Post-review fixes for BUG#14376: MySQL crash on scoped variable (re)initialization

sql/sp_pcontext.cc

@@ -150,7 +150,7 @@ sp_pcontext::diff_cursors(sp_pcontext *ctx)
 sp_pvar_t *
 sp_pcontext::find_pvar(LEX_STRING *name, my_bool scoped)
 {
-  uint i= m_pboundary;
+  uint i= m_pvar.elements - m_pboundary;
 
   while (i--)
   {
@@ -186,7 +186,6 @@ sp_pcontext::push_pvar(LEX_STRING *name, enum enum_field_types type,
     p->offset= current_pvars();
     p->dflt= NULL;
     insert_dynamic(&m_pvar, (gptr)&p);
-    m_pboundary= m_pvar.elements;
   }
 }
 

sql/sp_pcontext.h

@@ -164,7 +164,6 @@ class sp_pcontext : public Sql_alloc
   {
     while (num--)
       pop_dynamic(&m_pvar);
-    m_pboundary= m_pvar.elements;
   }
 
   // Find by name
@@ -184,12 +183,14 @@ class sp_pcontext : public Sql_alloc
     return p;
   }
 
-  // Set the current scope boundary (for default values)
-  // The argument is the number of variables to skip.
+  /*
+    Set the current scope boundary (for default values)
+    The argument is the number of variables to skip.   
+  */
   inline void
   declare_var_boundary(uint n)
   {
-    m_pboundary= m_pvar.elements-n;
+    m_pboundary= n;
   }
 
   //
@@ -297,10 +298,10 @@ class sp_pcontext : public Sql_alloc
   uint m_poffset;		// Variable offset for this context
   uint m_coffset;		// Cursor offset for this context
   /*
-    Boundary for finding variables in this in this context.
-    This is normally the same as m_pvar.elements, but differs during
-    parsing of DECLARE ... DEFAULT, to get the scope right for DEFAULT
-    values.
+    Boundary for finding variables in this context. This is the number
+    of variables currently "invisible" to default clauses.
+    This is normally 0, but will be larger during parsing of
+    DECLARE ... DEFAULT, to get the scope right for DEFAULT values.
   */
   uint m_pboundary;
 

sql/sql_yacc.yy

@@ -1661,11 +1661,11 @@ sp_decls:
 sp_decl:
           DECLARE_SYM sp_decl_idents type 
           {
-	    LEX *lex= Lex;
+            LEX *lex= Lex;
 
-	    lex->sphead->reset_lex(YYTHD);
-	    lex->spcont->declare_var_boundary($2);
-	  }
+            lex->sphead->reset_lex(YYTHD);
+            lex->spcont->declare_var_boundary($2);
+          }
           sp_opt_default
           {
             LEX *lex= Lex;
@@ -1695,7 +1695,7 @@ sp_decl:
               lex->sphead->add_instr(in);
               ctx->set_default(i, it);
             }
-	    ctx->declare_var_boundary(0);
+            ctx->declare_var_boundary(0);
             lex->sphead->restore_lex(YYTHD);
             $$.vars= $2;
             $$.conds= $$.hndlrs= $$.curs= 0;