Assertion failure for SELECT with subquery using ON expression

CREATE TABLE t (a INT);

INSERT INTO t VALUES (1),(2);

--error ER_BAD_FIELD_ERROR

SELECT 1 IN (SELECT COUNT(*) FROM t t1 JOIN (t t2 JOIN t t3 ON (t1.a != 0)));

# Cleanup

DROP TABLE t;

mysqld: /data/src/10.4/sql/sql_lex.cc:2806: bool st_select_lex::mark_as_dependent(THD*, st_select_lex*, Item_ident*): Assertion `this != last' failed.

220430  4:45:17 [ERROR] mysqld got signal 6 ;

#7  0x00007fa0183c3662 in __GI___assert_fail (assertion=0x5572af964e28 "this != last", file=0x5572af964324 "/data/src/10.4/sql/sql_lex.cc", line=2806, function=0x5572af964e38 "bool st_select_lex::mark_as_dependent(THD*, st_select_lex*, Item_ident*)") at assert.c:101

#8  0x00005572aec42e6e in st_select_lex::mark_as_dependent (this=0x7fa000014dc0, thd=0x7fa000000d90, last=0x7fa000014dc0, dependency=0x7fa000016a18) at /data/src/10.4/sql/sql_lex.cc:2806

#9  0x00005572aefdc243 in mark_as_dependent (thd=0x7fa000000d90, last=0x7fa000014dc0, current=0x7fa000014dc0, resolved_item=0x7fa000016a18, mark_item=0x7fa000016a18, suppress_warning_output=false) at /data/src/10.4/sql/item.cc:5112

#10 0x00005572aefde2aa in Item_field::fix_outer_field (this=0x7fa000016a18, thd=0x7fa000000d90, from_field=0x7fa0123939c0, reference=0x7fa000016c50) at /data/src/10.4/sql/item.cc:5801

#11 0x00005572aefdead8 in Item_field::fix_fields (this=0x7fa000016a18, thd=0x7fa000000d90, reference=0x7fa000016c50) at /data/src/10.4/sql/item.cc:5985

#12 0x00005572aeb60409 in Item::fix_fields_if_needed (this=0x7fa000016a18, thd=0x7fa000000d90, ref=0x7fa000016c50) at /data/src/10.4/sql/item.h:964

#13 0x00005572af039c66 in Item_func::fix_fields (this=0x7fa000016bc0, thd=0x7fa000000d90, ref=0x7fa000016318) at /data/src/10.4/sql/item_func.cc:352

#14 0x00005572aeb60409 in Item::fix_fields_if_needed (this=0x7fa000016bc0, thd=0x7fa000000d90, ref=0x7fa000016318) at /data/src/10.4/sql/item.h:964

#15 0x00005572aeb6043f in Item::fix_fields_if_needed_for_scalar (this=0x7fa000016bc0, thd=0x7fa000000d90, ref=0x7fa000016318) at /data/src/10.4/sql/item.h:968

#16 0x00005572aebe5b33 in Item::fix_fields_if_needed_for_bool (this=0x7fa000016bc0, thd=0x7fa000000d90, ref=0x7fa000016318) at /data/src/10.4/sql/item.h:972

#17 0x00005572aebe1b50 in setup_on_expr (thd=0x7fa000000d90, table=0x7fa0000162b8, is_update=false) at /data/src/10.4/sql/sql_base.cc:8325

#18 0x00005572aebe1fcc in setup_conds (thd=0x7fa000000d90, tables=0x7fa000015488, leaves=..., conds=0x7fa000019c10) at /data/src/10.4/sql/sql_base.cc:8442

#19 0x00005572aecbd5fd in setup_without_group (thd=0x7fa000000d90, ref_pointer_array=..., tables=0x7fa000015488, leaves=..., fields=..., all_fields=..., conds=0x7fa000019c10, order=0x0, group=0x0, win_specs=..., win_funcs=..., hidden_group_fields=0x7fa000019aef, reserved=0x7fa0000150c4) at /data/src/10.4/sql/sql_select.cc:724

#20 0x00005572aecc044d in JOIN::prepare (this=0x7fa000019808, tables_init=0x7fa000015488, wild_num=0, conds_init=0x0, og_num=0, order_init=0x0, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x7fa000014dc0, unit_arg=0x7fa000017ce8) at /data/src/10.4/sql/sql_select.cc:1283

#21 0x00005572af09e33f in subselect_single_select_engine::prepare (this=0x7fa000018718, thd=0x7fa000000d90) at /data/src/10.4/sql/item_subselect.cc:3827

#22 0x00005572af090a8b in Item_subselect::fix_fields (this=0x7fa0000184f0, thd_param=0x7fa000000d90, ref=0x7fa000018760) at /data/src/10.4/sql/item_subselect.cc:289

#23 0x00005572af09d288 in Item_in_subselect::fix_fields (this=0x7fa0000184f0, thd_arg=0x7fa000000d90, ref=0x7fa000018760) at /data/src/10.4/sql/item_subselect.cc:3489

#24 0x00005572aeb60409 in Item::fix_fields_if_needed (this=0x7fa0000184f0, thd=0x7fa000000d90, ref=0x7fa000018760) at /data/src/10.4/sql/item.h:964

#25 0x00005572aeb6043f in Item::fix_fields_if_needed_for_scalar (this=0x7fa0000184f0, thd=0x7fa000000d90, ref=0x7fa000018760) at /data/src/10.4/sql/item.h:968

#26 0x00005572aebdfa8e in setup_fields (thd=0x7fa000000d90, ref_pointer_array=..., fields=..., column_usage=MARK_COLUMNS_READ, sum_func_list=0x7fa0000194b8, pre_fix=0x7fa000014a00, allow_sum_func=true) at /data/src/10.4/sql/sql_base.cc:7707

#27 0x00005572aecc0314 in JOIN::prepare (this=0x7fa000019198, tables_init=0x0, wild_num=0, conds_init=0x0, og_num=0, order_init=0x0, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x7fa0000148a0, unit_arg=0x7fa000004cc0) at /data/src/10.4/sql/sql_select.cc:1278

#28 0x00005572aeccd17b in mysql_select (thd=0x7fa000000d90, tables=0x0, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x7fa000019170, unit=0x7fa000004cc0, select_lex=0x7fa0000148a0) at /data/src/10.4/sql/sql_select.cc:4729

#29 0x00005572aecbcbec in handle_select (thd=0x7fa000000d90, lex=0x7fa000004c00, result=0x7fa000019170, setup_tables_done_option=0) at /data/src/10.4/sql/sql_select.cc:436

#30 0x00005572aec8235c in execute_sqlcom_select (thd=0x7fa000000d90, all_tables=0x7fa000015488) at /data/src/10.4/sql/sql_parse.cc:6465

#31 0x00005572aec78b7c in mysql_execute_command (thd=0x7fa000000d90) at /data/src/10.4/sql/sql_parse.cc:3979

#32 0x00005572aec862f0 in mysql_parse (thd=0x7fa000000d90, rawbuf=0x7fa0000147a8 "SELECT 1 IN (SELECT COUNT(*) FROM t t1 JOIN (t t2 JOIN t t3 ON (t1.a != 0)))", length=76, parser_state=0x7fa012395550, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:8011

#33 0x00005572aec72781 in dispatch_command (command=COM_QUERY, thd=0x7fa000000d90, packet=0x7fa00000ac01 "SELECT 1 IN (SELECT COUNT(*) FROM t t1 JOIN (t t2 JOIN t t3 ON (t1.a != 0)))", packet_length=76, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1873

#34 0x00005572aec70f73 in do_command (thd=0x7fa000000d90) at /data/src/10.4/sql/sql_parse.cc:1378

#35 0x00005572aedffe19 in do_handle_one_connection (connect=0x5572b2d721a0) at /data/src/10.4/sql/sql_connect.cc:1420

#36 0x00005572aedffac1 in handle_one_connection (arg=0x5572b2d721a0) at /data/src/10.4/sql/sql_connect.cc:1316

#37 0x00005572af31c2fd in pfs_spawn_thread (arg=0x5572b2db7d10) at /data/src/10.4/storage/perfschema/pfs.cc:1869

#38 0x00007fa01888fea7 in start_thread (arg=<optimized out>) at pthread_create.c:477

#39 0x00007fa01848cdef in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

commit 39feab3cd31b5414aa9b428eaba915c251ac34a2

Author: Igor Babaev

Date:   Mon Apr 25 18:08:57 2022 -0700

    MDEV-26412 Server crash in Item_field::fix_outer_field for INSERT SELECT