Bug #22270139: SERVER CRASH WHEN TRYING TO COUNT THE

               RESULTS OF A SUBQUERY USING FULLTEXT

Issue:
-----
These issues occur under the following conditions:

1) A derived table is merged into the outer query block.
2) The same match function is used in the select-list and
   where clause of the derived table.

The following are the problem areas:
a) When a select count(*) without group-by is used in the
outer-query, opt_sum_query tries to set the hints for the
where condition. This is not allowed since, hints for slave
(i.e., the where condition) are not accessed.

But this where condition already has a master that has been
set by the setup_ftfuncs. The result is an assert.

b) While merging the derived table into the outer query,
the fulltext function list is rebuilt. Only this time, the
order of the functions is flipped. This creates a problem
when deciding who-is-who's master. Since setup_ftfuncs
expects the early expression to be the master of the later
expression.

Because of this, the ft-functions in select and where lists
 are eachother's master. The result is a recursion of the
get_master function.


SOLUTION:
---------
sql/opt_sum.cc:
Since the where condition is supplied to the opt_sum_query
by default, setting hints should be done on the master.

sql/sql_resolver.cc:
Since we want the early-late expression order to be
maintained, use push_back.

sql/item_func.h:
In case of prepare-execute statements, we need to set the
master variable to NULL. This will be reset when the
execute statement will call setup_ftfuncs.

Author: Sreeharsha Ramanavarapu

sql/item_func.h

@@ -2381,6 +2381,7 @@ class Item_func_match :public Item_real_func
     ft_handler= NULL;
     concat_ws= NULL;
     table_ref= NULL;           // required by Item_func_match::eq()
+    master= NULL;
     DBUG_VOID_RETURN;
   }
   virtual Item *key_item() const { return against; }

sql/opt_sum.cc

@@ -373,7 +373,8 @@ int opt_sum_query(THD *thd,
                  !((Item_sum_count*) item)->get_arg(0)->maybe_null)       // 4
         {
           Item_func_match* fts_item= static_cast<Item_func_match*>(conds); 
-          fts_item->set_hints(NULL, FT_NO_RANKING, HA_POS_ERROR, false);
+          fts_item->get_master()->set_hints(NULL, FT_NO_RANKING,
+                                            HA_POS_ERROR, false);
           if (fts_item->init_search(thd))
             break;
           count= fts_item->get_count();

sql/sql_resolver.cc

@@ -2743,7 +2743,7 @@ bool SELECT_LEX::add_ftfunc_list(List<Item_func_match> *ftfuncs)
   List_iterator_fast<Item_func_match> li(*ftfuncs);
   while ((ifm= li++))
   {
-    if (ftfunc_list->push_front(ifm))
+    if (ftfunc_list->push_back(ifm))
       return true;        /* purecov: inspected */
   }
   return false;