func_in.result, func_in.test:

  Added a case for bug #6365.
item_cmpfunc.cc:
  Fixed bug #6365 : Server crashed when list of values
  in IN predicate contains NULL while the tested field is
  of the character type and not of the default set;
  e.g. when f in 'f IN (NULL,'aa') belongs to binary
  character set, while the default character set is latin1.

mysql-test/r/func_in.result

@@ -179,3 +179,9 @@ select 1 in ('1.1',2);
 select 1 in ('1.1',2.0);
 1 in ('1.1',2.0)
 0
+create table t1 (a char(20) character set binary);
+insert into t1 values ('aa'), ('bb');
+select * from t1 where a in (NULL, 'aa');
+a
+aa
+drop table t1;

mysql-test/t/func_in.test

@@ -89,3 +89,10 @@ select 1 in ('1.0',2.0);
 select 1 in (1.0,'2.0');
 select 1 in ('1.1',2);
 select 1 in ('1.1',2.0);
+
+# Test case for bug #6365
+
+create table t1 (a char(20) character set binary);
+insert into t1 values ('aa'), ('bb');
+select * from t1 where a in (NULL, 'aa');
+drop table t1;

sql/item_cmpfunc.cc

@@ -1749,7 +1749,8 @@ void Item_func_in::fix_length_and_dec()
         thd->set_n_backup_item_arena(arena, &backup);
       for (arg= args+1, arg_end= args+arg_count; arg < arg_end; arg++)
       {
-        if (!my_charset_same(cmp_collation.collation,
+        if (!arg[0]->null_value &&
+            !my_charset_same(cmp_collation.collation,
                              arg[0]->collation.collation))
         {
           Item_string *conv;