crash in st_select_lex::mark_as_dependent

Version: '10.0.1-MariaDB'  Source distribution

 Invalid write of size 1

at: st_select_lex::mark_as_dependent (sql_lex.cc:2189)

by: Item_sum::register_sum_func (item_sum.cc:366)

by: Item_sum::check_sum_func (item_sum.cc:164)

by: Item_sum_num::fix_fields (item_sum.cc:1156)

by: setup_conds (sql_base.cc:8901)

by: JOIN::prepare (sql_select.cc:613)

by: st_select_lex_unit::prepare (sql_union.cc:329)

by: mysql_derived_prepare (sql_derived.cc:623)

by: mysql_handle_single_derived (sql_derived.cc:179)

by: st_select_lex::handle_derived (sql_lex.cc:3543)

by: JOIN::prepare (sql_select.cc:672)

by: subselect_single_select_engine::prepare (item_subselect.cc:2999)

by: Item_subselect::fix_fields (item_subselect.cc:245)

by: find_order_in_list (sql_select.cc:19833)

by: setup_order (sql_select.cc:19859)

by: JOIN::prepare (sql_select.cc:620)

by: mysql_select (sql_select.cc:3172)

by: handle_select (sql_select.cc:363)

by: execute_sqlcom_select (sql_parse.cc:5004)

by: mysql_execute_command (sql_parse.cc:2472)

by: mysql_parse (sql_parse.cc:6124)

by: dispatch_command (sql_parse.cc:1266)

by: do_handle_one_connection (sql_connect.cc:1267)

by: handle_one_connection (sql_connect.cc:1181)

by: start_thread (pthread_create.c:309)

by: clone (clone.S:115)

  Address 0x102 is not stack'd, malloc'd or (recently) free'd

drop table if exists `v`;

create table `v`(`a` int)engine=innodb;

select 1 from `v` order by

(

	select 1 from 

	(

		select 1 from `v` `v1` right join `v` on count(*)

	) `v`   

);