Fixed mdev-15162 Query with CTE hangs if assignment operator (:=) is used

If setting user variable was used in the specification of a recursive CTE
then Item_func_set_user_var::fix_fields() went into an infinite loop.

Author: igorbabaev

mysql-test/r/cte_recursive.result

@@ -3079,3 +3079,16 @@ ERROR 21000: The used SELECT statements have a different number of columns
 DROP TABLE a_tbl;
 WITH RECURSIVE x AS (SELECT 1,2 UNION ALL SELECT 1 FROM x) SELECT * FROM x;
 ERROR 21000: The used SELECT statements have a different number of columns
+#
+# MDEV-15162: Setting user variable in recursive CTE
+#
+SET @c=1;
+WITH RECURSIVE cte AS
+(SELECT 5
+UNION
+SELECT @c:=@c+1 FROM cte WHERE @c<3)
+SELECT * FROM cte;
+5
+5
+2
+3

mysql-test/t/cte_recursive.test

@@ -2113,3 +2113,15 @@ DROP TABLE a_tbl;
 
 --error ER_WRONG_NUMBER_OF_COLUMNS_IN_SELECT
 WITH RECURSIVE x AS (SELECT 1,2 UNION ALL SELECT 1 FROM x) SELECT * FROM x;
+
+--echo #
+--echo # MDEV-15162: Setting user variable in recursive CTE
+--echo #
+
+SET @c=1;
+
+WITH RECURSIVE cte AS
+	(SELECT 5
+	UNION
+	SELECT @c:=@c+1 FROM cte WHERE @c<3)
+SELECT * FROM cte;

sql/item_func.cc

@@ -54,6 +54,7 @@
 #include "set_var.h"
 #include "debug_sync.h"
 #include "sql_base.h"
+#include "sql_cte.h"
 
 #ifdef NO_EMBEDDED_ACCESS_CHECKS
 #define sp_restore_security_context(A,B) while (0) {}
@@ -4514,10 +4515,13 @@ bool Item_func_set_user_var::fix_fields(THD *thd, Item **ref)
     TABLE_LIST *derived;
     for (derived= unit->derived;
          derived;
-         derived= derived->select_lex->master_unit()->derived)
+         derived= unit->derived)
     {
       derived->set_materialized_derived();
       derived->prohibit_cond_pushdown= true;
+      if (unit->with_element && unit->with_element->is_recursive)
+        break;
+      unit= derived->select_lex->master_unit();
     }
   }