Comment 2 for bug 752353

Simplified test case, now crashing:

CREATE TABLE t1 ( f1 int) ;
INSERT IGNORE INTO t1 VALUES (0),(0);

CREATE TABLE t2 ( f2 int, f3 int, f10 int, f11 int, KEY (f10,f3)) ;
INSERT IGNORE INTO t2 VALUES (5,6,0,0),(0,4,0,0);

CREATE TABLE t3 ( f3 int, f10 int, KEY (f10,f3) , KEY (f3) ) ;
INSERT IGNORE INTO t3 VALUES (6,0),(4,0);

SELECT *
FROM t1 JOIN
( t2 JOIN t3 ON t2.f10 = 1 OR t3.f3 = t2.f2 )
 ON t3.f3 <> t2.f3 AND t3.f10 = t2.f11 ;

backtrace:

#5 0x082693ae in Field::eq (this=0xae623cc0, field=0x3) at field.h:236
#6 0x083b525b in sel_trees_must_be_ored (param=0xae7fba58, tree1=0xae622020, tree2=0xae6221d8, oredable_keys=...) at opt_range.cc:8136
#7 0x083b5759 in tree_or (param=0xae7fba58, tree1=0xae622020, tree2=0xae6221d8) at opt_range.cc:8327
#8 0x083b213f in get_ne_mm_tree (param=0xae7fba58, cond_func=0xae613a48, field=0xae623cc0, lt_value=0xae6139a8, gt_value=0xae6139a8, cmp_type=INT_RESULT)
    at opt_range.cc:6765
#9 0x083b21e5 in get_func_mm_tree (param=0xae7fba58, cond_func=0xae613a48, field=0xae623cc0, value=0xae6139a8, cmp_type=INT_RESULT, inv=false)
    at opt_range.cc:6798
#10 0x083b2ac3 in get_full_func_mm_tree (param=0xae7fba58, cond_func=0xae613a48, field_item=0xae6138f8, value=0xae6139a8, inv=false) at opt_range.cc:7103
#11 0x083b37a5 in get_mm_tree (param=0xae7fba58, cond=0xae613a48) at opt_range.cc:7293
#12 0x083b2d07 in get_mm_tree (param=0xae7fba58, cond=0xae62d138) at opt_range.cc:7145
#13 0x083aaff1 in SQL_SELECT::test_quick_select (this=0xae62d2a8, thd=0xb305c80, keys_to_use=..., prev_tables=4611686018427387907,
    limit=18446744073709551615, force_quick_range=false, ordered_output=false) at opt_range.cc:3025
#14 0x0831b588 in make_join_select (join=0xae625b00, select=0xae62c8d0, cond=0xae62af60) at sql_select.cc:7418
#15 0x0830a74c in JOIN::optimize (this=0xae625b00) at sql_select.cc:1130
#16 0x0830f665 in mysql_select (thd=0xb305c80, rref_pointer_array=0xb30771c, tables=0xae612808, wild_num=1, fields=..., conds=0x0, og_num=0, order=0x0,
    group=0x0, having=0x0, proc_param=0x0, select_options=2147764736, result=0xae614150, unit=0xb30737c, select_lex=0xb307618) at sql_select.cc:2687
#17 0x08307f47 in handle_select (thd=0xb305c80, lex=0xb307320, result=0xae614150, setup_tables_done_option=0) at sql_select.cc:282
#18 0x082a5324 in execute_sqlcom_select (thd=0xb305c80, all_tables=0xae612808) at sql_parse.cc:5094
#19 0x0829c18a in mysql_execute_command (thd=0xb305c80) at sql_parse.cc:2239
#20 0x082a78c7 in mysql_parse (thd=0xb305c80,
    rawbuf=0xae612618 "SELECT *\nFROM t1 JOIN\n( t2 JOIN t3 ON t2.f10 = 1 OR t3.f3 = t2.f2 )\nON t3.f3 <> t2.f3 AND t3.f10 = t2.f11", length=105,
    found_semicolon=0xae7ff228) at sql_parse.cc:6094
#21 0x08299e13 in dispatch_command (command=COM_QUERY, thd=0xb305c80,
    packet=0xb360961 "SELECT *\nFROM t1 JOIN\n( t2 JOIN t3 ON t2.f10 = 1 OR t3.f3 = t2.f2 )\nON t3.f3 <> t2.f3 AND t3.f10 = t2.f11 ", packet_length=106)
    at sql_parse.cc:1215
#22 0x08299271 in do_command (thd=0xb305c80) at sql_parse.cc:904
#23 0x08296324 in handle_one_connection (arg=0xb305c80) at sql_connect.cc:1154
#24 0x00821919 in start_thread () from /lib/libpthread.so.0
#25 0x0076acce in clone () from /lib/libc.so.6