Server crashes in Item_ref::const_item / Item::cache_const_expr_analyzer

create table t (a varchar(16) character set utf8mb3, b int);

insert into t values ('foo',1),('bar',2);

create view v as select a, b, count(*) from t;

execute immediate 'select * from v where (@x := b) like a';

# Cleanup

drop view v;

drop table t;

#3  <signal handler called>

#4  0x00005577257f0052 in Item_ref::const_item (this=0x62b000064b28) at /data/src/10.4/sql/item.h:5471

#5  0x00005577261764db in Item::cache_const_expr_analyzer (this=0x62b000064b28, arg=0x7f5acf6f2670) at /data/src/10.4/sql/item.cc:7249

#6  0x000055772617e347 in Item_ref::compile (this=0x62b000064b28, thd=0x62b00005b208, analyzer=(bool (Item::*)(Item * const, uchar **)) 0x5577261763a4 <Item::cache_const_expr_analyzer(unsigned char**)>, arg_p=0x7f5acf6f2670, transformer=(Item *(Item::*)(Item * const, THD *, uchar *)) 0x557726176850 <Item::cache_const_expr_transformer(THD*, unsigned char*)>, arg_t=0x7f5acf6f2b20 "") at /data/src/10.4/sql/item.cc:8225

#7  0x00005577262454c8 in Item_func::compile (this=0x62b00008ed30, thd=0x62b00005b208, analyzer=(bool (Item::*)(Item * const, uchar **)) 0x5577261763a4 <Item::cache_const_expr_analyzer(unsigned char**)>, arg_p=0x7f5acf6f2780, transformer=(Item *(Item::*)(Item * const, THD *, uchar *)) 0x557726176850 <Item::cache_const_expr_transformer(THD*, unsigned char*)>, arg_t=0x7f5acf6f2b20 "") at /data/src/10.4/sql/item_func.cc:557

#8  0x00005577262454c8 in Item_func::compile (this=0x62b0000642e0, thd=0x62b00005b208, analyzer=(bool (Item::*)(Item * const, uchar **)) 0x5577261763a4 <Item::cache_const_expr_analyzer(unsigned char**)>, arg_p=0x7f5acf6f2880, transformer=(Item *(Item::*)(Item * const, THD *, uchar *)) 0x557726176850 <Item::cache_const_expr_transformer(THD*, unsigned char*)>, arg_t=0x7f5acf6f2b20 "") at /data/src/10.4/sql/item_func.cc:557

#9  0x000055772617e624 in Item_ref::compile (this=0x62b0000647a0, thd=0x62b00005b208, analyzer=(bool (Item::*)(Item * const, uchar **)) 0x5577261763a4 <Item::cache_const_expr_analyzer(unsigned char**)>, arg_p=0x7f5acf6f2990, transformer=(Item *(Item::*)(Item * const, THD *, uchar *)) 0x557726176850 <Item::cache_const_expr_transformer(THD*, unsigned char*)>, arg_t=0x7f5acf6f2b20 "") at /data/src/10.4/sql/item.cc:8233

#10 0x00005577262454c8 in Item_func::compile (this=0x62b0000649c8, thd=0x62b00005b208, analyzer=(bool (Item::*)(Item * const, uchar **)) 0x5577261763a4 <Item::cache_const_expr_analyzer(unsigned char**)>, arg_p=0x7f5acf6f2b30, transformer=(Item *(Item::*)(Item * const, THD *, uchar *)) 0x557726176850 <Item::cache_const_expr_transformer(THD*, unsigned char*)>, arg_t=0x7f5acf6f2b20 "") at /data/src/10.4/sql/item_func.cc:557

#11 0x000055772569e6ac in Item::top_level_compile (this=0x62b0000649c8, thd=0x62b00005b208, analyzer=(bool (Item::*)(Item * const, uchar **)) 0x5577261763a4 <Item::cache_const_expr_analyzer(unsigned char**)>, arg_p=0x7f5acf6f2b30, transformer=(Item *(Item::*)(Item * const, THD *, uchar *)) 0x557726176850 <Item::cache_const_expr_transformer(THD*, unsigned char*)>, arg_t=0x7f5acf6f2b20 "") at /data/src/10.4/sql/item.h:1909

#12 0x0000557725ad31ab in JOIN::cache_const_exprs (this=0x62b000063ba0) at /data/src/10.4/sql/sql_select.cc:28785

#13 0x0000557725a0e279 in JOIN::optimize_stage2 (this=0x62b000063ba0) at /data/src/10.4/sql/sql_select.cc:2639

#14 0x0000557725a0b595 in JOIN::optimize_inner (this=0x62b000063ba0) at /data/src/10.4/sql/sql_select.cc:2394

#15 0x0000557725a04233 in JOIN::optimize (this=0x62b000063ba0) at /data/src/10.4/sql/sql_select.cc:1711

#16 0x000055772587eb29 in mysql_derived_optimize (thd=0x62b00005b208, lex=0x62b00008c228, derived=0x62b00008e4d8) at /data/src/10.4/sql/sql_derived.cc:1029

#17 0x0000557725879320 in mysql_handle_single_derived (lex=0x62b00008c228, derived=0x62b00008e4d8, phases=4) at /data/src/10.4/sql/sql_derived.cc:200

#18 0x0000557725a0978f in JOIN::optimize_inner (this=0x62b0000633b0) at /data/src/10.4/sql/sql_select.cc:2201

#19 0x0000557725a04233 in JOIN::optimize (this=0x62b0000633b0) at /data/src/10.4/sql/sql_select.cc:1711

#20 0x0000557725a25107 in mysql_select (thd=0x62b00005b208, tables=0x62b00008e4d8, wild_num=0, fields=..., conds=0x62b00008efe0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2416184064, result=0x62b00008fa48, unit=0x62b00008c2e8, select_lex=0x62b00008de90) at /data/src/10.4/sql/sql_select.cc:4812

#21 0x00005577259f5f37 in handle_select (thd=0x62b00005b208, lex=0x62b00008c228, result=0x62b00008fa48, setup_tables_done_option=0) at /data/src/10.4/sql/sql_select.cc:442

#22 0x000055772596545f in execute_sqlcom_select (thd=0x62b00005b208, all_tables=0x62b00008e4d8) at /data/src/10.4/sql/sql_parse.cc:6473

#23 0x0000557725952974 in mysql_execute_command (thd=0x62b00005b208) at /data/src/10.4/sql/sql_parse.cc:3976

#24 0x00005577259c281d in Prepared_statement::execute (this=0x619000086b88, expanded_query=0x7f5acf6f5910, open_cursor=false) at /data/src/10.4/sql/sql_prepare.cc:5024

#25 0x00005577259bde5d in Prepared_statement::execute_loop (this=0x619000086b88, expanded_query=0x7f5acf6f5910, open_cursor=false, packet=0x0, packet_end=0x0) at /data/src/10.4/sql/sql_prepare.cc:4493

#26 0x00005577259c3930 in Prepared_statement::execute_immediate (this=0x619000086b88, query=0x62b000062310 "select * from v where (@x := b) like a", query_len=38) at /data/src/10.4/sql/sql_prepare.cc:5148

#27 0x00005577259b4cff in mysql_sql_stmt_execute_immediate (thd=0x62b00005b208) at /data/src/10.4/sql/sql_prepare.cc:3012

#28 0x0000557725952991 in mysql_execute_command (thd=0x62b00005b208) at /data/src/10.4/sql/sql_parse.cc:3982

#29 0x000055772596e6af in mysql_parse (thd=0x62b00005b208, rawbuf=0x62b000062228 "execute immediate 'select * from v where (@x := b) like a'", length=58, parser_state=0x7f5acf6f7860, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:8010

#30 0x000055772594497a in dispatch_command (command=COM_QUERY, thd=0x62b00005b208, packet=0x629000230209 "execute immediate 'select * from v where (@x := b) like a'", packet_length=58, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1857

#31 0x00005577259414e9 in do_command (thd=0x62b00005b208) at /data/src/10.4/sql/sql_parse.cc:1378

#32 0x0000557725d40a48 in do_handle_one_connection (connect=0x6080000009a8) at /data/src/10.4/sql/sql_connect.cc:1420

#33 0x0000557725d4035f in handle_one_connection (arg=0x6080000009a8) at /data/src/10.4/sql/sql_connect.cc:1324

#34 0x00005577269afdd4 in pfs_spawn_thread (arg=0x615000003508) at /data/src/10.4/storage/perfschema/pfs.cc:1869

#35 0x00007f5ad74a7fd4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#36 0x00007f5ad75285bc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

commit 5dc9a6b4558d50298882b3d76b3249e9419e3682

Author: Igor Babaev

Date:   Fri Apr 21 13:46:14 2023 -0700

    MDEV-31102 Crash when pushing condition into view defined as union