LP:611691 - Crash in reinit_stmt_before_use() on subquery in the SELECT list

In Maria 5.2 and 5.3 , the following query:

SELECT (
SELECT `pk`
FROM C
WHERE table1 .`col_int_nokey` ) , `col_varchar_key` field12
FROM D table1
GROUP BY field12

crashes when executed as a prepared statement.

backtrace:

#3 0x0826c388 in handle_segfault (sig=11) at mysqld.cc:2693
#4 <signal handler called>
#5 0x0832375f in reinit_stmt_before_use (thd=0xaa4b528, lex=0xb5d5c3f8) at sql_prepare.cc:2335
#6 0x08325eef in Prepared_statement::execute (this=0xb5d4d6f0, expanded_query=0xb60d2430, open_cursor=false) at sql_prepare.cc:3570
#7 0x0832547e in Prepared_statement::execute_loop (this=0xb5d4d6f0, expanded_query=0xb60d2430, open_cursor=false, packet=0x0, packet_end=0x0)
at sql_prepare.cc:3262
#8 0x08323e6a in mysql_sql_stmt_execute (thd=0xaa4b528) at sql_prepare.cc:2532
#9 0x0827ea56 in mysql_execute_command (thd=0xaa4b528) at sql_parse.cc:2273
#10 0x0828a204 in mysql_parse (thd=0xaa4b528, inBuf=0xb5d2d930 "EXECUTE st1", length=11, found_semicolon=0xb60d3230) at sql_parse.cc:6024
#11 0x0827c45e in dispatch_command (command=COM_QUERY, thd=0xaa4b528, packet=0xaa63879 "EXECUTE st1", packet_length=11) at sql_parse.cc:1183
#12 0x0827b904 in do_command (thd=0xaa4b528) at sql_parse.cc:890
#13 0x08278a64 in handle_one_connection (arg=0xaa4b528) at sql_connect.cc:1153
#14 0x00a08919 in start_thread () from /lib/libpthread.so.0
#15 0x00951e5e in clone () from /lib/libc.so.6

explain:

id select_type table type possible_keys key key_len ref rows Extra
1 PRIMARY table1 ALL NULL NULL NULL NULL 100 Using temporary; Using filesort
2 DEPENDENT SUBQUERY C index NULL PRIMARY 4 NULL 20 Using where; Using index

in mysql 5.5.5 the same query crashes as follows:

#3 0x0811b321 in handle_segfault (sig=11) at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/mysqld.cc:2791
#4 <signal handler called>
#5 0x081c9e37 in simplify_joins (join=0xad216920, join_list=0xad2155ac, conds=0xad205cf8, top=true)
at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_select.cc:8901
#6 0x081d1908 in JOIN::optimize (this=0xad216920) at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_select.cc:892
#7 0x0831bb72 in subselect_single_select_engine::exec (this=0xad216080)
at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/item_subselect.cc:1912
#8 0x0831a4a3 in Item_subselect::exec (this=0xad215fe8) at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/item_subselect.cc:288
#9 0x0831a765 in Item_singlerow_subselect::val_int (this=0xad215fe8)
at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/item_subselect.cc:598
#10 0x082b3585 in Item_copy_int::copy (this=0xad205fd0) at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/item.cc:3657
#11 0x081b9a43 in copy_fields (param=0xad20566c) at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_select.cc:15637
#12 0x081c133a in end_send (join=0xad204610, join_tab=0xad205d94, end_of_records=false)
at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_select.cc:12495
#13 0x081bb982 in evaluate_join_record (join=0xad204610, join_tab=0xad205c00, error=0)
at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_select.cc:11707
#14 0x081bfddc in sub_select (join=0xad204610, join_tab=0xad205c00, end_of_records=false)
at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_select.cc:11582
#15 0x081c563c in do_select (join=0xad204610, fields=0xad205774, table=0x0, procedure=0x0)
at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_select.cc:11334
#16 0x081da351 in JOIN::exec (this=0xad204610) at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_select.cc:2354
#17 0x081d5ce1 in mysql_select (thd=0xa968b08, rref_pointer_array=0xad214e94, tables=0xad216268, wild_num=0, fields=..., conds=0x0, og_num=1, order=0x0,
group=0xad2166a8, having=0x0, proc_param=0x0, select_options=2416184064, result=0xad2166d8, unit=0xad214970, select_lex=0xad214d9c)
at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_select.cc:2549
#18 0x081dc23a in handle_select (thd=0xa968b08, lex=0xad214910, result=0xad2166d8, setup_tables_done_option=0)
at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_select.cc:290
#19 0x08193b3d in execute_sqlcom_select (thd=0xa968b08, all_tables=0xad216268)
at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_parse.cc:4882
#20 0x0819979f in mysql_execute_command (thd=0xa968b08) at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_parse.cc:2329
#21 0x081acc63 in Prepared_statement::execute (this=0xad209b90, expanded_query=0xaff869ac, open_cursor=false)
at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_prepare.cc:3769
#22 0x081afc8b in Prepared_statement::execute_loop (this=0xad209b90, expanded_query=0xaff869ac, open_cursor=false, packet=0x0, packet_end=0x0)
at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_prepare.cc:3416
#23 0x081b0057 in mysql_sql_stmt_execute (thd=0xa968b08) at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_prepare.cc:2596
#24 0x0819a32a in mysql_execute_command (thd=0xa968b08) at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_parse.cc:2339
#25 0x0819eebd in mysql_parse (thd=0xa968b08, inBuf=0xad204488 "EXECUTE st1", length=11, parser_state=0xaff88164)
at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_parse.cc:5911
#26 0x081a0eaf in dispatch_command (command=COM_QUERY, thd=0xa968b08, packet=0xa9f45d1 "", packet_length=11)
at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_parse.cc:1135
#27 0x081a13ef in do_command (thd=0xa968b08) at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_parse.cc:807
#28 0x082420e9 in do_handle_one_connection (thd_arg=0xa968b08) at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_connect.cc:1196
#29 0x0824247f in handle_one_connection (arg=0xa968b08) at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/sql/sql_connect.cc:1135
#30 0x08558e62 in pfs_spawn_thread (arg=0xa96bf70) at /export/home/pb2/build/sb_0-2019843-1278441673.38/mysql-5.5.5-m3/storage/perfschema/pfs.cc:1015
#31 0x00a08919 in start_thread () from /lib/libpthread.so.0
#32 0x00951e5e in clone () from /lib/libc.so.6