MySQL Bugs: #60279: Pure virtual method called in Item_bool_func2::fix_length_and

Bug #60279	Pure virtual method called in Item_bool_func2::fix_length_and_dec()
Submitted:	28 Feb 2011 11:30	Modified:	15 Oct 2012 14:38
Reporter:	Roy Lyseng	Email Updates:
Status:	Can't repeat	Impact on me:	None
Category:	MySQL Server: Optimizer	Severity:	S1 (Critical)
Version:	5.1.54, 5.5.8, 5.5.9, 5.5.15, 5.6	OS:	Any
Assigned to:		CPU Architecture:	Any

Description:
Server crashes with a pure virtual method call.

Copied from mailing list: http://lists.mysql.com/mysql/224493

How to repeat:
create table t1(a int);
create table t2(b int);
PREPARE stmt FROM "select sum(b) from t2 group by b having b in (select b from t1)";
execute stmt;

Verified with 5.1.54 and 5.5.9 also. Stack trace is:

 	mysqld.exe!Item_func::fix_fields(THD * thd=0x04b78418, Item * * ref=0x04b62d54)  Line 178 + 0xb bytes	C++
 	mysqld.exe!setup_conds(THD * thd=0x04b78400, TABLE_LIST * tables=0x023073d0, TABLE_LIST * leaves=0x023073d0, Item * * conds=0x04b62d54)  Line 8090 + 0x10 bytes	C++
 	mysqld.exe!setup_without_group(THD * thd=0x00000001, Item * * ref_pointer_array=0x02307768, TABLE_LIST * tables=0x023073d0, TABLE_LIST * leaves=0x023073d0, List<Item> & fields={...}, List<Item> & all_fields={...}, Item * * conds=0x04b62d54, st_order * order=0x00000000, st_order * group=0x00000000, bool * hidden_group_fields=0x04b62cc3)  Line 432 + 0x4b bytes	C++
 	mysqld.exe!JOIN::prepare(Item * * * rref_pointer_array=0x02306ffc, TABLE_LIST * tables_init=0x023073d0, unsigned int wild_num=0, Item * conds_init=0x02307998, unsigned int og_num=0, st_order * order_init=0x00000000, st_order * group_init=0x00000000, Item * having_init=0x00000000, st_order * proc_param_init=0x00000000, st_select_lex * select_lex_arg=0x02306f00, st_select_lex_unit * unit_arg=0x02307090)  Line 521 + 0xcd bytes	C++
 	mysqld.exe!subselect_single_select_engine::prepare()  Line 1786 + 0x50 bytes	C++
 	mysqld.exe!Item_subselect::fix_fields(THD * thd_param=0x04b78418, Item * * ref=0x02307800)  Line 173 + 0xa bytes	C++
 	mysqld.exe!Item_in_subselect::fix_fields(THD * thd_arg=0x04b78418, Item * * ref=0x02307800)  Line 1644 + 0x11 bytes	C++
 	mysqld.exe!Item_in_optimizer::fix_fields(THD * thd=0x04b78418, Item * * ref=0x04b60908)  Line 1742 + 0x17 bytes	C++
 	mysqld.exe!JOIN::prepare(Item * * * rref_pointer_array=0x023063f4, TABLE_LIST * tables_init=0x02306bc8, unsigned int wild_num=0, Item * conds_init=0x00000000, unsigned int og_num=1, st_order * order_init=0x00000000, st_order * group_init=0x02306e48, Item * having_init=0x023077a8, st_order * proc_param_init=0x00000000, st_select_lex * select_lex_arg=0x023062f8, st_select_lex_unit * unit_arg=0x02306080)  Line 534 + 0x18 bytes	C++
 	mysqld.exe!mysql_select(THD * thd=0x04b78418, Item * * * rref_pointer_array=0x023063f4, TABLE_LIST * tables=0x02306bc8, unsigned int wild_num=0, List<Item> & fields={...}, Item * conds=0x00000000, unsigned int og_num=1, st_order * order=0x00000000, st_order * group=0x02306e48, Item * having=0x023077a8, st_order * proc_param=0x00000000, unsigned __int64 select_options=2416200192, select_result * result=0x02307698, st_select_lex_unit * unit=0x02306080, st_select_lex * select_lex=0x023062f8)  Line 2523 + 0x49 bytes	C++
 	mysqld.exe!handle_select(THD * thd=0x04b78418, st_lex * lex=0x02306020, select_result * result=0x02307698, unsigned long setup_tables_done_option=0)  Line 269 + 0x75 bytes	C++
 	mysqld.exe!execute_sqlcom_select(THD * thd=0x00000000, TABLE_LIST * all_tables=0x00000000)  Line 5144 + 0xa bytes	C++
 	mysqld.exe!mysql_execute_command(THD * thd=0x04b78418)  Line 2293 + 0xb bytes	C++
 	mysqld.exe!check_stack_overrun(THD * thd=0x023073d0, long margin=79135744, unsigned char * buf=0x04b78418)  Line 5700 + 0x27 bytes	C++
 	mysqld.exe!open_table(THD * thd=0x005604cc, TABLE_LIST * table_list=0x023135ac, st_mem_root * mem_root=0x023135a0, bool * refresh=0x0054a4a7, unsigned int flags=5544427)  Line 3006	C++
 	mysqld.exe!reinit_stmt_before_use(THD * thd=0x02306f00, st_lex * lex=0x00000000)  Line 2410 + 0x8 bytes	C++
 	mysqld.exe!st_select_lex::cleanup()  Line 798	C++
...

reminds me of slightly different bug #59533

Bug #63035 was marked as a duplicate of this one.