fixed crash on non-well-constructed reference

mysql-test/r/subselect.result

@@ -1012,3 +1012,5 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 2	UNCACHEABLE SUBSELECT	t1	ALL	NULL	NULL	NULL	NULL	3	
 3	UNCACHEABLE SUBSELECT	t1	ALL	NULL	NULL	NULL	NULL	3	
 drop table t1;
+select t1.Continent, t2.Name, t2.Population from t1 LEFT JOIN t2 ON t1.Code = t2.Country  where t2.Population IN (select max(t2.Population) AS Population from t2, t1 where t2.Country = t1.Code group by Continent);
+Table 'test.t1' doesn't exist

mysql-test/t/subselect.test

@@ -595,3 +595,9 @@ insert into t1 values (1), (2), (3);
 explain select a,(select (select rand() from t1 limit 1)  from t1 limit 1)
 from t1;
 drop table t1;
+
+#
+# error in IN
+#
+-- error 1146
+select t1.Continent, t2.Name, t2.Population from t1 LEFT JOIN t2 ON t1.Code = t2.Country  where t2.Population IN (select max(t2.Population) AS Population from t2, t1 where t2.Country = t1.Code group by Continent);

sql/item.h

@@ -486,7 +486,7 @@ public:
   enum Type type() const		{ return REF_ITEM; }
   bool eq(const Item *item, bool binary_cmp) const
   { return ref && (*ref)->eq(item, binary_cmp); }
-  ~Item_ref() { if (ref && (*ref) != this) delete *ref; }
+  ~Item_ref() { if (ref && (*ref) && (*ref) != this) delete *ref; }
   double val()
   {
     double tmp=(*ref)->val_result();

sql/item_subselect.cc

@@ -487,6 +487,8 @@ void Item_in_subselect::single_value_transformer(THD *thd,
       setup_ref_array(thd, &sl->ref_pointer_array,
 		      1 + sl->with_sum_func +
 		      sl->order_list.elements + sl->group_list.elements);
+      // To prevent crash on Item_ref_null_helper destruction in case of error
+      sl->ref_pointer_array[0]= 0;
       item= (*func)(expr, new Item_ref_null_helper(this,
 						   sl->ref_pointer_array,
 						   (char *)"<ref>",