LP BUG#978847 fixed.

Fixed incorrect type casting which made all fields (except very first) changes to materialized table incorrect.
Saved list of view/derived table used items after expanding '*'.

mysql-test/r/derived_view.result

@@ -2034,6 +2034,59 @@ a
 drop table t1,t2;
 set optimizer_switch=@save968720_optimizer_switch;
 #
+# LP BUG#978847 Server crashes in Item_ref::real_item on
+# INSERT .. SELECT with FROM subquery and derived_merge=ON
+SET @save978847_optimizer_switch=@@optimizer_switch;
+SET optimizer_switch = 'derived_merge=on';
+CREATE TABLE t1 ( a INT, b INT );
+INSERT INTO t1 VALUES (2,1),(3,2);
+select * from t1;
+a	b
+2	1
+3	2
+INSERT INTO t1 SELECT * FROM
+( SELECT * FROM t1 ) AS alias;
+select * from t1;
+a	b
+2	1
+3	2
+2	1
+3	2
+prepare stmt1 from  'INSERT INTO t1 SELECT SQL_BIG_RESULT * FROM
+  ( SELECT * FROM t1 ) AS alias';
+execute stmt1;
+select * from t1;
+a	b
+2	1
+3	2
+2	1
+3	2
+2	1
+3	2
+2	1
+3	2
+execute stmt1;
+select * from t1;
+a	b
+2	1
+3	2
+2	1
+3	2
+2	1
+3	2
+2	1
+3	2
+2	1
+3	2
+2	1
+3	2
+2	1
+3	2
+2	1
+3	2
+drop table t1;
+set optimizer_switch=@save978847_optimizer_switch;
+#
 # end of 5.3 tests
 #
 set optimizer_switch=@exit_optimizer_switch;

mysql-test/t/derived_view.test

@@ -1413,6 +1413,30 @@ SELECT * FROM t1;
 drop table t1,t2;
 set optimizer_switch=@save968720_optimizer_switch;
 
+--echo #
+--echo # LP BUG#978847 Server crashes in Item_ref::real_item on
+--echo # INSERT .. SELECT with FROM subquery and derived_merge=ON
+SET @save978847_optimizer_switch=@@optimizer_switch;
+SET optimizer_switch = 'derived_merge=on';
+
+CREATE TABLE t1 ( a INT, b INT );
+INSERT INTO t1 VALUES (2,1),(3,2);
+
+select * from t1;
+INSERT INTO t1 SELECT * FROM
+  ( SELECT * FROM t1 ) AS alias;
+select * from t1;
+prepare stmt1 from  'INSERT INTO t1 SELECT SQL_BIG_RESULT * FROM
+  ( SELECT * FROM t1 ) AS alias';
+execute stmt1;
+select * from t1;
+execute stmt1;
+select * from t1;
+
+drop table t1;
+
+set optimizer_switch=@save978847_optimizer_switch;
+
 --echo #
 --echo # end of 5.3 tests
 --echo #

sql/sql_base.cc

@@ -8326,6 +8326,11 @@ insert_fields(THD *thd, Name_resolution_context *context, const char *db_name,
         }
       }
 #endif
+      /*
+         field_iterator.create_item() builds used_items which we
+         have to save because changes made once and they are persistent
+      */
+      tables->persistent_used_items= tables->used_items;
 
       if ((field= field_iterator.field()))
       {

sql/table.cc

@@ -6088,7 +6088,8 @@ bool TABLE_LIST::change_refs_to_fields()
       We need to restore the pointers after the execution of the
       prepared statement.
     */
-    thd->change_item_tree((Item **)&ref->ref, (Item*)materialized_items + idx);
+    thd->change_item_tree((Item **)&ref->ref,
+                          (Item*)(materialized_items + idx));
   }
 
   return FALSE;