Bug#35686058: Crashing the MySQL server

This is duplicate of Bug#35284734. Back porting that bugfix to 8.0.

Reference count for items created by IN to EXISTS transformation was
not correct because of which there was a problem. With this patch
we correct it.

Change-Id: Ie470a47486d1d549ef299b4e28ac5dcc234aff9a

Author: Chaithra Gopalareddy

sql/item_cmpfunc.cc

@@ -2054,6 +2054,21 @@ bool Arg_comparator::compare_null_values() {
   return result;
 }
 
+void Item_bool_func::set_created_by_in2exists() {
+  m_created_by_in2exists = true;
+  // When a condition is created by IN to EXISTS transformation,
+  // it re-uses the expressions that are part of the query. As a
+  // result we need to increment the reference count
+  // for these expressions.
+  WalkItem(this, enum_walk::PREFIX | enum_walk::SUBQUERY, [](Item *inner_item) {
+    // Reference counting matters only for referenced items.
+    if (inner_item->type() == REF_ITEM) {
+      down_cast<Item_ref *>(inner_item)->ref_item()->increment_ref_count();
+    }
+    return false;
+  });
+}
+
 const char *Item_bool_func::bool_transform_names[10] = {"is true",
                                                         "is false",
                                                         "is null",

sql/item_cmpfunc.h

@@ -329,7 +329,7 @@ class Item_bool_func : public Item_int_func {
   }
   uint decimal_precision() const override { return 1; }
   bool created_by_in2exists() const override { return m_created_by_in2exists; }
-  void set_created_by_in2exists() { m_created_by_in2exists = true; }
+  void set_created_by_in2exists();
 
   static const char *bool_transform_names[10];
   /**