MDEV-16803: Pushdown Item_func_in item that uses vectors in several S…

…ELECTs

The bug appears because of the Item_func_in::build_clone() method.
The 'array' field for the Item_func_in item that can be pushed into
the materialized view/derived table was built in the wrong way.
It becomes lame after the pushdown of the condition into the first
SELECT that defines that view/derived table. The server crashes in
the pushdown into the next SELECT while trying to use already lame
'array' field.

To fix it Item_func_in::build_clone() was changed.

mysql-test/r/derived_cond_pushdown.result

@@ -10220,3 +10220,24 @@ EXPLAIN
   }
 }
 DROP TABLE t1;
+#
+# MDEV-16803: pushdown condition with IN predicate in the derived table
+#             defined with several SELECT statements
+#
+CREATE TABLE t1 (a INT, b INT);
+INSERT INTO t1 VALUES (1,2),(3,2),(1,1);
+SELECT * FROM
+(
+SELECT a,b,1 as c
+FROM t1
+UNION ALL
+SELECT a,b,2 as c
+FROM t1
+) AS tab
+WHERE ((a,b) IN ((1,2),(3,2)));
+a	b	c
+1	2	1
+3	2	1
+1	2	2
+3	2	2
+DROP TABLE t1;

mysql-test/t/derived_cond_pushdown.test

@@ -2022,3 +2022,23 @@ EVAL $query;
 EVAL EXPLAIN FORMAT=JSON $query;
 
 DROP TABLE t1;
+
+--echo #
+--echo # MDEV-16803: pushdown condition with IN predicate in the derived table
+--echo #             defined with several SELECT statements
+--echo #
+
+CREATE TABLE t1 (a INT, b INT);
+INSERT INTO t1 VALUES (1,2),(3,2),(1,1);
+
+SELECT * FROM
+(
+  SELECT a,b,1 as c
+  FROM t1
+  UNION ALL
+  SELECT a,b,2 as c
+  FROM t1
+) AS tab
+WHERE ((a,b) IN ((1,2),(3,2)));
+
+DROP TABLE t1;

sql/item_cmpfunc.cc

@@ -4436,9 +4436,8 @@ Item *Item_func_in::build_clone(THD *thd, MEM_ROOT *mem_root)
   Item_func_in *clone= (Item_func_in *) Item_func::build_clone(thd, mem_root);
   if (clone)
   {
-    if (array && clone->create_array(thd))
-        return NULL;
     bzero(&clone->cmp_items, sizeof(cmp_items));
+    clone->fix_length_and_dec();
   }
   return clone;
 }