diff --git a/mysql-test/r/subselect.result b/mysql-test/r/subselect.result
index 47f24a340cd..9170301ea4c 100644
--- a/mysql-test/r/subselect.result
+++ b/mysql-test/r/subselect.result
@@ -1012,3 +1012,5 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 2	UNCACHEABLE SUBSELECT	t1	ALL	NULL	NULL	NULL	NULL	3	
 3	UNCACHEABLE SUBSELECT	t1	ALL	NULL	NULL	NULL	NULL	3	
 drop table t1;
+select t1.Continent, t2.Name, t2.Population from t1 LEFT JOIN t2 ON t1.Code = t2.Country  where t2.Population IN (select max(t2.Population) AS Population from t2, t1 where t2.Country = t1.Code group by Continent);
+Table 'test.t1' doesn't exist
diff --git a/mysql-test/t/subselect.test b/mysql-test/t/subselect.test
index 1841e9f109a..c4827c69793 100644
--- a/mysql-test/t/subselect.test
+++ b/mysql-test/t/subselect.test
@@ -595,3 +595,9 @@ insert into t1 values (1), (2), (3);
 explain select a,(select (select rand() from t1 limit 1)  from t1 limit 1)
 from t1;
 drop table t1;
+
+#
+# error in IN
+#
+-- error 1146
+select t1.Continent, t2.Name, t2.Population from t1 LEFT JOIN t2 ON t1.Code = t2.Country  where t2.Population IN (select max(t2.Population) AS Population from t2, t1 where t2.Country = t1.Code group by Continent);
diff --git a/sql/item.h b/sql/item.h
index e262a9cb4e6..a94e1008021 100644
--- a/sql/item.h
+++ b/sql/item.h
@@ -486,7 +486,7 @@ public:
   enum Type type() const		{ return REF_ITEM; }
   bool eq(const Item *item, bool binary_cmp) const
   { return ref && (*ref)->eq(item, binary_cmp); }
-  ~Item_ref() { if (ref && (*ref) != this) delete *ref; }
+  ~Item_ref() { if (ref && (*ref) && (*ref) != this) delete *ref; }
   double val()
   {
     double tmp=(*ref)->val_result();
diff --git a/sql/item_subselect.cc b/sql/item_subselect.cc
index a29cf57b4e1..913734e0993 100644
--- a/sql/item_subselect.cc
+++ b/sql/item_subselect.cc
@@ -487,6 +487,8 @@ void Item_in_subselect::single_value_transformer(THD *thd,
       setup_ref_array(thd, &sl->ref_pointer_array,
 		      1 + sl->with_sum_func +
 		      sl->order_list.elements + sl->group_list.elements);
+      // To prevent crash on Item_ref_null_helper destruction in case of error
+      sl->ref_pointer_array[0]= 0;
       item= (*func)(expr, new Item_ref_null_helper(this,
 						   sl->ref_pointer_array,
 						   (char *)"<ref>",