MDEV-22303: Incorrect ordering with REGEXP_REPLACE and OFFSET/LIMIT

For character sets and collation where character to weight mapping > 1,
there we need to make sure while creating a sort key,
a temporary buffer is created to store the value of the item by val_str function
and then copy that value back to the sort buffer.
In this case when using a priority queue Sort_param::tmp_buffer was not allocated.

mysql-test/main/order_by.result

@@ -3866,3 +3866,22 @@ cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
 dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd
 NULL
 DROP TABLE t1;
+#
+# MDEV-22303: Incorrect ordering with REGEXP_REPLACE and OFFSET/LIMIT
+#
+CREATE TABLE t1 (name VARCHAR(20) CHARACTER SET utf8 NOT NULL);
+INSERT INTO t1 (name) VALUES ('Charles Dickens'), ('Roald Dahl');
+SELECT name, REGEXP_REPLACE(name, '^(.*) (.*)$', '\\2, \\1') AS surname_first FROM t1
+ORDER BY surname_first ASC;
+name	surname_first
+Roald Dahl	Dahl, Roald
+Charles Dickens	Dickens, Charles
+SELECT name, REGEXP_REPLACE(name, '^(.*) (.*)$', '\\2, \\1') AS surname_first FROM t1
+ORDER BY surname_first ASC LIMIT 1;
+name	surname_first
+Roald Dahl	Dahl, Roald
+SELECT name, REGEXP_REPLACE(name, '^(.*) (.*)$', '\\2, \\1') AS surname_first FROM t1
+ORDER BY surname_first ASC LIMIT 1 OFFSET 1;
+name	surname_first
+Charles Dickens	Dickens, Charles
+DROP TABLE t1;

mysql-test/main/order_by.test

@@ -2413,3 +2413,21 @@ insert into t1 select repeat('d', 256);
 
 SELECT IF( 0, NULL, a ) AS f FROM t1 GROUP BY f WITH ROLLUP;
 DROP TABLE t1;
+
+--echo #
+--echo # MDEV-22303: Incorrect ordering with REGEXP_REPLACE and OFFSET/LIMIT
+--echo #
+
+CREATE TABLE t1 (name VARCHAR(20) CHARACTER SET utf8 NOT NULL);
+INSERT INTO t1 (name) VALUES ('Charles Dickens'), ('Roald Dahl');
+
+SELECT name, REGEXP_REPLACE(name, '^(.*) (.*)$', '\\2, \\1') AS surname_first FROM t1
+ORDER BY surname_first ASC;
+
+SELECT name, REGEXP_REPLACE(name, '^(.*) (.*)$', '\\2, \\1') AS surname_first FROM t1
+ORDER BY surname_first ASC LIMIT 1;
+
+SELECT name, REGEXP_REPLACE(name, '^(.*) (.*)$', '\\2, \\1') AS surname_first FROM t1
+ORDER BY surname_first ASC LIMIT 1 OFFSET 1;
+
+DROP TABLE t1;

sql/filesort.cc

@@ -309,12 +309,6 @@ SORT_INFO *filesort(THD *thd, TABLE *table, Filesort *filesort,
     tracker->report_sort_keys_format(param.using_packed_sortkeys());
     param.using_pq= false;
 
-    if ((multi_byte_charset || param.using_packed_sortkeys()) &&
-        !(param.tmp_buffer= (char*) my_malloc(key_memory_Sort_param_tmp_buffer, param.sort_length,
-                                              MYF(MY_WME | MY_THREAD_SPECIFIC))))
-      goto err;
-
-
     size_t min_sort_memory= MY_MAX(MIN_SORT_MEMORY,
                                    param.sort_length*MERGEBUFF2);
     set_if_bigger(min_sort_memory, sizeof(Merge_chunk*)*MERGEBUFF2);
@@ -345,6 +339,12 @@ SORT_INFO *filesort(THD *thd, TABLE *table, Filesort *filesort,
     tracker->report_addon_fields_format(param.using_packed_addons());
   }
 
+  if ((multi_byte_charset || param.using_packed_sortkeys()) &&
+      !(param.tmp_buffer= (char*) my_malloc(key_memory_Sort_param_tmp_buffer,
+                                            param.sort_length,
+                                            MYF(MY_WME | MY_THREAD_SPECIFIC))))
+      goto err;
+
   if (open_cached_file(&buffpek_pointers,mysql_tmpdir,TEMP_PREFIX,
 		       DISK_BUFFER_SIZE, MYF(MY_WME)))
     goto err;