fixed memory overrun (bug 380)

mysql-test/r/func_group.result:
  new tests
mysql-test/t/func_group.test:
  new tests
sql/item.cc:
  count items in select list
sql/item_subselect.cc:
  use number of item in select list for array creation
sql/item_sum.cc:
  with_sum_func now is boolean
sql/sql_derived.cc:
  use number of item in select list for array creation
sql/sql_lex.cc:
  create_refs changed with parsing_place enum variable
sql/sql_lex.h:
  added items in select list counter
  create_refs changed with parsing_place enum variable
  with_sum_func now is boolean
sql/sql_select.cc:
  use number of item in select list for array creation
sql/sql_union.cc:
  use number of item in select list for array creation
sql/sql_yacc.yy:
  create_refs changed with parsing_place enum variable

1 files changed, 1 insertions, 1 deletions

diff --git a/sql/item_subselect.cc b/sql/item_subselect.cc
index c749fba616f..e7a2c6e7f24 100644
--- a/sql/item_subselect.cc
+++ b/sql/item_subselect.cc
@@ -492,7 +492,7 @@ void Item_in_subselect::single_value_transformer(THD *thd,
     {
       sl->item_list.push_back(item);
       setup_ref_array(thd, &sl->ref_pointer_array,
-		      1 + sl->with_sum_func +
+		      1 + sl->select_items +
 		      sl->order_list.elements + sl->group_list.elements);
       // To prevent crash on Item_ref_null_helper destruction in case of error
       sl->ref_pointer_array[0]= 0;