MDEV-15118 ExtractValue(xml,something_complex) does not work

Item_xml_str_func::fix_fields() used a local "String tmp" as a buffer
for args[1]->val_str(). "tmp" was freed at the end of fix_fields(),
while Items created during my_xpath_parse() still pointed to its fragments.

Adding a new member Item_xml_str_func::m_xpath_query and store the result
of args[1]->val_str() into it.

1 files changed, 8 insertions, 2 deletions

diff --git a/sql/item_xmlfunc.cc b/sql/item_xmlfunc.cc
index c7fd923b0ae..c12f5fd3e87 100644
--- a/sql/item_xmlfunc.cc
+++ b/sql/item_xmlfunc.cc
@@ -2634,7 +2634,7 @@ void Item_xml_str_func::fix_length_and_dec()
 
 bool Item_xml_str_func::fix_fields(THD *thd, Item **ref)
 {
-  String *xp, tmp;
+  String *xp;
   MY_XPATH xpath;
   int rc;
 
@@ -2662,7 +2662,13 @@ bool Item_xml_str_func::fix_fields(THD *thd, Item **ref)
     return true;
   }
 
-  if (!(xp= args[1]->val_str(&tmp)))
+  /*
+    Get the XPath query text from args[1] and cache it in m_xpath_query.
+    Its fragments will be referenced by items created during my_xpath_parse(),
+    e.g. by Item_nodeset_func_axisbyname::node_name.
+  */
+  if (!(xp= args[1]->val_str(&m_xpath_query)) ||
+      (xp != &m_xpath_query && m_xpath_query.copy(*xp)))
     return false; // Will return NULL
   my_xpath_init(&xpath);
   xpath.cs= collation.collation;