LP:600968 - RQG: Crash in fix_semijoin_strategies_for_picked_join_order()

Queries of the following form cause a crash in maria 5.3 and not on 5.2 or lp:mysql. The correct response instead seems to be "1242: Subquery returns more than 1 row"

SELECT `col_int_key` FROM C
WHERE (
SELECT `col_varchar_nokey`
FROM CC SUBQUERY1_t1
WHERE `col_varchar_key` = ANY (
SELECT CHILD_SUBQUERY1_t1 .`col_varchar_key`
FROM CC CHILD_SUBQUERY1_t1
LEFT JOIN A ON CHILD_SUBQUERY1_t1 .`pk`
WHERE SUBQUERY1_t1 .`col_int_nokey`
)
)

bzr version-info:

[philips@eve mysql-test]$ bzr version-info
revision-id: <email address hidden>
date: 2010-06-14 15:17:54 +0400
build-date: 2010-07-02 02:40:41 -0700
revno: 2789
branch-nick: maria

backtrace:

#3 0x082776c0 in handle_segfault (sig=11) at mysqld.cc:2683
#4 <signal handler called>
#5 0x083ad313 in fix_semijoin_strategies_for_picked_join_order (join=0xadacc58) at opt_subselect.cc:2044
#6 0x08304e2f in get_best_combination (join=0xadacc58) at sql_select.cc:5859
#7 0x082fdf92 in make_join_statistics (join=0xadacc58, tables_arg=0xace1780, conds=0xadb6f30, keyuse_array=0xadb1990) at sql_select.cc:2970
#8 0x082f654b in JOIN::optimize (this=0xadacc58) at sql_select.cc:921
#9 0x0822dbe4 in subselect_single_select_engine::exec (this=0xace29c8) at item_subselect.cc:2521
#10 0x08228a27 in Item_subselect::exec (this=0xace2910) at item_subselect.cc:461
#11 0x0822976f in Item_singlerow_subselect::val_int (this=0xace2910) at item_subselect.cc:818
#12 0x081d93c7 in eval_const_cond (cond=0xace2910) at item_func.cc:63
#13 0x0830f231 in remove_eq_conds (thd=0xab881a0, cond=0xace2910, cond_value=0xadacb34) at sql_select.cc:10325
#14 0x0830ec20 in optimize_cond (join=0xada7de8, conds=0xace2910, join_list=0xab89b5c, cond_value=0xadacb34) at sql_select.cc:10163
#15 0x082f5e56 in JOIN::optimize (this=0xada7de8) at sql_select.cc:784
#16 0x082fb8fa in mysql_select (thd=0xab881a0, rref_pointer_array=0xab89b9c, tables=0xace1038, wild_num=0, fields=..., conds=0xace2910, og_num=0, order=0x0,
group=0x0, having=0x0, proc_param=0x0, select_options=2147764736, result=0xace2a60, unit=0xab89810, select_lex=0xab89a98) at sql_select.cc:2364
#17 0x082f4803 in handle_select (thd=0xab881a0, lex=0xab897b4, result=0xace2a60, setup_tables_done_option=0) at sql_select.cc:276
#18 0x0829466d in execute_sqlcom_select (thd=0xab881a0, all_tables=0xace1038) at sql_parse.cc:5133
#19 0x0828b069 in mysql_execute_command (thd=0xab881a0) at sql_parse.cc:2318
#20 0x08296857 in mysql_parse (thd=0xab881a0,
inBuf=0xace0cc8 "SELECT `col_int_key`\nFROM C\nWHERE (\nSELECT `col_varchar_nokey`\nFROM CC SUBQUERY1_t1\nWHERE `col_varchar_key` = ANY (\nSELECT CHILD_SUBQUERY1_t1 .`col_varchar_key`\nFROM CC CHILD_SUBQUERY1_t1 LEFT JOI"..., length=273, found_semicolon=0xaedb4228) at sql_parse.cc:6079
#21 0x08288b11 in dispatch_command (command=COM_QUERY, thd=0xab881a0,
packet=0xac93571 "SELECT `col_int_key`\nFROM C\nWHERE (\nSELECT `col_varchar_nokey`\nFROM CC SUBQUERY1_t1\nWHERE `col_varchar_key` = ANY (\nSELECT CHILD_SUBQUERY1_t1 .`col_varchar_key`\nFROM CC CHILD_SUBQUERY1_t1 LEFT JOI"..., packet_length=276) at sql_parse.cc:1253
#22 0x08287d4f in do_command (thd=0xab881a0) at sql_parse.cc:891
#23 0x08284e96 in handle_one_connection (arg=0xab881a0) at sql_connect.cc:1599
#24 0x00a08919 in start_thread () from /lib/libpthread.so.0
#25 0x00951e5e in clone () from /lib/libc.so.6

code:

(gdb) list
2039 POSITION *pos= join->best_positions + tablenr;
2040 JOIN_TAB *s= pos->table;
2041 uint first;
2042 LINT_INIT(first); // Set by every branch except SJ_OPT_NONE which doesn't use it
2043
2044 if ((handled_tabs & s->table->map) || pos->sj_strategy == SJ_OPT_NONE)
2045

{ 2046 remaining_tables |= s->table->map; 2047 continue; 2048 }

(gdb) print s
$1 = (JOIN_TAB *) 0xa5a5a5a5