SIGSEGV in Bitmap<64u>::set_bit from sort_and_filter_keyuse and UBSAN runtime error: member access within null pointer of type 'struct st_join_table' on SELECT

CREATE TABLE t1 (a TEXT, FULLTEXT INDEX (a));

SET SESSION sql_select_limit=0;

SELECT (SELECT 1 FROM (SELECT 1) f WHERE MATCH (a) AGAINST ('')) FROM t1;

Core was generated by `/test/MD010121-mariadb-10.6.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

[Current thread is 1 (Thread 0x14a82c0fb700 (LWP 700708))]

(gdb) bt

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

#1  0x000055d101af00d7 in my_write_core (sig=sig@entry=11) at /test/10.6_dbg/mysys/stacktrace.c:424

#2  0x000055d101284ab1 in handle_fatal_signal (sig=11) at /test/10.6_dbg/sql/signal_handler.cc:330

#3  <signal handler called>

#4  0x000055d100ffbac0 in Bitmap<64u>::set_bit (n=<optimized out>, this=0x188) at /test/10.6_dbg/sql/sql_bitmap.h:70

#5  sort_and_filter_keyuse (thd=thd@entry=0x14a7f4000db8, keyuse=keyuse@entry=0x14a7f4016d38, skip_unprefixed_keyparts=true) at /test/10.6_dbg/sql/sql_select.cc:6913

#6  0x000055d10103727c in make_join_statistics (join=join@entry=0x14a7f4016a48, tables_list=@0x14a7f4012e60: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14a7f4017708, last = 0x14a7f4017708, elements = 1}, <No data fields>}, keyuse_array=keyuse_array@entry=0x14a7f4016d38) at /test/10.6_dbg/sql/sql_select.cc:5064

#7  0x000055d10103fd9b in JOIN::optimize_inner (this=this@entry=0x14a7f4016a48) at /test/10.6_dbg/sql/sql_select.cc:2251

#8  0x000055d10104006c in JOIN::optimize (this=this@entry=0x14a7f4016a48) at /test/10.6_dbg/sql/sql_select.cc:1627

#9  0x000055d100f88517 in st_select_lex::optimize_unflattened_subqueries (this=0x14a7f40127b8, const_only=const_only@entry=false) at /test/10.6_dbg/sql/sql_lex.cc:4852

#10 0x000055d1011794cb in JOIN::optimize_unflattened_subqueries (this=this@entry=0x14a7f40163e8) at /test/10.6_dbg/sql/opt_subselect.cc:5555

#11 0x000055d10103e453 in JOIN::optimize_stage2 (this=this@entry=0x14a7f40163e8) at /test/10.6_dbg/sql/sql_select.cc:3037

#12 0x000055d10103fe3b in JOIN::optimize_inner (this=this@entry=0x14a7f40163e8) at /test/10.6_dbg/sql/sql_select.cc:2277

#13 0x000055d10104006c in JOIN::optimize (this=this@entry=0x14a7f40163e8) at /test/10.6_dbg/sql/sql_select.cc:1627

#14 0x000055d1010409ba in mysql_select (thd=thd@entry=0x14a7f4000db8, tables=0x14a7f4015370, fields=@0x14a7f4012908: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14a7f40152e8, last = 0x14a7f40152e8, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x14a7f40163c0, unit=0x14a7f4004f80, select_lex=0x14a7f40127b8) at /test/10.6_dbg/sql/sql_select.cc:4654

#15 0x000055d101040cd0 in handle_select (thd=thd@entry=0x14a7f4000db8, lex=lex@entry=0x14a7f4004eb8, result=result@entry=0x14a7f40163c0, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.6_dbg/sql/sql_select.cc:417

#16 0x000055d100fb319d in execute_sqlcom_select (thd=thd@entry=0x14a7f4000db8, all_tables=0x14a7f4015370) at /test/10.6_dbg/sql/sql_parse.cc:6116

#17 0x000055d100fbfc7c in mysql_execute_command (thd=thd@entry=0x14a7f4000db8) at /test/10.6_dbg/sql/sql_parse.cc:3820

#18 0x000055d100fac072 in mysql_parse (thd=thd@entry=0x14a7f4000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14a82c0fa3d0) at /test/10.6_dbg/sql/sql_parse.cc:7881

#19 0x000055d100fba1ec in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14a7f4000db8, packet=packet@entry=0x14a7f4008d39 "SELECT (SELECT 1 FROM (SELECT 1) f WHERE MATCH (a) AGAINST ('')) FROM t1", packet_length=packet_length@entry=72) at /test/10.6_dbg/sql/sql_class.h:1293

#20 0x000055d100fbd52d in do_command (thd=0x14a7f4000db8) at /test/10.6_dbg/sql/sql_parse.cc:1348

#21 0x000055d1011197fc in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55d103e5eb78, put_in_cache=put_in_cache@entry=true) at /test/10.6_dbg/sql/sql_connect.cc:1410

#22 0x000055d101119f03 in handle_one_connection (arg=arg@entry=0x55d103e5eb78) at /test/10.6_dbg/sql/sql_connect.cc:1312

#23 0x000055d1015cf88f in pfs_spawn_thread (arg=0x55d103d99f58) at /test/10.6_dbg/storage/perfschema/pfs.cc:2201

#24 0x000014a8442ae609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#25 0x000014a843e9d293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95