MDEV-23291: SUM column from a derived table returns invalid values

The issue here was the read_set bitmap was not set for a field which
was used as a reference in an inner select.
We need to make sure that if we are in an inner select and we have
references from outer select then we update the table bitmaps for
such references.

Introduced a function in the class Item_subselect that would
update bitmaps of table for the references within a
subquery that are defined in outer selects.

mysql-test/r/view.result

@@ -6818,5 +6818,20 @@ DROP PROCEDURE sp1;
 DROP VIEW v1;
 DROP TABLE t1, t2;
 #
+# MDEV-23291: SUM column from a derived table returns invalid values
+#
+CREATE TABLE t1(a INT, b INT);
+INSERT INTO t1 VALUES (1,1), (2,2);
+CREATE view v1 AS
+SELECT a as x, (select x) as y, (select y) as z FROM t1;
+SELECT sum(z) FROM (SELECT a as x, (select x) as y, (select y) as z FROM t1) q;
+sum(z)
+3
+SELECT sum(z) FROM v1;
+sum(z)
+3
+DROP TABLE t1;
+DROP VIEW v1;
+#
 # End of 10.2 tests
 #

mysql-test/t/view.test

@@ -6543,6 +6543,22 @@ DROP PROCEDURE sp1;
 DROP VIEW v1;
 DROP TABLE t1, t2;
 
+--echo #
+--echo # MDEV-23291: SUM column from a derived table returns invalid values
+--echo #
+
+CREATE TABLE t1(a INT, b INT);
+INSERT INTO t1 VALUES (1,1), (2,2);
+
+CREATE view v1 AS
+SELECT a as x, (select x) as y, (select y) as z FROM t1;
+
+SELECT sum(z) FROM (SELECT a as x, (select x) as y, (select y) as z FROM t1) q;
+SELECT sum(z) FROM v1;
+
+DROP TABLE t1;
+DROP VIEW v1;
+
 --echo #
 --echo # End of 10.2 tests
 --echo #

sql/item_subselect.cc

@@ -436,6 +436,26 @@ bool Item_subselect::mark_as_dependent(THD *thd, st_select_lex *select,
 }
 
 
+/*
+  @brief
+    Update the table bitmaps for the outer references used within a subquery
+*/
+
+bool Item_subselect::update_table_bitmaps_processor(void *arg)
+{
+  List_iterator<Ref_to_outside> it(upper_refs);
+  Ref_to_outside *upper;
+
+  while ((upper= it++))
+  {
+    if (upper->item &&
+        upper->item->walk(&Item::update_table_bitmaps_processor, FALSE, arg))
+      return TRUE;
+  }
+  return FALSE;
+}
+
+
 /*
   Adjust attributes after our parent select has been merged into grandparent
 

sql/item_subselect.h

@@ -249,6 +249,7 @@ class Item_subselect :public Item_result_field,
     @retval FALSE otherwise
   */
   bool is_expensive_processor(void *arg) { return is_expensive(); }
+  bool update_table_bitmaps_processor(void *arg);
 
   /**
     Get the SELECT_LEX structure associated with this Item.