@@ -1065,8 +1065,15 @@ Item_in_subselect::single_value_transformer(JOIN *join,
10651065 if (upper_item)
10661066 upper_item->set_sub_test (item);
10671067 }
1068- /* fix fields is already called for left expression */
1069- substitution= func->create (left_expr, subs);
1068+ /*
1069+ fix fields is already called for left expression.
1070+ Note that real_item() should be used instead of
1071+ original left expression because left_expr can be
1072+ runtime created Ref item which is deleted at the end
1073+ of the statement. Thus one of 'substitution' arguments
1074+ can be broken in case of PS.
1075+ */
1076+ substitution= func->create (left_expr->real_item (), subs);
10701077 DBUG_RETURN (RES_OK);
10711078 }
10721079
@@ -1261,8 +1268,16 @@ Item_in_subselect::single_value_transformer(JOIN *join,
12611268 // select and is not outer anymore.
12621269 item->walk (&Item::remove_dependence_processor, 0 ,
12631270 (uchar *) select_lex->outer_select ());
1264- item= func->create (left_expr, item);
1265- // fix_field of item will be done in time of substituting
1271+ item= func->create (left_expr->real_item (), item);
1272+ /*
1273+ fix_field of substitution item will be done in time of
1274+ substituting.
1275+ Note that real_item() should be used instead of
1276+ original left expression because left_expr can be
1277+ runtime created Ref item which is deleted at the end
1278+ of the statement. Thus one of 'substitution' arguments
1279+ can be broken in case of PS.
1280+ */
12661281 substitution= item;
12671282 have_to_be_excluded= 1 ;
12681283 if (thd->lex ->describe )
0 commit comments