A fix (bug #6441: Aggregate UDF in multi-table query crashes MySQL when returning multiple rows).

sql/item_func.cc:
  A fix (bug #6441: Aggregate UDF in multi-table query crashes MySQL when returning multiple rows).
  Do nothing in the udf_handler destructor if not_original flag is set.
sql/item_sum.h:
  A fix (bug #6441: Aggregate UDF in multi-table query crashes MySQL when returning multiple rows).
  Set udf.not_original flag if we create an Item from the existent one.
sql/sql_udf.h:
  A fix (bug #6441: Aggregate UDF in multi-table query crashes MySQL when returning multiple rows).
  not_original flag added.

sql/item_func.cc

@@ -1602,18 +1602,21 @@ longlong Item_func_bit_count::val_int()
 
 udf_handler::~udf_handler()
 {
-  if (initialized)
+  if (!not_original)
   {
-    if (u_d->func_deinit != NULL)
+    if (initialized)
     {
-      void (*deinit)(UDF_INIT *) = (void (*)(UDF_INIT*))
-	u_d->func_deinit;
-      (*deinit)(&initid);
+      if (u_d->func_deinit != NULL)
+      {
+        void (*deinit)(UDF_INIT *) = (void (*)(UDF_INIT*))
+        u_d->func_deinit;
+        (*deinit)(&initid);
+      }
+      free_udf(u_d);
     }
-    free_udf(u_d);
+    if (buffers)				// Because of bug in ecc
+      delete [] buffers;
   }
-  if (buffers)					// Because of bug in ecc
-    delete [] buffers;
 }
 
 

sql/item_sum.h

@@ -532,7 +532,7 @@ class Item_udf_sum : public Item_sum
     :Item_sum( list ), udf(udf_arg)
   { quick_group=0;}
   Item_udf_sum(THD *thd, Item_udf_sum *item)
-    :Item_sum(thd, item), udf(item->udf) {}
+    :Item_sum(thd, item), udf(item->udf) { udf.not_original= TRUE; }
   const char *func_name() const { return udf.name(); }
   bool fix_fields(THD *thd, TABLE_LIST *tables, Item **ref)
   {

sql/sql_udf.h

@@ -56,8 +56,9 @@ class udf_handler :public Sql_alloc
  public:
   table_map used_tables_cache;
   bool const_item_cache;
+  bool not_original;
   udf_handler(udf_func *udf_arg) :u_d(udf_arg), buffers(0), error(0),
-    is_null(0), initialized(0)
+    is_null(0), initialized(0), not_original(0)
   {}
   ~udf_handler();
   const char *name() const { return u_d ? u_d->name.str : "?"; }