MDEV-22534 check there are enough ref slots

mysql-test/main/subselect_decorrelate_in.result

@@ -159,8 +159,8 @@ json_extract(trace, '$**.join_optimization.steps[*].transformation.to')
 ["materialization", "semijoin"]
 drop table ten, t1, t2;
 # group by and having checks in the transformer; also not in
-create table t1 (a1 int, b1 char(8));
-create table t2 (a2 int, b2 char(8));
+create table t1 (a1 int not null, b1 char(8) not null);
+create table t2 (a2 int not null, b2 char(8) not null);
 insert into t1 values (0, '2 - 00');
 insert into t1 values (1, '2 - 01');
 insert into t1 values (2, '2 - 02');

mysql-test/main/subselect_decorrelate_in.test

@@ -73,8 +73,8 @@ drop table ten, t1, t2;
 
 --echo # group by and having checks in the transformer; also not in
 
-create table t1 (a1 int, b1 char(8));
-create table t2 (a2 int, b2 char(8));
+create table t1 (a1 int not null, b1 char(8) not null);
+create table t2 (a2 int not null, b2 char(8) not null);
 
 insert into t1 values (0, '2 - 00');
 insert into t1 values (1, '2 - 01');

sql/item_subselect.cc

@@ -3133,6 +3133,8 @@ bool Item_in_subselect::exists2in_processor(void *opt_arg)
   List<Item> outer;
   Query_arena *arena= NULL, backup;
   int res= FALSE;
+  uint outer_offset;
+  const uint offset= first_select->item_list.elements;
   DBUG_ENTER("Item_in_subselect::exists2in_processor");
 
   /*
@@ -3187,16 +3189,21 @@ bool Item_in_subselect::exists2in_processor(void *opt_arg)
     DBUG_ASSERT(prm.count >= (uint)eqs.elements());
     will_be_correlated= prm.count > (uint)eqs.elements();
   }
+
+  if ((uint)eqs.elements() > (first_select->item_list.elements +
+                              first_select->select_n_reserved))
+    goto out;
+
   /* Switch to the permanent arena if we are in a ps/sp execution */
   arena= thd->activate_stmt_arena_if_needed(&backup);
+
   /* Construct the items for left_expr */
   if (left_expr->type() == Item::ROW_ITEM)
     for (uint i= 0; i < left_expr->cols(); i++)
       outer.push_back(left_expr->element_index(i));
   else
     outer.push_back(left_expr);
-  const uint outer_offset= outer.elements;
-  const uint offset= first_select->item_list.elements;
+  outer_offset= outer.elements;
   DBUG_ASSERT(outer_offset == offset);
   /* Move items to outer and select item list */
   for (uint i= 0; i < (uint)eqs.elements(); i++)