Fixed bug #23478.

If elements a not top-level IN subquery were accessed by an index and 
the subquery result set included  a NULL value then the quantified
predicate that contained the subquery was evaluated to NULL when 
it should return a non-null value.


mysql-test/r/subselect.result:
  Added a test case for bug #23478.
mysql-test/t/subselect.test:
  Added a test case for bug #23478.

mysql-test/r/subselect.result

@@ -2982,3 +2982,18 @@ field1	field2
 1	1
 1	3
 DROP TABLE t1, t2;
+CREATE TABLE t1(a int, INDEX (a));
+INSERT INTO t1 VALUES (1), (3), (5), (7);
+INSERT INTO t1 VALUES (NULL);
+CREATE TABLE t2(a int);
+INSERT INTO t2 VALUES (1),(2),(3);
+EXPLAIN SELECT a, a IN (SELECT a FROM t1) FROM t2;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	t2	ALL	NULL	NULL	NULL	NULL	3	
+2	DEPENDENT SUBQUERY	t1	index_subquery	a	a	5	func	2	Using index
+SELECT a, a IN (SELECT a FROM t1) FROM t2;
+a	a IN (SELECT a FROM t1)
+1	1
+2	NULL
+3	1
+DROP TABLE t1,t2;

mysql-test/t/subselect.test

@@ -1948,4 +1948,21 @@ SELECT field1, field2
 
 DROP TABLE t1, t2;
 
+#
+# Bug #23478: not top-level IN subquery returning a non-empty result set
+#             with possible NULL values by index access from the outer query
+#
+
+CREATE TABLE t1(a int, INDEX (a));
+INSERT INTO t1 VALUES (1), (3), (5), (7);
+INSERT INTO t1 VALUES (NULL);
+
+CREATE TABLE t2(a int);
+INSERT INTO t2 VALUES (1),(2),(3);
+
+EXPLAIN SELECT a, a IN (SELECT a FROM t1) FROM t2;
+SELECT a, a IN (SELECT a FROM t1) FROM t2;
+
+DROP TABLE t1,t2;
+
 # End of 4.1 tests

sql/item_subselect.cc

@@ -610,6 +610,7 @@ double Item_in_subselect::val()
   */
   DBUG_ASSERT(0);
   DBUG_ASSERT(fixed == 1);
+  null_value= 0;
   if (exec())
   {
     reset();
@@ -625,6 +626,7 @@ double Item_in_subselect::val()
 longlong Item_in_subselect::val_int()
 {
   DBUG_ASSERT(fixed == 1);
+  null_value= 0;
   if (exec())
   {
     reset();
@@ -645,6 +647,7 @@ String *Item_in_subselect::val_str(String *str)
   */
   DBUG_ASSERT(0);
   DBUG_ASSERT(fixed == 1);
+  null_value= 0;
   if (exec())
   {
     reset();