Crash in ha_heap::index_flags with derived_merge=off,derived_with_keys=off and join_cache_level=0

[Elena Stepanova]

Backtrace:

#3 <signal handler called>
#4 0x00000000009debf5 in ha_heap::index_flags(unsigned int, unsigned int, bool) const ()
#5 0x0000000000950172 in push_index_cond (tab=0x1ce94d8, keyno=64)
    at opt_index_cond_pushdown.cc:328
#6 0x0000000000786cb0 in make_join_readinfo (join=0x1cdea30, options=0,
    no_jbuf_after=2) at sql_select.cc:9426
#7 0x00000000007717be in JOIN::optimize (this=0x1cdea30) at sql_select.cc:1500
#8 0x0000000000776859 in mysql_select (thd=0x1c244d8,
    rref_pointer_array=0x1c270b0, tables=0x1cd85f0, wild_num=1, fields=...,
    conds=0x1cd95c0, og_num=0, order=0x0, group=0x0, having=0x0,
    proc_param=0x0, select_options=2147764736, result=0x1cabea8,
    unit=0x1c26978, select_lex=0x1c26e60) at sql_select.cc:2892
#9 0x000000000076d4c9 in handle_select (thd=0x1c244d8, lex=0x1c268d8,
    result=0x1cabea8, setup_tables_done_option=0) at sql_select.cc:283
#10 0x00000000006fc648 in execute_sqlcom_select (thd=0x1c244d8,
    all_tables=0x1cd85f0) at sql_parse.cc:5112
#11 0x00000000006f371e in mysql_execute_command (thd=0x1c244d8)
    at sql_parse.cc:2250
#12 0x00000000006ff028 in mysql_parse (thd=0x1c244d8,
    rawbuf=0x1ca9ef0 "SELECT * FROM ( SELECT ta.* FROM t1 AS ta, t1 ) tb WHERE f1 IN ( SELECT * FROM t1 )", length=83, found_semicolon=0x7ffbc21c7c98)
    at sql_parse.cc:6113
#13 0x00000000006f0f36 in dispatch_command (command=COM_QUERY, thd=0x1c244d8,
    packet=0x1ca0a89 "SELECT * FROM ( SELECT ta.* FROM t1 AS ta, t1 ) tb WHERE f1 IN ( SELECT * FROM t1 )", packet_length=83) at sql_parse.cc:1221
#14 0x00000000006f026a in do_command (thd=0x1c244d8) at sql_parse.cc:916
#15 0x00000000006ed1c0 in handle_one_connection (arg=0x1c244d8)
    at sql_connect.cc:1191
#16 0x00007ffbcb965a4f in start_thread () from /lib64/libpthread.so.0
#17 0x00007ffbcad4f82d in clone () from /lib64/libc.so.6

[Elena Stepanova (elenst)]

Minimal switch: derived_merge=off,derived_with_keys=off
Full switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,index_condition_pushdown=on,derived_merge=off,derived_with_keys=off,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=off,semijoin_with_cache=off,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=off,table_elimination=on

Not reproducible with join_cache_level=1

Not reproducible with optimizer_prune_level=0

Reproducible on release 5.3.2 with additional semijoin=on

EXPLAIN also crashes.

[Elena Stepanova (elenst)]

Test case:

SET optimizer_switch='derived_merge=off,derived_with_keys=off';
SET join_cache_level=0;

CREATE TABLE t1 (f1 INTEGER);
INSERT INTO t1 VALUES (8), (7);

SELECT * FROM ( SELECT ta.* FROM t1 AS ta, t1 ) tb WHERE f1 IN ( SELECT * FROM t1 );

[Sergey Petrunia (sergefp)]

The problem seems to be that the optimizer attempts to construct hash join for some reason (keyno=64). Re-assigning