subselect.result, subselect.test:

  Added a test case for bug #9338.
sql_select.cc:
  Fixed bug #9338.
  When an occurence of a field reference has to be replaced
  by another field reference the whole Item_field must be
  replaced.
item.cc:
  Fixed bug #9338.
  The method Item_field::replace_equal_field_processor was
  replaced by Item_field::replace_equal_field. The new method
  is used to replace the occurences of Item_field objects.
item.h:
  Fixed bug #9338.
  The virtual function replace_equal_field_processor was replaced
  by replace_equal_field. The latter is supposed to be used as a
  callback function in calls of the method transform.


sql/item.h:
  Fixed bug #9338.
  The virtual function replace_equal_field_processor was replaced
  by replace_equal_field. The latter is supposed to be used as a
  callback function in calls of the method transform.
sql/item.cc:
  The method Item_field::replace_equal_field_processor was
  replaced by Item_field::replace_equal_field The new method
  is used to replace the occurences of Item_field objects.
sql/sql_select.cc:
  Fixed bug #9338.
  When an occurence of a field reference has to be replaced
  by another field reference the whole Item_field must be
  replaced.
mysql-test/t/subselect.test:
  Added a test case for bug #9338.
mysql-test/r/subselect.result:
  Added a test case for bug #9338.

mysql-test/r/subselect.result

@@ -2746,3 +2746,19 @@ NULL
 2.00
 4.00
 drop table t1;
+CREATE table t1 ( c1 integer );
+INSERT INTO t1 VALUES ( 1 );
+INSERT INTO t1 VALUES ( 2 );
+INSERT INTO t1 VALUES ( 3 );
+CREATE TABLE t2 ( c2 integer );
+INSERT INTO t2 VALUES ( 1 );
+INSERT INTO t2 VALUES ( 4 );
+INSERT INTO t2 VALUES ( 5 );
+SELECT * FROM t1 LEFT JOIN t2 ON c1 = c2 WHERE c2 IN (1);
+c1	c2
+1	1
+SELECT * FROM t1 LEFT JOIN t2 ON c1 = c2
+WHERE c2 IN ( SELECT c2 FROM t2 WHERE c2 IN ( 1 ) );
+c1	c2
+1	1
+DROP TABLE t1,t2;

mysql-test/t/subselect.test

@@ -1752,3 +1752,24 @@ insert into t1 values (1, 1), (2, 2), (2, 3), (3, 4), (3, 5), (3, 6), (NULL, NUL
 select * from t1;
 select min(a) from t1 group by grp;
 drop table t1;
+
+#
+# Test for bug #9338: lame substitution of c1 instead of c2 
+#
+
+CREATE table t1 ( c1 integer );
+INSERT INTO t1 VALUES ( 1 );
+INSERT INTO t1 VALUES ( 2 );
+INSERT INTO t1 VALUES ( 3 );
+
+CREATE TABLE t2 ( c2 integer );
+INSERT INTO t2 VALUES ( 1 );
+INSERT INTO t2 VALUES ( 4 );
+INSERT INTO t2 VALUES ( 5 );
+
+SELECT * FROM t1 LEFT JOIN t2 ON c1 = c2 WHERE c2 IN (1);
+
+SELECT * FROM t1 LEFT JOIN t2 ON c1 = c2
+  WHERE c2 IN ( SELECT c2 FROM t2 WHERE c2 IN ( 1 ) );
+
+DROP TABLE t1,t2;

sql/item.cc

@@ -2978,41 +2978,38 @@ Item *Item_field::set_no_const_sub(byte *arg)
 
 
 /*
-  Set a pointer to the multiple equality the field reference belongs to
+  Replace an Item_field for an equal Item_field that evaluated earlier
   (if any)
    
   SYNOPSIS
-    replace_equal_field_processor()
+    replace_equal_field_()
     arg - a dummy parameter, is not used here
   
   DESCRIPTION
-    The function replaces a pointer to a field in the Item_field object
-    by a pointer to another field.
-    The replacement field is taken from the very beginning of
-    the item_equal list which the Item_field object refers to (belongs to)  
-    If the Item_field object does not refer any Item_equal object,
-    nothing is done.
+    The function returns a pointer to an item that is taken from
+    the very beginning of the item_equal list which the Item_field
+    object refers to (belongs to).  
+    If the Item_field object does not refer any Item_equal object
+    'this' is returned 
 
   NOTES
     This function is supposed to be called as a callback parameter in calls
-    of the walk method.  
+    of the thransformer method.  
 
   RETURN VALUES
-    0 
+    pointer to a replacement Item_field if there is a better equal item;
+    this - otherwise.
 */
 
-bool Item_field::replace_equal_field_processor(byte *arg)
+Item *Item_field::replace_equal_field(byte *arg)
 {
   if (item_equal)
   {
     Item_field *subst= item_equal->get_first();
     if (!field->eq(subst->field))
-    {
-      field= subst->field;
-      return 0;
-    }
+      return subst;
   }
-  return 0;
+  return this;
 }
 
 

sql/item.h

@@ -520,7 +520,7 @@ class Item {
   virtual bool collect_item_field_processor(byte * arg) { return 0; }
   virtual Item *equal_fields_propagator(byte * arg) { return this; }
   virtual Item *set_no_const_sub(byte *arg) { return this; }
-  virtual bool replace_equal_field_processor(byte * arg) { return 0; }
+  virtual Item *replace_equal_field(byte * arg) { return this; }
   
   virtual Item *this_item() { return this; } /* For SPs mostly. */
   virtual Item *this_const_item() const { return const_cast<Item*>(this); } /* For SPs mostly. */
@@ -750,7 +750,7 @@ class Item_field :public Item_ident
   Item_equal *find_item_equal(COND_EQUAL *cond_equal);
   Item *equal_fields_propagator(byte *arg);
   Item *set_no_const_sub(byte *arg);
-  bool replace_equal_field_processor(byte *arg);
+  Item *replace_equal_field(byte *arg);
   inline uint32 max_disp_length() { return field->max_length(); }
   Item_field *filed_for_view_update() { return this; }
   Item *safe_charset_converter(CHARSET_INFO *tocs);

sql/sql_select.cc

@@ -7050,7 +7050,7 @@ static COND* substitute_for_best_equal_field(COND *cond,
     return eliminate_item_equal(0, cond_equal, item_equal);
   }
   else
-    cond->walk(&Item::replace_equal_field_processor, 0);
+    cond->transform(&Item::replace_equal_field, 0);
   return cond;
 }