LP:794038 - Crash in setup_tables in maria-5.3-mwl106

Not repeatable in maria-5.2, maria-5.3. Repeatable in maria-5.3-mwl106. Backtrace:

#5 0x0830314c in setup_tables (thd=0xa104738, context=0xae61375c, from_clause=0xae6137ec, tables=0xae613ef0, leaves=..., select_insert=false,
full_table_list=false) at sql_base.cc:7798
#6 0x08303627 in setup_tables_and_check_access (thd=0xa104738, context=0xae61375c, from_clause=0xae6137ec, tables=0xae613ef0, leaves=...,
select_insert=false, want_access_first=1, want_access=1, full_table_list=false) at sql_base.cc:7917
#7 0x08316a22 in JOIN::prepare (this=0xae630030, rref_pointer_array=0xae613848, tables_init=0xae613ef0, wild_num=0, conds_init=0x0, og_num=0,
order_init=0x0, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0xae613728, unit_arg=0xae61344c) at sql_select.cc:520
#8 0x08468257 in st_select_lex_unit::prepare (this=0xae61344c, thd_arg=0xa104738, sel_result=0xae629018, additional_options=0) at sql_union.cc:316
#9 0x0846b084 in mysql_derived_prepare (thd=0xa104738, lex=0xa105df8, derived=0xae612f68) at sql_derived.cc:639
#10 0x0846a6cf in mysql_handle_single_derived (lex=0xa105df8, derived=0xae612f68, phases=2) at sql_derived.cc:171
#11 0x08314f7c in TABLE_LIST::handle_derived (this=0xae612f68, lex=0xa105df8, phases=2) at table.cc:5762
#12 0x0846a747 in mysql_handle_list_of_derived (lex=0xa105df8, table_list=0xae612f68, phases=2) at sql_derived.cc:202
#13 0x0834eb73 in mysql_prepare_insert (thd=0xa104738, table_list=0xae612f68, table=0x0, fields=..., values=0xae6131b0, update_fields=...,
update_values=..., duplic=DUP_ERROR, where=0xb6d4e6b0, select_insert=false, check_fields=true, abort_on_warning=false) at sql_insert.cc:1278
#14 0x0834d3de in mysql_insert (thd=0xa104738, table_list=0xae612f68, fields=..., values_list=..., update_fields=..., update_values=..., duplic=DUP_ERROR,
ignore=false) at sql_insert.cc:669
#15 0x082ab4e4 in mysql_execute_command (thd=0xa104738) at sql_parse.cc:3175
#16 0x082b419d in mysql_parse (thd=0xa104738, rawbuf=0xae612eb0 "INSERT INTO view3 SET field2 = 'i'", length=34, found_semicolon=0xb6d4f228)
at sql_parse.cc:6090
#17 0x082a657b in dispatch_command (command=COM_QUERY, thd=0xa104738, packet=0xa15eff9 "INSERT INTO view3 SET field2 = 'i' ", packet_length=35)
at sql_parse.cc:1206
#18 0x082a5a01 in do_command (thd=0xa104738) at sql_parse.cc:904
#19 0x082a2a7c in handle_one_connection (arg=0xa104738) at sql_connect.cc:1177
#20 0x00821919 in start_thread () from /lib/libpthread.so.0
#21 0x0076acce in clone () from /lib/libc.so.6

test case:

CREATE TABLE t1 (field1 integer);

--disable_abort_on_error

CREATE OR REPLACE ALGORITHM = MERGE VIEW view1 AS SELECT * FROM t1;
CREATE OR REPLACE ALGORITHM = TEMPTABLE VIEW view4 AS SELECT * FROM t1;
CREATE OR REPLACE ALGORITHM = MERGE VIEW view2 AS SELECT * FROM view4;
CREATE OR REPLACE ALGORITHM = TEMPTABLE VIEW view3 AS SELECT * FROM view1;
CREATE OR REPLACE ALGORITHM = MERGE VIEW view1 AS SELECT * FROM view2;
INSERT INTO view3 SET field2 = 'i' ;