Fix bug lp:858148.

Analysis:
The crash is a result of the same cause as all similar
bugs (lp:827416, lp:718763, lp:778413, lp:806943,
lp:611690). The general pattern is that some optimization
requires the evaluation of some condition (e.g. the WHERE
clause), and this condition contains a subquery, such that
the subquery itself requires a temporary table for its
execution. During the subquery execution the original
tables in the FROM clause are replaced by the temporary
table needed for the final GROUP or ORDER operation. All
this happens during optimization of the outer query. Later
when EXPLAIN is run for the subquery, explain attempts to
print the name of the tables in the FROM clause, but it
finds there a temporary table without a corresponding
TABLE_LIST object. The attempt to print the name of a
NULL table list results in a crash.

Solution:
This patch extends the fix to bug lp:702301, and dissalows
constant substitution of aggregate functions if the filter
condition used to check MIN/MAX keys is an expensive condition.

1 files changed, 34 insertions, 0 deletions

diff --git a/mysql-test/t/subselect_innodb.test b/mysql-test/t/subselect_innodb.test
index e108aecfd36..af0e4f58e6b 100644
--- a/mysql-test/t/subselect_innodb.test
+++ b/mysql-test/t/subselect_innodb.test
@@ -264,4 +264,38 @@ WHERE t1.a = (
 
 DROP TABLE t1, t2, t3;
 
+
+--echo #
+--echo # LP BUG#858148 Fourth crash in select_describe() with nested subqueries
+--echo #
+
+CREATE TABLE t1 ( f1 int(11)) ENGINE=InnoDB;
+CREATE TABLE t2 ( f1 int(11), f2 int(11), PRIMARY KEY (f1)) ;
+CREATE TABLE t3 ( f3 int(11)) ENGINE=InnoDB;
+
+EXPLAIN
+SELECT MAX( f1 ) FROM t2
+WHERE f2 >= (
+        SELECT SUM( f1 )
+        FROM t1
+        WHERE EXISTS (
+                SELECT f3
+                FROM t3
+                GROUP BY 1
+        )
+);
+
+SELECT MAX( f1 ) FROM t2
+WHERE f2 >= (
+        SELECT SUM( f1 )
+        FROM t1
+        WHERE EXISTS (
+                SELECT f3
+                FROM t3
+                GROUP BY 1
+        )
+);
+
+drop table t1, t2, t3;
+
 set optimizer_switch=@subselect_innodb_tmp;