SIGSEGV in heap_info from make_join_statistics on 2nd SP exec

CREATE PROCEDURE p() SELECT * FROM (SELECT 1 FROM mysql.user) AS a;

SET SESSION optimizer_switch="derived_merge=OFF";

CALL p();

SET SESSION optimizer_switch="derived_merge=ON";

CALL p();

Core was generated by `/test/MD150920-mariadb-10.5.6-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57

[Current thread is 1 (Thread 0x145659369700 (LWP 29735))]

(gdb) bt

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57

#1  0x0000564858982ae7 in my_write_core (sig=sig@entry=11) at /data/10.5_opt/mysys/stacktrace.c:424

#2  0x0000564858351fda in handle_fatal_signal (sig=11) at /data/10.5_opt/sql/signal_handler.cc:330

#3  <signal handler called>

#4  heap_info (info=0x0, x=x@entry=0x145659365cd0, flag=flag@entry=18) at /data/10.5_opt/storage/heap/hp_info.c:34

#5  0x00005648586628ff in ha_heap::info (this=0x14563588fc30, flag=18) at /data/10.5_opt/storage/heap/ha_heap.cc:377

#6  0x00005648581b30be in make_join_statistics (keyuse_array=0x1456359a84b0, tables_list=@0x145635858f80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1456359a8e30, last = 0x1456359a8e30, elements = 1}, <No data fields>}, join=0x1456359a81c0) at /data/10.5_opt/sql/sql_select.cc:4891

#7  JOIN::optimize_inner (this=this@entry=0x1456359a81c0) at /data/10.5_opt/sql/sql_select.cc:2247

#8  0x00005648581b5533 in JOIN::optimize (this=this@entry=0x1456359a81c0) at /data/10.5_opt/sql/sql_select.cc:1623

#9  0x00005648581b5631 in mysql_select (thd=thd@entry=0x145635812018, tables=0x145635854830, fields=@0x145635858e90: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1456358592f0, last = 0x1456358592f0, elements = 1}, <No data fields>}, conds=0x0, og_num=<optimized out>, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147749632, result=0x1456359a8198, unit=0x1456358560f8, select_lex=0x145635858d40) at /data/10.5_opt/sql/sql_select.cc:4649

#10 0x00005648581b6041 in handle_select (thd=thd@entry=0x145635812018, lex=lex@entry=0x145635856030, result=result@entry=0x1456359a8198, setup_tables_done_option=setup_tables_done_option@entry=0) at /data/10.5_opt/sql/sql_select.cc:417

#11 0x000056485815b8f1 in execute_sqlcom_select (thd=thd@entry=0x145635812018, all_tables=0x145635854830) at /data/10.5_opt/sql/sql_parse.cc:6210

#12 0x0000564858157fd1 in mysql_execute_command (thd=0x145635812018) at /data/10.5_opt/sql/sql_parse.cc:3932

#13 0x00005648580bb6a5 in sp_instr_stmt::exec_core (this=0x145635859fc0, thd=<optimized out>, nextp=0x1456593672c4) at /data/10.5_opt/sql/sp_head.cc:3765

#14 0x00005648580c2ef2 in sp_lex_keeper::reset_lex_and_exec_core (this=this@entry=0x14563585a008, thd=thd@entry=0x145635812018, nextp=nextp@entry=0x1456593672c4, open_tables=open_tables@entry=false, instr=instr@entry=0x145635859fc0) at /data/10.5_opt/sql/sp_head.cc:3492

#15 0x00005648580c396e in sp_instr_stmt::execute (this=0x145635859fc0, thd=0x145635812018, nextp=0x1456593672c4) at /data/10.5_opt/sql/sp_head.cc:3671

#16 0x00005648580bea97 in sp_head::execute (this=this@entry=0x145635858030, thd=thd@entry=0x145635812018, merge_da_on_success=merge_da_on_success@entry=true) at /data/10.5_opt/sql/sp_head.cc:1435

#17 0x00005648580bfe4b in sp_head::execute_procedure (this=0x145635858030, thd=thd@entry=0x145635812018, args=0x145635816eb8) at /data/10.5_opt/sql/sp_head.cc:2446

#18 0x00005648581555e5 in do_execute_sp (thd=thd@entry=0x145635812018, sp=sp@entry=0x145635858030) at /data/10.5_opt/sql/sql_parse.cc:3043

#19 0x0000564858155c96 in Sql_cmd_call::execute (this=0x1456358470e0, thd=0x145635812018) at /data/10.5_opt/sql/sql_parse.cc:3289

#20 0x0000564858157eff in mysql_execute_command (thd=thd@entry=0x145635812018) at /data/10.5_opt/sql/sql_parse.cc:5952

#21 0x000056485815ea2c in mysql_parse (thd=0x145635812018, rawbuf=<optimized out>, length=8, parser_state=0x145659368430, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /data/10.5_opt/sql/sql_parse.cc:7994

#22 0x0000564858153cc5 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x145635812018, packet=packet@entry=0x14563583a019 "CALL p()", packet_length=packet_length@entry=8, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /data/10.5_opt/sql/sql_parse.cc:1867

#23 0x0000564858151fe4 in do_command (thd=0x145635812018) at /data/10.5_opt/sql/sql_parse.cc:1348

#24 0x0000564858248ba1 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x1456560338f8, put_in_cache=put_in_cache@entry=true) at /data/10.5_opt/sql/sql_connect.cc:1410

#25 0x0000564858248f14 in handle_one_connection (arg=arg@entry=0x1456560338f8) at /data/10.5_opt/sql/sql_connect.cc:1312

#26 0x00005648585bca4a in pfs_spawn_thread (arg=0x14565604f018) at /data/10.5_opt/storage/perfschema/pfs.cc:2201

#27 0x00001456582e26db in start_thread (arg=0x145659369700) at pthread_create.c:463

#28 0x00001456576e0a3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Core was generated by `/test/MD150920-mariadb-10.5.6-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:57

[Current thread is 1 (Thread 0x14d5d1718700 (LWP 3961923))]

(gdb) bt

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57

#1  0x0000562ce1fcf85a in my_write_core (sig=sig@entry=11) at /test/10.5_dbg/mysys/stacktrace.c:424

#2  0x0000562ce17963a9 in handle_fatal_signal (sig=11) at /test/10.5_dbg/sql/signal_handler.cc:330

#3  <signal handler called>

#4  heap_info (info=0x0, x=x@entry=0x14d5d17149f0, flag=flag@entry=18) at /test/10.5_dbg/storage/heap/hp_info.c:34

#5  0x0000562ce1b45104 in ha_heap::info (this=0x14d5ad4964a0, flag=18) at /test/10.5_dbg/storage/heap/ha_heap.cc:377

#6  0x0000562ce15f8352 in TABLE_LIST::fetch_number_of_rows (this=this@entry=0x14d5ad48f8a0) at /test/10.5_dbg/sql/table.cc:9288

#7  0x0000562ce155fc31 in make_join_statistics (keyuse_array=0x14d5ad5c9520, tables_list=@0x14d5ad489ff0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14d5ad5c9ea0, last = 0x14d5ad5c9ea0, elements = 1}, <No data fields>}, join=0x14d5ad5c9230) at /test/10.5_dbg/sql/sql_select.cc:4891

#8  JOIN::optimize_inner (this=this@entry=0x14d5ad5c9230) at /test/10.5_dbg/sql/sql_select.cc:2247

#9  0x0000562ce15623b3 in JOIN::optimize (this=this@entry=0x14d5ad5c9230) at /test/10.5_dbg/sql/sql_select.cc:1623

#10 0x0000562ce1562d40 in mysql_select (thd=thd@entry=0x14d5ad415088, tables=<optimized out>, fields=@0x14d5ad489f00: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14d5ad48a360, last = 0x14d5ad48a360, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=2147749632, result=0x14d5ad5c9208, unit=0x14d5ad47d168, select_lex=0x14d5ad489db0) at /test/10.5_dbg/sql/sql_select.cc:4649

#11 0x0000562ce15630bc in handle_select (thd=thd@entry=0x14d5ad415088, lex=lex@entry=0x14d5ad47d0a0, result=result@entry=0x14d5ad5c9208, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.5_dbg/sql/sql_select.cc:417

#12 0x0000562ce14ea348 in execute_sqlcom_select (thd=thd@entry=0x14d5ad415088, all_tables=0x14d5ad48f8a0) at /test/10.5_dbg/sql/sql_parse.cc:6210

#13 0x0000562ce14e341c in mysql_execute_command (thd=0x14d5ad415088) at /test/10.5_dbg/sql/sql_parse.cc:3932

#14 0x0000562ce1415dcb in sp_instr_stmt::exec_core (this=0x14d5ad48b030, thd=<optimized out>, nextp=0x14d5d1715f14) at /test/10.5_dbg/sql/sp_head.cc:3765

#15 0x0000562ce14219e3 in sp_lex_keeper::reset_lex_and_exec_core (this=this@entry=0x14d5ad48b078, thd=thd@entry=0x14d5ad415088, nextp=nextp@entry=0x14d5d1715f14, open_tables=open_tables@entry=false, instr=instr@entry=0x14d5ad48b030) at /test/10.5_dbg/sql/sp_head.cc:3492

#16 0x0000562ce1422589 in sp_instr_stmt::execute (this=0x14d5ad48b030, thd=0x14d5ad415088, nextp=0x14d5d1715f14) at /test/10.5_dbg/sql/sp_head.cc:3671

#17 0x0000562ce141b431 in sp_head::execute (this=this@entry=0x14d5ad4890a0, thd=thd@entry=0x14d5ad415088, merge_da_on_success=merge_da_on_success@entry=true) at /test/10.5_dbg/sql/sp_head.cc:1435

#18 0x0000562ce141d250 in sp_head::execute_procedure (this=0x14d5ad4890a0, thd=thd@entry=0x14d5ad415088, args=0x14d5ad41a0e8) at /test/10.5_dbg/sql/sp_head.cc:2446

#19 0x0000562ce14e0d92 in do_execute_sp (thd=thd@entry=0x14d5ad415088, sp=sp@entry=0x14d5ad4890a0) at /test/10.5_dbg/sql/sql_parse.cc:3043

#20 0x0000562ce14e16f6 in Sql_cmd_call::execute (this=0x14d5ad474150, thd=0x14d5ad415088) at /test/10.5_dbg/sql/sql_parse.cc:3289

#21 0x0000562ce14e89b0 in mysql_execute_command (thd=thd@entry=0x14d5ad415088) at /test/10.5_dbg/sql/sql_parse.cc:5952

#22 0x0000562ce14f0324 in mysql_parse (thd=thd@entry=0x14d5ad415088, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14d5d1717350, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7994

#23 0x0000562ce14dcd54 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14d5ad415088, packet=packet@entry=0x14d5ad467089 "CALL p()", packet_length=packet_length@entry=8, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1867

#24 0x0000562ce14db53e in do_command (thd=0x14d5ad415088) at /test/10.5_dbg/sql/sql_parse.cc:1348

#25 0x0000562ce163a893 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x14d5b08d4808, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1410

#26 0x0000562ce163afb7 in handle_one_connection (arg=arg@entry=0x14d5b08d4808) at /test/10.5_dbg/sql/sql_connect.cc:1312

#27 0x0000562ce1aa55c2 in pfs_spawn_thread (arg=0x14d5ce446508) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201

#28 0x000014d5d06916db in start_thread (arg=0x14d5d1718700) at pthread_create.c:463

#29 0x000014d5cfa8fa3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95