Bug #59686 crash in String::copy() with time data type

The problem was that Item_sum_hybrid::val_xxx() did not propagate null values
up the expression tree.


mysql-test/r/func_time.result:
  New test case.
mysql-test/t/func_time.test:
  New test case.
sql/item_sum.cc:
  Check for null_value when evaluating sub-items in sub-trees in Item_sum_hybrid::val_xxx()

3 files changed, 36 insertions, 4 deletions

diff --git a/mysql-test/r/func_time.result b/mysql-test/r/func_time.result
index 2a95b234548..0ffc988519c 100644
--- a/mysql-test/r/func_time.result
+++ b/mysql-test/r/func_time.result
@@ -1368,3 +1368,15 @@ SELECT SUBDATE(STR_TO_DATE(NULL,0), INTERVAL 1 HOUR);
 SUBDATE(STR_TO_DATE(NULL,0), INTERVAL 1 HOUR)
 NULL
 #
+# Bug #59686 crash in String::copy() with time data type
+#
+SELECT min(timestampadd(month, 1>'', from_days('%Z')));
+min(timestampadd(month, 1>'', from_days('%Z')))
+NULL
+Warnings:
+Warning	1292	Truncated incorrect INTEGER value: '%Z'
+create table t1(a time);
+insert into t1 values ('00:00:00'),('00:01:00');
+select 1 from t1 where 1 < some (select cast(a as datetime) from t1);
+1
+drop table t1;
diff --git a/mysql-test/t/func_time.test b/mysql-test/t/func_time.test
index eaa592c2ad5..0afc882ea6c 100644
--- a/mysql-test/t/func_time.test
+++ b/mysql-test/t/func_time.test
@@ -881,4 +881,12 @@ SELECT WEEK(STR_TO_DATE(NULL,0));
 SELECT SUBDATE(STR_TO_DATE(NULL,0), INTERVAL 1 HOUR);
 
 --echo #
+--echo # Bug #59686 crash in String::copy() with time data type
+--echo #
+
+SELECT min(timestampadd(month, 1>'', from_days('%Z')));
 
+create table t1(a time);
+insert into t1 values ('00:00:00'),('00:01:00');
+select 1 from t1 where 1 < some (select cast(a as datetime) from t1);
+drop table t1;
diff --git a/sql/item_sum.cc b/sql/item_sum.cc
index adfa1ea66f0..8855ef05c84 100644
--- a/sql/item_sum.cc
+++ b/sql/item_sum.cc
@@ -1903,7 +1903,10 @@ double Item_sum_hybrid::val_real()
   DBUG_ASSERT(fixed == 1);
   if (null_value)
     return 0.0;
-  return value->val_real();
+  double retval= value->val_real();
+  if ((null_value= value->null_value))
+    DBUG_ASSERT(retval == 0.0);
+  return retval;
 }
 
 longlong Item_sum_hybrid::val_int()
@@ -1911,7 +1914,10 @@ longlong Item_sum_hybrid::val_int()
   DBUG_ASSERT(fixed == 1);
   if (null_value)
     return 0;
-  return value->val_int();
+  longlong retval= value->val_int();
+  if ((null_value= value->null_value))
+    DBUG_ASSERT(retval == 0);
+  return retval;
 }
 
 
@@ -1920,7 +1926,10 @@ my_decimal *Item_sum_hybrid::val_decimal(my_decimal *val)
   DBUG_ASSERT(fixed == 1);
   if (null_value)
     return 0;
-  return value->val_decimal(val);
+  my_decimal *retval= value->val_decimal(val);
+  if ((null_value= value->null_value))
+    DBUG_ASSERT(retval == NULL);
+  return retval;
 }
 
 
@@ -1930,7 +1939,10 @@ Item_sum_hybrid::val_str(String *str)
   DBUG_ASSERT(fixed == 1);
   if (null_value)
     return 0;
-  return value->val_str(str);
+  String *retval= value->val_str(str);
+  if ((null_value= value->null_value))
+    DBUG_ASSERT(retval == NULL);
+  return retval;
 }