Bug #27363:

Validity checks for nested set functions
were not taking into account that the enclosed
set function may be on a nest level that is
lower than the nest level of the enclosing set
function.
Fixed by :
 - propagating max_sum_func_level
up the enclosing set functions chain.
 - updating the max_sum_func_level of the 
   enclosing set function when the enclosed set
   function is aggregated above or on the same
   nest level of as the level of the enclosing 
   set function.
 - updating the max_arg_level of the enclosing
   set function on a reference that refers to
   an item above or on the same nest level
   as the level of the enclosing set function.
 - Treating both Item_field and Item_ref as possibly
   referencing items from outer nest levels.

1 files changed, 14 insertions, 2 deletions

diff --git a/sql/item_sum.cc b/sql/item_sum.cc
index 359b4516c3c..ca8aa2f06e7 100644
--- a/sql/item_sum.cc
+++ b/sql/item_sum.cc
@@ -175,13 +175,25 @@ bool Item_sum::check_sum_func(THD *thd, Item **ref)
                MYF(0));
     return TRUE;
   }
-  if (in_sum_func && in_sum_func->nest_level == nest_level)
+  if (in_sum_func)
   {
     /*
       If the set function is nested adjust the value of
       max_sum_func_level for the nesting set function.
+      We take into account only enclosed set functions that are to be 
+      aggregated on the same level or above of the nest level of 
+      the enclosing set function.
+      But we must always pass up the max_sum_func_level because it is
+      the maximum nested level of all directly and indirectly enclosed
+      set functions. We must do that even for set functions that are
+      aggregated inside of their enclosing set function's nest level
+      because the enclosing function may contain another enclosing
+      function that is to be aggregated outside or on the same level
+      as its parent's nest level.
     */
-    set_if_bigger(in_sum_func->max_sum_func_level, aggr_level);
+    if (in_sum_func->nest_level >= aggr_level)
+      set_if_bigger(in_sum_func->max_sum_func_level, aggr_level);
+    set_if_bigger(in_sum_func->max_sum_func_level, max_sum_func_level);
   }
   update_used_tables();
   thd->lex->in_sum_func= in_sum_func;