Fixed the bug mdev-12558.

In the current code temporary tables we identified and opened before
other tables. CTE tables are identified in the same procedure as
regular tables. When a temporary table and a CTE table have the same
name T any reference to T that is in the scope of the CTE declaration
must be associated with this CTE. Yet it was not done properly.
When a reference to T was found in the scope of the declaration
of CTE T a pointer to this CTE was set in the reference. No check
that the reference had been already associated with a temporary table
was done. As a result, if the temporary table T  had been created then
the reference to T was considered simultaneously as reference to the CTE
named T and as a reference to the temporary table named T. This
confused the code that were executed later and caused a crash of
the server.
Now when a table reference is associated with a CTE any previous
association with a temporary table is dropped.

This problem could be easily avoided if the temporary tables were
not identified prematurely.
as reference to CTE named T and

1 files changed, 11 insertions, 0 deletions

diff --git a/sql/sql_cte.cc b/sql/sql_cte.cc
index c9976baeabd..62b27d05e9b 100644
--- a/sql/sql_cte.cc
+++ b/sql/sql_cte.cc
@@ -968,6 +968,17 @@ With_element *st_select_lex::find_table_def_in_with_clauses(TABLE_LIST *table)
 
 bool TABLE_LIST::set_as_with_table(THD *thd, With_element *with_elem)
 {
+  if (table)
+  {
+    /*
+      This table was prematurely identified as a temporary table.
+      We correct it here, but it's not a nice solution in the case
+      when the temporary table with this name is not used anywhere
+      else in the query.
+    */
+    thd->mark_tmp_table_as_free_for_reuse(table);
+    table= 0;
+  }
   with= with_elem;
   if (!with_elem->is_referenced() || with_elem->is_recursive)
     derived= with_elem->spec;