Crash on subquery with order by window function of window function

create table t (c int);

explain update t set c=1 where exists (

  select * union select nullif(avg(1) over (order by 1), avg(1) over (order by 1)) x

  from t order by x=avg(row_number() over t) over (order by 1));

drop table t;

```c++

#0  Exec_time_tracker::get_loops (this=0xa5a5a5a5a5a5a5a5) at ../src/sql/sql_analyze_stmt.h:112

#1  0x00005555565dfec1 in Filesort_tracker::report_use (this=0xa5a5a5a5a5a5a5a5, thd=0x7fffe0000d58, r_limit_arg=18446744073709551615) at ../src/sql/sql_analyze_stmt.h:286

#2  0x00005555565d6193 in filesort (thd=0x7fffe0000d58, table=0x7fffe004f0b0, filesort=0x7fffe0042348, tracker=0xa5a5a5a5a5a5a5a5, join=0x7fffe003fd08, first_table_bit=1) at ../src/sql/filesort.cc:267

#3  0x0000555556a6c860 in create_sort_index (thd=0x7fffe0000d58, join=0x7fffe003fd08, tab=0x7fffe0041490, fsort=0x7fffe0042348) at ../src/sql/sql_select.cc:26571

#4  0x0000555556cca651 in Window_funcs_sort::exec (this=0x7fffe00422b0, join=0x7fffe003fd08, keep_filesort_result=true) at ../src/sql/sql_window.cc:3081

#5  0x0000555556ccafd9 in Window_funcs_computation::exec (this=0x7fffe0042290, join=0x7fffe003fd08, keep_last_filesort_result=true) at ../src/sql/sql_window.cc:3216

#6  0x0000555556a6a701 in AGGR_OP::end_send (this=0x7fffe001e6f8) at ../src/sql/sql_select.cc:32214

#7  0x0000555556a43a54 in sub_select_postjoin_aggr (join=0x7fffe003fd08, join_tab=0x7fffe0041490, end_of_records=true) at ../src/sql/sql_select.cc:22711

#8  0x0000555556a22721 in sub_select (join=0x7fffe003fd08, join_tab=0x7fffe00410c8, end_of_records=true) at ../src/sql/sql_select.cc:22964

#9  0x0000555556a4a100 in do_select (join=0x7fffe003fd08, procedure=0x0) at ../src/sql/sql_select.cc:22548

#10 0x0000555556a490fb in JOIN::exec_inner (this=0x7fffe003fd08) at ../src/sql/sql_select.cc:4985

#11 0x0000555556a4820c in JOIN::exec (this=0x7fffe003fd08) at ../src/sql/sql_select.cc:4769

#12 0x0000555556a235a2 in mysql_select (thd=0x7fffe0000d58, tables=0x7fffe00178a0, fields={...}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2199023255552, result=0x7fffe001aa60, unit=0x7fffe0017858, select_lex=0x7fffe00199e0) at ../src/sql/sql_select.cc:5243

#13 0x0000555556b0e520 in st_select_lex_unit::exec (this=0x7fffe0017858) at ../src/sql/sql_union.cc:2408

#14 0x00005555569058ca in subselect_union_engine::exec (this=0x7fffe001aa90) at ../src/sql/item_subselect.cc:4174

#15 0x00005555568f583d in Item_subselect::exec (this=0x7fffe001a8f0) at ../src/sql/item_subselect.cc:816

#16 0x00005555568f9a45 in Item_exists_subselect::val_bool (this=0x7fffe001a8f0) at ../src/sql/item_subselect.cc:1878

#17 0x00005555565ff902 in Item::eval_const_cond (this=0x7fffe001a8f0) at ../src/sql/item.h:1752

#18 0x0000555556a61197 in Item::remove_eq_conds (this=0x7fffe001a8f0, thd=0x7fffe0000d58, cond_value=0x7fffe001b1a0, top_level_arg=true) at ../src/sql/sql_select.cc:19836

#19 0x0000555556a33124 in optimize_cond (join=0x7fffe001ae10, conds=0x7fffe001a8f0, join_list=0x7fffe0005b98, ignore_on_conds=false, cond_value=0x7fffe001b1a0, cond_equal=0x7fffe001b2c8, flags=1) at ../src/sql/sql_select.cc:19380

#20 0x0000555556a2f6c7 in JOIN::optimize_inner (this=0x7fffe001ae10) at ../src/sql/sql_select.cc:2377

#21 0x0000555556a2b820 in JOIN::optimize (this=0x7fffe001ae10) at ../src/sql/sql_select.cc:1970

#22 0x0000555556a234d3 in mysql_select (thd=0x7fffe0000d58, tables=0x7fffe0016970, fields={...}, conds=0x7fffe001a8f0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=37383395344516, result=0x7fffe001ad00, unit=0x7fffe00051b8, select_lex=0x7fffe00059e8) at ../src/sql/sql_select.cc:5229

#23 0x0000555556b27be8 in mysql_multi_update (thd=0x7fffe0000d58, table_list=0x7fffe0016970, fields=0x7fffe0005ca0, values=0x7fffe0006108, conds=0x7fffe001a8f0, options=4, handle_duplicates=DUP_ERROR, ignore=false, unit=0x7fffe00051b8, select_lex=0x7fffe00059e8, result=0x7ffff0a7aeb8) at ../src/sql/sql_update.cc:2021

#24 0x00005555569bcde7 in mysql_execute_command (thd=0x7fffe0000d58, is_called_from_prepared_stmt=false) at ../src/sql/sql_parse.cc:4552

#25 0x00005555569b516d in mysql_parse (thd=0x7fffe0000d58, rawbuf=0x7fffe0016750 "explain update t set c=1 where exists (\nselect * union select nullif(avg(1) over (order by 1), avg(1) over (order by 1)) x\nfrom t order by x=avg(row_number() over t) over (order by 1))", length=184, parser_state=0x7ffff0a7c218) at ../src/sql/sql_parse.cc:8184

Thread 7 received signal SIGSEGV, Segmentation fault.

Exec_time_tracker::get_loops (this=0xa5a5a5a5a5a5a5a5) at ../src/sql/sql_analyze_stmt.h:112

112       ulonglong get_loops() const { return count; }