Crash on 2nd ps execution caused by exists-to-in, and ASAN: use-after-poison in Item_func::fix_fields and Item_func::print_op

set optimizer_switch=default;

CREATE TABLE t1 (a INT);

CREATE TABLE t2 (b INT);

PREPARE st FROM "

SELECT * FROM t2

HAVING 0 IN (

  SELECT a FROM t1

  WHERE EXISTS ( 

    SELECT a FROM t1

    WHERE b = a

  )

)

";

EXECUTE st;

EXECUTE st;

drop table t1, t2;

mysys/stacktrace.c:215(my_print_stacktrace)[0x561ec390cefa]

sql/signal_handler.cc:238(handle_fatal_signal)[0x561ec30a10cb]

??:0(__restore_rt)[0x7fb3f1a26140]

sql/item.cc:495(Item::print_parenthesised(String*, enum_query_type, precedence))[0x561ec30c57f7]

sql/item_func.cc:634(Item_func::print_op(String*, enum_query_type))[0x561ec312d43e]

sql/item_cmpfunc.h:551(Item_bool_rowready_func2::print(String*, enum_query_type))[0x561ec2b7dc3d]

sql/item.cc:499(Item::print_parenthesised(String*, enum_query_type, precedence))[0x561ec30c584b]

sql/item_cmpfunc.cc:5385(Item_cond::print(String*, enum_query_type))[0x561ec310338e]

sql/item.cc:10894(dbug_print_item(Item*))[0x561ec30e6f31]

sql/sql_select.cc:1382(JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x561ec2d2fc40]

sql/item_subselect.cc:3943(subselect_single_select_engine::prepare(THD*))[0x561ec31b74e7]

sql/item_subselect.cc:296(Item_subselect::fix_fields(THD*, Item**))[0x561ec31a941c]

sql/item_subselect.cc:3602(Item_in_subselect::fix_fields(THD*, Item**))[0x561ec31b63a2]

sql/item.h:1147(Item::fix_fields_if_needed(THD*, Item**))[0x561ec2ba1620]

sql/item_cmpfunc.cc:1379(Item_in_optimizer::fix_fields(THD*, Item**))[0x561ec30f59d7]

sql/item.h:1147(Item::fix_fields_if_needed(THD*, Item**))[0x561ec2ba1620]

sql/item.h:1156(Item::fix_fields_if_needed_for_scalar(THD*, Item**))[0x561ec2ba1655]

sql/item.h:1161(Item::fix_fields_if_needed_for_bool(THD*, Item**))[0x561ec2c2a2cb]

sql/sql_select.cc:1552(JOIN::prepare(TABLE_LIST*, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*))[0x561ec2d3085d]

sql/sql_select.cc:5132(mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*))[0x561ec2d3da56]

sql/sql_select.cc:611(handle_select(THD*, LEX*, select_result*, unsigned long long))[0x561ec2d2ca67]

sql/sql_parse.cc:6024(execute_sqlcom_select(THD*, TABLE_LIST*))[0x561ec2cd4abd]

sql/sql_parse.cc:3944(mysql_execute_command(THD*, bool))[0x561ec2cccd4b]

sql/sql_prepare.cc:4992(Prepared_statement::execute(String*, bool))[0x561ec2d12dcd]

sql/sql_prepare.cc:4415(Prepared_statement::execute_loop(String*, bool, unsigned char*, unsigned char*))[0x561ec2d10f84]

sql/sql_prepare.cc:3457(mysql_sql_stmt_execute(THD*))[0x561ec2d0e647]

sql/sql_parse.cc:3961(mysql_execute_command(THD*, bool))[0x561ec2cccd90]

sql/sql_parse.cc:7760(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x561ec2cd96fa]

sql/sql_parse.cc:1894(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x561ec2cc6db0]

sql/sql_parse.cc:1405(do_command(THD*, bool))[0x561ec2cc5789]

sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x561ec2ea4fda]

sql/sql_connect.cc:1320(handle_one_connection)[0x561ec2ea4d45]

perfschema/pfs.cc:2203(pfs_spawn_thread)[0x561ec33a8fc4]

??:0(start_thread)[0x7fb3f1a1aea7]

??:0(clone)[0x7fb3f1216a2f]