Bug#16347426:ASSERTION FAILED: (SELECT_INSERT &&

             !TABLES->NEXT_NAME_RESOLUTION_TABLE) || !TAB
      
Problem:
The context info of select query gets corrupted when a query
with group_concat having order by is present in an order by
clause of the select query. As a result, server crashes with
an assert.
      
Analysis:
While parsing order by for group_concat, it is presumed that
it is always present before the actual order by for the
select query.
As a result, parser uses select->order_list to populate the
order by items of group_concat and creates a select->gorder_list
to which select->order_list is copied onto. Once this is done,
it empties the select->order_list.
In the case presented in the bugpage, as order by is already
parsed when group_concat's order by is encountered, parser
presumes that it is the second order by in the select query
and creates fake_lex_unit which results in the change of
context info.
      
Solution:
Make group_concat's order by parsing independent of the select


sql/item_sum.cc:
  Change the argument as, select->gorder_list is not pointer anymore
sql/item_sum.h:
  Change the argument as, select->gorder_list is not pointer anymore
sql/mysql_priv.h:
  Parsing for group_concat's order by is made independent.
  As a result, add_order_to_list cannot be used anymore.
sql/sql_lex.cc:
  Parsing for group_concat's order by is made independent.
  As a result, add_order_to_list cannot be used anymore.
sql/sql_lex.h:
  Parsing for group_concat's order by is made independent.
  As a result, add_order_to_list cannot be used anymore.
sql/sql_yacc.yy:
   Make group_concat's order by parsing independent of the select
  queries order by.

1 files changed, 4 insertions, 3 deletions

diff --git a/sql/item_sum.cc b/sql/item_sum.cc
index fd35ab027e1..fecf083e8ef 100644
--- a/sql/item_sum.cc
+++ b/sql/item_sum.cc
@@ -2960,11 +2960,12 @@ int dump_leaf_key(uchar* key, element_count count __attribute__((unused)),
 Item_func_group_concat::
 Item_func_group_concat(Name_resolution_context *context_arg,
                        bool distinct_arg, List<Item> *select_list,
-                       SQL_I_List<ORDER> *order_list, String *separator_arg)
+                       const SQL_I_List<ORDER> &order_list,
+                       String *separator_arg)
   :tmp_table_param(0), warning(0),
    separator(separator_arg), tree(0), unique_filter(NULL), table(0),
    order(0), context(context_arg),
-   arg_count_order(order_list ? order_list->elements : 0),
+   arg_count_order(order_list.elements),
    arg_count_field(select_list->elements),
    count_cut_values(0),
    distinct(distinct_arg),
@@ -3004,7 +3005,7 @@ Item_func_group_concat(Name_resolution_context *context_arg,
   if (arg_count_order)
   {
     ORDER **order_ptr= order;
-    for (ORDER *order_item= order_list->first;
+    for (ORDER *order_item= order_list.first;
          order_item != NULL;
          order_item= order_item->next)
     {