from func_group.test after the patch for bug #27229 had been applied.
The memory corruption happened because in some rare cases the function
count_field_types underestimated the number of elements in
in the array param->items_to_copy.


sql/item_sum.cc:
  The return value of the Item_sum::update_used_tables method
  should not depend on the place of aggregation of the set 
  function for which the Item_sum object has been created.
sql/sql_select.cc:
  This is a fix for the memory corruption occurred in one of test cases
  from func_group.test after the patch for bug #27229 had been applied.
  The memory corruption happened because in some rare cases the function
  count_field_types underestimated the number of elements in
  in the array param->items_to_copy.
  
  Currently it's not guaranteed that after JOIN::prepare() the 
  used_tables attribute is calculated for all items. For example
  for the expression SUM(outer_ref)+1 used_tables() must return
  OUTER_REF_TABLE_BIT. Yet by the moment when the used_tables
  attribute is calculated in JOIN::prepare SUM(outer_ref) has
  not been substituted for Item_aggregate_ref yet.
  By this reason additional calls of the method update_used_tables
  are needed for some items passed as parameters to the function
  create_tmp_table.