Fixed LP bug #777745.

Fields belonging to views in general cannot be substituted for 
equal items, in particular for constants, because all references
to a view field refer to the same Item_field object while they 
could be used in different OR parts of the where condition and
belong to different equivalence classes (to different Item_equals).
That's why substitution for equal items in any context is allowed
only in place of Item_direct_view_ref objects, but not in place of
Item_fields these objects refer to.
Due to some erroneous code in the patch for bug 717577 substitution
for view fields were allowed in some context.This could lead
to wrong results returned by queries using views.

The fix prohibits substitution of view fields for equal items 
in any context.

The patch also changes slightly the compile method for the Item_func
class. Now if the analyze method returns NULL in his parameter the
compile method is not called for the arguments of the function
at all. A similar change was made for the Item_ref class.     

6 files changed, 67 insertions, 22 deletions

diff --git a/sql/item.cc b/sql/item.cc
index b0530f0e17e..027a5f2c67e 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -4675,7 +4675,7 @@ Item_equal *Item_field::find_item_equal(COND_EQUAL *cond_equal)
   The function checks whether a substitution of a field item for
   an equal item is valid.
 
-  @param arg   *arg != NULL && **arg <-> the field is in the context
+  @param arg   *arg != NULL <-> the field is in the context
                where substitution for an equal item is valid
 
   @note
@@ -4701,8 +4701,10 @@ Item_equal *Item_field::find_item_equal(COND_EQUAL *cond_equal)
 
 bool Item_field::subst_argument_checker(uchar **arg)
 {
-  return (!(*arg) && (result_type() != STRING_RESULT)) ||
-          ((*arg) && (**arg));
+  return *arg &&
+         (*arg == (uchar *) Item::ANY_SUBST ||
+          result_type() != STRING_RESULT || 
+          (field->flags & BINARY_FLAG));
 }
 
 
@@ -6376,9 +6378,11 @@ Item* Item_ref::transform(Item_transformer transformer, uchar *arg)
 
   First the function applies the analyzer to the Item_ref object. Then
   if the analizer succeeeds we first applies the compile method to the
-  object the Item_ref object is referencing.  If this returns a new
+  object the Item_ref object is referencing. If this returns a new
   item the old item is substituted for a new one.  After this the
   transformer is applied to the Item_ref object itself.
+  The compile function is not called if the analyzer returns NULL
+  in the parameter arg_p. 
 
   @param analyzer      the analyzer callback function to be applied to the
                        nodes of the tree of the object
@@ -6399,10 +6403,13 @@ Item* Item_ref::compile(Item_analyzer analyzer, uchar **arg_p,
 
   /* Compile the Item we are referencing. */
   DBUG_ASSERT((*ref) != NULL);
-  uchar *arg_v= *arg_p;
-  Item *new_item= (*ref)->compile(analyzer, &arg_v, transformer, arg_t);
-  if (new_item && *ref != new_item)
-    current_thd->change_item_tree(ref, new_item);
+  if (*arg_p)
+  {
+    uchar *arg_v= *arg_p;
+    Item *new_item= (*ref)->compile(analyzer, &arg_v, transformer, arg_t);
+    if (new_item && *ref != new_item)
+      current_thd->change_item_tree(ref, new_item);
+  }
 
   /* Transform this Item object. */
   return (this->*transformer)(arg_t);
@@ -7270,7 +7277,7 @@ Item_equal *Item_direct_view_ref::find_item_equal(COND_EQUAL *cond_equal)
   The function checks whether a substitution of a reference to field item for
   an equal item is valid.
 
-  @param arg   *arg != NULL && **arg <-> the reference is in the context
+  @param arg   *arg != NULL <-> the reference is in the context
                where substitution for an equal item is valid
 
   @note
@@ -7283,11 +7290,19 @@ Item_equal *Item_direct_view_ref::find_item_equal(COND_EQUAL *cond_equal)
 */
 bool Item_direct_view_ref::subst_argument_checker(uchar **arg)
 {
-  bool res=  (!(*arg) && (result_type() != STRING_RESULT)) ||
-          ((*arg) && (**arg));
+  bool res= FALSE;
+  if (*arg)
+  { 
+    Item *item= real_item();
+    if (item->type() == FIELD_ITEM &&
+        (*arg == (uchar *) Item::ANY_SUBST || 
+         result_type() != STRING_RESULT ||
+         (((Item_field *) item)->field->flags & BINARY_FLAG)))
+      res= TRUE;
+  }
   /* Block any substitution into the wrapped object */
   if (*arg)
-    **arg= (uchar) 0;
+    *arg= NULL; 
   return res; 
 }
 
diff --git a/sql/item.h b/sql/item.h
index 120ff358098..34e670037c1 100644
--- a/sql/item.h
+++ b/sql/item.h
@@ -1057,12 +1057,23 @@ public:
     return FALSE;
   }
 
+  /*
+    The enumeration Subst_constraint is currently used only in implementations
+    of the virtual function subst_argument_checker.
+  */ 
+  enum Subst_constraint 
+  { 
+    NO_SUBST= 0,         /* No substitution for a field is allowed   */
+    ANY_SUBST,           /* Any substitution for a field is allowed  */ 
+    IDENTITY_SUBST       /* Substitution for a field is allowed if any two
+                            different values of the field type are not equal */
+  };
+
   virtual bool subst_argument_checker(uchar **arg)
-  {
-    if (*arg)
-      *arg= NULL;
-    return TRUE;
+  { 
+    return (*arg != NULL); 
   }
+
   /*
     @brief
     Processor used to check acceptability of an item in the defining
diff --git a/sql/item_cmpfunc.h b/sql/item_cmpfunc.h
index 9f4efbc08be..c2240ae245a 100644
--- a/sql/item_cmpfunc.h
+++ b/sql/item_cmpfunc.h
@@ -392,7 +392,10 @@ public:
   }
   Item *neg_transformer(THD *thd);
   virtual Item *negated_item();
-  bool subst_argument_checker(uchar **arg) { return TRUE; }
+  bool subst_argument_checker(uchar **arg)
+  {
+    return (*arg != NULL);     
+  }
 };
 
 class Item_func_not :public Item_bool_func
diff --git a/sql/item_func.cc b/sql/item_func.cc
index 63b8419aaaa..f345c2f29df 100644
--- a/sql/item_func.cc
+++ b/sql/item_func.cc
@@ -352,6 +352,8 @@ Item *Item_func::transform(Item_transformer transformer, uchar *argument)
     the old item is substituted for a new one.
     After this the transformer is applied to the root node
     of the Item_func object. 
+    The compile function is not called if the analyzer returns NULL
+    in the parameter arg_p. 
 
   @param analyzer      the analyzer callback function to be applied to the
                        nodes of the tree of the object
@@ -369,7 +371,7 @@ Item *Item_func::compile(Item_analyzer analyzer, uchar **arg_p,
 {
   if (!(this->*analyzer)(arg_p))
     return 0;
-  if (arg_count)
+  if (*arg_p && arg_count)
   {
     Item **arg,**arg_end;
     for (arg= args, arg_end= args+arg_count; arg != arg_end; arg++)
@@ -377,7 +379,7 @@ Item *Item_func::compile(Item_analyzer analyzer, uchar **arg_p,
       /* 
         The same parameter value of arg_p must be passed
         to analyze any argument of the condition formula.
-      */   
+      */
       uchar *arg_v= *arg_p;
       Item *new_item= (*arg)->compile(analyzer, &arg_v, transformer, arg_t);
       if (new_item && *arg != new_item)
diff --git a/sql/item_func.h b/sql/item_func.h
index 5c5ea33f247..0ddf4acf035 100644
--- a/sql/item_func.h
+++ b/sql/item_func.h
@@ -251,6 +251,21 @@ public:
   }
 
   /*
+    By default only substitution for a field whose two different values
+    are never equal is allowed in the arguments of a function.
+    This is overruled for the direct arguments of comparison functions.
+  */ 
+  bool subst_argument_checker(uchar **arg) 
+  { 
+    if (*arg)
+    {
+      *arg= (uchar *) Item::IDENTITY_SUBST;
+      return TRUE;
+    }
+    return FALSE;
+  }
+
+  /*
     We assume the result of any function that has a TIMESTAMP argument to be
     timezone-dependent, since a TIMESTAMP value in both numeric and string
     contexts is interpreted according to the current timezone.
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 5e84138bf9c..8d7224f5574 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -9788,10 +9788,9 @@ static COND *build_equal_items_for_cond(THD *thd, COND *cond,
       as soon the field is not of a string type or the field reference is
       an argument of a comparison predicate. 
     */ 
-    uchar is_subst_valid= (uchar) 1;
-    uchar *is_subst_valid_ptr= &is_subst_valid;
+    uchar* is_subst_valid= (uchar *) Item::ANY_SUBST;
     cond= cond->compile(&Item::subst_argument_checker,
-                        &is_subst_valid_ptr, 
+                        &is_subst_valid, 
                         &Item::equal_fields_propagator,
                         (uchar *) inherited);
     cond->update_used_tables();