diff --git a/mysql-test/r/error_simulation.result b/mysql-test/r/error_simulation.result
new file mode 100644
index 00000000000..805e8fabbd8
--- /dev/null
+++ b/mysql-test/r/error_simulation.result
@@ -0,0 +1,19 @@
+DROP TABLE IF EXISTS t1;
+Warnings:
+Note	1051	Unknown table 't1'
+CREATE TABLE t1 (
+a varchar(32) character set utf8 collate utf8_bin NOT NULL,
+b varchar(32) character set utf8 collate utf8_bin NOT NULL )
+ENGINE=MyISAM DEFAULT CHARSET=utf8;
+INSERT INTO t1 VALUES
+('AAAAAAAAAA','AAAAAAAAAA'), ('AAAAAAAAAB','AAAAAAAAAB '),
+('AAAAAAAAAB','AAAAAAAAAB'), ('AAAAAAAAAC','AAAAAAAAAC'),
+('AAAAAAAAAD','AAAAAAAAAD'), ('AAAAAAAAAE','AAAAAAAAAE'),
+('AAAAAAAAAF','AAAAAAAAAF'), ('AAAAAAAAAG','AAAAAAAAAG'),
+('AAAAAAAAAH','AAAAAAAAAH'), ('AAAAAAAAAI','AAAAAAAAAI'),
+('AAAAAAAAAJ','AAAAAAAAAJ'), ('AAAAAAAAAK','AAAAAAAAAK');
+set tmp_table_size=1024;
+SELECT MAX(a) FROM t1 GROUP BY a,b;
+ERROR 23000: Can't write; duplicate key in table ''
+set tmp_table_size=default;
+DROP TABLE t1;
diff --git a/mysql-test/t/error_simulation-master.opt b/mysql-test/t/error_simulation-master.opt
new file mode 100644
index 00000000000..edb77cfa85e
--- /dev/null
+++ b/mysql-test/t/error_simulation-master.opt
@@ -0,0 +1 @@
+--loose-debug=d,raise_error
diff --git a/mysql-test/t/error_simulation.test b/mysql-test/t/error_simulation.test
new file mode 100644
index 00000000000..8c044224b8a
--- /dev/null
+++ b/mysql-test/t/error_simulation.test
@@ -0,0 +1,29 @@
+-- source include/have_debug.inc
+
+#
+# Bug #28499: crash for grouping query when tmp_table_size is too small
+#
+
+DROP TABLE IF EXISTS t1;
+
+CREATE TABLE t1 (
+  a varchar(32) character set utf8 collate utf8_bin NOT NULL,
+  b varchar(32) character set utf8 collate utf8_bin NOT NULL )
+ENGINE=MyISAM DEFAULT CHARSET=utf8;
+
+INSERT INTO t1 VALUES
+  ('AAAAAAAAAA','AAAAAAAAAA'), ('AAAAAAAAAB','AAAAAAAAAB '),
+  ('AAAAAAAAAB','AAAAAAAAAB'), ('AAAAAAAAAC','AAAAAAAAAC'),
+  ('AAAAAAAAAD','AAAAAAAAAD'), ('AAAAAAAAAE','AAAAAAAAAE'),
+  ('AAAAAAAAAF','AAAAAAAAAF'), ('AAAAAAAAAG','AAAAAAAAAG'),
+  ('AAAAAAAAAH','AAAAAAAAAH'), ('AAAAAAAAAI','AAAAAAAAAI'),
+  ('AAAAAAAAAJ','AAAAAAAAAJ'), ('AAAAAAAAAK','AAAAAAAAAK');
+
+set tmp_table_size=1024;
+
+--error ER_DUP_KEY
+SELECT MAX(a) FROM t1 GROUP BY a,b;
+
+set tmp_table_size=default;
+
+DROP TABLE t1;
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 41688794721..ece37708370 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -10147,7 +10147,9 @@ bool create_myisam_from_heap(THD *thd, TABLE *table, TMP_TABLE_PARAM *param,
   /* copy all old rows */
   while (!table->file->rnd_next(new_table.record[1]))
   {
-    if ((write_err=new_table.file->write_row(new_table.record[1])))
+    write_err=new_table.file->write_row(new_table.record[1]);
+    DBUG_EXECUTE_IF("raise_error", write_err= HA_ERR_FOUND_DUPP_KEY ;);
+    if (write_err)
       goto err;
   }
   /* copy row that filled HEAP table */
@@ -10174,7 +10176,7 @@ bool create_myisam_from_heap(THD *thd, TABLE *table, TMP_TABLE_PARAM *param,
 
  err:
   DBUG_PRINT("error",("Got error: %d",write_err));
-  table->file->print_error(error,MYF(0));	// Give table is full error
+  table->file->print_error(write_err, MYF(0));	// Give table is full error
   (void) table->file->ha_rnd_end();
   (void) new_table.file->close();
  err1:
@@ -10182,6 +10184,7 @@ bool create_myisam_from_heap(THD *thd, TABLE *table, TMP_TABLE_PARAM *param,
   delete new_table.file;
  err2:
   thd->proc_info=save_proc_info;
+  table->mem_root= new_table.mem_root;
   DBUG_RETURN(1);
 }