MDEV-29300 Assertion `*ref && (*ref)->fixed()' failed in Item_field::fix_outer_field on SELECT

This issue arises when we have an outer reference resolved in another outer reference
where that outer reference is resolved in a outer select that is a grouping select.
Under these circumstances, the intermediate item is wrapped in an Item_outer_ref and
fixing is deferred later until fix_inner_refs.  As this item wrapper isn't fixed
we fail this assertion.  The fix here is to resolve the item at the lowest level
to the item inside the wrapper, which is fixed.  This item can then get it's
own wrapper pointing to the ultimate resolution of this item.

Approved by Sanja Byelkin (sanja@mariadb.com) 2025-06-13

Author: mariadb-RexJohnston

mysql-test/main/subselect4.result

@@ -3366,3 +3366,11 @@ Variable_name	Value
 Handler_read_rnd_next	0
 drop table t1,t2,t3;
 # End of 10.4 tests
+#
+# MDEV-29300 Assertion `*ref && (*ref)->fixed()' failed in Item_field::fix_outer_field on SELECT
+#
+CREATE TABLE t(c INT);
+SELECT (SELECT 0 GROUP BY c HAVING (SELECT c)) FROM t GROUP BY c;
+(SELECT 0 GROUP BY c HAVING (SELECT c))
+DROP TABLE t;
+# End of 10.11 tests

mysql-test/main/subselect4.test

@@ -2687,3 +2687,12 @@ drop table t1,t2,t3;
 
 --echo # End of 10.4 tests
 
+--echo #
+--echo # MDEV-29300 Assertion `*ref && (*ref)->fixed()' failed in Item_field::fix_outer_field on SELECT
+--echo #
+
+CREATE TABLE t(c INT);
+SELECT (SELECT 0 GROUP BY c HAVING (SELECT c)) FROM t GROUP BY c;
+DROP TABLE t;
+
+--echo # End of 10.11 tests

sql/item.cc

@@ -5792,6 +5792,8 @@ resolve_ref_in_select_and_group(THD *thd, Item_ident *ref, SELECT_LEX *select)
       DBUG_ASSERT((*select_ref)->fixed());
       return &select->ref_pointer_array[counter];
     }
+    if (group_by_ref && (*group_by_ref)->type() == Item::REF_ITEM)
+      return ((Item_ref*)(*group_by_ref))->ref;
     if (group_by_ref)
       return group_by_ref;
     DBUG_ASSERT(FALSE);