Fix bug#13392 Wrong VALUES() behaviour in INSERT SELECT with ON DUPLICATE

VALUES() can only refer to table insert going to. 
But Item_insert_value::fix_fields() were passing to it's arg full table list,
This results in finding second column which shouldn't be found, and
failing with error about ambiguous field.

Item_insert_value::fix_fields() now passes only first table of full table
list.

3 files changed, 27 insertions, 0 deletions

diff --git a/mysql-test/r/insert_select.result b/mysql-test/r/insert_select.result
index d4eb4e8b788..028b40ac3b6 100644
--- a/mysql-test/r/insert_select.result
+++ b/mysql-test/r/insert_select.result
@@ -678,3 +678,11 @@ f1
 2001
 2002
 drop table t1;
+create table t1(x int, y int);
+create table t2(x int, z int);
+insert into t1(x,y) select x,z from t2 on duplicate key update x=values(x);
+insert into t1(x,y) select x,z from t2 on duplicate key update x=values(z);
+ERROR 42S22: Unknown column 'z' in 'field list'
+insert into t1(x,y) select x,z from t2 on duplicate key update x=values(t2.x);
+ERROR 42S02: Unknown table 't2' in field list
+drop table t1,t2;
diff --git a/mysql-test/t/insert_select.test b/mysql-test/t/insert_select.test
index 6fcdef6ab03..48acdf1cbc5 100644
--- a/mysql-test/t/insert_select.test
+++ b/mysql-test/t/insert_select.test
@@ -214,4 +214,16 @@ insert into t1(f1) select if(max(f1) is null, '2000',max(f1)+1) from t1;
 select * from t1;
 drop table t1;
 
+#
+# Bug #13392 values() fails with 'ambiguous' or returns NULL 
+#            with ON DUPLICATE and SELECT
+create table t1(x int, y int);
+create table t2(x int, z int);
+insert into t1(x,y) select x,z from t2 on duplicate key update x=values(x);
+--error 1054
+insert into t1(x,y) select x,z from t2 on duplicate key update x=values(z);
+--error 1109
+insert into t1(x,y) select x,z from t2 on duplicate key update x=values(t2.x);
+drop table t1,t2; 
+
 # End of 4.1 tests
diff --git a/sql/item.cc b/sql/item.cc
index b2a1e44cfcc..642a0ccf1b4 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -2796,8 +2796,14 @@ bool Item_insert_value::fix_fields(THD *thd,
 				   Item **items)
 {
   DBUG_ASSERT(fixed == 0);
+  st_table_list *orig_next_table= table_list->next;
+  table_list->next= 0;
   if (!arg->fixed && arg->fix_fields(thd, table_list, &arg))
+  {
+    table_list->next= orig_next_table;
     return 1;
+  }
+  table_list->next= orig_next_table;
 
   if (arg->type() == REF_ITEM)
   {
@@ -2809,6 +2815,7 @@ bool Item_insert_value::fix_fields(THD *thd,
     arg= ref->ref[0];
   }
   Item_field *field_arg= (Item_field *)arg;
+
   if (field_arg->field->table->insert_values)
   {
     Field *def_field= (Field*) sql_alloc(field_arg->field->size_of());