From 5a9a80a213e249a2903446f9f065eb21268d57cd Mon Sep 17 00:00:00 2001
From: Rucha Deodhar <rucha.deodhar@mariadb.com>
Date: Mon, 10 Oct 2022 16:21:46 +0530
Subject: [PATCH] MDEV-28480: Assertion `0' failed in
 Item_row::illegal_method_call on SELECT FROM JSON_TABLE

Analysis: When fix_fields_if_needed() is called, it doesnt check if operands
are valid because check_cols() is not called. So it doesn't error out and
eventually crashes.
Fix: Use fix_fields_if_needed_for_scalar() instead of
fix_fields_if_needed(). It filters the scalar and returns the error if
it occurs.
---
 mysql-test/suite/json/r/json_table.result | 6 ++++++
 mysql-test/suite/json/t/json_table.test   | 8 ++++++++
 sql/item.h                                | 5 +++++
 sql/json_table.cc                         | 2 +-
 4 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/mysql-test/suite/json/r/json_table.result b/mysql-test/suite/json/r/json_table.result
index cc87a34ffb3..b9cc09fdd97 100644
--- a/mysql-test/suite/json/r/json_table.result
+++ b/mysql-test/suite/json/r/json_table.result
@@ -1005,5 +1005,11 @@ name  VARCHAR(10) CHARACTER SET latin1 COLLATE DEFAULT PATH '$.name'
 name
 Jeans
 #
+# MDEV-28480: Assertion `0' failed in Item_row::illegal_method_call
+#             on SELECT FROM JSON_TABLE
+#
+SELECT 1 FROM JSON_TABLE (row(1,2), '$' COLUMNS (o FOR ORDINALITY)) AS j;
+ERROR 21000: Operand should contain 1 column(s)
+#
 # End of 10.6 tests
 #
diff --git a/mysql-test/suite/json/t/json_table.test b/mysql-test/suite/json/t/json_table.test
index a6392b7bfff..ec330046f25 100644
--- a/mysql-test/suite/json/t/json_table.test
+++ b/mysql-test/suite/json/t/json_table.test
@@ -863,6 +863,14 @@ SELECT * FROM json_table('[{"name":"Jeans"}]', '$[*]'
 ) AS jt;
 
 
+--echo #
+--echo # MDEV-28480: Assertion `0' failed in Item_row::illegal_method_call
+--echo #             on SELECT FROM JSON_TABLE
+--echo #
+
+--error ER_OPERAND_COLUMNS
+SELECT 1 FROM JSON_TABLE (row(1,2), '$' COLUMNS (o FOR ORDINALITY)) AS j;
+
 --echo #
 --echo # End of 10.6 tests
 --echo #
diff --git a/sql/item.h b/sql/item.h
index bc7f72e971b..eb231430751 100644
--- a/sql/item.h
+++ b/sql/item.h
@@ -1143,6 +1143,11 @@ public:
   {
     return fixed() ? false : fix_fields(thd, ref);
   }
+
+  /*
+   fix_fields_if_needed_for_scalar() is used where we need to filter items
+   that can't be scalars and want to return error for it.
+  */
   bool fix_fields_if_needed_for_scalar(THD *thd, Item **ref)
   {
     return fix_fields_if_needed(thd, ref) || check_cols(1);
diff --git a/sql/json_table.cc b/sql/json_table.cc
index 73ae4974956..65fe3c9a659 100644
--- a/sql/json_table.cc
+++ b/sql/json_table.cc
@@ -1171,7 +1171,7 @@ bool Table_function_json_table::setup(THD *thd, TABLE_LIST *sql_table,
   // fields in non_agg_field_used:
   const bool saved_non_agg_field_used= s_lex->non_agg_field_used();
 
-  bool res= m_json->fix_fields_if_needed(thd, &m_json);
+  bool res= m_json->fix_fields_if_needed_for_scalar(thd, &m_json);
 
   s_lex->is_item_list_lookup= save_is_item_list_lookup;
   s_lex->set_non_agg_field_used(saved_non_agg_field_used);