Bug #26815:

When creating a temporary table the concise column type
 of a string expression is decided based on its length:
 - if its length is under 512 it is stored as either 
   varchar or char.
 - otherwise it is stored as a BLOB.
 
 There is a flag (convert_blob_length) to create_tmp_field 
 that, when >0 allows to force creation of a varchar if the
 max blob length is under convert_blob_length.
 However it must be verified that convert_blob_length 
 (settable through a SQL option in some cases) is 
 under the maximum that can be stored in a varchar column.
 While performing that check for expressions in 
 create_tmp_field_from_item the max length of the blob was
 used instead. This causes blob columns to be created in the
 heap temp table used by GROUP_CONCAT (where blobs must not
 be created in the temp table because of the constant 
 convert_blob_length that is passed to create_tmp_field() ).
 And since these blob columns are not expected in that place
 we get wrong results.
 Fixed by checking that the value of the flag variable is 
 in the limits that fit into VARCHAR instead of the max length
 of the blob column.

sql/sql_select.cc

@@ -8805,8 +8805,7 @@ static Field *create_tmp_field_from_item(THD *thd, Item *item, TABLE *table,
       2-byte lenght. 
     */
     else if (item->max_length/item->collation.collation->mbmaxlen > 255 &&
-             item->max_length/item->collation.collation->mbmaxlen < UINT_MAX16
-             && convert_blob_length)
+             convert_blob_length < UINT_MAX16 && convert_blob_length)
       new_field= new Field_varstring(convert_blob_length, maybe_null,
                                      item->name, table,
                                      item->collation.collation);