Fix for LP bug#1001505 and LP bug#1001510

We set correct cmp_context during preparation to avoid changing it later by Item_field::equal_fields_propagator.
(see mysql bugs #57135 #57692 during merging)

5 files changed, 45 insertions, 0 deletions

diff --git a/mysql-test/r/case.result b/mysql-test/r/case.result
index 0c0e2d623c8..811bbee1d91 100644
--- a/mysql-test/r/case.result
+++ b/mysql-test/r/case.result
@@ -218,3 +218,7 @@ a	d
 3	11120436154190595086
 drop table t1, t2;
 End of 5.0 tests
+CREATE TABLE t1(a YEAR);
+SELECT 1 FROM t1 WHERE a=1 AND CASE 1 WHEN a THEN 1 ELSE 1 END;
+1
+DROP TABLE t1;
diff --git a/mysql-test/r/compare.result b/mysql-test/r/compare.result
index 796821a87bd..5168eb38586 100644
--- a/mysql-test/r/compare.result
+++ b/mysql-test/r/compare.result
@@ -96,3 +96,7 @@ SELECT * FROM t1 WHERE a > '2008-01-01' AND a = '0000-00-00';
 a
 DROP TABLE t1;
 End of 5.0 tests
+CREATE TABLE t1(a INT ZEROFILL);
+SELECT 1 FROM t1 WHERE t1.a IN (1, t1.a) AND t1.a=2;
+1
+DROP TABLE t1;
diff --git a/mysql-test/t/case.test b/mysql-test/t/case.test
index 028c64d6de7..81855dfc97f 100644
--- a/mysql-test/t/case.test
+++ b/mysql-test/t/case.test
@@ -170,3 +170,13 @@ select t1.a, (case t1.a when 0 then 0 else t1.b end) d from t1
 drop table t1, t2;
 
 --echo End of 5.0 tests
+
+#
+# LP BUG#1001510
+# Bug #11764313 57135: CRASH IN ITEM_FUNC_CASE::FIND_ITEM WITH CASE WHEN
+# ELSE CLAUSE
+#
+
+CREATE TABLE t1(a YEAR);
+SELECT 1 FROM t1 WHERE a=1 AND CASE 1 WHEN a THEN 1 ELSE 1 END;
+DROP TABLE t1;
diff --git a/mysql-test/t/compare.test b/mysql-test/t/compare.test
index 103244eb2f7..d2b2a7e5523 100644
--- a/mysql-test/t/compare.test
+++ b/mysql-test/t/compare.test
@@ -86,3 +86,11 @@ SELECT * FROM t1 WHERE a > '2008-01-01' AND a = '0000-00-00';
 DROP TABLE t1;
 
 --echo End of 5.0 tests
+
+#
+# Bug #11764818 57692: Crash in item_func_in::val_int() with ZEROFILL
+#
+
+CREATE TABLE t1(a INT ZEROFILL);
+SELECT 1 FROM t1 WHERE t1.a IN (1, t1.a) AND t1.a=2;
+DROP TABLE t1;
diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc
index 61554bdf420..847c51b8a5e 100644
--- a/sql/item_cmpfunc.cc
+++ b/sql/item_cmpfunc.cc
@@ -3095,6 +3095,15 @@ void Item_func_case::fix_length_and_dec()
           return;
       }
     }
+    /*
+      Set cmp_context of all WHEN arguments. This prevents
+      Item_field::equal_fields_propagator() from transforming a
+      zerofill argument into a string constant. Such a change would
+      require rebuilding cmp_items.
+    */
+    for (i= 0; i < ncases; i+= 2)
+      args[i]->cmp_context= item_cmp_type(left_result_type,
+                                          args[i]->result_type());
   }
 
   if (else_expr_num == -1 || args[else_expr_num]->maybe_null)
@@ -4081,6 +4090,16 @@ void Item_func_in::fix_length_and_dec()
       }
     }
   }
+  /*
+    Set cmp_context of all arguments. This prevents
+    Item_field::equal_fields_propagator() from transforming a zerofill integer
+    argument into a string constant. Such a change would require rebuilding
+    cmp_itmes.
+   */
+  for (arg= args + 1, arg_end= args + arg_count; arg != arg_end ; arg++)
+  {
+    arg[0]->cmp_context= item_cmp_type(left_result_type, arg[0]->result_type());
+  }
   max_length= 1;
 }