Merge moonbone.local:/work/16716-bug-4.1-mysql

into moonbone.local:/work/16716-bug-4.1-opt-mysql

mysql-test/r/func_in.result

@@ -202,3 +202,24 @@ select count(*) from t1 where id not in (1,2);
 count(*)
 1
 drop table t1;
+create table t1 (f1 char(1), f2 int);
+insert into t1 values (1,0),('a',1),('z',2);
+select f1 from t1 where f1 in (1,'z');
+f1
+1
+z
+select f2 from t1 where f2 in (1,'z');
+f2
+0
+1
+select f1 from t1 where 'z' in (1,f1);
+f1
+z
+select * from t1 where 'z' in (f2,f1);
+f1	f2
+z	2
+select * from t1 where 1 in (f2,f1);
+f1	f2
+1	0
+a	1
+drop table t1;

mysql-test/r/multi_update.result

@@ -475,3 +475,8 @@ aclid bigint, index idx_acl(aclid)
 insert into t2 values(1,null);
 delete t2, t1 from t2 left join t1 on (t2.aclid=t1.aclid) where t2.refid='1';
 drop table t1, t2;
+create table t1(a int);
+create table t2(a int);
+delete from t1,t2 using t1,t2 where t1.a=(select a from t1);
+ERROR HY000: You can't specify target table 't1' for update in FROM clause
+drop table t1, t2;

mysql-test/t/func_in.test

@@ -109,4 +109,16 @@ select count(*) from t1 where id not in (1);
 select count(*) from t1 where id not in (1,2);
 drop table t1;
 
+#
+# Bug#18360 Incorrect type coercion in IN() results in false comparison
+#
+create table t1 (f1 char(1), f2 int);
+insert into t1 values (1,0),('a',1),('z',2);
+select f1 from t1 where f1 in (1,'z');
+select f2 from t1 where f2 in (1,'z');
+select f1 from t1 where 'z' in (1,f1);
+select * from t1 where 'z' in (f2,f1);
+select * from t1 where 1 in (f2,f1);
+drop table t1;
+
 # End of 4.1 tests

mysql-test/t/multi_update.test

@@ -448,4 +448,12 @@ insert into t2 values(1,null);
 delete t2, t1 from t2 left join t1 on (t2.aclid=t1.aclid) where t2.refid='1';
 drop table t1, t2;
 
+#
+# Bug#19225: unchecked error leads to server crash
+#
+create table t1(a int);
+create table t2(a int);
+--error 1093
+delete from t1,t2 using t1,t2 where t1.a=(select a from t1);
+drop table t1, t2;
 # End of 4.1 tests

sql/item_cmpfunc.cc

@@ -58,12 +58,45 @@ static void agg_result_type(Item_result *type, Item **items, uint nitems)
   }
 }
 
+
+/*
+  Aggregates result types from the array of items.
+
+  SYNOPSIS:
+    agg_cmp_type()
+    type   [out] the aggregated type
+    items        array of items to aggregate the type from
+    nitems       number of items in the array
+
+  DESCRIPTION
+    This function aggregates result types from the array of items. Found type
+    supposed to be used later for comparison of values of these items.
+    Aggregation itself is performed by the item_cmp_type() function.
+
+  NOTES
+    Aggregation rules:
+    If all items are constants the type will be aggregated from all items.
+    If there are some non-constant items then only types of non-constant
+    items will be used for aggregation.
+*/
 static void agg_cmp_type(Item_result *type, Item **items, uint nitems)
 {
   uint i;
   type[0]= items[0]->result_type();
-  for (i=1 ; i < nitems ; i++)
+  /* Reset to 0 on first occurence of non-const item. 1 otherwise */
+  bool is_const= items[0]->const_item();
+
+  for (i= 1 ; i < nitems ; i++)
+  {
+    if (!items[i]->const_item())
+    {
+      type[0]= is_const ? items[i]->result_type() :
+                 item_cmp_type(type[0], items[i]->result_type());
+      is_const= 0;
+    }
+    else if (is_const)
       type[0]= item_cmp_type(type[0], items[i]->result_type());
+  }
 }
 
 static void my_coll_agg_error(DTCollation &c1, DTCollation &c2,

sql/sql_parse.cc

@@ -3047,8 +3047,8 @@ mysql_execute_command(THD *thd)
       }
     }
 
-    if (!thd->is_fatal_error && (result= new multi_delete(thd,aux_tables,
-							  table_count)))
+    if (!res && !thd->is_fatal_error &&
+        (result= new multi_delete(thd,aux_tables, table_count)))
     {
       res= mysql_select(thd, &select_lex->ref_pointer_array,
 			select_lex->get_table_list(),