Bug #19815702 TIS620: CRASH WITH MULTI TABLE DELETE

Description:
  Using correct length when moving to next field in cmp_ref. The store
length already includes the length bytes of blobs, which is already considered
earlier for blob types.
	Approved by Mattias, Jimmy [rb-7088] 

mysql-test/suite/innodb/r/multi_delete.result

+create table t1 (a int,b varchar(100) ,d blob,primary key (a,d(10), b(10))) engine=innodb;
+insert into t1 values (1,'e','a'),(5,'f','5'), (3,'a','b');
+create table t2 (a int) engine=innodb;
+insert into t2() values(4),(5);
+delete t1 from t1, t2 where t1.a;
+show create table t1;
+Table	Create Table
+t1	CREATE TABLE `t1` (
+  `a` int(11) NOT NULL DEFAULT '0',
+  `b` varchar(100) NOT NULL DEFAULT '',
+  `d` blob NOT NULL,
+  PRIMARY KEY (`a`,`d`(10),`b`(10))
+) ENGINE=InnoDB DEFAULT CHARSET=latin1
+drop table t1, t2;

mysql-test/suite/innodb/t/multi_delete.test

+--source include/have_innodb.inc
+create table t1 (a int,b varchar(100) ,d blob,primary key (a,d(10), b(10))) engine=innodb;
+insert into t1 values (1,'e','a'),(5,'f','5'), (3,'a','b');
+create table t2 (a int) engine=innodb;
+insert into t2() values(4),(5);
+delete t1 from t1, t2 where t1.a;
+show create table t1;
+drop table t1, t2;

storage/innobase/handler/ha_innodb.cc

@@ -10405,10 +10405,8 @@ ha_innobase::cmp_ref(
 			len1 = innobase_read_from_2_little_endian(ref1);
 			len2 = innobase_read_from_2_little_endian(ref2);
 
-			ref1 += 2;
-			ref2 += 2;
-			result = ((Field_blob*)field)->cmp( ref1, len1,
-                                                            ref2, len2);
+			result = ((Field_blob*)field)->cmp(ref1 + 2, len1,
+							   ref2 + 2, len2);
 		} else {
 			result = field->key_cmp(ref1, ref2);
 		}