BUG#21166: Prepared statement causes signal 11 on second execution

Changes in an item tree done by optimizer weren't properly
registered and went unnoticed, which resulted in preliminary freeing
of used memory.


mysql-test/r/ps.result:
  Add result for bug#21166: Prepared statement causes signal 11
  on second execution.
mysql-test/t/ps.test:
  Add test case for bug#21166: Prepared statement causes signal 11
  on second execution.
sql/item.cc:
  Move Item::transform() and Item_default_value::transform() from
  item.h here and use THD::change_item_tree() instead of plain
  assignment.
  Change Item_field::set_no_const_sub() to be used with Item::walk()
  instead of Item::transform().
sql/item.h:
  Move definition of Item::transform() and Item_default_value::transform()
  to item.cc.
  Change Item::set_no_const_sub() to be used with Item::walk()
  instead of Item::transform().
sql/item_cmpfunc.cc:
  Use Item::walk() to execute Item::set_no_const_sub().
  Use THD::change_item_tree() instead of plain assignment.
sql/item_func.cc:
  Add assert and comment to Item_func::traverse_cond().
sql/item_row.cc:
  Use THD::change_item_tree() instead of plain assignment.
sql/item_strfunc.cc:
  Move Item_func_make_set::transform() from item_strfunc.h here and use
  THD::change_item_tree() instead of plain assignment.
sql/item_strfunc.h:
  Move definition of Item_func_make_set::transform() to item_strfunc.cc.

1 files changed, 11 insertions, 1 deletions

diff --git a/sql/item_row.cc b/sql/item_row.cc
index f5c8d511025..d7591b9865d 100644
--- a/sql/item_row.cc
+++ b/sql/item_row.cc
@@ -154,12 +154,22 @@ bool Item_row::walk(Item_processor processor, byte *arg)
 
 Item *Item_row::transform(Item_transformer transformer, byte *arg)
 {
+  DBUG_ASSERT(!current_thd->is_stmt_prepare());
+
   for (uint i= 0; i < arg_count; i++)
   {
     Item *new_item= items[i]->transform(transformer, arg);
     if (!new_item)
       return 0;
-    items[i]= new_item;
+
+    /*
+      THD::change_item_tree() should be called only if the tree was
+      really transformed, i.e. when a new item has been created.
+      Otherwise we'll be allocating a lot of unnecessary memory for
+      change records at each execution.
+    */
+    if (items[i] != new_item)
+      current_thd->change_item_tree(&items[i], new_item);
   }
   return (this->*transformer)(arg);
 }