Crash with order by expression containing window functions

create table t1 (i int);

insert into t1 values (1),(2),(3);

CREATE TABLE t2 ( id int) ;

INSERT INTO t2 values (1),(2),(3);

SELECT * FROM t1 WHERE (i) IN (SELECT 1 FROM t2 ORDER BY benchmark(1, sum(id) over ()));

CREATE TABLE t2 ( id int) ;

INSERT INTO t2 values (1),(2),(3);

CREATE TABLE t1 (b1 BIT, b2 BIT, b3 BIT, b4 BIT , b5 BIT, b6 BIT);

INSERT INTO t1 VALUES (1,0,0,1,0,1),(0,1,0,0,1,0);

SELECT * FROM t2 WHERE (id) IN  

(SELECT b1 from t1 order by row_number() over (ORDER BY b6) + 1);

# Cleanup

DROP TABLE t1,t2;

201209  9:49:55 [ERROR] mysqld got signal 11 ;

Server version: 10.2.37-MariaDB-debug-log

sql/field.h:1151(Field::set_notnull(long long))[0x556b282b2243]

sql/item.cc:6415(Item::save_in_field(Field*, bool))[0x556b28b8992c]

sql/sql_window.cc:2534(save_window_function_values(List<Item_window_func>&, TABLE*, unsigned char*))[0x556b2898b5cf]

sql/sql_window.cc:2681(compute_window_func(THD*, List<Item_window_func>&, List<Cursor_manager>&, TABLE*, SORT_INFO*))[0x556b2898c002]

sql/sql_window.cc:2782(Window_func_runner::exec(THD*, TABLE*, SORT_INFO*))[0x556b2898c645]

sql/sql_window.cc:2810(Window_funcs_sort::exec(JOIN*, bool))[0x556b2898c896]

sql/sql_window.cc:2937(Window_funcs_computation::exec(JOIN*, bool))[0x556b2898d555]

sql/sql_select.cc:26853(AGGR_OP::end_send())[0x556b28628f6b]

sql/sql_select.cc:18577(sub_select_postjoin_aggr(JOIN*, st_join_table*, bool))[0x556b285ea1e4]

sql/sql_select.cc:18813(sub_select(JOIN*, st_join_table*, bool))[0x556b285ead8a]

sql/sql_select.cc:18408(do_select(JOIN*, Procedure*))[0x556b285e9264]

sql/sql_select.cc:3641(JOIN::exec_inner())[0x556b2858023a]

sql/sql_select.cc:3437(JOIN::exec())[0x556b2857ddac]

sql/opt_subselect.cc:5405(join_tab_execution_startup(st_join_table*))[0x556b2893f100]

sql/sql_select.cc:18851(sub_select(JOIN*, st_join_table*, bool))[0x556b285eb2db]

sql/sql_select.cc:19082(evaluate_join_record(JOIN*, st_join_table*, int))[0x556b285ece6f]

sql/sql_select.cc:18862(sub_select(JOIN*, st_join_table*, bool))[0x556b285eb660]

sql/sql_select.cc:18406(do_select(JOIN*, Procedure*))[0x556b285e9173]

sql/sql_select.cc:3641(JOIN::exec_inner())[0x556b2858023a]

sql/sql_select.cc:3437(JOIN::exec())[0x556b2857ddac]

sql/sql_select.cc:3838(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x556b2858140c]

sql/sql_select.cc:361(handle_select(THD*, LEX*, select_result*, unsigned long))[0x556b2855df80]

sql/sql_parse.cc:6247(execute_sqlcom_select(THD*, TABLE_LIST*))[0x556b284d2057]

sql/sql_parse.cc:3558(mysql_execute_command(THD*))[0x556b284bd3f1]

sql/sql_parse.cc:7762(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x556b284db3a6]

sql/sql_parse.cc:1830(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x556b284b21f2]

sql/sql_parse.cc:1381(do_command(THD*))[0x556b284aec17]

sql/sql_connect.cc:1336(do_handle_one_connection(CONNECT*))[0x556b288560e3]

sql/sql_connect.cc:1242(handle_one_connection)[0x556b288559a4]

perfschema/pfs.cc:1871(pfs_spawn_thread)[0x556b29cee012]

nptl/pthread_create.c:487(start_thread)[0x7f041ba1cfa3]

x86_64/clone.S:97(clone)[0x7f041b3a04cf]

Query (0x62b000000290): SELECT * FROM t1 WHERE (i) IN (SELECT 1 FROM t2 ORDER BY benchmark(1, sum(id) over ()))