From 5e051bfa15d201228b103d7f536436a61cde8707 Mon Sep 17 00:00:00 2001
From: Alexander Barkov <bar@mariadb.org>
Date: Wed, 21 Dec 2016 15:39:45 +0400
Subject: [PATCH] MDEV-10386 Assertion `fixed == 1' failed in virtual String*
 Item_func_conv_charset::val_str(String*)

The patch b96c196f1cd5d77e524cbf952539bdd33c65ffc1 added a new call for
safe_charset_converter() without a corresponding fix_fields().
In case of a sub-query the created Item remained in non-fixed state.
The problem did not show up with literal derived expressions, only
subselects were affected. This patch adds a corresponding fix_fields()
to the previously added safe_charset_converter().
---
 mysql-test/r/subselect.result             | 11 +++++++++++
 mysql-test/r/subselect_no_mat.result      | 11 +++++++++++
 mysql-test/r/subselect_no_opts.result     | 11 +++++++++++
 mysql-test/r/subselect_no_scache.result   | 11 +++++++++++
 mysql-test/r/subselect_no_semijoin.result | 11 +++++++++++
 mysql-test/t/subselect.test               | 10 ++++++++++
 sql/item.cc                               |  3 ++-
 7 files changed, 67 insertions(+), 1 deletion(-)

diff --git a/mysql-test/r/subselect.result b/mysql-test/r/subselect.result
index 0a599a64f80..789cfe2fdca 100644
--- a/mysql-test/r/subselect.result
+++ b/mysql-test/r/subselect.result
@@ -7105,3 +7105,14 @@ group by round((select 1 from t1 limit 1));
 round((select 1 from t1 limit 1))
 1
 drop table t1;
+#
+# MDEV-10386 Assertion `fixed == 1' failed in virtual String* Item_func_conv_charset::val_str(String*)
+#
+CREATE TABLE t1 (f1 CHAR(3) CHARACTER SET utf8 NULL, f2 CHAR(3) CHARACTER SET latin1 NULL);
+INSERT INTO t1 VALUES ('foo','bar');
+SELECT * FROM t1 WHERE f2 >= SOME ( SELECT f1 FROM t1 );
+f1	f2
+SELECT * FROM t1 WHERE f2 <= SOME ( SELECT f1 FROM t1 );
+f1	f2
+foo	bar
+DROP TABLE t1;
diff --git a/mysql-test/r/subselect_no_mat.result b/mysql-test/r/subselect_no_mat.result
index b819b1e4ef9..c729c17f94f 100644
--- a/mysql-test/r/subselect_no_mat.result
+++ b/mysql-test/r/subselect_no_mat.result
@@ -7102,6 +7102,17 @@ group by round((select 1 from t1 limit 1));
 round((select 1 from t1 limit 1))
 1
 drop table t1;
+#
+# MDEV-10386 Assertion `fixed == 1' failed in virtual String* Item_func_conv_charset::val_str(String*)
+#
+CREATE TABLE t1 (f1 CHAR(3) CHARACTER SET utf8 NULL, f2 CHAR(3) CHARACTER SET latin1 NULL);
+INSERT INTO t1 VALUES ('foo','bar');
+SELECT * FROM t1 WHERE f2 >= SOME ( SELECT f1 FROM t1 );
+f1	f2
+SELECT * FROM t1 WHERE f2 <= SOME ( SELECT f1 FROM t1 );
+f1	f2
+foo	bar
+DROP TABLE t1;
 set optimizer_switch=default;
 select @@optimizer_switch like '%materialization=on%';
 @@optimizer_switch like '%materialization=on%'
diff --git a/mysql-test/r/subselect_no_opts.result b/mysql-test/r/subselect_no_opts.result
index e1001a51658..dc308ea77e5 100644
--- a/mysql-test/r/subselect_no_opts.result
+++ b/mysql-test/r/subselect_no_opts.result
@@ -7100,4 +7100,15 @@ group by round((select 1 from t1 limit 1));
 round((select 1 from t1 limit 1))
 1
 drop table t1;
+#
+# MDEV-10386 Assertion `fixed == 1' failed in virtual String* Item_func_conv_charset::val_str(String*)
+#
+CREATE TABLE t1 (f1 CHAR(3) CHARACTER SET utf8 NULL, f2 CHAR(3) CHARACTER SET latin1 NULL);
+INSERT INTO t1 VALUES ('foo','bar');
+SELECT * FROM t1 WHERE f2 >= SOME ( SELECT f1 FROM t1 );
+f1	f2
+SELECT * FROM t1 WHERE f2 <= SOME ( SELECT f1 FROM t1 );
+f1	f2
+foo	bar
+DROP TABLE t1;
 set @optimizer_switch_for_subselect_test=null;
diff --git a/mysql-test/r/subselect_no_scache.result b/mysql-test/r/subselect_no_scache.result
index e175e7e0072..e7c85c10f2d 100644
--- a/mysql-test/r/subselect_no_scache.result
+++ b/mysql-test/r/subselect_no_scache.result
@@ -7111,6 +7111,17 @@ group by round((select 1 from t1 limit 1));
 round((select 1 from t1 limit 1))
 1
 drop table t1;
+#
+# MDEV-10386 Assertion `fixed == 1' failed in virtual String* Item_func_conv_charset::val_str(String*)
+#
+CREATE TABLE t1 (f1 CHAR(3) CHARACTER SET utf8 NULL, f2 CHAR(3) CHARACTER SET latin1 NULL);
+INSERT INTO t1 VALUES ('foo','bar');
+SELECT * FROM t1 WHERE f2 >= SOME ( SELECT f1 FROM t1 );
+f1	f2
+SELECT * FROM t1 WHERE f2 <= SOME ( SELECT f1 FROM t1 );
+f1	f2
+foo	bar
+DROP TABLE t1;
 set optimizer_switch=default;
 select @@optimizer_switch like '%subquery_cache=on%';
 @@optimizer_switch like '%subquery_cache=on%'
diff --git a/mysql-test/r/subselect_no_semijoin.result b/mysql-test/r/subselect_no_semijoin.result
index a211d498762..b6261f05098 100644
--- a/mysql-test/r/subselect_no_semijoin.result
+++ b/mysql-test/r/subselect_no_semijoin.result
@@ -7100,5 +7100,16 @@ group by round((select 1 from t1 limit 1));
 round((select 1 from t1 limit 1))
 1
 drop table t1;
+#
+# MDEV-10386 Assertion `fixed == 1' failed in virtual String* Item_func_conv_charset::val_str(String*)
+#
+CREATE TABLE t1 (f1 CHAR(3) CHARACTER SET utf8 NULL, f2 CHAR(3) CHARACTER SET latin1 NULL);
+INSERT INTO t1 VALUES ('foo','bar');
+SELECT * FROM t1 WHERE f2 >= SOME ( SELECT f1 FROM t1 );
+f1	f2
+SELECT * FROM t1 WHERE f2 <= SOME ( SELECT f1 FROM t1 );
+f1	f2
+foo	bar
+DROP TABLE t1;
 set @optimizer_switch_for_subselect_test=null;
 set @join_cache_level_for_subselect_test=NULL;
diff --git a/mysql-test/t/subselect.test b/mysql-test/t/subselect.test
index 77b6c6c5582..a8ad3ba52a5 100644
--- a/mysql-test/t/subselect.test
+++ b/mysql-test/t/subselect.test
@@ -5988,3 +5988,13 @@ from t1
 group by round((select 1 from t1 limit 1));
 
 drop table t1;
+
+--echo #
+--echo # MDEV-10386 Assertion `fixed == 1' failed in virtual String* Item_func_conv_charset::val_str(String*)
+--echo #
+
+CREATE TABLE t1 (f1 CHAR(3) CHARACTER SET utf8 NULL, f2 CHAR(3) CHARACTER SET latin1 NULL);
+INSERT INTO t1 VALUES ('foo','bar');
+SELECT * FROM t1 WHERE f2 >= SOME ( SELECT f1 FROM t1 );
+SELECT * FROM t1 WHERE f2 <= SOME ( SELECT f1 FROM t1 );
+DROP TABLE t1;
diff --git a/sql/item.cc b/sql/item.cc
index fc9eb31bf5b..1df91dc2534 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -1164,7 +1164,8 @@ Item *Item_cache::safe_charset_converter(CHARSET_INFO *tocs)
   if (conv == example)
     return this;
   Item_cache *cache;
-  if (!conv || !(cache= new Item_cache_str(conv)))
+  if (!conv || conv->fix_fields(current_thd, (Item **) NULL) ||
+      !(cache= new Item_cache_str(conv)))
     return NULL; // Safe conversion is not possible, or OEM
   cache->setup(conv);
   cache->fixed= false; // Make Item::fix_fields() happy