MDEV-16730: Server crashes in Bitmap<64u>::merge

The problem appears because of the pushdown of a non-pushable condition 'cond'
into the materialized derived table/view. To prevent pushdown a map of
tables that are used in 'cond' should be updated. This call is missing
because of the MDEV-12387 changes. The call is added in the
setup_jtbm_semi_joins() method.

mysql-test/main/in_subq_cond_pushdown.result

@@ -3814,3 +3814,20 @@ FROM t2
 WHERE t2.b IN (SELECT MIN(t1.a) from t1);
 b
 DROP TABLE t1, t2;
+#
+# MDEV-16730: server fault caused by pushdown into the derived table
+#             condition that joins IN subquery and parent select
+#
+CREATE TABLE t1 (a INT);
+INSERT INTO t1 VALUES (1), (2), (3);
+SELECT *
+FROM (SELECT DISTINCT * FROM t1) AS tbl
+WHERE tbl.a IN
+(
+SELECT COUNT(t1.a)
+FROM t1
+WHERE (t1.a!=1)
+);
+a
+2
+DROP TABLE t1;

mysql-test/main/in_subq_cond_pushdown.test

@@ -773,3 +773,22 @@ FROM t2
 WHERE t2.b IN (SELECT MIN(t1.a) from t1);
 
 DROP TABLE t1, t2;
+
+--echo #
+--echo # MDEV-16730: server fault caused by pushdown into the derived table
+--echo #             condition that joins IN subquery and parent select
+--echo #
+
+CREATE TABLE t1 (a INT);
+INSERT INTO t1 VALUES (1), (2), (3);
+
+SELECT *
+FROM (SELECT DISTINCT * FROM t1) AS tbl
+WHERE tbl.a IN
+(
+  SELECT COUNT(t1.a)
+  FROM t1
+  WHERE (t1.a!=1)
+);
+
+DROP TABLE t1;

sql/opt_subselect.cc

@@ -5924,6 +5924,7 @@ bool setup_jtbm_semi_joins(JOIN *join, List<TABLE_LIST> *join_list,
         Item *item;
         while ((item=li++))
         {
+          item->update_used_tables();
           if (eq_list.push_back(item, thd->mem_root))
             DBUG_RETURN(TRUE);
         }