Bulk INSERT: IN list and REGEXP with a parameter use the first parameter set for all rows

In an optimized bulk INSERT/REPLACE (COM_STMT_BULK_EXECUTE, CF_PS_ARRAY_BINDING_OPTIMIZED), an IN list with a parameter in the list and REGEXP with a parameter in the pattern use the first parameter set for all rows.

How to repeat

Array binding with 3 parameter sets; columns are given as (row1, row2, row3):

CREATE TABLE tl (id INT, r INT);

-- bulk: id = (1,2,3), second parameter = (2,3,2)

INSERT INTO tl VALUES (?, 2 IN (?, 5));

-- bulk: id = (1,2,3), second parameter = (1,2,1)

INSERT INTO tl VALUES (?, '12' REGEXP CONCAT('^', ?));

Expected r = 1, 0, 1 in both cases. Actual: 1, 1, 1 in both cases.

Reproduced on 10.11 (10.11.19 debug) and 11.4 (11.4.13 debug, source revision 4813c2f0a8a79e4e4c000cc8c9447096fafe7033).

Correct results in similar cases:

• bulk UPDATE (not optimized, executed once per parameter set): UPDATE tl SET r= 2 IN (?, 5) WHERE id= ? and the REGEXP variant;
• ordinary PREPARE / repeated EXECUTE with different values;
• ? IN (2, 5) (parameter on the left) and 120 LIKE CONCAT(?, '%') in the same bulk INSERT.

The optimized bulk INSERT runs the statement once and only re-reads the parameter values for each row. Items that cache something computed from "constant" arguments, such as the sorted array of Item_func_in and the compiled REGEXP pattern, keep the values of the first parameter set. Subqueries have the same problem, see MDEV-23864.