Fix for bug #1564: CREATE TABLE + UNION + same table name = crash

mysql-test/r/union.result

@@ -419,4 +419,7 @@ a
 3
 (SELECT * FROM t1) UNION all (SELECT SQL_CALC_FOUND_ROWS * FROM t2) LIMIT 1;
 Wrong usage/placement of 'SQL_CALC_FOUND_ROWS'
+create temporary table t1 select a from t1 union select a from t2;
+create table t1 select a from t1 union select a from t2;
+INSERT TABLE 't1' isn't allowed in FROM table list
 drop table t1,t2;

mysql-test/t/union.test

@@ -223,4 +223,7 @@ SELECT * FROM t1 UNION SELECT * FROM t2 ORDER BY a desc LIMIT 1;
 --error 1234
 (SELECT * FROM t1) UNION all (SELECT SQL_CALC_FOUND_ROWS * FROM t2) LIMIT 1;
 
+create temporary table t1 select a from t1 union select a from t2;
+--error 1093
+create table t1 select a from t1 union select a from t2;
 drop table t1,t2;

sql/sql_parse.cc

@@ -3496,6 +3496,9 @@ static bool create_total_list(THD *thd, LEX *lex, TABLE_LIST **result)
     return 0;
   }
 
+  /* We should skip first table if SQL command is SQLCOM_CREATE_TABLE */
+  bool skip_first= (lex->sql_command == SQLCOM_CREATE_TABLE);
+  bool first_added= 0;
   SELECT_LEX *sl;
   TABLE_LIST **new_table_list= result, *aux;
 
@@ -3512,9 +3515,11 @@ static bool create_total_list(THD *thd, LEX *lex, TABLE_LIST **result)
       TABLE_LIST *next;
       for (; aux; aux=next)
       {
-	TABLE_LIST *cursor;
+	TABLE_LIST *cursor= *result;
+	if (first_added && skip_first)
+	  cursor= cursor->next;
 	next= aux->next;
-	for (cursor= *result; cursor; cursor=cursor->next)
+	for ( ; cursor; cursor=cursor->next)
 	  if (!strcmp(cursor->db,aux->db) &&
 	      !strcmp(cursor->real_name,aux->real_name) &&
 	      !strcmp(cursor->alias, aux->alias))
@@ -3531,6 +3536,7 @@ static bool create_total_list(THD *thd, LEX *lex, TABLE_LIST **result)
 	  *new_table_list= cursor;
 	  new_table_list= &cursor->next;
 	  *new_table_list=0;			// end result list
+	  first_added= 1;
 	}
 	else
 	  aux->shared=1;			// Mark that it's used twice