MDEV-4908: Assertion `((Item_cond *) cond)->functype() == ((Item_cond *) new_item)->functype()' fails on a query with IN and equal conditions, AND/OR, materialization+semijoin

A new AND Item should be prepared (fix_field() call) before using.

4 files changed, 50 insertions, 2 deletions

diff --git a/mysql-test/r/subselect_mat.result b/mysql-test/r/subselect_mat.result
index f3442b2018e..f5cce0e2d88 100644
--- a/mysql-test/r/subselect_mat.result
+++ b/mysql-test/r/subselect_mat.result
@@ -2002,6 +2002,20 @@ DROP TABLE t1,t2;
 # This must be at the end:
 set optimizer_switch=@subselect_sj_mat_tmp;
 set join_cache_level=@save_join_cache_level;
+#
+# MDEV-4908: Assertion `((Item_cond *) cond)->functype() == 
+# ((Item_cond *) new_item)->functype()' fails on a query with
+# IN and equal conditions, AND/OR, materialization+semijoin
+# 
+SET @save_optimizer_switch=@@optimizer_switch;
+SET optimizer_switch = 'materialization=on,semijoin=on';
+CREATE TABLE t1 (pk INT, a INT, b INT, PRIMARY KEY(pk)) ENGINE=MyISAM;
+INSERT INTO t1 VALUES (1,3,5),(2,4,6);
+SELECT * FROM t1 WHERE 8 IN ( SELECT MIN(pk) FROM t1 ) AND ( pk = a OR pk = b );
+pk	a	b
+drop table t1;
+SET optimizer_switch=@save_optimizer_switch;
+# End of 5.3 tests
 set @subselect_mat_test_optimizer_switch_value=null;
 set @@optimizer_switch='materialization=on,in_to_exists=off,semijoin=off';
 set optimizer_switch='mrr=on,mrr_sort_keys=on,index_condition_pushdown=on';
diff --git a/mysql-test/r/subselect_sj_mat.result b/mysql-test/r/subselect_sj_mat.result
index 8368318ea3d..fb7fdb0e8f0 100644
--- a/mysql-test/r/subselect_sj_mat.result
+++ b/mysql-test/r/subselect_sj_mat.result
@@ -2042,3 +2042,17 @@ DROP TABLE t1,t2;
 # This must be at the end:
 set optimizer_switch=@subselect_sj_mat_tmp;
 set join_cache_level=@save_join_cache_level;
+#
+# MDEV-4908: Assertion `((Item_cond *) cond)->functype() == 
+# ((Item_cond *) new_item)->functype()' fails on a query with
+# IN and equal conditions, AND/OR, materialization+semijoin
+# 
+SET @save_optimizer_switch=@@optimizer_switch;
+SET optimizer_switch = 'materialization=on,semijoin=on';
+CREATE TABLE t1 (pk INT, a INT, b INT, PRIMARY KEY(pk)) ENGINE=MyISAM;
+INSERT INTO t1 VALUES (1,3,5),(2,4,6);
+SELECT * FROM t1 WHERE 8 IN ( SELECT MIN(pk) FROM t1 ) AND ( pk = a OR pk = b );
+pk	a	b
+drop table t1;
+SET optimizer_switch=@save_optimizer_switch;
+# End of 5.3 tests
diff --git a/mysql-test/t/subselect_sj_mat.test b/mysql-test/t/subselect_sj_mat.test
index 4c40b2b5487..d0ab2f5e300 100644
--- a/mysql-test/t/subselect_sj_mat.test
+++ b/mysql-test/t/subselect_sj_mat.test
@@ -1681,3 +1681,21 @@ DROP TABLE t1,t2;
 set optimizer_switch=@subselect_sj_mat_tmp;
 set join_cache_level=@save_join_cache_level;
 
+--echo #
+--echo # MDEV-4908: Assertion `((Item_cond *) cond)->functype() == 
+--echo # ((Item_cond *) new_item)->functype()' fails on a query with
+--echo # IN and equal conditions, AND/OR, materialization+semijoin
+--echo # 
+
+
+SET @save_optimizer_switch=@@optimizer_switch;
+SET optimizer_switch = 'materialization=on,semijoin=on';
+
+CREATE TABLE t1 (pk INT, a INT, b INT, PRIMARY KEY(pk)) ENGINE=MyISAM;
+INSERT INTO t1 VALUES (1,3,5),(2,4,6);
+SELECT * FROM t1 WHERE 8 IN ( SELECT MIN(pk) FROM t1 ) AND ( pk = a OR pk = b );
+
+drop table t1;
+SET optimizer_switch=@save_optimizer_switch;
+
+--echo # End of 5.3 tests
diff --git a/sql/opt_subselect.cc b/sql/opt_subselect.cc
index 149d395a25d..b0d84fe5400 100644
--- a/sql/opt_subselect.cc
+++ b/sql/opt_subselect.cc
@@ -5154,10 +5154,12 @@ bool setup_jtbm_semi_joins(JOIN *join, List<TABLE_LIST> *join_list,
           {
             eq_cond= new Item_func_eq(subq_pred->left_expr->element_index(i),
                                       new_sink->row[i]);
-            if (!eq_cond || eq_cond->fix_fields(join->thd, &eq_cond))
+            if (!eq_cond)
               DBUG_RETURN(1);
 
-            (*join_where)= and_items(*join_where, eq_cond);
+            if (!((*join_where)= and_items(*join_where, eq_cond)) ||
+                (*join_where)->fix_fields(join->thd, join_where))
+              DBUG_RETURN(1);
           }
         }
         else