merging with 5.1.29.

3 files changed, 41 insertions, 0 deletions

diff --git a/mysql-test/r/default.result b/mysql-test/r/default.result
index e65e015eff9..5b0d82407a2 100644
--- a/mysql-test/r/default.result
+++ b/mysql-test/r/default.result
@@ -205,4 +205,19 @@ Warnings:
 Warning	1364	Field 'id' doesn't have a default value
 drop view v1;
 drop table t1;
+create table t1 (a int unique);
+create table t2 (b int default 10);
+insert into t1 (a) values (1);
+insert into t2 (b) values (1);
+insert into t1 (a) select b from t2 on duplicate key update a=default;
+select * from t1;
+a
+NULL
+insert into t1 (a) values (1);
+insert into t1 (a) select b from t2 on duplicate key update a=default(b);
+select * from t1;
+a
+NULL
+10
+drop table t1, t2;
 End of 5.0 tests.
diff --git a/mysql-test/t/default.test b/mysql-test/t/default.test
index 14aa4b02cfe..b719cb83448 100644
--- a/mysql-test/t/default.test
+++ b/mysql-test/t/default.test
@@ -145,5 +145,24 @@ insert into t1 values(default);
 drop view v1;
 drop table t1;
 
+#
+# Bug #39002: crash with
+#             INSERT ... SELECT ... ON DUPLICATE KEY UPDATE col=DEFAULT
+#
+
+create table t1 (a int unique);
+create table t2 (b int default 10);
+insert into t1 (a) values (1);
+insert into t2 (b) values (1);
+
+insert into t1 (a) select b from t2 on duplicate key update a=default;
+select * from t1;
+
+insert into t1 (a) values (1);
+insert into t1 (a) select b from t2 on duplicate key update a=default(b);
+select * from t1;
+
+drop table t1, t2;
+
 --echo End of 5.0 tests.
 
diff --git a/sql/item.cc b/sql/item.cc
index 3f41c7211c8..119097ea942 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -6210,6 +6210,13 @@ Item *Item_default_value::transform(Item_transformer transformer, uchar *args)
 {
   DBUG_ASSERT(!current_thd->is_stmt_prepare());
 
+  /*
+    If the value of arg is NULL, then this object represents a constant,
+    so further transformation is unnecessary (and impossible).
+  */
+  if (!arg)
+    return 0;
+
   Item *new_item= arg->transform(transformer, args);
   if (!new_item)
     return 0;