CURSOR_TYPE_READ_ONLY select within select".
The bug was caused by the reset of thd->mem_root to thd->main_mem_root in 
Item_subselect::exec, which in turn triggered too early free_root() for
data which was needed on subsequent fetches from a cursor.
This reset also caused a memory leak in stored procedures, as 
subsequent executions of instructions containing a subselect
were allocating memory in thd->main_mem_root, which is not freed
until the end of the entire SP, instead of the per-call mem_root,
which is freed in the end of execution of the instruction.


sql/item_subselect.cc:
  Don't try to protect subqueries from the code that assumes that
  it can reset thd->mem_root and get away with it: it's responsibility
  of the caller to ensure that no assumption about the life span
  of the allocated memory made by the called code is broken.
  Besides, this didn't work well with cursors and stored procedures, 
  where the runtime memory root is not the same as &thd->main_mem_root.
sql/opt_range.cc:
  In get_mm_leaf restore the original mem_root of the thd which has
  been temporarily reset with the quick select mem_root earlier: if 
  thd->mem_root points to the QUICK...::mem_root, the memory allocated
  in JOIN::exec during evaluation of a subquery gets freed too early.
tests/mysql_client_test.c:
  A test case for Bug#10736 "mysql_stmt_attr_set CURSOR_TYPE_READ_ONLY
   select within select"