Bug #40625: Concat fails on DOUBLE values in a Stored

            Procedure, while DECIMAL works

Selecting of the CONCAT(...<SP variable>...) result into
a user variable may return wrong data.


Item_func_concat::val_str contains a number of memory
allocation-saving tricks. One of them concatenates
strings inplace inserting the value of one string
at the beginning of the other string. However,
this trick didn't care about strings those points
to the same data buffer: this is possible when
a CONCAT() parameter is a stored procedure variable -
Item_sp_variable::val_str() uses the intermediate
Item_sp_variable::str_value field, where it may
store a reference to an external buffer.


The Item_func_concat::val_str function has been
modified to take into account val_str functions
(such as Item_sp_variable::val_str) that return
a pointer to an internal Item member variable
that may reference to a buffer provided.

mysql-test/r/func_concat.result

@@ -130,4 +130,22 @@ SELECT @query;
 @query
 abcde,0,1234
 DROP PROCEDURE p1;
+#
+# Bug #40625: Concat fails on DOUBLE values in a Stored Procedure,
+#             while DECIMAL works
+#
+CREATE PROCEDURE p1()
+BEGIN
+DECLARE v1 DOUBLE(10,3);
+SET v1= 100;
+SET @s = CONCAT('########################################', 40 , v1);
+SELECT @s;
+END;//
+CALL p1();
+@s
+########################################40100.000
+CALL p1();
+@s
+########################################40100.000
+DROP PROCEDURE p1;
 # End of 5.1 tests

mysql-test/t/func_concat.test

@@ -124,4 +124,24 @@ SELECT @query;
 
 DROP PROCEDURE p1;
 
+--echo #
+--echo # Bug #40625: Concat fails on DOUBLE values in a Stored Procedure,
+--echo #             while DECIMAL works
+--echo #
+
+DELIMITER //;
+CREATE PROCEDURE p1()
+BEGIN
+  DECLARE v1 DOUBLE(10,3);
+  SET v1= 100;
+  SET @s = CONCAT('########################################', 40 , v1);
+  SELECT @s;
+END;//
+DELIMITER ;//
+
+CALL p1();
+CALL p1();
+
+DROP PROCEDURE p1;
+
 --echo # End of 5.1 tests

sql/item_strfunc.cc

@@ -324,7 +324,7 @@ String *Item_func_concat::val_str(String *str)
       }
       else if (str->alloced_length() >= res->length()+res2->length())
       {
-	if (str == res2)
+	if (str->ptr() == res2->ptr())
 	  str->replace(0,0,*res);
 	else
 	{