[Bug] SELECT INSTEAD with sub-query

I could find out a case to cause Assert() failure during investigation of RLS...

postgres=# CREATE TABLE t1 (x int, y text);
CREATE TABLE

postgres=# CREATE RULE "_RETURN" AS ON SELECT TO t1 DO INSTEAD SELECT
1 AS x, 'aaa'::text AS y;
CREATE RULE

postgres=# SELECT * FROM t1;
x | y
---+-----
1 | aaa
(1 row)

postgres=# SELECT tableoid, * FROM t1;
TRAP: FailedAssertion("!(attno >= rel->min_attr && attno <=
rel->max_attr)", File: "initsplan.c", Line: 180)
The connection to the server was lost. Attempting reset: LOG: server
process (PID 27345) was terminated by signal 6: Aborted
DETAIL: Failed process was running: SELECT tableoid, * FROM t1;

The failure scenario is obvious. Reference to "t1" was replaced by a sub-query
that does not have any system columns, however, the given query tries to the
column with negative attribute number. Then, it was caught on the
FailedAssertion.
How do we fix the problem? Please give us some comments.

Thanks,
--
KaiGai Kohei <kaigai(at)kaigai(dot)gr(dot)jp>