The query from the test case below, when run with subquery cache enabled, causes the server to crash as follows:

#3 0x0827e8f8 in handle_segfault (sig=11) at mysqld.cc:2703
#4 <signal handler called>
#5 0x0831f045 in join_read_next_same (info=0xb5f8bdcc) at sql_select.cc:13811
#6 0x0831d93e in sub_select (join=0xb5f5ea80, join_tab=0xb5f8bd88, end_of_records=false) at sql_select.cc:13122
#7 0x0831ccae in do_select (join=0xb5f5ea80, fields=0xb5f63820, table=0x0, procedure=0x0) at sql_select.cc:12649
#8 0x083030cf in JOIN::exec (this=0xb5f5ea80) at sql_select.cc:2355
#9 0x082352b1 in subselect_single_select_engine::exec (this=0xb5f46960) at item_subselect.cc:2716
#10 0x0822f9e3 in Item_subselect::exec (this=0xb5f468a0) at item_subselect.cc:481
#11 0x082308cd in Item_singlerow_subselect::val_int (this=0xb5f468a0) at item_subselect.cc:918
#12 0x081cf2fc in Item::val_int_result (this=0xb5f468a0) at item.h:779
#13 0x081cb196 in Item_cache_int::cache_value (this=0xb5f6c0c0) at item.cc:7712
#14 0x081d2f4c in Item_cache_wrapper::cache (this=0xb5f6c060) at item.cc:6725
#15 0x081c8812 in Item_cache_wrapper::val_int (this=0xb5f6c060) at item.cc:6779
#16 0x081cf2fc in Item::val_int_result (this=0xb5f6c060) at item.h:779
#17 0x083c2cbc in make_sortkey (param=0xb61d1c18,
to=0xb5f90d2c "\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245"...,
ref_pos=0xb5f4dd40 "\\\235\374\265\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245\245h4z\025\365\001") at filesort.cc:852
#18 0x083c2318 in find_all_keys (param=0xb61d1c18, select=0x0, sort_keys=0xb5f90978, buffpek_pointers=0xb61d1a50, tempfile=0xb61d1b34, indexfile=0x0)
at filesort.cc:625
#19 0x083c0ed1 in filesort (thd=0xa1d4fd0, table=0xb5f4c5f8, sortorder=0xb5f8da40, s_length=3, select=0x0, max_rows=18446744073709551615,
sort_positions=false, examined_rows=0xb61d1d80) at filesort.cc:246
#20 0x08324a74 in create_sort_index (thd=0xa1d4fd0, join=0xb5f54da0, order=0xb5f4aa28, filesort_limit=18446744073709551615,
select_limit=18446744073709551615, is_order_by=true) at sql_select.cc:15849
#21 0x08302dd4 in JOIN::exec (this=0xb5f54da0) at sql_select.cc:2298
#22 0x08303802 in mysql_select (thd=0xa1d4fd0, rref_pointer_array=0xa1d6a44, tables=0xb5f46ec8, wild_num=0, fields=..., conds=0xb5f4a8e0, og_num=4,
order=0x0, group=0xb5f4aa28, having=0xb5f4adc8, proc_param=0x0, select_options=2147764744, result=0xb5f4af48, unit=0xa1d66a8, select_lex=0xa1d6940)
at sql_select.cc:2556
#23 0x082fbecf in handle_select (thd=0xa1d4fd0, lex=0xa1d664c, result=0xb5f4af48, setup_tables_done_option=0) at sql_select.cc:276
#24 0x0829a5f0 in execute_sqlcom_select (thd=0xa1d4fd0, all_tables=0xb5f46ec8) at sql_parse.cc:5081
#25 0x08290fd0 in mysql_execute_command (thd=0xa1d4fd0) at sql_parse.cc:2265
#26 0x0829c7d1 in mysql_parse (thd=0xa1d4fd0,
inBuf=0xb5e48108 "/* cache is on */ SELECT SQL_SMALL_RESULT MAX( DISTINCT table1 . `col_varchar_key` ) AS field1 , MIN( table1 . `col_varchar_nokey` ) AS field2 , COUNT( table1 . `col_varchar_key` ) AS field3 , tab"..., length=1730, found_semicolon=0xb61d3230) at sql_parse.cc:6027
#27 0x0828ea02 in dispatch_command (command=COM_QUERY, thd=0xa1d4fd0,
packet=0xa1ed329 "/* cache is on */ SELECT SQL_SMALL_RESULT MAX( DISTINCT table1 . `col_varchar_key` ) AS field1 , MIN( table1 . `col_varchar_nokey` ) AS field2 , COUNT( table1 . `col_varchar_key` ) AS field3 , tab"..., packet_length=1731) at sql_parse.cc:1184
#28 0x0828dea8 in do_command (thd=0xa1d4fd0) at sql_parse.cc:890
#29 0x0828b008 in handle_one_connection (arg=0xa1d4fd0) at sql_connect.cc:1153
#30 0x00a08919 in start_thread () from /lib/libpthread.so.0
#31 0x00951e5e in clone () from /lib/libc.so.6