=0xa8b0fd0, rref_pointer_array=0xb5d71e74, tables=0xb5d722e8, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0,
group=0x0, having=0x0, proc_param=0x0, select_options=2416201216, result=0xb5d92150, unit=0xb5d71f10, select_lex=0xb5d71d70) at sql_select.cc:2542
#9 0x08447f45 in mysql_derived_filling (thd=0xa8b0fd0, lex=0xb5d710f8, orig_table_list=0xb5d8c170) at sql_derived.cc:295
#10 0x08447837 in mysql_handle_derived (lex=0xb5d710f8, processor=0x8447d60 <mysql_derived_filling(THD*, LEX*, TABLE_LIST*)>) at sql_derived.cc:56
#11 0x082e4918 in open_and_lock_tables_derived (thd=0xa8b0fd0, tables=0xb5d8c170, derived=true) at sql_base.cc:5067
#12 0x082a0d0f in open_and_lock_tables (thd=0xa8b0fd0, tables=0xb5d8c170) at mysql_priv.h:1648
#13 0x0829a4b1 in execute_sqlcom_select (thd=0xa8b0fd0, all_tables=0xb5d8c170) at sql_parse.cc:5046
#14 0x082910b8 in mysql_execute_command (thd=0xa8b0fd0) at sql_parse.cc:2265
#15 0x084623f1 in sp_instr_stmt::exec_core (this=0xb5d8c370, thd=0xa8b0fd0, nextp=0xb609f2f8) at sp_head.cc:2927
#16 0x08461d5d in sp_lex_keeper::reset_lex_and_exec_core (this=0xb5d8c398, thd=0xa8b0fd0, nextp=0xb609f2f8, open_tables=false, instr=0xb5d8c370)
at sp_head.cc:2748
#17 0x084621ca in sp_instr_stmt::execute (this=0xb5d8c370, thd=0xa8b0fd0, nextp=0xb609f2f8) at sp_head.cc:2870
#18 0x0845e4ce in sp_head::execute (this=0xb5d707f0, thd=0xa8b0fd0) at sp_head.cc:1249
#19 0x08460117 in sp_head::execute_procedure (this=0xb5d707f0, thd=0xa8b0fd0, args=0xa8b2c04) at sp_head.cc:1983
#20 0x0829818d in mysql_execute_command (thd=0xa8b0fd0) at sql_parse.cc:4419
#21 0x0829c8b9 in mysql_parse (thd=0xa8b0fd0, inBuf=0xb5d31900 "CALL stored_proc_23161()", length=24, found_semicolon=0xb60a0230) at sql_parse.cc:6027
#22 0x0828eaea in dispatch_command (command=COM_QUERY, thd=0xa8b0fd0, packet=0xa8c9329 "CALL stored_proc_23161()", packet_length=24) at sql_parse.cc:1184
#23 0x0828df90 in do_command (thd=0xa8b0fd0) at sql_parse.cc:890
#24 0x0828b0f0 in handle_one_connection (arg=0xa8b0fd0) at sql_connect.cc:1153
#25 0x00a08919 in start_thread () from /lib/libpthread.so.0
#26 0x00951e5e in clone () from /lib/libc.so.6

EXPLAIN:

1 PRIMARY <derived2> system NULL NULL NULL NULL 0 const row not found
2 DERIVED NULL NULL NULL NULL NULL NULL NULL no matching row in const table
3 DEPENDENT SUBQUERY NULL NULL NULL NULL NULL NULL NULL Impossible WHERE noticed after reading const tables