Server crashes in Item_field::used_tables/Item_window_func::update_used_tables

create table t (a int primary key, b int);

insert into t values (1,1);

SELECT a, b, SUM(a) OVER (PARTITION BY b) MEMBER OF ('[3]') m FROM t;

#4  0x000061ba47581551 in handle_fatal_signal (sig=11) at /13/sql/signal_handler.cc:298

#5  <signal handler called>

#6  0x000061ba4762a4fc in Item_field::used_tables (this=0x52d0001730c8) at /13/sql/item.cc:3769

#7  0x000061ba486c2c05 in Item_window_func::update_used_tables (this=0x52d000173338) at /13/sql/item_windowfunc.cc:72

#8  0x000061ba47436405 in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join (this=this@entry=0x52d0001754a0, item=0x52d000173338) at /13/sql/item.h:6005

#9  0x000061ba4743644c in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join (this=0x52d0001754a0, argc=1, argv=0x52d000175488) at /13/sql/item.h:6017

#10 0x000061ba4743651d in Item_func::update_used_tables (this=<optimized out>) at /13/sql/item_func.h:217

#11 0x000061ba48585bfc in Item_func_member_of::fix_length_and_dec (this=0x52d0001734f0, thd=0x52c0001a0220) at /13/sql/item_jsonfunc.cc:6861

#12 0x000061ba4770f322 in Item_func::fix_fields (this=0x52d0001734f0, thd=<optimized out>, ref=<optimized out>) at /13/sql/item_func.cc:412

#13 0x000061ba47649497 in Item::fix_fields_if_needed (this=this@entry=0x52d0001734f0, thd=<optimized out>, ref=<optimized out>) at /13/sql/item.h:763

#14 0x000061ba476494c5 in Item::fix_fields_if_needed_for_scalar (this=0x52d0001734f0, thd=<optimized out>, ref=<optimized out>) at /13/sql/item.h:1160

#15 0x000061ba47cffbdf in setup_fields (thd=0x52c0001a0220, ref_pointer_array=..., fields=..., column_usage=<optimized out>, sum_func_list=sum_func_list@entry=(List<Item> *) 0x52d000174be0 3 Item's, pre_fix=<optimized out>, allow_sum_func=<optimized out>, where=<optimized out>) at /13/sql/sql_base.cc:8335

#16 0x000061ba48031a71 in JOIN::prepare (this=this@entry=0x52d000174838, tables_init=tables_init@entry=0x52d0001736c0, conds_init=conds_init@entry=0x0, og_num=og_num@entry=0, order_init=order_init@entry=0x0, skip_order_by=skip_order_by@entry=false, group_init=<optimized out>, having_init=<optimized out>, proc_param_init=<optimized out>, select_lex_arg=<optimized out>, unit_arg=<optimized out>) at /13/sql/sql_select.cc:1599

#17 0x000061ba4808da0b in mysql_select (thd=thd@entry=0x52c0001a0220, tables=<optimized out>, fields=..., conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=<optimized out>, having=<optimized out>, proc_param=<optimized out>, select_options=2164525824, result=<optimized out>, unit=<optimized out>, select_lex=<optimized out>) at /13/sql/sql_select.cc:5411

#18 0x000061ba4808e3e3 in handle_select (thd=thd@entry=0x52c0001a0220, lex=lex@entry=0x52c0001a46d8, result=result@entry=0x52d000174800, setup_tables_done_option=setup_tables_done_option@entry=0) at /13/sql/sql_select.cc:637

#19 0x000061ba47eb5cf4 in execute_sqlcom_select (thd=thd@entry=0x52c0001a0220, all_tables=<optimized out>) at /13/sql/sql_parse.cc:6229

#20 0x000061ba47ed60d1 in mysql_execute_command (thd=thd@entry=0x52c0001a0220, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /13/sql/sql_parse.cc:3997

#21 0x000061ba47ee35a3 in mysql_parse (thd=thd@entry=0x52c0001a0220, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x6858df3461b0) at /13/sql/sql_parse.cc:7968

#22 0x000061ba47ee7257 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x52c0001a0220, packet=packet@entry=0x5290002b7221 "SELECT a, b, SUM(a) OVER (PARTITION BY b) MEMBER OF ('[3]') m FROM t", packet_length=packet_length@entry=68, blocking=blocking@entry=true) at /13/sql/sql_parse.cc:1903

#23 0x000061ba47eebbb6 in do_command (thd=thd@entry=0x52c0001a0220, blocking=blocking@entry=true) at /13/sql/sql_parse.cc:1437

#24 0x000061ba483db8b9 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x50b000005b20, put_in_cache=put_in_cache@entry=true) at /13/sql/sql_connect.cc:1514

#25 0x000061ba483dbcbf in handle_one_connection (arg=arg@entry=0x50b000005b20) at /13/sql/sql_connect.cc:1426

#26 0x00007058f5e5ea42 in asan_thread_start (arg=0x6858e0154000) at ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234

#27 0x00007058f509cb84 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447

#28 0x00007058f5129ecc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78