Fixed bug #34763.

Queries like:

  SELECT ROW(1, 2) IN (SELECT t1.a, 2)
    FROM t1 GROUP BY t1.a

or 

  SELECT ROW(1, 2) IN (SELECT t1.a, 2 FROM t2)
    FROM t1 GROUP BY t1.a

lead to assertion failure in the
Item_in_subselect::row_value_transformer method in debugging
build, or to unexpected error message in release build:

  ERROR 1247 (42S22): Reference '<list ref>' not supported (forward
                      reference in item list)

Unexpected error message and assertion failure have been
eliminated.


mysql-test/r/subselect3.result:
  Added test case for bug #34763.
mysql-test/t/subselect3.test:
  Added test case for bug #34763.
sql/item.cc:
  Fixed bug #34763.
  The Item_ref::fix_fields method has been modified to silently
  ignore not fixed outer references: by the definition, those
  references should be fixed later by the call to the
  fix_inner_refs function.
sql/item_subselect.cc:
  Fixed bug #34763.
  The Item_in_subselect::row_value_transformer method has been
  modified to eliminate assertion failure on not fixed outer
  references: by the definition those references are allowed in
  this context and should be fixed later by the call to the
  fix_inner_refs function.

4 files changed, 49 insertions, 10 deletions

diff --git a/mysql-test/r/subselect3.result b/mysql-test/r/subselect3.result
index bdf00e4c307..c194ba33756 100644
--- a/mysql-test/r/subselect3.result
+++ b/mysql-test/r/subselect3.result
@@ -758,5 +758,16 @@ EXPLAIN SELECT a FROM t1 WHERE a NOT IN (SELECT a FROM t2);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	PRIMARY	t1	ALL	NULL	NULL	NULL	NULL	4	Using where
 2	DEPENDENT SUBQUERY	t2	unique_subquery	PRIMARY	PRIMARY	4	func	1	Using index; Using where
-DROP TABLE t1;
+DROP TABLE t1, t2;
+CREATE TABLE t1 (a INT);
+INSERT INTO t1 VALUES(1);
+CREATE TABLE t2 (placeholder CHAR(11));
+INSERT INTO t2 VALUES("placeholder");
+SELECT ROW(1, 2) IN (SELECT t1.a, 2)         FROM t1 GROUP BY t1.a;
+ROW(1, 2) IN (SELECT t1.a, 2)
+1
+SELECT ROW(1, 2) IN (SELECT t1.a, 2 FROM t2) FROM t1 GROUP BY t1.a;
+ROW(1, 2) IN (SELECT t1.a, 2 FROM t2)
+1
+DROP TABLE t1, t2;
 End of 5.0 tests
diff --git a/mysql-test/t/subselect3.test b/mysql-test/t/subselect3.test
index 2f844c9cc21..cfbde8c29cd 100644
--- a/mysql-test/t/subselect3.test
+++ b/mysql-test/t/subselect3.test
@@ -586,6 +586,23 @@ SELECT a FROM t1 WHERE a NOT IN (65,66);
 SELECT a FROM t1 WHERE a NOT IN (SELECT a FROM t2);
 EXPLAIN SELECT a FROM t1 WHERE a NOT IN (SELECT a FROM t2);
 
-DROP TABLE t1;
+DROP TABLE t1, t2;
+
+#
+# Bug #34763: item_subselect.cc:1235:Item_in_subselect::row_value_transformer:
+#             Assertion failed, unexpected error message:
+#             ERROR 1247 (42S22): Reference '<list ref>' not supported (forward
+#             reference in item list)
+#
+CREATE TABLE t1 (a INT);
+INSERT INTO t1 VALUES(1);
+
+CREATE TABLE t2 (placeholder CHAR(11));
+INSERT INTO t2 VALUES("placeholder");
+
+SELECT ROW(1, 2) IN (SELECT t1.a, 2)         FROM t1 GROUP BY t1.a;
+SELECT ROW(1, 2) IN (SELECT t1.a, 2 FROM t2) FROM t1 GROUP BY t1.a;
+
+DROP TABLE t1, t2;
 
 --echo End of 5.0 tests
diff --git a/sql/item.cc b/sql/item.cc
index 53e7f124ccd..36612ddea44 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -5451,13 +5451,16 @@ bool Item_ref::fix_fields(THD *thd, Item **reference)
   DBUG_ASSERT(*ref);
   /*
     Check if this is an incorrect reference in a group function or forward
-    reference. Do not issue an error if this is an unnamed reference inside an
-    aggregate function.
+    reference. Do not issue an error if this is:
+      1. outer reference (will be fixed later by the fix_inner_refs function);
+      2. an unnamed reference inside an aggregate function.
   */
-  if (((*ref)->with_sum_func && name &&
-       !(current_sel->linkage != GLOBAL_OPTIONS_TYPE &&
-         current_sel->having_fix_field)) ||
-      !(*ref)->fixed)
+  if (!((*ref)->type() == REF_ITEM &&
+       ((Item_ref *)(*ref))->ref_type() == OUTER_REF) &&
+      (((*ref)->with_sum_func && name &&
+        !(current_sel->linkage != GLOBAL_OPTIONS_TYPE &&
+          current_sel->having_fix_field)) ||
+       !(*ref)->fixed))
   {
     my_error(ER_ILLEGAL_REFERENCE, MYF(0),
              name, ((*ref)->with_sum_func?
diff --git a/sql/item_subselect.cc b/sql/item_subselect.cc
index b3710841dfb..a03a7d739b2 100644
--- a/sql/item_subselect.cc
+++ b/sql/item_subselect.cc
@@ -1232,7 +1232,11 @@ Item_in_subselect::row_value_transformer(JOIN *join)
     Item *item_having_part2= 0;
     for (uint i= 0; i < cols_num; i++)
     {
-      DBUG_ASSERT(left_expr->fixed && select_lex->ref_pointer_array[i]->fixed);
+      DBUG_ASSERT(left_expr->fixed &&
+                  select_lex->ref_pointer_array[i]->fixed ||
+                  (select_lex->ref_pointer_array[i]->type() == REF_ITEM &&
+                   ((Item_ref*)(select_lex->ref_pointer_array[i]))->ref_type() ==
+                    Item_ref::OUTER_REF));
       if (select_lex->ref_pointer_array[i]->
           check_cols(left_expr->element_index(i)->cols()))
         DBUG_RETURN(RES_ERROR);
@@ -1306,7 +1310,11 @@ Item_in_subselect::row_value_transformer(JOIN *join)
     for (uint i= 0; i < cols_num; i++)
     {
       Item *item, *item_isnull;
-      DBUG_ASSERT(left_expr->fixed && select_lex->ref_pointer_array[i]->fixed);
+      DBUG_ASSERT(left_expr->fixed &&
+                  select_lex->ref_pointer_array[i]->fixed ||
+                  (select_lex->ref_pointer_array[i]->type() == REF_ITEM &&
+                   ((Item_ref*)(select_lex->ref_pointer_array[i]))->ref_type() ==
+                    Item_ref::OUTER_REF));
       if (select_lex->ref_pointer_array[i]->
           check_cols(left_expr->element_index(i)->cols()))
         DBUG_RETURN(RES_ERROR);