Merge 5.1 => 5.5.

mysql-test/r/errors.result

@@ -146,3 +146,17 @@ ERROR 22003: BIGINT value is out of range in '(-(73) * -(2465717823867977728))'
 #
 # End Bug#57882
 #
+CREATE TABLE t1 (a INT);
+CREATE TABLE t2(a INT PRIMARY KEY, b INT);
+SELECT '' AS b FROM t1 GROUP BY VALUES(b);
+ERROR 42S22: Unknown column '' in 'VALUES() function'
+REPLACE t2(b) SELECT '' AS b FROM t1 GROUP BY VALUES(b);
+ERROR 42S22: Unknown column '' in 'VALUES() function'
+UPDATE t2 SET a=(SELECT '' AS b FROM t1 GROUP BY VALUES(b));
+ERROR 42S22: Unknown column '' in 'VALUES() function'
+INSERT INTO t2 VALUES (1,0) ON DUPLICATE KEY UPDATE
+b=(SELECT '' AS b FROM t1 GROUP BY VALUES(b));
+ERROR 42S22: Unknown column '' in 'VALUES() function'
+INSERT INTO t2(a,b) VALUES (1,0) ON DUPLICATE KEY UPDATE
+b=(SELECT VALUES(a)+2 FROM t1);
+DROP TABLE t1, t2;

mysql-test/t/errors.test

@@ -171,3 +171,21 @@ SELECT UPDATEXML(-73 * -2465717823867977728,@@global.auto_increment_increment,nu
 --echo #
 --echo # End Bug#57882
 --echo #
+
+#
+# Bug #13031606 VALUES() IN A SELECT STATEMENT CRASHES SERVER
+#
+CREATE TABLE t1 (a INT);
+CREATE TABLE t2(a INT PRIMARY KEY, b INT);
+--error ER_BAD_FIELD_ERROR
+SELECT '' AS b FROM t1 GROUP BY VALUES(b);
+--error ER_BAD_FIELD_ERROR
+REPLACE t2(b) SELECT '' AS b FROM t1 GROUP BY VALUES(b);
+--error ER_BAD_FIELD_ERROR
+UPDATE t2 SET a=(SELECT '' AS b FROM t1 GROUP BY VALUES(b));
+--error ER_BAD_FIELD_ERROR
+INSERT INTO t2 VALUES (1,0) ON DUPLICATE KEY UPDATE
+  b=(SELECT '' AS b FROM t1 GROUP BY VALUES(b));
+INSERT INTO t2(a,b) VALUES (1,0) ON DUPLICATE KEY UPDATE
+  b=(SELECT VALUES(a)+2 FROM t1);
+DROP TABLE t1, t2;

sql/item.cc

@@ -7078,20 +7078,12 @@ bool Item_insert_value::fix_fields(THD *thd, Item **items)
   }
 
   if (arg->type() == REF_ITEM)
-  {
-    Item_ref *ref= (Item_ref *)arg;
-    if (ref->ref[0]->type() != FIELD_ITEM)
+    arg= static_cast<Item_ref *>(arg)->ref[0];
+  if (arg->type() != FIELD_ITEM)
   {
     my_error(ER_BAD_FIELD_ERROR, MYF(0), "", "VALUES() function");
     return TRUE;
   }
-    arg= ref->ref[0];
-  }
-  /*
-    According to our SQL grammar, VALUES() function can reference
-    only to a column.
-  */
-  DBUG_ASSERT(arg->type() == FIELD_ITEM);
 
   Item_field *field_arg= (Item_field *)arg;