MDEV-26061 MariaDB server crash at Field::set_default

* Item_default_value::fix_fields creates a copy of its argument's field.
* Field::default_value is changed when its expression is prepared in
  unpack_vcol_info_from_frm()

This means we must unpack any vcol expression that includes DEFAULT(x)
strictly after unpacking x->default_value.

To avoid building and solving this dependency graph on every table open,
we update Item_default_value::field->default_value after all vcols
are unpacked and fixed.

mysql-test/r/check_constraint.result

@@ -235,3 +235,18 @@ a	b
 insert t1 (b) values (1);
 ERROR 23000: CONSTRAINT `CONSTRAINT_1` failed for `test`.`t1`
 drop table t1;
+#
+# MDEV-26061 MariaDB server crash at Field::set_default
+#
+create table t1 (v2 date check (v1 like default (v1)), v1 date default (from_days ('x')));
+Warnings:
+Warning	1292	Truncated incorrect INTEGER value: 'x'
+insert ignore into t1 values ( 'x' , 'x' ) ;
+Warnings:
+Warning	1265	Data truncated for column 'v2' at row 1
+Warning	1265	Data truncated for column 'v1' at row 1
+Warning	1292	Truncated incorrect INTEGER value: 'x'
+drop table t1;
+#
+# End of 10.2 tests
+#

mysql-test/t/check_constraint.test

@@ -176,3 +176,20 @@ select * from t1 where a is null;
 --error ER_CONSTRAINT_FAILED
 insert t1 (b) values (1);
 drop table t1;
+
+--echo #
+--echo # MDEV-26061 MariaDB server crash at Field::set_default
+--echo #
+
+create table t1 (v2 date check (v1 like default (v1)), v1 date default (from_days ('x')));
+insert ignore into t1 values ( 'x' , 'x' ) ;
+drop table t1;
+
+--echo #
+--echo # End of 10.2 tests
+--echo #
+
+# 10.3 test
+#create table t1 (d timestamp check (default (d) is true)) as select 1;
+#show create table t1;
+#drop table t1;

sql/item.cc

@@ -8976,6 +8976,12 @@ bool Item_default_value::eq(const Item *item, bool binary_cmp) const
 }
 
 
+bool Item_default_value::check_field_expression_processor(void *)
+{
+  field->default_value= ((Item_field *)(arg->real_item()))->field->default_value;
+  return 0;
+}
+
 bool Item_default_value::fix_fields(THD *thd, Item **items)
 {
   Item *real_arg;

sql/item.h

@@ -5507,6 +5507,7 @@ class Item_default_value : public Item_field
   Item *get_tmp_table_item(THD *thd) { return this; }
   Item_field *field_for_view_update() { return 0; }
   bool update_vcol_processor(void *arg) { return 0; }
+  bool check_field_expression_processor(void *arg);
   bool check_func_default_processor(void *arg) { return true; }
   bool enchant_default_with_arg_processor(void *arg);