Fixed bug #31075.

The `SELECT col FROM t WHERE col NOT IN (col, ...) GROUP BY col'
crashed in the range optimizer.

The get_func_mm_tree function has been modified to check the
Item_func_in::array field for the NULL value before using of that
value.

mysql-test/r/func_in.result

@@ -564,4 +564,9 @@ explain select f2 from t2 where f2 in (1,'b');
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	t2	index	t2f2	t2f2	5	NULL	3	Using where; Using index
 drop table t1, t2;
+create table t1 (a time, key(a));
+insert into t1 values (),(),(),(),(),(),(),(),(),();
+select a from t1 where a not in (a,a,a) group by a;
+a
+drop table t1;
 End of 5.1 tests

mysql-test/t/func_in.test

@@ -408,5 +408,13 @@ select f2 from t2 where f2 in (1,'b');
 explain select f2 from t2 where f2 in (1,'b');
 drop table t1, t2;
 
+#
+# Bug #31075: crash in get_func_mm_tree
+#
+
+create table t1 (a time, key(a));
+insert into t1 values (),(),(),(),(),(),(),(),(),();
+select a from t1 where a not in (a,a,a) group by a;
+drop table t1;
 
 --echo End of 5.1 tests

sql/opt_range.cc

@@ -5053,7 +5053,7 @@ static SEL_TREE *get_func_mm_tree(RANGE_OPT_PARAM *param, Item_func *cond_func,
 
     if (inv)
     {
-      if (func->array->result_type() != ROW_RESULT)
+      if (func->array && func->array->result_type() != ROW_RESULT)
       {
         /*
           We get here for conditions in form "t.key NOT IN (c1, c2, ...)",