Bug #36737 having + full text operator crashes mysql

Description:
Tested on 5.0.45 and 5.1.24
Server crashes when using MATCH() AGAINST() in HAVING clause on GROUP_CONCAT()-anated field

How to repeat:
CREATE TABLE `kw_names` (
  `id` MEDIUMINT(9) UNSIGNED NOT NULL AUTO_INCREMENT,
  `name` VARCHAR(100) COLLATE utf8_general_ci NOT NULL DEFAULT '',
  PRIMARY KEY (`id`),
  UNIQUE KEY `name_unique` (`name`),
  FULLTEXT KEY `ft_name` (`name`)
)ENGINE=MyISAM AUTO_INCREMENT=1952 CHARACTER SET 'utf8' COLLATE 'utf8_general_ci';

SELECT GROUP_CONCAT(DISTINCT kn.name SEPARATOR " ") AS st
FROM kw_names AS kn
WHERE MATCH (kn.name) AGAINST ("festival" IN BOOLEAN MODE)
GROUP BY kn.id
HAVING MATCH(st) AGAINST('festival' IN BOOLEAN MODE);

Thank you for a bug report. Verified just as described with 5.1.24 on Windows XP. Stack trace is:

 	mysqld.exe!Item_func_match::fix_fields(THD * thd=0x05619308, Item * * ref=0x05633e48)  Line 4984	C++
 	mysqld.exe!JOIN::prepare(Item * * * rref_pointer_array=0x0561a6dc, TABLE_LIST * tables_init=0x056326e0, unsigned int wild_num=0, Item * conds_init=0x056329f8, unsigned int og_num=1, st_order * order_init=0x00000000, st_order * group_init=0x05632b70, Item * having_init=0x05632cb8, st_order * proc_param_init=0x00000000, st_select_lex * select_lex_arg=0x0561a5e0, st_select_lex_unit * unit_arg=0x0561a368)  Line 505 + 0x17 bytes	C++
 	mysqld.exe!mysql_select(THD * thd=0x05619308, Item * * * rref_pointer_array=0x0561a6dc, TABLE_LIST * tables=0x056326e0, unsigned int wild_num=0, List<Item> & fields={...}, Item * conds=0x056329f8, unsigned int og_num=1, st_order * order=0x00000000, st_order * group=0x05632b70, Item * having=0x05632cb8, st_order * proc_param=0x00000000, unsigned __int64 select_options=2147764736, select_result * result=0x05632df0, st_select_lex_unit * unit=0x0561a368, st_select_lex * select_lex=0x0561a5e0)  Line 2336 + 0x49 bytes	C++
 	mysqld.exe!handle_select(THD * thd=0x05619308, st_lex * lex=0x0561a308, select_result * result=0x05632df0, unsigned long setup_tables_done_option=0)  Line 269 + 0x79 bytes	C++
 	mysqld.exe!execute_sqlcom_select(THD * thd=0x00000000, TABLE_LIST * all_tables=0x056326e0)  Line 4752 + 0xa bytes	C++
 	mysqld.exe!mysql_execute_command(THD * thd=0x05619308)  Line 2052 + 0xc bytes	C++
 	mysqld.exe!mysql_parse(THD * thd=0x05619308, const char * inBuf=0x05632180, unsigned int length=204, const char * * found_semicolon=0x04b1f9e8)  Line 5634	C++
 	mysqld.exe!dispatch_command(enum_server_command command=COM_QUERY, THD * thd=0x05619308, char * packet=0x05814de1, unsigned int packet_length=204)  Line 1123	C++
 	mysqld.exe!do_command(THD * thd=0x00000003)  Line 781 + 0xf bytes	C++
 	mysqld.exe!handle_one_connection(void * arg=0x05619308)  Line 1115 + 0x6 bytes	C++
 	mysqld.exe!pthread_start(void * param=0x02351e50)  Line 85 + 0x3 bytes	C
>	mysqld.exe!_threadstart(void * ptd=0x02344f70)  Line 196 + 0x6 bytes	C
 	kernel32.dll!7c80b683() 	
 	[Frames below may be incorrect and/or missing, no symbols loaded for kernel32.dll]

5.0.60 also crashes.

Bug #36738 was marked as duplicate of this one.

Simplified test case:
CREATE TABLE t1(a TEXT);
SELECT GROUP_CONCAT(a) AS st FROM t1 HAVING MATCH(st) AGAINST('test' IN BOOLEAN MODE);

IIRC MATCH() accepts _column_ list as arguments. In our case it gets result from GROUP_CONCAT() function. This statement should be considered as invalid.

It will be a one line fix to resolve this issue, thus R2/E2.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/64428

2754 Sergey Vojtovich	2009-01-29
      BUG#36737 - having + full text operator crashes mysql
      
      MATCH() function accepts column list as an argument. It was possible to override
      this requirement with aliased non-column select expression. Which results in
      server crash.
      
      With this fix aliased non-column select expressions are not accepted by MATCH()
      function, returning an error.

A patch for this bug has been committed. After review, it may
be pushed to the relevant source trees for release in the next
version. You can access the patch from:

  http://lists.mysql.com/commits/66018

2742 Sergey Vojtovich	2009-02-12
      BUG#36737 - having + full text operator crashes mysql
            
      MATCH() function accepts column list as an argument. It was possible to override
      this requirement with aliased non-column select expression. Which results in
      server crash.
      
      With this fix aliased non-column select expressions are not accepted by MATCH()
      function, returning an error.

Pushed into 6.0.10-alpha (revid:sergey.glukhov@sun.com-20090218125737-5y5b2xo3duo1wlvo) (version source revid:azundris@mysql.com-20090213182753-tsqikd41gkwowrqq) (merge vers: 6.0.10-alpha) (pib:6)

Noted in 6.0.10 changelog.

An argument to the MATCH() function that was an alias for an
expression other than a column name caused a server crash.

Setting report to NDI pending push into 5.0.x/5.1.x.

Pushed into 5.0.79 (revid:joro@sun.com-20090309135922-a0di9ebkxoj4d4wv) (version source revid:matthias.leich@sun.com-20090213125529-oznlhyq5c50ej39f) (merge vers: 5.0.79) (pib:6)

Noted in 5.0.79 changelog.

Setting report to NDI pending push into 5.1.x.

Pushed into 5.1.33 (revid:joro@sun.com-20090313111355-7bsi1hgkvrg8pdds) (version source revid:vvaintroub@mysql.com-20090218093153-sjzxf01i4ezte0xp) (merge vers: 5.1.33) (pib:6)

Noted in 5.1.33 changelog.

Pushed into 5.1.34-ndb-6.2.18 (revid:jonas@mysql.com-20090508185236-p9b3as7qyauybefl) (version source revid:jonas@mysql.com-20090508100057-30ote4xggi4nq14v) (merge vers: 5.1.33-ndb-6.2.18) (pib:6)

Pushed into 5.1.34-ndb-6.3.25 (revid:jonas@mysql.com-20090509063138-1u3q3v09wnn2txyt) (version source revid:jonas@mysql.com-20090508175813-s6yele2z3oh6o99z) (merge vers: 5.1.33-ndb-6.3.25) (pib:6)

Pushed into 5.1.34-ndb-7.0.6 (revid:jonas@mysql.com-20090509154927-im9a7g846c6u1hzc) (version source revid:jonas@mysql.com-20090509073226-09bljakh9eppogec) (merge vers: 5.1.33-ndb-7.0.6) (pib:6)