LP:611622 - Crash in JOIN::optimize called from subselect_hash_sj_engine::exec with semijoin=off

With semijoin=off, the following query:

PREPARE st1 FROM "SELECT table1 .`col_varchar_key`
FROM (
SELECT *
FROM BB ) table1 RIGHT JOIN BB ON ( 8 , 4 ) IN (
SELECT `pk` , `pk`
FROM C ) ";

crashes as follows (note the presence of subselect_hash_sj_engine in the backtrace):

#3 0x0827e9e0 in handle_segfault (sig=11) at mysqld.cc:2703
#4 <signal handler called>
#5 0x082fd446 in JOIN::optimize (this=0xb5f8c7c8) at sql_select.cc:745
#6 0x08237a39 in subselect_hash_sj_engine::exec (this=0xb5f5f228) at item_subselect.cc:4081
#7 0x0822facb in Item_subselect::exec (this=0xb5f5e948) at item_subselect.cc:481
#8 0x0822fcc4 in Item_in_subselect::exec (this=0xb5f5e948) at item_subselect.cc:578
#9 0x0823152c in Item_in_subselect::val_bool (this=0xb5f5e948) at item_subselect.cc:1246
#10 0x081cf442 in Item::val_bool_result (this=0xb5f5e948) at item.h:783
#11 0x081faab7 in Item_in_optimizer::val_int (this=0xb5f5f028) at item_cmpfunc.cc:1873
#12 0x0831e5fe in join_read_const_table (tab=0xb5f32350, pos=0xb5f8a044) at sql_select.cc:13488
#13 0x08304fb2 in make_join_statistics (join=0xb5f87958, tables_arg=0xb5f5db28, conds=0x0, keyuse_array=0xb5f8c694) at sql_select.cc:2937
#14 0x082fddc9 in JOIN::optimize (this=0xb5f87958) at sql_select.cc:939
#15 0x08303865 in mysql_select (thd=0xa81efd0, rref_pointer_array=0xb5f5c7e8, tables=0xb5f5db28, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0,
group=0x0, having=0x0, proc_param=0x0, select_options=2416200192, result=0xb5f5ec98, unit=0xb5f5c44c, select_lex=0xb5f5c6e4) at sql_select.cc:2542
#16 0x082fbfb7 in handle_select (thd=0xa81efd0, lex=0xb5f5c3f0, result=0xb5f5ec98, setup_tables_done_option=0) at sql_select.cc:276
#17 0x0829a6d8 in execute_sqlcom_select (thd=0xa81efd0, all_tables=0xb5f5db28) at sql_parse.cc:5081
#18 0x082910b8 in mysql_execute_command (thd=0xa81efd0) at sql_parse.cc:2265
#19 0x08342d81 in Prepared_statement::execute (this=0xb5f4d6c0, expanded_query=0xb6e53410, open_cursor=false) at sql_prepare.cc:3588
#20 0x08342280 in Prepared_statement::execute_loop (this=0xb5f4d6c0, expanded_query=0xb6e53410, open_cursor=false, packet=0x0, packet_end=0x0)
at sql_prepare.cc:3263
#21 0x08340c6c in mysql_sql_stmt_execute (thd=0xa81efd0) at sql_prepare.cc:2533
#22 0x082910e2 in mysql_execute_command (thd=0xa81efd0) at sql_parse.cc:2274
#23 0x0829c8b9 in mysql_parse (thd=0xa81efd0, inBuf=0xb5f31900 "EXECUTE st1", length=11, found_semicolon=0xb6e54230) at sql_parse.cc:6027
#24 0x0828eaea in dispatch_command (command=COM_QUERY, thd=0xa81efd0, packet=0xa837329 "EXECUTE st1", packet_length=11) at sql_parse.cc:1184
#25 0x0828df90 in do_command (thd=0xa81efd0) at sql_parse.cc:890
#26 0x0828b0f0 in handle_one_connection (arg=0xa81efd0) at sql_connect.cc:1153
#27 0x00a08919 in start_thread () from /lib/libpthread.so.0
#28 0x00951e5e in clone () from /lib/libc.so.6

EXPLAIN:

id select_type table type possible_keys key key_len ref rows Extra
1 PRIMARY BB system NULL NULL NULL NULL 1
1 PRIMARY <derived2> system NULL NULL NULL NULL 1
3 SUBQUERY C index NULL PRIMARY 4 NULL 20 Using index
2 DERIVED BB system NULL NULL NULL NULL 1