LP:684086 - Memory corruption in test_quick_select() in maria-5.1-wl21

backtrace:

#8 0x006f5b9d in __libc_message () from /lib/libc.so.6
#9 0x006fbfe1 in malloc_printerr () from /lib/libc.so.6
#10 0x08716681 in my_no_flags_free (ptr=0xaf43440) at my_malloc.c:72
#11 0x087174f2 in free_root (root=0x9f965800, MyFlags=0) at my_alloc.c:364
#12 0x0837be32 in SQL_SELECT::test_quick_select (this=0xaf5cbe8, thd=0xae518d0, keys_to_use=..., prev_tables=0, limit=18446744073709551615,
force_quick_range=false) at opt_range.cc:3118
#13 0x082e7b1b in get_quick_record_count (thd=0xae518d0, select=0xaf5cbe8, table=0xaf4ce38, keys=0xaf5c4fc, limit=18446744073709551615) at sql_select.cc:2600
#14 0x082e98d9 in make_join_statistics (join=0xaf5aef8, tables_arg=0xaf4deb8, conds=0xaf4e5d0, keyuse_array=0xaf5c018) at sql_select.cc:3037
#15 0x082e2067 in JOIN::optimize (this=0xaf5aef8) at sql_select.cc:1029
#16 0x082e7843 in mysql_select (thd=0xae518d0, rref_pointer_array=0xae52f70, tables=0xaf4deb8, wild_num=0, fields=..., conds=0xaf4e5d0, og_num=0, order=0x0,
group=0x0, having=0x0, proc_param=0x0, select_options=2147764740, result=0xaf42b20, unit=0xae52be0, select_lex=0xae52e58) at sql_select.cc:2538
#17 0x0830cd08 in mysql_explain_union (thd=0xae518d0, unit=0xae52be0, result=0xaf42b20) at sql_select.cc:17200
#18 0x08286c4c in execute_sqlcom_select (thd=0xae518d0, all_tables=0xaf4deb8) at sql_parse.cc:5144
#19 0x0827d736 in mysql_execute_command (thd=0xae518d0) at sql_parse.cc:2340
#20 0x08288e46 in mysql_parse (thd=0xae518d0, rawbuf=0xaf4beb8 "EXPLAIN SELECT f2 FROM t1 WHERE ( f2 IN ( 1 , 255 ) OR f2 = 8 ) AND f1 IN ( 0 , 74 )",
length=84, found_semicolon=0x9f967220) at sql_parse.cc:6092
#21 0x0827b222 in dispatch_command (command=COM_QUERY, thd=0xae518d0, packet=0xaf0a629 "", packet_length=84) at sql_parse.cc:1269
#22 0x0827a47f in do_command (thd=0xae518d0) at sql_parse.cc:895
#23 0x08277490 in handle_one_connection (arg=0xae518d0) at sql_connect.cc:1138
#24 0x00821919 in start_thread () from /lib/libpthread.so.0
#25 0x0076acce in clone () from /lib/libc.so.6

testcase:

--source include/have_innodb.inc

SET SESSION optimizer_switch=index_merge_sort_intersection=on;

CREATE TABLE t1 (f1 int, f2 int, PRIMARY KEY (f2), KEY (f1)) ENGINE=InnoDB;
INSERT INTO t1 VALUES ('2','5'),('2','3'),('2','8'),('2','438'),('2','4');

SELECT f2 FROM t1 WHERE ( f2 IN ( 1 , 255 ) OR f2 = 8 ) AND f1 IN ( 0 , 74 );