Server crash in Json_writer_object::add / sel_arg_and_weight_heuristic with optimizer_max_sel_arg_weight=1 and optimizer_trace

--source include/have_innodb.inc

CREATE TABLE t1 (a INT, b INT) ENGINE=InnoDB;

INSERT INTO t1 VALUES (1,2);

CREATE TABLE t2 (c INT, d INT, e INT, f INT, PRIMARY KEY(c,d,e)) ENGINE=InnoDB;

INSERT INTO t2 VALUES (3,4,5,6);

SET OPTIMIZER_MAX_SEL_ARG_WEIGHT= 1;

SET OPTIMIZER_TRACE= 'enabled=on';

SELECT * FROM t1 JOIN t2 ON (t2.c = t1.a AND t2.d = t1.b);

# Cleanup

DROP TABLE t1, t2;

#3  <signal handler called>

#4  0x000055e3804ddeef in Json_writer_object::add (this=0x7ff6bc0b3710, name=0x55e381432639 "key1_field", value=...) at /data/src/10.5/sql/my_json_writer.h:444

#5  0x000055e38095b557 in sel_arg_and_weight_heuristic (param=0x7ff6bc0b3bc0, key1=0x7ff68c05e828, key2=0x7ff68c05e918) at /data/src/10.5/sql/opt_range.cc:10942

#6  0x000055e38095941b in key_and (param=0x7ff6bc0b3bc0, key1=0x7ff68c05e828, key2=0x7ff68c05e918, clone_flag=0) at /data/src/10.5/sql/opt_range.cc:9866

#7  0x000055e380959c0c in key_and_with_limit (param=0x7ff6bc0b3bc0, keyno=0, key1=0x7ff68c05e828, key2=0x7ff68c05e918, clone_flag=0) at /data/src/10.5/sql/opt_range.cc:10087

#8  0x000055e380957ae2 in and_range_trees (param=0x7ff6bc0b3bc0, tree1=0x7ff68c05e7a8, tree2=0x7ff68c05e898, result=0x7ff68c05e7a8) at /data/src/10.5/sql/opt_range.cc:9151

#9  0x000055e380957d73 in tree_and (param=0x7ff6bc0b3bc0, tree1=0x7ff68c05e7a8, tree2=0x7ff68c05e898) at /data/src/10.5/sql/opt_range.cc:9263

#10 0x000055e3809548fc in Item_cond_and::get_mm_tree (this=0x7ff68c061380, param=0x7ff6bc0b3bc0, cond_ptr=0x7ff68c0614c8) at /data/src/10.5/sql/opt_range.cc:8315

#11 0x000055e38094662b in SQL_SELECT::test_quick_select (this=0x7ff68c0614c0, thd=0x7ff68c000db8, keys_to_use=..., prev_tables=13835058055282163713, limit=18446744073709551615, force_quick_range=false, ordered_output=false, remove_false_parts_of_where=false, only_single_index_range_scan=false) at /data/src/10.5/sql/opt_range.cc:2880

#12 0x000055e3804a4e40 in make_join_select (join=0x7ff68c0183e8, select=0x7ff68c01aea0, cond=0x7ff68c017218) at /data/src/10.5/sql/sql_select.cc:11769

#13 0x000055e3804884f2 in JOIN::optimize_stage2 (this=0x7ff68c0183e8) at /data/src/10.5/sql/sql_select.cc:2535

#14 0x000055e3804873eb in JOIN::optimize_inner (this=0x7ff68c0183e8) at /data/src/10.5/sql/sql_select.cc:2284

#15 0x000055e380484de1 in JOIN::optimize (this=0x7ff68c0183e8) at /data/src/10.5/sql/sql_select.cc:1630

#16 0x000055e38049020c in mysql_select (thd=0x7ff68c000db8, tables=0x7ff68c0159d0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7ff68c0183c0, unit=0x7ff68c004f68, select_lex=0x7ff68c0153c0) at /data/src/10.5/sql/sql_select.cc:4711

#17 0x000055e38047fd0b in handle_select (thd=0x7ff68c000db8, lex=0x7ff68c004ea0, result=0x7ff68c0183c0, setup_tables_done_option=0) at /data/src/10.5/sql/sql_select.cc:419

#18 0x000055e3804425da in execute_sqlcom_select (thd=0x7ff68c000db8, all_tables=0x7ff68c0159d0) at /data/src/10.5/sql/sql_parse.cc:6307

#19 0x000055e380439840 in mysql_execute_command (thd=0x7ff68c000db8) at /data/src/10.5/sql/sql_parse.cc:4003

#20 0x000055e380447494 in mysql_parse (thd=0x7ff68c000db8, rawbuf=0x7ff68c0152f0 "SELECT * FROM t1 JOIN t2 ON (t2.c = t1.a AND t2.d = t1.b)", length=57, parser_state=0x7ff6bc0b5510, is_com_multi=false, is_next_command=false) at /data/src/10.5/sql/sql_parse.cc:8093

#21 0x000055e38043335f in dispatch_command (command=COM_QUERY, thd=0x7ff68c000db8, packet=0x7ff68c00b5a9 "SELECT * FROM t1 JOIN t2 ON (t2.c = t1.a AND t2.d = t1.b)", packet_length=57, is_com_multi=false, is_next_command=false) at /data/src/10.5/sql/sql_parse.cc:1889

#22 0x000055e380431b53 in do_command (thd=0x7ff68c000db8) at /data/src/10.5/sql/sql_parse.cc:1370

#23 0x000055e3805e03b7 in do_handle_one_connection (connect=0x55e384e73428, put_in_cache=true) at /data/src/10.5/sql/sql_connect.cc:1410

#24 0x000055e3805e011a in handle_one_connection (arg=0x55e384e60418) at /data/src/10.5/sql/sql_connect.cc:1312

#25 0x000055e380b42217 in pfs_spawn_thread (arg=0x55e384ea74d8) at /data/src/10.5/storage/perfschema/pfs.cc:2201

#26 0x00007ff6c2223609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#27 0x00007ff6c1df7293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95