Comment 11 for bug 1384568

I am able to trigger the crash with:
DROP table t1; CREATE TABLE t1(a INT KEY,b text) ENGINE=InnoDB; select * FROM t1 where (a,b) in ((0,0),(5,0),(4,3));
but not with:
DROP table t1;CREATE TABLE t1(a INT KEY,b int)ENGINE=InnoDB; select * FROM t1 where (a,b) in ((0,0),(5,0),(4,3));

Tested on MySQL Community 5.6.21. Error log:
Thread pointer: 0x2bebb90
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 7f7cc321de50 thread_stack 0x40000
/usr/sbin/mysqld(my_print_stacktrace+0x3b)[0x8efafb]
/usr/sbin/mysqld(handle_fatal_signal+0x491)[0x6841b1]
/lib64/libpthread.so.0[0x38e500f6d0]
/lib64/libc.so.6[0x38e494daf0]
/usr/sbin/mysqld(_ZN6String4copyERKS_+0x26)[0x743566]
/usr/sbin/mysqld(_ZN20cmp_item_sort_string11store_valueEP4Item+0x33)[0x5fed03]
/usr/sbin/mysqld(_ZN12cmp_item_row11store_valueEP4Item+0x7c)[0x5fa36c]
/usr/sbin/mysqld(_ZN12Item_func_in18fix_length_and_decEv+0x8b4)[0x5fade4]
/usr/sbin/mysqld(_ZN9Item_func10fix_fieldsEP3THDPP4Item+0x21d)[0x61801d]
/usr/sbin/mysqld(_ZN12Item_func_in10fix_fieldsEP3THDPP4Item+0x13)[0x5f0b73]
/usr/sbin/mysqld(_Z11setup_condsP3THDP10TABLE_LISTS2_PP4Item+0x10a)[0x6bd1ca]
/usr/sbin/mysqld(_ZN4JOIN7prepareEP10TABLE_LISTjP4ItemjP8st_orderS5_S3_P13st_select_lexP18st_select_lex_unit+0x51b)[0x71bd6b]
/usr/sbin/mysqld(_Z12mysql_selectP3THDP10TABLE_LISTjR4ListI4ItemEPS4_P10SQL_I_ListI8st_orderESB_S7_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x89e)[0x7254fe]
/usr/sbin/mysqld(_Z13handle_selectP3THDP13select_resultm+0x175)[0x725745]
/usr/sbin/mysqld[0x58cd70]
/usr/sbin/mysqld(_Z21mysql_execute_commandP3THD+0x34a4)[0x701d14]
/usr/sbin/mysqld(_Z11mysql_parseP3THDPcjP12Parser_state+0x3a8)[0x704fb8]
/usr/sbin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcj+0xf90)[0x7066d0]
/usr/sbin/mysqld(_Z24do_handle_one_connectionP3THD+0x152)[0x6d48c2]
/usr/sbin/mysqld(handle_one_connection+0x40)[0x6d4980]
/usr/sbin/mysqld(pfs_spawn_thread+0x143)[0xb355e3]
/lib64/libpthread.so.0[0x38e5007ee5]
/lib64/libc.so.6(clone+0x6d)[0x38e48f4b8d]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (7f7c9c006cd0): select * FROM t1 where (a,b) in ((0,0),(5,0),(4,3))
Connection ID (thread ID): 1