SIGSEGV in get_sort_by_table on SELECT

CREATE TABLE t (a INT KEY,b INT) COMMENT='' ENGINE=InnoDB;

SELECT 1 FROM t WHERE 1 IN (SELECT 1 FROM t WHERE 1=(EXISTS (SELECT a FROM (SELECT 1) s GROUP BY 1=ANY (SELECT 1 FROM t HAVING a) HAVING 1)));

Core was generated by `/test/MD141024-mariadb-11.2.6-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  get_sort_by_table (const_tables=1, tables=..., b=<optimized out>, a=0x0)at /test/11.2_dbg/sql/sql_select.cc:28792

[Current thread is 1 (LWP 3093068)]

(gdb) bt

#0  get_sort_by_table (const_tables=1, tables=@0x10bae4015470: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x10bae4072568, last = 0x10bae4072568, elements = 1}, <No data fields>}, b=<optimized out>, a=0x0) at /test/11.2_dbg/sql/sql_select.cc:28792

#1  make_join_statistics (join=join@entry=0x10bae40717d8, tables_list=@0x10bae4015470: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x10bae4072568, last = 0x10bae4072568, elements = 1}, <No data fields>}, keyuse_array=keyuse_array@entry=0x10bae4071b40)at /test/11.2_dbg/sql/sql_select.cc:6041

#2  0x000059c9233998f9 in JOIN::optimize_inner (this=this@entry=0x10bae40717d8)at /test/11.2_dbg/sql/sql_select.cc:2699

#3  0x000059c923399eae in JOIN::optimize (this=this@entry=0x10bae40717d8)at /test/11.2_dbg/sql/sql_select.cc:2003

#4  0x000059c9232d7412 in st_select_lex::optimize_unflattened_subqueries (this=0x10bae40137c8, const_only=const_only@entry=false)at /test/11.2_dbg/sql/sql_lex.cc:5005

#5  0x000059c9234dff27 in JOIN::optimize_unflattened_subqueries (this=this@entry=0x10bae4027218) at /test/11.2_dbg/sql/opt_subselect.cc:5873

#6  0x000059c9233973f7 in JOIN::optimize_stage2 (this=this@entry=0x10bae4027218) at /test/11.2_dbg/sql/sql_select.cc:3318

#7  0x000059c923399956 in JOIN::optimize_inner (this=this@entry=0x10bae4027218)at /test/11.2_dbg/sql/sql_select.cc:2725

#8  0x000059c923399eae in JOIN::optimize (this=this@entry=0x10bae4027218)at /test/11.2_dbg/sql/sql_select.cc:2003

#9  0x000059c923399fce in mysql_select (thd=thd@entry=0x10bae4000d58, tables=0x10bae4013d68, fields=@0x10bae4013a80: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x10bae4013d18, last = 0x10bae4013d18, elements = 1}, <No data fields>}, conds=0x10bae40265d0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x10bae40271f0, unit=0x10bae40052b0, select_lex=0x10bae40137c8)at /test/11.2_dbg/sql/sql_select.cc:5344

#10 0x000059c92339a858 in handle_select (thd=thd@entry=0x10bae4000d58, lex=lex@entry=0x10bae40051d0, result=result@entry=0x10bae40271f0, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/11.2_dbg/sql/sql_select.cc:642

#11 0x000059c9232f8751 in execute_sqlcom_select (thd=thd@entry=0x10bae4000d58, all_tables=0x10bae4013d68) at /test/11.2_dbg/sql/sql_parse.cc:6177

#12 0x000059c9233045bc in mysql_execute_command (thd=thd@entry=0x10bae4000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.2_dbg/sql/sql_parse.cc:3984

#13 0x000059c92330b2ce in mysql_parse (thd=thd@entry=0x10bae4000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x10bb2a74c2a0)at /test/11.2_dbg/sql/sql_parse.cc:7938

#14 0x000059c92330d786 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x10bae4000d58, packet=packet@entry=0x10bae400b319 "SELECT 1 FROM t WHERE 1 IN (SELECT 1 FROM t WHERE 1=(EXISTS (SELECT a FROM (SELECT 1) s GROUP BY 1=ANY (SELECT 1 FROM t HAVING a) HAVING 1)))", packet_length=packet_length@entry=141, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_class.h:248

#15 0x000059c92330f9c2 in do_command (thd=0x10bae4000d58, blocking=blocking@entry=true) at /test/11.2_dbg/sql/sql_parse.cc:1407

#16 0x000059c92347cfe7 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x59c92659b3f8, put_in_cache=put_in_cache@entry=true)at /test/11.2_dbg/sql/sql_connect.cc:1439

#17 0x000059c92347d2ef in handle_one_connection (arg=arg@entry=0x59c92659b3f8)at /test/11.2_dbg/sql/sql_connect.cc:1341

#18 0x000059c9238c4f14 in pfs_spawn_thread (arg=0x59c9264ee228)at /test/11.2_dbg/storage/perfschema/pfs.cc:2201

#19 0x000010bb3349ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#20 0x000010bb33529c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78