Bug#28763: Selecting geometry fields in UNION caused server crash.

This bug was introduced by the fix for the bug#27300. In this fix a section
of code was added to the Item::tmp_table_field_from_field_type method.
This section intended to create Field_geom fields for the Item_geometry_func
class and its descendants. In order to get the geometry type of the current
item it casted "this" to the Item_geometry_func* type. But the
Item::tmp_table_field_from_field_type method is also used for creation of
fields for UNION and in this case this method is called for an object of the
Item_type_holder class and the cast to the Item_geometry_func* type causes 
a server crash.

Now the Item::tmp_table_field_from_field_type method correctly works when it's
called for both the Item_type_holder and the Item_geometry_func classes.
The new geometry_type variable is added to the Item_type_holder class.
The new method called get_geometry_type is added to the Item_field
and the Field classes. It returns geometry type from the field for the
Item_field and the Field_geom classes and fails an assert for other Field
descendants.


sql/field.h:
  Bug#28763: Selecting geometry fields in UNION caused server crash.
  The new method called get_geometry_type is added to the Field class.
  It returns geometry type of the field for the Field_geom class
  and fails an assert for other Field descendants.
sql/item.cc:
  Bug#28763: Selecting geometry fields in UNION caused server crash.
  Now the Item::tmp_table_field_from_field_type method correctly works when it's
  called for both the Item_type_holder and the Item_geometry_func classes.
mysql-test/r/gis.result:
  Added a test case for the bug#28763: Selecting geometry fields in UNION caused server crash.
mysql-test/t/gis.test:
  Added a test case for the bug#28763: Selecting geometry fields in UNION caused server crash.
sql/item.h:
  Bug#28763: Selecting geometry fields in UNION caused server crash.
  The new method called get_geometry_type is added to the Item_field class.
  It returns geometry type from the field.
  The new geometry_type variable is added to the Item_type_holder class.

1 files changed, 7 insertions, 1 deletions

diff --git a/sql/item.cc b/sql/item.cc
index 92ea35072f9..59708afdd19 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -4317,7 +4317,9 @@ Field *Item::tmp_table_field_from_field_type(TABLE *table)
   case MYSQL_TYPE_GEOMETRY:
     return new Field_geom(max_length, maybe_null, name, table,
                           (Field::geometry_type)
-                          ((Item_geometry_func *)this)->get_geometry_type());
+                          ((type() == Item::TYPE_HOLDER) ?
+                           ((Item_type_holder *)this)->get_geometry_type() :
+                           ((Item_geometry_func *)this)->get_geometry_type()));
   }
 }
 
@@ -6422,6 +6424,10 @@ Item_type_holder::Item_type_holder(THD *thd, Item *item)
   if (Field::result_merge_type(fld_type) == INT_RESULT)
     decimals= 0;
   prev_decimal_int_part= item->decimal_int_part();
+  if (item->field_type() == MYSQL_TYPE_GEOMETRY)
+    geometry_type= (item->type() == Item::FIELD_ITEM) ?
+      ((Item_field *)item)->get_geometry_type() :
+      (Field::geometry_type)((Item_geometry_func *)item)->get_geometry_type();
 }