BUG#779885: Crash in eliminate_item_equal with materialization=on in maria-5.3

- In eliminate_item_equal(), we could end up in a situation where:
  = The multiple equality has a constant C1 (and so it is the "head item")
  = The join order was such that we've generated "sj_inner_table1=C1" equality,
    and now are looking to generate "sj_inner_table2_=..." equality. 
  When looking for what should be the other member of equality, we run

      Item *head_item= current_sjm? current_sjm_head: head;
  
  which sees current_sjm!=NULL, and takes current_sjm_head (which is NULL because 
  the constant C1 is the head for all cases).

- Fixed in a trivial way: take current_sjm_head if we don't have constant.

mysql-test/r/subselect.result

@@ -5087,3 +5087,23 @@ GROUP BY b;
 b
 0
 DROP TABLE t1;
+#
+# BUG#779885: Crash in eliminate_item_equal with materialization=on in maria-5.3
+#
+CREATE TABLE t1 ( f1 int );
+INSERT INTO t1 VALUES (19), (20);
+CREATE TABLE t2 ( f10 varchar(32) );
+INSERT INTO t2 VALUES ('c'),('d');
+CREATE TABLE t3 ( f10 varchar(32) );
+INSERT INTO t3 VALUES ('a'),('b');
+SELECT *
+FROM t1
+WHERE
+( 't' ) IN (
+SELECT t3.f10
+FROM t3
+JOIN t2
+ON t2.f10 = t3.f10
+);
+f1
+DROP TABLE t1,t2,t3;

mysql-test/r/subselect_no_mat.result

@@ -5089,6 +5089,26 @@ GROUP BY b;
 b
 0
 DROP TABLE t1;
+#
+# BUG#779885: Crash in eliminate_item_equal with materialization=on in maria-5.3
+#
+CREATE TABLE t1 ( f1 int );
+INSERT INTO t1 VALUES (19), (20);
+CREATE TABLE t2 ( f10 varchar(32) );
+INSERT INTO t2 VALUES ('c'),('d');
+CREATE TABLE t3 ( f10 varchar(32) );
+INSERT INTO t3 VALUES ('a'),('b');
+SELECT *
+FROM t1
+WHERE
+( 't' ) IN (
+SELECT t3.f10
+FROM t3
+JOIN t2
+ON t2.f10 = t3.f10
+);
+f1
+DROP TABLE t1,t2,t3;
 set optimizer_switch=default;
 select @@optimizer_switch like '%materialization=on%';
 @@optimizer_switch like '%materialization=on%'

mysql-test/r/subselect_no_opts.result

@@ -5086,4 +5086,24 @@ GROUP BY b;
 b
 0
 DROP TABLE t1;
+#
+# BUG#779885: Crash in eliminate_item_equal with materialization=on in maria-5.3
+#
+CREATE TABLE t1 ( f1 int );
+INSERT INTO t1 VALUES (19), (20);
+CREATE TABLE t2 ( f10 varchar(32) );
+INSERT INTO t2 VALUES ('c'),('d');
+CREATE TABLE t3 ( f10 varchar(32) );
+INSERT INTO t3 VALUES ('a'),('b');
+SELECT *
+FROM t1
+WHERE
+( 't' ) IN (
+SELECT t3.f10
+FROM t3
+JOIN t2
+ON t2.f10 = t3.f10
+);
+f1
+DROP TABLE t1,t2,t3;
 set optimizer_switch=default;

mysql-test/r/subselect_no_semijoin.result

@@ -5086,4 +5086,24 @@ GROUP BY b;
 b
 0
 DROP TABLE t1;
+#
+# BUG#779885: Crash in eliminate_item_equal with materialization=on in maria-5.3
+#
+CREATE TABLE t1 ( f1 int );
+INSERT INTO t1 VALUES (19), (20);
+CREATE TABLE t2 ( f10 varchar(32) );
+INSERT INTO t2 VALUES ('c'),('d');
+CREATE TABLE t3 ( f10 varchar(32) );
+INSERT INTO t3 VALUES ('a'),('b');
+SELECT *
+FROM t1
+WHERE
+( 't' ) IN (
+SELECT t3.f10
+FROM t3
+JOIN t2
+ON t2.f10 = t3.f10
+);
+f1
+DROP TABLE t1,t2,t3;
 set optimizer_switch=default;

mysql-test/t/subselect.test

@@ -4352,3 +4352,27 @@ SELECT b FROM t1
     GROUP BY b;
 
 DROP TABLE t1;
+
+--echo #
+--echo # BUG#779885: Crash in eliminate_item_equal with materialization=on in maria-5.3
+--echo #
+CREATE TABLE t1 ( f1 int );
+INSERT INTO t1 VALUES (19), (20);
+
+CREATE TABLE t2 ( f10 varchar(32) );
+INSERT INTO t2 VALUES ('c'),('d');
+
+CREATE TABLE t3 ( f10 varchar(32) );
+INSERT INTO t3 VALUES ('a'),('b');
+
+SELECT *
+FROM t1
+WHERE
+( 't' ) IN (
+        SELECT t3.f10
+        FROM t3
+        JOIN t2
+        ON t2.f10 = t3.f10
+);
+DROP TABLE t1,t2,t3;
+

sql/sql_select.cc

@@ -10160,8 +10160,16 @@ Item *eliminate_item_equal(COND *cond, COND_EQUAL *upper_levels,
     {
       if (eq_item)
         eq_list.push_back(eq_item);
+      
+      /*
+        If we're inside an SJM-nest (current_sjm!=NULL), and the multi-equality
+        doesn't include a constant, we should produce equality with the first
+        of the equals in this SJM.
 
-      Item *head_item= current_sjm? current_sjm_head: head;
+        In other cases, get the "head" item, which is either first of the
+        equals on top level, or the constant.
+      */
+      Item *head_item= (!item_const && current_sjm)? current_sjm_head: head;
       Item *head_real_item=  head_item->real_item();
       if (head_real_item->type() == Item::FIELD_ITEM)
         head_item= head_real_item;