SIGSEGV in update_depend_map_for_order on SELECT, UBSAN: runtime error: member access within null pointer of type 'struct JOIN_TAB'

CREATE TABLE v816 ( v817 TEXT ) ;

 INSERT INTO v816 ( v817 ) VALUES ( 'x' ) , ( NULL ) , ( 'x' ) , ( NULL ) ;

 SELECT v817 , 'x' / 12155613.000000 IS NOT NULL AS v818 FROM ( SELECT DISTINCT 42 FROM ( SELECT DISTINCT v817 , 'x' FROM v816 ) AS v819 , v816 AS v820 , v816 AS v821 , v816 AS v822 JOIN v816 ) AS v823 NATURAL JOIN v816 AS v824 NATURAL JOIN v816 WINDOW v832 AS ( PARTITION BY ( v817 OR NOT v817 ) BETWEEN ( ( ( NOT ( ( ( v817 < 'x' ) ) * NULL ) ) ) ) AND 19998157.000000 ORDER BY 'x' BETWEEN ( ( ( SELECT v817 FROM v816 GROUP BY v817 WINDOW v833 AS ( PARTITION BY v817 ORDER BY ( SELECT DISTINCT 66 FROM v816 AS v829 , v816 AS v830 NATURAL JOIN v816 AS v831 JOIN v816 ) DESC RANGE BETWEEN 79934776.000000 FOLLOWING AND 41086601.000000 FOLLOWING ) ORDER BY v817 + v817 , v817 + v817 ) = 3 ) ) AND ( CASE v817 WHEN ( v817 IN ( 38 , 20 , 11 , 43 , 'x' / v817 = v817 + CASE v817 WHEN TRUE THEN -128 ELSE 99 END OR v817 = v817 OR v817 = v817 ) ) THEN 2 ELSE 2147483647 END != -128 ) ) ;

Core was generated by `/test/MD030522-mariadb-10.9.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x0000563600e85b30 in update_depend_map_for_order (order=0x147bd8073500, 

    join=0x147bd8096ee8) at /test/10.9_dbg/sql/sql_select.cc:14518

14518		  order->depend_map|=(*tab)->ref.depend_map;

[Current thread is 1 (Thread 0x147c123c1700 (LWP 1070999))]

(gdb) bt

#0  0x0000563600e85b30 in update_depend_map_for_order (order=0x147bd8073500, join=0x147bd8096ee8) at /test/10.9_dbg/sql/sql_select.cc:14518

#1  remove_const (join=join@entry=0x147bd8096ee8, first_order=<optimized out>, cond=0x0, change_list=true, simple_order=simple_order@entry=0x147bd80971f4) at /test/10.9_dbg/sql/sql_select.cc:14631

#2  0x0000563600eae5dd in JOIN::optimize_stage2 (this=this@entry=0x147bd8096ee8) at /test/10.9_dbg/sql/sql_select.cc:2971

#3  0x0000563600eb15a7 in JOIN::optimize_inner (this=this@entry=0x147bd8096ee8) at /test/10.9_dbg/sql/sql_select.cc:2521

#4  0x0000563600eb196c in JOIN::optimize (this=this@entry=0x147bd8096ee8) at /test/10.9_dbg/sql/sql_select.cc:1837

#5  0x0000563600df6462 in st_select_lex::optimize_unflattened_subqueries (this=0x147bd8014328, const_only=const_only@entry=true) at /test/10.9_dbg/sql/sql_lex.cc:4916

#6  0x0000563600fe2f3d in JOIN::optimize_constant_subqueries (this=this@entry=0x147bd807b600) at /test/10.9_dbg/sql/opt_subselect.cc:5622

#7  0x0000563600eb0490 in JOIN::optimize_inner (this=this@entry=0x147bd807b600) at /test/10.9_dbg/sql/sql_select.cc:2157

#8  0x0000563600eb196c in JOIN::optimize (this=this@entry=0x147bd807b600) at /test/10.9_dbg/sql/sql_select.cc:1837

#9  0x0000563600eb1a5f in mysql_select (thd=thd@entry=0x147bd8000db8, tables=0x147bd806f580, fields=@0x147bd80145c8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x147bd80148c0, last = 0x147bd8014b88, elements = 2}, <No data fields>}, conds=0x0, og_num=1, order=0x0, group=0x147bd8073500, having=0x0, proc_param=0x0, select_options=2147748608, result=0x147bd807b5d8, unit=0x147bd8004fd8, select_lex=0x147bd8014328) at /test/10.9_dbg/sql/sql_select.cc:5022

#10 0x0000563600eb22a8 in handle_select (thd=thd@entry=0x147bd8000db8, lex=lex@entry=0x147bd8004f00, result=result@entry=0x147bd807b5d8, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.9_dbg/sql/sql_select.cc:570

#11 0x0000563600e1e6c8 in execute_sqlcom_select (thd=thd@entry=0x147bd8000db8, all_tables=0x147bd806f580) at /test/10.9_dbg/sql/sql_parse.cc:6271

#12 0x0000563600e2a935 in mysql_execute_command (thd=thd@entry=0x147bd8000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.9_dbg/sql/sql_parse.cc:3961

#13 0x0000563600e1867b in mysql_parse (thd=thd@entry=0x147bd8000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x147c123c0470) at /test/10.9_dbg/sql/sql_parse.cc:8046

#14 0x0000563600e25f79 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x147bd8000db8, packet=packet@entry=0x147bd800b699 "SELECT v817 , 'x' / 12155613.000000 IS NOT NULL AS v818 FROM ( SELECT DISTINCT 42 FROM ( SELECT DISTINCT v817 , 'x' FROM v816 ) AS v819 , v816 AS v820 , v816 AS v821 , v816 AS v822 JOIN v816 ) AS v823"..., packet_length=packet_length@entry=878, blocking=blocking@entry=true) at /test/10.9_dbg/sql/sql_class.h:1364

#15 0x0000563600e28686 in do_command (thd=0x147bd8000db8, blocking=blocking@entry=true) at /test/10.9_dbg/sql/sql_parse.cc:1408

#16 0x0000563600f85d02 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5636047d2638, put_in_cache=put_in_cache@entry=true) at /test/10.9_dbg/sql/sql_connect.cc:1418

#17 0x0000563600f8620b in handle_one_connection (arg=0x5636047d2638) at /test/10.9_dbg/sql/sql_connect.cc:1312

#18 0x0000147c2f257609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#19 0x0000147c2ee43163 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Core was generated by `/test/MD030522-mariadb-10.9.0-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x0000564ef96fe3cf in update_depend_map_for_order (join=0x15027c06cf90, 

    join=0x15027c06cf90, order=0x15027c04b048)

    at /test/10.9_opt/sql/sql_select.cc:14518

14518		  order->depend_map|=(*tab)->ref.depend_map;

[Current thread is 1 (Thread 0x1502bc6a4700 (LWP 1070981))]

(gdb) bt

#0  0x0000564ef96fe3cf in update_depend_map_for_order (join=0x15027c06cf90, join=0x15027c06cf90, order=0x15027c04b048) at /test/10.9_opt/sql/sql_select.cc:14518

#1  remove_const (join=0x15027c06cf90, first_order=<optimized out>, cond=0x0, change_list=true, simple_order=0x15027c06d29c) at /test/10.9_opt/sql/sql_select.cc:14631

#2  0x0000564ef971e1ba in JOIN::optimize_stage2 (this=<optimized out>) at /test/10.9_opt/sql/sql_select.cc:2971

#3  0x0000564ef9721368 in JOIN::optimize_inner (this=0x15027c06cf90) at /test/10.9_opt/sql/sql_select.cc:2521

#4  0x0000564ef97236d3 in JOIN::optimize (this=this@entry=0x15027c06cf90) at /test/10.9_opt/sql/sql_select.cc:1837

#5  0x0000564ef9687464 in st_select_lex::optimize_unflattened_subqueries (this=0x15027c010e08, const_only=const_only@entry=true) at /test/10.9_opt/sql/sql_lex.cc:4916

#6  0x0000564ef9809455 in JOIN::optimize_constant_subqueries (this=this@entry=0x15027c053068) at /test/10.9_opt/sql/opt_subselect.cc:5622

#7  0x0000564ef971ff67 in JOIN::optimize_inner (this=0x15027c053068) at /test/10.9_opt/sql/sql_select.cc:2157

#8  0x0000564ef97236d3 in JOIN::optimize (this=this@entry=0x15027c053068) at /test/10.9_opt/sql/sql_select.cc:1837

#9  0x0000564ef97237be in mysql_select (thd=0x15027c000c58, tables=0x15027c047138, fields=@0x15027c0110a8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x15027c0113a0, last = 0x15027c011660, elements = 2}, <No data fields>}, conds=0x0, og_num=1, order=0x0, group=0x15027c04b048, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x15027c053040, unit=0x15027c004cb8, select_lex=0x15027c010e08) at /test/10.9_opt/sql/sql_select.cc:5022

#10 0x0000564ef9723f57 in handle_select (thd=thd@entry=0x15027c000c58, lex=lex@entry=0x15027c004be0, result=result@entry=0x15027c053040, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.9_opt/sql/sql_select.cc:570

#11 0x0000564ef96a7a21 in execute_sqlcom_select (thd=0x15027c000c58, all_tables=0x15027c047138) at /test/10.9_opt/sql/sql_parse.cc:6271

#12 0x0000564ef96b5363 in mysql_execute_command (thd=0x15027c000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.9_opt/sql/sql_parse.cc:3961

#13 0x0000564ef96a2a55 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x15027c000c58) at /test/10.9_opt/sql/sql_parse.cc:8046

#14 mysql_parse (thd=0x15027c000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.9_opt/sql/sql_parse.cc:7968

#15 0x0000564ef96ae71a in dispatch_command (command=COM_QUERY, thd=0x15027c000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.9_opt/sql/sql_class.h:1364

#16 0x0000564ef96b0642 in do_command (thd=0x15027c000c58, blocking=blocking@entry=true) at /test/10.9_opt/sql/sql_parse.cc:1408

#17 0x0000564ef97c55bf in do_handle_one_connection (connect=<optimized out>, connect@entry=0x564efb6494d8, put_in_cache=put_in_cache@entry=true) at /test/10.9_opt/sql/sql_connect.cc:1418

#18 0x0000564ef97c589d in handle_one_connection (arg=0x564efb6494d8) at /test/10.9_opt/sql/sql_connect.cc:1312

#19 0x00001502d5700609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#20 0x00001502d52ec163 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95