BUG#21166: Prepared statement causes signal 11 on second execution

Changes in an item tree done by optimizer weren't properly
registered and went unnoticed, which resulted in preliminary freeing
of used memory.


mysql-test/r/ps.result:
  Add result for bug#21166: Prepared statement causes signal 11
  on second execution.
mysql-test/t/ps.test:
  Add test case for bug#21166: Prepared statement causes signal 11
  on second execution.
sql/item.cc:
  Move Item::transform() and Item_default_value::transform() from
  item.h here and use THD::change_item_tree() instead of plain
  assignment.
  Change Item_field::set_no_const_sub() to be used with Item::walk()
  instead of Item::transform().
sql/item.h:
  Move definition of Item::transform() and Item_default_value::transform()
  to item.cc.
  Change Item::set_no_const_sub() to be used with Item::walk()
  instead of Item::transform().
sql/item_cmpfunc.cc:
  Use Item::walk() to execute Item::set_no_const_sub().
  Use THD::change_item_tree() instead of plain assignment.
sql/item_func.cc:
  Add assert and comment to Item_func::traverse_cond().
sql/item_row.cc:
  Use THD::change_item_tree() instead of plain assignment.
sql/item_strfunc.cc:
  Move Item_func_make_set::transform() from item_strfunc.h here and use
  THD::change_item_tree() instead of plain assignment.
sql/item_strfunc.h:
  Move definition of Item_func_make_set::transform() to item_strfunc.cc.

1 files changed, 4 insertions, 18 deletions

diff --git a/sql/item.h b/sql/item.h
index 514c31c2d74..003f264fc7d 100644
--- a/sql/item.h
+++ b/sql/item.h
@@ -734,10 +734,7 @@ public:
     return (this->*processor)(arg);
   }
 
-  virtual Item* transform(Item_transformer transformer, byte *arg)
-  {
-    return (this->*transformer)(arg);
-  }
+  virtual Item* transform(Item_transformer transformer, byte *arg);
 
    virtual void traverse_cond(Cond_traverser traverser,
                               void *arg, traverse_order order)
@@ -755,7 +752,7 @@ public:
   virtual bool is_expensive_processor(byte *arg) { return 0; }
 
   virtual Item *equal_fields_propagator(byte * arg) { return this; }
-  virtual Item *set_no_const_sub(byte *arg) { return this; }
+  virtual bool set_no_const_sub(byte *arg) { return FALSE; }
   virtual Item *replace_equal_field(byte * arg) { return this; }
 
   /*
@@ -1255,7 +1252,7 @@ public:
   }
   Item_equal *find_item_equal(COND_EQUAL *cond_equal);
   Item *equal_fields_propagator(byte *arg);
-  Item *set_no_const_sub(byte *arg);
+  bool set_no_const_sub(byte *arg);
   Item *replace_equal_field(byte *arg);
   inline uint32 max_disp_length() { return field->max_length(); }
   Item_field *filed_for_view_update() { return this; }
@@ -2116,18 +2113,7 @@ public:
       (this->*processor)(args);
   }
 
-  /* 
-     This method like the walk method traverses the item tree, but
-     at the same time it can replace some nodes in the tree
-  */ 
-  Item *transform(Item_transformer transformer, byte *args)
-  {
-    Item *new_item= arg->transform(transformer, args);
-    if (!new_item)
-      return 0;
-    arg= new_item;
-    return (this->*transformer)(args);
-  }
+  Item *transform(Item_transformer transformer, byte *args);
 };
 
 /*