Fixed bug #27229: crash when a set function aggregated in outer

context was used as an argument of GROUP_CONCAT.
Ensured correct setting of the depended_from field in references
generated for set functions aggregated in outer selects.
A wrong value of this field resulted in wrong maps returned by 
used_tables() for these references.
Made sure that a temporary table field is added for any set function
aggregated in outer context when creation of a temporary table is 
needed to execute the inner subquery. 


mysql-test/r/subselect.result:
  Added a test case for bug #27229.
mysql-test/t/subselect.test:
  Added a test case for bug #27229.
sql/item.cc:
  Fixed bug #27229: crash when a set function aggregated in outer
  context was used as an argument of GROUP_CONCAT.
  Ensured correct setting of the depended_from field in references
  generated for set functions aggregated in outer selects.
sql/item_sum.cc:
  Fixed bug #27229: crash when a set function aggregated in outer
  context was used as an argument of GROUP_CONCAT.
  Added the field aggr_sel to the objects of the class Item_sum.
  In any Item_sum object created for a set function this field 
  has to contain a pointer to the select where the set function
  is aggregated.
sql/item_sum.h:
  Fixed bug #27229: crash when a set function aggregated in outer
  context was used as an argument of GROUP_CONCAT.
  Added the field aggr_sel to the objects of the class Item_sum.
  In any Item_sum object created for a set function this field 
  has to contain a pointer to the select where the set function
  is aggregated.
  Added a method that says whether a set function is aggregated
  in outer context and, if so, returns the aggregating select.
  Removed the field nest_level_tables_count introduced by the
  patch for bug 24484 as aggr_sel->join->tables contains the
  sane number.
sql/sql_base.cc:
  Fixed bug #27229: crash when a set function aggregated in outer
  context was used as an argument of GROUP_CONCAT.
  Added the field aggr_sel to the objects of the class Item_sum.
  Removed changes introduced by the patch for bug 24484 as 
  the field leaf_count of the THD class is not used anymore.
sql/sql_class.h:
  Fixed bug #27229: crash when a set function aggregated in outer
  context was used as an argument of GROUP_CONCAT.
  Added the field aggr_sel to the objects of the class Item_sum.
  Removed changes introduce by the patch for bug 24484 as 
  the field leaf_count of the THD class is not used anymore.
sql/sql_insert.cc:
  Fixed bug #27229: crash when a set function aggregated in outer
  context was used as an argument of GROUP_CONCAT.
  Added the field aggr_sel to the objects of the class Item_sum.
  Removed changes introduce by the patch for bug 24484 as 
  the field leaf_count of the THD class is not used anymore.
sql/sql_select.cc:
  Fixed bug #27229: crash when a set function aggregated in outer
  context was used as an argument of GROUP_CONCAT.
  When creating a temporary table a field is added in it for any 
  set function aggregated in outer context.

1 files changed, 6 insertions, 3 deletions

diff --git a/sql/item.cc b/sql/item.cc
index 11a5039ca19..255a756b6d1 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -1261,15 +1261,18 @@ void Item::split_sum_func2(THD *thd, Item **ref_pointer_array,
       Exception is Item_direct_view_ref which we need to convert to
       Item_ref to allow fields from view being stored in tmp table.
     */
+    Item_aggregate_ref *item_ref;
     uint el= fields.elements;
-    Item *new_item, *real_itm= real_item();
+    Item *real_itm= real_item();
 
     ref_pointer_array[el]= real_itm;
-    if (!(new_item= new Item_aggregate_ref(&thd->lex->current_select->context,
+    if (!(item_ref= new Item_aggregate_ref(&thd->lex->current_select->context,
                                            ref_pointer_array + el, 0, name)))
       return;                                   // fatal_error is set
+    if (type() == SUM_FUNC_ITEM)
+      item_ref->depended_from= ((Item_sum *) this)->depended_from(); 
     fields.push_front(real_itm);
-    thd->change_item_tree(ref, new_item);
+    thd->change_item_tree(ref, item_ref);
   }
 }