Merge aelkin@bk-internal.mysql.com:/home/bk/mysql-5.0

into  mysql.com:/usr_rh9/home/elkin.rh9/MySQL/Merge/5.0-bug19136

mysql-test/r/rpl_user_variables.result

@@ -106,5 +106,6 @@ slave-bin.000001	#	User var	2	#	@`a`=5
 slave-bin.000001	#	Query	1	#	use `test`; insert into t1 values (@a),(@a)
 slave-bin.000001	#	User var	2	#	@`a`=NULL
 slave-bin.000001	#	Query	1	#	use `test`; insert into t1 values (@a),(@a),(@a*5)
+insert into t1 select * FROM (select @var1 union  select @var2) AS t2;
 drop table t1;
 stop slave;

mysql-test/t/rpl_user_variables.test

@@ -48,9 +48,15 @@ sync_with_master;
 select * from t1;
 --replace_column 2 # 5 #
 show binlog events from 98;
+#
+# BUG19136: Crashing log-bin and uninitialized user variables in a derived table
+# just to check nothing bad happens anymore
+#
 connection master;
+insert into t1 select * FROM (select @var1 union  select @var2) AS t2;
 drop table t1;
 save_master_pos;
+
 connection slave;
 sync_with_master;
 stop slave;

sql/item_func.cc

@@ -3946,14 +3946,24 @@ int get_var_with_binlog(THD *thd, enum_sql_command sql_command,
       sql_set_variables(), we could instead manually call check() and update();
       this would save memory and time; but calling sql_set_variables() makes
       one unique place to maintain (sql_set_variables()). 
+
+      Manipulation with lex is necessary since free_underlaid_joins
+      is going to release memory belonging to the main query.
     */
 
     List<set_var_base> tmp_var_list;
+    LEX *sav_lex= thd->lex, lex_tmp;
+    thd->lex= &lex_tmp;
+    lex_start(thd, NULL, 0);
     tmp_var_list.push_back(new set_var_user(new Item_func_set_user_var(name,
                                                                        new Item_null())));
     /* Create the variable */
     if (sql_set_variables(thd, &tmp_var_list))
+    {
+      thd->lex= sav_lex;
       goto err;
+    }
+    thd->lex= sav_lex;
     if (!(var_entry= get_variable(&thd->user_vars, name, 0)))
       goto err;
   }