SIGSEGV in Item_field::used_tables on PREPARED STATEMENT with nested SELECT's

CREATE TABLE t (a INT) CHARSET utf8mb4 ENGINE=InnoDB;

INSERT INTO t VALUES();

INSERT INTO t VALUES (1),(2),(3),(4),(5),(6),(7),(8);

PREPARE s1 FROM ' SELECT a FROM t WHERE a in (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t WHERE a IN (SELECT a FROM t))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))';

SET max_JOIN_size=9;

EXECUTE s1;

SET SESSION sql_big_selects=1;

EXECUTE s1;

Core was generated by `/test/MD310522-mariadb-10.10.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  0x000055df01a81017 in Item_field::used_tables (this=0x14f0c00744c8)

    at /test/10.10_dbg/sql/item.cc:3504

[Current thread is 1 (Thread 0x14f1003fa700 (LWP 3134736))]

(gdb) bt

#0  0x000055df01a81017 in Item_field::used_tables (this=0x14f0c00744c8) at /test/10.10_dbg/sql/item.cc:3504

#1  0x000055df0191c405 in optimize_semijoin_nests (join=join@entry=0x14f0c00148b8, all_table_map=all_table_map@entry=1152921504606846975) at /test/10.10_dbg/sql/sql_array.h:63

#2  0x000055df017e7f6c in make_join_statistics (join=join@entry=0x14f0c00148b8, tables_list=@0x14f0c0073460: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f0c0014e70, last = 0x14f0c0015220, elements = 60}, <No data fields>}, keyuse_array=keyuse_array@entry=0x14f0c0014bd8) at /test/10.10_dbg/sql/sql_select.cc:5928

#3  0x000055df017ef012 in JOIN::optimize_inner (this=this@entry=0x14f0c00148b8) at /test/10.10_dbg/sql/sql_select.cc:2503

#4  0x000055df017ef452 in JOIN::optimize (this=this@entry=0x14f0c00148b8) at /test/10.10_dbg/sql/sql_select.cc:1845

#5  0x000055df01733a24 in st_select_lex::optimize_unflattened_subqueries (this=0x14f0c0070848, const_only=const_only@entry=false) at /test/10.10_dbg/sql/sql_lex.cc:4916

#6  0x000055df01922669 in JOIN::optimize_unflattened_subqueries (this=this@entry=0x14f0c00142d0) at /test/10.10_dbg/sql/opt_subselect.cc:5588

#7  0x000055df017ecafa in JOIN::optimize_stage2 (this=this@entry=0x14f0c00142d0) at /test/10.10_dbg/sql/sql_select.cc:3104

#8  0x000055df017ef08d in JOIN::optimize_inner (this=this@entry=0x14f0c00142d0) at /test/10.10_dbg/sql/sql_select.cc:2529

#9  0x000055df017ef452 in JOIN::optimize (this=this@entry=0x14f0c00142d0) at /test/10.10_dbg/sql/sql_select.cc:1845

#10 0x000055df017ef545 in mysql_select (thd=thd@entry=0x14f0c0000db8, tables=0x14f0c0070e28, fields=@0x14f0c0070ae8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14f0c0070de0, last = 0x14f0c0070de0, elements = 1}, <No data fields>}, conds=0x14f0c0013cd8, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2201171004160, result=0x14f0c00d8d40, unit=0x14f0c006de60, select_lex=0x14f0c0070848) at /test/10.10_dbg/sql/sql_select.cc:5030

#11 0x000055df017efd8e in handle_select (thd=thd@entry=0x14f0c0000db8, lex=lex@entry=0x14f0c006dd88, result=result@entry=0x14f0c00d8d40, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/10.10_dbg/sql/sql_select.cc:578

#12 0x000055df0175bb5e in execute_sqlcom_select (thd=thd@entry=0x14f0c0000db8, all_tables=0x14f0c0070e28) at /test/10.10_dbg/sql/sql_parse.cc:6260

#13 0x000055df01767e70 in mysql_execute_command (thd=0x14f0c0000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=true) at /test/10.10_dbg/sql/sql_parse.cc:3944

#14 0x000055df0179139e in Prepared_statement::execute (this=this@entry=0x14f0c006d908, expanded_query=expanded_query@entry=0x14f1003f8e60, open_cursor=open_cursor@entry=false) at /test/10.10_dbg/sql/sql_prepare.cc:5221

#15 0x000055df01791737 in Prepared_statement::execute_loop (this=this@entry=0x14f0c006d908, expanded_query=expanded_query@entry=0x14f1003f8e60, open_cursor=open_cursor@entry=false, packet=packet@entry=0x0, packet_end=packet_end@entry=0x0) at /test/10.10_dbg/sql/sql_prepare.cc:4644

#16 0x000055df01791de2 in mysql_sql_stmt_execute (thd=thd@entry=0x14f0c0000db8) at /test/10.10_dbg/sql/sql_prepare.cc:3688

#17 0x000055df01767ecd in mysql_execute_command (thd=thd@entry=0x14f0c0000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.10_dbg/sql/sql_parse.cc:3960

#18 0x000055df01755e3a in mysql_parse (thd=thd@entry=0x14f0c0000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14f1003f9470) at /test/10.10_dbg/sql/sql_parse.cc:8036

#19 0x000055df01763422 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14f0c0000db8, packet=packet@entry=0x14f0c000b6d9 "EXECUTE s1", packet_length=packet_length@entry=10, blocking=blocking@entry=true) at /test/10.10_dbg/sql/sql_class.h:1364

#20 0x000055df01765b2c in do_command (thd=0x14f0c0000db8, blocking=blocking@entry=true) at /test/10.10_dbg/sql/sql_parse.cc:1407

#21 0x000055df018c53c0 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55df043a6b98, put_in_cache=put_in_cache@entry=true) at /test/10.10_dbg/sql/sql_connect.cc:1418

#22 0x000055df018c58c9 in handle_one_connection (arg=0x55df043a6b98) at /test/10.10_dbg/sql/sql_connect.cc:1312

#23 0x000014f1254c3609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#24 0x000014f1250af133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

SIGSEGV|Item_field::used_tables|optimize_semijoin_nests|make_join_statistics|JOIN::optimize_inner