BUG#36139 "float, zerofill, crash with subquery"

- Make convert_zerofill_number_to_string() take into account that the 
  constant it is converting may evaluate to NULL.


mysql-test/r/subselect.result:
  BUG#36139 "float, zerofill, crash with subquery"
  - Testcase
mysql-test/t/subselect.test:
  BUG#36139 "float, zerofill, crash with subquery"
  - Testcase

mysql-test/r/subselect.result

@@ -4374,4 +4374,11 @@ a4	f3	a6
 1	NULL	NULL
 2	NULL	NULL
 DROP TABLE t1, t2, t3, t4;
+create table t1 (a float(5,4) zerofill);
+create table t2 (a float(5,4),b float(2,0));
+select t1.a from t1 where   
+t1.a= (select b from t2 limit 1) and not
+t1.a= (select a from t2 limit 1) ;
+a
+drop table t1;
 End of 5.0 tests.

mysql-test/t/subselect.test

@@ -3259,5 +3259,17 @@ GROUP BY a4;
 
 DROP TABLE t1, t2, t3, t4;
 
+#
+# BUG#36139 "float, zerofill, crash with subquery"
+#
+create table t1 (a float(5,4) zerofill);
+create table t2 (a float(5,4),b float(2,0));
+
+select t1.a from t1 where   
+  t1.a= (select b from t2 limit 1) and not
+  t1.a= (select a from t2 limit 1) ;
+
+drop table t1;
+
 --echo End of 5.0 tests.
 

sql/item.cc

@@ -4156,9 +4156,14 @@ static void convert_zerofill_number_to_string(Item **item, Field_num *field)
   String tmp(buff,sizeof(buff), field->charset()), *res;
 
   res= (*item)->val_str(&tmp);
-  field->prepend_zeros(res);
-  pos= (char *) sql_strmake (res->ptr(), res->length());
-  *item= new Item_string(pos, res->length(), field->charset());
+  if ((*item)->is_null())
+    *item= new Item_null();
+  else
+  {
+    field->prepend_zeros(res);
+    pos= (char *) sql_strmake (res->ptr(), res->length());
+    *item= new Item_string(pos, res->length(), field->charset());
+  }
 }