Bug #25197 repeat function returns null when using table field directly as count

Description:
If a table field is passed directly to REPEAT function as count parameter, a 1301 warning is generated and the function in effect returns null.

The warning says "Result of repeat() was larger than max_allowed_packet (1048576) - truncated"

Tested on MyISAM, InnoDB, and Memory, all yields same result

I tried both PHP 4 (3.23.49) and mysql console (dunno how to get version...)

How to repeat:
CREATE TABLE `test` (
  `id` varchar(20) NOT NULL,
  `tire` tinyint(3) unsigned NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

INSERT INTO `test` (`id`, `tire`) VALUES ('A', 0),('B', 1),('C', 2);

SELECT REPEAT( '#', tire ) AS A, REPEAT( '#', tire % 999 ) AS B, tire FROM `test`;

Result:

+------+------+------+
| A    | B    | tire |
+------+------+------+
| NULL |      |    0 |
| NULL | #    |    1 |
| NULL | ##   |    2 |
+------+------+------+
3 rows in set, 3 warnings (0.00 sec)

mysql> show warnings;
+---------+------+-----------------------------------------------------------------------------+
| Level   | Code | Message                                                                     |
+---------+------+-----------------------------------------------------------------------------+
| Warning | 1301 | Result of repeat() was larger than max_allowed_packet (1048576) - truncated |
| Warning | 1301 | Result of repeat() was larger than max_allowed_packet (1048576) - truncated |
| Warning | 1301 | Result of repeat() was larger than max_allowed_packet (1048576) - truncated |
+---------+------+-----------------------------------------------------------------------------+

Suggested fix:
Workaround: Modifying the statement so that table field is not used directly as parameter, even after optimization.  See test case for example.

mysqltest test case

Attachment: bug25197.tgz (application/x-gtar, text), 945 bytes.

Program received signal SIGFPE, Arithmetic exception.
0x08161ca2 in Item_func_repeat::val_str (this=0x95e0608, str=0xb7df2f5c)
    at item_strfunc.cc:2264
2264      if (length > current_thd->variables.max_allowed_packet / (uint) count)
(gdb) p count
$5 = 0

It seem like this only happens for unsigned fields with the value 0

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/19487

ChangeSet@1.2407, 2007-02-07 15:03:56+01:00, msvensson@pilot.mysql.com +3 -0
  Bug#25197 repeat function returns null when using table field directly as count
   - Return empty string also if count is unsigned and value is 0

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/20443

ChangeSet@1.2407, 2007-02-23 10:28:50+01:00, msvensson@pilot.blaudden +3 -0
  Bug#25197 repeat function returns null when using table field directly as count
   - Return empty string also if count is unsigned and value is 0

pushed to 5.0.38, 5.1.17

Noted in 5.0.38, 5.1.17 changelogs.

The REPEAT() function did not allow a column name as the count
parameter.

The patch also has fixed bug#27073 (another manifestation of the same problem).

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/23104

ChangeSet@1.2408, 2007-03-28 09:32:49+02:00, msvensson@pilot.blaudden +3 -0
  Bug#25197 repeat function returns null when using table field directly as count
   - Add extra test case from bug#27073
   - Change "if" to be optimized for count > 0

Bug 27514 was marked as a duplicate of this one.

Pushed into 5.0.40

Pushed into 5.1.18-beta