Bug#36606073: json_table and exists make a bug

When JSON_TABLE was used in an IN or EXISTS subquery, and referenced a
table in the outer query block, wrong results were returned in some
cases when semijoin transformation had been performed.

The problem was that the semijoin transformation didn't call
fix_after_pullout() on the argument of the JSON_TABLE expression, so
that it still appeared to have an outer reference. Because of this,
the table function had no lateral dependency on the outer table, and
the optimizer could end up choosing a plan with the outer table inner
to the table function.

Fixed by implementing fix_after_pullout() on Table_function, and
calling it from fix_tables_after_pullout().

Change-Id: I9e3de5710486c0af24fb9d5177a2f69cd195d330

Author: kahatlen

mysql-test/suite/json/r/json_table.result

@@ -2252,3 +2252,14 @@ txt	i
 [2]	2
 [3]	3
 DROP TABLE t;
+#
+# Bug#36606073: json_table and exists make a bug
+#
+CREATE TABLE t(x VARCHAR(10));
+INSERT INTO t VALUES ('[1]'), ('[2]'), ('[3]');
+SELECT * FROM t WHERE EXISTS (
+SELECT * FROM JSON_TABLE(x, '$[*]' COLUMNS (i INT PATH '$')) AS jt WHERE i = 2
+);
+x
+[2]
+DROP TABLE t;

mysql-test/suite/json/t/json_table.test

@@ -1579,3 +1579,14 @@ SELECT *
 FROM t, JSON_TABLE(txt, '$[*]' COLUMNS (i INT PATH '$')) AS jt
 ORDER BY i;
 DROP TABLE t;
+
+--echo #
+--echo # Bug#36606073: json_table and exists make a bug
+--echo #
+
+CREATE TABLE t(x VARCHAR(10));
+INSERT INTO t VALUES ('[1]'), ('[2]'), ('[3]');
+SELECT * FROM t WHERE EXISTS (
+  SELECT * FROM JSON_TABLE(x, '$[*]' COLUMNS (i INT PATH '$')) AS jt WHERE i = 2
+);
+DROP TABLE t;

sql/sql_resolver.cc

@@ -109,6 +109,7 @@
 #include "sql/sql_union.h"  // Query_result_union
 #include "sql/system_variables.h"
 #include "sql/table.h"
+#include "sql/table_function.h"
 #include "sql/thd_raii.h"
 #include "sql/thr_malloc.h"
 #include "sql/visible_fields.h"
@@ -2164,6 +2165,11 @@ static void fix_tables_after_pullout(Query_block *parent_query_block,
       "lateral CTE".
     */
   }
+
+  if (tr->is_table_function()) {
+    tr->table_function->fix_after_pullout(parent_query_block,
+                                          removed_query_block);
+  }
 }
 
 /**

sql/table_function.cc

@@ -95,6 +95,12 @@ bool Table_function::init_args() {
   return false;
 }
 
+void Table_function::fix_after_pullout(Query_block *parent_query_block,
+                                       Query_block *removed_query_block) {
+  do_fix_after_pullout(parent_query_block, removed_query_block);
+  table->pos_in_table_list->dep_tables = used_tables();
+}
+
 /******************************************************************************
   Implementation of JSON_TABLE function
 ******************************************************************************/
@@ -770,6 +776,11 @@ void Table_function_json::do_cleanup() {
   for (uint i = 0; i < m_all_columns.size(); i++) m_all_columns[i]->cleanup();
 }
 
+void Table_function_json::do_fix_after_pullout(
+    Query_block *parent_query_block, Query_block *removed_query_block) {
+  source->fix_after_pullout(parent_query_block, removed_query_block);
+}
+
 void JT_data_source::cleanup() {
   v.clear();
   producing_records = false;

sql/table_function.h

@@ -158,6 +158,17 @@ class Table_function {
 
   virtual bool walk(Item_processor processor, enum_walk walk, uchar *arg) = 0;
 
+  /**
+    Fix after tables have been moved from one query_block level to the parent
+    level, e.g by semijoin conversion.
+
+    @param parent_query_block  query_block that tables are moved to.
+    @param removed_query_block query_block that tables are moved away from,
+                          child of parent_query_block.
+  */
+  void fix_after_pullout(Query_block *parent_query_block,
+                         Query_block *removed_query_block);
+
  private:
   /**
     Get the list of fields to create the result table
@@ -173,6 +184,8 @@ class Table_function {
   virtual bool do_init_args() = 0;
   friend bool Table_ref::setup_table_function(THD *thd);
   virtual void do_cleanup() {}
+  virtual void do_fix_after_pullout(Query_block *parent_query_block,
+                                    Query_block *removed_query_block) = 0;
 };
 
 /****************************************************************************
@@ -436,6 +449,8 @@ class Table_function_json final : public Table_function {
   List<Create_field> *get_field_list() override;
   bool do_init_args() override;
   void do_cleanup() override;
+  void do_fix_after_pullout(Query_block *parent_query_block,
+                            Query_block *removed_query_block) override;
 };
 
 /**