Fixed BUG#16474: SP crashed MySQL

  fix_fields() was not called for "order by" variables if the type was a
  "constant integer", and thus interpreted as a column index.
  However, a local variable is an expression and should not be interpreted
  as a column index. Instead it behaves just like when using a user variable
  for instance (i.e. it will not affect the ordering).

mysql-test/r/sp.result

@@ -4857,4 +4857,33 @@ i
 0
 drop table t3|
 drop procedure bug16887|
+drop procedure if exists bug16474_1|
+drop procedure if exists bug16474_2|
+delete from t1|
+insert into t1 values ('c', 2), ('b', 3), ('a', 1)|
+create procedure bug16474_1()
+begin
+declare x int;
+select id from t1 order by x;
+end|
+create procedure bug16474_2(x int)
+select id from t1 order by x|
+call bug16474_1()|
+id
+c
+b
+a
+call bug16474_2(1)|
+id
+c
+b
+a
+call bug16474_2(2)|
+id
+c
+b
+a
+drop procedure bug16474_1|
+drop procedure bug16474_2|
+delete from t1|
 drop table t1,t2;

mysql-test/t/sp.test

@@ -5717,6 +5717,37 @@ drop table t3|
 drop procedure bug16887|
 
 
+#
+# BUG#16474: SP crashed MySQL
+# (when using "order by localvar", where 'localvar' is just that.
+#
+--disable_warnings
+drop procedure if exists bug16474_1|
+drop procedure if exists bug16474_2|
+--enable_warnings
+
+delete from t1|
+insert into t1 values ('c', 2), ('b', 3), ('a', 1)|
+
+create procedure bug16474_1()
+begin
+  declare x int;
+
+  select id from t1 order by x;
+end|
+
+# This does NOT order by column index; variable is an expression.
+create procedure bug16474_2(x int)
+  select id from t1 order by x|
+
+call bug16474_1()|
+call bug16474_2(1)|
+call bug16474_2(2)|
+drop procedure bug16474_1|
+drop procedure bug16474_2|
+delete from t1|
+
+
 #
 # BUG#NNNN: New bug synopsis
 #

sql/sql_select.cc

@@ -12325,7 +12325,11 @@ find_order_in_list(THD *thd, Item **ref_pointer_array, TABLE_LIST *tables,
   Item **select_item; /* The corresponding item from the SELECT clause. */
   Field *from_field;  /* The corresponding field from the FROM clause. */
 
-  if (order_item->type() == Item::INT_ITEM)
+  /*
+    Local SP variables may be int but are expressions, not positions.
+    (And they must be fixed.)
+  */
+  if (order_item->type() == Item::INT_ITEM && !order_item->is_splocal())
   {						/* Order by position */
     uint count= (uint) order_item->val_int();
     if (!count || count > fields.elements)