Fixed BUG#9902: Crash with simple stored function using user defined variables

  ... actually, it was a query cache problem. (It shouldn't cache such queries)

mysql-test/r/sp.result

@@ -2936,4 +2936,26 @@ select @tmp1, @tmp2|
 50	60
 drop procedure bug9598_1|
 drop procedure bug9598_2|
+drop procedure if exists bug9902|
+create function bug9902() returns int(11)
+begin
+set @x = @x + 1;
+return @x;
+end|
+set @qcs1 = @@query_cache_size|
+set global query_cache_size = 100000|
+set @x = 1|
+insert into t1 values ("qc", 42)|
+select bug9902() from t1|
+bug9902()
+2
+select bug9902() from t1|
+bug9902()
+3
+select @x|
+@x
+3
+set global query_cache_size = @qcs1|
+delete from t1|
+drop function bug9902|
 drop table t1,t2;

mysql-test/t/sp.test

@@ -3603,6 +3603,31 @@ drop procedure bug9598_1|
 drop procedure bug9598_2|
 
 
+#
+# BUG#9902: Crash with simple stored function using user defined variables
+#
+--disable_warnings
+drop procedure if exists bug9902|
+--enable_warnings
+create function bug9902() returns int(11)
+begin
+  set @x = @x + 1;
+  return @x;
+end|
+
+set @qcs1 = @@query_cache_size|
+set global query_cache_size = 100000|
+set @x = 1|
+insert into t1 values ("qc", 42)|
+select bug9902() from t1|
+select bug9902() from t1|
+select @x|
+
+set global query_cache_size = @qcs1|
+delete from t1|
+drop function bug9902|
+
+
 #
 # BUG#NNNN: New bug synopsis
 #

sql/sql_yacc.yy

@@ -4598,14 +4598,16 @@ simple_expr:
 	  { $$= new Item_int((char*) "TRUE",1,1); }
 	| ident '.' ident '(' udf_expr_list ')'
 	  {
+	    LEX *lex= Lex;
 	    sp_name *name= new sp_name($1, $3);
 
 	    name->init_qname(YYTHD);
-	    sp_add_to_hash(&Lex->spfuns, name);
+	    sp_add_to_hash(&lex->spfuns, name);
 	    if ($5)
 	      $$= new Item_func_sp(name, *$5);
 	    else
 	      $$= new Item_func_sp(name);
+	    lex->safe_to_cache_query=0;
 	  }
 	| IDENT_sys '(' udf_expr_list ')'
           {
@@ -4686,13 +4688,15 @@ simple_expr:
             else
 #endif /* HAVE_DLOPEN */
             {
+	      LEX *lex= Lex;
               sp_name *name= sp_name_current_db_new(YYTHD, $1);
 
-              sp_add_to_hash(&Lex->spfuns, name);
+              sp_add_to_hash(&lex->spfuns, name);
               if ($3)
                 $$= new Item_func_sp(name, *$3);
               else
                 $$= new Item_func_sp(name);
+	      lex->safe_to_cache_query=0;
 	    }
           }
 	| UNIQUE_USERS '(' text_literal ',' NUM ',' NUM ',' expr_list ')'