MDEV-28266 Crash in Field_string::type_handler when calling procedures

on_table_fill_finished() should always be done at the end of open()
even if result is not Select_materialize but (for example)
Select_fetch_into_spvars.

mysql-test/main/sp-cursor.result

@@ -800,3 +800,15 @@ drop procedure test_proc;
 drop view v1;
 drop function get_name;
 drop table t1;
+#
+# MDEV-28266: Crash in Field_string::type_handler when calling procedures
+#
+CREATE TABLE t (f INT);
+CREATE TRIGGER tr AFTER INSERT ON t FOR EACH ROW
+FOR x IN (SELECT * FROM json_table(NULL, '$' COLUMNS(a CHAR(1) path '$.*')) tmp)
+DO set @a=1; END FOR $
+INSERT INTO t () values ();
+DROP TABLE t;
+#
+# End of 10.6 tests
+#

mysql-test/main/sp-cursor.test

@@ -800,3 +800,24 @@ drop procedure test_proc;
 drop view v1;
 drop function get_name;
 drop table t1;
+
+--echo #
+--echo # MDEV-28266: Crash in Field_string::type_handler when calling procedures
+--echo #
+
+CREATE TABLE t (f INT);
+
+--delimiter $
+CREATE TRIGGER tr AFTER INSERT ON t FOR EACH ROW
+    FOR x IN (SELECT * FROM json_table(NULL, '$' COLUMNS(a CHAR(1) path '$.*')) tmp)
+    DO set @a=1; END FOR $
+--delimiter ;
+
+INSERT INTO t () values ();
+
+# Cleanup
+DROP TABLE t;
+
+--echo #
+--echo # End of 10.6 tests
+--echo #

sql/sql_cursor.cc

@@ -80,19 +80,7 @@ class Select_materialize: public select_unit
   Select_materialize(THD *thd_arg, select_result *result_arg):
     select_unit(thd_arg), result(result_arg), materialized_cursor(0) {}
   virtual bool send_result_set_metadata(List<Item> &list, uint flags);
-  bool send_eof()
-  {
-    if (materialized_cursor)
-      materialized_cursor->on_table_fill_finished();
-    return false;
-  }
-
-  void abort_result_set()
-  {
-    if (materialized_cursor)
-      materialized_cursor->on_table_fill_finished();
-  }
-
+  bool send_eof() { return false; }
   bool view_structure_only() const
   {
     return result->view_structure_only();
@@ -333,6 +321,8 @@ int Materialized_cursor::open(JOIN *join __attribute__((unused)))
     result->abort_result_set();
   }
 
+  on_table_fill_finished();
+
   return rc;
 }