Second crash in select_describe() and materialization

Even if bug 611690 is no longer repeatable, the following crash happens in both maria-5.3 and maria-5.3-mwl89

backtrace:

#3 0x08285887 in handle_segfault (sig=11) at mysqld.cc:2778
#4 <signal handler called>
#5 0x08331179 in select_describe (join=0xae5691a8, need_tmp_table=true, need_order=true, distinct=false, message=0x0) at sql_select.cc:19184
#6 0x083089de in JOIN::exec (this=0xae5691a8) at sql_select.cc:1966
#7 0x0830ab99 in mysql_select (thd=0xa30bbf8, rref_pointer_array=0xae532734, tables=0xae532b48, wild_num=0, fields=..., conds=0x0, og_num=1, order=0x0,
    group=0xae532e00, having=0x0, proc_param=0x0, select_options=2147764740, result=0xae5331c0, unit=0xae5327d0, select_lex=0xae532630) at sql_select.cc:2652
#8 0x08332fd9 in mysql_explain_union (thd=0xa30bbf8, unit=0xae5327d0, result=0xae5331c0) at sql_select.cc:19659
#9 0x08332bfe in select_describe (join=0xae562340, need_tmp_table=false, need_order=false, distinct=false, message=0x0) at sql_select.cc:19600
#10 0x083089de in JOIN::exec (this=0xae562340) at sql_select.cc:1966
#11 0x0830ab99 in mysql_select (thd=0xa30bbf8, rref_pointer_array=0xae531f54, tables=0xae532370, wild_num=0, fields=..., conds=0xae5672a0, og_num=0,
    order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147764740, result=0xae5331c0, unit=0xae531ff0, select_lex=0xae531e50)
    at sql_select.cc:2652
#12 0x08332fd9 in mysql_explain_union (thd=0xa30bbf8, unit=0xae531ff0, result=0xae5331c0) at sql_select.cc:19659
#13 0x08332bfe in select_describe (join=0xae55d4c0, need_tmp_table=false, need_order=false, distinct=false,
    message=0x88afd14 "Impossible WHERE noticed after reading const tables") at sql_select.cc:19600
#14 0x0831a213 in return_zero_rows (join=0xae55d4c0, result=0xae5331c0, tables=0xae531b90, fields=..., send_row=false, select_options=2147764740,
    info=0x88afd14 "Impossible WHERE noticed after reading const tables", having=0x0) at sql_select.cc:8993
#15 0x083086c1 in JOIN::exec (this=0xae55d4c0) at sql_select.cc:1928
#16 0x0830ab99 in mysql_select (thd=0xa30bbf8, rref_pointer_array=0xa30d694, tables=0xae531b90, wild_num=1, fields=..., conds=0xae533040, og_num=0,
    order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147764740, result=0xae5331c0, unit=0xa30d2f4, select_lex=0xa30d590)
    at sql_select.cc:2652
#17 0x08332fd9 in mysql_explain_union (thd=0xa30bbf8, unit=0xa30d2f4, result=0xae5331c0) at sql_select.cc:19659
#18 0x082a0dd6 in execute_sqlcom_select (thd=0xa30bbf8, all_tables=0xae531b90) at sql_parse.cc:5049
#19 0x08297f63 in mysql_execute_command (thd=0xa30bbf8) at sql_parse.cc:2234
#20 0x082a34ec in mysql_parse (thd=0xa30bbf8,
    rawbuf=0xae531960 "EXPLAIN SELECT * \nFROM t1 AS alias1\nWHERE alias1.f3 = (\nSELECT t1.f3 FROM t1\nWHERE ( t1.f10 ) IN ( SELECT f11 FROM t2 GROUP BY f11 )\n)", length=134, found_semicolon=0xae8a0228) at sql_parse.cc:6077
#21 0x08295bfb in dispatch_command (command=COM_QUERY, thd=0xa30bbf8, packet=0xa325d31 "", packet_length=134) at sql_parse.cc:1210
#22 0x082950a8 in do_command (thd=0xa30bbf8) at sql_parse.cc:903
#23 0x08292186 in handle_one_connection (arg=0xa30bbf8) at sql_connect.cc:1154
#24 0x00821919 in start_thread () from /lib/libpthread.so.0
#25 0x0076acce in clone () from /lib/libc.so.6

test case:

SET SESSION optimizer_switch = 'materialization=on';
CREATE TABLE t2 (f11 varchar(1)) ;
INSERT INTO t2 VALUES ('f'),('d');

CREATE TABLE t1 ( f1 int(11), f3 int(11), f10 varchar(1), KEY (f3)) ;
INSERT INTO t1 VALUES ('28','6','m'),('29','4','c');

EXPLAIN SELECT *
FROM t1 AS alias1
WHERE alias1.f3 = (
        SELECT t1.f3 FROM t1
        WHERE ( t1.f10 ) IN ( SELECT f11 FROM t2 GROUP BY f11 )
);