BUG#882994: Crash in QUICK_RANGE_SELECT::reset with derived_with_keys

- The bug was caused by the following scenario:
  = a quick select is created with get_quick_select_for_ref. The quick 
    select refers to temporary (derived) table. It saves table->file, which
    refers to a ha_heap object.
  = When temp table is populated, ha_heap reaches max. size and is converted
    to a ha_myisam.  However, quick->file remains pointing to where ha_heap 
    was. 
  = Attempt to use the quick select causes crash.
- Fixed by introducing QUICK_SELECT_I::replace_handler(). Note that it will 
  not work for index_merge quick selects. Which is fine, because these
  quick selects are never created for derived tables.

1 files changed, 7 insertions, 0 deletions

diff --git a/sql/opt_range.h b/sql/opt_range.h
index 0ad2b7242f2..e498d229dde 100644
--- a/sql/opt_range.h
+++ b/sql/opt_range.h
@@ -354,6 +354,12 @@ public:
     Table record buffer used by this quick select.
   */
   uchar    *record;
+
+  virtual void replace_handler(handler *new_file)
+  {
+    DBUG_ASSERT(0); /* Only supported in QUICK_RANGE_SELECT */
+  }
+
 #ifndef DBUG_OFF
   /*
     Print quick select information to DBUG_FILE. Caller is responsible
@@ -449,6 +455,7 @@ public:
 #ifndef DBUG_OFF
   void dbug_dump(int indent, bool verbose);
 #endif
+  virtual void replace_handler(handler *new_file) { file= new_file; }
 private:
   /* Default copy ctor used by QUICK_SELECT_DESC */
   friend class TRP_ROR_INTERSECT;