MDEV-17360 Server crashes in optimize_keyuse

This was a bug in the code of MDEV-12387 "Push conditions into materialized
subqueries". The bug manifested itself in rather rare situations. An
affected query must contain IN subquery predicate whose left operand
was an outer field of a mergeable derived table or view and right operand
was a materialized subquery.
The erroneous code in fact stripped off the Item_direct_ref wrapper from
the left operand of the IN subquery predicate when building equalities
produced by the conversion of the predicate into a semi-join. As a result
the left operand was not considered as an outer reference anymore and
used_tables() was calculated incorrectly. This caused a crash in the
function optimize_keyuse().

1 files changed, 13 insertions, 0 deletions

diff --git a/mysql-test/main/in_subq_cond_pushdown.result b/mysql-test/main/in_subq_cond_pushdown.result
index c9319a5fb86..077edf79bea 100644
--- a/mysql-test/main/in_subq_cond_pushdown.result
+++ b/mysql-test/main/in_subq_cond_pushdown.result
@@ -3855,3 +3855,16 @@ ORDER BY t4.d
 a	b	c
 x	x	NULL
 DROP TABLE t1,t2,t3,t4;
+#
+# MDEV-17360: IN subquery predicate with outer reference in the left part
+#             that refers to a field of a mergeable derived table
+#
+CREATE TABLE t1 (id1 int) ENGINE=MYISAM;
+INSERT INTO t1 VALUES (1814),(0),(NULL),(1);
+CREATE TABLE t2 (id2 int) ENGINE=MYISAM;
+SELECT 1 AS r FROM t2,t1,(SELECT * FROM t1) dt1
+WHERE NOT EXISTS (SELECT id2 FROM t2
+WHERE dt1.id1 IN (SELECT t2.id2 FROM t2
+HAVING t2.id2 >= 1));
+r
+DROP TABLE t1,t2;