Server crash in sql/item.cc:5866 in Item_field::fix_outer_field

CREATE TABLE v946 ( v947 INT , v948 CHAR ) ;

 CREATE VIEW v949 AS SELECT 98912237.000000 AS v950 , -1 FROM v946 ORDER BY 'x' = 'x' AND ( NOT ( 'x' = 'x' AND v948 = 'x' ) ) IS NULL DESC ;

 CREATE VIEW v951 AS SELECT v948 FROM ( WITH v959 AS ( SELECT ( 'x' = ( v950 IN ( SELECT DISTINCT ( SELECT v947 FROM v946 WHERE ( v947 , ( v947 < 'x' ) ) NOT IN ( SELECT ( v950 % v950 <= v950 ) , 17 FROM v949 ) ) * 96 AS v952 FROM v949 WHERE v950 = CASE WHEN v950 * ( SELECT 21 FROM v949 AS v953 WHERE v950 BETWEEN 26844446.000000 AND 59 WINDOW v957 AS ( PARTITION BY v950 ORDER BY ( SELECT DISTINCT 127 FROM v949 AS v954 , v946 AS v955 , v949 AS v956 JOIN v946 ) DESC ) ) ^ v950 THEN 'x' ELSE v950 END / 16 ) ) ) , 'x' FROM v949 UNION SELECT 39798253.000000 AS v958 , v947 FROM v946 ORDER BY LAST_VALUE ( v950 ) DESC ) SELECT 'x' * v947 * 75 , v950 FROM v946 NATURAL JOIN v949 ) AS v960 NATURAL JOIN v949 AS v961 NATURAL JOIN v946 AS v962 NATURAL JOIN v946 ;

 DROP TABLE v946 ;

 INSERT INTO x VALUES ( 127 ) ;

Core was generated by `/test/MD160322-mariadb-10.3.35-linux-x86_64-opt/bin/mysqld --no-defaults --core'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  Item_field::fix_outer_field (this=0x14755402c570, thd=0x147554000c48, 

    from_field=0x1475b805cb40, reference=0x14755402c738)

    at /test/10.3_opt/sql/item.cc:5852

[Current thread is 1 (Thread 0x1475b8060700 (LWP 885352))]

(gdb) bt

#0  Item_field::fix_outer_field (this=0x14755402c570, thd=0x147554000c48, from_field=0x1475b805cb40, reference=0x14755402c738) at /test/10.3_opt/sql/item.cc:5852

#1  0x000055e9916f32bc in Item_field::fix_fields (this=0x14755402c570, thd=0x147554000c48, reference=0x14755402c738) at /test/10.3_opt/sql/item.cc:6269

#2  0x000055e991731bac in Item::fix_fields_if_needed (ref=0x14755402c738, thd=0x147554000c48, this=0x14755402c570) at /test/10.3_opt/sql/item.h:827

#3  Item::fix_fields_if_needed (ref=0x14755402c738, thd=0x147554000c48, this=0x14755402c570) at /test/10.3_opt/sql/item.h:827

#4  Item_func::fix_fields (ref=<optimized out>, thd=0x147554000c48, this=0x14755402c6a8) at /test/10.3_opt/sql/item_func.cc:352

#5  Item_func::fix_fields (this=0x14755402c6a8, thd=0x147554000c48, ref=<optimized out>) at /test/10.3_opt/sql/item_func.cc:319

#6  0x000055e9914fa6e2 in Item::fix_fields_if_needed (ref=<optimized out>, thd=0x147554000c48, this=0x14755402c6a8) at /test/10.3_opt/sql/item.h:827

#7  Item::fix_fields_if_needed (ref=<optimized out>, thd=0x147554000c48, this=0x14755402c6a8) at /test/10.3_opt/sql/item.h:827

#8  Item::fix_fields_if_needed_for_scalar (ref=<optimized out>, thd=0x147554000c48, this=0x14755402c6a8) at /test/10.3_opt/sql/item.h:833

#9  Item::fix_fields_if_needed_for_order_by (ref=<optimized out>, thd=0x147554000c48, this=0x14755402c6a8) at /test/10.3_opt/sql/item.h:841

#10 find_order_in_list (thd=0x147554000c48, ref_pointer_array=<optimized out>, tables=0x1475540115b8, order=0x14755402c770, fields=@0x147554011c48: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14755407c3e0, last = 0x14755407c500, elements = 2}, <No data fields>}, all_fields=@0x14755407c830: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14755407c3e0, last = 0x14755407c500, elements = 2}, <No data fields>}, is_group_field=false, add_to_all_fields=true, from_window_spec=false) at /test/10.3_opt/sql/sql_select.cc:23707

#11 0x000055e99151dc0d in setup_order (thd=thd@entry=0x147554000c48, ref_pointer_array={m_array = 0x14755407ca88, m_size = 5}, tables=0x1475540115b8, fields=@0x147554011c48: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14755407c3e0, last = 0x14755407c500, elements = 2}, <No data fields>}, all_fields=@0x14755407c830: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14755407c3e0, last = 0x14755407c500, elements = 2}, <No data fields>}, order=0x14755402c770, from_window_spec=false) at /test/10.3_opt/sql/sql_select.cc:23754

#12 0x000055e9915213d6 in setup_without_group (reserved=<optimized out>, hidden_group_fields=0x14755407c7f7, win_funcs=<optimized out>, win_specs=<optimized out>, group=<optimized out>, order=<optimized out>, conds=0x14755407c918, all_fields=<optimized out>, fields=<optimized out>, leaves=<optimized out>, tables=<optimized out>, ref_pointer_array=<optimized out>, thd=<optimized out>) at /test/10.3_opt/sql/sql_select.cc:676

#13 JOIN::prepare (unit_arg=<optimized out>, select_lex_arg=0x14755402b820, proc_param_init=<optimized out>, having_init=<optimized out>, group_init=<optimized out>, skip_order_by=false, order_init=<optimized out>, og_num=<optimized out>, conds_init=0x0, wild_num=0, tables_init=<optimized out>, this=0x14755407c510) at /test/10.3_opt/sql/sql_select.cc:1157

#14 JOIN::prepare (this=0x14755407c510, tables_init=<optimized out>, wild_num=wild_num@entry=0, conds_init=conds_init@entry=0x0, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=<optimized out>, group_init=<optimized out>, having_init=<optimized out>, proc_param_init=<optimized out>, select_lex_arg=<optimized out>, unit_arg=<optimized out>) at /test/10.3_opt/sql/sql_select.cc:1039

#15 0x000055e99157d6e2 in st_select_lex_unit::prepare (this=0x147554011570, derived_arg=<optimized out>, sel_result=sel_result@entry=0x0, additional_options=<optimized out>, additional_options@entry=0) at /test/10.3_opt/sql/sql_lex.h:827

#16 0x000055e99162ece0 in With_element::prepare_unreferenced (this=this@entry=0x14755402c7c8, thd=thd@entry=0x147554000c48) at /test/10.3_opt/sql/sql_cte.cc:1261

#17 0x000055e99162ed7c in With_clause::prepare_unreferenced_elements (this=<optimized out>, thd=0x147554000c48) at /test/10.3_opt/sql/sql_cte.h:261

#18 0x000055e9915217df in JOIN::prepare (unit_arg=<optimized out>, select_lex_arg=<optimized out>, proc_param_init=<optimized out>, having_init=<optimized out>, group_init=<optimized out>, skip_order_by=<optimized out>, order_init=<optimized out>, og_num=<optimized out>, conds_init=<optimized out>, wild_num=<optimized out>, tables_init=<optimized out>, this=0x147554069738) at /test/10.3_opt/sql/sql_select.cc:1246

#19 JOIN::prepare (this=this@entry=0x147554069738, tables_init=<optimized out>, wild_num=<optimized out>, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=<optimized out>, group_init=<optimized out>, having_init=<optimized out>, proc_param_init=<optimized out>, select_lex_arg=<optimized out>, unit_arg=<optimized out>) at /test/10.3_opt/sql/sql_select.cc:1039

#20 0x000055e991579b76 in st_select_lex_unit::prepare_join (this=0x1475540108f0, thd_arg=0x147554000c48, sl=0x1475540104b0, tmp_result=0x147554069650, additional_options=<optimized out>, is_union_select=<optimized out>) at /test/10.3_opt/sql/sql_union.cc:647

#21 0x000055e99157c7cb in st_select_lex_unit::prepare (this=this@entry=0x1475540108f0, derived_arg=derived_arg@entry=0x14755402e2b0, sel_result=sel_result@entry=0x147554069650, additional_options=additional_options@entry=0) at /test/10.3_opt/sql/sql_union.cc:993

#22 0x000055e9914934ba in mysql_derived_prepare (thd=0x147554000c48, lex=<optimized out>, derived=0x14755402e2b0) at /test/10.3_opt/sql/sql_derived.cc:793

#23 0x000055e991494198 in mysql_handle_single_derived (lex=lex@entry=0x147554004878, derived=derived@entry=0x14755402e2b0, phases=phases@entry=2) at /test/10.3_opt/sql/sql_derived.cc:193

#24 0x000055e991598aae in TABLE_LIST::handle_derived (this=this@entry=0x14755402e2b0, lex=lex@entry=0x147554004878, phases=phases@entry=2) at /test/10.3_opt/sql/table.cc:8419

#25 0x000055e9914af1b7 in LEX::handle_list_of_derived (phases=2, table_list=<optimized out>, this=0x147554004878) at /test/10.3_opt/sql/table.h:2684

#26 st_select_lex::handle_derived (this=<optimized out>, lex=0x147554004878, phases=phases@entry=2) at /test/10.3_opt/sql/sql_lex.cc:4198

#27 0x000055e991520eaa in JOIN::prepare (unit_arg=0x147554004938, select_lex_arg=0x1475540050d0, proc_param_init=0x0, having_init=0x0, group_init=0x0, skip_order_by=false, order_init=0x0, og_num=0, conds_init=<optimized out>, wild_num=0, tables_init=<optimized out>, this=0x147554068b80) at /test/10.3_opt/sql/sql_select.cc:1066

#28 JOIN::prepare (this=this@entry=0x147554068b80, tables_init=<optimized out>, wild_num=0, conds_init=<optimized out>, og_num=0, order_init=0x0, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x1475540050d0, unit_arg=0x147554004938) at /test/10.3_opt/sql/sql_select.cc:1039

#29 0x000055e991579b76 in st_select_lex_unit::prepare_join (this=0x147554004938, thd_arg=0x147554000c48, sl=0x1475540050d0, tmp_result=0x0, additional_options=<optimized out>, is_union_select=<optimized out>) at /test/10.3_opt/sql/sql_union.cc:647

#30 0x000055e99157c7cb in st_select_lex_unit::prepare (this=this@entry=0x147554004938, derived_arg=0x0, sel_result=sel_result@entry=0x0, additional_options=additional_options@entry=0) at /test/10.3_opt/sql/sql_union.cc:993

#31 0x000055e9915870eb in mysql_create_view (thd=thd@entry=0x147554000c48, views=views@entry=0x14755400fd20, mode=VIEW_CREATE_NEW) at /test/10.3_opt/sql/sql_view.cc:538

#32 0x000055e9914cf946 in mysql_execute_command (thd=<optimized out>) at /test/10.3_opt/sql/sql_parse.cc:5898

#33 0x000055e9914d4957 in mysql_parse (thd=0x147554000c48, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.3_opt/sql/sql_parse.cc:7870

#34 0x000055e9914d6cf5 in dispatch_command (command=COM_QUERY, thd=0x147554000c48, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.3_opt/sql/sql_class.h:1152

#35 0x000055e9914d8cdd in do_command (thd=0x147554000c48) at /test/10.3_opt/sql/sql_parse.cc:1398

#36 0x000055e9915c14a6 in do_handle_one_connection (connect=connect@entry=0x55e993813ca8) at /test/10.3_opt/sql/sql_connect.cc:1403

#37 0x000055e9915c167f in handle_one_connection (arg=0x55e993813ca8) at /test/10.3_opt/sql/sql_connect.cc:1308

#38 0x00001475b88d0609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#39 0x00001475b87f5133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Core was generated by `/test/MD160322-mariadb-10.3.35-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  Item_field::fix_outer_field (this=this@entry=0x15132c031ac8, thd=thd@entry=

    0x15132c000d90, from_field=from_field@entry=0x15138805d920, 

    reference=reference@entry=0x15132c031c90)

    at /test/10.3_dbg/sql/item.cc:5852

[Current thread is 1 (Thread 0x151388061700 (LWP 885952))]

(gdb) bt

#0  Item_field::fix_outer_field (this=this@entry=0x15132c031ac8, thd=thd@entry=0x15132c000d90, from_field=from_field@entry=0x15138805d920, reference=reference@entry=0x15132c031c90) at /test/10.3_dbg/sql/item.cc:5852

#1  0x0000556f59076e80 in Item_field::fix_fields (this=0x15132c031ac8, thd=0x15132c000d90, reference=0x15132c031c90) at /test/10.3_dbg/sql/item.cc:6269

#2  0x0000556f590ca0f1 in Item::fix_fields_if_needed (ref=0x15132c031c90, thd=0x15132c000d90, this=<optimized out>) at /test/10.3_dbg/sql/item.h:829

#3  Item_func::fix_fields (this=0x15132c031c00, thd=0x15132c000d90, ref=<optimized out>) at /test/10.3_dbg/sql/item_func.cc:352

#4  0x0000556f58deedd5 in Item::fix_fields_if_needed (ref=<optimized out>, thd=0x15132c000d90, this=0x15132c031c00) at /test/10.3_dbg/sql/item.h:841

#5  Item::fix_fields_if_needed_for_scalar (ref=<optimized out>, thd=0x15132c000d90, this=0x15132c031c00) at /test/10.3_dbg/sql/item.h:833

#6  Item::fix_fields_if_needed_for_order_by (ref=<optimized out>, thd=0x15132c000d90, this=0x15132c031c00) at /test/10.3_dbg/sql/item.h:841

#7  find_order_in_list (thd=thd@entry=0x15132c000d90, ref_pointer_array=<optimized out>, tables=tables@entry=0x15132c0134c0, order=order@entry=0x15132c031cc8, fields=@0x15132c013b50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x15132c08c420, last = 0x15132c08c540, elements = 2}, <No data fields>}, all_fields=@0x15132c08c870: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x15132c08c420, last = 0x15132c08c540, elements = 2}, <No data fields>}, is_group_field=false, add_to_all_fields=true, from_window_spec=false) at /test/10.3_dbg/sql/sql_select.cc:23707

#8  0x0000556f58e16f35 in setup_order (thd=thd@entry=0x15132c000d90, ref_pointer_array=<optimized out>, tables=tables@entry=0x15132c0134c0, fields=@0x15132c013b50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x15132c08c420, last = 0x15132c08c540, elements = 2}, <No data fields>}, all_fields=@0x15132c08c870: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x15132c08c420, last = 0x15132c08c540, elements = 2}, <No data fields>}, order=0x15132c031cc8, from_window_spec=false) at /test/10.3_dbg/sql/sql_select.cc:23754

#9  0x0000556f58e1b077 in setup_without_group (reserved=0x15132c030fe4, hidden_group_fields=0x15132c08c837, win_funcs=@0x15132c031108: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x556f5a19d120 <end_of_list>, last = 0x15132c031108, elements = 0}, <No data fields>}, win_specs=@0x15132c0310f0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x556f5a19d120 <end_of_list>, last = 0x15132c0310f0, elements = 0}, <No data fields>}, group=0x0, order=0x15132c031cc8, conds=0x15132c08c958, all_fields=@0x15132c08c870: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x15132c08c420, last = 0x15132c08c540, elements = 2}, <No data fields>}, fields=@0x15132c013b50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x15132c08c420, last = 0x15132c08c540, elements = 2}, <No data fields>}, leaves=@0x15132c030f20: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x15132c08cab8, last = 0x15132c08cab8, elements = 1}, <No data fields>}, tables=0x15132c0134c0, ref_pointer_array=<optimized out>, thd=0x15132c000d90) at /test/10.3_dbg/sql/sql_select.cc:676

#10 JOIN::prepare (this=0x15132c08c550, tables_init=<optimized out>, wild_num=wild_num@entry=0, conds_init=conds_init@entry=0x0, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x15132c030d08, unit_arg=0x15132c013478) at /test/10.3_dbg/sql/sql_select.cc:1157

#11 0x0000556f58e8dc4f in st_select_lex_unit::prepare (this=0x15132c013478, derived_arg=0x0, sel_result=sel_result@entry=0x0, additional_options=additional_options@entry=0) at /test/10.3_dbg/sql/sql_lex.h:827

#12 0x0000556f58f7a064 in With_element::prepare_unreferenced (this=this@entry=0x15132c031d20, thd=thd@entry=0x15132c000d90) at /test/10.3_dbg/sql/sql_cte.cc:1261

#13 0x0000556f58f7a0c3 in With_clause::prepare_unreferenced_elements (this=<optimized out>, thd=0x15132c000d90) at /test/10.3_dbg/sql/sql_cte.h:261

#14 0x0000556f58e1b72f in JOIN::prepare (this=this@entry=0x15132c077438, tables_init=<optimized out>, wild_num=<optimized out>, conds_init=<optimized out>, og_num=<optimized out>, order_init=<optimized out>, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x15132c0123b8, unit_arg=0x15132c0127f8) at /test/10.3_dbg/sql/sql_select.cc:1246

#15 0x0000556f58e8874f in st_select_lex_unit::prepare_join (this=this@entry=0x15132c0127f8, thd_arg=0x15132c000d90, sl=sl@entry=0x15132c0123b8, tmp_result=tmp_result@entry=0x15132c077350, additional_options=additional_options@entry=0, is_union_select=is_union_select@entry=false) at /test/10.3_dbg/sql/sql_union.cc:647

#16 0x0000556f58e8c68e in st_select_lex_unit::prepare (this=this@entry=0x15132c0127f8, derived_arg=derived_arg@entry=0x15132c033808, sel_result=0x15132c077350, additional_options=additional_options@entry=0) at /test/10.3_dbg/sql/sql_union.cc:993

#17 0x0000556f58d6c60a in mysql_derived_prepare (thd=0x15132c000d90, lex=0x15132c004b80, derived=0x15132c033808) at /test/10.3_dbg/sql/sql_derived.cc:793

#18 0x0000556f58d6d705 in mysql_handle_single_derived (lex=lex@entry=0x15132c004b80, derived=derived@entry=0x15132c033808, phases=phases@entry=2) at /test/10.3_dbg/sql/sql_derived.cc:193

#19 0x0000556f58eb2369 in TABLE_LIST::handle_derived (this=this@entry=0x15132c033808, lex=lex@entry=0x15132c004b80, phases=phases@entry=2) at /test/10.3_dbg/sql/table.cc:8419

#20 0x0000556f58d8d4a9 in LEX::handle_list_of_derived (phases=2, table_list=<optimized out>, this=0x15132c004b80) at /test/10.3_dbg/sql/table.h:2684

#21 st_select_lex::handle_derived (this=<optimized out>, lex=0x15132c004b80, phases=phases@entry=2) at /test/10.3_dbg/sql/sql_lex.cc:4198

#22 0x0000556f58e1a95b in JOIN::prepare (this=this@entry=0x15132c076788, tables_init=0x15132c033808, wild_num=0, conds_init=0x0, og_num=0, order_init=0x0, skip_order_by=false, group_init=0x0, having_init=0x0, proc_param_init=0x0, select_lex_arg=0x15132c0053d8, unit_arg=0x15132c004c40) at /test/10.3_dbg/sql/sql_select.cc:1066

#23 0x0000556f58e8874f in st_select_lex_unit::prepare_join (this=this@entry=0x15132c004c40, thd_arg=0x15132c000d90, sl=sl@entry=0x15132c0053d8, tmp_result=tmp_result@entry=0x0, additional_options=additional_options@entry=0, is_union_select=is_union_select@entry=false) at /test/10.3_dbg/sql/sql_union.cc:647

#24 0x0000556f58e8c68e in st_select_lex_unit::prepare (this=this@entry=0x15132c004c40, derived_arg=0x0, sel_result=sel_result@entry=0x0, additional_options=additional_options@entry=0) at /test/10.3_dbg/sql/sql_union.cc:993

#25 0x0000556f58e99504 in mysql_create_view (thd=thd@entry=0x15132c000d90, views=views@entry=0x15132c011c28, mode=VIEW_CREATE_NEW) at /test/10.3_dbg/sql/sql_view.cc:538

#26 0x0000556f58dba5df in mysql_execute_command (thd=thd@entry=0x15132c000d90) at /test/10.3_dbg/sql/sql_parse.cc:5898

#27 0x0000556f58dbcd24 in mysql_parse (thd=thd@entry=0x15132c000d90, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x151388060530, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.3_dbg/sql/sql_parse.cc:7870

#28 0x0000556f58dbf495 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x15132c000d90, packet=packet@entry=0x15132c0198f1 "CREATE VIEW v951 AS SELECT v948 FROM ( WITH v959 AS ( SELECT ( 'x' = ( v950 IN ( SELECT DISTINCT ( SELECT v947 FROM v946 WHERE ( v947 , ( v947 < 'x' ) ) NOT IN ( SELECT ( v950 % v950 <= v950 ) , 17 FR"..., packet_length=packet_length@entry=756, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.3_dbg/sql/sql_class.h:1152

#29 0x0000556f58dc2625 in do_command (thd=0x15132c000d90) at /test/10.3_dbg/sql/sql_parse.cc:1398

#30 0x0000556f58eea85f in do_handle_one_connection (connect=connect@entry=0x556f5bfbf770) at /test/10.3_dbg/sql/sql_connect.cc:1403

#31 0x0000556f58eeaa96 in handle_one_connection (arg=0x556f5bfbf770) at /test/10.3_dbg/sql/sql_connect.cc:1308

#32 0x0000151391641609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#33 0x0000151391566133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95