Merge pilot.blaudden:/home/msvensson/mysql/bug25197/my50-bug25197

into  pilot.blaudden:/home/msvensson/mysql/mysql-5.0-maint

mysql-test/r/func_str.result

@@ -1940,4 +1940,18 @@ abcxx
 select lpad('abc', cast(5 as unsigned integer), 'x');
 lpad('abc', cast(5 as unsigned integer), 'x')
 xxabc
+DROP TABLE IF EXISTS t1;
+CREATE TABLE `t1` (
+`id` varchar(20) NOT NULL,
+`tire` tinyint(3) unsigned NOT NULL,
+PRIMARY KEY (`id`)
+);
+INSERT INTO `t1` (`id`, `tire`) VALUES ('A', 0), ('B', 1),('C', 2);
+SELECT REPEAT( '#', tire ) AS A,
+REPEAT( '#', tire % 999 ) AS B, tire FROM `t1`;
+A	B	tire
+		0
+#	#	1
+##	##	2
+DROP TABLE t1;
 End of 5.0 tests

mysql-test/t/func_str.test

@@ -1008,4 +1008,26 @@ select repeat('a', cast(2 as unsigned int));
 select rpad('abc', cast(5 as unsigned integer), 'x');
 select lpad('abc', cast(5 as unsigned integer), 'x');
 
+
+#
+# Bug #25197 :repeat function returns null when using table field directly as count
+#
+
+--disable_warnings
+DROP TABLE IF EXISTS t1;
+--enable_warnings
+
+CREATE TABLE `t1` (
+  `id` varchar(20) NOT NULL,
+  `tire` tinyint(3) unsigned NOT NULL,
+  PRIMARY KEY (`id`)
+);
+
+INSERT INTO `t1` (`id`, `tire`) VALUES ('A', 0), ('B', 1),('C', 2);
+
+SELECT REPEAT( '#', tire ) AS A,
+       REPEAT( '#', tire % 999 ) AS B, tire FROM `t1`;
+
+DROP TABLE t1;
+
 --echo End of 5.0 tests

sql/item_strfunc.cc

@@ -2251,8 +2251,10 @@ String *Item_func_repeat::val_str(String *str)
   if (args[0]->null_value || args[1]->null_value)
     goto err;				// string and/or delim are null
   null_value= 0;
-  if ((count <= 0) && !args[1]->unsigned_flag)	// For nicer SQL code
+
+  if (count == 0 || count < 0 && !args[1]->unsigned_flag)
     return &my_empty_string;
+
   /* Assumes that the maximum length of a String is < INT_MAX32. */
   /* Bounds check on count:  If this is triggered, we will error. */
   if ((ulonglong) count > INT_MAX32)