BUG#882994: Crash in QUICK_RANGE_SELECT::reset with derived_with_keys

- The bug was caused by the following scenario:
  = a quick select is created with get_quick_select_for_ref. The quick 
    select refers to temporary (derived) table. It saves table->file, which
    refers to a ha_heap object.
  = When temp table is populated, ha_heap reaches max. size and is converted
    to a ha_myisam.  However, quick->file remains pointing to where ha_heap 
    was. 
  = Attempt to use the quick select causes crash.
- Fixed by introducing QUICK_SELECT_I::replace_handler(). Note that it will 
  not work for index_merge quick selects. Which is fine, because these
  quick selects are never created for derived tables.

2 files changed, 9 insertions, 0 deletions

diff --git a/sql/opt_range.h b/sql/opt_range.h
index 0ad2b7242f2..e498d229dde 100644
--- a/sql/opt_range.h
+++ b/sql/opt_range.h
@@ -354,6 +354,12 @@ public:
     Table record buffer used by this quick select.
   */
   uchar    *record;
+
+  virtual void replace_handler(handler *new_file)
+  {
+    DBUG_ASSERT(0); /* Only supported in QUICK_RANGE_SELECT */
+  }
+
 #ifndef DBUG_OFF
   /*
     Print quick select information to DBUG_FILE. Caller is responsible
@@ -449,6 +455,7 @@ public:
 #ifndef DBUG_OFF
   void dbug_dump(int indent, bool verbose);
 #endif
+  virtual void replace_handler(handler *new_file) { file= new_file; }
 private:
   /* Default copy ctor used by QUICK_SELECT_DESC */
   friend class TRP_ROR_INTERSECT;
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index af7cd3c0a7a..c6b5369c356 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -9701,6 +9701,8 @@ bool JOIN_TAB::preread_init()
                                     derived, DT_CREATE | DT_FILL))
       return TRUE;
   preread_init_done= TRUE;
+  if (select && select->quick)
+    select->quick->replace_handler(table->file);
   return FALSE;
 }