sql_base.cc:

  Fixed bug #12470.
  A misplaced initialization of the cond_count counter
  resulted in a wrong calculation of it. This caused a memory
  corruption since this counter was used as a parameter of
  some memory allocation.
view.test:
  Added a test case for bug #12470.

mysql-test/r/view.result

@@ -2079,3 +2079,16 @@ id	f
 2	foo2
 DROP VIEW v1;
 DROP TABLE t1;
+CREATE TABLE t1 (pk int PRIMARY KEY, b int);
+CREATE TABLE t2 (pk int PRIMARY KEY, fk int, INDEX idx(fk));
+CREATE TABLE t3 (pk int PRIMARY KEY, fk int, INDEX idx(fk));
+CREATE TABLE t4 (pk int PRIMARY KEY, fk int, INDEX idx(fk));
+CREATE TABLE t5 (pk int PRIMARY KEY, fk int, INDEX idx(fk));
+CREATE VIEW v1 AS
+SELECT t1.pk as a FROM t1,t2,t3,t4,t5
+WHERE t1.b IS NULL AND
+t1.pk=t2.fk AND t2.pk=t3.fk AND t3.pk=t4.fk AND t4.pk=t5.fk;
+SELECT a FROM v1;
+a
+DROP VIEW v1;
+DROP TABLE t1,t2,t3,t4,t5;

mysql-test/t/view.test

@@ -1917,6 +1917,23 @@ SELECT * FROM v1;
 DROP VIEW v1;
 DROP TABLE t1;
 
+#
+# Test for bug #12470: crash for a simple select from a view defined
+#                      as a join over 5 tables
+
+CREATE TABLE t1 (pk int PRIMARY KEY, b int);
+CREATE TABLE t2 (pk int PRIMARY KEY, fk int, INDEX idx(fk));
+CREATE TABLE t3 (pk int PRIMARY KEY, fk int, INDEX idx(fk));
+CREATE TABLE t4 (pk int PRIMARY KEY, fk int, INDEX idx(fk));
+CREATE TABLE t5 (pk int PRIMARY KEY, fk int, INDEX idx(fk));
+CREATE VIEW v1 AS
+  SELECT t1.pk as a FROM t1,t2,t3,t4,t5
+    WHERE t1.b IS NULL AND
+          t1.pk=t2.fk AND t2.pk=t3.fk AND t3.pk=t4.fk AND t4.pk=t5.fk;
 
+SELECT a FROM v1;
+
+DROP VIEW v1;
+DROP TABLE t1,t2,t3,t4,t5;
 
 

sql/sql_base.cc

@@ -3660,6 +3660,7 @@ int setup_conds(THD *thd, TABLE_LIST *tables, TABLE_LIST *leaves,
     arena= 0;                                   // For easier test
 
   thd->set_query_id=1;
+  select_lex->cond_count= 0;
 
   for (table= tables; table; table= table->next_local)
   {
@@ -3667,7 +3668,6 @@ int setup_conds(THD *thd, TABLE_LIST *tables, TABLE_LIST *leaves,
       goto err_no_arena;
   }
 
-  select_lex->cond_count= 0;
   if (*conds)
   {
     thd->where="where clause";