Server crash on second execution of prepare statement with in_predicate_conversion_threshold=1 (or =2)

SET @@in_predicate_conversion_threshold=1;

CREATE TABLE t1 (a BIGINT);

INSERT INTO t1 VALUES (1), (2), (3);

prepare stmt1 from "SELECT * FROM t1 WHERE a IN ('1','5','3')";

execute stmt1;

execute stmt1;

deallocate prepare stmt1;

drop table t1;

SET @@in_predicate_conversion_threshold= default;

Thread pointer: 0x7f759c000da0

Attempting backtrace. You can use the following information to find out

where mysqld died. If you see no messages after this, something went

terribly wrong...

stack_bottom = 0x7f75ad224c70 thread_stack 0x49000

mysys/stacktrace.c:174(my_print_stacktrace)[0x5620feb1c68a]

sql/signal_handler.cc:238(handle_fatal_signal)[0x5620fe1a9120]

libc_sigaction.c:0(__restore_rt)[0x7f75b3042520]

sql/item.h:966(Item::fix_fields_if_needed(THD*, Item**))[0x5620fdd27021]

sql/item.h:970(Item::fix_fields_if_needed_for_scalar(THD*, Item**))[0x5620fdd27095]

sql/sql_tvc.cc:62(fix_fields_for_tvc(THD*, List_iterator_fast<List<Item> >&))[0x5620fe0c2146]

sql/sql_tvc.cc:238(table_value_constr::prepare(THD*, st_select_lex*, select_result*, st_select_lex_unit*))[0x5620fe0c288f]

sql/sql_union.cc:1086(st_select_lex_unit::prepare(TABLE_LIST*, select_result*, unsigned long))[0x5620fdf68dac]

sql/sql_derived.cc:821(mysql_derived_prepare(THD*, LEX*, TABLE_LIST*))[0x5620fddf1355]

sql/sql_derived.cc:200(mysql_handle_single_derived(LEX*, TABLE_LIST*, unsigned int))[0x5620fddefa1d]

sql/table.cc:9099(TABLE_LIST::handle_derived(LEX*, unsigned int))[0x5620fdf9eef4]

sql/sql_lex.h:4391(LEX::handle_list_of_derived(TABLE_LIST*, unsigned int))[0x5620fde0c26f]

sql/sql_lex.cc:4310(st_select_lex::handle_derived(LEX*, unsigned int))[0x5620fde18f96]

sql/sql_select.cc:1222(JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x5620fde990ef]

sql/sql_select.cc:4774(mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x5620fdea6a7f]

sql/sql_select.cc:442(handle_select(THD*, LEX*, select_result*, unsigned long))[0x5620fde95c99]

sql/sql_parse.cc:6463(execute_sqlcom_select(THD*, TABLE_LIST*))[0x5620fde57d7c]

sql/sql_parse.cc:3966(mysql_execute_command(THD*))[0x5620fde4e2d4]

sql/sql_prepare.cc:5024(Prepared_statement::execute(String*, bool))[0x5620fde7ead5]

sql/sql_prepare.cc:4493(Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*))[0x5620fde7cd64]

sql/sql_prepare.cc:3578(mysql_sql_stmt_execute(THD*))[0x5620fde7a516]

sql/sql_parse.cc:3983(mysql_execute_command(THD*))[0x5620fde4e319]

sql/sql_parse.cc:7998(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x5620fde5bf13]

sql/sql_parse.cc:1860(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x5620fde47b41]

sql/sql_parse.cc:1378(do_command(THD*))[0x5620fde4638d]

sql/sql_connect.cc:1420(do_handle_one_connection(CONNECT*))[0x5620fdfe8fc0]

sql/sql_connect.cc:1325(handle_one_connection)[0x5620fdfe8d1c]

perfschema/pfs.cc:1871(pfs_spawn_thread)[0x5620fe57350d]

nptl/pthread_create.c:442(start_thread)[0x7f75b3094b43]

x86_64/clone3.S:83(__clone3)[0x7f75b3126a00]