From 5f978e739a8d29f1a6eab96c0881ef1187799358 Mon Sep 17 00:00:00 2001
From: KhaledR57 <khaled57.dev@gmail.com>
Date: Tue, 25 Aug 2026 17:07:09 +0300
Subject: [PATCH] MDEV-32383 Server crashes in Item_func_match::init_search on
 2nd execution of PS

Item_func_match::master points at an equal MATCH item that owns the
shared ft_handler. setup_ftfuncs() sets it only when it is still unset,
and cleanup() never reset it.

A mergeable view is merged once. On re-execution mysql_derived_prepare()
returns early because TABLE_LIST::merged is set, so the view's own MATCH
item is never re-fixed and keeps the NULL table left by cleanup().
init_ftfuncs() skips unfixed items in ftfunc_list, but init_search()
follows master without that check and dereferenced the NULL table.

Reset master in cleanup(), after the ft_handler ownership check that
reads it, so the link is rebuilt from scratch on every execution.
---
 mysql-test/main/fulltext.result | 21 +++++++++++++++++++++
 mysql-test/main/fulltext.test   | 25 +++++++++++++++++++++++++
 sql/item_func.h                 |  1 +
 3 files changed, 47 insertions(+)

diff --git a/mysql-test/main/fulltext.result b/mysql-test/main/fulltext.result
index 233dd549aae3f..0d3b54978ad22 100644
--- a/mysql-test/main/fulltext.result
+++ b/mysql-test/main/fulltext.result
@@ -788,3 +788,24 @@ CREATE TEMPORARY TABLE tmp (a TEXT) ENGINE=Aria;
 ALTER TABLE tmp ADD FULLTEXT (a);
 INSERT INTO tmp VALUES ('foo');
 DROP TABLE tmp;
+#
+# MDEV-32383 Server crashes in Item_func_match::init_search on 2nd execution of PS
+#
+CREATE TABLE t (a VARCHAR(255), FULLTEXT(a));
+INSERT INTO t VALUES ('foo'),('bar');
+CREATE VIEW v AS
+SELECT MATCH (a) AGAINST ('MariaDB' IN NATURAL LANGUAGE MODE) AS f
+FROM t
+WHERE MATCH (a) AGAINST ('MariaDB' IN NATURAL LANGUAGE MODE) > 0
+ORDER BY f;
+PREPARE stmt FROM "SELECT f FROM v ORDER BY f";
+EXECUTE stmt;
+f
+EXECUTE stmt;
+f
+DEALLOCATE PREPARE stmt;
+DROP VIEW v;
+DROP TABLE t;
+#
+# End of 10.11 tests
+#
diff --git a/mysql-test/main/fulltext.test b/mysql-test/main/fulltext.test
index 09d241907d70e..85858e7b3d627 100644
--- a/mysql-test/main/fulltext.test
+++ b/mysql-test/main/fulltext.test
@@ -736,3 +736,28 @@ CREATE TEMPORARY TABLE tmp (a TEXT) ENGINE=Aria;
 ALTER TABLE tmp ADD FULLTEXT (a);
 INSERT INTO tmp VALUES ('foo');
 DROP TABLE tmp;
+
+--echo #
+--echo # MDEV-32383 Server crashes in Item_func_match::init_search on 2nd execution of PS
+--echo #
+
+CREATE TABLE t (a VARCHAR(255), FULLTEXT(a));
+INSERT INTO t VALUES ('foo'),('bar');
+
+CREATE VIEW v AS
+  SELECT MATCH (a) AGAINST ('MariaDB' IN NATURAL LANGUAGE MODE) AS f
+  FROM t
+  WHERE MATCH (a) AGAINST ('MariaDB' IN NATURAL LANGUAGE MODE) > 0
+  ORDER BY f;
+
+PREPARE stmt FROM "SELECT f FROM v ORDER BY f";
+EXECUTE stmt;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;
+
+DROP VIEW v;
+DROP TABLE t;
+
+--echo #
+--echo # End of 10.11 tests
+--echo #
diff --git a/sql/item_func.h b/sql/item_func.h
index c668bbfe76826..1cbe08b6b680e 100644
--- a/sql/item_func.h
+++ b/sql/item_func.h
@@ -3851,6 +3851,7 @@ class Item_func_match :public Item_real_func
     ft_handler= 0;
     concat_ws= 0;
     table= 0;           // required by Item_func_match::eq()
+    master= 0;
     DBUG_VOID_RETURN;
   }
   bool is_expensive_processor(void *arg) override { return TRUE; }