MDEV-16549 Server crashes in Item_field::fix_fields on query with view and subquery, Assertion `context' failed, Assertion `field' failed

Add one-table-resolve context for items created with an aim of switching
to temporary table because then it can be cloned in push-down-condition.

5 files changed, 56 insertions, 2 deletions

diff --git a/mysql-test/main/derived.result b/mysql-test/main/derived.result
index c3421a288a1..2761fdfa287 100644
--- a/mysql-test/main/derived.result
+++ b/mysql-test/main/derived.result
@@ -1313,3 +1313,19 @@ a	a
 4	4
 6	6
 drop table t1,t2,t3;
+#
+# MDEV-16549: Server crashes in Item_field::fix_fields on query with
+# view and subquery, Assertion `context' failed, Assertion `field' failed
+#
+CREATE TABLE t1 (a DECIMAL, b INT);
+INSERT INTO t1 VALUES (1,1),(2,2);
+CREATE VIEW v1 AS SELECT * FROM ( SELECT * FROM t1 WHERE a <> RAND() ) sq;
+SELECT * FROM v1 WHERE b > 0;
+a	b
+1	1
+2	2
+DROP VIEW v1;
+DROP TABLE t1;
+#
+# End of 10.3 tests
+#
diff --git a/mysql-test/main/derived.test b/mysql-test/main/derived.test
index 4ff0cf4165c..6a831000e57 100644
--- a/mysql-test/main/derived.test
+++ b/mysql-test/main/derived.test
@@ -1120,3 +1120,23 @@ analyze select * from t1 , ( (select t2.a from t2 order by c) union all (select
 select * from t1 , ( (select t2.a from t2 order by c) union all (select  t2.a from t2 order by c) except(select t3.a from t3 order by b))q  where t1.a=q.a;
 
 drop table t1,t2,t3;
+
+
+--echo #
+--echo # MDEV-16549: Server crashes in Item_field::fix_fields on query with
+--echo # view and subquery, Assertion `context' failed, Assertion `field' failed
+--echo #
+
+CREATE TABLE t1 (a DECIMAL, b INT);
+INSERT INTO t1 VALUES (1,1),(2,2); # optional
+CREATE VIEW v1 AS SELECT * FROM ( SELECT * FROM t1 WHERE a <> RAND() ) sq;
+
+SELECT * FROM v1 WHERE b > 0;
+
+# Cleanup
+DROP VIEW v1;
+DROP TABLE t1;
+
+--echo #
+--echo # End of 10.3 tests
+--echo #
diff --git a/sql/item.cc b/sql/item.cc
index 8b127cf2626..012dcebdaee 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -10753,6 +10753,20 @@ void view_error_processor(THD *thd, void *data)
   ((TABLE_LIST *)data)->hide_view_error(thd);
 }
 
+/**
+  Name resolution context with resolution in only one table
+*/
+
+Name_resolution_context::Name_resolution_context(TABLE_LIST *table):
+  outer_context(0), table_list(0), select_lex(0),
+  error_processor_data(0),
+  security_ctx(0)
+{
+  resolve_in_select_list= FALSE;
+  error_processor= &dummy_error_processor;
+  // resolve only in this table
+  first_name_resolution_table= last_name_resolution_table= table;
+}
 
 st_select_lex *Item_ident::get_depended_from() const
 {
diff --git a/sql/item.h b/sql/item.h
index f28e4fb4bd7..a291678529e 100644
--- a/sql/item.h
+++ b/sql/item.h
@@ -237,6 +237,8 @@ struct Name_resolution_context: Sql_alloc
     security_ctx(0)
     {}
 
+  Name_resolution_context(TABLE_LIST *table);
+
   void init()
   {
     resolve_in_select_list= FALSE;
diff --git a/sql/table.cc b/sql/table.cc
index d6d68988a52..5a3e704d3ff 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -8826,7 +8826,8 @@ bool TABLE_LIST::change_refs_to_fields()
 
   Item **materialized_items=
       (Item **)thd->calloc(sizeof(void *) * table->s->fields);
-  if (!materialized_items)
+  Name_resolution_context *ctx= new Name_resolution_context(this);
+  if (!materialized_items || !ctx)
     return TRUE;
 
   while ((ref= (Item_direct_ref*)li++))
@@ -8842,7 +8843,8 @@ bool TABLE_LIST::change_refs_to_fields()
     DBUG_ASSERT(!field_it.end_of_fields());
     if (!materialized_items[idx])
     {
-      materialized_items[idx]= new (thd->mem_root) Item_field(thd, table->field[idx]);
+      materialized_items[idx]=
+        new (thd->mem_root) Item_field(thd, ctx, table->field[idx]);
       if (!materialized_items[idx])
         return TRUE;
     }