From b8b5d8d87de0cb19a1fa108fa66bfe79b43af190 Mon Sep 17 00:00:00 2001
From: Aleksey Midenkov <midenok@gmail.com>
Date: Tue, 2 Jan 2018 15:28:50 +0300
Subject: [PATCH] MDEV-14828 Server crashes in JOIN::prepare / setup_fields on
 2nd execution of PS [fixes #437]

---
 mysql-test/suite/versioning/r/create.result | 12 ++++++++++++
 mysql-test/suite/versioning/t/create.test   |  6 ++++++
 sql/handler.cc                              |  6 +++---
 sql/sql_insert.cc                           |  3 ++-
 4 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/mysql-test/suite/versioning/r/create.result b/mysql-test/suite/versioning/r/create.result
index f806288d79f..6179ed81bca 100644
--- a/mysql-test/suite/versioning/r/create.result
+++ b/mysql-test/suite/versioning/r/create.result
@@ -399,5 +399,17 @@ t3	CREATE TABLE `t3` (
   `en` SYS_DATATYPE GENERATED ALWAYS AS ROW END INVISIBLE,
   PERIOD FOR SYSTEM_TIME (`st`, `en`)
 ) ENGINE=DEFAULT_ENGINE DEFAULT CHARSET=latin1 WITH SYSTEM VERSIONING
+# MDEV-14828 Server crashes in JOIN::prepare / setup_fields on 2nd execution of PS [#437]
+create or replace table t1 (x int) with system versioning;
+prepare bad from 'create or replace table t2 with system versioning as select * from t1';
+execute bad;
+execute bad;
+execute bad;
+execute bad;
+execute bad;
+execute bad;
+execute bad;
+execute bad;
+# bad is good.
 drop database test;
 create database test;
diff --git a/mysql-test/suite/versioning/t/create.test b/mysql-test/suite/versioning/t/create.test
index 25046e2e4b1..5d5f62c9368 100644
--- a/mysql-test/suite/versioning/t/create.test
+++ b/mysql-test/suite/versioning/t/create.test
@@ -361,5 +361,11 @@ as select x30, y, sys_trx_start, sys_trx_end, st, en from t1, t2;
 --replace_result $default_engine DEFAULT_ENGINE $sys_datatype SYS_DATATYPE $sys_datatype_null SYS_DATATYPE $sys_datatype_not_null SYS_DATATYPE $sys_datatype_default_null SYS_DATATYPE
 show create table t3;
 
+--echo # MDEV-14828 Server crashes in JOIN::prepare / setup_fields on 2nd execution of PS [#437]
+create or replace table t1 (x int) with system versioning;
+prepare bad from 'create or replace table t2 with system versioning as select * from t1';
+execute bad; execute bad; execute bad; execute bad; execute bad; execute bad; execute bad; execute bad;
+--echo # bad is good.
+
 drop database test;
 create database test;
diff --git a/sql/handler.cc b/sql/handler.cc
index 60909ba2299..abafaad2a59 100644
--- a/sql/handler.cc
+++ b/sql/handler.cc
@@ -7093,9 +7093,9 @@ bool Table_scope_and_contents_source_st::vers_fix_system_fields(
     DBUG_ASSERT(items);
     while (added--)
     {
-      items->push_back(
-        new (thd->mem_root) Item_default_value(thd, thd->lex->current_context()),
-        thd->mem_root);
+      Item_default_value *item= new (thd->mem_root)
+        Item_default_value(thd, thd->lex->current_context());
+      items->push_back(item, thd->mem_root);
     }
   }
 
diff --git a/sql/sql_insert.cc b/sql/sql_insert.cc
index b58a2ea8e24..5e4c51c36c6 100644
--- a/sql/sql_insert.cc
+++ b/sql/sql_insert.cc
@@ -4318,8 +4318,9 @@ TABLE *select_create::create_table_from_items(THD *thd,
 
 
 int
-select_create::prepare(List<Item> &values, SELECT_LEX_UNIT *u)
+select_create::prepare(List<Item> &_values, SELECT_LEX_UNIT *u)
 {
+  List<Item> values(_values, thd->mem_root);
   MYSQL_LOCK *extra_lock= NULL;
   DBUG_ENTER("select_create::prepare");