From f5cd55c79ac7afbdf221d0ff864ea3b58844c659 Mon Sep 17 00:00:00 2001
From: Oleksandr Byelkin <sanja@mariadb.com>
Date: Wed, 9 May 2018 13:39:13 +0200
Subject: MDEV-15576: Server crashed in Cached_item_str::cmp / sortcmp or
 Assertion `item->null_value' failed in
 Type_handler_temporal_result::make_sort_key upon SELECT with NULLIF and
 ROLLUP

Fixed null_value processing and is_null() usage.
---
 mysql-test/main/olap.result | 14 ++++++++++++++
 mysql-test/main/olap.test   | 17 +++++++++++++++++
 sql/item.h                  |  6 ++++++
 sql/item_cmpfunc.cc         |  2 +-
 sql/item_func.h             | 17 +++++++----------
 5 files changed, 45 insertions(+), 11 deletions(-)

diff --git a/mysql-test/main/olap.result b/mysql-test/main/olap.result
index bcc96d4951d..6fdbe008016 100644
--- a/mysql-test/main/olap.result
+++ b/mysql-test/main/olap.result
@@ -816,3 +816,17 @@ a	int(11)	YES		0
 b	int(20)	YES		0	
 DROP VIEW v1;
 DROP TABLE t1;
+#
+# MDEV-15576: Server crashed in Cached_item_str::cmp / sortcmp or
+# Assertion `item->null_value' failed in
+# Type_handler_temporal_result::make_sort_key upon SELECT with NULLIF
+# and ROLLUP
+#
+CREATE TABLE t1 (i INT);
+INSERT INTO t1 VALUES (1),(2);
+SELECT NULLIF( CAST( 'foo' AS DATE ), NULL & 'bar' ) AS f FROM t1 GROUP BY f WITH ROLLUP;
+f
+NULL
+NULL
+DROP TABLE t1;
+# End of 10.3 Tests
diff --git a/mysql-test/main/olap.test b/mysql-test/main/olap.test
index 3da08581a87..74dbe8ba10b 100644
--- a/mysql-test/main/olap.test
+++ b/mysql-test/main/olap.test
@@ -447,3 +447,20 @@ DESC v1;
 DROP VIEW v1;
 
 DROP TABLE t1;
+
+--echo #
+--echo # MDEV-15576: Server crashed in Cached_item_str::cmp / sortcmp or
+--echo # Assertion `item->null_value' failed in
+--echo # Type_handler_temporal_result::make_sort_key upon SELECT with NULLIF
+--echo # and ROLLUP
+--echo #
+
+CREATE TABLE t1 (i INT);
+INSERT INTO t1 VALUES (1),(2);
+--disable_warnings
+SELECT NULLIF( CAST( 'foo' AS DATE ), NULL & 'bar' ) AS f FROM t1 GROUP BY f WITH ROLLUP;
+--enable_warnings
+DROP TABLE t1;
+
+
+--echo # End of 10.3 Tests
diff --git a/sql/item.h b/sql/item.h
index 3ebb92b3afb..54f228468a7 100644
--- a/sql/item.h
+++ b/sql/item.h
@@ -718,6 +718,12 @@ protected:
       value= NULL;
     return value;
   }
+  bool get_date_from_item(Item *item, MYSQL_TIME *ltime, ulonglong fuzzydate)
+  {
+    bool rc= item->get_date(ltime, fuzzydate);
+    null_value= MY_TEST(rc || item->null_value);
+    return rc;
+  }
   /*
     This method is used if the item was not null but convertion to
     TIME/DATE/DATETIME failed. We return a zero date if allowed,
diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc
index afa68fc5df3..76f4788c1cf 100644
--- a/sql/item_cmpfunc.cc
+++ b/sql/item_cmpfunc.cc
@@ -2832,7 +2832,7 @@ Item_func_nullif::time_op(MYSQL_TIME *ltime)
 bool
 Item_func_nullif::is_null()
 {
-  return (null_value= (!compare() ? 1 : args[2]->null_value));
+  return (null_value= (!compare() ? 1 : args[2]->is_null()));
 }
 
 void Item_func_case::reorder_args(uint start)
diff --git a/sql/item_func.h b/sql/item_func.h
index 8504fe41f37..376f8fc16a1 100644
--- a/sql/item_func.h
+++ b/sql/item_func.h
@@ -1615,14 +1615,13 @@ public:
   {
     name= a->name;
   }
-  double val_real() { return args[0]->val_real(); }
-  longlong val_int() { return args[0]->val_int(); }
-  String *val_str(String *str) { return args[0]->val_str(str); }
-  my_decimal *val_decimal(my_decimal *dec) { return args[0]->val_decimal(dec); }
+  double val_real() { return val_real_from_item(args[0]); }
+  longlong val_int() { return val_int_from_item(args[0]); }
+  String *val_str(String *str) { return val_str_from_item(args[0], str); }
+  my_decimal *val_decimal(my_decimal *dec)
+    { return val_decimal_from_item(args[0], dec); }
   bool get_date(MYSQL_TIME *ltime, ulonglong fuzzydate)
-  {
-    return args[0]->get_date(ltime, fuzzydate);
-  }
+    { return get_date_from_item(args[0], ltime, fuzzydate); }
   const char *func_name() const { return "rollup_const"; }
   bool const_item() const { return 0; }
   const Type_handler *type_handler() const { return args[0]->type_handler(); }
@@ -1630,9 +1629,7 @@ public:
   {
     collation= args[0]->collation;
     max_length= args[0]->max_length;
-    decimals=args[0]->decimals; 
-    /* The item could be a NULL constant. */
-    null_value= args[0]->is_null();
+    decimals=args[0]->decimals;
   }
   Item *get_copy(THD *thd)
   { return get_item_copy<Item_func_rollup_const>(thd, this); }
-- 
cgit v1.2.1