MDEV-26412 Server crash in Item_field::fix_outer_field for INSERT SELECT

IF an INSERT/REPLACE SELECT statement contained an ON expression in the top
level select and this expression used a subquery with a column reference
that could not be resolved then an attempt to resolve this reference as
an outer reference caused a crash of the server. This happened because the
outer context field in the Name_resolution_context structure was not set
to NULL for such references. Rather it pointed to the first element in
the select_stack.

Note that starting from 10.4 we cannot use the SELECT_LEX::outer_select()
method when parsing a SELECT construct.

Approved by Oleksandr Byelkin <sanja@mariadb.com>

1 files changed, 16 insertions, 0 deletions

diff --git a/mysql-test/main/insert.result b/mysql-test/main/insert.result
index 4aea81262d2..1062ddd6a94 100644
--- a/mysql-test/main/insert.result
+++ b/mysql-test/main/insert.result
@@ -751,3 +751,19 @@ REPLACE INTO v1 SET f = NULL;
 ERROR 22007: Truncated incorrect DOUBLE value: 'foo'
 DROP VIEW v1;
 DROP TABLE t1;
+# End of 10.0 tests
+#
+# MDEV-26412: INSERT CREATE with subquery in ON expression
+#
+create table t1 (a int);
+create table t2 (b int);
+create table t3 (c int);
+create table t4 (d1 int, d2 int);
+insert into t4
+select * from t1 left join t2 on (select t1.i from t3);
+ERROR 42S22: Unknown column 't1.i' in 'field list'
+replace t4
+select * from t1 left join t2 on (select t1.i from t3);
+ERROR 42S22: Unknown column 't1.i' in 'field list'
+drop table t1,t2,t3,t4;
+# End of 10.4 tests