Bug #27363:

Validity checks for nested set functions
were not taking into account that the enclosed
set function may be on a nest level that is
lower than the nest level of the enclosing set
function.
Fixed by :
 - propagating max_sum_func_level
up the enclosing set functions chain.
 - updating the max_sum_func_level of the 
   enclosing set function when the enclosed set
   function is aggregated above or on the same
   nest level of as the level of the enclosing 
   set function.
 - updating the max_arg_level of the enclosing
   set function on a reference that refers to
   an item above or on the same nest level
   as the level of the enclosing set function.
 - Treating both Item_field and Item_ref as possibly
   referencing items from outer nest levels.

1 files changed, 26 insertions, 2 deletions

diff --git a/sql/item.cc b/sql/item.cc
index 8568a44c547..05067cf16dc 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -3538,9 +3538,13 @@ Item_field::fix_outer_field(THD *thd, Field **from_field, Item **reference)
               thd->restore_active_arena(arena, &backup);
             fixed_as_field= 1;
           }
+          /*
+            A reference is resolved to a nest level that's outer or the same as
+            the nest level of the enclosing set function : adjust the value of
+            max_arg_level for the function if it's needed.
+          */
           if (thd->lex->in_sum_func &&
-              thd->lex->in_sum_func->nest_level == 
-              thd->lex->current_select->nest_level)
+              thd->lex->in_sum_func->nest_level >= select->nest_level)
           {
             Item::Type ref_type= (*reference)->type();
             set_if_bigger(thd->lex->in_sum_func->max_arg_level,
@@ -5182,6 +5186,16 @@ bool Item_ref::fix_fields(THD *thd, Item **reference)
         thd->change_item_tree(reference, fld);
         mark_as_dependent(thd, last_checked_context->select_lex,
                           thd->lex->current_select, this, fld);
+        /*
+          A reference is resolved to a nest level that's outer or the same as
+          the nest level of the enclosing set function : adjust the value of
+          max_arg_level for the function if it's needed.
+        */
+        if (thd->lex->in_sum_func &&
+            thd->lex->in_sum_func->nest_level >= 
+            last_checked_context->select_lex->nest_level)
+          set_if_bigger(thd->lex->in_sum_func->max_arg_level,
+                        last_checked_context->select_lex->nest_level);
         return FALSE;
       }
       if (ref == 0)
@@ -5195,6 +5209,16 @@ bool Item_ref::fix_fields(THD *thd, Item **reference)
       DBUG_ASSERT(*ref && (*ref)->fixed);
       mark_as_dependent(thd, last_checked_context->select_lex,
                         context->select_lex, this, this);
+      /*
+        A reference is resolved to a nest level that's outer or the same as
+        the nest level of the enclosing set function : adjust the value of
+        max_arg_level for the function if it's needed.
+      */
+      if (thd->lex->in_sum_func &&
+          thd->lex->in_sum_func->nest_level >= 
+          last_checked_context->select_lex->nest_level)
+        set_if_bigger(thd->lex->in_sum_func->max_arg_level,
+                      last_checked_context->select_lex->nest_level);
     }
   }