Bug #31156 mysqld: item_sum.cc:918: virtual bool Item_sum_distinct::setup(THD*): Assertion

Description:
070923 14:59:53 [Note] /home/sbester/server/5.1/mysql-5.1.23-beta-linux-i686/bin/mysqld: ready for connections.
Version: '5.1.23-beta-debug'  socket: '/tmp/mysql.sock'  port: 3306  yes
mysqld: item_sum.cc:918: virtual bool Item_sum_distinct::setup(THD*): Assertion `tree == 0' failed.
070923 15:00:10 - mysqld got signal 6;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help diagnose
the problem, but since we have already crashed, something is definitely wrong
and this may fail.

key_buffer_size=8388572
read_buffer_size=131072
max_used_connections=1
max_threads=151
threads_connected=1
It is possible that mysqld could use up to 
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 337620 K
bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

thd: 0x87bc4a0
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
Cannot determine thread, fp=0x40ca8844, backtrace may not be correct.
Stack range sanity check OK, backtrace follows:
0x820111b handle_segfault + 541
0xffffe410 _end + -142173536
0x400edb75 _end + 932549125
0x400e5903 _end + 932515731
0x81672d7 Item_sum_distinct::setup(THD*) + 253
0x827ac1c setup_sum_funcs(THD*, Item_sum**) + 96
0x8260c4f JOIN::exec() + 5405
0x81c2797 subselect_single_select_engine::exec() + 843
0x81bd9a8 Item_subselect::exec() + 38
0x81be511 Item_singlerow_subselect::val_str(String*) + 21
0x8157ae4 Item_copy_string::copy() + 36
0x827a3cc copy_fields(TMP_TABLE_PARAM*) + 66
0x82749a5 end_send_group(JOIN*, st_join_table*, bool) + 865
0x8272ad3 evaluate_join_record(JOIN*, st_join_table*, int, char*) + 445
0x82728b9 sub_select(JOIN*, st_join_table*, bool) + 209
0x8272400 do_select(JOIN*, List<Item>*, st_table*, Procedure*) + 756
0x82612bf JOIN::exec() + 7053
0x826181e _Z12mysql_selectP3THDPPP4ItemP10TABLE_LISTjR4ListIS1_ES2_jP8st_orderSB_S2_SB_yP13select_resultP18st_select_lex_unitP13st_select + 638
0x825c33d handle_select(THD*, st_lex*, select_result*, unsigned long) + 365
0x8215af4 execute_sqlcom_select(THD*, TABLE_LIST*) + 772
0x820e7d5 mysql_execute_command(THD*) + 1701
0x8217550 mysql_parse(THD*, char const*, unsigned int, char const**) + 372
0x820cc00 dispatch_command(enum_server_command, THD*, char*, unsigned int) + 2354
0x820c2c2 do_command(THD*) + 600
0x820acbd handle_one_connection + 255
0x40038aa7 _end + 931807543
0x4017ec2e _end + 933143230
New value of fp=(nil) failed sanity check, terminating stack trace!
Please read http://dev.mysql.com/doc/refman/5.1/en/resolve-stack-dump.html
and follow instructions on how to resolve the stack trace.
Resolved stack trace is much more helpful in diagnosing the
problem, so please do resolve it
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort...
thd->query at 0x87ec230 = select 1 from t1 group by (select sleep(0) from t1 order by avg( distinct `col000`) )
thd->thread_id=1

How to repeat:
#run debug build of mysqld then :

drop table if exists t1;
create table `t1` (`col000`int)engine=myisam;
insert into t1 values (),(),();
select 1 from t1 group by (select sleep(0) from t1 order by avg(distinct `col000`) );

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/35082

ChangeSet@1.2553, 2007-10-08 12:57:43+03:00, gkodinov@magare.gmz +3 -0
  Bug #31156: mysqld: item_sum.cc:918: virtual bool 
    Item_sum_distinct::setup(THD*): Assertion
  
  There was an assertion to detect a bug in ROLLUP
  implementation. However the assertion is not true
  when used in a subquery context with non-cacheable
  statements.
  Fixed by turning the assertion to accepted case
  (just like it's done for the other aggregate functions).

Pushed into 5.0.52

Pushed into 5.1.23-beta

Pushed into 6.0.4-alpha

Noted in 5.0.52, 5.1.23, 6.0.4 changelogs.

An assertion designed detect a bug in the ROLLUP implementation
incorrectly failed when used in subquery context with non-cacheable 
statements.