Auto-merged.

5 files changed, 49 insertions, 2 deletions

diff --git a/mysql-test/r/ps.result b/mysql-test/r/ps.result
index 1f8a077af40..34b94b71eff 100644
--- a/mysql-test/r/ps.result
+++ b/mysql-test/r/ps.result
@@ -1917,6 +1917,29 @@ execute stmt using @arg;
 ?
 -12345.5432100000
 deallocate prepare stmt;
+#
+# Bug#48508: Crash on prepared statement re-execution.
+#
+create table t1(b int);
+insert into t1 values (0);
+create view v1 AS select 1 as a from t1 where b;
+prepare stmt from "select * from v1 where a";
+execute stmt;
+a
+execute stmt;
+a
+drop table t1;
+drop view v1;
+create table t1(a bigint);
+create table t2(b tinyint);
+insert into t2 values (null);
+prepare stmt from "select 1 from t1 join  t2 on a xor b where b > 1  and a =1";
+execute stmt;
+1
+execute stmt;
+1
+drop table t1,t2;
+#
 End of 5.0 tests.
 create procedure proc_1() reset query cache;
 call proc_1();
diff --git a/mysql-test/t/ps.test b/mysql-test/t/ps.test
index db5994d434b..c160ba993d5 100644
--- a/mysql-test/t/ps.test
+++ b/mysql-test/t/ps.test
@@ -1991,6 +1991,27 @@ select @arg;
 execute stmt using @arg;
 deallocate prepare stmt;
 
+--echo #
+--echo # Bug#48508: Crash on prepared statement re-execution.
+--echo #
+create table t1(b int);
+insert into t1 values (0);
+create view v1 AS select 1 as a from t1 where b;
+prepare stmt from "select * from v1 where a";
+execute stmt;
+execute stmt;
+drop table t1;
+drop view v1;
+
+create table t1(a bigint);
+create table t2(b tinyint);
+insert into t2 values (null);
+prepare stmt from "select 1 from t1 join  t2 on a xor b where b > 1  and a =1";
+execute stmt;
+execute stmt;
+drop table t1,t2;
+--echo #
+
 --echo End of 5.0 tests.
 
 #
diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc
index fd5eca8911a..5415d6f4f8a 100644
--- a/sql/item_cmpfunc.cc
+++ b/sql/item_cmpfunc.cc
@@ -4291,7 +4291,7 @@ Item *Item_cond::compile(Item_analyzer analyzer, uchar **arg_p,
     uchar *arg_v= *arg_p;
     Item *new_item= item->compile(analyzer, &arg_v, transformer, arg_t);
     if (new_item && new_item != item)
-      li.replace(new_item);
+      current_thd->change_item_tree(li.ref(), new_item);
   }
   return Item_func::transform(transformer, arg_t);
 }
diff --git a/sql/sql_base.cc b/sql/sql_base.cc
index cf8a0b32764..9bb4ebedd55 100644
--- a/sql/sql_base.cc
+++ b/sql/sql_base.cc
@@ -5686,7 +5686,8 @@ find_field_in_view(THD *thd, TABLE_LIST *table_list,
     if (!my_strcasecmp(system_charset_info, field_it.name(), name))
     {
       // in PS use own arena or data will be freed after prepare
-      if (register_tree_change && thd->stmt_arena->is_stmt_prepare_or_first_sp_execute())
+      if (register_tree_change &&
+          thd->stmt_arena->is_stmt_prepare_or_first_stmt_execute())
         arena= thd->activate_stmt_arena_if_needed(&backup);
       /*
         create_item() may, or may not create a new Item, depending on
diff --git a/sql/sql_class.h b/sql/sql_class.h
index f74524de60e..8acc03f929d 100644
--- a/sql/sql_class.h
+++ b/sql/sql_class.h
@@ -548,6 +548,8 @@ public:
   { return state == INITIALIZED_FOR_SP; }
   inline bool is_stmt_prepare_or_first_sp_execute() const
   { return (int)state < (int)PREPARED; }
+  inline bool is_stmt_prepare_or_first_stmt_execute() const
+  { return (int)state <= (int)PREPARED; }
   inline bool is_first_stmt_execute() const { return state == PREPARED; }
   inline bool is_stmt_execute() const
   { return state == PREPARED || state == EXECUTED; }