Bug#13519724 63793: CRASH IN DTCOLLATION::SET(DTCOLLATION &SET)

Backport of fix for:
Bug#53236 Segfault in DTCollation::set(DTCollation&)

Author: Tor Didriksen

mysql-test/r/cast.result

@@ -468,4 +468,13 @@ NULL
 Warnings:
 Warning	1301	Result of cast_as_char() was larger than max_allowed_packet (2048) - truncated
 SET @@GLOBAL.max_allowed_packet=default;
+#
+# Bug#13519724 63793: CRASH IN DTCOLLATION::SET(DTCOLLATION &SET)
+#
+CREATE TABLE t1 (a VARCHAR(50));
+SELECT a FROM t1 
+WHERE CAST(a as BINARY)=x'62736D697468' 
+AND CAST(a AS BINARY)=x'65736D697468';
+a
+DROP TABLE t1;
 End of 5.1 tests

mysql-test/t/cast.test

@@ -297,4 +297,16 @@ connection default;
 disconnect newconn;
 SET @@GLOBAL.max_allowed_packet=default;
 
+--echo #
+--echo # Bug#13519724 63793: CRASH IN DTCOLLATION::SET(DTCOLLATION &SET)
+--echo #
+
+CREATE TABLE t1 (a VARCHAR(50));
+
+SELECT a FROM t1 
+WHERE CAST(a as BINARY)=x'62736D697468' 
+  AND CAST(a AS BINARY)=x'65736D697468';
+
+DROP TABLE t1;
+
 --echo End of 5.1 tests

sql/sql_select.cc

@@ -8546,10 +8546,10 @@ change_cond_ref_to_const(THD *thd, I_List<COND_CMP> *save_list,
        left_item->collation.collation == value->collation.collation))
   {
     Item *tmp=value->clone_item();
-    tmp->collation.set(right_item->collation);
 
     if (tmp)
     {
+      tmp->collation.set(right_item->collation);
       thd->change_item_tree(args + 1, tmp);
       func->update_used_tables();
       if ((functype == Item_func::EQ_FUNC || functype == Item_func::EQUAL_FUNC)
@@ -8570,10 +8570,10 @@ change_cond_ref_to_const(THD *thd, I_List<COND_CMP> *save_list,
             right_item->collation.collation == value->collation.collation))
   {
     Item *tmp= value->clone_item();
-    tmp->collation.set(left_item->collation);
 
     if (tmp)
     {
+      tmp->collation.set(left_item->collation);
       thd->change_item_tree(args, tmp);
       value= tmp;
       func->update_used_tables();