SIGSEGV in base_list_iterator::next on PS execution after changing the derived_merge optimizer_switch

SET SESSION optimizer_switch="derived_merge=OFF";

CREATE TABLE t (c INT PRIMARY KEY) ENGINE=InnoDB;

PREPARE s FROM 'INSERT INTO t SELECT * FROM (SELECT * FROM t) AS a';

SET SESSION optimizer_switch="derived_merge=ON";

EXECUTE s;

Core was generated by `/test/MD211020-mariadb-10.6.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

[Current thread is 1 (Thread 0x1484800fc700 (LWP 3893065))]

(gdb) bt

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

#1  0x0000562b8c16c021 in my_write_core (sig=sig@entry=11) at /test/10.6_dbg/mysys/stacktrace.c:424

#2  0x0000562b8b8b3321 in handle_fatal_signal (sig=11) at /test/10.6_dbg/sql/signal_handler.cc:330

#3  <signal handler called>

#4  base_list_iterator::next (this=<synthetic pointer>) at /test/10.6_dbg/sql/sql_list.h:431

#5  List_iterator<Item>::operator++ (this=<synthetic pointer>) at /test/10.6_dbg/sql/sql_list.h:596

#6  TABLE_LIST::change_refs_to_fields (this=this@entry=0x14845002ccf8) at /test/10.6_dbg/sql/table.cc:9348

#7  0x0000562b8b5571f9 in find_dup_table (thd=thd@entry=0x148450000db8, table=table@entry=0x14845002ab30, table_list=table_list@entry=0x14845002bdc0, check_flag=check_flag@entry=0) at /test/10.6_dbg/sql/sql_base.cc:1159

#8  0x0000562b8b5573ce in unique_table (thd=0x148450000db8, table=0x14845002ab30, table_list=0x14845002bdc0, check_flag=check_flag@entry=0) at /test/10.6_dbg/sql/sql_base.cc:1222

#9  0x0000562b8b59fb82 in select_insert::prepare (this=0x148450012ec8, values=<optimized out>, u=<optimized out>) at /test/10.6_dbg/sql/sql_insert.cc:3904

#10 0x0000562b8b658901 in JOIN::prepare (this=this@entry=0x148450012f80, tables_init=tables_init@entry=0x14845002ccf8, conds_init=conds_init@entry=0x0, og_num=og_num@entry=0, order_init=order_init@entry=0x0, skip_order_by=skip_order_by@entry=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x14845002b208, unit_arg=0x148450028f60) at /test/10.6_dbg/sql/my_json_writer.h:367

#11 0x0000562b8b670880 in mysql_select (thd=thd@entry=0x148450000db8, tables=0x14845002ccf8, fields=@0x14845002b358: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14845002b7b8, last = 0x14845002b7b8, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2202244745984, result=0x148450012ec8, unit=0x148450028f60, select_lex=0x14845002b208) at /test/10.6_dbg/sql/sql_select.cc:4637

#12 0x0000562b8b670c72 in handle_select (thd=thd@entry=0x148450000db8, lex=lex@entry=0x148450028e98, result=result@entry=0x148450012ec8, setup_tables_done_option=setup_tables_done_option@entry=1073741824) at /test/10.6_dbg/sql/sql_select.cc:417

#13 0x0000562b8b5f2bf1 in mysql_execute_command (thd=0x148450000db8) at /test/10.6_dbg/sql/sql_parse.cc:4544

#14 0x0000562b8b60a4b4 in Prepared_statement::execute (this=this@entry=0x148450023f48, expanded_query=expanded_query@entry=0x1484800fad30, open_cursor=open_cursor@entry=false) at /test/10.6_dbg/sql/sql_prepare.cc:4736

#15 0x0000562b8b60a801 in Prepared_statement::execute_loop (this=this@entry=0x148450023f48, expanded_query=expanded_query@entry=0x1484800fad30, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/10.6_dbg/sql/sql_prepare.cc:4225

#16 0x0000562b8b60ad39 in mysql_sql_stmt_execute (thd=thd@entry=0x148450000db8) at /test/10.6_dbg/sql/sql_prepare.cc:3336

#17 0x0000562b8b5f0b4a in mysql_execute_command (thd=thd@entry=0x148450000db8) at /test/10.6_dbg/sql/sql_parse.cc:3800

#18 0x0000562b8b5dcfd2 in mysql_parse (thd=thd@entry=0x148450000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1484800fb3d0) at /test/10.6_dbg/sql/sql_parse.cc:7833

#19 0x0000562b8b5eb0c7 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x148450000db8, packet=packet@entry=0x148450008ce9 "EXECUTE s", packet_length=packet_length@entry=9) at /test/10.6_dbg/sql/sql_class.h:1253

#20 0x0000562b8b5ee3d2 in do_command (thd=0x148450000db8) at /test/10.6_dbg/sql/sql_parse.cc:1343

#21 0x0000562b8b748994 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x562b8f20b678, put_in_cache=put_in_cache@entry=true) at /test/10.6_dbg/sql/sql_connect.cc:1410

#22 0x0000562b8b74909b in handle_one_connection (arg=arg@entry=0x562b8f20b678) at /test/10.6_dbg/sql/sql_connect.cc:1312

#23 0x0000562b8bbfcabb in pfs_spawn_thread (arg=0x562b8f1331c8) at /test/10.6_dbg/storage/perfschema/pfs.cc:2201

#24 0x0000148494eb5609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#25 0x0000148494aa4293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Core was generated by `/test/MD201020-mariadb-10.6.0-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

[Current thread is 1 (Thread 0x1455ec546700 (LWP 3898211))]

(gdb) bt

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

#1  0x0000564adbe92a4f in my_write_core (sig=sig@entry=11) at /test/10.6_opt/mysys/stacktrace.c:424

#2  0x0000564adb8b6130 in handle_fatal_signal (sig=11) at /test/10.6_opt/sql/signal_handler.cc:330

#3  <signal handler called>

#4  base_list_iterator::next (this=<synthetic pointer>) at /test/10.6_opt/sql/sql_list.h:431

#5  List_iterator<Item>::operator++ (this=<synthetic pointer>) at /test/10.6_opt/sql/sql_list.h:596

#6  TABLE_LIST::change_refs_to_fields (this=this@entry=0x14557c027178) at /test/10.6_opt/sql/table.cc:9348

#7  0x0000564adb63c7a3 in find_dup_table (table=0x14557c024fb0, table_list=0x14557c026240, check_flag=check_flag@entry=0, thd=<optimized out>) at /test/10.6_opt/sql/sql_base.cc:1159

#8  0x0000564adb63c8c4 in unique_table (thd=<optimized out>, table=<optimized out>, table_list=<optimized out>, check_flag=check_flag@entry=0) at /test/10.6_opt/sql/sql_base.cc:1222

#9  0x0000564adb66e5f6 in select_insert::prepare (this=0x14557c010bf8, values=<optimized out>, u=<optimized out>) at /test/10.6_opt/sql/sql_insert.cc:3904

#10 0x0000564adb7008b0 in JOIN::prepare (this=0x14557c010cb0, tables_init=<optimized out>, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=<optimized out>, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x14557c025688, unit_arg=0x14557c0233e0) at /test/10.6_opt/sql/sql_select.cc:1445

#11 0x0000564adb7129c9 in mysql_select (thd=0x14557c000c58, tables=0x14557c027178, fields=@0x14557c0257d8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14557c025c38, last = 0x14557c025c38, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2202244745984, result=0x14557c010bf8, unit=0x14557c0233e0, select_lex=0x14557c025688) at /test/10.6_opt/sql/sql_select.cc:4637

#12 0x0000564adb712d67 in handle_select (thd=thd@entry=0x14557c000c58, lex=lex@entry=0x14557c023318, result=result@entry=0x14557c010bf8, setup_tables_done_option=setup_tables_done_option@entry=1073741824) at /test/10.6_opt/sql/sql_select.cc:417

#13 0x0000564adb6b11c2 in mysql_execute_command (thd=0x14557c000c58) at /test/10.6_opt/sql/sql_parse.cc:4544

#14 0x0000564adb6c1955 in Prepared_statement::execute (this=0x14557c01e378, expanded_query=<optimized out>, open_cursor=false) at /test/10.6_opt/sql/sql_prepare.cc:4736

#15 0x0000564adb6c1b29 in Prepared_statement::execute_loop (packet=<optimized out>, packet_end=<optimized out>, open_cursor=<optimized out>, expanded_query=0x1455ec544e00, this=0x14557c01e378) at /test/10.6_opt/sql/sql_prepare.cc:4225

#16 Prepared_statement::execute_loop (this=0x14557c01e378, expanded_query=0x1455ec544e00, open_cursor=<optimized out>, packet=<optimized out>, packet_end=<optimized out>) at /test/10.6_opt/sql/sql_prepare.cc:4180

#17 0x0000564adb6c1e33 in mysql_sql_stmt_execute (thd=thd@entry=0x14557c000c58) at /test/10.6_opt/sql/sql_prepare.cc:3336

#18 0x0000564adb6af08e in mysql_execute_command (thd=0x14557c000c58) at /test/10.6_opt/sql/sql_parse.cc:3800

#19 0x0000564adb69d03f in mysql_parse (thd=0x14557c000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.6_opt/sql/sql_parse.cc:7833

#20 0x0000564adb6a8967 in dispatch_command (command=COM_QUERY, thd=0x14557c000c58, packet=0x14557c008009 "EXECUTE s", packet_length=<optimized out>) at /test/10.6_opt/sql/sql_class.h:1253

#21 0x0000564adb6aad42 in do_command (thd=0x14557c000c58) at /test/10.6_opt/sql/sql_parse.cc:1343

#22 0x0000564adb7ae6e1 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x564ade2428c8, put_in_cache=put_in_cache@entry=true) at /test/10.6_opt/sql/sql_connect.cc:1410

#23 0x0000564adb7aeb5d in handle_one_connection (arg=arg@entry=0x564ade2428c8) at /test/10.6_opt/sql/sql_connect.cc:1312

#24 0x0000564adbb34266 in pfs_spawn_thread (arg=0x564ade1bd888) at /test/10.6_opt/storage/perfschema/pfs.cc:2201

#25 0x00001455ede82609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#26 0x00001455eda71293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95