BUG#724275: Crash in JOIN::optimize in maria-5.3

- Make equality-substitution-for-ref-access code in JOIN::optimize() treat join_tab->ref.key_copy correctly
  (in the way create_ref_for_key() has filled it).

mysql-test/r/join.result

@@ -1251,3 +1251,37 @@ Handler_read_rnd	0
 Handler_read_rnd_next	1
 DROP TABLE t1, t2;
 End of 5.1 tests
+#
+# BUG#724275: Crash in JOIN::optimize in maria-5.3
+#
+create table t1 (a int);
+insert into t1 values (1),(2);
+insert into t1 select * from t1;
+create table t2 (a int, b int, key(a,b));
+insert into t2 values (1,1),(1,2),(1,3),(1,4),(2,5),(2,6),(2,7),(2,8),(2,9);
+insert into t2 select * from t2;
+insert into t2 select * from t2;
+insert into t2 select * from t2;
+create table t3 (a int, b int, key(a));
+insert into t3 values (1,1),(2,2);
+select * from 
+t3 straight_join t1 straight_join t2 force index(a) 
+where t2.a=1 and t2.b=t1.a and t1.a=t3.b and t3.a=1;
+a	b	a	a	b
+1	1	1	1	1
+1	1	1	1	1
+1	1	1	1	1
+1	1	1	1	1
+1	1	1	1	1
+1	1	1	1	1
+1	1	1	1	1
+1	1	1	1	1
+1	1	1	1	1
+1	1	1	1	1
+1	1	1	1	1
+1	1	1	1	1
+1	1	1	1	1
+1	1	1	1	1
+1	1	1	1	1
+1	1	1	1	1
+drop table t1,t2,t3;

mysql-test/t/join.test

@@ -941,3 +941,26 @@ SHOW STATUS LIKE 'Handler_read_%';
 DROP TABLE t1, t2;
 
 --echo End of 5.1 tests
+
+--echo #
+--echo # BUG#724275: Crash in JOIN::optimize in maria-5.3
+--echo #
+
+create table t1 (a int);
+insert into t1 values (1),(2);
+insert into t1 select * from t1;
+
+create table t2 (a int, b int, key(a,b));
+insert into t2 values (1,1),(1,2),(1,3),(1,4),(2,5),(2,6),(2,7),(2,8),(2,9);
+insert into t2 select * from t2;
+insert into t2 select * from t2;
+insert into t2 select * from t2;
+
+create table t3 (a int, b int, key(a));
+insert into t3 values (1,1),(2,2);
+select * from 
+  t3 straight_join t1 straight_join t2 force index(a) 
+where t2.a=1 and t2.b=t1.a and t1.a=t3.b and t3.a=1;
+
+drop table t1,t2,t3;
+

sql/sql_select.cc

@@ -1056,6 +1056,7 @@ JOIN::optimize()
   */
   for (JOIN_TAB *tab= join_tab + const_tables; tab < join_tab + tables; tab++)
   {
+    uint key_copy_index=0;
     for (uint i=0; i < tab->ref.key_parts; i++)
     {
       
@@ -1071,13 +1072,14 @@ JOIN::optimize()
       {
         *ref_item_ptr= ref_item;
         Item *item= ref_item->real_item();
-        store_key *key_copy= tab->ref.key_copy[i];
+        store_key *key_copy= tab->ref.key_copy[key_copy_index];
         if (key_copy->type() == store_key::FIELD_STORE_KEY)
 	{
           store_key_field *field_copy= ((store_key_field *)key_copy);
           field_copy->change_source_field((Item_field *) item);
         }
       }
+      key_copy_index++;
     }
   }