MDEV-5991: crash in Item_field::used_tablesmariadb-5.5.37

Units of subqueroes from excluded expressions should be excluded from select_lex/select_unit tree.

7 files changed, 55 insertions, 1 deletions

diff --git a/mysql-test/r/subselect.result b/mysql-test/r/subselect.result
index eacc254a083..4afde93925d 100644
--- a/mysql-test/r/subselect.result
+++ b/mysql-test/r/subselect.result
@@ -7007,3 +7007,11 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 2	SUBQUERY	t1	index	a	a	5	NULL	2	Using where; Using index
 2	SUBQUERY	t2	ref	b	b	5	test.t1.a	2	Using index
 DROP TABLE t1,t2;
+#
+# MDEV-5991: crash in Item_field::used_tables
+#
+create table t1 (c int);
+select exists(select 1 from t1 group by `c` in (select `c` from t1));
+exists(select 1 from t1 group by `c` in (select `c` from t1))
+0
+drop table t1;
diff --git a/mysql-test/r/subselect_no_mat.result b/mysql-test/r/subselect_no_mat.result
index 56474bc8e02..9df216da3cb 100644
--- a/mysql-test/r/subselect_no_mat.result
+++ b/mysql-test/r/subselect_no_mat.result
@@ -7004,6 +7004,14 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 2	SUBQUERY	t1	index	a	a	5	NULL	2	Using where; Using index
 2	SUBQUERY	t2	ref	b	b	5	test.t1.a	2	Using index
 DROP TABLE t1,t2;
+#
+# MDEV-5991: crash in Item_field::used_tables
+#
+create table t1 (c int);
+select exists(select 1 from t1 group by `c` in (select `c` from t1));
+exists(select 1 from t1 group by `c` in (select `c` from t1))
+0
+drop table t1;
 set optimizer_switch=default;
 select @@optimizer_switch like '%materialization=on%';
 @@optimizer_switch like '%materialization=on%'
diff --git a/mysql-test/r/subselect_no_opts.result b/mysql-test/r/subselect_no_opts.result
index 3e1b002473a..7b93f277274 100644
--- a/mysql-test/r/subselect_no_opts.result
+++ b/mysql-test/r/subselect_no_opts.result
@@ -7002,4 +7002,12 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 2	SUBQUERY	t1	index	a	a	5	NULL	2	Using where; Using index
 2	SUBQUERY	t2	ref	b	b	5	test.t1.a	2	Using index
 DROP TABLE t1,t2;
+#
+# MDEV-5991: crash in Item_field::used_tables
+#
+create table t1 (c int);
+select exists(select 1 from t1 group by `c` in (select `c` from t1));
+exists(select 1 from t1 group by `c` in (select `c` from t1))
+0
+drop table t1;
 set @optimizer_switch_for_subselect_test=null;
diff --git a/mysql-test/r/subselect_no_scache.result b/mysql-test/r/subselect_no_scache.result
index 8d628ef2d9a..b6d3a89ea7a 100644
--- a/mysql-test/r/subselect_no_scache.result
+++ b/mysql-test/r/subselect_no_scache.result
@@ -7013,6 +7013,14 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 2	SUBQUERY	t1	index	a	a	5	NULL	2	Using where; Using index
 2	SUBQUERY	t2	ref	b	b	5	test.t1.a	2	Using index
 DROP TABLE t1,t2;
+#
+# MDEV-5991: crash in Item_field::used_tables
+#
+create table t1 (c int);
+select exists(select 1 from t1 group by `c` in (select `c` from t1));
+exists(select 1 from t1 group by `c` in (select `c` from t1))
+0
+drop table t1;
 set optimizer_switch=default;
 select @@optimizer_switch like '%subquery_cache=on%';
 @@optimizer_switch like '%subquery_cache=on%'
diff --git a/mysql-test/r/subselect_no_semijoin.result b/mysql-test/r/subselect_no_semijoin.result
index d0e9ae225d9..d51d211e71d 100644
--- a/mysql-test/r/subselect_no_semijoin.result
+++ b/mysql-test/r/subselect_no_semijoin.result
@@ -7002,5 +7002,13 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 2	SUBQUERY	t1	index	a	a	5	NULL	2	Using where; Using index
 2	SUBQUERY	t2	ref	b	b	5	test.t1.a	2	Using index
 DROP TABLE t1,t2;
+#
+# MDEV-5991: crash in Item_field::used_tables
+#
+create table t1 (c int);
+select exists(select 1 from t1 group by `c` in (select `c` from t1));
+exists(select 1 from t1 group by `c` in (select `c` from t1))
+0
+drop table t1;
 set @optimizer_switch_for_subselect_test=null;
 set @join_cache_level_for_subselect_test=NULL;
diff --git a/mysql-test/t/subselect.test b/mysql-test/t/subselect.test
index e7cb505b19f..d1c3774947a 100644
--- a/mysql-test/t/subselect.test
+++ b/mysql-test/t/subselect.test
@@ -5884,3 +5884,9 @@ EXPLAIN SELECT * FROM t1 WHERE EXISTS ( SELECT a FROM t1, t2 WHERE b = a GROUP B
 
 DROP TABLE t1,t2;
 
+--echo #
+--echo # MDEV-5991: crash in Item_field::used_tables
+--echo #
+create table t1 (c int);
+select exists(select 1 from t1 group by `c` in (select `c` from t1));
+drop table t1;
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 50d700b56b4..fcadecdb85f 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -496,6 +496,7 @@ fix_inner_refs(THD *thd, List<Item> &all_fields, SELECT_LEX *select,
 static
 void remove_redundant_subquery_clauses(st_select_lex *subq_select_lex)
 {
+  DBUG_ENTER("remove_redundant_subquery_clauses");
   Item_subselect *subq_predicate= subq_select_lex->master_unit()->item;
   /*
     The removal should happen for IN, ALL, ANY and EXISTS subqueries,
@@ -505,7 +506,7 @@ void remove_redundant_subquery_clauses(st_select_lex *subq_select_lex)
        b) SELECT a, (<single row subquery) FROM t1
    */
   if (subq_predicate->substype() == Item_subselect::SINGLEROW_SUBS)
-    return;
+    DBUG_VOID_RETURN;
 
   /* A subquery that is not single row should be one of IN/ALL/ANY/EXISTS. */
   DBUG_ASSERT (subq_predicate->substype() == Item_subselect::EXISTS_SUBS ||
@@ -515,6 +516,7 @@ void remove_redundant_subquery_clauses(st_select_lex *subq_select_lex)
   {
     subq_select_lex->join->select_distinct= false;
     subq_select_lex->options&= ~SELECT_DISTINCT;
+    DBUG_PRINT("info", ("DISTINCT removed"));
   }
 
   /*
@@ -524,8 +526,13 @@ void remove_redundant_subquery_clauses(st_select_lex *subq_select_lex)
   if (subq_select_lex->group_list.elements &&
       !subq_select_lex->with_sum_func && !subq_select_lex->join->having)
   {
+    for (ORDER *ord= subq_select_lex->group_list.first; ord; ord= ord->next)
+    {
+      (*ord->item)->walk(&Item::eliminate_subselect_processor, FALSE, NULL);
+    }
     subq_select_lex->join->group_list= NULL;
     subq_select_lex->group_list.empty();
+    DBUG_PRINT("info", ("GROUP BY removed"));
   }
 
   /*
@@ -540,6 +547,7 @@ void remove_redundant_subquery_clauses(st_select_lex *subq_select_lex)
     subq_select_lex->group_list.empty();
   }
   */
+  DBUG_VOID_RETURN;
 }