MDEV-19350 Server crashes in delete_tree_element / ... / Item_func_group_concat::repack_tree

Item_func_group_concat stores values in `tree`, which is often, but not
always the same as `&tree_base`.

1 files changed, 2 insertions, 2 deletions

diff --git a/sql/item_sum.cc b/sql/item_sum.cc
index 281b3af5a4d..71f07706d22 100644
--- a/sql/item_sum.cc
+++ b/sql/item_sum.cc
@@ -3345,8 +3345,8 @@ bool Item_func_group_concat::repack_tree(THD *thd)
     delete_tree(&st.tree);
     return 1;
   }
-  delete_tree(&tree_base);
-  tree_base= st.tree;
+  delete_tree(tree);
+  *tree= st.tree;
   tree_len= st.len;
   return 0;
 }