Bug #111379 Assertion `context->query_block == thd->lex->current_query_block()' failed

Description:
The latest version of the MySQL Server (version 8.0.33) (git commit hash: ea7087d8850) crashes with Assertion Failure when executing the following query:

Config from "/etc/mysql/conf.d/mysql.cnf":

```
[mysqld]
sql_mode = "NO_ENGINE_SUBSTITUTION"
```

```sql
drop database if exists test123;
create database test123;
use test123;
create table v0(c1 INT);
SELECT * FROM v0 GROUP BY c1 HAVING c1 MEMBER OF ( EXISTS ( ( TABLE v0 LOCK IN SHARE MODE ) ORDER BY c1) ) ;
```

The last query returns error: 

```
mysql> SELECT * FROM v0 GROUP BY c1 HAVING c1 MEMBER OF ( EXISTS ( ( TABLE v0 LOCK IN SHARE MODE ) ORDER BY c1) ) ;
mysqld: /home/mysql/mysql-server/sql/item.cc:8012: virtual bool Item_ref::fix_fields(THD *, Item **): Assertion `context->query_block == thd->lex->current_query_block()' failed.
2023-06-13T01:43:36Z UTC - mysqld got signal 6 ;
Most likely, you have hit a bug, but this error can also be caused by malfunctioning hardware.
BuildID[sha1]=1d55d4671b7469352fc317efb0121b604c26443d
Thread pointer: 0xfffefc001040
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = ffff984bb538 thread_stack 0x100000
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(my_print_stacktrace(unsigned char const*, unsigned long)+0x60) [0x4e6bc30]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(print_fatal_signal(int)+0x340) [0x1a89320]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(handle_fatal_signal+0x16c) [0x1a896dc]
linux-vdso.so.1(__kernel_rt_sigreturn+0) [0xffffa23a67a0]
/lib/aarch64-linux-gnu/libc.so.6(gsignal+0xe0) [0xffffa1a1ad78]
/lib/aarch64-linux-gnu/libc.so.6(abort+0x114) [0xffffa1a07aac]
/lib/aarch64-linux-gnu/libc.so.6(+0x2d490) [0xffffa1a14490]
/lib/aarch64-linux-gnu/libc.so.6(+0x2d4f4) [0xffffa1a144f4]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_ref::fix_fields(THD*, Item**)+0x13b0) [0x1eb8b30]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_field::fix_outer_field(THD*, Field**, Item**)+0xfa4) [0x1ea2c08]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_field::fix_fields(THD*, Item**)+0xd0c) [0x1ea5758]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(find_order_in_list(THD*, Bounds_checked_array<Item*>, Table_ref*, ORDER*, mem_root_deque<Item*>*, bool, bool)+0xe9c) [0x1701820]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(setup_order(THD*, Bounds_checked_array<Item*>, Table_ref*, mem_root_deque<Item*>*, ORDER*)+0x3fc) [0x16dd028]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Query_block::prepare(THD*, mem_root_deque<Item*>*)+0x1520) [0x16d5efc]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Query_expression::prepare(THD*, Query_result*, mem_root_deque<Item*>*, unsigned long long, unsigned long long)+0x7d8) [0x18abef0]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_subselect::fix_fields(THD*, Item**)+0x270) [0x20f93f8]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_func::fix_func_arg(THD*, Item**)+0x60) [0x1fb93b4]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Item_func::fix_fields(THD*, Item**)+0x1d4) [0x1fb9138]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Query_block::prepare(THD*, mem_root_deque<Item*>*)+0x1900) [0x16d62dc]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Sql_cmd_select::prepare_inner(THD*)+0x3d4) [0x17371ac]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Sql_cmd_dml::prepare(THD*)+0xa28) [0x173632c]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(Sql_cmd_dml::execute(THD*)+0x538) [0x1737bb4]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(mysql_execute_command(THD*, bool)+0x281c) [0x162bcd8]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(dispatch_sql_command(THD*, Parser_state*)+0x1124) [0x16252c0]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(dispatch_command(THD*, COM_DATA const*, enum_server_command)+0x5434) [0x161e224]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld(do_command(THD*)+0xb8c) [0x16228f4]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld() [0x1a59a64]
/home/mysql/mysql-server/bld/runtime_output_directory/mysqld() [0x655c1a0]
/lib/aarch64-linux-gnu/libpthread.so.0(+0x7624) [0xffffa234c624]
/lib/aarch64-linux-gnu/libc.so.6(+0xd149c) [0xffffa1ab849c]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (fffefc0243c0): SELECT * FROM v0 GROUP BY c1 HAVING c1 MEMBER OF ( EXISTS ( ( TABLE v0 LOCK IN SHARE MODE ) ORDER BY c1) )
Connection ID (thread ID): 8
Status: NOT_KILLED
```

How to repeat:
Steps to repeat the Assertion Failure:
1. Download the MySQL Server source code from the official github repo: `https://github.com/mysql/mysql-server`
2. Checkout to the latest mysql released version: 8.0.33 (hash: `ea7087d8850`)
3. Compile MySQL using the command: 

```
mkdir -p bld
cd bld
cmake .. -DDOWNLOAD_BOOST=1 -DWITH_BOOST=../boost -DWITH_UNIT_TESTS=OFF -DUSE_LD_GOLD=1 -DWITH_DEBUG=1
make
```

4. Run the MySQL Server with command: 

```
./bin/mysqld --basedir=$(pwd) --datadir=$(pwd)/data_all/ori_data --port=7000  --socket=/tmp/mysql_0.sock --mysqlx=OFF --performance_schema=OFF
```

5. Setup the MySQL Server config in the path: "/etc/mysql/conf.d/mysql.cnf"

```
[mysqld]
sql_mode = "NO_ENGINE_SUBSTITUTION"
```

6. Run the MySQL Client with the PoC:

```
./bin/mysql --port=7000 --user=root --socket=/tmp/mysql_0.sock < poc_0.sql
```

where `poc_0.sql` is:

```sql
drop database if exists test123;
create database test123;
use test123;
create table v0(c1 INT);
SELECT * FROM v0 GROUP BY c1 HAVING c1 MEMBER OF ( EXISTS ( ( TABLE v0 LOCK IN SHARE MODE ) ORDER BY c1) ) ;
```

Suggested fix:
The server should continue running instead of crashing by Assertion Failure.

Hello Yu Liang,

Thank you for the report and test case.
Observed that 8.0.33 only debug build is affected.

regards,
Umesh

-- release build
 ./mtr bug111379 --nocheck-testcases
Logging: ./mtr  bug111379 --nocheck-testcases
MySQL Version 8.0.33
Checking supported features
Using 'all' suites
Collecting tests
Checking leftover processes
Removing old var directory
Creating var directory '/export/home/tmp/ushastry/binaries/mysql-8.0.33/mysql-test/var'
Installing system database
Using parallel: 1

==============================================================================
                  TEST NAME                       RESULT  TIME (ms) COMMENT
------------------------------------------------------------------------------
drop database if exists test123;
Warnings:
Note    1008    Can't drop database 'test123'; database doesn't exist
create database test123;
use test123;
create table v0(c1 INT);
SELECT * FROM v0 GROUP BY c1 HAVING c1 MEMBER OF ( EXISTS ( ( TABLE v0 LOCK IN SHARE MODE ) ORDER BY c1) ) ;
c1
[ 50%] main.bug111379                            [ pass ]     83
[100%] shutdown_report                           [ pass ]

-- debug build - affected

 ./mtr bug111379 --nocheck-testcases --debug-server
Logging: ./mtr  bug111379 --nocheck-testcases --debug-server
MySQL Version 8.0.33
Checking supported features
 - Binaries are debug compiled
Using 'all' suites
Collecting tests
Checking leftover processes
Removing old var directory
Creating var directory '/export/home/tmp/ushastry/binaries/mysql-8.0.33/mysql-test/var'
Installing system database
Using parallel: 1

==============================================================================
                  TEST NAME                       RESULT  TIME (ms) COMMENT
------------------------------------------------------------------------------
drop database if exists test123;
Warnings:
Note    1008    Can't drop database 'test123'; database doesn't exist
create database test123;
use test123;
create table v0(c1 INT);
SELECT * FROM v0 GROUP BY c1 HAVING c1 MEMBER OF ( EXISTS ( ( TABLE v0 LOCK IN SHARE MODE ) ORDER BY c1) ) ;
[ 50%] main.bug111379                            [ fail ]
        Test ended at 2023-06-13 10:06:28

CURRENT_TEST: main.bug111379
mysqltest: At line 5: Query 'SELECT * FROM v0 GROUP BY c1 HAVING c1 MEMBER OF ( EXISTS ( ( TABLE v0 LOCK IN SHARE MODE ) ORDER BY c1) ) ' failed.
ERROR 2013 (HY000): Lost connection to MySQL server during query

-bt

#0  0x00007f16457b8aa1 in pthread_kill () from /lib64/libpthread.so.0
#1  0x0000000004005426 in my_write_core(int) ()
#2  0x00000000032b0166 in handle_fatal_signal ()
#3  <signal handler called>
#4  0x00007f1643c79387 in raise () from /lib64/libc.so.6
#5  0x00007f1643c7aa78 in abort () from /lib64/libc.so.6
#6  0x00007f1643c721a6 in __assert_fail_base () from /lib64/libc.so.6
#7  0x00007f1643c72252 in __assert_fail () from /lib64/libc.so.6
#8  0x0000000003403b59 in Item_ref::fix_fields(THD*, Item**) ()
#9  0x00000000034051c9 in Item_field::fix_outer_field(THD*, Field**, Item**) ()
#10 0x0000000003405769 in Item_field::fix_fields(THD*, Item**) ()
#11 0x000000000317e357 in find_order_in_list(THD*, Bounds_checked_array<Item*>, Table_ref*, ORDER*, mem_root_deque<Item*>*, bool, bool) ()
#12 0x000000000317e5ab in setup_order(THD*, Bounds_checked_array<Item*>, Table_ref*, mem_root_deque<Item*>*, ORDER*) ()
#13 0x00000000031884b7 in Query_block::prepare(THD*, mem_root_deque<Item*>*) ()
#14 0x0000000003209cd7 in Query_expression::prepare(THD*, Query_result*, mem_root_deque<Item*>*, unsigned long long, unsigned long long) ()
#15 0x00000000034a374a in SubqueryWithResult::prepare(THD*) ()
#16 0x00000000034a9cb6 in Item_subselect::fix_fields(THD*, Item**) ()
#17 0x00000000034583d5 in Item_func::fix_func_arg(THD*, Item**) ()
#18 0x00000000034585b8 in Item_func::fix_fields(THD*, Item**) ()
#19 0x0000000003188327 in Query_block::prepare(THD*, mem_root_deque<Item*>*) ()
#20 0x0000000003194935 in Sql_cmd_select::prepare_inner(THD*) ()
#21 0x000000000319e16d in Sql_cmd_dml::prepare(THD*) ()
#22 0x000000000319e48e in Sql_cmd_dml::execute(THD*) ()
#23 0x000000000313f789 in mysql_execute_command(THD*, bool) ()
#24 0x0000000003140bc8 in dispatch_sql_command(THD*, Parser_state*) ()
#25 0x00000000031421fb in dispatch_command(THD*, COM_DATA const*, enum_server_command) ()
#26 0x0000000003143e97 in do_command(THD*) ()
#27 0x00000000032a219e in handle_connection ()
#28 0x00000000047b1601 in pfs_spawn_thread ()
#29 0x00007f16457b3ea5 in start_thread () from /lib64/libpthread.so.0
#30 0x00007f1643d41b2d in clone () from /lib64/libc.so.6

After running bisecting, the bug seems to be introduced in commit: `8e7252ecf14290edc3b486245d34d4e3ea84126a`. The buggy introduced commit contains no commit messages, so I am not sure what has been changed under the hood. 

At the same time, bug #111305 and bug #111307 shares the same bug introduced commit in the bisecting process. We are not sure whether these three bugs are due to the same root cause.