Server crashes in Item_field::used_tables upon queries from a view

CREATE TABLE t (a VARCHAR(128));

CREATE VIEW v1 AS SELECT a, COUNT(*) from t GROUP BY a;

CREATE VIEW v2 AS SELECT * FROM v1;

SELECT * FROM v2 WHERE GREATEST(a, DEFAULT(a));

DROP VIEW v2;

DROP VIEW v1;

DROP TABLE t;

#3  <signal handler called>

#4  0x0000560811216069 in Item_field::used_tables (this=0x6290002557c0) at /data/bld/10.5-asan/sql/item.cc:3542

#5  0x0000560811257086 in Item_direct_view_ref::used_tables (this=0x629000254cb8) at /data/bld/10.5-asan/sql/item.cc:10997

#6  0x00005608107de3d8 in Used_tables_and_const_cache::used_tables_and_const_cache_join (this=0x62b000039600, item=0x629000254cb8) at /data/bld/10.5-asan/sql/item.h:5303

#7  0x00005608107de539 in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join (this=0x62b000039600, item=0x629000254cb8) at /data/bld/10.5-asan/sql/item.h:5309

#8  0x00005608107de59c in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join (this=0x62b000039600, argc=2, argv=0x62b0000395e8) at /data/bld/10.5-asan/sql/item.h:5320

#9  0x00005608107e28ba in Item_func::update_used_tables (this=0x62b000039550) at /data/bld/10.5-asan/sql/item_func.h:192

#10 0x0000560810a3632f in make_join_statistics (join=0x629000242c30, tables_list=..., keyuse_array=0x629000242f30) at /data/bld/10.5-asan/sql/sql_select.cc:5557

#11 0x0000560810a16070 in JOIN::optimize_inner (this=0x629000242c30) at /data/bld/10.5-asan/sql/sql_select.cc:2419

#12 0x0000560810a0f0b1 in JOIN::optimize (this=0x629000242c30) at /data/bld/10.5-asan/sql/sql_select.cc:1765

#13 0x0000560810a303b4 in mysql_select (thd=0x62b000069218, tables=0x62b000038990, fields=..., conds=0x62b000039550, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x629000242c00, unit=0x62b00006d3d0, select_lex=0x62b000038300) at /data/bld/10.5-asan/sql/sql_select.cc:4907

#14 0x0000560810a00664 in handle_select (thd=0x62b000069218, lex=0x62b00006d308, result=0x629000242c00, setup_tables_done_option=0) at /data/bld/10.5-asan/sql/sql_select.cc:449

#15 0x0000560810966556 in execute_sqlcom_select (thd=0x62b000069218, all_tables=0x62b000038990) at /data/bld/10.5-asan/sql/sql_parse.cc:6452

#16 0x00005608109549ed in mysql_execute_command (thd=0x62b000069218) at /data/bld/10.5-asan/sql/sql_parse.cc:4043

#17 0x000056081097131b in mysql_parse (thd=0x62b000069218, rawbuf=0x62b000038238 "SELECT * FROM v2 WHERE GREATEST(a, DEFAULT(a))", length=46, parser_state=0x7f4359ce2c70, is_com_multi=false, is_next_command=false) at /data/bld/10.5-asan/sql/sql_parse.cc:8243

#18 0x0000560810946528 in dispatch_command (command=COM_QUERY, thd=0x62b000069218, packet=0x629000235219 "SELECT * FROM v2 WHERE GREATEST(a, DEFAULT(a))", packet_length=46, is_com_multi=false, is_next_command=false) at /data/bld/10.5-asan/sql/sql_parse.cc:1891

#19 0x0000560810942ebb in do_command (thd=0x62b000069218) at /data/bld/10.5-asan/sql/sql_parse.cc:1375

#20 0x0000560810da063f in do_handle_one_connection (connect=0x608000002f38, put_in_cache=true) at /data/bld/10.5-asan/sql/sql_connect.cc:1386

#21 0x0000560810da01a5 in handle_one_connection (arg=0x608000002eb8) at /data/bld/10.5-asan/sql/sql_connect.cc:1298

#22 0x0000560811a01a2e in pfs_spawn_thread (arg=0x615000006c18) at /data/bld/10.5-asan/storage/perfschema/pfs.cc:2201

#23 0x00007f43634a81c4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#24 0x00007f436352885c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

commit 405613ebb5f2f66e6c0d3f6ff4059b63170dfd11

Author: Oleg Smirnov

Date:   Wed Jul 3 15:42:21 2024 +0700

    MDEV-34490 get_copy() and build_clone() may return an instance of an ancestor class instead of a copy/clone

commit cf202decde475933dfa6b0aadfa5e04e667bfab7

Author: Oleg Smirnov

Date:   Fri Aug 2 18:48:29 2024 +0700

    MDEV-34683 Types mismatch when cloning items causes debug assertion

mariadbd: /data/bld/10.6-asan/sql/sql_lex.cc:11171: Field_pair* get_corresponding_field_pair(Item*, List<Field_pair>): Assertion `item->type() == Item::FIELD_ITEM || (item->type() == Item::REF_ITEM && ((((Item_ref *) item)->ref_type() == Item_ref::VIEW_REF) || (((Item_ref *) item)->ref_type() == Item_ref::REF)))' failed.

250424 16:36:59 [ERROR] /share8t/bld/10.6-asan/sql/mariadbd got signal 6 ;

#9  0x00007f85b1453eb2 in __GI___assert_fail (assertion=0x5566ac515040 "item->type() == Item::FIELD_ITEM || (item->type() == Item::REF_ITEM && ((((Item_ref *) item)->ref_type() == Item_ref::VIEW_REF) || (((Item_ref *) item)->ref_type() == Item_ref::REF)))", file=0x5566ac501dc0 "/data/bld/10.6-asan/sql/sql_lex.cc", line=11171, function=0x5566ac515120 "Field_pair* get_corresponding_field_pair(Item*, List<Field_pair>)") at ./assert/assert.c:101

#10 0x00005566aa2df961 in get_corresponding_field_pair (item=0x62d000270770, pair_list=...) at /data/bld/10.6-asan/sql/sql_lex.cc:11171

#11 0x00005566aa8bcc20 in find_matching_field_pair (item=0x62d000270770, pair_list=...) at /data/bld/10.6-asan/sql/opt_subselect.cc:6869

#12 0x00005566aac5013c in Item_field::grouping_field_transformer_for_where (this=0x62d000270770, thd=0x62b00007e218, arg=0x62d000061ce0 "") at /data/bld/10.6-asan/sql/item.cc:8081

#13 0x00005566aac629c8 in Item_default_value::transform (this=0x62d000270770, thd=0x62b00007e218, transformer=&virtual Item::grouping_field_transformer_for_where(THD*, unsigned char*), args=0x62d000061ce0 "") at /data/bld/10.6-asan/sql/item.cc:9981

#14 0x00005566aad16d8f in Item_args::transform_args (this=0x62d000270908, thd=0x62b00007e218, transformer=&virtual table offset 1384, arg=0x62d000061ce0 "") at /data/bld/10.6-asan/sql/item_func.cc:492

#15 0x00005566aad1701d in Item_func::transform (this=0x62d000270898, thd=0x62b00007e218, transformer=&virtual table offset 1384, argument=0x62d000061ce0 "") at /data/bld/10.6-asan/sql/item_func.cc:528

#16 0x00005566aa24718f in transform_condition_or_part (thd=0x62b00007e218, cond=0x62d000270898, transformer=&virtual table offset 1384, arg=0x62d000061ce0 "") at /data/bld/10.6-asan/sql/sql_derived.cc:1406

#17 0x00005566aa2de59a in st_select_lex::pushdown_cond_into_where_clause (this=0x62d000061ce0, thd=0x62b00007e218, cond=0x62d000270898, remaining_cond=0x7f85a7c45f90, transformer=&virtual table offset 1376, arg=0x62d000061ce0 "") at /data/bld/10.6-asan/sql/sql_lex.cc:10908

#18 0x00005566aa247f14 in pushdown_cond_for_derived (thd=0x62b00007e218, cond=0x62d00005b6b8, derived=0x62d00005e7c0) at /data/bld/10.6-asan/sql/sql_derived.cc:1600

#19 0x00005566aa3efc8e in JOIN::optimize_inner (this=0x62d00026e048) at /data/bld/10.6-asan/sql/sql_select.cc:2426

#20 0x00005566aa3ea3dd in JOIN::optimize (this=0x62d00026e048) at /data/bld/10.6-asan/sql/sql_select.cc:1927

#21 0x00005566aa40cb3e in mysql_select (thd=0x62b00007e218, tables=0x62d00005ab78, fields=..., conds=0x62d00005b6b8, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147748608, result=0x62d00026e018, unit=0x62b0000825f8, select_lex=0x62d00005a500) at /data/bld/10.6-asan/sql/sql_select.cc:5182

#22 0x00005566aa3db73e in handle_select (thd=0x62b00007e218, lex=0x62b000082530, result=0x62d00026e018, setup_tables_done_option=0) at /data/bld/10.6-asan/sql/sql_select.cc:573

#23 0x00005566aa33be6c in execute_sqlcom_select (thd=0x62b00007e218, all_tables=0x62d00005ab78) at /data/bld/10.6-asan/sql/sql_parse.cc:6422

#24 0x00005566aa32a00d in mysql_execute_command (thd=0x62b00007e218, is_called_from_prepared_stmt=false) at /data/bld/10.6-asan/sql/sql_parse.cc:4013

#25 0x00005566aa346c44 in mysql_parse (thd=0x62b00007e218, rawbuf=0x62d00005a438 "SELECT * FROM v2 WHERE GREATEST(a, DEFAULT(a))", length=46, parser_state=0x7f85a7c47a90) at /data/bld/10.6-asan/sql/sql_parse.cc:8200

#26 0x00005566aa31c081 in dispatch_command (command=COM_QUERY, thd=0x62b00007e218, packet=0x62900024e219 "SELECT * FROM v2 WHERE GREATEST(a, DEFAULT(a))", packet_length=46, blocking=true) at /data/bld/10.6-asan/sql/sql_parse.cc:1908

#27 0x00005566aa318db5 in do_command (thd=0x62b00007e218, blocking=true) at /data/bld/10.6-asan/sql/sql_parse.cc:1421

#28 0x00005566aa79d859 in do_handle_one_connection (connect=0x6080000030b8, put_in_cache=true) at /data/bld/10.6-asan/sql/sql_connect.cc:1386

#29 0x00005566aa79d3b8 in handle_one_connection (arg=0x608000003038) at /data/bld/10.6-asan/sql/sql_connect.cc:1298

#30 0x00005566ab419036 in pfs_spawn_thread (arg=0x617000005b98) at /data/bld/10.6-asan/storage/perfschema/pfs.cc:2201

#31 0x00007f85b14a81c4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#32 0x00007f85b152885c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

#2  <signal handler called>

#3  0x000056289052b3cb in Item_ref::update_used_tables (this=<optimized out>) at /data/bld/main-rel/sql/item.cc:11321

#4  Item_ref::update_used_tables (this=<optimized out>) at /data/bld/main-rel/sql/item.cc:11318

#5  0x000056289018baac in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join (item=0x7f83cc03f2e0, this=0x7f83cc014718) at /data/bld/main-rel/sql/item.h:5654

#6  Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join (argv=<optimized out>, argc=<optimized out>, this=0x7f83cc014718) at /data/bld/main-rel/sql/item.h:5666

#7  Item_func::update_used_tables (this=0x7f83cc014680) at /data/bld/main-rel/sql/item_func.h:215

#8  0x000056289018baac in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join (item=0x7f83cc014680, this=0x7f83cc0147e8) at /data/bld/main-rel/sql/item.h:5654

#9  Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join (argv=<optimized out>, argc=<optimized out>, this=0x7f83cc0147e8) at /data/bld/main-rel/sql/item.h:5666

#10 Item_func::update_used_tables (this=0x7f83cc014750) at /data/bld/main-rel/sql/item_func.h:215

#11 0x000056289018baac in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join (item=0x7f83cc014750, this=0x7f83cc014bf8) at /data/bld/main-rel/sql/item.h:5654

#12 Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join (argv=<optimized out>, argc=<optimized out>, this=0x7f83cc014bf8) at /data/bld/main-rel/sql/item.h:5666

#13 Item_func::update_used_tables (this=0x7f83cc014b60) at /data/bld/main-rel/sql/item_func.h:215

#14 0x000056289018baac in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join (item=0x7f83cc014b60, this=0x7f83cc0155b8) at /data/bld/main-rel/sql/item.h:5654

#15 Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join (argv=<optimized out>, argc=<optimized out>, this=0x7f83cc0155b8) at /data/bld/main-rel/sql/item.h:5666

#16 Item_func::update_used_tables (this=0x7f83cc015520) at /data/bld/main-rel/sql/item_func.h:215

#17 0x000056289018baac in Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join (item=0x7f83cc015520, this=0x7f83cc0156d8) at /data/bld/main-rel/sql/item.h:5654

#18 Used_tables_and_const_cache::used_tables_and_const_cache_update_and_join (argv=<optimized out>, argc=<optimized out>, this=0x7f83cc0156d8) at /data/bld/main-rel/sql/item.h:5666

#19 Item_func::update_used_tables (this=0x7f83cc015640) at /data/bld/main-rel/sql/item_func.h:215

#20 0x00005628902edf09 in JOIN::optimize_stage2 (this=this@entry=0x7f83cc132738) at /data/bld/main-rel/sql/sql_select.cc:2869

#21 0x00005628902f2163 in JOIN::optimize_inner (this=this@entry=0x7f83cc132738) at /data/bld/main-rel/sql/sql_select.cc:2737

#22 0x00005628902f270a in JOIN::optimize (this=this@entry=0x7f83cc132738) at /data/bld/main-rel/sql/sql_select.cc:1994

#23 0x00005628902f27f9 in mysql_select (thd=thd@entry=0x7f83cc000c68, tables=<optimized out>, fields=..., conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=<optimized out>, having=<optimized out>, proc_param=<optimized out>, select_options=<optimized out>, result=<optimized out>, unit=<optimized out>, select_lex=<optimized out>) at /data/bld/main-rel/sql/sql_select.cc:5361

#24 0x00005628902f3034 in handle_select (thd=thd@entry=0x7f83cc000c68, lex=lex@entry=0x7f83cc004fa0, result=result@entry=0x7f83cc132710, setup_tables_done_option=setup_tables_done_option@entry=0) at /data/bld/main-rel/sql/sql_select.cc:633

#25 0x0000562890262cf0 in execute_sqlcom_select (thd=thd@entry=0x7f83cc000c68, all_tables=0x7f83cc013a48) at /data/bld/main-rel/sql/sql_parse.cc:6191

#26 0x00005628902723db in mysql_execute_command (thd=thd@entry=0x7f83cc000c68, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /data/bld/main-rel/sql/sql_parse.cc:3979

#27 0x00005628902739c6 in mysql_parse (thd=0x7f83cc000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /data/bld/main-rel/sql/sql_parse.cc:7915

#28 0x0000562890275e8d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7f83cc000c68, packet=packet@entry=0x7f83cc008a29 "SELECT * FROM test.v181 WHERE (@A := thread_id) != (GREATEST(((- (SUBSTR(user FROM user))) MOD (@A := (CAST(total AS DATETIME)))), (FIELD(processlist_id, '1977-06-05 20:43:49.027691', (DEFAULT(user)))"..., packet_length=packet_length@entry=209, blocking=blocking@entry=true) at /data/bld/main-rel/sql/sql_parse.cc:2001

#29 0x0000562890277b7f in do_command (thd=thd@entry=0x7f83cc000c68, blocking=blocking@entry=true) at /data/bld/main-rel/sql/sql_parse.cc:1415

#30 0x00005628903ab4e5 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5628c4569e78, put_in_cache=put_in_cache@entry=true) at /data/bld/main-rel/sql/sql_connect.cc:1415

#31 0x00005628903ab83d in handle_one_connection (arg=arg@entry=0x5628c4569e78) at /data/bld/main-rel/sql/sql_connect.cc:1327

#32 0x0000562890778e4c in pfs_spawn_thread (arg=0x5628c4503fc8) at /data/bld/main-rel/storage/perfschema/pfs.cc:2198

#33 0x00007f83e99c91c4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442

#34 0x00007f83e9a4985c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81