Hi Daniel!
 
The test case should also look at the result of the:

select * from mysql.index_stats where index_name='a' and table_name='t1';
Added in the test case. Also, I got the explanation slightly wrong. It's not index_init that causes the problem, it's calling ha_index_first with a garbage buffer as a parameter that messes things up. The flags in table specifically say that (in that case) the table->record[0] is garbage, but we used it anyway.
 
> diff --git a/mysql-test/t/mdev-7362.test b/mysql-test/t/mdev-7362.test
> new file mode 100644
> index 0000000..6551893
> --- /dev/null
> +++ b/mysql-test/t/mdev-7362.test

more recent test cases include the area of the test failure in the filename or include the test with the general t/statistics.test
Hmm, I made a new file to test for this bug and named it statistics_index_crash.test. I don't think it fits going into the statistics.test. 

> @@ -0,0 +1,14 @@
> +CREATE TABLE t1 (a longtext, FULLTEXT KEY (`a`)) ENGINE=MyISAM;
> +insert into t1 values
> (unhex('3E0D0A4141414142334E7A6143317963324541414141424977414141674541726D'));
> +analyze table t1 persistent for all;
> +drop table t1;
> +
> +CREATE TABLE t1 (a longtext, FULLTEXT KEY (`a`)) ENGINE=MyISAM;
> +insert into t1 values
> (unhex('3E0D0A4141414142334E7A6143317963324541414141424977414141674541'));
> +analyze table t1 persistent for all;
> +drop table t1;
> +
> +CREATE TABLE t1 (f longtext NOT NULL, FULLTEXT KEY f (f)) ENGINE=MyISAM;
> +INSERT INTO t1 VALUES (REPEAT('a',27)),('foo');
> +ANALYZE TABLE t1 PERSISTENT FOR ALL;
> +drop table t1;

Can you please add a test case for innodb too as it supports FT in 10.0.
 Done.


> diff --git a/sql/sql_statistics.cc b/sql/sql_statistics.cc
> index d368145..2c1cccf 100644
> --- a/sql/sql_statistics.cc
> +++ b/sql/sql_statistics.cc
> @@ -2367,6 +2367,9 @@ int collect_statistics_for_index(THD *thd, TABLE
> *table, uint index)
> DBUG_RETURN(rc);
> }
> + if (key_info->flags & HA_FULLTEXT) // skip if FULLTEXT index
> + DBUG_RETURN(rc);
> +

If this is the fix the if..return can go much earlier in collect_statistics_for_index, before Index_prefix_calc() even.
Done.

Regards,
Vicențiu