Bug #37761: IN handles NULL differently for table-subquery

            and value-list

The server returns unexpected results if a right side of the 
NOT IN clause consists of NULL value and some constants of
the same type, for example:

  SELECT * FROM t WHERE NOT t.id IN (NULL, 1, 2) 
  
may return 3, 4, 5 etc if a table contains these values.


The Item_func_in::val_int method has been modified:
unnecessary resets of an Item_func_case::has_null field 
value has been moved outside of an argument comparison
loop. (Also unnecessary re-initialization of the null_value
field has been moved).


mysql-test/r/func_in.result:
  Added test case for bug #37761.
mysql-test/t/func_in.test:
  Added test case for bug #37761.
sql/item_cmpfunc.cc:
  Bug #37761: IN handles NULL differently for table-subquery 
              and value-list
  
  The Item_func_in::val_int method has been modified:
  unnecessary resets of an Item_func_case::has_null field 
  value has been moved outside of an argument comparison
  loop. (Also unnecessary re-initialization of the null_value
  field has been moved).

1 files changed, 3 insertions, 3 deletions

diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc
index f267ad39984..2db77eb7c56 100644
--- a/sql/item_cmpfunc.cc
+++ b/sql/item_cmpfunc.cc
@@ -3758,6 +3758,9 @@ longlong Item_func_in::val_int()
     return (longlong) (!null_value && tmp != negated);
   }
 
+  if ((null_value= args[0]->null_value))
+    return 0;
+  have_null= 0;
   for (uint i= 1 ; i < arg_count ; i++)
   {
     Item_result cmp_type= item_cmp_type(left_result_type, args[i]->result_type());
@@ -3766,9 +3769,6 @@ longlong Item_func_in::val_int()
     if (!(value_added_map & (1 << (uint)cmp_type)))
     {
       in_item->store_value(args[0]);
-      if ((null_value=args[0]->null_value))
-        return 0;
-      have_null= 0;
       value_added_map|= 1 << (uint)cmp_type;
     }
     if (!in_item->cmp(args[i]) && !args[i]->null_value)