Server crashes in st_select_lex::mark_const_derived on DELETE with ORDER BY and a subquery in RETURNING clause

CREATE TABLE t1 (i1 INT);

INSERT INTO t1 VALUES (1),(2);

CREATE TABLE t2 (i2 INT);

INSERT INTO t2 VALUES (1),(2);

DELETE FROM t1 ORDER BY i1 RETURNING ( SELECT i2 FROM t2 );

#3  <signal handler called>

#4  0x00000000006107f0 in st_select_lex::mark_const_derived (this=0x7f203c011ba0, empty=false) at 10.0-base/sql/sql_lex.cc:4088

#5  0x0000000000653ff3 in JOIN::exec_inner (this=0x7f203c02d998) at 10.0-base/sql/sql_select.cc:2492

#6  0x0000000000653367 in JOIN::exec (this=0x7f203c02d998) at 10.0-base/sql/sql_select.cc:2296

#7  0x000000000088e9ec in subselect_single_select_engine::exec (this=0x7f203c012e40) at 10.0-base/sql/item_subselect.cc:3683

#8  0x00000000008858ad in Item_subselect::exec (this=0x7f203c012d08) at 10.0-base/sql/item_subselect.cc:667

#9  0x000000000088702f in Item_singlerow_subselect::val_int (this=0x7f203c012d08) at 10.0-base/sql/item_subselect.cc:1247

#10 0x000000000080f40a in Item::send (this=0x7f203c012d08, protocol=0x210d610, buffer=0x7f2046885f10) at 10.0-base/sql/item.cc:6361

#11 0x0000000000579290 in Protocol::send_result_set_row (this=0x210d610, row_items=0x2110d80) at 10.0-base/sql/protocol.cc:900

#12 0x00000000005e19d7 in select_send::send_data (this=0x7f203c012ed0, items=...) at 10.0-base/sql/sql_class.cc:2364

#13 0x0000000000945410 in mysql_delete (thd=0x210d030, table_list=0x7f203c011490, conds=0x0, order_list=0x2110ea0, limit=18446744073709551615, options=0, result=0x7f203c012ed0) at 10.0-base/sql/sql_delete.cc:363

#14 0x000000000061c61a in mysql_execute_command (thd=0x210d030) at 10.0-base/sql/sql_parse.cc:3259

#15 0x0000000000624021 in mysql_parse (thd=0x210d030, rawbuf=0x7f203c011368 "DELETE FROM t1 ORDER BY i1 RETURNING ( SELECT i2 FROM t2 )", length=58, parser_state=0x7f2046887520) at 10.0-base/sql/sql_parse.cc:5974

#16 0x0000000000616fab in dispatch_command (command=COM_QUERY, thd=0x210d030, packet=0x2111ce1 "", packet_length=58) at 10.0-base/sql/sql_parse.cc:1094

#17 0x00000000006164a9 in do_command (thd=0x210d030) at 10.0-base/sql/sql_parse.cc:810

#18 0x000000000072fdbd in do_handle_one_connection (thd_arg=0x210d030) at 10.0-base/sql/sql_connect.cc:1266

#19 0x000000000072fb2b in handle_one_connection (arg=0x210d030) at 10.0-base/sql/sql_connect.cc:1181

#20 0x000000000098e552 in pfs_spawn_thread (arg=0x20a6430) at 10.0-base/storage/perfschema/pfs.cc:1015

#21 0x00007f204af74e9a in start_thread (arg=0x7f2046888700) at pthread_create.c:308

#22 0x00007f204a268cbd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112

revision-id: knielsen@knielsen-hq.org-20130816131025-etjrvmfvupsjzq83

revno: 3674

branch-nick: 10.0-base