From 0b7fa4c267cb7eee4a84a696170266f10397f266 Mon Sep 17 00:00:00 2001
From: Alexander Barkov <bar@mariadb.com>
Date: Fri, 29 Nov 2024 21:03:16 +0400
Subject: [PATCH] MDEV-31219 Assertion `fixed' failed in
 Item_func_hybrid_field_type / Frame_positional_cursor

add_special_frame_cursors() did not check the return
value offset_func->fix_fields(). It can return an error
if the data type does not support the operator "minus".
---
 mysql-test/main/gis.result |  8 ++++++++
 mysql-test/main/gis.test   | 10 ++++++++++
 sql/sql_window.cc          | 18 ++++++++++++------
 3 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/mysql-test/main/gis.result b/mysql-test/main/gis.result
index c4918809e4d..196758b1e94 100644
--- a/mysql-test/main/gis.result
+++ b/mysql-test/main/gis.result
@@ -5466,4 +5466,12 @@ CREATE TABLE t (f POINT, KEY(f));
 DELETE FROM t WHERE f NOT IN (NULL,'x');
 ERROR 22003: Cannot get geometry object from data you send to the GEOMETRY field
 DROP TABLE t;
+#
+# MDEV-31219 Assertion `fixed' failed in Item_func_hybrid_field_type / Frame_positional_cursor
+#
+CREATE TABLE t (a INT, b POINT);
+INSERT INTO t VALUES (1,POINT(0,0)),(2,POINT(0,0));
+SELECT NTH_VALUE(a,b) OVER () FROM t;
+ERROR HY000: Illegal parameter data types point and bigint for operation '-'
+DROP TABLE t;
 # End of 10.5 tests
diff --git a/mysql-test/main/gis.test b/mysql-test/main/gis.test
index 8e392e6b2f4..6dc932b4f8d 100644
--- a/mysql-test/main/gis.test
+++ b/mysql-test/main/gis.test
@@ -3472,4 +3472,14 @@ CREATE TABLE t (f POINT, KEY(f));
 DELETE FROM t WHERE f NOT IN (NULL,'x');
 DROP TABLE t;
 
+--echo #
+--echo # MDEV-31219 Assertion `fixed' failed in Item_func_hybrid_field_type / Frame_positional_cursor
+--echo #
+
+CREATE TABLE t (a INT, b POINT);
+INSERT INTO t VALUES (1,POINT(0,0)),(2,POINT(0,0));
+--error ER_ILLEGAL_PARAMETER_DATA_TYPES2_FOR_OPERATION
+SELECT NTH_VALUE(a,b) OVER () FROM t;
+DROP TABLE t;
+
 --echo # End of 10.5 tests
diff --git a/sql/sql_window.cc b/sql/sql_window.cc
index fd8e188a76b..565a1b964b5 100644
--- a/sql/sql_window.cc
+++ b/sql/sql_window.cc
@@ -2528,7 +2528,7 @@ Frame_cursor *get_frame_cursor(THD *thd, Window_spec *spec, bool is_top_bound)
 }
 
 static
-void add_special_frame_cursors(THD *thd, Cursor_manager *cursor_manager,
+bool add_special_frame_cursors(THD *thd, Cursor_manager *cursor_manager,
                                Item_window_func *window_func)
 {
   Window_spec *spec= window_func->window_spec;
@@ -2615,7 +2615,9 @@ void add_special_frame_cursors(THD *thd, Cursor_manager *cursor_manager,
       Item *offset_func= new (thd->mem_root)
                               Item_func_minus(thd, item_sum->get_arg(1),
                                               int_item);
-      offset_func->fix_fields(thd, &offset_func);
+      if (offset_func->fix_fields(thd, &offset_func))
+        return true;
+
       fc= new Frame_positional_cursor(*top_bound,
                                       *top_bound, *bottom_bound,
                                       *offset_func, false);
@@ -2648,6 +2650,7 @@ void add_special_frame_cursors(THD *thd, Cursor_manager *cursor_manager,
       fc->add_sum_func(item_sum);
       cursor_manager->add_cursor(fc);
   }
+  return false;
 }
 
 
@@ -2675,7 +2678,7 @@ static bool is_computed_with_remove(Item_sum::Sumfunctype sum_func)
    If the window functions share the same frame specification,
    those window functions will be registered to the same cursor.
 */
-void get_window_functions_required_cursors(
+bool get_window_functions_required_cursors(
     THD *thd,
     List<Item_window_func>& window_functions,
     List<Cursor_manager> *cursor_managers)
@@ -2726,7 +2729,8 @@ void get_window_functions_required_cursors(
     if (item_win_func->is_frame_prohibited() ||
         item_win_func->requires_special_cursors())
     {
-      add_special_frame_cursors(thd, cursor_manager, item_win_func);
+      if (add_special_frame_cursors(thd, cursor_manager, item_win_func))
+        return true;
       cursor_managers->push_back(cursor_manager);
       continue;
     }
@@ -2760,6 +2764,7 @@ void get_window_functions_required_cursors(
     }
     cursor_managers->push_back(cursor_manager);
   }
+  return false;
 }
 
 /**
@@ -3034,8 +3039,9 @@ bool Window_func_runner::exec(THD *thd, TABLE *tbl, SORT_INFO *filesort_result)
   it.rewind();
 
   List<Cursor_manager> cursor_managers;
-  get_window_functions_required_cursors(thd, window_functions,
-                                        &cursor_managers);
+  if (get_window_functions_required_cursors(thd, window_functions,
+                                            &cursor_managers))
+    return true;
 
   /* Go through the sorted array and compute the window function */
   bool is_error= compute_window_func(thd,