MDEV-15180: server crashed with NTH_VALUE()

fix_fields for the arguments of the NTH_VALUE function was updating the same reference,
so for the second argument (or after the first argument) the items were not resolved
to their corresponding field from the view as they were updating the reference to the
first argument.

mysql-test/r/win.result

@@ -3850,5 +3850,21 @@ ERROR 42000: Too big scale 56 specified for 'rank() over w1'. Maximum is 38
 SELECT cast((rank() over w1) as decimal (53,30));
 ERROR HY000: Window specification with name 'w1' is not defined
 #
+# MDEV-15180: server crashed with NTH_VALUE()
+#
+CREATE TABLE t1 (i1 int, a int);
+INSERT INTO t1 VALUES (1, 1), (2, 2),(3, 3);
+CREATE TABLE t2 (i2 int);
+INSERT INTO t2 VALUES (1),(2),(5),(1),(7),(4),(3);
+CREATE VIEW v1 AS (SELECT * FROM t1,t2 WHERE t1.i1=t2.i2) ;
+SELECT NTH_VALUE(i1, i1) OVER (PARTITION BY i1) FROM v1;
+NTH_VALUE(i1, i1) OVER (PARTITION BY i1)
+1
+1
+NULL
+NULL
+DROP VIEW v1;
+DROP TABLE t1,t2;
+#
 # End of 10.2 tests
 #

mysql-test/t/win.test

@@ -2506,6 +2506,22 @@ SELECT cast((rank() over w1) as decimal (53,56));
 --error ER_WRONG_WINDOW_SPEC_NAME
 SELECT cast((rank() over w1) as decimal (53,30));
 
+--echo #
+--echo # MDEV-15180: server crashed with NTH_VALUE()
+--echo #
+
+CREATE TABLE t1 (i1 int, a int);
+INSERT INTO t1 VALUES (1, 1), (2, 2),(3, 3);
+
+CREATE TABLE t2 (i2 int);
+INSERT INTO t2 VALUES (1),(2),(5),(1),(7),(4),(3);
+
+CREATE VIEW v1 AS (SELECT * FROM t1,t2 WHERE t1.i1=t2.i2) ;
+SELECT NTH_VALUE(i1, i1) OVER (PARTITION BY i1) FROM v1;
+
+DROP VIEW v1;
+DROP TABLE t1,t2;
+
 --echo #
 --echo # End of 10.2 tests
 --echo #

sql/item_windowfunc.cc

@@ -234,7 +234,7 @@ bool Item_sum_hybrid_simple::fix_fields(THD *thd, Item **ref)
   {
     Item *item= args[i];
     // 'item' can be changed during fix_fields
-    if ((!item->fixed && item->fix_fields(thd, args)) ||
+    if ((!item->fixed && item->fix_fields(thd, args + i)) ||
         (item= args[i])->check_cols(1))
       return TRUE;
     with_window_func|= item->with_window_func;