fix_fields recoursion didn't stop when some level's fix_length_and_dec

produced an error. This led to server crash in some cases, e.g.:
create table t7 (s1 char);
select * from t7
where concat(s1 collate latin1_general_ci,s1 collate latin1_swedish_ci)
= 'AA';

3 files changed, 17 insertions, 0 deletions

diff --git a/mysql-test/r/func_str.result b/mysql-test/r/func_str.result
index 37694ad2f0a..929ab0535d8 100644
--- a/mysql-test/r/func_str.result
+++ b/mysql-test/r/func_str.result
@@ -553,3 +553,8 @@ SUBSTR('abcdefg',-1,-1)
 select SUBSTR('abcdefg',1,-1) FROM DUAL;
 SUBSTR('abcdefg',1,-1)
 
+create table t7 (s1 char);
+select * from t7
+where concat(s1 collate latin1_general_ci,s1 collate latin1_swedish_ci) = 'AA';
+ERROR HY000: Illegal mix of collations (latin1_general_ci,EXPLICIT) and (latin1_swedish_ci,EXPLICIT) for operation 'concat'
+drop table t7;
diff --git a/mysql-test/t/func_str.test b/mysql-test/t/func_str.test
index f158eaa3764..4c996121446 100644
--- a/mysql-test/t/func_str.test
+++ b/mysql-test/t/func_str.test
@@ -305,3 +305,13 @@ select SUBSTR('abcdefg',-1,5) FROM DUAL;
 select SUBSTR('abcdefg',0,0) FROM DUAL;
 select SUBSTR('abcdefg',-1,-1) FROM DUAL;
 select SUBSTR('abcdefg',1,-1) FROM DUAL;
+
+#
+# Test that fix_fields doesn't follow to upper level (to comparison)
+# when an error on a lower level (in concat) has accured:
+#
+create table t7 (s1 char);
+--error 1265
+select * from t7
+where concat(s1 collate latin1_general_ci,s1 collate latin1_swedish_ci) = 'AA';
+drop table t7;
diff --git a/sql/item_func.cc b/sql/item_func.cc
index 9ecc062d645..e1092dda857 100644
--- a/sql/item_func.cc
+++ b/sql/item_func.cc
@@ -192,6 +192,8 @@ Item_func::fix_fields(THD *thd, TABLE_LIST *tables, Item **ref)
     }
   }
   fix_length_and_dec();
+  if (thd && thd->net.last_errno) // An error inside fix_length_and_dec accured
+    return 1;
   fixed= 1;
   return 0;
 }