MDEV-13683: crash in Item_window_func::update_used_tables

Window definitions are resolved during fix fields. Updating used tables
for window functions must be done after all window functions have had a
chance to be resolved.

There was an additional problem with the implementation: expressions that
contained window functions never updated the expression's used tables.
To fix both these issues, make sure to call "update_used_tables" on all
items that contain window functions after we have passed through all
items.

sql/sql_select.cc

@@ -859,6 +859,22 @@ JOIN::prepare(TABLE_LIST *tables_init,
     }
   }
 
+  /*
+     After setting up window functions, we may have discovered additional
+     used tables from the PARTITION BY and ORDER BY list. Update all items
+     that contain window functions.
+  */
+  if (select_lex->have_window_funcs())
+  {
+    List_iterator_fast<Item> it(select_lex->item_list);
+    Item *item;
+    while ((item= it++))
+    {
+      if (item->with_window_func)
+        item->update_used_tables();
+    }
+  }
+
   With_clause *with_clause=select_lex->get_with_clause();
   if (with_clause && with_clause->prepare_unreferenced_elements(thd))
     DBUG_RETURN(1);

sql/sql_window.cc

@@ -297,13 +297,6 @@ setup_windows(THD *thd, Ref_ptr_array ref_pointer_array, TABLE_LIST *tables,
     }
   }
 
-  List_iterator_fast<Item_window_func> li(win_funcs);
-  Item_window_func *win_func_item;
-  while ((win_func_item= li++))
-  {
-    win_func_item->update_used_tables();
-  }
-
   DBUG_RETURN(0);
 }