merging with 5.1.29.

mysql-test/r/default.result

@@ -205,4 +205,19 @@ Warnings:
 Warning	1364	Field 'id' doesn't have a default value
 drop view v1;
 drop table t1;
+create table t1 (a int unique);
+create table t2 (b int default 10);
+insert into t1 (a) values (1);
+insert into t2 (b) values (1);
+insert into t1 (a) select b from t2 on duplicate key update a=default;
+select * from t1;
+a
+NULL
+insert into t1 (a) values (1);
+insert into t1 (a) select b from t2 on duplicate key update a=default(b);
+select * from t1;
+a
+NULL
+10
+drop table t1, t2;
 End of 5.0 tests.

mysql-test/t/default.test

@@ -145,5 +145,24 @@ insert into t1 values(default);
 drop view v1;
 drop table t1;
 
+#
+# Bug #39002: crash with
+#             INSERT ... SELECT ... ON DUPLICATE KEY UPDATE col=DEFAULT
+#
+
+create table t1 (a int unique);
+create table t2 (b int default 10);
+insert into t1 (a) values (1);
+insert into t2 (b) values (1);
+
+insert into t1 (a) select b from t2 on duplicate key update a=default;
+select * from t1;
+
+insert into t1 (a) values (1);
+insert into t1 (a) select b from t2 on duplicate key update a=default(b);
+select * from t1;
+
+drop table t1, t2;
+
 --echo End of 5.0 tests.
 

sql/item.cc

@@ -6210,6 +6210,13 @@ Item *Item_default_value::transform(Item_transformer transformer, uchar *args)
 {
   DBUG_ASSERT(!current_thd->is_stmt_prepare());
 
+  /*
+    If the value of arg is NULL, then this object represents a constant,
+    so further transformation is unnecessary (and impossible).
+  */
+  if (!arg)
+    return 0;
+
   Item *new_item= arg->transform(transformer, args);
   if (!new_item)
     return 0;