bzr push into mysql-trunk branch (nuno.carvalho:3731 to 3732)

[Nuno Carvalho]

 3732 Nuno Carvalho	2012-01-16 [merge]
      Automerge from mysql-5.5 to mysql-trunk.

    modified:
      mysql-test/extra/rpl_tests/rpl_extra_col_master.test
 3731 Norvald H. Ryeng	2012-01-16
      Bug#11766143 59185: ASSERTION FAILED: (FIXED == 1), FILE
      ITEM_STRFUNC.CC, LINE 2760
      
      Problem: The server crashes when a subquery that is involved in a
      comparison requiring a character set conversion causes an error.
      
      During optimization, predicates are combined into multiple equality
      predicates by a call to optimize_cond(). As part of this,
      Item_equal::compare_const() is called to evaluate the comparison. Part
      of this evaluation is to set the comparison function by a call to
      Item_func_eq::set_cmp_func(), which calls
      Arg_comparator::set_cmp_func(). Since the character sets of the two
      arguments differ, it needs to call agg_item_set_converter() to set up
      a conversion. There, a new Item_func_conv_charset is constructed, and
      the constructor calls val_str() on its argument (the subquery). The
      subquery is evaluated and stores an error in the diagnostics
      area.
      
      Later, agg_item_set_converter() calls fix_fields() on the character
      set converter. Item_func::fix_fields() checks for thd->is_error() and
      misinterprets the error as if it occurred in
      Item_func::fix_length_and_dec(). This error is propagated by return
      values back to Arg_comparator::set_cmp_func(), which therefore skips
      setting the func attribute of the comparator.
      
      After the error occurs, Item_equal::compare_const() does not do any
      error checking before calling Item_func_eq::val_int(), where the crash
      occurs when Arg_comparator::compare() tries to call the function
      pointed to by the func attribute, which is a null pointer.
      
      Fix: Skip the call to Item_func_eq::val_int() in
      Item_equal::compare_const() if an error has been stored in the
      diagnostics area. The diagnostics area is checked and the error is
      caught in JOIN::optimize() right after the call to optimize_cond()
      returns.
      
      This patch also fixes bug #11765734.
     @ mysql-test/r/ctype_many.result
        Add test for bug #11766143.
     @ mysql-test/t/ctype_many.test
        Add test for bug #11766143.
     @ sql/item_cmpfunc.cc
        Skip condition evaluation if an error has occurred.
     @ sql/item_cmpfunc.h
        Add return value to Item_bool_func2::set_cmp_func().
     @ sql/sql_optimizer.cc
        Add error handling.

    modified:
      mysql-test/r/ctype_many.result
      mysql-test/t/ctype_many.test
      sql/item_cmpfunc.cc
      sql/item_cmpfunc.h
      sql/sql_optimizer.cc
=== modified file 'mysql-test/extra/rpl_tests/rpl_extra_col_master.test'
--- a/mysql-test/extra/rpl_tests/rpl_extra_col_master.test	2011-08-19 13:04:28 +0000
+++ b/mysql-test/extra/rpl_tests/rpl_extra_col_master.test	2012-01-16 10:15:36 +0000
@@ -59,6 +59,8 @@
 #VARCHAR(M)    
 #
 
+--let $_saved_conn= $CURRENT_CONNECTION
+
 let $binformat = `SHOW VARIABLES LIKE '%binlog_format%'`;
 --echo
 --echo ***********************************************************
@@ -1056,3 +1058,5 @@ SELECT * FROM t1;
 -- connection master
 DROP TABLE t1; 
 -- sync_slave_with_master
+
+--connection $_saved_conn

No bundle (reason: useless for push emails).