Bug#23800: Outer fields in correlated subqueries is used in a temporary table

created for sorting.

Any outer reference in a subquery was represented by an Item_field object.
If the outer select employs a temporary table all such fields should be
replaced with fields from that temporary table in order to point to the 
actual data. This replacement wasn't done and that resulted in a wrong
subquery evaluation and a wrong result of the whole query.

Now any outer field is represented by two objects - Item_field placed in the
outer select and Item_outer_ref in the subquery. Item_field object is
processed as a normal field and the reference to it is saved in the
ref_pointer_array. Thus the Item_outer_ref is always references the correct
field. The original field is substituted for a reference in the
Item_field::fix_outer_field() function.

New function called fix_inner_refs() is added to fix fields referenced from
inner selects and to fix references (Item_ref objects) to these fields.

The new Item_outer_ref class is a descendant of the Item_direct_ref class.
It additionally stores a reference to the original field and designed to
behave more like a field.


sql/item.cc:
  Bug#23800: Correlated sub query returning incorrect results when operated upon.
  Now all outer fields are substituted with references to them (Item_outer_ref objects)
  in the Item_field::fix_outer_field() function.
  The original field is saved in the Item_outer_ref object.
sql/item.h:
  Bug#23800: Correlated sub query returning incorrect results when operated upon.
  Added the Item_outer_ref class.
sql/mysql_priv.h:
  Bug#23800: Correlated sub query returning incorrect results when operated upon.
  Added the fix_inner_refs() function prototype.
sql/sql_delete.cc:
  Bug#23800: Correlated sub query returning incorrect results when operated upon.
  Added call to the fix_inner_refs() function.
sql/sql_select.cc:
  Bug#23800: Correlated sub query returning incorrect results when operated upon.
  The new function called fix_inner_refs() is added.
mysql-test/r/subselect.result:
  Added a test case for bug#23800: Correlated sub query returning incorrect results when
  operated upon.
sql/sql_update.cc:
  Bug#23800: Correlated sub query returning incorrect results when operated upon.
  Added call to the fix_inner_refs() function.
mysql-test/r/subselect3.result:
  Corrected test cases result after fix for bug#23800: Correlated sub query returning
  incorrect results when operated upon.
mysql-test/t/subselect.test:
  Added a test case for bug#23800: Correlated sub query returning incorrect results when
  operated upon.
sql/sql_lex.cc:
  Bug#23800: Correlated sub query returning incorrect results when operated upon.
  Added cleanup of the inner_refs_list.
sql/sql_lex.h:
  Bug#23800: Correlated sub query returning incorrect results when operated upon.
  The inner_refs_list is added to the SELECT_LEX class.

1 files changed, 5 insertions, 0 deletions

diff --git a/sql/sql_update.cc b/sql/sql_update.cc
index 1db77f8704c..60b7ac1df1c 100644
--- a/sql/sql_update.cc
+++ b/sql/sql_update.cc
@@ -134,6 +134,7 @@ int mysql_update(THD *thd,
   READ_RECORD	info;
   SELECT_LEX    *select_lex= &thd->lex->select_lex;
   bool need_reopen;
+  List<Item> all_fields;
   DBUG_ENTER("mysql_update");
 
   LINT_INIT(timestamp_query_id);
@@ -226,6 +227,10 @@ int mysql_update(THD *thd,
     DBUG_RETURN(1);				/* purecov: inspected */
   }
 
+  if (select_lex->inner_refs_list.elements &&
+    fix_inner_refs(thd, all_fields, select_lex, select_lex->ref_pointer_array))
+    DBUG_RETURN(-1);
+
   if (conds)
   {
     Item::cond_result cond_value;