From a7f62444ae3ca3048ff69762e6f950f72eaf63ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vicen=C8=9Biu=20Ciorbaru?= <vicentiu@mariadb.org>
Date: Tue, 26 Jan 2016 14:49:25 +0200
Subject: [MDEV-9304] MariaDB crash with specific query

A fix making tmp_join not get double freed.
---
 sql/sql_union.cc | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sql/sql_union.cc b/sql/sql_union.cc
index c8350838ee8..6d584e1242e 100644
--- a/sql/sql_union.cc
+++ b/sql/sql_union.cc
@@ -1043,6 +1043,12 @@ bool st_select_lex_unit::cleanup()
       join->tables_list= 0;
       join->table_count= 0;
       join->top_join_tab_count= 0;
+      if (join->tmp_join && join->tmp_join != join)
+      {
+        join->tmp_join->tables_list= 0;
+        join->tmp_join->table_count= 0;
+        join->tmp_join->top_join_tab_count= 0;
+      }
     }
     error|= fake_select_lex->cleanup();
     /*
-- 
cgit v1.2.1