Bug #39002: The server crashes on the query:

  INSERT .. SELECT .. ON DUPLICATE KEY UPDATE col=DEFAULT

In order to get correct values from update fields that
belongs to the SELECT part in the INSERT .. SELECT .. ON
DUPLICATE KEY UPDATE statement, the server adds referenced
fields to the select list. Part of the code that does this
transformation is shared between implementations of
the DEFAULT(col) function and the DEFAULT keyword (in
the col=DEFAULT expression), and an implementation of
the DEFAULT keyword is incomplete.

mysql-test/r/default.result

@@ -205,4 +205,19 @@ Warnings:
 Warning	1364	Field 'id' doesn't have a default value
 drop view v1;
 drop table t1;
+create table t1 (a int unique);
+create table t2 (b int default 10);
+insert into t1 (a) values (1);
+insert into t2 (b) values (1);
+insert into t1 (a) select b from t2 on duplicate key update a=default;
+select * from t1;
+a
+NULL
+insert into t1 (a) values (1);
+insert into t1 (a) select b from t2 on duplicate key update a=default(b);
+select * from t1;
+a
+NULL
+10
+drop table t1, t2;
 End of 5.0 tests.

mysql-test/t/default.test

@@ -145,5 +145,24 @@ insert into t1 values(default);
 drop view v1;
 drop table t1;
 
+#
+# Bug #39002: crash with
+#             INSERT ... SELECT ... ON DUPLICATE KEY UPDATE col=DEFAULT
+#
+
+create table t1 (a int unique);
+create table t2 (b int default 10);
+insert into t1 (a) values (1);
+insert into t2 (b) values (1);
+
+insert into t1 (a) select b from t2 on duplicate key update a=default;
+select * from t1;
+
+insert into t1 (a) values (1);
+insert into t1 (a) select b from t2 on duplicate key update a=default(b);
+select * from t1;
+
+drop table t1, t2;
+
 --echo End of 5.0 tests.
 

sql/item.cc

@@ -6039,6 +6039,13 @@ Item *Item_default_value::transform(Item_transformer transformer, byte *args)
 {
   DBUG_ASSERT(!current_thd->is_stmt_prepare());
 
+  /*
+    If the value of arg is NULL, then this object represents a constant,
+    so further transformation is unnecessary (and impossible).
+  */
+  if (!arg)
+    return 0;
+
   Item *new_item= arg->transform(transformer, args);
   if (!new_item)
     return 0;