Bug#28494: Grouping by Item_func_set_user_var produces incorrect result.

The end_update() function uses the Item::save_org_in_field() function to
save original values of items into the group buffer. But for the 
Item_func_set_user_var this method was mapped to the save_in_field method.
The latter function wrongly decides to use the result_field. This leads to
saving incorrect value in the grouping buffer and wrong result of the whole
query.

The can_use_result_field argument of the bool type is added to the
Item_func_set_user_var::save_in_field() function. If it is set to FALSE
then the item's result field won't be used. Otherwise it will be detected
whether the result field will be used (old behaviour).
Two wrapping functions for the function above are added to the 
Item_func_set_user_var class:
the save_in_field(Field *field, bool no_conversions) - it calls the above
function with the can_use_result_field set to TRUE.
the save_org_in_field(Field *field) - same, but the can_use_result_field
is set to FALSE.

mysql-test/r/user_var.result

@@ -317,3 +317,10 @@ SHOW COUNT(*) WARNINGS;
 SHOW COUNT(*) ERRORS;
 @@session.error_count
 1
+create table t1(f1 int);
+insert into t1 values(1),(1),(2);
+select @a:=f1, count(f1) from t1 group by 1;
+@a:=f1	count(f1)
+1	2
+2	1
+drop table t1;

mysql-test/t/user_var.test

@@ -222,3 +222,11 @@ drop table t1,t2;
 insert into city 'blah';
 SHOW COUNT(*) WARNINGS;
 SHOW COUNT(*) ERRORS;
+
+#
+# Bug#28494: Grouping by Item_func_set_user_var produces incorrect result.
+#
+create table t1(f1 int);
+insert into t1 values(1),(1),(2);
+select @a:=f1, count(f1) from t1 group by 1;
+drop table t1;

sql/item_func.cc

@@ -4290,9 +4290,11 @@ void Item_func_set_user_var::make_field(Send_field *tmp_field)
     TRUE        Error
 */
 
-int Item_func_set_user_var::save_in_field(Field *field, bool no_conversions)
+int Item_func_set_user_var::save_in_field(Field *field, bool no_conversions,
+                                          bool can_use_result_field)
 {
-  bool use_result_field= (result_field && result_field != field);
+  bool use_result_field= (!can_use_result_field ? 0 :
+                          (result_field && result_field != field));
   int error;
 
   /* Update the value of the user variable */

sql/item_func.h

@@ -1220,7 +1220,13 @@ class Item_func_set_user_var :public Item_func
   void print(String *str);
   void print_as_stmt(String *str);
   const char *func_name() const { return "set_user_var"; }
-  int save_in_field(Field *field, bool no_conversions);
+  int save_in_field(Field *field, bool no_conversions,
+                    bool can_use_result_field);
+  int save_in_field(Field *field, bool no_conversions)
+  {
+    return save_in_field(field, no_conversions, 1);
+  }
+  void save_org_in_field(Field *field) { (void)save_in_field(field, 1, 0); }
 };