Server crashes in make_join_statistics on IN subquery, constant table

revision-id: igor@askmonty.org-20131012062457-xvp1ecvw97zwklc4

revno: 3704

branch-nick: 5.3

CREATE TABLE t1 (i1 INT) ENGINE=MyISAM;

INSERT INTO t1 VALUES (1),(2);

CREATE TABLE t2 (i2 INT, INDEX(i2)) ENGINE=MyISAM;

CREATE TABLE t3 (i3 INT, c VARCHAR(1), INDEX(i3), INDEX(c)) ENGINE=MyISAM;

INSERT INTO t3 VALUES (3,'x'),(4,'y');

SELECT * FROM t1 WHERE ( 1, 1 ) IN ( 

  SELECT i2, i2 FROM t2 LEFT OUTER JOIN ( 

    t3 AS t3a INNER JOIN t3 AS t3b ON ( t3a.i3 = t3b.i3 ) 

  ) ON ( t3a.c = t3b.c ) 

);

#3  <signal handler called>

#4  0x000000000071222a in make_join_statistics (join=0x7fb878039a00, tables_list=..., conds=0x7fb87808bc08, keyuse_array=0x7fb878039cd8) at sql_select.cc:3516

#5  0x0000000000709bbb in JOIN::optimize (this=0x7fb878039a00) at sql_select.cc:1158

#6  0x00000000007106a9 in mysql_select (thd=0x3669858, rref_pointer_array=0x366c548, tables=0x7fb878004df8, wild_num=1, fields=..., conds=0x7fb878039748, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147764736, result=0x7fb8780399e0, unit=0x366bde8, select_lex=0x366c2f0) at sql_select.cc:2986

#7  0x000000000070714d in handle_select (thd=0x3669858, lex=0x366bd48, result=0x7fb8780399e0, setup_tables_done_option=0) at sql_select.cc:288

#8  0x0000000000693312 in execute_sqlcom_select (thd=0x3669858, all_tables=0x7fb878004df8) at sql_parse.cc:5172

#9  0x000000000068a0da in mysql_execute_command (thd=0x3669858) at sql_parse.cc:2305

#10 0x0000000000695d9c in mysql_parse (thd=0x3669858, rawbuf=0x7fb878004b00 "SELECT * FROM t1 WHERE ( 1, 1 ) IN ( \nSELECT i2, i2 FROM t2 LEFT OUTER JOIN ( \nt3 AS t3a INNER JOIN t3 AS t3b ON ( t3a.i3 = t3b.i3 ) \n) ON ( t3a.c = t3b.c ) \n)", length=159, found_semicolon=0x7fb887d497e0) at sql_parse.cc:6173

#11 0x00000000006877f7 in dispatch_command (command=COM_QUERY, thd=0x3669858, packet=0x36e3ba9 "SELECT * FROM t1 WHERE ( 1, 1 ) IN ( \nSELECT i2, i2 FROM t2 LEFT OUTER JOIN ( \nt3 AS t3a INNER JOIN t3 AS t3b ON ( t3a.i3 = t3b.i3 ) \n) ON ( t3a.c = t3b.c ) \n)", packet_length=159) at sql_parse.cc:1243

#12 0x0000000000686a68 in do_command (thd=0x3669858) at sql_parse.cc:923

#13 0x0000000000683902 in handle_one_connection (arg=0x3669858) at sql_connect.cc:1231

#14 0x00007fb89596ce9a in start_thread (arg=0x7fb887d4a700) at pthread_create.c:308

#15 0x00007fb894e95cbd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112