MDEV-14388 Server crashes in handle_select / val_uint in ORACLE mode

mysql-test/suite/compat/oracle/r/sp-cursor-rowtype.result

@@ -1359,3 +1359,36 @@ t2	CREATE TABLE "t2" (
   "b" varchar(3) DEFAULT NULL,
   "c" time DEFAULT NULL
 )
+#
+# MDEV-14388 Server crashes in handle_select / val_uint in ORACLE mode
+#
+CREATE TABLE t1 (id INT);
+INSERT INTO t1 VALUES (0),(1),(2),(3);
+CREATE FUNCTION f1() RETURN INT is
+BEGIN
+FOR v1 in (SELECT id FROM t1)
+LOOP
+NULL;
+END LOOP;
+RETURN 1;
+END;
+$$
+SELECT f1();
+f1()
+1
+DROP FUNCTION f1;
+DROP TABLE t1;
+CREATE TABLE t1 (id INT);
+INSERT INTO t1 VALUES (1),(2),(3),(4);
+CREATE FUNCTION f1() RETURN INT IS
+CURSOR cur IS SELECT id FROM t1;
+rec cur%ROWTYPE;
+BEGIN
+RETURN 1;
+END;
+$$
+SELECT f1();
+f1()
+1
+DROP FUNCTION f1;
+DROP TABLE t1;

mysql-test/suite/compat/oracle/t/sp-cursor-rowtype.test

@@ -1444,3 +1444,39 @@ BEGIN
 END;
 $$
 DELIMITER ;$$
+
+--echo #
+--echo # MDEV-14388 Server crashes in handle_select / val_uint in ORACLE mode
+--echo #
+
+CREATE TABLE t1 (id INT);
+INSERT INTO t1 VALUES (0),(1),(2),(3);
+DELIMITER $$;
+CREATE FUNCTION f1() RETURN INT is
+BEGIN
+  FOR v1 in (SELECT id FROM t1)
+  LOOP
+    NULL;
+  END LOOP;
+  RETURN 1;
+END;
+$$
+DELIMITER ;$$
+SELECT f1();
+DROP FUNCTION f1;
+DROP TABLE t1;
+
+CREATE TABLE t1 (id INT);
+INSERT INTO t1 VALUES (1),(2),(3),(4);
+DELIMITER $$;
+CREATE FUNCTION f1() RETURN INT IS
+  CURSOR cur IS SELECT id FROM t1;
+  rec cur%ROWTYPE;
+BEGIN
+  RETURN 1;
+END;
+$$
+DELIMITER ;$$
+SELECT f1();
+DROP FUNCTION f1;
+DROP TABLE t1;

sql/sp_rcontext.cc

@@ -802,7 +802,13 @@ int sp_cursor::open_view_structure_only(THD *thd)
   if (!(thd->lex->limit_rows_examined= new (thd->mem_root) Item_uint(thd, 0)))
     return -1;
   thd->no_errors= true; // Suppress ER_QUERY_EXCEEDED_ROWS_EXAMINED_LIMIT
+  DBUG_ASSERT(!thd->killed);
   res= open(thd);
+  /*
+    The query possibly exited on LIMIT ROWS EXAMINED and set thd->killed.
+    Reset it now.
+  */
+  thd->reset_killed();
   thd->no_errors= thd_no_errors_save;
   thd->lex->limit_rows_examined= limit_rows_examined;
   return res;