2 files changed, 121 insertions, 0 deletions
diff --git a/mysql-test/r/sp.result b/mysql-test/r/sp.result
index 56d8ea62f44..cf50bf49004 100644
--- a/mysql-test/r/sp.result
+++ b/mysql-test/r/sp.result
@@ -7858,3 +7858,56 @@ v1
 DROP PROCEDURE p1;
 DROP TABLE t1;
 # End of 5.5 test
+#
+#  MDEV-7040: Crash in field_conv, memcpy_field_possible, part#2
+#
+create table t1 (
+col1 bigint(20),
+col2 char(1),
+col3 char(2)
+);
+insert into t1 values (1,'a','a'), (2,'b','b');
+create table t2 as select * from t1;
+create table t3 as select * from t1;
+create table t4 as select * from t1;
+create table t5 as select * from t1;
+create table t6 as select * from t1;
+flush tables;
+CREATE PROCEDURE p1()
+begin
+DECLARE _var1 bigint(20) UNSIGNED;
+DECLARE _var2 CHAR(1) DEFAULT NULL;
+DECLARE _var3 CHAR(1) DEFAULT NULL;
+DECLARE _done BOOLEAN DEFAULT 0;
+declare cur1 cursor for
+select col1, col2, col3 
+from t1 
+where 
+col1 in (select t2.col1 from t2 where t2.col2=t1.col2) or
+col2 in (select t3.col3 from t3 where t3.col3=t1.col2) ;
+DECLARE CONTINUE HANDLER FOR NOT FOUND SET _done = 1;
+OPEN cur1;
+set _var1 = (select _var1 from t4 limit 1);
+set _var1 = (select _var1 from t5 limit 1);
+set _var1 = (select _var1 from t6 limit 1);
+label1:
+LOOP
+SET _done = 0;
+FETCH cur1 INTO _var1, _var2, _var3;
+IF _done THEN
+LEAVE label1;
+END IF;
+END LOOP label1;
+CLOSE cur1;
+end|
+set @tmp_toc= @@table_open_cache;
+set @tmp_tdc= @@table_definition_cache;
+set global table_open_cache=1;
+set global table_definition_cache=1;
+Warnings:
+Warning	1292	Truncated incorrect table_definition_cache value: '1'
+call p1();
+set global table_open_cache= @tmp_toc;
+set global table_definition_cache= @tmp_tdc;
+drop procedure p1;
+drop table t1,t2,t3,t4,t5,t6;
diff --git a/mysql-test/t/sp.test b/mysql-test/t/sp.test
index d378ab551e6..c62257049ee 100644
--- a/mysql-test/t/sp.test
+++ b/mysql-test/t/sp.test
@@ -9303,3 +9303,71 @@ DROP PROCEDURE p1;
 DROP TABLE t1;
 
 --echo # End of 5.5 test
+
+--echo #
+--echo #  MDEV-7040: Crash in field_conv, memcpy_field_possible, part#2
+--echo #
+create table t1 (
+  col1 bigint(20),
+  col2 char(1),
+  col3 char(2)
+);
+insert into t1 values (1,'a','a'), (2,'b','b');
+
+create table t2 as select * from t1;
+create table t3 as select * from t1;
+create table t4 as select * from t1;
+create table t5 as select * from t1;
+create table t6 as select * from t1;
+
+flush tables;
+
+DELIMITER |;
+
+CREATE PROCEDURE p1()
+begin
+   DECLARE _var1 bigint(20) UNSIGNED;
+   DECLARE _var2 CHAR(1) DEFAULT NULL;
+   DECLARE _var3 CHAR(1) DEFAULT NULL;
+
+   DECLARE _done BOOLEAN DEFAULT 0;
+
+   declare cur1 cursor for
+   select col1, col2, col3 
+   from t1 
+   where 
+     col1 in (select t2.col1 from t2 where t2.col2=t1.col2) or
+     col2 in (select t3.col3 from t3 where t3.col3=t1.col2) ;
+   
+   DECLARE CONTINUE HANDLER FOR NOT FOUND SET _done = 1;
+
+   OPEN cur1;
+   
+   set _var1 = (select _var1 from t4 limit 1);
+   set _var1 = (select _var1 from t5 limit 1);
+   set _var1 = (select _var1 from t6 limit 1);
+label1:
+   LOOP
+     SET _done = 0;
+     FETCH cur1 INTO _var1, _var2, _var3;
+     IF _done THEN
+         LEAVE label1;
+     END IF;
+   END LOOP label1;
+   CLOSE cur1;
+end|
+DELIMITER ;|
+
+set @tmp_toc= @@table_open_cache;
+set @tmp_tdc= @@table_definition_cache;
+
+set global table_open_cache=1;
+set global table_definition_cache=1;
+call p1();
+
+set global table_open_cache= @tmp_toc;
+set global table_definition_cache= @tmp_tdc;
+drop procedure p1;
+
+drop table t1,t2,t3,t4,t5,t6;
+