Crash in pull_out_semijoin_tables with outer join + semijoin + derived tables in maria-5.3 with WL#106

[Philip Stoev]

Repeatable in maria-5.3 , repeatable in maria-5.3-subqueries-mwl90. Not repeatable with maria-5.3 before WL#106. EXPLAIN also crashes.

backtrace:

#3 <signal handler called>
#4 0x000000000080672c in pull_out_semijoin_tables (join=0xc34b1f0) at opt_subselect.cc:1545
#5 0x0000000000747d35 in make_join_statistics (join=0xc34b1f0, tables_list=..., conds=0xc303cd0, keyuse_array=0xc3511a0) at sql_select.cc:3460
#6 0x000000000074a49e in JOIN::optimize (this=0xc34b1f0) at sql_select.cc:1101
#7 0x000000000074dfbd in mysql_select (thd=0xc23f098, rref_pointer_array=0xc241c18, tables=0xc2c4ee8, wild_num=1, fields=..., conds=0xc301728, og_num=0,
    order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147764736, result=0xc301990, unit=0xc241510, select_lex=0xc2419f8)
    at sql_select.cc:2872
#8 0x000000000075443c in handle_select (thd=0xc23f098, lex=0xc241470, result=0xc301990, setup_tables_done_option=0) at sql_select.cc:283
#9 0x00000000006a1744 in execute_sqlcom_select (thd=0xc23f098, all_tables=0xc2c4ee8) at sql_parse.cc:5082
#10 0x00000000006a33f7 in mysql_execute_command (thd=0xc23f098) at sql_parse.cc:2227
#11 0x00000000006ac18f in mysql_parse (thd=0xc23f098,
    rawbuf=0xc2c4c40 "SELECT *\nFROM t1\nWHERE t1.f1 IN (\nSELECT t2.f2\nFROM t2\nLEFT JOIN (\nSELECT *\nFROM t3\n) AS alias1\nON alias1.f3 = t2.f2\n)",
    length=118, found_semicolon=0x422b9f08) at sql_parse.cc:6083
#12 0x00000000006ad027 in dispatch_command (command=COM_QUERY, thd=0xc23f098,
    packet=0xc2bb8c9 "SELECT *\nFROM t1\nWHERE t1.f1 IN (\nSELECT t2.f2\nFROM t2\nLEFT JOIN (\nSELECT *\nFROM t3\n) AS alias1\nON alias1.f3 = t2.f2\n)\n",
    packet_length=119) at sql_parse.cc:1206
#13 0x00000000006ae635 in do_command (thd=0xc23f098) at sql_parse.cc:904
#14 0x00000000006990eb in handle_one_connection (arg=0xc23f098) at sql_connect.cc:1178
#15 0x00000033b600673d in start_thread () from /lib64/libpthread.so.0
#16 0x00000033b58d40cd in clone () from /lib64/libc.so.6

optimizer switch in effect:

index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=off,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=on,mrr_cost_based=off,mrr_sort_keys=on,outer_join_with_cache=off,semijoin_with_cache=off,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on

test case:

CREATE TABLE t1 ( f1 int) ;
INSERT INTO t1 VALUES (1),(1);

CREATE TABLE t2 ( f2 int) ;
INSERT INTO t2 VALUES (1),(1);

CREATE TABLE t3 ( f3 int) ;
INSERT INTO t3 VALUES (1),(1);

SELECT *
FROM t1
WHERE t1.f1 IN (
        SELECT t2.f2
        FROM t2
        LEFT JOIN (
                SELECT *
                FROM t3
        ) AS alias1
        ON alias1.f3 = t2.f2
);