Bug#28494: Grouping by Item_func_set_user_var produces incorrect result.

The end_update() function uses the Item::save_org_in_field() function to
save original values of items into the group buffer. But for the 
Item_func_set_user_var this method was mapped to the save_in_field method.
The latter function wrongly decides to use the result_field. This leads to
saving incorrect value in the grouping buffer and wrong result of the whole
query.

The can_use_result_field argument of the bool type is added to the
Item_func_set_user_var::save_in_field() function. If it is set to FALSE
then the item's result field won't be used. Otherwise it will be detected
whether the result field will be used (old behaviour).
Two wrapping functions for the function above are added to the 
Item_func_set_user_var class:
the save_in_field(Field *field, bool no_conversions) - it calls the above
function with the can_use_result_field set to TRUE.
the save_org_in_field(Field *field) - same, but the can_use_result_field
is set to FALSE.


mysql-test/t/user_var.test:
  Added a test case for the bug#28494: Grouping by Item_func_set_user_var
  produces incorrect result.
mysql-test/r/user_var.result:
  Added a test case for the bug#28494: Grouping by Item_func_set_user_var
  produces incorrect result.
sql/item_func.cc:
  Bug#28494: Grouping by Item_func_set_user_var produces incorrect result.
  The can_use_result_field argument of the bool type is added to the
  Item_func_set_user_var::save_in_field() function. If it is set to FALSE
  then the item's result field won't be used. Otherwise it will be detected
  whether the result field will be used (old behaviour).
sql/item_func.h:
  Bug#28494: Grouping by Item_func_set_user_var produces incorrect result.
  The can_use_result_field argument of the bool type is added to the
  Item_func_set_user_var::save_in_field() function.
  Two wrapping functions for the function above are added to the 
  Item_func_set_user_var class:
  the save_in_field(Field *field, bool no_conversions) - it calls the above
  function with the can_use_result_field set to TRUE.
  the save_org_in_field(Field *field) - same, but the can_use_result_field
  is set to FALSE.

4 files changed, 26 insertions, 3 deletions

diff --git a/mysql-test/r/user_var.result b/mysql-test/r/user_var.result
index 753c982155c..b9f58b60d9b 100644
--- a/mysql-test/r/user_var.result
+++ b/mysql-test/r/user_var.result
@@ -317,3 +317,10 @@ SHOW COUNT(*) WARNINGS;
 SHOW COUNT(*) ERRORS;
 @@session.error_count
 1
+create table t1(f1 int);
+insert into t1 values(1),(1),(2);
+select @a:=f1, count(f1) from t1 group by 1;
+@a:=f1	count(f1)
+1	2
+2	1
+drop table t1;
diff --git a/mysql-test/t/user_var.test b/mysql-test/t/user_var.test
index 70f57fdf283..7919b663a73 100644
--- a/mysql-test/t/user_var.test
+++ b/mysql-test/t/user_var.test
@@ -222,3 +222,11 @@ drop table t1,t2;
 insert into city 'blah';
 SHOW COUNT(*) WARNINGS;
 SHOW COUNT(*) ERRORS;
+
+#
+# Bug#28494: Grouping by Item_func_set_user_var produces incorrect result.
+#
+create table t1(f1 int);
+insert into t1 values(1),(1),(2);
+select @a:=f1, count(f1) from t1 group by 1;
+drop table t1;
diff --git a/sql/item_func.cc b/sql/item_func.cc
index ce44a3e15df..95ff432ca5a 100644
--- a/sql/item_func.cc
+++ b/sql/item_func.cc
@@ -4290,9 +4290,11 @@ void Item_func_set_user_var::make_field(Send_field *tmp_field)
     TRUE        Error
 */
 
-int Item_func_set_user_var::save_in_field(Field *field, bool no_conversions)
+int Item_func_set_user_var::save_in_field(Field *field, bool no_conversions,
+                                          bool can_use_result_field)
 {
-  bool use_result_field= (result_field && result_field != field);
+  bool use_result_field= (!can_use_result_field ? 0 :
+                          (result_field && result_field != field));
   int error;
 
   /* Update the value of the user variable */
diff --git a/sql/item_func.h b/sql/item_func.h
index 1cffe9a934e..18cd87d2de4 100644
--- a/sql/item_func.h
+++ b/sql/item_func.h
@@ -1220,7 +1220,13 @@ public:
   void print(String *str);
   void print_as_stmt(String *str);
   const char *func_name() const { return "set_user_var"; }
-  int save_in_field(Field *field, bool no_conversions);
+  int save_in_field(Field *field, bool no_conversions,
+                    bool can_use_result_field);
+  int save_in_field(Field *field, bool no_conversions)
+  {
+    return save_in_field(field, no_conversions, 1);
+  }
+  void save_org_in_field(Field *field) { (void)save_in_field(field, 1, 0); }
 };