Fix bug lp:858148.

Analysis:
The crash is a result of the same cause as all similar
bugs (lp:827416, lp:718763, lp:778413, lp:806943,
lp:611690). The general pattern is that some optimization
requires the evaluation of some condition (e.g. the WHERE
clause), and this condition contains a subquery, such that
the subquery itself requires a temporary table for its
execution. During the subquery execution the original
tables in the FROM clause are replaced by the temporary
table needed for the final GROUP or ORDER operation. All
this happens during optimization of the outer query. Later
when EXPLAIN is run for the subquery, explain attempts to
print the name of the tables in the FROM clause, but it
finds there a temporary table without a corresponding
TABLE_LIST object. The attempt to print the name of a
NULL table list results in a crash.

Solution:
This patch extends the fix to bug lp:702301, and dissalows
constant substitution of aggregate functions if the filter
condition used to check MIN/MAX keys is an expensive condition.

mysql-test/r/subselect_innodb.result

@@ -271,4 +271,38 @@ FROM t2
 WHERE (SELECT DISTINCT b FROM t3) > 0);
 a
 DROP TABLE t1, t2, t3;
+#
+# LP BUG#858148 Fourth crash in select_describe() with nested subqueries
+#
+CREATE TABLE t1 ( f1 int(11)) ENGINE=InnoDB;
+CREATE TABLE t2 ( f1 int(11), f2 int(11), PRIMARY KEY (f1)) ;
+CREATE TABLE t3 ( f3 int(11)) ENGINE=InnoDB;
+EXPLAIN
+SELECT MAX( f1 ) FROM t2
+WHERE f2 >= (
+SELECT SUM( f1 )
+FROM t1
+WHERE EXISTS (
+SELECT f3
+FROM t3
+GROUP BY 1
+)
+);
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+2	SUBQUERY	t1	ALL	NULL	NULL	NULL	NULL	1	
+3	SUBQUERY	t3	ALL	NULL	NULL	NULL	NULL	1	Using temporary; Using filesort
+SELECT MAX( f1 ) FROM t2
+WHERE f2 >= (
+SELECT SUM( f1 )
+FROM t1
+WHERE EXISTS (
+SELECT f3
+FROM t3
+GROUP BY 1
+)
+);
+MAX( f1 )
+NULL
+drop table t1, t2, t3;
 set optimizer_switch=@subselect_innodb_tmp;

mysql-test/t/subselect_innodb.test

@@ -264,4 +264,38 @@ WHERE t1.a = (
 
 DROP TABLE t1, t2, t3;
 
+
+--echo #
+--echo # LP BUG#858148 Fourth crash in select_describe() with nested subqueries
+--echo #
+
+CREATE TABLE t1 ( f1 int(11)) ENGINE=InnoDB;
+CREATE TABLE t2 ( f1 int(11), f2 int(11), PRIMARY KEY (f1)) ;
+CREATE TABLE t3 ( f3 int(11)) ENGINE=InnoDB;
+
+EXPLAIN
+SELECT MAX( f1 ) FROM t2
+WHERE f2 >= (
+        SELECT SUM( f1 )
+        FROM t1
+        WHERE EXISTS (
+                SELECT f3
+                FROM t3
+                GROUP BY 1
+        )
+);
+
+SELECT MAX( f1 ) FROM t2
+WHERE f2 >= (
+        SELECT SUM( f1 )
+        FROM t1
+        WHERE EXISTS (
+                SELECT f3
+                FROM t3
+                GROUP BY 1
+        )
+);
+
+drop table t1, t2, t3;
+
 set optimizer_switch=@subselect_innodb_tmp;

sql/opt_sum.cc

@@ -625,6 +625,8 @@ static bool matching_cond(bool max_fl, TABLE_REF *ref, KEY *keyinfo,
     /* Condition doesn't restrict the used table */
     DBUG_RETURN(!cond->const_item());
   }
+  else if (cond->is_expensive())
+    DBUG_RETURN(FALSE);
   if (cond->type() == Item::COND_ITEM)
   {
     if (((Item_cond*) cond)->functype() == Item_func::COND_OR_FUNC)