Fixed bug #34763.

Queries like:

  SELECT ROW(1, 2) IN (SELECT t1.a, 2)
    FROM t1 GROUP BY t1.a

or 

  SELECT ROW(1, 2) IN (SELECT t1.a, 2 FROM t2)
    FROM t1 GROUP BY t1.a

lead to assertion failure in the
Item_in_subselect::row_value_transformer method in debugging
build, or to unexpected error message in release build:

  ERROR 1247 (42S22): Reference '<list ref>' not supported (forward
                      reference in item list)

Unexpected error message and assertion failure have been
eliminated.


mysql-test/r/subselect3.result:
  Added test case for bug #34763.
mysql-test/t/subselect3.test:
  Added test case for bug #34763.
sql/item.cc:
  Fixed bug #34763.
  The Item_ref::fix_fields method has been modified to silently
  ignore not fixed outer references: by the definition, those
  references should be fixed later by the call to the
  fix_inner_refs function.
sql/item_subselect.cc:
  Fixed bug #34763.
  The Item_in_subselect::row_value_transformer method has been
  modified to eliminate assertion failure on not fixed outer
  references: by the definition those references are allowed in
  this context and should be fixed later by the call to the
  fix_inner_refs function.

2 files changed, 19 insertions, 8 deletions

diff --git a/sql/item.cc b/sql/item.cc
index 53e7f124ccd..36612ddea44 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -5451,13 +5451,16 @@ bool Item_ref::fix_fields(THD *thd, Item **reference)
   DBUG_ASSERT(*ref);
   /*
     Check if this is an incorrect reference in a group function or forward
-    reference. Do not issue an error if this is an unnamed reference inside an
-    aggregate function.
+    reference. Do not issue an error if this is:
+      1. outer reference (will be fixed later by the fix_inner_refs function);
+      2. an unnamed reference inside an aggregate function.
   */
-  if (((*ref)->with_sum_func && name &&
-       !(current_sel->linkage != GLOBAL_OPTIONS_TYPE &&
-         current_sel->having_fix_field)) ||
-      !(*ref)->fixed)
+  if (!((*ref)->type() == REF_ITEM &&
+       ((Item_ref *)(*ref))->ref_type() == OUTER_REF) &&
+      (((*ref)->with_sum_func && name &&
+        !(current_sel->linkage != GLOBAL_OPTIONS_TYPE &&
+          current_sel->having_fix_field)) ||
+       !(*ref)->fixed))
   {
     my_error(ER_ILLEGAL_REFERENCE, MYF(0),
              name, ((*ref)->with_sum_func?
diff --git a/sql/item_subselect.cc b/sql/item_subselect.cc
index b3710841dfb..a03a7d739b2 100644
--- a/sql/item_subselect.cc
+++ b/sql/item_subselect.cc
@@ -1232,7 +1232,11 @@ Item_in_subselect::row_value_transformer(JOIN *join)
     Item *item_having_part2= 0;
     for (uint i= 0; i < cols_num; i++)
     {
-      DBUG_ASSERT(left_expr->fixed && select_lex->ref_pointer_array[i]->fixed);
+      DBUG_ASSERT(left_expr->fixed &&
+                  select_lex->ref_pointer_array[i]->fixed ||
+                  (select_lex->ref_pointer_array[i]->type() == REF_ITEM &&
+                   ((Item_ref*)(select_lex->ref_pointer_array[i]))->ref_type() ==
+                    Item_ref::OUTER_REF));
       if (select_lex->ref_pointer_array[i]->
           check_cols(left_expr->element_index(i)->cols()))
         DBUG_RETURN(RES_ERROR);
@@ -1306,7 +1310,11 @@ Item_in_subselect::row_value_transformer(JOIN *join)
     for (uint i= 0; i < cols_num; i++)
     {
       Item *item, *item_isnull;
-      DBUG_ASSERT(left_expr->fixed && select_lex->ref_pointer_array[i]->fixed);
+      DBUG_ASSERT(left_expr->fixed &&
+                  select_lex->ref_pointer_array[i]->fixed ||
+                  (select_lex->ref_pointer_array[i]->type() == REF_ITEM &&
+                   ((Item_ref*)(select_lex->ref_pointer_array[i]))->ref_type() ==
+                    Item_ref::OUTER_REF));
       if (select_lex->ref_pointer_array[i]->
           check_cols(left_expr->element_index(i)->cols()))
         DBUG_RETURN(RES_ERROR);