BUG#952372: Server crashes on 2nd execution of PS in find_field_in_tables with...

BUG#952372: Server crashes on 2nd execution of PS in find_field_in_tables with semijoin+materialization
- The problem was that convert_subq_to_jtbm() attached the semi-join
  TABLE_LIST object into the wrong list: they used to attach it to the 
  end of parent_lex->leaf_tables.head()->next_local->...->next_local.
  This was apparently inccorect, as one can construct an example where 
  JTBM nest is attached to a table that is inside some mergeable VIEW, which
  breaks (causes crash) for name resolution on the subsequent statement
  re-execution.
- Solution: Attach to the "right" list. The "wording" was copied from
  st_select_lex::handle_derived.

mysql-test/r/subselect_sj.result

@@ -2628,4 +2628,26 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	PRIMARY	t3	ALL	NULL	NULL	NULL	NULL	100	Using where; Using join buffer (flat, BNL join)
 drop table t0,t1,t3;
 set optimizer_switch= @tmp_923246;
+#
+# BUG#952372: Server crashes on 2nd execution of PS in find_field_in_tables with semijoin+materialization
+#
+CREATE TABLE t1 ( a INT );
+INSERT INTO t1 VALUES (2),(3);
+CREATE VIEW v1 AS SELECT * FROM t1;
+CREATE TABLE t2 ( b VARCHAR(1) );
+INSERT INTO t2 VALUES ('v'),('v');
+PREPARE pstmt FROM
+'SELECT DISTINCT a FROM v1, t2
+   WHERE b IN ( SELECT MIN(b) FROM t2 )';
+EXECUTE pstmt;
+a
+2
+3
+EXECUTE pstmt;
+a
+2
+3
+DEALLOCATE PREPARE pstmt;
+DROP VIEW v1;
+DROP TABLE t1, t2;
 set optimizer_switch=@subselect_sj_tmp;

mysql-test/r/subselect_sj_jcl6.result

@@ -2642,6 +2642,28 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	PRIMARY	t3	ALL	NULL	NULL	NULL	NULL	100	Using where; Using join buffer (flat, BNL join)
 drop table t0,t1,t3;
 set optimizer_switch= @tmp_923246;
+#
+# BUG#952372: Server crashes on 2nd execution of PS in find_field_in_tables with semijoin+materialization
+#
+CREATE TABLE t1 ( a INT );
+INSERT INTO t1 VALUES (2),(3);
+CREATE VIEW v1 AS SELECT * FROM t1;
+CREATE TABLE t2 ( b VARCHAR(1) );
+INSERT INTO t2 VALUES ('v'),('v');
+PREPARE pstmt FROM
+'SELECT DISTINCT a FROM v1, t2
+   WHERE b IN ( SELECT MIN(b) FROM t2 )';
+EXECUTE pstmt;
+a
+2
+3
+EXECUTE pstmt;
+a
+2
+3
+DEALLOCATE PREPARE pstmt;
+DROP VIEW v1;
+DROP TABLE t1, t2;
 set optimizer_switch=@subselect_sj_tmp;
 #
 # BUG#49129: Wrong result with IN-subquery with join_cache_level=6 and firstmatch=off

mysql-test/t/subselect_sj.test

@@ -2331,5 +2331,27 @@ explain select * from t3 where a in (select kp1 from t1 where kp1<20);
 drop table t0,t1,t3;
 set optimizer_switch= @tmp_923246;
 
+
+--echo #
+--echo # BUG#952372: Server crashes on 2nd execution of PS in find_field_in_tables with semijoin+materialization
+--echo #
+CREATE TABLE t1 ( a INT );
+INSERT INTO t1 VALUES (2),(3);
+CREATE VIEW v1 AS SELECT * FROM t1;
+
+CREATE TABLE t2 ( b VARCHAR(1) );
+INSERT INTO t2 VALUES ('v'),('v');
+
+PREPARE pstmt FROM
+  'SELECT DISTINCT a FROM v1, t2
+   WHERE b IN ( SELECT MIN(b) FROM t2 )';
+
+EXECUTE pstmt;
+EXECUTE pstmt;
+
+DEALLOCATE PREPARE pstmt;
+DROP VIEW v1;
+DROP TABLE t1, t2;
+
 # The following command must be the last one the file 
 set optimizer_switch=@subselect_sj_tmp;

sql/opt_subselect.cc

@@ -1250,7 +1250,10 @@ static bool convert_subq_to_sj(JOIN *parent_join, Item_in_subselect *subq_pred)
     (a theory: a next_local chain always starts with ::leaf_tables
      because view's tables are inserted after the view)
   */
-  for (tl= parent_lex->leaf_tables.head(); tl->next_local; tl= tl->next_local) ;
+  
+  for (tl= (TABLE_LIST*)(parent_lex->table_list.first); tl->next_local; tl= tl->next_local)
+  {}
+
   tl->next_local= subq_lex->leaf_tables.head();
 
   /* A theory: no need to re-connect the next_global chain */
@@ -1463,7 +1466,7 @@ static bool convert_subq_to_jtbm(JOIN *parent_join,
     (a theory: a next_local chain always starts with ::leaf_tables
      because view's tables are inserted after the view)
   */
-  for (tl= parent_lex->leaf_tables.head(); tl->next_local; tl= tl->next_local)
+  for (tl= (TABLE_LIST*)(parent_lex->table_list.first); tl->next_local; tl= tl->next_local)
   {}
   tl->next_local= jtbm;