Server crashes in Item_equal_iterator<List_iterator_fast, Item>::get_curr_field from get_full_func_mm_tree

CREATE TABLE t1 (i1 INT, j1 INT) ENGINE=MyISAM;

INSERT INTO t1 VALUES (1,8);

CREATE TABLE t2 (i2 INT, KEY(i2)) ENGINE=MyISAM;

INSERT INTO t2 VALUES (8),(9);

CREATE TABLE t3 (i3 INT) ENGINE=MyISAM;

INSERT INTO t3 VALUES (0),(0);

SELECT * FROM t1, t2 WHERE i1 = i2 AND ( ( SELECT MAX(i3) FROM t3 ) OR ( j1 > 27 AND j1 < 100 OR j1 <= 3 ) AND j1 = i2 );

bzr version-info

revision-id: igor@askmonty.org-20130823153435-h0x3db9sjxsov8uc

revno: 3860

branch-nick: 5.5

#3  <signal handler called>

#4  0x000000000067ff96 in Item_equal_iterator<List_iterator_fast, Item>::get_curr_field (this=0x7f3dab94d380) at 5.5/sql/item_cmpfunc.h:1850

#5  0x00000000008d8e53 in get_full_func_mm_tree (param=0x7f3dab94d9b0, cond_func=0x7f3da0027c88, field_item=0x7f3da0027af8, value=0x7f3da0027bf8, inv=false) at 5.5/sql/opt_range.cc:7346

#6  0x00000000008d9c05 in get_mm_tree (param=0x7f3dab94d9b0, cond=0x7f3da0027c88) at 5.5/sql/opt_range.cc:7534

#7  0x00000000008d9042 in get_mm_tree (param=0x7f3dab94d9b0, cond=0x7f3da0028108) at 5.5/sql/opt_range.cc:7380

#8  0x00000000008d910c in get_mm_tree (param=0x7f3dab94d9b0, cond=0x7f3da0028528) at 5.5/sql/opt_range.cc:7390

#9  0x00000000008d9042 in get_mm_tree (param=0x7f3dab94d9b0, cond=0x7f3da0028c08) at 5.5/sql/opt_range.cc:7380

#10 0x00000000008cfd6a in SQL_SELECT::test_quick_select (this=0x7f3da002cea0, thd=0x3126090, keys_to_use=..., prev_tables=0, limit=18446744073709551615, force_quick_range=false, ordered_output=false) at 5.5/sql/opt_range.cc:3053

#11 0x0000000000647c49 in get_quick_record_count (thd=0x3126090, select=0x7f3da002cea0, table=0x7f3da001a430, keys=0x7f3da002c350, limit=18446744073709551615) at 5.5/sql/sql_select.cc:3111

#12 0x0000000000649a51 in make_join_statistics (join=0x7f3da0028e08, tables_list=..., conds=0x7f3da0028c08, keyuse_array=0x7f3da0029110) at 5.5/sql/sql_select.cc:3667

#13 0x0000000000640ef9 in JOIN::optimize (this=0x7f3da0028e08) at 5.5/sql/sql_select.cc:1209

#14 0x00000000006479b7 in mysql_select (thd=0x3126090, rref_pointer_array=0x3129ce8, tables=0x7f3da0007778, wild_num=1, fields=..., conds=0x7f3da0028c08, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7f3da0028de8, unit=0x31293a8, select_lex=0x3129a80) at 5.5/sql/sql_select.cc:3060

#15 0x000000000063e472 in handle_select (thd=0x3126090, lex=0x31292f8, result=0x7f3da0028de8, setup_tables_done_option=0) at 5.5/sql/sql_select.cc:318

#16 0x0000000000617230 in execute_sqlcom_select (thd=0x3126090, all_tables=0x7f3da0007778) at 5.5/sql/sql_parse.cc:4651

#17 0x000000000060fc7f in mysql_execute_command (thd=0x3126090) at 5.5/sql/sql_parse.cc:2205

#18 0x0000000000619ad0 in mysql_parse (thd=0x3126090, rawbuf=0x7f3da00074c8 "SELECT * FROM t1, t2 WHERE i1 = i2 AND ( ( SELECT MAX(i3) FROM t3 ) OR ( j1 > 27 AND j1 < 100 OR j1 <= 3 ) AND j1 = i2 )", length=120, parser_state=0x7f3dab951500) at 5.5/sql/sql_parse.cc:5769

#19 0x000000000060d149 in dispatch_command (command=COM_QUERY, thd=0x3126090, packet=0x31976e1 "SELECT * FROM t1, t2 WHERE i1 = i2 AND ( ( SELECT MAX(i3) FROM t3 ) OR ( j1 > 27 AND j1 < 100 OR j1 <= 3 ) AND j1 = i2 )", packet_length=120) at 5.5/sql/sql_parse.cc:1071

#20 0x000000000060c359 in do_command (thd=0x3126090) at 5.5/sql/sql_parse.cc:794

#21 0x0000000000713685 in do_handle_one_connection (thd_arg=0x3126090) at 5.5/sql/sql_connect.cc:1266

#22 0x000000000071306c in handle_one_connection (arg=0x3126090) at 5.5/sql/sql_connect.cc:1181

#23 0x0000000000961f2c in pfs_spawn_thread (arg=0x3145b00) at 5.5/storage/perfschema/pfs.cc:1015

#24 0x00007f3daf83de9a in start_thread (arg=0x7f3dab952700) at pthread_create.c:308

#25 0x00007f3daeb31cbd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112