The problem was that expression with field after transformation (on the first execution)

reached by fix_fields() (via reference) before row which it belongs to (on the second execution)
and fix_field for row did not follow usual protocol for Items with argument
(first check that the item fixed then call fix_fields).

Item_row::fix_field fixed.

4 files changed, 52 insertions, 1 deletions

diff --git a/mysql-test/r/subselect_sj.result b/mysql-test/r/subselect_sj.result
index ad2d5f760e8..01ad6f9712f 100644
--- a/mysql-test/r/subselect_sj.result
+++ b/mysql-test/r/subselect_sj.result
@@ -2757,4 +2757,19 @@ GROUP BY b
 HAVING t1sum <> 1;
 t1sum	b
 DROP TABLE t1, t2;
+#
+# MDEV-3911: Assertion `fixed == 0' failed in Item_field::fix_fields
+# on 2nd execution of PS with semijoin=on and IN subquery
+#
+CREATE TABLE t1 (a INT, b INT) ENGINE=MyISAM;
+INSERT INTO t1 VALUES (0,4),(8,6);
+CREATE TABLE t2 (c INT, d INT) ENGINE=MyISAM;
+INSERT INTO t2 VALUES (7,1),(0,7);
+PREPARE stmt FROM ' SELECT * FROM t1 WHERE ( a, b ) IN ( SELECT c, d FROM t2 ) ';
+execute stmt;
+a	b
+execute stmt;
+a	b
+deallocate prepare stmt;
+drop table t1,t2;
 set optimizer_switch=@subselect_sj_tmp;
diff --git a/mysql-test/r/subselect_sj_jcl6.result b/mysql-test/r/subselect_sj_jcl6.result
index 6247688d635..cf45162284c 100644
--- a/mysql-test/r/subselect_sj_jcl6.result
+++ b/mysql-test/r/subselect_sj_jcl6.result
@@ -2771,6 +2771,21 @@ GROUP BY b
 HAVING t1sum <> 1;
 t1sum	b
 DROP TABLE t1, t2;
+#
+# MDEV-3911: Assertion `fixed == 0' failed in Item_field::fix_fields
+# on 2nd execution of PS with semijoin=on and IN subquery
+#
+CREATE TABLE t1 (a INT, b INT) ENGINE=MyISAM;
+INSERT INTO t1 VALUES (0,4),(8,6);
+CREATE TABLE t2 (c INT, d INT) ENGINE=MyISAM;
+INSERT INTO t2 VALUES (7,1),(0,7);
+PREPARE stmt FROM ' SELECT * FROM t1 WHERE ( a, b ) IN ( SELECT c, d FROM t2 ) ';
+execute stmt;
+a	b
+execute stmt;
+a	b
+deallocate prepare stmt;
+drop table t1,t2;
 set optimizer_switch=@subselect_sj_tmp;
 #
 # BUG#49129: Wrong result with IN-subquery with join_cache_level=6 and firstmatch=off
diff --git a/mysql-test/t/subselect_sj.test b/mysql-test/t/subselect_sj.test
index 2facb089718..650c9d73893 100644
--- a/mysql-test/t/subselect_sj.test
+++ b/mysql-test/t/subselect_sj.test
@@ -2462,5 +2462,25 @@ HAVING t1sum <> 1;
 
 DROP TABLE t1, t2;
 
+--echo #
+--echo # MDEV-3911: Assertion `fixed == 0' failed in Item_field::fix_fields
+--echo # on 2nd execution of PS with semijoin=on and IN subquery
+--echo #
+
+CREATE TABLE t1 (a INT, b INT) ENGINE=MyISAM;
+INSERT INTO t1 VALUES (0,4),(8,6);
+						
+CREATE TABLE t2 (c INT, d INT) ENGINE=MyISAM;
+INSERT INTO t2 VALUES (7,1),(0,7);
+						
+eval PREPARE stmt FROM ' SELECT * FROM t1 WHERE ( a, b ) IN ( SELECT c, d FROM t2 ) ';
+
+execute stmt;
+execute stmt;
+
+deallocate prepare stmt;
+drop table t1,t2;
+
+
 # The following command must be the last one the file 
 set optimizer_switch=@subselect_sj_tmp;
diff --git a/sql/item_row.cc b/sql/item_row.cc
index 72bae6f0900..d9d3e359338 100644
--- a/sql/item_row.cc
+++ b/sql/item_row.cc
@@ -68,7 +68,8 @@ bool Item_row::fix_fields(THD *thd, Item **ref)
   Item **arg, **arg_end;
   for (arg= items, arg_end= items+arg_count; arg != arg_end ; arg++)
   {
-    if ((*arg)->fix_fields(thd, arg))
+    if (!(*arg)->fixed &&
+        (*arg)->fix_fields(thd, arg))
       return TRUE;
     // we can't assign 'item' before, because fix_fields() can change arg
     Item *item= *arg;