From: Alexander Barkov
Date: January 17 2011 12:12pm
Subject: bzr commit into mysql-5.1 branch (alexander.barkov:3557) Bug#58371
List-Archive: http://lists.mysql.com/commits/128945
X-Bug: 58371
Message-Id: <201101171212.p0HCCE91029296@bar.myoffice.izhnet.ru>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2082551844815183896=="

--===============2082551844815183896==
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

#At file:///home/bar/mysql-bzr/mysql-5.1.b58371/ based on revid:alexander.barkov@stripped

 3557 Alexander Barkov	2011-01-17
      Bug#58371 Assertion failed: !s.uses_buffer_owned_by(this) with format string function
      
      Introduced by the fix for bug#44766.
      
      Problem: it's not correct to use args[0]->str_value as a buffer,
      because args[0] may need this buffer for its own purposes.
      
      Fix: adding a new class member tmp_value to use as return value.
      
        @ mysql-test/r/ctype_many.result
        @ mysql-test/t/ctype_many.test
        Adding tests
      
        @ sql/item_strfunc.cc
        Changing code into traditional style:
        use "str" as a buffer for the argument and tmp_value for the result value.
      
        @ sql/item_strfunc.h
        Adding tmp_value

    modified:
      mysql-test/r/ctype_many.result
      mysql-test/t/ctype_many.test
      sql/item_strfunc.cc
      sql/item_strfunc.h
=== modified file 'mysql-test/r/ctype_many.result'
--- a/mysql-test/r/ctype_many.result	2006-02-22 09:09:59 +0000
+++ b/mysql-test/r/ctype_many.result	2011-01-17 12:11:33 +0000
@@ -1683,3 +1683,18 @@ ARMENIAN CAPIT DA	2
 ARMENIAN CAPIT ECH	2
 ARMENIAN CAPIT ZA	2
 DROP TABLE t1;
+#
+# Start of 5.1 tests
+#
+#
+# Bug#58371 Assertion failed: !s.uses_buffer_owned_by(this) with format string function
+#
+SET NAMES latin1;
+DO CONVERT(CAST(SUBSTRING_INDEX(FORMAT(1,'1111'), FORMAT('','Zpq'),1) 
+AS BINARY(0)) USING utf8);
+Warnings:
+Warning	1292	Truncated incorrect INTEGER value: 'Zpq'
+Warning	1292	Truncated incorrect BINARY(0) value: '1.'
+#
+# End of 5.1 tests
+#

=== modified file 'mysql-test/t/ctype_many.test'
--- a/mysql-test/t/ctype_many.test	2005-10-13 14:16:19 +0000
+++ b/mysql-test/t/ctype_many.test	2011-01-17 12:11:33 +0000
@@ -211,3 +211,19 @@ SELECT min(comment),count(*) FROM t1 GRO
 DROP TABLE t1;
 
 # End of 4.1 tests
+
+
+--echo #
+--echo # Start of 5.1 tests
+--echo #
+
+--echo #
+--echo # Bug#58371 Assertion failed: !s.uses_buffer_owned_by(this) with format string function
+--echo #
+
+SET NAMES latin1;
+DO CONVERT(CAST(SUBSTRING_INDEX(FORMAT(1,'1111'), FORMAT('','Zpq'),1) 
+                AS BINARY(0)) USING utf8);
+--echo #
+--echo # End of 5.1 tests
+--echo #

=== modified file 'sql/item_strfunc.cc'
--- a/sql/item_strfunc.cc	2011-01-13 07:57:15 +0000
+++ b/sql/item_strfunc.cc	2011-01-17 12:11:33 +0000
@@ -2761,22 +2761,16 @@ String *Item_func_conv_charset::val_str(
   DBUG_ASSERT(fixed == 1);
   if (use_cached_value)
     return null_value ? 0 : &str_value;
-  /* 
-    Here we don't pass 'str' as a parameter to args[0]->val_str()
-    as 'str' may point to 'str_value' (e.g. see Item::save_in_field()),
-    which we use below to convert string. 
-    Use argument's 'str_value' instead.
-  */
-  String *arg= args[0]->val_str(&args[0]->str_value);
+  String *arg= args[0]->val_str(str);
   uint dummy_errors;
   if (!arg)
   {
     null_value=1;
     return 0;
   }
-  null_value= str_value.copy(arg->ptr(),arg->length(),arg->charset(),
+  null_value= tmp_value.copy(arg->ptr(), arg->length(), arg->charset(),
                              conv_charset, &dummy_errors);
-  return null_value ? 0 : check_well_formed_result(&str_value);
+  return null_value ? 0 : check_well_formed_result(&tmp_value);
 }
 
 void Item_func_conv_charset::fix_length_and_dec()

=== modified file 'sql/item_strfunc.h'
--- a/sql/item_strfunc.h	2011-01-13 07:57:15 +0000
+++ b/sql/item_strfunc.h	2011-01-17 12:11:33 +0000
@@ -713,6 +713,7 @@ public:
 class Item_func_conv_charset :public Item_str_func
 {
   bool use_cached_value;
+  String tmp_value;
 public:
   bool safe;
   CHARSET_INFO *conv_charset; // keep it public


--===============2082551844815183896==
MIME-Version: 1.0
Content-Type: text/bzr-bundle; charset="us-ascii";
 name="bzr/alexander.barkov@stripped"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

# Bazaar merge directive format 2 (Bazaar 0.90)
# revision_id: alexander.barkov@stripped\
#   64dwqa4aiu382e7y
# target_branch: file:///home/bar/mysql-bzr/mysql-5.1.b58371/
# testament_sha1: d07d060ab186f68fed8625f0d3ccb7fc10863aaf
# timestamp: 2011-01-17 15:12:14 +0300
# base_revision_id: alexander.barkov@stripped\
#   2lqsy48r0jfcd986
# 
# Begin bundle
IyBCYXphYXIgcmV2aXNpb24gYnVuZGxlIHY0CiMKQlpoOTFBWSZTWahzo+kABDdfgEA0eff///+j
3/q////wYAkvnu95506ZEIo2yzuCgUHXQAYSiUn6k9E8gMk2TU02o2p6NTRoANA0NA00MgJSE00y
ZE2UT1GyUNAPUAeiNMjQAAGQEpCYVPyiep6jJo0xMgMjTRoA0A0AGjQEE1TIABtTQAAABkBoAANA
A4aaYIZDTTIyYQDTQBhNGmTAAgaCSImmgJk00BAxJlPBAnqj1NHqHpGgaNB5SwduUgIX9C1KajPd
WRRuXN0kiVgvx7adWf9KV+KxpUXPbhDw2mvjXugoj15NFTNeb37HlQ3OY4TtujtoSD/HjZgam6b3
jS9HRKijwxwGUEK9W9KBy3r7Q2hWDDJkEVyO2IuZaqAKC4hEZEAGsgFDbADSsoYmkkfYqQFUX+s6
cz1lazIr9wwqMzhNeTrCRxqzUO/Bd+n7bbdiPQ22C9y6l6CSRsn6J8T85QEaJp6tKgVNKAOpvbMh
Egl+euDQKbyutVkFBx2Z5TwKrYcypRSpLNwVI7j8bpHPLhYssITYOu9GgNVAIExKoKiiqqrtB0ce
phyjDkKM4rGo8xs9/5qIfmMYTulBaew4mzxTGnAYY76mmWTiwVEhzNBgcDSH/aGQHac18TkuILoX
oaOwPmgjtVpKggV+Aw1rJF41Ria9u+uCGVKrADEIPRAcMS4CtbwhCgKdMxog1lKF6sBZ0J3gG0YY
zGPYOqQoCKAZAYjAxAxTGliIQUcopgwsaTQJMGEjMJOcj3hdEcmRHDpSrkaUFrKiMMEtDFTFw65B
R3GRzjf+NoUoDRbpIhb5bjqeZqkgHLjFQIiUU6SlTlpBaNEif7TCGe3GuHRO8pcWIkP4WDxJFGrF
J06J1PUmYx6mLnhV5GjjYKREiYHA0zj2QygPF8JQN4cUDO2jAFjRZoH4WvxS5JEx1TQC2jU8ySky
pyIa7D6mes2U8DM6eFVheYNkYpQMJyqooUmnvdKr2lv1zHBWly6RjcTLMrraOqILcG4haSIBI0wg
McGBanIfYroNcaCoN4JIgOysnBNBI4HChgsi01FZxGo78hpTVTCkhJ5sYXquVrFFWPMwkTzZsvtv
NqZ1xVvoXlppBLxmJpBK8iqg0YXwvFEXLUoNAb7DEVVO7XUwg3KIwiYTtIEjFJTehkVpspC04qiI
8wTUWPITv3l4LsuKksgRfWNrBZvrwPG0rqLb5CjSMbTsM74DFXzKTaZbYZX24s1AOQZUR1KAJyBi
TGtKCWB+BO80xLi8uuGpcwGE95OYp2jXSKYLbI6RwWM+ouHKWEnk3XDZiIsIkl4aRyOFTIPHynK6
0vR1z7nqDRKekkTaCfs0RvKESrCsin2wDRW0+8mUmr0rTnRh77yvF1k+IWNGNrUZJxRcTSaKJQpS
pg3wLWoGs+KO6ig63dhm8gxcGA2/kHLJgsR1zXEA/RGOf1MgQL6kmnUpSKBSlp9ivlqzkFJEePxd
2UkeBkHhAfAio2p/iw+JY5YfsYdAh9SJpOgLJTKwWVIYiZkC8wLQkRC4vMGP4jEiBWqSS+i9F4rY
OuS93V7A6Eg7E9Ev5wAp5gP9IUuh/hpXuV41QhEjyKLDmBLmnJuN3s4zlMJiA9xym4pGu4ctEekA
Stv4EwnCgoF5cbUEcFiOb0IBXS0BiLFesiDy9lWG60A/UjTJDktmmxCwKWdbGRtFxtFBr+LBhnF3
I0AoG2S918vmKvMZjLLCmRF7xWJCUgRZ1JQLRcfR2LnNxwGz3kydWwGeRuTH5EvD/mmlB0xfaRiI
GsSDW0yHiUqC7Snz9OI7uSCQzdQb9/HsrMdg5MW8cmKZtKOI6tVSBg32HBOeyz5HKCsQEbwieSKF
HE7LuwpIguvSzG537whCt3uZREDMGFgxPViYduyTq066gVdge4OIbckeDyCtLYBESkEpgH695Abw
o4PDzyQpWkkoW7a63EOjWz06K2MLDRdeBe/3Pih0wrctxmzoDfVBcOPBkudsgGZFgosgsuQEUFHM
OWoC03QY0GQRJmZKkPBP+S7ilI5lZpRqF3GZ3HxDiFyKyS1wQd/pyH3gRVCRaEFzbuOsfICXSdjl
53ZkKU0R8j06EzMd5yEfwgQ5lC1Q5kyIYkUGj7jeIoObF5hp3oGjkhzqNQLWqDewMbkrayyvxdON
CXx69c6xb0m6gfRHMeOyMYwnSq2OyCXCySFrvrBJuRE6XR8ql2a8q+p5D5HnzSjyQGGnW2IFoe0o
S8zVhQDzYuL1uMwcQMFbJd3t99QBMbnZwXvPE9ygLIwmhd2eZ2VCCxmA3Ad5uFsj0lgRjfLWdpqv
LjxL+0txFWi4jXEjcfpEmrmU+5ngMwyCQaBFkR1+BCCTICilSep6AVEx9NcFcedOBEsKahhVMvxd
xUlzEaB4qdxAomoj13iyAYmQ0EIgmtFHB27Bsg2CC5J0oL4wTU7rMUBf0LHQJMKHQwMJ0doEIEZ9
D+R5BmxpSuEopcNUzxpZBKl04izVBLciSGs6yJsMcGGiw9oN6m5wD3/qTq8m6pmIGZLx6FQkeu1r
GHOHi6KgJBWwNTBEEBWluOgYgt59pFOymap5DFbDKH8hlzOorRI7un5xjFVWfVdIQUu3wrwo+RUG
2hYQW+KPTMNCTB7LxfDSWL5ByZmZmasrPYHUMfeT0/euxOgmlVo+Hm4FikhmFLI3eR4ryy0cTRvq
IqMiW57YDl9WuJwqiEPUBj6DxKwOHgHAtM0JuokuMQ3L9ZXnnuGIGtOqqJr7MUGTmSTqD8mUWA1M
moHROqAnltPUlUBgSEuRpGMkL4e1L5qRcedgq3A0DLfMozgYzyixvTFZ1mJsrGAOXYKkZhiRRWst
exKg9WdqZqsNBsBZlrNpOowL3otQHuGQd5t17IIudR1ANELk4uBJA7QEiEkFxsIf8XckU4UJCoc6
PpA=


--===============2082551844815183896==--