MDEV-24675 Server crash when table value constructor uses a subselect

This patch actually fixes the bug MDEV-24675 and the bug MDEV-24618:
Assertion failure when TVC uses a row in the context expecting scalar value

The cause of these bugs is the same wrong call of the function that fixes
value expressions in the value list of a table value constructor.
The assertion failure happened when an expression in the value list is of
the row type. In this case an error message was expected, but it was not
issued because the function fix_fields_if_needed() was called for to
check fields of value expressions in a TVC instead of the function
fix_fields_if_needed_for_scalar() that would also check that the value
expressions are are of a scalar type.
The first bug happened when a table value expression used an expression
returned by single-row subselect. In this case the call of the
fix_fields_if_needed_for_scalar virtual function must be provided with
and address to which the single-row subselect has to be attached.

Test cases were added for each of the bugs.

Approved by Oleksandr Byelkin <sanja@mariadb.com>

1 files changed, 2 insertions, 2 deletions

diff --git a/sql/sql_tvc.cc b/sql/sql_tvc.cc
index 10a279b92ed..1f91539ff45 100644
--- a/sql/sql_tvc.cc
+++ b/sql/sql_tvc.cc
@@ -47,7 +47,7 @@ bool fix_fields_for_tvc(THD *thd, List_iterator_fast<List_item> &li)
 
   while ((lst= li++))
   {
-    List_iterator_fast<Item> it(*lst);
+    List_iterator<Item> it(*lst);
     Item *item;
 
     while ((item= it++))
@@ -59,7 +59,7 @@ bool fix_fields_for_tvc(THD *thd, List_iterator_fast<List_item> &li)
         while replacing their values to NAME_CONST()s.
         So fix only those that have not been.
       */
-      if (item->fix_fields_if_needed(thd, 0) ||
+      if (item->fix_fields_if_needed_for_scalar(thd, it.ref()) ||
           item->check_is_evaluable_expression_or_error())
 	DBUG_RETURN(true);
     }