LP:609043 - RQG: crash in Item_ref::val_str with subquery cache

This query:

SELECT SUBQUERY2_t1 .`col_int_key`
FROM B SUBQUERY2_t1 JOIN CC ON SUBQUERY2_t1 .`col_int_key`
WHERE table1 .`col_varchar_key` ) , table2 .`col_varchar_nokey` field10
FROM D table1 JOIN ( C table2 STRAIGHT_JOIN C table3 ON table2 .`pk` ) ON table3 .`col_varchar_key` = table2 .`col_varchar_key`
GROUP BY field10 ;

causes the following backtrace:

#3 0x0827e8f8 in handle_segfault (sig=11) at mysqld.cc:2703
#4 <signal handler called>
#5 0x081c7bd8 in Item_ref::val_str (this=0xb5e461d8, tmp=0xb5e463c0) at item.cc:6465
#6 0x081f8fe0 in Arg_comparator::compare_string (this=0xb5e46374) at item_cmpfunc.cc:1277
#7 0x081deb78 in Arg_comparator::compare (this=0xb5e46374) at item_cmpfunc.h:81
#8 0x081fad0f in Item_func_eq::val_int (this=0xb5e462f8) at item_cmpfunc.cc:1970
#9 0x0849757e in Expression_cache_tmptable::check_value (this=0xb5e457a8, value=0xb60d1a64) at sql_expression_cache.cc:250
#10 0x081c8556 in Item_cache_wrapper::check_cache (this=0xb5e456d0) at item.cc:6710
#11 0x081c8a6c in Item_cache_wrapper::val_str (this=0xb5e456d0, str=0xb5e45ac4) at item.cc:6827
#12 0x081c0c84 in Item_copy_string::copy (this=0xb5e45ab8) at item.cc:3452
#13 0x08327ae8 in copy_fields (param=0xb5e3fecc) at sql_select.cc:17251
#14 0x083202ab in end_send_group (join=0xb5e3b238, join_tab=0xb5e16e60, end_of_records=false) at sql_select.cc:14236
#15 0x0831df08 in evaluate_join_record (join=0xb5e3b238, join_tab=0xb5e16ca0, error=0) at sql_select.cc:13294
#16 0x0831d8af in sub_select (join=0xb5e3b238, join_tab=0xb5e16ca0, end_of_records=false) at sql_select.cc:13103
#17 0x0831df08 in evaluate_join_record (join=0xb5e3b238, join_tab=0xb5e16ae0, error=0) at sql_select.cc:13294
#18 0x0831d9fd in sub_select (join=0xb5e3b238, join_tab=0xb5e16ae0, end_of_records=false) at sql_select.cc:13142
#19 0x0831ccae in do_select (join=0xb5e3b238, fields=0xb5e3ffd8, table=0x0, procedure=0x0) at sql_select.cc:12649
#20 0x083030cf in JOIN::exec (this=0xb5e3b238) at sql_select.cc:2355
#21 0x08303802 in mysql_select (thd=0xae49e90, rref_pointer_array=0xae4b904, tables=0xb5d49780, wild_num=0, fields=..., conds=0x0, og_num=1, order=0x0,
group=0xb5e15840, having=0x0, proc_param=0x0, select_options=2147764736, result=0xb5e158e8, unit=0xae4b568, select_lex=0xae4b800) at sql_select.cc:2556
#22 0x082fbecf in handle_select (thd=0xae49e90, lex=0xae4b50c, result=0xb5e158e8, setup_tables_done_option=0) at sql_select.cc:276
#23 0x0829a5f0 in execute_sqlcom_select (thd=0xae49e90, all_tables=0xb5d49780) at sql_parse.cc:5081
#24 0x08290fd0 in mysql_execute_command (thd=0xae49e90) at sql_parse.cc:2265
#25 0x0829c7d1 in mysql_parse (thd=0xae49e90,
inBuf=0xb5d480b0 "/* cache is on */ SELECT COUNT( DISTINCT table2 .`col_int_key` ) , (\nSELECT SUBQUERY2_t1 .`col_int_key`\nFROM B SUBQUERY2_t1 JOIN CC ON SUBQUERY2_t1 .`col_int_key`\nWHERE table1 .`col_varchar_key`"..., length=394, found_semicolon=0xb60d3230) at sql_parse.cc:6027
#26 0x0828ea02 in dispatch_command (command=COM_QUERY, thd=0xae49e90, packet=0xae62271 "", packet_length=397) at sql_parse.cc:1184
#27 0x0828dea8 in do_command (thd=0xae49e90) at sql_parse.cc:890
#28 0x0828b008 in handle_one_connection (arg=0xae49e90) at sql_connect.cc:1153
#29 0x00a08919 in start_thread () from /lib/libpthread.so.0
#30 0x00951e5e in clone () from /lib/libc.so.6