Fixed...

BUG#6642: Stored procedure crash if expression with set function
  BUG#7013: Stored procedure crash if group by ... with rollup
  BUG#7743: 'Lost connection to MySQL server during query' on Stored Procedure
  BUG#7992: SELECT .. INTO variable .. within Stored Procedure crashes
            the server
  BUG#8116: calling simple stored procedure twice in a row results
            in server crash

Rolling back the item change list after each substatement in a procedure
fixed the failing assert().


mysql-test/r/sp.result:
  New test cases for BUG#6642, 7013, 7743, 7992 and 8116.
mysql-test/t/sp.test:
  New test cases for BUG#6642, 7013, 7743, 7992 and 8116.
sql/sp_head.cc:
  Roll back the item change list after each sub statement.

mysql-test/r/sp.result

@@ -2069,6 +2069,97 @@ call bug8540()|
 y	z
 1	1
 drop procedure bug8540|
+drop table if exists t3|
+create table t3 (s1 int)|
+drop procedure if exists bug6642|
+create procedure bug6642()
+select abs(count(s1)) from t3|
+call bug6642()|
+abs(count(s1))
+0
+call bug6642()|
+abs(count(s1))
+0
+drop procedure bug6642|
+insert into t3 values (0),(1)|
+drop procedure if exists bug7013|
+create procedure bug7013()
+select s1,count(s1) from t3 group by s1 with rollup|
+call bug7013()|
+s1	count(s1)
+0	1
+1	1
+NULL	2
+call bug7013()|
+s1	count(s1)
+0	1
+1	1
+NULL	2
+drop procedure bug7013|
+drop table if exists t4;
+--enable_warnings|
+create table t4 (
+a mediumint(8) unsigned not null auto_increment,
+b smallint(5) unsigned not null,
+c char(32) not null,
+primary key  (a)
+) engine=myisam default charset=latin1|
+insert into t4 values (1, 2, 'oneword')|
+insert into t4 values (2, 2, 'anotherword')|
+drop procedure if exists bug7743|
+create procedure bug7743 ( searchstring char(28) )
+begin
+declare var mediumint(8) unsigned;
+select a into var from t4 where b = 2 and c = binary searchstring limit 1;
+select var;
+end|
+call bug7743("oneword")|
+var
+1
+call bug7743("OneWord")|
+var
+NULL
+call bug7743("anotherword")|
+var
+2
+call bug7743("AnotherWord")|
+var
+NULL
+drop procedure bug7743|
+drop table t4|
+delete from t3|
+insert into t3 values(1)|
+drop procedure if exists bug7992_1|
+Warnings:
+Note	1305	PROCEDURE bug7992_1 does not exist
+drop procedure if exists bug7992_2|
+Warnings:
+Note	1305	PROCEDURE bug7992_2 does not exist
+create procedure bug7992_1()
+begin
+declare i int;
+select max(s1)+1 into i from t3;
+end|
+create procedure bug7992_2()
+insert into t3 (s1) select max(t4.s1)+1 from t3 as t4|
+call bug7992_1()|
+call bug7992_1()|
+call bug7992_2()|
+call bug7992_2()|
+drop procedure bug7992_1|
+drop procedure bug7992_2|
+drop table t3|
+drop table if exists t3|
+create table t3 (  userid bigint(20) not null default 0 )|
+drop procedure if exists bug8116|
+create procedure bug8116(in _userid int)
+select * from t3 where userid = _userid|
+call bug8116(42)|
+userid
+call bug8116(42)|
+userid
+drop procedure bug8116|
+drop table t3|
 drop table if exists fac|
 create table fac (n int unsigned not null primary key, f bigint unsigned)|
 drop procedure if exists ifac|

mysql-test/t/sp.test

@@ -2536,6 +2536,115 @@ end|
 call bug8540()|
 drop procedure bug8540|
 
+#
+# BUG#6642: Stored procedure crash if expression with set function
+#
+--disable_warnings
+drop table if exists t3|
+--enable_warnings
+create table t3 (s1 int)|
+
+--disable_warnings
+drop procedure if exists bug6642|
+--enable_warnings
+
+create procedure bug6642()
+  select abs(count(s1)) from t3|
+
+call bug6642()|
+call bug6642()|
+drop procedure bug6642|
+
+#
+# BUG#7013: Stored procedure crash if group by ... with rollup
+#
+insert into t3 values (0),(1)|
+--disable_warnings
+drop procedure if exists bug7013|
+--enable_warnings
+create procedure bug7013()
+  select s1,count(s1) from t3 group by s1 with rollup|
+call bug7013()|
+call bug7013()|
+drop procedure bug7013|
+
+#
+# BUG#7743: 'Lost connection to MySQL server during query' on Stored Procedure
+#
+--disable_warnings
+drop table if exists t4;
+--enable_warnings
+create table t4 (
+  a mediumint(8) unsigned not null auto_increment,
+  b smallint(5) unsigned not null,
+  c char(32) not null,
+  primary key  (a)
+) engine=myisam default charset=latin1|
+insert into t4 values (1, 2, 'oneword')|
+insert into t4 values (2, 2, 'anotherword')|
+
+--disable_warnings
+drop procedure if exists bug7743|
+--enable_warnings
+create procedure bug7743 ( searchstring char(28) )
+begin
+  declare var mediumint(8) unsigned;
+  select a into var from t4 where b = 2 and c = binary searchstring limit 1;
+  select var;
+end|
+
+call bug7743("oneword")|
+call bug7743("OneWord")|
+call bug7743("anotherword")|
+call bug7743("AnotherWord")|
+drop procedure bug7743|
+drop table t4|
+
+#
+# BUG#7992: SELECT .. INTO variable .. within Stored Procedure crashes
+#           the server
+#
+delete from t3|
+insert into t3 values(1)|
+drop procedure if exists bug7992_1|
+drop procedure if exists bug7992_2|
+create procedure bug7992_1()
+begin
+  declare i int;
+  select max(s1)+1 into i from t3;
+end|
+create procedure bug7992_2()
+  insert into t3 (s1) select max(t4.s1)+1 from t3 as t4|
+
+call bug7992_1()|
+call bug7992_1()|
+call bug7992_2()|
+call bug7992_2()|
+
+drop procedure bug7992_1|
+drop procedure bug7992_2|
+drop table t3|
+
+#
+# BUG#8116: calling simple stored procedure twice in a row results
+#           in server crash
+#
+--disable_warnings
+drop table if exists t3|
+--enable_warnings
+create table t3 (  userid bigint(20) not null default 0 )|
+
+--disable_warnings
+drop procedure if exists bug8116|
+--enable_warnings
+create procedure bug8116(in _userid int)
+   select * from t3 where userid = _userid|
+
+call bug8116(42)|
+call bug8116(42)|
+drop procedure bug8116|
+drop table t3|
+
 
 #
 # Some "real" examples

sql/sp_head.cc

@@ -1251,6 +1251,7 @@ sp_instr_stmt::exec_stmt(THD *thd, LEX *lex)
   res= mysql_execute_command(thd);
 
   lex->unit.cleanup();
+  thd->rollback_item_tree_changes();
   if (thd->lock || thd->open_tables || thd->derived_tables)
   {
     thd->proc_info="closing tables";