Server crashes in SEL_ARG::tree_delete upon query with ranges

--source include/have_innodb.inc

CREATE TABLE t1 (a INT, b INT, s CHAR(32), PRIMARY KEY (s,b,a)) ENGINE=InnoDB;

INSERT INTO t1 VALUES (1,10,'Colorado'),(2,20,'Missouri');

SELECT * FROM t1 WHERE

  b IN (8,3,2,7)

    AND s NOT IN ('Florida','Hawaii')

    AND a >= 6

    AND (s != 'Idaho' AND a = 1 OR s = 'Montana');

# Cleanup

DROP TABLE t1;

#3  <signal handler called>

#4  0x000055685d6df568 in SEL_ARG::tree_delete (this=0x0, key=0x7f7138037a98) at /data/src/10.2/sql/opt_range.cc:9995

#5  0x000055685d6dd877 in and_all_keys (param=0x7f7154235730, key1=0x0, key2=0x7f7138038508, clone_flag=3) at /data/src/10.2/sql/opt_range.cc:9024

#6  0x000055685d6dda1c in key_and (param=0x7f7154235730, key1=0x7f71380378b8, key2=0x7f7138038508, clone_flag=3) at /data/src/10.2/sql/opt_range.cc:9078

#7  0x000055685d6ddce7 in key_and (param=0x7f7154235730, key1=0x7f7138037cb8, key2=0x7f7138038740, clone_flag=3) at /data/src/10.2/sql/opt_range.cc:9144

#8  0x000055685d6dc2c1 in and_range_trees (param=0x7f7154235730, tree1=0x7f7138037740, tree2=0x7f7138038260, result=0x7f7138037740) at /data/src/10.2/sql/opt_range.cc:8395

#9  0x000055685d6dc507 in tree_and (param=0x7f7154235730, tree1=0x7f7138037740, tree2=0x7f7138038260) at /data/src/10.2/sql/opt_range.cc:8501

#10 0x000055685d6d9f0a in Item_cond_and::get_mm_tree (this=0x7f7138013928, param=0x7f7154235730, cond_ptr=0x7f7138017248) at /data/src/10.2/sql/opt_range.cc:7661

#11 0x000055685d6ce0b8 in SQL_SELECT::test_quick_select (this=0x7f7138017240, thd=0x7f7138000d90, keys_to_use=..., prev_tables=0, limit=18446744073709551615, force_quick_range=false, ordered_output=false, remove_false_parts_of_where=true) at /data/src/10.2/sql/opt_range.cc:2545

#12 0x000055685d352290 in get_quick_record_count (thd=0x7f7138000d90, select=0x7f7138017240, table=0x7f713817ed80, keys=0x7f7138016008, limit=18446744073709551615) at /data/src/10.2/sql/sql_select.cc:3886

#13 0x000055685d3546c6 in make_join_statistics (join=0x7f71380149c0, tables_list=..., keyuse_array=0x7f7138014cb0) at /data/src/10.2/sql/sql_select.cc:4501

#14 0x000055685d34a607 in JOIN::optimize_inner (this=0x7f71380149c0) at /data/src/10.2/sql/sql_select.cc:1597

#15 0x000055685d348b08 in JOIN::optimize (this=0x7f71380149c0) at /data/src/10.2/sql/sql_select.cc:1127

#16 0x000055685d351fd1 in mysql_select (thd=0x7f7138000d90, tables=0x7f71380129c0, wild_num=1, fields=..., conds=0x7f7138013928, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7f71380149a0, unit=0x7f7138004988, select_lex=0x7f71380050d8) at /data/src/10.2/sql/sql_select.cc:3835

#17 0x000055685d346275 in handle_select (thd=0x7f7138000d90, lex=0x7f71380048c8, result=0x7f71380149a0, setup_tables_done_option=0) at /data/src/10.2/sql/sql_select.cc:361

#18 0x000055685d3117da in execute_sqlcom_select (thd=0x7f7138000d90, all_tables=0x7f71380129c0) at /data/src/10.2/sql/sql_parse.cc:6271

#19 0x000055685d308371 in mysql_execute_command (thd=0x7f7138000d90) at /data/src/10.2/sql/sql_parse.cc:3582

#20 0x000055685d3154f0 in mysql_parse (thd=0x7f7138000d90, rawbuf=0x7f7138012708 "SELECT * FROM t1 WHERE\nb IN (8,3,2,7)\nAND s NOT IN ('Florida','Hawaii')\nAND a >= 6\nAND (s != 'Idaho' AND a = 1 OR s = 'Montana')", length=128, parser_state=0x7f71542375e0, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:7793

#21 0x000055685d303893 in dispatch_command (command=COM_QUERY, thd=0x7f7138000d90, packet=0x7f7138008b61 "SELECT * FROM t1 WHERE\nb IN (8,3,2,7)\nAND s NOT IN ('Florida','Hawaii')\nAND a >= 6\nAND (s != 'Idaho' AND a = 1 OR s = 'Montana')", packet_length=128, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1827

#22 0x000055685d3023ac in do_command (thd=0x7f7138000d90) at /data/src/10.2/sql/sql_parse.cc:1381

#23 0x000055685d45a190 in do_handle_one_connection (connect=0x55686061b6d0) at /data/src/10.2/sql/sql_connect.cc:1336

#24 0x000055685d459f04 in handle_one_connection (arg=0x55686061b6d0) at /data/src/10.2/sql/sql_connect.cc:1241

#25 0x000055685dc62819 in pfs_spawn_thread (arg=0x556860607470) at /data/src/10.2/storage/perfschema/pfs.cc:1869

#26 0x00007f7159d9eea7 in start_thread (arg=<optimized out>) at pthread_create.c:477

#27 0x00007f71599a3def in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95