a simpler fix for

MySQL Bug #12408412: GROUP_CONCAT + ORDER BY + INPUT/OUTPUT SAME USER VARIABLE = CRASH
and
MySQL Bug#14664077 SEVERE PERFORMANCE DEGRADATION IN SOME CASES WHEN USER VARIABLES ARE USED


sql/item_func.cc:
  don't use anything from Item_func_set_user_var::fix_fields()
  in Item_func_set_user_var::save_item_result()
sql/sql_class.cc:
  Call suv->save_item_result(item) *before* doing suv->fix_fields(), because
  the former evaluates the item (and caches its value), while the latter marks
  the user variable as non-const. The problem is that the item was fix_field'ed
  when the user variable was const, and it doesn't expect it to change to non-const
  in the middle of the execution.

mysql-test/r/user_var.result

@@ -456,4 +456,6 @@ SELECT (@v:=a) <> (@v:=1) FROM t1;
 (@v:=a) <> (@v:=1)
 1
 DROP TABLE t1;
+SET @bug12408412=1;
+SELECT GROUP_CONCAT(@bug12408412 ORDER BY 1) INTO @bug12408412;
 End of 5.1 tests

mysql-test/t/user_var.test

@@ -365,4 +365,12 @@ SELECT (@v:=a) <> (@v:=1) FROM t1;
 
 DROP TABLE t1;
 
+#
+# Bug #12408412: GROUP_CONCAT + ORDER BY + INPUT/OUTPUT
+#   SAME USER VARIABLE = CRASH
+#
+SET @bug12408412=1;
+SELECT GROUP_CONCAT(@bug12408412 ORDER BY 1) INTO @bug12408412;
+
 --echo End of 5.1 tests
+

sql/item_func.cc

@@ -4175,7 +4175,7 @@ void Item_func_set_user_var::save_item_result(Item *item)
 {
   DBUG_ENTER("Item_func_set_user_var::save_item_result");
 
-  switch (cached_result_type) {
+  switch (args[0]->result_type()) {
   case REAL_RESULT:
     save_result.vreal= item->val_result();
     break;

sql/sql_class.cc

@@ -2922,9 +2922,9 @@ int select_dumpvar::send_data(List<Item> &items)
     else
     {
       Item_func_set_user_var *suv= new Item_func_set_user_var(mv->s, item);
+      suv->save_item_result(item);
       if (suv->fix_fields(thd, 0))
         DBUG_RETURN (1);
-      suv->save_item_result(item);
       if (suv->update())
         DBUG_RETURN (1);
     }