Server is crashing in base_list::push_back/List<Item_field>::push_back

create table t1 (a int primary key, b int);

insert into t1 values (1,1);

create table t2 (c int);

insert into t2 values (1),(2);

set sql_mode='ONLY_FULL_GROUP_BY';

insert into t1 values (1,1) on duplicate key update b=(select max(t2.c + t1.b) from t2);

select * from t1;

set sql_mode=default;

drop table t2, t1;

#3  0x00005787465275a4 in my_write_core (sig=11) at //mysys/stacktrace.c:424

#4  0x000057874469f791 in handle_fatal_signal (sig=11) at //sql/signal_handler.cc:298

#5  <signal handler called>

#6  0x00005787445465b2 in base_list::push_back (this=0x10, info=0x52d000174540, mem_root=<optimized out>) at //sql/sql_list.h:190

#7  0x00005787449bdc38 in List<Item_field>::push_back (mem_root=<optimized out>, a=<optimized out>, this=<optimized out>) at //sql/sql_list.h:518

#8  Item_sum::check_sum_func (this=this@entry=0x52d000174760, thd=thd@entry=0x52c0001a0220, ref=ref@entry=0x52d0001748d0) at //sql/item_sum.cc:330

#9  0x00005787449bebc7 in Item_sum_min_max::fix_fields (this=0x52d000174760, thd=0x52c0001a0220, ref=<optimized out>) at //sql/item_sum.cc:1174

#10 0x00005787447656c7 in Item::fix_fields_if_needed (this=this@entry=0x52d000174760, thd=<optimized out>, ref=<optimized out>) at //sql/item.h:763

#11 0x00005787447656f5 in Item::fix_fields_if_needed_for_scalar (this=0x52d000174760, thd=<optimized out>, ref=<optimized out>) at //sql/item.h:1160

#12 0x0000578744df7625 in setup_fields (thd=0x52c0001a0220, ref_pointer_array=..., fields=..., column_usage=<optimized out>, sum_func_list=sum_func_list@entry=(List<Item> *) 0x52d000176220 1 Item's, pre_fix=<optimized out>, allow_sum_func=<optimized out>, where=<optimized out>) at //sql/sql_base.cc:8312

#13 0x0000578745114b4f in JOIN::prepare (this=0x52d000175e78, tables_init=<optimized out>, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=skip_order_by@entry=false, group_init=<optimized out>, having_init=<optimized out>, proc_param_init=<optimized out>, select_lex_arg=<optimized out>, unit_arg=<optimized out>) at //sql/sql_select.cc:1598

#14 0x000057874496ed4a in subselect_single_select_engine::prepare (this=<optimized out>, thd=0x52c0001a0220) at //sql/item_subselect.cc:3984

#15 0x000057874496d2f9 in Item_subselect::fix_fields (this=0x52d0001759b8, thd_param=0x52c0001a0220, ref=<optimized out>) at //sql/item_subselect.cc:294

#16 0x00005787447656c7 in Item::fix_fields_if_needed (this=this@entry=0x52d0001759b8, thd=<optimized out>, ref=<optimized out>) at //sql/item.h:763

#17 0x00005787447656f5 in Item::fix_fields_if_needed_for_scalar (this=0x52d0001759b8, thd=<optimized out>, ref=<optimized out>) at //sql/item.h:1160

#18 0x0000578744df7625 in setup_fields (thd=thd@entry=0x52c0001a0220, ref_pointer_array=..., fields=..., column_usage=column_usage@entry=MARK_COLUMNS_READ, sum_func_list=sum_func_list@entry=0x0, pre_fix=<optimized out>, allow_sum_func=<optimized out>, where=<optimized out>) at //sql/sql_base.cc:8312

#19 0x0000578744ed6646 in mysql_prepare_insert (thd=thd@entry=0x52c0001a0220, table_list=table_list@entry=0x52d000172600, fields=..., values=values@entry=(List_item *) 0x52d000173268 2 Item's, update_fields=..., update_values=..., duplic=<optimized out>, ignore=<optimized out>, where=<optimized out>, select_insert=<optimized out>, cache_insert_values=<optimized out>) at //sql/sql_insert.cc:1864

#20 0x0000578744ef1843 in mysql_insert (thd=thd@entry=0x52c0001a0220, table_list=0x52d000172600, fields=..., values_list=..., update_fields=..., update_values=..., duplic=<optimized out>, ignore=<optimized out>, result=<optimized out>) at //sql/sql_insert.cc:826

#21 0x0000578744fc919f in mysql_execute_command (thd=thd@entry=0x52c0001a0220, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at //sql/sql_parse.cc:4502

#22 0x0000578744fd3d6c in mysql_parse (thd=thd@entry=0x52c0001a0220, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7054246f61a0) at //sql/sql_parse.cc:7945

#23 0x0000578744fd789b in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x52c0001a0220, packet=packet@entry=0x5290002b7221 "insert into t1 values (1,1) on duplicate key update b=(select max(t2.c + t1.b) from t2)", packet_length=packet_length@entry=87, blocking=blocking@entry=true) at //sql/sql_parse.cc:1903

#24 0x0000578744fdc1b7 in do_command (thd=thd@entry=0x52c0001a0220, blocking=blocking@entry=true) at //sql/sql_parse.cc:1437

#25 0x00005787454b4e9d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x50b000005b20, put_in_cache=put_in_cache@entry=true) at //sql/sql_connect.cc:1510

#26 0x00005787454b52a3 in handle_one_connection (arg=arg@entry=0x50b000005b20) at //sql/sql_connect.cc:1422

#27 0x0000785439e5ea42 in asan_thread_start (arg=0x7054255f0000) at ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234

#28 0x0000785438e9cb84 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447

#29 0x0000785438f29ecc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78