This is a backport from 5.1.32 into 5.1.31sp1.

The original fix was done by Ramil Kalimullin on 2009-02-05
All comments are copied from the original fix:


Fix for bug#42014: Crash, name_const with collate

Problem: some queries using NAME_CONST(.. COLLATE ...)
lead to server crash due to failed type cast.

Fix: return the underlying item's type in case of
NAME_CONST(.. COLLATE ...) to avoid wrong casting.


mysql-test/r/func_misc.result:
  Fix for bug#42014: Crash, name_const with coll
    - test result.
mysql-test/t/func_misc.test:
  Fix for bug#42014: Crash, name_const with coll
    - test case.
sql/item.cc:
  Fix for bug#42014: Crash, name_const with coll
    - in case of NAME_CONST('name', 'value' COLLATE collation)
  Item_name_const::type() returns type of 'value' argument 
  to avoid wrong type casting of the Item_name_const items.

mysql-test/r/func_misc.result

@@ -324,6 +324,11 @@ select @my_uuid_date - @my_uuid_synthetic;
 @my_uuid_date - @my_uuid_synthetic
 0
 set @@session.time_zone=@save_tz;
+CREATE TABLE t1 (a DATE);
+SELECT * FROM t1 WHERE a = NAME_CONST('reportDate',
+_binary'2009-01-09' COLLATE 'binary');
+a
+DROP TABLE t1;
 End of 5.0 tests
 select connection_id() > 0;
 connection_id() > 0

mysql-test/t/func_misc.test

@@ -445,6 +445,15 @@ select @my_uuid_date - @my_uuid_synthetic;
 
 set @@session.time_zone=@save_tz;
 
+
+#
+# Bug#42014: Crash, name_const with collate
+#
+CREATE TABLE t1 (a DATE);
+SELECT * FROM t1 WHERE a = NAME_CONST('reportDate',
+  _binary'2009-01-09' COLLATE 'binary');
+DROP TABLE t1;
+
 --echo End of 5.0 tests
 
 #

sql/item.cc

@@ -1274,13 +1274,26 @@ Item::Type Item_name_const::type() const
     valid_args guarantees value_item->basic_const_item(); if type is
     FUNC_ITEM, then we have a fudged item_func_neg() on our hands
     and return the underlying type.
+    For Item_func_set_collation()
+    e.g. NAME_CONST('name', 'value' COLLATE collation) we return its
+    'value' argument type. 
   */
-  return valid_args ?
-             (((value_item->type() == FUNC_ITEM) &&
-               (((Item_func *) value_item)->functype() == Item_func::NEG_FUNC)) ?
-             ((Item_func *) value_item)->key_item()->type() :
-             value_item->type()) :
-           NULL_ITEM;
+  if (!valid_args)
+    return NULL_ITEM;
+  Item::Type value_type= value_item->type();
+  if (value_type == FUNC_ITEM)
+  {
+    /* 
+      The second argument of NAME_CONST('name', 'value') must be 
+      a simple constant item or a NEG_FUNC/COLLATE_FUNC.
+    */
+    DBUG_ASSERT(((Item_func *) value_item)->functype() == 
+                Item_func::NEG_FUNC ||
+                ((Item_func *) value_item)->functype() == 
+                Item_func::COLLATE_FUNC);
+    return ((Item_func *) value_item)->key_item()->type();            
+  }
+  return value_type;
 }