Fix bug #10886 - INSERT ... SELECT ... ON DUPLICATE KEY UPDATE produces bad results

Temporary field wasn't restored to default values after ON DUPLICATE KEY
 UPDATE event, which results in wrong data being inserted in new record.

mysql-test/r/insert_select.result

@@ -625,3 +625,12 @@ select SQL_BUFFER_RESULT * from t1 WHERE (SEQ = 1);
 ID	NO	SEQ
 1	1	1
 drop table t1;
+create table t1 (f1 int);
+create table t2 (ff1 int unique, ff2 int default 1);
+insert into t1 values (1),(1),(2);
+insert into t2(ff1) select f1 from t1 on duplicate key update ff2=ff2+1;
+select * from t2;
+ff1	ff2
+1	2
+2	1
+drop table t1, t2;

mysql-test/t/insert_select.test

@@ -166,3 +166,12 @@ INSERT INTO t1 (SEQ, NO) SELECT "1" AS SEQ, IF(MAX(NO) IS NULL, 0, MAX(NO)) + 1
 select SQL_BUFFER_RESULT * from t1 WHERE (SEQ = 1);
 drop table t1;
 
+#
+# Bug#10886 - Have to restore default values after update ON DUPLICATE KEY
+#
+create table t1 (f1 int);
+create table t2 (ff1 int unique, ff2 int default 1);
+insert into t1 values (1),(1),(2);
+insert into t2(ff1) select f1 from t1 on duplicate key update ff2=ff2+1;
+select * from t2;
+drop table t1, t2;

sql/sql_insert.cc

@@ -1625,11 +1625,22 @@ bool select_insert::send_data(List<Item> &values)
   store_values(values);
   error=thd->net.report_error || write_record(table,&info);
   thd->count_cuted_fields= CHECK_FIELD_IGNORE;
-  if (!error && table->next_number_field)       // Clear for next record
+
+  if (!error)
   {
-    table->next_number_field->reset();
-    if (! last_insert_id && thd->insert_id_used)
-      last_insert_id=thd->insert_id();
+    /*
+    Restore fields of the record since it is possible that they were
+    changed by ON DUPLICATE KEY UPDATE clause.
+    */
+    if (info.handle_duplicates == DUP_UPDATE)
+      restore_record(table, default_values);
+
+    if (table->next_number_field)       // Clear for next record
+    {
+      table->next_number_field->reset();
+      if (! last_insert_id && thd->insert_id_used)
+        last_insert_id=thd->insert_id();
+    }
   }
   DBUG_RETURN(error);
 }