Fixed bug mdev-6874.

The method subselect_union_engine::no_rows() must take
into account the fact that now unit->fake_select_lex is
NULL for for select_union_direct objects.

mysql-test/r/union.result

@@ -1971,3 +1971,13 @@ FOUND_ROWS()
 1
 DROP TABLE t1, t2;
 # End of WL1763 tests
+#
+# Bug mdev-6874: crash with UNION ALL in a subquery
+#
+CREATE TABLE t1 (a int, b int);
+INSERT INTO t1 VALUES (1,1), (2,8);
+SELECT * FROM t1 t1_1 LEFT JOIN t1 t1_2 ON ( t1_2.b = t1_1.a )
+WHERE t1_2.b NOT IN ( SELECT 4 UNION ALL SELECT 5 );
+a	b	a	b
+1	1	1	1
+DROP TABLE t1;

mysql-test/t/union.test

@@ -1387,3 +1387,15 @@ DROP TABLE t1, t2;
 
 --echo # End of WL1763 tests
 
+--echo #
+--echo # Bug mdev-6874: crash with UNION ALL in a subquery
+--echo #
+
+CREATE TABLE t1 (a int, b int);
+INSERT INTO t1 VALUES (1,1), (2,8);
+
+SELECT * FROM t1 t1_1 LEFT JOIN t1 t1_2 ON ( t1_2.b = t1_1.a )
+  WHERE t1_2.b NOT IN ( SELECT 4 UNION ALL SELECT 5 );
+
+DROP TABLE t1;
+

sql/item_subselect.cc

@@ -3395,7 +3395,9 @@ bool subselect_union_engine::is_executed() const
 bool subselect_union_engine::no_rows()
 {
   /* Check if we got any rows when reading UNION result from temp. table: */
-  return MY_TEST(!unit->fake_select_lex->join->send_records);
+  return MY_TEST(!(unit->fake_select_lex ?
+                   unit->fake_select_lex->join->send_records :
+                   ((select_union_direct *) result)->send_records));
 }
 
 

sql/sql_class.h

@@ -4397,11 +4397,13 @@ class select_union_direct :public select_union
   ha_rows limit;
 
 public:
+  /* Number of rows in the union */
+  ha_rows send_records; 
   select_union_direct(select_result *result, SELECT_LEX *last_select_lex)
     :result(result), last_select_lex(last_select_lex),
     done_send_result_set_metadata(false), done_initialize_tables(false),
     limit_found_rows(0)
-  {}
+    { send_records= 0; }
   bool change_result(select_result *new_result);
   uint field_count(List<Item> &fields) const
   {
@@ -4432,6 +4434,7 @@ class select_union_direct :public select_union
       and for the results of subquery engines
       (select_<something>_subselect).
     */
+    send_records= 0;
     DBUG_ASSERT(false); /* purecov: inspected */
   }
   void set_thd(THD *thd_arg)

sql/sql_union.cc

@@ -246,6 +246,7 @@ int select_union_direct::send_data(List<Item> &items)
     return false;
   }
 
+  send_records++;
   fill_record(thd, table, table->field, items, true, false);
   if (thd->is_error())
     return true; /* purecov: inspected */