MDEV-6868: MariaDB server crash ( select with union and order by with subquery )

Excluding ORDER BY condition should be done after preparation it (even to catch syntax errors).

mysql-test/r/union.result

@@ -1935,3 +1935,23 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 3	UNION	t1	ALL	NULL	NULL	NULL	NULL	4	
 NULL	UNION RESULT	<union2,3>	ALL	NULL	NULL	NULL	NULL	NULL	
 drop table t1;
+#
+# MDEV-6868:MariaDB  server crash ( select with union and order by
+# with subquery )
+#
+CREATE TABLE t1 ( id INTEGER, sample_name1 VARCHAR(100), sample_name2 VARCHAR(100), PRIMARY KEY(id) );
+INSERT INTO t1 ( id, sample_name1, sample_name2 ) VALUES ( 1, 'aaaa', 'bbbb' ), ( 2, 'cccc', 'dddd' );
+(
+SELECT sample_name1 AS testname FROM t1
+)
+UNION
+(
+SELECT sample_name2 AS testname FROM t1 C ORDER BY (SELECT T.sample_name1 FROM t1 T WHERE T.id = C.id)
+)
+;
+testname
+aaaa
+cccc
+bbbb
+dddd
+drop table t1;

mysql-test/t/union.test

@@ -1330,3 +1330,23 @@ create table t1 (a int);
 insert t1 values (1),(2),(3),(1);
 explain select 1 from dual where exists (select max(a) from t1 group by a union select a+2 from t1);
 drop table t1;
+
+--echo #
+--echo # MDEV-6868:MariaDB  server crash ( select with union and order by
+--echo # with subquery )
+--echo #
+
+CREATE TABLE t1 ( id INTEGER, sample_name1 VARCHAR(100), sample_name2 VARCHAR(100), PRIMARY KEY(id) );
+					
+INSERT INTO t1 ( id, sample_name1, sample_name2 ) VALUES ( 1, 'aaaa', 'bbbb' ), ( 2, 'cccc', 'dddd' );
+										
+(
+	SELECT sample_name1 AS testname FROM t1
+)
+UNION
+(
+	SELECT sample_name2 AS testname FROM t1 C ORDER BY (SELECT T.sample_name1 FROM t1 T WHERE T.id = C.id)
+)
+;
+
+drop table t1;

sql/sql_union.cc

@@ -315,18 +315,6 @@ bool st_select_lex_unit::prepare(THD *thd_arg, select_result *sel_result,
 
     can_skip_order_by= is_union_select && !(sl->braces && sl->explicit_limit);
 
-    /*
-      Remove all references from the select_lex_units to the subqueries that
-      are inside the ORDER BY clause.
-    */
-    if (can_skip_order_by)
-    {
-      for (ORDER *ord= (ORDER *)sl->order_list.first; ord; ord= ord->next)
-      {
-        (*ord->item)->walk(&Item::eliminate_subselect_processor, FALSE, NULL);
-      }
-    }
-
     saved_error= join->prepare(&sl->ref_pointer_array,
                                sl->table_list.first,
                                sl->with_wild,
@@ -349,6 +337,18 @@ bool st_select_lex_unit::prepare(THD *thd_arg, select_result *sel_result,
 
     if (saved_error || (saved_error= thd_arg->is_fatal_error))
       goto err;
+    /*
+      Remove all references from the select_lex_units to the subqueries that
+      are inside the ORDER BY clause.
+    */
+    if (can_skip_order_by)
+    {
+      for (ORDER *ord= (ORDER *)sl->order_list.first; ord; ord= ord->next)
+      {
+        (*ord->item)->walk(&Item::eliminate_subselect_processor, FALSE, NULL);
+      }
+    }
+
     /*
       Use items list of underlaid select for derived tables to preserve
       information about fields lengths and exact types