that returns the results of aggregation by GROUP_CONCAT.
The crash was due to an overflow happened for the field
sortoder->length.
The fix prevents this overflow exploiting the fact that the
value of sortoder->length cannot be greater than the value of
thd->variables.max_sort_length.   


mysql-test/r/func_gconcat.result:
  Added a test case for bug #22015.
mysql-test/t/func_gconcat.test:
  Added a test case for bug #22015.