MDEV-14835 Server crashes in Field_iterator_table::create_item when number of

elements of BIGINT or YEAR type in the IN list reaches in_predicate_conversion_threshold The bug appears at the prepare stage when IN-predicate with the long list of values is converted into IN-subquery. It happens because values in the right operand of the IN-predicate that have BIGINT or YEAR types are converted into the Item_int_with_ref. To fix it in the procedure Item_func_in::create_value_list_for_tvc real_item() is taken for each value in the right operand of the IN-predicate.

Author: shagalla

mysql-test/r/opt_tvc.result

@@ -638,3 +638,21 @@ Warnings:
 Note	1003	/* select#1 */ select `test`.`t1`.`i` AS `i` from `test`.`t1` semi join ((values (NULL),(NULL),(NULL),(NULL),(NULL)) `tvc_0`) where `test`.`t1`.`i` = `tvc_0`.`NULL`
 SET in_predicate_conversion_threshold= default;
 DROP TABLE t1;
+#
+# MDEV-14835: conversion of TVC with BIGINT or YEAR values
+#
+SET @@in_predicate_conversion_threshold= 2;
+CREATE TABLE t1 (a BIGINT);
+CREATE TABLE t2 (y YEAR);
+INSERT INTO t1 VALUES (1), (2), (3);
+INSERT INTO t2 VALUES (2009), (2010), (2011);
+SELECT * FROM t1 WHERE a IN ('1','5','3');
+a
+1
+3
+SELECT * FROM t2 WHERE y IN ('2009','2011');
+y
+2009
+2011
+DROP TABLE t1,t2;
+SET @@in_predicate_conversion_threshold= default;

mysql-test/t/opt_tvc.test

@@ -340,3 +340,23 @@ eval EXPLAIN EXTENDED $q;
 SET in_predicate_conversion_threshold= default;
 
 DROP TABLE t1;
+
+--echo #
+--echo # MDEV-14835: conversion of TVC with BIGINT or YEAR values
+--echo #
+
+SET @@in_predicate_conversion_threshold= 2;
+
+CREATE TABLE t1 (a BIGINT);
+CREATE TABLE t2 (y YEAR);
+
+INSERT INTO t1 VALUES (1), (2), (3);
+INSERT INTO t2 VALUES (2009), (2010), (2011);
+
+SELECT * FROM t1 WHERE a IN ('1','5','3');
+
+SELECT * FROM t2 WHERE y IN ('2009','2011');
+
+DROP TABLE t1,t2;
+
+SET @@in_predicate_conversion_threshold= default;

sql/sql_tvc.cc

@@ -479,7 +479,7 @@ bool Item_func_in::create_value_list_for_tvc(THD *thd,
  return true;
  }
  }
- else if (tvc_value->push_back(args[i]))
+ else if (tvc_value->push_back(args[i]->real_item()))
  return true;
 
  if (values->push_back(tvc_value, thd->mem_root))