diff --git a/README.md b/README.md
index e123e5b64c9..f4fab1bd3a3 100644
--- a/README.md
+++ b/README.md
@@ -1,9 +1,8 @@
-Code status:
-------------
+# Code status:
 
 * [![Appveyor CI status](https://ci.appveyor.com/api/projects/status/4u6pexmtpuf8jq66?svg=true)](https://ci.appveyor.com/project/rasmushoj/server) ci.appveyor.com
 
-## MariaDB: The innovative open source database 
+## MariaDB: The innovative open source database
 
 MariaDB was designed as a drop-in replacement of MySQL(R) with more
 features, new storage engines, fewer bugs, and better performance.
@@ -33,20 +32,19 @@ https://mariadb.com/kb/en/mariadb-versus-mysql-compatibility/
 
 https://mariadb.com/kb/en/new-and-old-releases/
 
-Getting the code, building it and testing it
----------------------------------------------------------------
+# Getting the code, building it and testing it
 
-Refer to the following guide: https://mariadb.org/get-involved/getting-started-for-developers/get-code-build-test/ which outlines how to correctly build the source code and run the MariaDB testing framework.
+Refer to the following guide: https://mariadb.org/get-involved/getting-started-for-developers/get-code-build-test/
+which outlines how to build the source code correctly and run the MariaDB testing framework,
+as well as which branch to target for your contributions.
 
-Help
------
+# Help
 
 More help is available from the Maria Discuss mailing list
 https://lists.mariadb.org/postorius/lists/discuss.lists.mariadb.org/ and MariaDB's Zulip
-instance, https://mariadb.zulipchat.com/ 
+instance, https://mariadb.zulipchat.com/
 
-Licensing
----------
+# Licensing
 
 ***************************************************************************
 
@@ -60,8 +58,7 @@ license information can be found in the THIRDPARTY file.
 
 ***************************************************************************
 
-Bug Reports
-------------
+# Bug Reports
 
 Bug and/or error reports regarding MariaDB should be submitted at:
 https://jira.mariadb.org
diff --git a/client/mysqladmin.cc b/client/mysqladmin.cc
index dd57ac68df3..0859ca75a55 100644
--- a/client/mysqladmin.cc
+++ b/client/mysqladmin.cc
@@ -451,7 +451,7 @@ int main(int argc,char *argv[])
       is given a t!=0, we get an endless loop, or n iterations if --count=n
       was given an n!=0. If --sleep wasn't given, we get one iteration.
 
-      To wit, --wait loops the connection-attempts, while --sleep loops
+      To wait, --wait loops the connection-attempts, while --sleep loops
       the command execution (endlessly if no --count is given).
     */
 
diff --git a/client/mysqldump.c b/client/mysqldump.c
index 820767f0a6d..d98ea78302f 100644
--- a/client/mysqldump.c
+++ b/client/mysqldump.c
@@ -5993,7 +5993,7 @@ static int dump_selected_tables(char *db, char **table_names, int tables)
         free_root(&glob_root, MYF(0));
       }
       maybe_die(EX_ILLEGAL_TABLE, "Couldn't find table: \"%s\"", *table_names);
-      /* We shall countinue here, if --force was given */
+      /* We shall continue here, if --force was given */
     }
   }
   end= pos;
@@ -6014,7 +6014,7 @@ static int dump_selected_tables(char *db, char **table_names, int tables)
         free_root(&glob_root, MYF(0));
       }
       DB_error(mysql, "when doing LOCK TABLES");
-       /* We shall countinue here, if --force was given */
+       /* We shall continue here, if --force was given */
     }
   }
   dynstr_free(&lock_tables_query);
@@ -6026,7 +6026,7 @@ static int dump_selected_tables(char *db, char **table_names, int tables)
         free_root(&glob_root, MYF(0));
       DB_error(mysql, "when doing refresh");
     }
-     /* We shall countinue here, if --force was given */
+     /* We shall continue here, if --force was given */
     else
       verbose_msg("-- dump_selected_tables : logs flushed successfully!\n");
   }
diff --git a/client/mysqlimport.c b/client/mysqlimport.c
index fc96b767780..1c3c54f95e0 100644
--- a/client/mysqlimport.c
+++ b/client/mysqlimport.c
@@ -429,7 +429,7 @@ static void lock_table(MYSQL *mysql, int tablecount, char **raw_tablename)
     dynstr_append(&query, " WRITE,");
   }
   if (mysql_real_query(mysql, query.str, (ulong)query.length-1))
-    db_error(mysql); /* We shall countinue here, if --force was given */
+    db_error(mysql); /* We shall continue here, if --force was given */
 }
 
 
@@ -631,7 +631,7 @@ pthread_handler_t worker_thread(void *arg)
 
   if (mysql_query(mysql, "/*!40101 set @@character_set_database=binary */;"))
   {
-    db_error(mysql); /* We shall countinue here, if --force was given */
+    db_error(mysql); /* We shall continue here, if --force was given */
     goto error;
   }
 
@@ -759,12 +759,12 @@ int main(int argc, char **argv)
     if (!(mysql= db_connect(current_host,current_db,current_user,opt_password)))
     {
       free_defaults(argv_to_free);
-      return(1); /* purecov: deadcode */
+      return(1); /* purecov: dead code */
     }
 
     if (mysql_query(mysql, "/*!40101 set @@character_set_database=binary */;"))
     {
-      db_error(mysql); /* We shall countinue here, if --force was given */
+      db_error(mysql); /* We shall continue here, if --force was given */
       return(1);
     }
 
diff --git a/cmake/maintainer.cmake b/cmake/maintainer.cmake
index dfc725c36b9..5143e745ac6 100644
--- a/cmake/maintainer.cmake
+++ b/cmake/maintainer.cmake
@@ -44,7 +44,7 @@ FOREACH(F ${MY_WARNING_FLAGS})
   MY_CHECK_AND_SET_COMPILER_FLAG(${F} DEBUG RELWITHDEBINFO)
 ENDFOREACH()
 
-SET(MY_ERROR_FLAGS -Werror)
+SET(MY_ERROR_FLAGS -Werror -fno-operator-names)
 
 IF(CMAKE_COMPILER_IS_GNUCC AND CMAKE_C_COMPILER_VERSION VERSION_LESS "6.0.0")
   SET(MY_ERROR_FLAGS ${MY_ERROR_FLAGS} -Wno-error=maybe-uninitialized)
diff --git a/extra/mariabackup/backup_copy.cc b/extra/mariabackup/backup_copy.cc
index e60f6455e1e..7857c62bc2a 100644
--- a/extra/mariabackup/backup_copy.cc
+++ b/extra/mariabackup/backup_copy.cc
@@ -901,14 +901,14 @@ bool is_system_table(const char *dbname, const char *tablename)
 	DBUG_ASSERT(dbname);
 	DBUG_ASSERT(tablename);
 
-	LEX_CSTRING lex_dbname;
-	LEX_CSTRING lex_tablename;
+	Lex_ident_db lex_dbname;
+	Lex_ident_table lex_tablename;
 	lex_dbname.str = dbname;
 	lex_dbname.length = strlen(dbname);
 	lex_tablename.str = tablename;
 	lex_tablename.length = strlen(tablename);
 
-	TABLE_CATEGORY tg = get_table_category(&lex_dbname, &lex_tablename);
+	TABLE_CATEGORY tg = get_table_category(lex_dbname, lex_tablename);
 
 	return (tg == TABLE_CATEGORY_LOG) || (tg == TABLE_CATEGORY_SYSTEM);
 }
diff --git a/extra/mariabackup/xtrabackup.cc b/extra/mariabackup/xtrabackup.cc
index 190bf6f6de6..b5297fc67b7 100644
--- a/extra/mariabackup/xtrabackup.cc
+++ b/extra/mariabackup/xtrabackup.cc
@@ -6996,7 +6996,7 @@ static bool check_all_privileges()
 	if (opt_galera_info || opt_slave_info
 		|| opt_safe_slave_backup) {
 		check_result |= check_privilege(granted_privileges,
-			"REPLICA MONITOR", "*", "*",
+			"SLAVE MONITOR", "*", "*",
 			PRIVILEGE_WARNING);
 	}
 
diff --git a/mysql-test/lib/My/Platform.pm b/mysql-test/lib/My/Platform.pm
index f33875e14aa..279fea02ffb 100644
--- a/mysql-test/lib/My/Platform.pm
+++ b/mysql-test/lib/My/Platform.pm
@@ -23,7 +23,7 @@ use File::Path;
 use Carp;
 
 use base qw(Exporter);
-our @EXPORT= qw(IS_CYGWIN IS_MSYS IS_WINDOWS IS_WIN32PERL IS_AIX IS_MAC
+our @EXPORT= qw(IS_CYGWIN IS_MSYS IS_WINDOWS IS_WIN32PERL IS_AIX IS_MAC IS_FREEBSD
 		native_path posix_path mixed_path
                 check_socket_path_length process_alive open_for_append);
 
@@ -79,6 +79,15 @@ BEGIN {
   }
 }
 
+BEGIN {
+  if ($^O eq "freebsd") {
+    eval 'sub IS_FREEBSD { 1 }';
+  }
+  else {
+    eval 'sub IS_FREEBSD { 0 }';
+  }
+}
+
 #
 # native_path
 # Convert from path format used by perl to the underlying
diff --git a/mysql-test/main/analyze_engine_stats2.opt b/mysql-test/main/analyze_engine_stats2.opt
new file mode 100644
index 00000000000..a5bb9a93636
--- /dev/null
+++ b/mysql-test/main/analyze_engine_stats2.opt
@@ -0,0 +1 @@
+--innodb_buffer_pool_dump_at_shutdown=off --innodb_buffer_pool_load_at_startup=off --innodb-stats-persistent=1  --innodb-stats-auto-recalc=off
diff --git a/mysql-test/main/analyze_engine_stats2.result b/mysql-test/main/analyze_engine_stats2.result
new file mode 100644
index 00000000000..08a09538426
--- /dev/null
+++ b/mysql-test/main/analyze_engine_stats2.result
@@ -0,0 +1,68 @@
+#
+# MDEV-34125: ANALYZE FORMAT=JSON: r_engine_stats.pages_read_time_ms has wrong scale
+#
+create table t1 (
+a varchar(255),
+b varchar(255),
+c varchar(255),
+d varchar(255),
+primary key(a,b,c,d)
+) engine=innodb;
+SET STATEMENT unique_checks=0,foreign_key_checks=0 FOR
+insert into t1 select
+repeat(uuid(), 7), 
+repeat(uuid(), 7), 
+repeat(uuid(), 7), 
+repeat(uuid(), 7)
+from seq_1_to_16384;
+SET GLOBAL innodb_fast_shutdown=0;
+# restart
+set log_slow_verbosity='engine';
+set long_query_time=0.0;
+set @js='$analyze_output';
+select @js;
+@js
+{
+  "query_optimization": {
+    "r_total_time_ms": "REPLACED"
+  },
+  "query_block": {
+    "select_id": 1,
+    "cost": 0.011647987,
+    "r_loops": 1,
+    "r_total_time_ms": "REPLACED",
+    "nested_loop": [
+      {
+        "table": {
+          "table_name": "t1",
+          "access_type": "index",
+          "key": "PRIMARY",
+          "key_length": "1028",
+          "used_key_parts": ["a", "b", "c", "d"],
+          "loops": 1,
+          "r_loops": 1,
+          "rows": 1,
+          "r_rows": 16384,
+          "cost": 0.0110178,
+          "r_table_time_ms": "REPLACED",
+          "r_other_time_ms": "REPLACED",
+          "r_engine_stats": {
+            "pages_accessed": "REPLACED",
+            "pages_read_count": "REPLACED",
+            "pages_read_time_ms": "REPLACED"
+          },
+          "filtered": 100,
+          "r_filtered": 100
+        }
+      }
+    ]
+  }
+}
+set @pages_read_time_ms=
+(select json_value(@js,'$.query_block.nested_loop[0].table.r_engine_stats.pages_read_time_ms'));
+
+
+  OK: pages_read_time is same in slow log and ANALYZE
+
+set long_query_time=default;
+drop table t1;
diff --git a/mysql-test/main/analyze_engine_stats2.test b/mysql-test/main/analyze_engine_stats2.test
new file mode 100644
index 00000000000..36f6a76585e
--- /dev/null
+++ b/mysql-test/main/analyze_engine_stats2.test
@@ -0,0 +1,75 @@
+#
+# r_engine_stats tests that require slow query log.
+#
+--source include/analyze-format.inc
+--source include/have_sequence.inc
+--source include/have_innodb.inc
+
+--echo #
+--echo # MDEV-34125: ANALYZE FORMAT=JSON: r_engine_stats.pages_read_time_ms has wrong scale
+--echo #
+
+# Each row is 1K.
+create table t1 (
+  a varchar(255),
+  b varchar(255),
+  c varchar(255),
+  d varchar(255),
+  primary key(a,b,c,d)
+) engine=innodb;
+
+# The data size is 160K * 1K = 160M 
+#  16M / (page_size=16K) = 1K pages.
+SET STATEMENT unique_checks=0,foreign_key_checks=0 FOR
+insert into t1 select
+  repeat(uuid(), 7), 
+  repeat(uuid(), 7), 
+  repeat(uuid(), 7), 
+  repeat(uuid(), 7)
+from seq_1_to_16384;
+
+SET GLOBAL innodb_fast_shutdown=0;
+source include/restart_mysqld.inc;
+set log_slow_verbosity='engine';
+set long_query_time=0.0;
+
+let $analyze_output= `analyze format=json
+select * from t1 force index (PRIMARY) order by a desc, b desc, c desc, d desc`;
+evalp set @js='$analyze_output';
+
+# Print it out for user-friendlines
+--replace_regex /("(r_[a-z_]*_time_ms|pages[^"]*)": )[^, \n]*/\1"REPLACED"/
+select @js;
+
+set @pages_read_time_ms=
+  (select json_value(@js,'$.query_block.nested_loop[0].table.r_engine_stats.pages_read_time_ms'));
+
+let ANALYZE_PAGES=`select @pages_read_time_ms`;
+let SLOW_LOG_FILE= `select @@slow_query_log_file`;
+
+perl;
+  my $slow_log_file= $ENV{'SLOW_LOG_FILE'} or die "SLOW_LOG_FILE not set";
+  my $analyze_pages=$ENV{'ANALYZE_PAGES'};
+  open(FILE, $slow_log_file) or die "Failed to open $slow_log_file";
+  # We didn't run any queries touching a storage engine after the query of
+  # interest, so we will be fine here if we just get the last occurrence of 
+  # Pages_read_time: NNNN in the file
+  while(<FILE>) {
+    $slow_log_pages=$1 if (/Pages_read_time: ([0-9.]+)/);
+  }
+  close(FILE);
+  
+  if ( $slow_log_pages > $analyze_pages * 0.95 && 
+       $slow_log_pages < $analyze_pages * 1.05) {
+    print "\n\n  OK: pages_read_time is same in slow log and ANALYZE\n\n";
+  } else {
+    print "\n\n  FAIL: $slow_log_pages not equal to  $analyze_pages\n";
+  }
+
+EOF
+
+
+set long_query_time=default;
+drop table t1;
+
+
diff --git a/mysql-test/main/connect-no-db.result b/mysql-test/main/connect-no-db.result
new file mode 100644
index 00000000000..75597c0753c
--- /dev/null
+++ b/mysql-test/main/connect-no-db.result
@@ -0,0 +1,9 @@
+#
+# MDEV-34226 On startup: UBSAN: applying zero offset to null pointer in my_copy_fix_mb from strings/ctype-mb.c and other locations
+#
+connect  con1,localhost,root,,"*NO-ONE*";
+SELECT database();
+database()
+NULL
+disconnect con1;
+connection default;
diff --git a/mysql-test/main/connect-no-db.test b/mysql-test/main/connect-no-db.test
new file mode 100644
index 00000000000..bc36499e703
--- /dev/null
+++ b/mysql-test/main/connect-no-db.test
@@ -0,0 +1,10 @@
+--echo #
+--echo # MDEV-34226 On startup: UBSAN: applying zero offset to null pointer in my_copy_fix_mb from strings/ctype-mb.c and other locations
+--echo #
+
+# Connect without a database
+
+connect (con1,localhost,root,,"*NO-ONE*");
+SELECT database();
+disconnect con1;
+connection default;
diff --git a/mysql-test/main/drop.result b/mysql-test/main/drop.result
index 73beabc35fa..f4415117dc9 100644
--- a/mysql-test/main/drop.result
+++ b/mysql-test/main/drop.result
@@ -258,3 +258,8 @@ drop database mysqltest;
 Warnings:
 Note	1008	Can't drop database 'mysqltest'; database doesn't exist
 set @@session.sql_if_exists=0;
+#
+# MDEV-34205 ASAN stack-buffer-overflow in strxnmov | frm_file_exists
+#
+DROP TABLE `##################################################_long`.`#################################################_long`;
+ERROR 42S02: Unknown table '##################################################_long.#########################################...'
diff --git a/mysql-test/main/drop.test b/mysql-test/main/drop.test
index 5185ce30db0..6b926d3f0c1 100644
--- a/mysql-test/main/drop.test
+++ b/mysql-test/main/drop.test
@@ -361,3 +361,9 @@ drop table mysqltest.does_not_exists;
 drop database mysqltest;
 drop database mysqltest;
 set @@session.sql_if_exists=0;
+
+--echo #
+--echo # MDEV-34205 ASAN stack-buffer-overflow in strxnmov | frm_file_exists
+--echo #
+--error ER_BAD_TABLE_ERROR
+DROP TABLE `##################################################_long`.`#################################################_long`;
diff --git a/mysql-test/main/dyncol.result b/mysql-test/main/dyncol.result
index 64ce60b4e45..d0a34a10ab0 100644
--- a/mysql-test/main/dyncol.result
+++ b/mysql-test/main/dyncol.result
@@ -1950,12 +1950,6 @@ ex
 # End of 10.4 tests
 #
 #
-# Start of 10.5 tests
-#
-#
-# Start of 10.5 tests
-#
-#
 # MDEV-33788 HEX(COLUMN_CREATE(.. AS CHAR ...)) fails with --view-protocol
 #
 SELECT hex(column_create(1,'a' AS CHAR CHARACTER SET utf8mb3 COLLATE utf8mb3_bin)) AS ex;
@@ -1967,5 +1961,16 @@ SELECT hex(column_add(column_create(
 ex
 00020001000302001353612162
 #
-# Start of 10.5 tests
+# MDEV-31566 Fix buffer overrun of column_json function
 #
+create table t1 (
+c1 varchar(32) primary key,
+d1  blob
+);
+insert into t1 values ('var', 0x0402000A0000000300030023076A736E7375626A6563742E0005006C0027000200290002002B0002002D0002002F0002000C31000C3B000C4B000C51000F62006631663266336634663509E5A79AE8BF9CE6B48B0FE8819AE9809AE98791E6A1A5E5BA970537343530301031313634332F393634352F31313630300C080000000000EFBFBDEFBFBD192E), ('zzz', 0x0402000900000003000300740C6A736E766F6C756D652E000900EFBFBD004300020045000200470003004A0004004E00050053000500580005005D000500620005000C67000C6A000C6D000C7000052C00051B00052C000CEFBFBD0007EFBFBD006638663966313070696332626F785F63626F785F67626F785F6B626F785F7666355F696402343402343402333241687474703A2F2F6F73732E68646238382E636F6D2F302F70686F746F2F30373865653765376336343634616236386130343833373333323636613532612E67696608302E303532323732244F1E00030180C106);
+select c1,column_json(d1) as not_crashing from t1 order by c1;
+c1	not_crashing
+var	{"jsn":"\u0000\u0005\u0000l\u0000'\u0000\u0002\u0000)\u0000\u0002\u0000+\u0000\u0002\u0000-\u0000\u0002\u0000/\u0000\u0002\u0000\u000C1\u0000\u000C;\u0000\u000CK\u0000\u000CQ\u0000\u000Fb\u0000f1f2f3f4f5\u0009姚远洋\u000F聚通金桥店\u000574500\u001011643/9645/11600\u000C\u0008\u0000\u0000\u0000\u0000\u0000��\u0019","subject":""}
+zzz	{"jsn":"\u0000\u0009\u0000�\u0000C\u0000\u0002\u0000E\u0000\u0002\u0000G\u0000\u0003\u0000J\u0000\u0004\u0000N\u0000\u0005\u0000S\u0000\u0005\u0000X\u0000\u0005\u0000]\u0000\u0005\u0000b\u0000\u0005\u0000\u000Cg\u0000\u000Cj\u0000\u000Cm\u0000\u000Cp\u0000\u0005,\u0000\u0005\u001B\u0000\u0005,\u0000\u000C�\u0000\u0007�\u0000f8f9f10pic2box_cbox_gbox_kbox_vf5_id\u000244\u000244\u000232Ahttp://oss.hdb88.com/0/photo/078ee7e7c6464ab68a0483733266a52a.gif\u00080.052272$O\u001E\u0000","volume":193.6}
+drop table t1;
+# End of 10.5 tests
diff --git a/mysql-test/main/dyncol.test b/mysql-test/main/dyncol.test
index 1343025d5c5..693c768768f 100644
--- a/mysql-test/main/dyncol.test
+++ b/mysql-test/main/dyncol.test
@@ -1001,14 +1001,6 @@ SELECT HEX(COLUMN_ADD(COLUMN_CREATE(1,10),2,NULL,1,NULL)) as ex;
 --echo # End of 10.4 tests
 --echo #
 
---echo #
---echo # Start of 10.5 tests
---echo #
-
---echo #
---echo # Start of 10.5 tests
---echo #
-
 --echo #
 --echo # MDEV-33788 HEX(COLUMN_CREATE(.. AS CHAR ...)) fails with --view-protocol
 --echo #
@@ -1019,5 +1011,18 @@ SELECT hex(column_add(column_create(
                       2, 'b' AS CHAR CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci)) AS ex;
 
 --echo #
---echo # Start of 10.5 tests
+--echo # MDEV-31566 Fix buffer overrun of column_json function
 --echo #
+
+
+create table t1 (
+  c1 varchar(32) primary key,
+  d1  blob
+);
+insert into t1 values ('var', 0x0402000A0000000300030023076A736E7375626A6563742E0005006C0027000200290002002B0002002D0002002F0002000C31000C3B000C4B000C51000F62006631663266336634663509E5A79AE8BF9CE6B48B0FE8819AE9809AE98791E6A1A5E5BA970537343530301031313634332F393634352F31313630300C080000000000EFBFBDEFBFBD192E), ('zzz', 0x0402000900000003000300740C6A736E766F6C756D652E000900EFBFBD004300020045000200470003004A0004004E00050053000500580005005D000500620005000C67000C6A000C6D000C7000052C00051B00052C000CEFBFBD0007EFBFBD006638663966313070696332626F785F63626F785F67626F785F6B626F785F7666355F696402343402343402333241687474703A2F2F6F73732E68646238382E636F6D2F302F70686F746F2F30373865653765376336343634616236386130343833373333323636613532612E67696608302E303532323732244F1E00030180C106);
+
+select c1,column_json(d1) as not_crashing from t1 order by c1;
+
+drop table t1;
+
+--echo # End of 10.5 tests
diff --git a/mysql-test/main/func_date_add.result b/mysql-test/main/func_date_add.result
index a6201a3c23f..1c2d9ab5eb1 100644
--- a/mysql-test/main/func_date_add.result
+++ b/mysql-test/main/func_date_add.result
@@ -200,3 +200,34 @@ select 30 + (20010101 + interval 2 day), x from v1;
 20010133	20010133
 drop view v1;
 End of 10.2 tests
+#
+# Start of 10.5 tests
+#
+#
+# MDEV-30931 UBSAN: negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in get_interval_value on SELECT
+#
+SELECT DATE_ADD('01-01-23',INTERVAL '9223372036854775808-02' WEEK);
+DATE_ADD('01-01-23',INTERVAL '9223372036854775808-02' WEEK)
+NULL
+Warnings:
+Warning	1292	Truncated incorrect INTEGER value: '9223372036854775808-02'
+Warning	1441	Datetime function: datetime field overflow
+SELECT DATE_ADD('01-01-23',INTERVAL -9223372036854775807 WEEK);
+DATE_ADD('01-01-23',INTERVAL -9223372036854775807 WEEK)
+NULL
+Warnings:
+Warning	1441	Datetime function: datetime field overflow
+SELECT DATE_ADD('01-01-23',INTERVAL -9223372036854775808 WEEK);
+DATE_ADD('01-01-23',INTERVAL -9223372036854775808 WEEK)
+NULL
+Warnings:
+Warning	1441	Datetime function: datetime field overflow
+SELECT DATE_ADD('01-01-23',INTERVAL -9223372036854775809 WEEK);
+DATE_ADD('01-01-23',INTERVAL -9223372036854775809 WEEK)
+NULL
+Warnings:
+Warning	1916	Got overflow when converting '-9223372036854775809' to INT. Value truncated
+Warning	1441	Datetime function: datetime field overflow
+#
+# End of 10.5 tests
+#
diff --git a/mysql-test/main/func_date_add.test b/mysql-test/main/func_date_add.test
index f9287b952d2..aa00fd144e2 100644
--- a/mysql-test/main/func_date_add.test
+++ b/mysql-test/main/func_date_add.test
@@ -169,3 +169,20 @@ select 30 + (20010101 + interval 2 day), x from v1;
 drop view v1;
 
 --echo End of 10.2 tests
+
+--echo #
+--echo # Start of 10.5 tests
+--echo #
+
+--echo #
+--echo # MDEV-30931 UBSAN: negation of -X cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in get_interval_value on SELECT
+--echo #
+
+SELECT DATE_ADD('01-01-23',INTERVAL '9223372036854775808-02' WEEK);
+SELECT DATE_ADD('01-01-23',INTERVAL -9223372036854775807 WEEK);
+SELECT DATE_ADD('01-01-23',INTERVAL -9223372036854775808 WEEK);
+SELECT DATE_ADD('01-01-23',INTERVAL -9223372036854775809 WEEK);
+
+--echo #
+--echo # End of 10.5 tests
+--echo #
diff --git a/mysql-test/main/func_str.result b/mysql-test/main/func_str.result
index 32b56fea165..9a2b39ddb00 100644
--- a/mysql-test/main/func_str.result
+++ b/mysql-test/main/func_str.result
@@ -5310,6 +5310,14 @@ NULL
 DROP TABLE t1;
 DROP VIEW v1;
 #
+# MDEV-28387 UBSAN: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in my_strtoll10 on SELECT
+#
+SET @a='-9223372036854775808';
+CREATE TABLE t (c1 INT,c2 CHAR);
+SELECT SUBSTR(0,@a) FROM t;
+SUBSTR(0,@a)
+DROP TABLE t;
+#
 # End of 10.5 tests
 #
 #
diff --git a/mysql-test/main/func_str.test b/mysql-test/main/func_str.test
index b34623d96a7..36af647fd6e 100644
--- a/mysql-test/main/func_str.test
+++ b/mysql-test/main/func_str.test
@@ -1548,6 +1548,7 @@ CREATE TABLE t1 ( a TEXT );
 SELECT insert( substring_index( 'a', 'a', 'b' ), 1, 0, 'x' );
 --replace_result $MYSQLTEST_VARDIR MYSQLTEST_VARDIR
 --eval LOAD DATA INFILE '$MYSQLTEST_VARDIR/tmp/bug58165.txt' INTO TABLE t1;
+--remove_file $MYSQLTEST_VARDIR/tmp/bug58165.txt
 SELECT * FROM t1;
 DROP TABLE t1;
 
@@ -2351,6 +2352,15 @@ DROP TABLE t1;
 DROP VIEW v1;
 
 
+--echo #
+--echo # MDEV-28387 UBSAN: runtime error: negation of -9223372036854775808 cannot be represented in type 'long long int'; cast to an unsigned type to negate this value to itself in my_strtoll10 on SELECT
+--echo #
+
+SET @a='-9223372036854775808';  # Quite specific value; considerably varying it will not work
+CREATE TABLE t (c1 INT,c2 CHAR);
+SELECT SUBSTR(0,@a) FROM t;
+DROP TABLE t;
+
 --echo #
 --echo # End of 10.5 tests
 --echo #
diff --git a/mysql-test/main/lowercase_table5.result b/mysql-test/main/lowercase_table5.result
index 77318a8e2aa..2baa50282b5 100644
--- a/mysql-test/main/lowercase_table5.result
+++ b/mysql-test/main/lowercase_table5.result
@@ -47,3 +47,145 @@ DROP PROCEDURE SP;
 #
 # End of 10.4 tests
 #
+#
+# Start of 10.5 tests
+#
+#
+# MDEV-33084 LASTVAL(t1) and LASTVAL(T1) do not work well with lower-case-table-names=0
+#
+CREATE SEQUENCE t1;
+CREATE SEQUENCE T1;
+SELECT nextval(t1), lastval(t1);
+nextval(t1)	lastval(t1)
+1	1
+SELECT nextval(T1), lastval(T1);
+nextval(T1)	lastval(T1)
+1	1
+SELECT lastval(t1), lastval(T1) l2;
+lastval(t1)	l2
+1	1
+DROP SEQUENCE t1, T1;
+#
+# MDEV-33086 SHOW OPEN TABLES IN DB1 -- is case insensitive with lower-case-table-names=0
+#
+CREATE DATABASE db1;
+CREATE TABLE db1.t1 (a INT);
+SELECT * FROM db1.t1;
+a
+SHOW OPEN TABLES IN DB1;
+Database	Table	In_use	Name_locked
+SHOW OPEN TABLES IN db1;
+Database	Table	In_use	Name_locked
+db1	t1	0	0
+DROP DATABASE db1;
+#
+# MDEV-33088 Cannot create triggers in the database `MYSQL`
+#
+CREATE DATABASE MYSQL;
+CREATE TABLE MYSQL.t1 (a INT);
+CREATE TABLE MYSQL.t2 (a INT);
+CREATE TRIGGER MYSQL.tr1 AFTER INSERT ON t1 FOR EACH ROW INSERT INTO t2 VALUES (new.a);
+INSERT INTO MYSQL.t1 VALUES (10);
+SELECT * FROM MYSQL.t1;
+a
+10
+SELECT * FROM MYSQL.t2;
+a
+10
+DROP DATABASE MYSQL;
+#
+# MDEV-33103 LOCK TABLE t1 AS t2 -- alias is not case sensitive with lower-case-table-names=0
+#
+CREATE TABLE t1 (a INT);
+INSERT INTO t1 VALUES (1);
+LOCK TABLE t1 AS t2 READ;
+SELECT * FROM t1 AS t2;
+a
+1
+UNLOCK TABLES;
+LOCK TABLE t1 AS t2 READ;
+SELECT * FROM t1 AS T2;
+ERROR HY000: Table 'T2' was not locked with LOCK TABLES
+UNLOCK TABLES;
+DROP TABLE t1;
+#
+# MDEV-33108 TABLE_STATISTICS and INDEX_STATISTICS are case insensitive with lower-case-table-names=0
+#
+SET GLOBAL userstat=1;
+CREATE TABLE t1 (a INT, KEY(a));
+INSERT INTO t1 VALUES (1),(2),(3),(4);
+SELECT * FROM t1 ORDER BY a;
+a
+1
+2
+3
+4
+CREATE TABLE T1 (a INT, KEY(a));
+INSERT INTO T1 VALUES (1),(2),(3),(4);
+SELECT * FROM T1 ORDER BY a;
+a
+1
+2
+3
+4
+SELECT * FROM INFORMATION_SCHEMA.TABLE_STATISTICS ORDER BY BINARY TABLE_NAME;
+TABLE_SCHEMA	TABLE_NAME	ROWS_READ	ROWS_CHANGED	ROWS_CHANGED_X_INDEXES
+test	T1	4	4	4
+test	t1	4	4	4
+SELECT * FROM INFORMATION_SCHEMA.INDEX_STATISTICS ORDER BY BINARY TABLE_NAME;
+TABLE_SCHEMA	TABLE_NAME	INDEX_NAME	ROWS_READ
+test	T1	a	4
+test	t1	a	4
+DROP TABLE t1;
+DROP TABLE T1;
+SET GLOBAL userstat=DEFAULT;
+#
+# MDEV-33109 DROP DATABASE MYSQL -- does not drop SP with lower-case-table-names=0
+#
+CREATE DATABASE MYSQL;
+CREATE FUNCTION MYSQL.f1() RETURNS INT RETURN 1;
+DROP DATABASE MYSQL;
+SELECT db, name, body FROM mysql.proc WHERE db=BINARY 'MYSQL' AND name='f1';
+db	name	body
+#
+# MDEV-33110 HANDLER commands are case insensitive with lower-case-table-names=0
+#
+CREATE TABLE t1 (a INT);
+INSERT INTO t1 VALUES (1),(2);
+HANDLER t1 OPEN;
+HANDLER t1 READ FIRST;
+a
+1
+CREATE OR REPLACE TABLE T1 (a INT);
+DROP TABLE T1;
+HANDLER t1 READ NEXT;
+a
+2
+HANDLER t1 CLOSE;
+DROP TABLE t1;
+#
+# MDEV-33120 System log table names are case insensitive with lower-cast-table-names=0
+#
+CREATE TABLE mysql.GENERAL_log (a INT);
+INSERT INTO mysql.GENERAL_log VALUES (1),(2);
+DROP TABLE mysql.GENERAL_log;
+CREATE TABLE mysql.SLOW_log (a INT);
+INSERT INTO mysql.SLOW_log VALUES (1),(2);
+DROP TABLE mysql.SLOW_log;
+CREATE TABLE mysql.TRANSACTION_registry (a INT);
+INSERT INTO mysql.TRANSACTION_registry VALUES (1),(2);
+DROP TABLE mysql.TRANSACTION_registry;
+CREATE DATABASE MYSQL;
+CREATE TABLE MYSQL.general_log (a INT);
+INSERT INTO MYSQL.general_log VALUES (1),(2);
+DROP TABLE MYSQL.general_log;
+CREATE TABLE MYSQL.slow_log (a INT);
+INSERT INTO MYSQL.slow_log VALUES (1),(2);
+DROP TABLE MYSQL.slow_log;
+CREATE TABLE MYSQL.transaction_registry (a INT);
+INSERT INTO MYSQL.transaction_registry VALUES (1),(2);
+DROP TABLE MYSQL.transaction_registry;
+DROP DATABASE MYSQL;
+#
+# End of 10.5 tests
+#
diff --git a/mysql-test/main/lowercase_table5.test b/mysql-test/main/lowercase_table5.test
index 0103dbf5fd2..fcbb3fefb33 100644
--- a/mysql-test/main/lowercase_table5.test
+++ b/mysql-test/main/lowercase_table5.test
@@ -49,3 +49,141 @@ DROP PROCEDURE SP;
 --echo #
 --echo # End of 10.4 tests
 --echo #
+
+--echo #
+--echo # Start of 10.5 tests
+--echo #
+
+--echo #
+--echo # MDEV-33084 LASTVAL(t1) and LASTVAL(T1) do not work well with lower-case-table-names=0
+--echo #
+
+CREATE SEQUENCE t1;
+CREATE SEQUENCE T1;
+--disable_ps2_protocol
+SELECT nextval(t1), lastval(t1);
+SELECT nextval(T1), lastval(T1);
+SELECT lastval(t1), lastval(T1) l2;
+--enable_ps2_protocol
+DROP SEQUENCE t1, T1;
+
+--echo #
+--echo # MDEV-33086 SHOW OPEN TABLES IN DB1 -- is case insensitive with lower-case-table-names=0
+--echo #
+
+CREATE DATABASE db1;
+CREATE TABLE db1.t1 (a INT);
+SELECT * FROM db1.t1;
+SHOW OPEN TABLES IN DB1;
+SHOW OPEN TABLES IN db1;
+DROP DATABASE db1;
+
+--echo #
+--echo # MDEV-33088 Cannot create triggers in the database `MYSQL`
+--echo #
+
+CREATE DATABASE MYSQL;
+CREATE TABLE MYSQL.t1 (a INT);
+CREATE TABLE MYSQL.t2 (a INT);
+CREATE TRIGGER MYSQL.tr1 AFTER INSERT ON t1 FOR EACH ROW INSERT INTO t2 VALUES (new.a);
+INSERT INTO MYSQL.t1 VALUES (10);
+SELECT * FROM MYSQL.t1;
+SELECT * FROM MYSQL.t2;
+DROP DATABASE MYSQL;
+
+
+--echo #
+--echo # MDEV-33103 LOCK TABLE t1 AS t2 -- alias is not case sensitive with lower-case-table-names=0
+--echo #
+
+--disable_view_protocol
+CREATE TABLE t1 (a INT);
+INSERT INTO t1 VALUES (1);
+LOCK TABLE t1 AS t2 READ;
+SELECT * FROM t1 AS t2;
+UNLOCK TABLES;
+LOCK TABLE t1 AS t2 READ;
+--error ER_TABLE_NOT_LOCKED
+SELECT * FROM t1 AS T2;
+UNLOCK TABLES;
+DROP TABLE t1;
+--enable_view_protocol
+
+
+--echo #
+--echo # MDEV-33108 TABLE_STATISTICS and INDEX_STATISTICS are case insensitive with lower-case-table-names=0
+--echo #
+
+SET GLOBAL userstat=1;
+CREATE TABLE t1 (a INT, KEY(a));
+INSERT INTO t1 VALUES (1),(2),(3),(4);
+--disable_ps2_protocol
+SELECT * FROM t1 ORDER BY a;
+CREATE TABLE T1 (a INT, KEY(a));
+INSERT INTO T1 VALUES (1),(2),(3),(4);
+SELECT * FROM T1 ORDER BY a;
+--enable_ps2_protocol
+SELECT * FROM INFORMATION_SCHEMA.TABLE_STATISTICS ORDER BY BINARY TABLE_NAME;
+SELECT * FROM INFORMATION_SCHEMA.INDEX_STATISTICS ORDER BY BINARY TABLE_NAME;
+DROP TABLE t1;
+DROP TABLE T1;
+SET GLOBAL userstat=DEFAULT;
+
+
+--echo #
+--echo # MDEV-33109 DROP DATABASE MYSQL -- does not drop SP with lower-case-table-names=0
+--echo #
+
+CREATE DATABASE MYSQL;
+CREATE FUNCTION MYSQL.f1() RETURNS INT RETURN 1;
+DROP DATABASE MYSQL;
+SELECT db, name, body FROM mysql.proc WHERE db=BINARY 'MYSQL' AND name='f1';
+
+
+--echo #
+--echo # MDEV-33110 HANDLER commands are case insensitive with lower-case-table-names=0
+--echo #
+
+CREATE TABLE t1 (a INT);
+INSERT INTO t1 VALUES (1),(2);
+HANDLER t1 OPEN;
+HANDLER t1 READ FIRST;
+CREATE OR REPLACE TABLE T1 (a INT);
+DROP TABLE T1;
+HANDLER t1 READ NEXT;
+HANDLER t1 CLOSE;
+DROP TABLE t1;
+
+--echo #
+--echo # MDEV-33120 System log table names are case insensitive with lower-cast-table-names=0
+--echo #
+
+CREATE TABLE mysql.GENERAL_log (a INT);
+INSERT INTO mysql.GENERAL_log VALUES (1),(2);
+DROP TABLE mysql.GENERAL_log;
+
+CREATE TABLE mysql.SLOW_log (a INT);
+INSERT INTO mysql.SLOW_log VALUES (1),(2);
+DROP TABLE mysql.SLOW_log;
+
+CREATE TABLE mysql.TRANSACTION_registry (a INT);
+INSERT INTO mysql.TRANSACTION_registry VALUES (1),(2);
+DROP TABLE mysql.TRANSACTION_registry;
+
+CREATE DATABASE MYSQL;
+CREATE TABLE MYSQL.general_log (a INT);
+INSERT INTO MYSQL.general_log VALUES (1),(2);
+DROP TABLE MYSQL.general_log;
+
+CREATE TABLE MYSQL.slow_log (a INT);
+INSERT INTO MYSQL.slow_log VALUES (1),(2);
+DROP TABLE MYSQL.slow_log;
+
+CREATE TABLE MYSQL.transaction_registry (a INT);
+INSERT INTO MYSQL.transaction_registry VALUES (1),(2);
+DROP TABLE MYSQL.transaction_registry;
+DROP DATABASE MYSQL;
+
+--echo #
+--echo # End of 10.5 tests
+--echo #
diff --git a/mysql-test/main/ps_mem_leaks.result b/mysql-test/main/ps_mem_leaks.result
index 2ddf47a992c..e647c89b740 100644
--- a/mysql-test/main/ps_mem_leaks.result
+++ b/mysql-test/main/ps_mem_leaks.result
@@ -89,3 +89,32 @@ f
 DEALLOCATE PREPARE stmt;
 DROP TABLE t1;
 # End of 10.4 tests
+#
+# MDEV-33769: Memory leak found in the test main.rownum run with --ps-protocol against a server built with the option -DWITH_PROTECT_STATEMENT_MEMROOT
+#
+CREATE OR REPLACE TABLE t1(a INT);
+PREPARE stmt FROM 'SELECT 1 FROM t1 WHERE ROWNUM() < 2';
+EXECUTE stmt;
+1
+EXECUTE stmt;
+1
+INSERT INTO t1 VALUES (1), (2), (3), (4), (5);
+PREPARE stmt FROM 'SELECT * FROM t1 WHERE ROWNUM() < ?';
+# Expected output is two rows (1), (2)
+EXECUTE stmt USING 3;
+a
+1
+2
+# Expected output is one row (1)
+EXECUTE stmt USING 2;
+a
+1
+# Expected output is three rows (1), (2), (3)
+EXECUTE stmt USING 4;
+a
+1
+2
+# Clean up
+DEALLOCATE PREPARE stmt;
+DROP TABLE t1;
+# End of 10.6 tests
diff --git a/mysql-test/main/ps_mem_leaks.test b/mysql-test/main/ps_mem_leaks.test
index dacb4ecabba..16a46596c94 100644
--- a/mysql-test/main/ps_mem_leaks.test
+++ b/mysql-test/main/ps_mem_leaks.test
@@ -110,3 +110,27 @@ DEALLOCATE PREPARE stmt;
 DROP TABLE t1;
 
 --echo # End of 10.4 tests
+
+--echo #
+--echo # MDEV-33769: Memory leak found in the test main.rownum run with --ps-protocol against a server built with the option -DWITH_PROTECT_STATEMENT_MEMROOT
+--echo #
+CREATE OR REPLACE TABLE t1(a INT);
+PREPARE stmt FROM 'SELECT 1 FROM t1 WHERE ROWNUM() < 2';
+EXECUTE stmt;
+EXECUTE stmt;
+
+INSERT INTO t1 VALUES (1), (2), (3), (4), (5);
+
+PREPARE stmt FROM 'SELECT * FROM t1 WHERE ROWNUM() < ?';
+--echo # Expected output is two rows (1), (2)
+EXECUTE stmt USING 3;
+--echo # Expected output is one row (1)
+EXECUTE stmt USING 2;
+--echo # Expected output is three rows (1), (2), (3)
+EXECUTE stmt USING 4;
+
+--echo # Clean up
+DEALLOCATE PREPARE stmt;
+DROP TABLE t1;
+
+--echo # End of 10.6 tests
diff --git a/mysql-test/main/view_grant.result b/mysql-test/main/view_grant.result
index cfb8f7df60e..18290b6bafe 100644
--- a/mysql-test/main/view_grant.result
+++ b/mysql-test/main/view_grant.result
@@ -1948,6 +1948,38 @@ connection default;
 drop user user_11766767;
 drop database mysqltest1;
 drop database mysqltest2;
+#
+# MDEV-33119 User is case insensitive in INFORMATION_SCHEMA.VIEWS
+#
+USE test;
+CREATE USER foo;
+CREATE USER FOO;
+GRANT SELECT ON test.* TO foo;
+GRANT SELECT ON test.* TO FOO;
+CREATE DEFINER=foo SQL SECURITY INVOKER VIEW v1 AS SELECT 1 AS c1;
+connect  FOO, localhost, FOO, , test;
+connection FOO;
+SELECT CURRENT_USER;
+CURRENT_USER
+FOO@%
+SELECT * FROM INFORMATION_SCHEMA.VIEWS;
+TABLE_CATALOG	def
+TABLE_SCHEMA	test
+TABLE_NAME	v1
+VIEW_DEFINITION	
+CHECK_OPTION	NONE
+IS_UPDATABLE	NO
+DEFINER	foo@%
+SECURITY_TYPE	INVOKER
+CHARACTER_SET_CLIENT	latin1
+COLLATION_CONNECTION	latin1_swedish_ci
+ALGORITHM	UNDEFINED
+disconnect FOO;
+connection default;
+DROP VIEW v1;
+DROP USER foo;
+DROP USER FOO;
+# End of 10.5 tests
 # Check that a user without access to the schema 'foo' cannot query
 # a JSON_TABLE view in that schema.
 CREATE SCHEMA foo;
@@ -1964,3 +1996,4 @@ connection default;
 disconnect con1;
 drop user foo@localhost;
 drop schema foo;
+# End of 10.6 tests
diff --git a/mysql-test/main/view_grant.test b/mysql-test/main/view_grant.test
index a7990b44636..f106808bd18 100644
--- a/mysql-test/main/view_grant.test
+++ b/mysql-test/main/view_grant.test
@@ -2207,6 +2207,35 @@ drop user user_11766767;
 drop database mysqltest1;
 drop database mysqltest2;
 
+--echo #
+--echo # MDEV-33119 User is case insensitive in INFORMATION_SCHEMA.VIEWS
+--echo #
+
+USE test;
+CREATE USER foo;
+CREATE USER FOO;
+GRANT SELECT ON test.* TO foo;
+GRANT SELECT ON test.* TO FOO;
+
+CREATE DEFINER=foo SQL SECURITY INVOKER VIEW v1 AS SELECT 1 AS c1;
+
+--connect (FOO, localhost, FOO, , test)
+--connection FOO
+
+SELECT CURRENT_USER;
+--vertical_results
+--query_vertical SELECT * FROM INFORMATION_SCHEMA.VIEWS
+--horizontal_results
+
+--disconnect FOO
+--connection default
+
+DROP VIEW v1;
+DROP USER foo;
+DROP USER FOO;
+
+--echo # End of 10.5 tests
+
 --echo # Check that a user without access to the schema 'foo' cannot query
 --echo # a JSON_TABLE view in that schema.
 CREATE SCHEMA foo;
@@ -2225,7 +2254,7 @@ connection default;
 disconnect con1;
 drop user foo@localhost;
 drop schema foo;
+--echo # End of 10.6 tests
 
 # Wait till we reached the initial number of concurrent sessions
 --source include/wait_until_count_sessions.inc
-
diff --git a/mysql-test/mariadb-test-run.pl b/mysql-test/mariadb-test-run.pl
index b542e23aa9d..9a148e56c88 100755
--- a/mysql-test/mariadb-test-run.pl
+++ b/mysql-test/mariadb-test-run.pl
@@ -436,7 +436,7 @@ sub main {
     {
       $opt_parallel= $ENV{NUMBER_OF_PROCESSORS} || 1;
     }
-    elsif (IS_MAC)
+    elsif (IS_MAC || IS_FREEBSD)
     {
       $opt_parallel= `sysctl -n hw.ncpu`;
     }
diff --git a/mysql-test/suite/csv/lowercase_table0.result b/mysql-test/suite/csv/lowercase_table0.result
new file mode 100644
index 00000000000..fba6a509aea
--- /dev/null
+++ b/mysql-test/suite/csv/lowercase_table0.result
@@ -0,0 +1,15 @@
+#
+# MDEV-33085 Tables T1 and t1 do not work well with ENGINE=CSV and lower-case-table-names=0
+#
+CREATE OR REPLACE TABLE t1 (a INT NOT NULL) ENGINE=CSV;
+CREATE OR REPLACE TABLE T1 (a INT NOT NULL) ENGINE=CSV;
+INSERT INTO t1 VALUES (10);
+INSERT INTO T1 VALUES (20);
+SELECT * FROM t1;
+a
+10
+SELECT * FROM T1;
+a
+20
+DROP TABLE t1;
+DROP TABLE T1;
diff --git a/mysql-test/suite/csv/lowercase_table0.test b/mysql-test/suite/csv/lowercase_table0.test
new file mode 100644
index 00000000000..2bb0e486cb6
--- /dev/null
+++ b/mysql-test/suite/csv/lowercase_table0.test
@@ -0,0 +1,16 @@
+--source include/have_csv.inc
+--source include/have_lowercase0.inc
+--source include/have_case_sensitive_file_system.inc
+
+--echo #
+--echo # MDEV-33085 Tables T1 and t1 do not work well with ENGINE=CSV and lower-case-table-names=0
+--echo #
+
+CREATE OR REPLACE TABLE t1 (a INT NOT NULL) ENGINE=CSV;
+CREATE OR REPLACE TABLE T1 (a INT NOT NULL) ENGINE=CSV;
+INSERT INTO t1 VALUES (10);
+INSERT INTO T1 VALUES (20);
+SELECT * FROM t1;
+SELECT * FROM T1;
+DROP TABLE t1;
+DROP TABLE T1;
diff --git a/mysql-test/suite/galera/galera_2nodes.cnf b/mysql-test/suite/galera/galera_2nodes.cnf
index 3532c1f2134..f1697c08149 100644
--- a/mysql-test/suite/galera/galera_2nodes.cnf
+++ b/mysql-test/suite/galera/galera_2nodes.cnf
@@ -33,6 +33,9 @@ wsrep_node_address='127.0.0.1:@mysqld.2.#galera_port'
 wsrep_node_incoming_address=127.0.0.1:@mysqld.2.port
 wsrep_sst_receive_address='127.0.0.1:@mysqld.2.#sst_port'
 
+[sst]
+sst-log-archive-dir=@ENV.MYSQLTEST_VARDIR/log
+
 [ENV]
 NODE_MYPORT_1= @mysqld.1.port
 NODE_MYSOCK_1= @mysqld.1.socket
diff --git a/mysql-test/suite/innodb/r/lock_memory.result b/mysql-test/suite/innodb/r/lock_memory.result
new file mode 100644
index 00000000000..9859fdfd1f4
--- /dev/null
+++ b/mysql-test/suite/innodb/r/lock_memory.result
@@ -0,0 +1,20 @@
+#
+# MDEV-28800 SIGABRT due to running out of memory for InnoDB locks
+#
+CREATE TABLE t1 (col1 INT) ENGINE=InnoDB;
+INSERT INTO t1 VALUES (1),(2),(3),(4);
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+START TRANSACTION;
+INSERT INTO t1 SELECT a.* FROM t1 a, t1 b, t1 c, t1 d;
+SELECT CASE WHEN (POOL_SIZE - (FREE_BUFFERS + DATABASE_PAGES)) <= 10 THEN "PASSED"
+            ELSE (POOL_SIZE - (FREE_BUFFERS + DATABASE_PAGES)) END
+FROM information_schema.innodb_buffer_pool_stats;
+CASE WHEN (POOL_SIZE - (FREE_BUFFERS + DATABASE_PAGES)) <= 10 THEN "PASSED"
+            ELSE (POOL_SIZE - (FREE_BUFFERS + DATABASE_PAGES)) END
+PASSED
+COMMIT;
+SELECT COUNT(*) FROM t1;
+COUNT(*)
+65552
+DROP TABLE t1;
diff --git a/mysql-test/suite/innodb/r/lock_memory_debug.result b/mysql-test/suite/innodb/r/lock_memory_debug.result
new file mode 100644
index 00000000000..36d7433974e
--- /dev/null
+++ b/mysql-test/suite/innodb/r/lock_memory_debug.result
@@ -0,0 +1,13 @@
+#
+# MDEV-34166 Server could hang with BP < 80M under stress
+#
+call mtr.add_suppression("\\[Warning\\] InnoDB: Over 67 percent of the buffer pool");
+CREATE TABLE t1 (col1 INT) ENGINE=InnoDB;
+INSERT INTO t1 VALUES (1),(2),(3),(4),(5);
+SET STATEMENT debug_dbug='+d,innodb_skip_lock_bitmap' FOR
+INSERT INTO t1 SELECT a.* FROM t1 a, t1 b, t1 c, t1 d, t1 e, t1 f, t1 g LIMIT 45000;
+ERROR HY000: The total number of locks exceeds the lock table size
+SELECT COUNT(*) FROM t1;
+COUNT(*)
+5
+DROP TABLE t1;
diff --git a/mysql-test/suite/innodb/r/table_flags.result b/mysql-test/suite/innodb/r/table_flags.result
index e38eb93e781..c4470b00017 100644
--- a/mysql-test/suite/innodb/r/table_flags.result
+++ b/mysql-test/suite/innodb/r/table_flags.result
@@ -185,3 +185,14 @@ ALTER TABLE t1 PAGE_COMPRESSED = 1;
 INSERT INTO t1 VALUES(2);
 # restart
 DROP TABLE t1;
+#
+# MDEV-34222 Alter operation on redundant table aborts the server
+#
+SET @df_row = @@global.INNODB_DEFAULT_ROW_FORMAT;
+SET GLOBAL INNODB_DEFAULT_ROW_FORMAT=REDUNDANT;
+CREATE TABLE t1 (c CHAR(1)) ENGINE=InnoDB;
+SET GLOBAL INNODB_DEFAULT_ROW_FORMAT=compact;
+ALTER TABLE t1 PAGE_COMPRESSED=1;
+ERROR HY000: Table storage engine 'InnoDB' does not support the create option 'PAGE_COMPRESSED=1 ROW_FORMAT=REDUNDANT'
+DROP TABLE t1;
+SET @@global.INNODB_DEFAULT_ROW_FORMAT = @df_row;
diff --git a/mysql-test/suite/innodb/r/temporary_table.result b/mysql-test/suite/innodb/r/temporary_table.result
index e90302daba4..bb5f960e7cb 100644
--- a/mysql-test/suite/innodb/r/temporary_table.result
+++ b/mysql-test/suite/innodb/r/temporary_table.result
@@ -801,4 +801,14 @@ CHECK TABLE t EXTENDED;
 Table	Op	Msg_type	Msg_text
 test.t	check	status	OK
 DROP TEMPORARY TABLE t;
+#
+# MDEV-34118 fsp_alloc_free_extent() fails to flag DB_OUT_OF_FILE_SPACE
+#
+SET @save_increment = @@GLOBAL.innodb_autoextend_increment;
+SET GLOBAL innodb_autoextend_increment=1;
+CREATE TEMPORARY TABLE t (c LONGTEXT) ENGINE=INNODB;
+INSERT INTO t VALUES (REPEAT ('1',16777216));
+ERROR HY000: The table 't' is full
+DROP TEMPORARY TABLE t;
+SET GLOBAL innodb_autoextend_increment=@save_increment;
 # End of 10.6 tests
diff --git a/mysql-test/suite/innodb/r/undo_space_dblwr.result b/mysql-test/suite/innodb/r/undo_space_dblwr.result
index 4466df9857b..2172ce53cb7 100644
--- a/mysql-test/suite/innodb/r/undo_space_dblwr.result
+++ b/mysql-test/suite/innodb/r/undo_space_dblwr.result
@@ -12,7 +12,7 @@ set global innodb_fil_make_page_dirty_debug = 1;
 SET GLOBAL innodb_buf_flush_list_now = 1;
 # Kill the server
 # restart: --debug_dbug=+d,ib_log_checkpoint_avoid_hard --innodb_flush_sync=0
-FOUND 1 /Checksum mismatch in the first page of file/ in mysqld.1.err
+FOUND 1 /Restoring page \[page id: space=1, page number=0\] of datafile '.*undo001' from the doublewrite buffer./ in mysqld.1.err
 check table t1;
 Table	Op	Msg_type	Msg_text
 test.t1	check	status	OK
diff --git a/mysql-test/suite/innodb/r/xa_recovery.result b/mysql-test/suite/innodb/r/xa_recovery.result
index f61e29be20e..0caa501c1e1 100644
--- a/mysql-test/suite/innodb/r/xa_recovery.result
+++ b/mysql-test/suite/innodb/r/xa_recovery.result
@@ -1,4 +1,4 @@
-CREATE TABLE t1 (a INT) ENGINE=InnoDB;
+CREATE TABLE t1 (a INT PRIMARY KEY) ENGINE=InnoDB;
 INSERT INTO t1 VALUES (1);
 connect  con1,localhost,root;
 XA START 'x';
@@ -6,7 +6,7 @@ UPDATE t1 set a=2;
 XA END 'x';
 XA PREPARE 'x';
 connect  con2,localhost,root;
-CREATE TABLE t2 (a INT) ENGINE=InnoDB;
+CREATE TABLE t2 (a INT PRIMARY KEY) ENGINE=InnoDB;
 XA START 'y';
 INSERT INTO t2 VALUES (1);
 XA END 'y';
@@ -30,10 +30,21 @@ XA ROLLBACK 'x';
 SELECT * FROM t1;
 a
 1
-DROP TABLE t1;
 DROP TABLE t2;
 ERROR HY000: Lock wait timeout exceeded; try restarting transaction
 XA ROLLBACK 'y';
 DROP TABLE t2;
+CREATE TABLE t3(a INT PRIMARY KEY REFERENCES t1(a)) ENGINE=InnoDB;
+XA START 'a';
+INSERT INTO t3 SET a=1;
+INSERT INTO t3 SET a=42;
+ERROR 23000: Cannot add or update a child row: a foreign key constraint fails (`test`.`t3`, CONSTRAINT `t3_ibfk_1` FOREIGN KEY (`a`) REFERENCES `t1` (`a`))
+XA END 'a';
+XA PREPARE 'a';
 SET GLOBAL innodb_fast_shutdown=0;
 # restart
+XA COMMIT 'a';
+SELECT * FROM t3;
+a
+1
+DROP TABLE t3,t1;
diff --git a/mysql-test/suite/innodb/t/lock_memory.test b/mysql-test/suite/innodb/t/lock_memory.test
new file mode 100644
index 00000000000..6b936e18dfc
--- /dev/null
+++ b/mysql-test/suite/innodb/t/lock_memory.test
@@ -0,0 +1,29 @@
+--source include/have_innodb.inc
+--source include/have_innodb_16k.inc
+
+--echo #
+--echo # MDEV-28800 SIGABRT due to running out of memory for InnoDB locks
+--echo #
+
+CREATE TABLE t1 (col1 INT) ENGINE=InnoDB;
+
+INSERT INTO t1 VALUES (1),(2),(3),(4);
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+
+START TRANSACTION;
+
+# Insert 64K records
+INSERT INTO t1 SELECT a.* FROM t1 a, t1 b, t1 c, t1 d;
+
+# The check needs to be adjusted if we start using more memory for locks. It
+# needs 9 pages for 16k page size and we put the limit as 10.
+SELECT CASE WHEN (POOL_SIZE - (FREE_BUFFERS + DATABASE_PAGES)) <= 10 THEN "PASSED"
+            ELSE (POOL_SIZE - (FREE_BUFFERS + DATABASE_PAGES)) END
+FROM information_schema.innodb_buffer_pool_stats;
+
+COMMIT;
+
+SELECT COUNT(*) FROM t1;
+
+DROP TABLE t1;
diff --git a/mysql-test/suite/innodb/t/lock_memory_debug.opt b/mysql-test/suite/innodb/t/lock_memory_debug.opt
new file mode 100644
index 00000000000..67c8423cf2a
--- /dev/null
+++ b/mysql-test/suite/innodb/t/lock_memory_debug.opt
@@ -0,0 +1 @@
+--innodb_buffer_pool_size=5M
diff --git a/mysql-test/suite/innodb/t/lock_memory_debug.test b/mysql-test/suite/innodb/t/lock_memory_debug.test
new file mode 100644
index 00000000000..51e0e8fd57e
--- /dev/null
+++ b/mysql-test/suite/innodb/t/lock_memory_debug.test
@@ -0,0 +1,19 @@
+--source include/have_innodb.inc
+--source include/have_debug.inc
+
+--echo #
+--echo # MDEV-34166 Server could hang with BP < 80M under stress
+--echo #
+
+call mtr.add_suppression("\\[Warning\\] InnoDB: Over 67 percent of the buffer pool");
+
+CREATE TABLE t1 (col1 INT) ENGINE=InnoDB;
+INSERT INTO t1 VALUES (1),(2),(3),(4),(5);
+
+--error ER_LOCK_TABLE_FULL
+SET STATEMENT debug_dbug='+d,innodb_skip_lock_bitmap' FOR
+INSERT INTO t1 SELECT a.* FROM t1 a, t1 b, t1 c, t1 d, t1 e, t1 f, t1 g LIMIT 45000;
+
+SELECT COUNT(*) FROM t1;
+
+DROP TABLE t1;
diff --git a/mysql-test/suite/innodb/t/table_flags.test b/mysql-test/suite/innodb/t/table_flags.test
index e88499a4278..8badb6af79b 100644
--- a/mysql-test/suite/innodb/t/table_flags.test
+++ b/mysql-test/suite/innodb/t/table_flags.test
@@ -256,3 +256,15 @@ INSERT INTO t1 VALUES(2);
 let $shutdown_timeout = 0;
 --source include/restart_mysqld.inc
 DROP TABLE t1;
+
+--echo #
+--echo # MDEV-34222 Alter operation on redundant table aborts the server
+--echo #
+SET @df_row = @@global.INNODB_DEFAULT_ROW_FORMAT;
+SET GLOBAL INNODB_DEFAULT_ROW_FORMAT=REDUNDANT;
+CREATE TABLE t1 (c CHAR(1)) ENGINE=InnoDB;
+SET GLOBAL INNODB_DEFAULT_ROW_FORMAT=compact;
+--error ER_ILLEGAL_HA_CREATE_OPTION
+ALTER TABLE t1 PAGE_COMPRESSED=1;
+DROP TABLE t1;
+SET @@global.INNODB_DEFAULT_ROW_FORMAT = @df_row;
diff --git a/mysql-test/suite/innodb/t/temporary_table.test b/mysql-test/suite/innodb/t/temporary_table.test
index 9c742ce75c6..0a8e72969d5 100644
--- a/mysql-test/suite/innodb/t/temporary_table.test
+++ b/mysql-test/suite/innodb/t/temporary_table.test
@@ -635,4 +635,23 @@ CHECK TABLE t;
 CHECK TABLE t EXTENDED;
 DROP TEMPORARY TABLE t;
 
+--echo #
+--echo # MDEV-34118 fsp_alloc_free_extent() fails to flag DB_OUT_OF_FILE_SPACE
+--echo #
+SET @save_increment = @@GLOBAL.innodb_autoextend_increment;
+SET GLOBAL innodb_autoextend_increment=1;
+CREATE TEMPORARY TABLE t (c LONGTEXT) ENGINE=INNODB;
+if ($MTR_COMBINATION_4K)
+{
+--error ER_RECORD_FILE_FULL
+INSERT INTO t VALUES (REPEAT ('1',16777216));
+}
+if (!$MTR_COMBINATION_4K)
+{
+INSERT INTO t VALUES (REPEAT ('1',16777216));
+--echo ERROR HY000: The table 't' is full
+}
+DROP TEMPORARY TABLE t;
+SET GLOBAL innodb_autoextend_increment=@save_increment;
+
 --echo # End of 10.6 tests
diff --git a/mysql-test/suite/innodb/t/undo_space_dblwr.test b/mysql-test/suite/innodb/t/undo_space_dblwr.test
index 52b19a4b7fb..4cf4d3b8b6d 100644
--- a/mysql-test/suite/innodb/t/undo_space_dblwr.test
+++ b/mysql-test/suite/innodb/t/undo_space_dblwr.test
@@ -39,7 +39,7 @@ EOF
 
 --source include/start_mysqld.inc
 let SEARCH_FILE= $MYSQLTEST_VARDIR/log/mysqld.1.err;
-let SEARCH_PATTERN= Checksum mismatch in the first page of file;
+let SEARCH_PATTERN= Restoring page \[page id: space=1, page number=0\] of datafile '.*undo001' from the doublewrite buffer.;
 --source include/search_pattern_in_file.inc
 
 check table t1;
diff --git a/mysql-test/suite/innodb/t/xa_recovery.test b/mysql-test/suite/innodb/t/xa_recovery.test
index 547c4eb9d54..e3479f6fe78 100644
--- a/mysql-test/suite/innodb/t/xa_recovery.test
+++ b/mysql-test/suite/innodb/t/xa_recovery.test
@@ -10,12 +10,12 @@ call mtr.add_suppression("Found [12] prepared XA transactions");
 FLUSH TABLES;
 --enable_query_log
 
-CREATE TABLE t1 (a INT) ENGINE=InnoDB;
+CREATE TABLE t1 (a INT PRIMARY KEY) ENGINE=InnoDB;
 INSERT INTO t1 VALUES (1);
 connect (con1,localhost,root);
 XA START 'x'; UPDATE t1 set a=2; XA END 'x'; XA PREPARE 'x';
 connect (con2,localhost,root);
-CREATE TABLE t2 (a INT) ENGINE=InnoDB;
+CREATE TABLE t2 (a INT PRIMARY KEY) ENGINE=InnoDB;
 XA START 'y'; INSERT INTO t2 VALUES (1); XA END 'y'; XA PREPARE 'y';
 connection default;
 
@@ -53,11 +53,21 @@ SELECT * FROM t1;
 XA ROLLBACK 'x';
 SELECT * FROM t1;
 
-DROP TABLE t1;
 --error ER_LOCK_WAIT_TIMEOUT
 DROP TABLE t2;
 XA ROLLBACK 'y';
 DROP TABLE t2;
+CREATE TABLE t3(a INT PRIMARY KEY REFERENCES t1(a)) ENGINE=InnoDB;
+XA START 'a';
+INSERT INTO t3 SET a=1;
+--error ER_NO_REFERENCED_ROW_2
+INSERT INTO t3 SET a=42;
+XA END 'a';
+XA PREPARE 'a';
 
 SET GLOBAL innodb_fast_shutdown=0;
 --source include/restart_mysqld.inc
+
+XA COMMIT 'a';
+SELECT * FROM t3;
+DROP TABLE t3,t1;
diff --git a/mysql-test/suite/mariabackup/backup_grants.result b/mysql-test/suite/mariabackup/backup_grants.result
index 3407d288264..c268d4fb19d 100644
--- a/mysql-test/suite/mariabackup/backup_grants.result
+++ b/mysql-test/suite/mariabackup/backup_grants.result
@@ -1,13 +1,17 @@
 CREATE user backup@localhost IDENTIFIED BY 'xyz';
+NOT FOUND /missing required privilege/ in backup.log
 FOUND 1 /missing required privilege RELOAD/ in backup.log
 FOUND 1 /missing required privilege PROCESS/ in backup.log
 FOUND 1 /GRANT USAGE ON/ in backup.log
 GRANT RELOAD, PROCESS on *.* to backup@localhost;
-FOUND 1 /missing required privilege REPLICA MONITOR/ in backup.log
+NOT FOUND /missing required privilege/ in backup.log
+FOUND 1 /missing required privilege SLAVE MONITOR/ in backup.log
 GRANT REPLICA MONITOR ON *.* TO backup@localhost;
+NOT FOUND /missing required privilege/ in backup.log
 REVOKE REPLICA MONITOR ON *.* FROM backup@localhost;
 FOUND 1 /missing required privilege REPLICATION SLAVE ADMIN/ in backup.log
-FOUND 1 /missing required privilege REPLICA MONITOR/ in backup.log
+FOUND 1 /missing required privilege SLAVE MONITOR/ in backup.log
 GRANT REPLICATION SLAVE ADMIN ON *.* TO backup@localhost;
 GRANT REPLICA MONITOR ON *.* TO backup@localhost;
+NOT FOUND /missing required privilege/ in backup.log
 DROP USER backup@localhost;
diff --git a/mysql-test/suite/mariabackup/backup_grants.test b/mysql-test/suite/mariabackup/backup_grants.test
index a90b4678d44..1e1d6a34f3d 100644
--- a/mysql-test/suite/mariabackup/backup_grants.test
+++ b/mysql-test/suite/mariabackup/backup_grants.test
@@ -1,10 +1,14 @@
 let $targetdir=$MYSQLTEST_VARDIR/tmp/backup;
 CREATE user backup@localhost IDENTIFIED BY 'xyz';
 
+let SEARCH_FILE=$MYSQLTEST_VARDIR/tmp/backup.log;
 # backup possible for unprivileges user, with --no-lock
 --disable_result_log
-exec $XTRABACKUP --defaults-file=$MYSQLTEST_VARDIR/my.cnf --backup --parallel=10 -ubackup -pxyz --no-lock  --target-dir=$targetdir;
+exec $XTRABACKUP --defaults-file=$MYSQLTEST_VARDIR/my.cnf --backup --parallel=10 -ubackup -pxyz --no-lock  --target-dir=$targetdir > $MYSQLTEST_VARDIR/tmp/backup.log 2>&1;
 --enable_result_log
+
+--let SEARCH_PATTERN=  missing required privilege
+--source include/search_pattern_in_file.inc
 rmdir $targetdir;
 
 # backup fails without --no-lock, because of FTWRL
@@ -13,7 +17,6 @@ error 1;
 exec $XTRABACKUP --defaults-file=$MYSQLTEST_VARDIR/my.cnf --backup --parallel=10 -ubackup -pxyz --target-dir=$targetdir > $MYSQLTEST_VARDIR/tmp/backup.log 2>&1;
 --enable_result_log
 
-let SEARCH_FILE=$MYSQLTEST_VARDIR/tmp/backup.log;
 --let SEARCH_PATTERN=  missing required privilege RELOAD
 --source include/search_pattern_in_file.inc
 --let SEARCH_PATTERN=  missing required privilege PROCESS
@@ -23,25 +26,29 @@ let SEARCH_FILE=$MYSQLTEST_VARDIR/tmp/backup.log;
 # backup succeeds with RELOAD privilege
 GRANT RELOAD, PROCESS on *.* to backup@localhost;
 --disable_result_log
-exec $XTRABACKUP --defaults-file=$MYSQLTEST_VARDIR/my.cnf  --backup --parallel=10 --user=backup --password=xyz --target-dir=$targetdir;
+exec $XTRABACKUP --defaults-file=$MYSQLTEST_VARDIR/my.cnf  --backup --parallel=10 --user=backup --password=xyz --target-dir=$targetdir > $MYSQLTEST_VARDIR/tmp/backup.log 2>&1;
 --enable_result_log
+--let SEARCH_PATTERN=  missing required privilege
+--source include/search_pattern_in_file.inc
 rmdir $targetdir;
 
 # MDEV-23607 Warning: missing required privilege REPLICATION CLIENT
-# --slave-info and galera info require REPLICA MONITOR
+# --slave-info and --galera-info require REPLICA MONITOR
 --disable_result_log
 error 1;
 exec $XTRABACKUP --defaults-file=$MYSQLTEST_VARDIR/my.cnf --backup --user=backup --password=xyz --slave-info  --target-dir=$targetdir > $MYSQLTEST_VARDIR/tmp/backup.log 2>&1;
 --enable_result_log
 rmdir $targetdir;
 
---let SEARCH_PATTERN=  missing required privilege REPLICA MONITOR
+--let SEARCH_PATTERN=  missing required privilege SLAVE MONITOR
 --source include/search_pattern_in_file.inc
 
 GRANT REPLICA MONITOR ON *.* TO backup@localhost;
 --disable_result_log
-exec $XTRABACKUP --defaults-file=$MYSQLTEST_VARDIR/my.cnf --backup --user backup --password xyz --slave-info --target-dir=$targetdir;
+exec $XTRABACKUP --defaults-file=$MYSQLTEST_VARDIR/my.cnf --backup --user backup --password xyz --slave-info --target-dir=$targetdir > $MYSQLTEST_VARDIR/tmp/backup.log 2>&1;
 --enable_result_log
+--let SEARCH_PATTERN=  missing required privilege
+--source include/search_pattern_in_file.inc
 rmdir $targetdir;
 REVOKE REPLICA MONITOR ON *.* FROM backup@localhost;
 
@@ -54,14 +61,16 @@ rmdir $targetdir;
 
 --let SEARCH_PATTERN=  missing required privilege REPLICATION SLAVE ADMIN
 --source include/search_pattern_in_file.inc
---let SEARCH_PATTERN=  missing required privilege REPLICA MONITOR
+--let SEARCH_PATTERN=  missing required privilege SLAVE MONITOR
 --source include/search_pattern_in_file.inc
 
 GRANT REPLICATION SLAVE ADMIN ON *.* TO backup@localhost;
 GRANT REPLICA MONITOR ON *.* TO backup@localhost;
 --disable_result_log
-exec $XTRABACKUP --defaults-file=$MYSQLTEST_VARDIR/my.cnf --backup -ubackup -pxyz --safe-slave-backup --target-dir=$targetdir;
+exec $XTRABACKUP --defaults-file=$MYSQLTEST_VARDIR/my.cnf --backup -ubackup -pxyz --safe-slave-backup --target-dir=$targetdir > $MYSQLTEST_VARDIR/tmp/backup.log 2>&1;
 --enable_result_log
+--let SEARCH_PATTERN=  missing required privilege
+--source include/search_pattern_in_file.inc
 rmdir $targetdir;
 
 DROP USER backup@localhost;
diff --git a/mysql-test/suite/parts/r/mdev_24610.result b/mysql-test/suite/parts/r/mdev_24610.result
new file mode 100644
index 00000000000..6b49b059993
--- /dev/null
+++ b/mysql-test/suite/parts/r/mdev_24610.result
@@ -0,0 +1,24 @@
+CREATE TABLE t (c BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY) ENGINE=MEMORY PARTITION BY KEY();
+INSERT INTO t VALUES (18446744073709551615);
+select * from t;
+c
+18446744073709551615
+drop table t;
+CREATE TABLE t (c BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY) ENGINE=MEMORY;
+INSERT INTO t VALUES (18446744073709551615);
+ALTER TABLE t PARTITION BY KEY();
+INSERT INTO t VALUES (1);
+select * from t;
+c
+18446744073709551615
+1
+drop table t;
+CREATE TABLE t (c BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY) ENGINE=MEMORY;
+INSERT INTO t VALUES (18446744073709551615);
+ALTER TABLE t PARTITION BY KEY();
+INSERT INTO t VALUES (NULL);
+ERROR HY000: Failed to read auto-increment value from storage engine
+select * from t;
+c
+18446744073709551615
+drop table t;
diff --git a/mysql-test/suite/parts/t/mdev_24610.test b/mysql-test/suite/parts/t/mdev_24610.test
new file mode 100644
index 00000000000..df3ce9fdf0b
--- /dev/null
+++ b/mysql-test/suite/parts/t/mdev_24610.test
@@ -0,0 +1,22 @@
+--source include/have_innodb.inc
+--source include/have_partition.inc
+
+CREATE TABLE t (c BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY) ENGINE=MEMORY PARTITION BY KEY();
+INSERT INTO t VALUES (18446744073709551615);
+select * from t;
+drop table t;
+
+CREATE TABLE t (c BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY) ENGINE=MEMORY;
+INSERT INTO t VALUES (18446744073709551615);
+ALTER TABLE t PARTITION BY KEY();
+INSERT INTO t VALUES (1);
+select * from t;
+drop table t;
+
+CREATE TABLE t (c BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY) ENGINE=MEMORY;
+INSERT INTO t VALUES (18446744073709551615);
+ALTER TABLE t PARTITION BY KEY();
+--error ER_AUTOINC_READ_FAILED
+INSERT INTO t VALUES (NULL);
+select * from t;
+drop table t;
diff --git a/mysys/crc32/crc32c_x86.cc b/mysys/crc32/crc32c_x86.cc
index 02dbf2920eb..1ea0689a14b 100644
--- a/mysys/crc32/crc32c_x86.cc
+++ b/mysys/crc32/crc32c_x86.cc
@@ -24,7 +24,11 @@
 # endif
 #else
 # include <cpuid.h>
-# if __GNUC__ >= 11 || (defined __clang_major__ && __clang_major__ >= 8)
+# ifdef __APPLE__ /* AVX512 states are not enabled in XCR0 */
+# elif __GNUC__ >= 14 || (defined __clang_major__ && __clang_major__ >= 18)
+#  define TARGET "pclmul,evex512,avx512f,avx512dq,avx512bw,avx512vl,vpclmulqdq"
+#  define USE_VPCLMULQDQ __attribute__((target(TARGET)))
+# elif __GNUC__ >= 11 || (defined __clang_major__ && __clang_major__ >= 8)
 #  define TARGET "pclmul,avx512f,avx512dq,avx512bw,avx512vl,vpclmulqdq"
 #  define USE_VPCLMULQDQ __attribute__((target(TARGET)))
 # endif
@@ -173,19 +177,11 @@ static inline __m512i combine512(__m512i a, __m512i tab, __m512i b)
 # define and128(a, b) _mm_and_si128(a, b)
 
 template<uint8_t bits> USE_VPCLMULQDQ
-/** Pick a 128-bit component of a 512-bit vector */
+/** Pick and zero-extend 128 bits of a 512-bit vector (vextracti32x4) */
 static inline __m512i extract512_128(__m512i a)
 {
   static_assert(bits <= 3, "usage");
-# if defined __GNUC__ && __GNUC__ >= 11
-  /* While technically incorrect, this would seem to translate into a
-  vextracti32x4 instruction, which actually outputs a ZMM register
-  (anything above the XMM range is cleared). */
-  return _mm512_castsi128_si512(_mm512_extracti64x2_epi64(a, bits));
-# else
-  /* On clang, this is needed in order to get a correct result. */
-  return _mm512_maskz_shuffle_i64x2(3, a, a, bits);
-# endif
+  return _mm512_zextsi128_si512(_mm512_extracti64x2_epi64(a, bits));
 }
 
 alignas(16) static const uint64_t shuffle128[4] = {
diff --git a/mysys/ma_dyncol.c b/mysys/ma_dyncol.c
index 35060b17665..60aaffba227 100644
--- a/mysys/ma_dyncol.c
+++ b/mysys/ma_dyncol.c
@@ -3848,13 +3848,13 @@ my_bool dynstr_append_json_quoted(DYNAMIC_STRING *str,
     register char c= append[i];
     if (unlikely(((uchar)c) <= 0x1F))
     {
-      if (lim < 5)
+      if (lim < 6)
         {
           if (dynstr_realloc(str, additional))
             return TRUE;
           lim+= additional;
         }
-        lim-= 5;
+        lim -= 6;
         str->str[str->length++]= '\\';
         str->str[str->length++]= 'u';
         str->str[str->length++]= '0';
@@ -3865,17 +3865,18 @@ my_bool dynstr_append_json_quoted(DYNAMIC_STRING *str,
     }
     else
     {
+      if (lim < 2)
+      {
+        if (dynstr_realloc(str, additional))
+          return TRUE;
+        lim += additional;
+      }
       if (c == '"' || c == '\\')
       {
-        if (!lim)
-        {
-          if (dynstr_realloc(str, additional))
-            return TRUE;
-          lim= additional;
-        }
         lim--;
         str->str[str->length++]= '\\';
       }
+      lim--;
       str->str[str->length++]= c;
     }
   }
diff --git a/scripts/mysql_install_db.sh b/scripts/mysql_install_db.sh
index 1ba63b7759f..e6abcd10958 100644
--- a/scripts/mysql_install_db.sh
+++ b/scripts/mysql_install_db.sh
@@ -38,6 +38,7 @@ force=0
 in_rpm=0
 ip_only=0
 cross_bootstrap=0
+do_resolve=0
 auth_root_authentication_method=socket
 auth_root_socket_user=""
 skip_test_db=0
@@ -336,6 +337,11 @@ parse_arguments PICK-ARGS-FROM-ARGV "$@"
 
 rel_mysqld="$dirname0/@INSTALL_SBINDIR@/mariadbd"
 
+if test "$cross_bootstrap" -eq 0 -a "$in_rpm" -eq 0 -a "$force" -eq 0
+  do_resolve=1
+then
+fi
+
 # Configure paths to support files
 if test -n "$srcdir"
 then
@@ -428,7 +434,7 @@ fi
 hostname=`@HOSTNAME@`
 
 # Check if hostname is valid
-if test "$cross_bootstrap" -eq 0 -a "$in_rpm" -eq 0 -a "$force" -eq 0
+if test "$do_resolve" -eq 1
 then
   resolved=`"$resolveip" $hostname 2>&1`
   if test $? -ne 0
@@ -454,7 +460,7 @@ then
   fi
 fi
 
-if test "$ip_only" -eq 1
+if test "$do_resolve" -eq 1 -a "$ip_only" -eq 1
 then
   hostname=`echo "$resolved" | while read a; do echo ${a##* }; done`
 fi
diff --git a/sql-common/client.c b/sql-common/client.c
index 1562d016273..f2803119678 100644
--- a/sql-common/client.c
+++ b/sql-common/client.c
@@ -21,7 +21,7 @@
   The differences for the two cases are:
 
   - Things that only works for the client:
-  - Trying to automaticly determinate user name if not supplied to
+  - Trying to automatically determinate user name if not supplied to
     mysql_real_connect()
   - Support for reading local file with LOAD DATA LOCAL
   - SHARED memory handling
@@ -30,7 +30,7 @@
   - Things that only works for the server
   - Alarm handling on connect
   
-  In all other cases, the code should be idential for the client and
+  In all other cases, the code should be identical for the client and
   server.
 */ 
 
@@ -1455,7 +1455,7 @@ mysql_init(MYSQL *mysql)
     mysql_reconnect()).
     This is a change: < 5.0.3 mysql->reconnect was set to 1 by default.
     How this change impacts existing apps:
-    - existing apps which relyed on the default will see a behaviour change;
+    - existing apps which relied on the default will see a behaviour change;
     they will have to set reconnect=1 after mysql_real_connect().
     - existing apps which explicitly asked for reconnection (the only way they
     could do it was by setting mysql.reconnect to 1 after mysql_real_connect())
@@ -1936,7 +1936,7 @@ typedef struct {
 
 
 /*
-  Write 1-8 bytes of string length header infromation to dest depending on
+  Write 1-8 bytes of string length header information to dest depending on
   value of src_len, then copy src_len bytes from src to dest.
  
  @param dest Destination buffer of size src_len+8
@@ -2217,7 +2217,7 @@ static int send_client_reply_packet(MCPVIO_EXT *mpvio,
   }
 #endif /* HAVE_OPENSSL */
 
-  DBUG_PRINT("info",("Server version = '%s'  capabilites: %lu  status: %u  client_flag: %lu",
+  DBUG_PRINT("info",("Server version = '%s'  capabilities: %lu  status: %u  client_flag: %lu",
 		     mysql->server_version, mysql->server_capabilities,
 		     mysql->server_status, mysql->client_flag));
 
@@ -2354,7 +2354,7 @@ static int client_mpvio_read_packet(struct st_plugin_vio *mpv, uchar **buf)
   to send data to the server.
 
   It transparently wraps the data into a change user or authentication
-  handshake packet, if neccessary.
+  handshake packet, if necessary.
 */
 static int client_mpvio_write_packet(struct st_plugin_vio *mpv,
                                      const uchar *pkt, int pkt_len)
@@ -3757,7 +3757,7 @@ mysql_options(MYSQL *mysql,enum mysql_option option, const void *arg)
     mysql->options.compress= 1;			/* Remember for connect */
     mysql->options.client_flag|= CLIENT_COMPRESS;
     break;
-  case MYSQL_OPT_NAMED_PIPE:			/* This option is depricated */
+  case MYSQL_OPT_NAMED_PIPE:			/* This option is deprecated */
     mysql->options.protocol=MYSQL_PROTOCOL_PIPE; /* Force named pipe */
     break;
   case MYSQL_OPT_LOCAL_INFILE:			/* Allow LOAD DATA LOCAL ?*/
diff --git a/sql-common/my_time.c b/sql-common/my_time.c
index 96674723b34..eff39cd5eae 100644
--- a/sql-common/my_time.c
+++ b/sql-common/my_time.c
@@ -475,7 +475,7 @@ str_to_DDhhmmssff_internal(my_bool neg, const char *str, size_t length,
 
 
   DESCRIPTION
-    At least the following formats are recogniced (based on number of digits)
+    At least the following formats are recognized (based on number of digits)
     YYMMDD, YYYYMMDD, YYMMDDHHMMSS, YYYYMMDDHHMMSS
     YY-MM-DD, YYYY-MM-DD, YY-MM-DD HH.MM.SS
     YYYYMMDDTHHMMSS  where T is a the character T (ISO8601)
@@ -1223,7 +1223,7 @@ long calc_daynr(uint year,uint month,uint day)
 
 /*
   Convert time in MYSQL_TIME representation in system time zone to its
-  my_time_t form (number of seconds in UTC since begginning of Unix Epoch).
+  my_time_t form (number of seconds in UTC since beginning of Unix Epoch).
 
   SYNOPSIS
     my_system_gmt_sec()
@@ -1291,7 +1291,7 @@ my_system_gmt_sec(const MYSQL_TIME *t_src, long *my_timezone, uint *error_code)
     two days earlier, and then add these days to the final value.
 
     The same trick is done for the values close to 0 in time_t
-    representation for platfroms with unsigned time_t (QNX).
+    representation for platforms with unsigned time_t (QNX).
 
     To be more verbose, here is a sample (extracted from the code below):
     (calc_daynr(2038, 1, 19) - (long) days_at_timestart)*86400L + 4*3600L
@@ -1303,9 +1303,9 @@ my_system_gmt_sec(const MYSQL_TIME *t_src, long *my_timezone, uint *error_code)
     will give -3600.
 
     On some platforms, (E.g. on QNX) time_t is unsigned and localtime(-3600)
-    wil give us a date around 2106 year. Which is no good.
+    will give us a date around 2106 year. Which is no good.
 
-    Theoreticaly, there could be problems with the latter conversion:
+    Theoretically, there could be problems with the latter conversion:
     there are at least two timezones, which had time switches near 1 Jan
     of 1970 (because of political reasons). These are America/Hermosillo and
     America/Mazatlan time zones. They changed their offset on
@@ -1335,7 +1335,7 @@ my_system_gmt_sec(const MYSQL_TIME *t_src, long *my_timezone, uint *error_code)
   else
   {
     /*
-      We can get 0 in time_t representaion only on 1969, 31 of Dec or on
+      We can get 0 in time_t representation only on 1969, 31 of Dec or on
       1970, 1 of Jan. For both dates we use shift, which is added
       to t->day in order to step out a bit from the border.
       This is required for platforms, where time_t is unsigned.
@@ -1430,9 +1430,9 @@ my_system_gmt_sec(const MYSQL_TIME *t_src, long *my_timezone, uint *error_code)
     First check will pass for platforms with signed time_t.
     instruction above (tmp+= shift*86400L) could exceed
     MAX_INT32 (== TIMESTAMP_MAX_VALUE) and overflow will happen.
-    So, tmp < TIMESTAMP_MIN_VALUE will be triggered. On platfroms
+    So, tmp < TIMESTAMP_MIN_VALUE will be triggered. On platforms
     with unsigned time_t tmp+= shift*86400L might result in a number,
-    larger then TIMESTAMP_MAX_VALUE, so another check will work.
+    larger than TIMESTAMP_MAX_VALUE, so another check will work.
   */
   if (!IS_TIME_T_VALID_FOR_TIMESTAMP(tmp))
   {
@@ -1545,8 +1545,8 @@ static inline char* fmt_number2(uint8 val, char *out)
   - 0.225 sec (current)
   - 0.219 sec (array)
 
-  It demonstrated an additional 3% performance imrovement one these queries.
-  However, as the array size is too huge, we afraid that it will flush data
+  It demonstrated an additional 3% performance improvement one these queries.
+  However, as the array size is too huge, we are afraid that it will flush data
   from the CPU memory cache, which under real load may affect negatively.
 
   Let's keep using the fmt_number4() version with division and remainder
diff --git a/sql/gcalc_slicescan.cc b/sql/gcalc_slicescan.cc
index f94c7190532..9af635eb5ab 100644
--- a/sql/gcalc_slicescan.cc
+++ b/sql/gcalc_slicescan.cc
@@ -144,7 +144,7 @@ static void GCALC_DBUG_PRINT_SLICE(const char *header,
   size_t nbuf;
   char buf[1024];
   nbuf= strlen(header);
-  strcpy(buf, header);
+  safe_strcpy(buf, sizeof(buf), header);
   for (; slice; slice= slice->get_next())
   {
     size_t lnbuf= nbuf;
diff --git a/sql/ha_handler_stats.h b/sql/ha_handler_stats.h
index 726ba6041dc..60ae5deedbe 100644
--- a/sql/ha_handler_stats.h
+++ b/sql/ha_handler_stats.h
@@ -26,9 +26,14 @@ public:
   ulonglong pages_accessed;              /* Pages accessed from page cache */
   ulonglong pages_updated;               /* Pages changed in page cache */
   ulonglong pages_read_count;            /* Pages read from disk */
-  ulonglong pages_read_time;             /* Time reading pages, in microsec. */
+
+  /* Time spent reading pages, in timer_tracker_frequency() units */
+  ulonglong pages_read_time;
+
   ulonglong undo_records_read;
-  ulonglong engine_time;                 /* Time spent in engine in microsec */
+
+  /* Time spent in engine, in timer_tracker_frequency() units */
+  ulonglong engine_time;
   uint      active;                      /* <> 0 if status has to be updated */
 #define first_stat pages_accessed
 #define last_stat  engine_time
diff --git a/sql/handler.cc b/sql/handler.cc
index 6aaa45f6629..e98d109969f 100644
--- a/sql/handler.cc
+++ b/sql/handler.cc
@@ -300,13 +300,20 @@ redo:
 }
 
 
+/*
+  Resolve the storage engine by name.
+
+  Succeed if the storage engine is found and initialised. Otherwise
+  fail if the sql mode contains NO_ENGINE_SUBSTITUTION.
+*/
 bool
 Storage_engine_name::resolve_storage_engine_with_error(THD *thd,
                                                        handlerton **ha,
                                                        bool tmp_table)
 {
-  if (plugin_ref plugin= ha_resolve_by_name(thd, &m_storage_engine_name,
-                                            tmp_table))
+  plugin_ref plugin;
+  if ((plugin= ha_resolve_by_name(thd, &m_storage_engine_name, tmp_table)) &&
+      (plugin_ref_to_int(plugin)->state == PLUGIN_IS_READY))
   {
     *ha= plugin_hton(plugin);
     return false;
@@ -4861,7 +4868,7 @@ void handler::print_error(int error, myf errflag)
   if (error < HA_ERR_FIRST && bas_ext()[0])
   {
     char buff[FN_REFLEN];
-    strxnmov(buff, sizeof(buff),
+    strxnmov(buff, sizeof(buff)-1,
              table_share->normalized_path.str, bas_ext()[0], NULL);
     my_error(textno, errflag, buff, error);
   }
diff --git a/sql/hostname.cc b/sql/hostname.cc
index d5f342b9216..0641528f98b 100644
--- a/sql/hostname.cc
+++ b/sql/hostname.cc
@@ -514,42 +514,48 @@ int ip_to_hostname(struct sockaddr_storage *ip_storage,
 
   DBUG_EXECUTE_IF("getnameinfo_error_noname",
                   {
-                    strcpy(hostname_buffer, "<garbage>");
+                    safe_strcpy(hostname_buffer, sizeof(hostname_buffer),
+                                "<garbage>");
                     err_code= EAI_NONAME;
                   }
                   );
 
   DBUG_EXECUTE_IF("getnameinfo_error_again",
                   {
-                    strcpy(hostname_buffer, "<garbage>");
+                    safe_strcpy(hostname_buffer, sizeof(hostname_buffer),
+                                "<garbage>");
                     err_code= EAI_AGAIN;
                   }
                   );
 
   DBUG_EXECUTE_IF("getnameinfo_fake_ipv4",
                   {
-                    strcpy(hostname_buffer, "santa.claus.ipv4.example.com");
+                    safe_strcpy(hostname_buffer, sizeof(hostname_buffer),
+                                "santa.claus.ipv4.example.com");
                     err_code= 0;
                   }
                   );
 
   DBUG_EXECUTE_IF("getnameinfo_fake_ipv6",
                   {
-                    strcpy(hostname_buffer, "santa.claus.ipv6.example.com");
+                    safe_strcpy(hostname_buffer, sizeof(hostname_buffer),
+                                "santa.claus.ipv6.example.com");
                     err_code= 0;
                   }
                   );
 
   DBUG_EXECUTE_IF("getnameinfo_format_ipv4",
                   {
-                    strcpy(hostname_buffer, "12.12.12.12");
+                    safe_strcpy(hostname_buffer, sizeof(hostname_buffer),
+                                "12.12.12.12");
                     err_code= 0;
                   }
                   );
 
   DBUG_EXECUTE_IF("getnameinfo_format_ipv6",
                   {
-                    strcpy(hostname_buffer, "12:DEAD:BEEF:0");
+                    safe_strcpy(hostname_buffer, sizeof(hostname_buffer),
+                                "12:DEAD:BEEF:0");
                     err_code= 0;
                   }
                   );
diff --git a/sql/item_create.cc b/sql/item_create.cc
index 758409c4bd2..3ed601a9b60 100644
--- a/sql/item_create.cc
+++ b/sql/item_create.cc
@@ -6308,8 +6308,7 @@ const Native_func_registry func_array_oracle_overrides[] =
   { { STRING_WITH_LEN("REGEXP_REPLACE") },
                                     BUILDER(Create_func_regexp_replace_oracle)},
   { { STRING_WITH_LEN("RPAD") },    BUILDER(Create_func_rpad_oracle)},
-  { { STRING_WITH_LEN("RTRIM") },   BUILDER(Create_func_rtrim_oracle)},
-  { {0, 0}, NULL}
+  { { STRING_WITH_LEN("RTRIM") },   BUILDER(Create_func_rtrim_oracle)}
 };
 
 Native_func_registry_array
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
index 04086be689c..36df6c12220 100644
--- a/sql/item_strfunc.cc
+++ b/sql/item_strfunc.cc
@@ -5761,7 +5761,7 @@ static NATSORT_ERR to_natsort_key(const String *in, String *out,
 {
   size_t n_digits= 0;
   size_t n_lead_zeros= 0;
-  size_t num_start;
+  size_t num_start= 0;
   size_t reserve_length= std::min(
       natsort_max_key_size(in->length()) + MAX_BIGINT_WIDTH + 2, max_key_size);
 
diff --git a/sql/item_timefunc.cc b/sql/item_timefunc.cc
index 0ac75f903e9..3286651f9d9 100644
--- a/sql/item_timefunc.cc
+++ b/sql/item_timefunc.cc
@@ -1303,6 +1303,15 @@ my_decimal *Item_func_time_to_sec::decimal_op(my_decimal* buf)
 }
 
 
+static inline
+uint32 adjust_interval_field_uint32(ulonglong value, int32 multiplier)
+{
+  return value > ((ulonglong) (uint32) (UINT_MAX32)) / multiplier ?
+         (uint32) UINT_MAX32 :
+         (uint32) (value * multiplier);
+}
+
+
 /**
   Convert a string to a interval value.
 
@@ -1313,7 +1322,7 @@ bool get_interval_value(THD *thd, Item *args,
                         interval_type int_type, INTERVAL *interval)
 {
   ulonglong array[5];
-  longlong UNINIT_VAR(value);
+  ulonglong UNINIT_VAR(value);
   const char *UNINIT_VAR(str);
   size_t UNINIT_VAR(length);
   CHARSET_INFO *UNINIT_VAR(cs);
@@ -1340,14 +1349,17 @@ bool get_interval_value(THD *thd, Item *args,
   }
   else if ((int) int_type <= INTERVAL_MICROSECOND)
   {
-    value= args->val_int();
-    if (args->null_value)
-      return 1;
-    if (value < 0)
-    {
-      interval->neg=1;
-      value= -value;
-    }
+    /*
+      Let's use Longlong_hybrid_null to handle correctly:
+      - signed and unsigned values
+      - the corner case with LONGLONG_MIN
+        (avoid undefined behavior with its negation)
+    */
+    const Longlong_hybrid_null nr= args->to_longlong_hybrid_null();
+    if (nr.is_null())
+      return true;
+    value= nr.abs();
+    interval->neg= nr.neg() ? 1 : 0;
   }
   else
   {
@@ -1374,13 +1386,13 @@ bool get_interval_value(THD *thd, Item *args,
     interval->year= (ulong) value;
     break;
   case INTERVAL_QUARTER:
-    interval->month= (ulong)(value*3);
+    interval->month= adjust_interval_field_uint32(value, 3);
     break;
   case INTERVAL_MONTH:
     interval->month= (ulong) value;
     break;
   case INTERVAL_WEEK:
-    interval->day= (ulong)(value*7);
+    interval->day= adjust_interval_field_uint32(value, 7);
     break;
   case INTERVAL_DAY:
     interval->day= (ulong) value;
diff --git a/sql/lex_ident.h b/sql/lex_ident.h
new file mode 100644
index 00000000000..3af52ab99d0
--- /dev/null
+++ b/sql/lex_ident.h
@@ -0,0 +1,85 @@
+#ifndef LEX_IDENT_INCLUDED
+#define LEX_IDENT_INCLUDED
+/*
+   Copyright (c) 2023, MariaDB
+
+   This program is free software; you can redistribute it and/or
+   modify it under the terms of the GNU General Public License
+   as published by the Free Software Foundation; version 2 of
+   the License.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1335  USA
+*/
+
+
+extern MYSQL_PLUGIN_IMPORT CHARSET_INFO *table_alias_charset;
+
+
+/*
+  Identifiers for the database objects stored on disk,
+  e.g. databases, tables, triggers.
+*/
+class Lex_ident_fs: public LEX_CSTRING
+{
+public:
+  static CHARSET_INFO *charset_info()
+  {
+    return table_alias_charset;
+  }
+public:
+  Lex_ident_fs()
+   :LEX_CSTRING({0,0})
+  { }
+  Lex_ident_fs(const char *str, size_t length)
+   :LEX_CSTRING({str, length})
+  { }
+  explicit Lex_ident_fs(const LEX_CSTRING &str)
+   :LEX_CSTRING(str)
+  { }
+#if MYSQL_VERSION_ID<=110501
+private:
+  static bool is_valid_ident(const LEX_CSTRING &str)
+  {
+    // NULL identifier, or 0-terminated identifier
+    return (str.str == NULL && str.length == 0) || str.str[str.length] == 0;
+  }
+public:
+  bool streq(const LEX_CSTRING &rhs) const
+  {
+    DBUG_ASSERT(is_valid_ident(*this));
+    DBUG_ASSERT(is_valid_ident(rhs));
+    return length == rhs.length &&
+           my_strcasecmp(charset_info(), str, rhs.str) == 0;
+  }
+#else
+/*
+  Starting from 11.5.1 streq() is inherited from the base.
+  The above implementations of streq() and is_valid_ident() should be removed.
+*/
+#error Remove streq() above.
+#endif
+};
+
+
+class Lex_ident_db: public Lex_ident_fs
+{
+public:
+  using Lex_ident_fs::Lex_ident_fs;
+};
+
+
+class Lex_ident_table: public Lex_ident_fs
+{
+public:
+  using Lex_ident_fs::Lex_ident_fs;
+};
+
+
+#endif // LEX_IDENT_INCLUDED
diff --git a/sql/log.h b/sql/log.h
index bcccd3e433e..0b4e6362fce 100644
--- a/sql/log.h
+++ b/sql/log.h
@@ -942,7 +942,7 @@ public:
     mysql_mutex_assert_not_owner(&LOCK_binlog_end_pos);
     lock_binlog_end_pos();
     binlog_end_pos= pos;
-    strcpy(binlog_end_pos_file, file_name);
+    safe_strcpy(binlog_end_pos_file, sizeof(binlog_end_pos_file), file_name);
     signal_bin_log_update();
     unlock_binlog_end_pos();
   }
@@ -955,7 +955,7 @@ public:
   {
     mysql_mutex_assert_not_owner(&LOCK_log);
     mysql_mutex_assert_owner(&LOCK_binlog_end_pos);
-    strcpy(file_name_buf, binlog_end_pos_file);
+    safe_strcpy(file_name_buf, FN_REFLEN, binlog_end_pos_file);
     return binlog_end_pos;
   }
   void lock_binlog_end_pos() { mysql_mutex_lock(&LOCK_binlog_end_pos); }
diff --git a/sql/my_json_writer.cc b/sql/my_json_writer.cc
index 54eb8423caf..b645d4e28b9 100644
--- a/sql/my_json_writer.cc
+++ b/sql/my_json_writer.cc
@@ -212,7 +212,7 @@ void Json_writer::add_ull(ulonglong val)
 }
 
 
-/* Add a memory size, printing in Kb, Kb, Gb if necessary */
+/* Add a memory size, printing in Kb, Mb if necessary */
 void Json_writer::add_size(longlong val)
 {
   char buf[64];
@@ -220,18 +220,10 @@ void Json_writer::add_size(longlong val)
   if (val < 1024) 
     len= my_snprintf(buf, sizeof(buf), "%lld", val);
   else if (val < 1024*1024*16)
-  {
     /* Values less than 16MB are specified in KB for precision */
-    len= my_snprintf(buf, sizeof(buf), "%lld", val/1024);
-    strcpy(buf + len, "Kb");
-    len+= 2;
-  }
+    len= my_snprintf(buf, sizeof(buf), "%lldKb", val/1024);
   else
-  {
-    len= my_snprintf(buf, sizeof(buf), "%lld", val/(1024*1024));
-    strcpy(buf + len, "Mb");
-    len+= 2;
-  }
+    len= my_snprintf(buf, sizeof(buf), "%lldMb", val/(1024*1024));
   add_str(buf, len);
 }
 
diff --git a/sql/mysql_install_db.cc b/sql/mysql_install_db.cc
index 5294b91738b..9217a231af2 100644
--- a/sql/mysql_install_db.cc
+++ b/sql/mysql_install_db.cc
@@ -160,7 +160,7 @@ int main(int argc, char **argv)
   char *datadir = NULL;
   MY_INIT(argv[0]);
   GetModuleFileName(NULL, self_name, MAX_PATH);
-  strcpy(mysqld_path,self_name);
+  safe_strcpy(mysqld_path, sizeof(mysqld_path), self_name);
   p= strrchr(mysqld_path, FN_LIBCHAR);
   if (p)
   {
@@ -224,7 +224,7 @@ int main(int argc, char **argv)
       Figure out default data directory. It "data" directory, next to "bin" directory, where
       mysql_install_db.exe resides.
     */
-    strcpy(default_datadir, self_name);
+    safe_strcpy(default_datadir, sizeof(default_datadir), self_name);
     p = strrchr(default_datadir, FN_LIBCHAR);
     if (p)
     {
diff --git a/sql/rpl_parallel.cc b/sql/rpl_parallel.cc
index bbfc02110a7..a75c0e49650 100644
--- a/sql/rpl_parallel.cc
+++ b/sql/rpl_parallel.cc
@@ -54,11 +54,13 @@ rpt_handle_event(rpl_parallel_thread::queued_event *qev,
   thd->system_thread_info.rpl_sql_info->rpl_filter = rli->mi->rpl_filter;
   ev->thd= thd;
 
-  strcpy(rgi->event_relay_log_name_buf, qev->event_relay_log_name);
+  safe_strcpy(rgi->event_relay_log_name_buf, sizeof(rgi->event_relay_log_name_buf),
+              qev->event_relay_log_name);
   rgi->event_relay_log_name= rgi->event_relay_log_name_buf;
   rgi->event_relay_log_pos= qev->event_relay_log_pos;
   rgi->future_event_relay_log_pos= qev->future_event_relay_log_pos;
-  strcpy(rgi->future_event_master_log_name, qev->future_event_master_log_name);
+  safe_strcpy(rgi->future_event_master_log_name, sizeof(rgi->future_event_master_log_name),
+              qev->future_event_master_log_name);
   if (event_can_update_last_master_timestamp(ev))
     rgi->last_master_timestamp= ev->when + (time_t)ev->exec_time;
   err= apply_event_and_update_pos_for_parallel(ev, thd, rgi);
@@ -115,7 +117,8 @@ handle_queued_pos_update(THD *thd, rpl_parallel_thread::queued_event *qev)
   cmp= compare_log_name(rli->group_master_log_name, qev->future_event_master_log_name);
   if (cmp < 0)
   {
-    strcpy(rli->group_master_log_name, qev->future_event_master_log_name);
+    safe_strcpy(rli->group_master_log_name, sizeof(rli->group_master_log_name),
+                qev->future_event_master_log_name);
     rli->group_master_log_pos= qev->future_event_master_log_pos;
   }
   else if (cmp == 0
@@ -2051,10 +2054,13 @@ rpl_parallel_thread::get_qev(Log_event *ev, ulonglong event_size,
   queued_event *qev= get_qev_common(ev, event_size);
   if (!qev)
     return NULL;
-  strcpy(qev->event_relay_log_name, rli->event_relay_log_name);
+  safe_strcpy(qev->event_relay_log_name, sizeof(qev->event_relay_log_name),
+              rli->event_relay_log_name);
   qev->event_relay_log_pos= rli->event_relay_log_pos;
   qev->future_event_relay_log_pos= rli->future_event_relay_log_pos;
-  strcpy(qev->future_event_master_log_name, rli->future_event_master_log_name);
+  safe_strcpy(qev->future_event_master_log_name,
+              sizeof(qev->future_event_master_log_name),
+              rli->future_event_master_log_name);
   return qev;
 }
 
@@ -2068,11 +2074,13 @@ rpl_parallel_thread::retry_get_qev(Log_event *ev, queued_event *orig_qev,
   if (!qev)
     return NULL;
   qev->rgi= orig_qev->rgi;
-  strcpy(qev->event_relay_log_name, relay_log_name);
+  safe_strcpy(qev->event_relay_log_name, sizeof(qev->event_relay_log_name),
+              relay_log_name);
   qev->event_relay_log_pos= event_pos;
   qev->future_event_relay_log_pos= event_pos+event_size;
-  strcpy(qev->future_event_master_log_name,
-         orig_qev->future_event_master_log_name);
+  safe_strcpy(qev->future_event_master_log_name,
+              sizeof(qev->future_event_master_log_name),
+              orig_qev->future_event_master_log_name);
   return qev;
 }
 
diff --git a/sql/rpl_rli.cc b/sql/rpl_rli.cc
index ad0cb000dfc..4888601ff9b 100644
--- a/sql/rpl_rli.cc
+++ b/sql/rpl_rli.cc
@@ -996,7 +996,8 @@ void Relay_log_info::inc_group_relay_log_pos(ulonglong log_pos,
     {
       if (cmp < 0)
       {
-        strcpy(group_master_log_name, rgi->future_event_master_log_name);
+        safe_strcpy(group_master_log_name, sizeof(group_master_log_name),
+                    rgi->future_event_master_log_name);
         group_master_log_pos= log_pos;
       }
       else if (group_master_log_pos < log_pos)
diff --git a/sql/semisync_master.cc b/sql/semisync_master.cc
index aa1056c8c8f..f22d3fc4016 100644
--- a/sql/semisync_master.cc
+++ b/sql/semisync_master.cc
@@ -422,7 +422,8 @@ Repl_semi_sync_master::Repl_semi_sync_master()
     m_state(0),
     m_wait_point(0)
 {
-  m_reply_file_name[0]= m_wait_file_name[0]= 0;
+  m_reply_file_name[0]= '\0';
+  m_wait_file_name[0]= '\0';
 }
 
 int Repl_semi_sync_master::init_object()
@@ -802,7 +803,8 @@ int Repl_semi_sync_master::report_binlog_update(THD *trans_thd,
         return 1;
       trans_thd->semisync_info= log_info;
     }
-    strcpy(log_info->log_file, log_file + dirname_length(log_file));
+    safe_strcpy(log_info->log_file, sizeof(log_info->log_file), 
+                log_file + dirname_length(log_file));
     log_info->log_pos = log_pos;
 
     return write_tranx_in_binlog(waiter_thd, log_info->log_file,
diff --git a/sql/sql_acl.cc b/sql/sql_acl.cc
index 9108047c781..785e0956c97 100644
--- a/sql/sql_acl.cc
+++ b/sql/sql_acl.cc
@@ -7312,8 +7312,8 @@ int mysql_table_grant(THD *thd, TABLE_LIST *table_list,
       continue;					// Add next user
     }
 
-    db_name= table_list->get_db_name();
-    table_name= table_list->get_table_name();
+    db_name= table_list->get_db_name().str;
+    table_name= table_list->get_table_name().str;
 
     /* Find/create cached table grant */
     grant_table= table_hash_search(Str->host.str, NullS, db_name,
@@ -8388,8 +8388,8 @@ bool check_grant(THD *thd, privilege_t want_access, TABLE_LIST *tables,
 
     const ACL_internal_table_access *access=
       get_cached_table_access(&t_ref->grant.m_internal,
-                              t_ref->get_db_name(),
-                              t_ref->get_table_name());
+                              t_ref->get_db_name().str,
+                              t_ref->get_table_name().str);
 
     if (access)
     {
@@ -8454,7 +8454,8 @@ bool check_grant(THD *thd, privilege_t want_access, TABLE_LIST *tables,
       mysql_rwlock_rdlock(&LOCK_grant);
     }
 
-    t_ref->grant.read(sctx, t_ref->get_db_name(), t_ref->get_table_name());
+    t_ref->grant.read(sctx,
+                      t_ref->get_db_name().str, t_ref->get_table_name().str);
 
     if (!t_ref->grant.grant_table_user &&
         !t_ref->grant.grant_table_role &&
@@ -8499,7 +8500,7 @@ err:
              command,
              sctx->priv_user,
              sctx->host_or_ip, tl ? tl->db.str : "unknown",
-             tl ? tl->get_table_name() : "unknown");
+             tl ? tl->get_table_name().str : "unknown");
   }
   DBUG_RETURN(TRUE);
 }
@@ -13957,9 +13958,11 @@ static ulong parse_client_handshake_packet(MPVIO_EXT *mpvio,
     Since 4.1 all database names are stored in utf8
     The cast is ok as copy_with_error will create a new area for db
   */
+  DBUG_ASSERT(db || !db_len);
+  // Don't pass db==nullptr to avoid UB nullptr+0 inside copy_with_error()
   if (unlikely(thd->copy_with_error(system_charset_info,
                                     (LEX_STRING*) &mpvio->db,
-                                    thd->charset(), db, db_len)))
+                                    thd->charset(), db ? db : "", db_len)))
     return packet_error;
 
   user_len= copy_and_convert(user_buff, sizeof(user_buff) - 1,
diff --git a/sql/sql_base.cc b/sql/sql_base.cc
index f8901c07c7b..8d11dac4a5c 100644
--- a/sql/sql_base.cc
+++ b/sql/sql_base.cc
@@ -202,9 +202,9 @@ uint get_table_def_key(const TABLE_LIST *table_list, const char **key)
     is properly initialized, so table definition cache can be produced
     from key used by MDL subsystem.
   */
-  DBUG_ASSERT(!strcmp(table_list->get_db_name(),
+  DBUG_ASSERT(!strcmp(table_list->get_db_name().str,
                       table_list->mdl_request.key.db_name()));
-  DBUG_ASSERT(!strcmp(table_list->get_table_name(),
+  DBUG_ASSERT(!strcmp(table_list->get_table_name().str,
                       table_list->mdl_request.key.name()));
 
   *key= (const char*)table_list->mdl_request.key.ptr() + 1;
@@ -235,33 +235,40 @@ uint get_table_def_key(const TABLE_LIST *table_list, const char **key)
     #		Pointer to list of names of open tables.
 */
 
-struct list_open_tables_arg
+class list_open_tables_arg
 {
+public:
   THD *thd;
-  const char *db;
+  const Lex_ident_db db;
   const char *wild;
   TABLE_LIST table_list;
   OPEN_TABLE_LIST **start_list, *open_list;
+
+  list_open_tables_arg(THD *thd_arg, const LEX_CSTRING &db_arg,
+                       const char *wild_arg)
+   :thd(thd_arg), db(db_arg), wild(wild_arg),
+    start_list(&open_list), open_list(0)
+  {
+    bzero((char*) &table_list, sizeof(table_list));
+  }
 };
 
 
 static my_bool list_open_tables_callback(TDC_element *element,
                                          list_open_tables_arg *arg)
 {
-  const char *db= (char*) element->m_key;
-  size_t db_length= strlen(db);
-  const char *table_name= db + db_length + 1;
+  const Lex_ident_db
+    db= Lex_ident_db(Lex_cstring_strlen((const char*) element->m_key));
+  const char *table_name= db.str + db.length + 1;
 
-  if (arg->db && my_strcasecmp(system_charset_info, arg->db, db))
+  if (arg->db.str && !arg->db.streq(db))
     return FALSE;
   if (arg->wild && wild_compare(table_name, arg->wild, 0))
     return FALSE;
 
   /* Check if user has SELECT privilege for any column in the table */
-  arg->table_list.db.str= db;
-  arg->table_list.db.length= db_length;
-  arg->table_list.table_name.str= table_name;
-  arg->table_list.table_name.length= strlen(table_name);
+  arg->table_list.db= db;
+  arg->table_list.table_name= Lex_cstring_strlen(table_name);
   arg->table_list.grant.privilege= NO_ACL;
 
   if (check_table_access(arg->thd, SELECT_ACL, &arg->table_list, TRUE, 1, TRUE))
@@ -273,7 +280,7 @@ static my_bool list_open_tables_callback(TDC_element *element,
 
   strmov((*arg->start_list)->table=
          strmov(((*arg->start_list)->db= (char*) ((*arg->start_list) + 1)),
-                db) + 1, table_name);
+                db.str) + 1, table_name);
   (*arg->start_list)->in_use= 0;
 
   mysql_mutex_lock(&element->LOCK_table_share);
@@ -290,17 +297,12 @@ static my_bool list_open_tables_callback(TDC_element *element,
 }
 
 
-OPEN_TABLE_LIST *list_open_tables(THD *thd, const char *db, const char *wild)
+OPEN_TABLE_LIST *list_open_tables(THD *thd,
+                                  const LEX_CSTRING &db,
+                                  const char *wild)
 {
-  list_open_tables_arg argument;
   DBUG_ENTER("list_open_tables");
-
-  argument.thd= thd;
-  argument.db= db;
-  argument.wild= wild;
-  bzero((char*) &argument.table_list, sizeof(argument.table_list));
-  argument.start_list= &argument.open_list;
-  argument.open_list= 0;
+  list_open_tables_arg argument(thd, db, wild);
 
   if (tdc_iterate(thd, (my_hash_walk_action) list_open_tables_callback,
                   &argument, true))
@@ -1902,7 +1904,7 @@ bool open_table(THD *thd, TABLE_LIST *table_list, Open_table_context *ot_ctx)
   TABLE *table;
   const char *key;
   uint	key_length;
-  const char *alias= table_list->alias.str;
+  const LEX_CSTRING &alias= table_list->alias;
   uint flags= ot_ctx->get_flags();
   MDL_ticket *mdl_ticket;
   TABLE_SHARE *share;
@@ -1970,7 +1972,7 @@ bool open_table(THD *thd, TABLE_LIST *table_list, Open_table_context *ot_ctx)
       if (table->s->table_cache_key.length == key_length &&
 	  !memcmp(table->s->table_cache_key.str, key, key_length))
       {
-        if (!my_strcasecmp(system_charset_info, table->alias.c_ptr(), alias) &&
+        if (Lex_ident_table(table->alias.to_lex_cstring()).streq(alias) &&
             table->query_id != thd->query_id && /* skip tables already used */
             (thd->locked_tables_mode == LTM_LOCK_TABLES ||
              table->query_id == 0))
@@ -2044,7 +2046,7 @@ bool open_table(THD *thd, TABLE_LIST *table_list, Open_table_context *ot_ctx)
     if (thd->locked_tables_mode == LTM_PRELOCKED)
       my_error(ER_NO_SUCH_TABLE, MYF(0), table_list->db.str, table_list->alias.str);
     else
-      my_error(ER_TABLE_NOT_LOCKED, MYF(0), alias);
+      my_error(ER_TABLE_NOT_LOCKED, MYF(0), alias.str);
     DBUG_RETURN(TRUE);
   }
 
diff --git a/sql/sql_base.h b/sql/sql_base.h
index eaf6ca8a6cd..cf5856f9b54 100644
--- a/sql/sql_base.h
+++ b/sql/sql_base.h
@@ -319,7 +319,8 @@ bool flush_tables(THD *thd, flush_tables_type flag);
 void close_all_tables_for_name(THD *thd, TABLE_SHARE *share,
                                ha_extra_function extra,
                                TABLE *skip_table);
-OPEN_TABLE_LIST *list_open_tables(THD *thd, const char *db, const char *wild);
+OPEN_TABLE_LIST *list_open_tables(THD *thd, const LEX_CSTRING &db,
+                                  const char *wild);
 bool tdc_open_view(THD *thd, TABLE_LIST *table_list, uint flags);
 
 TABLE *find_table_for_mdl_upgrade(THD *thd, const char *db,
diff --git a/sql/sql_class.cc b/sql/sql_class.cc
index a1482601647..956796c085b 100644
--- a/sql/sql_class.cc
+++ b/sql/sql_class.cc
@@ -856,7 +856,7 @@ THD::THD(my_thread_id id, bool is_wsrep_applier)
   my_hash_init(key_memory_user_var_entry, &user_vars, system_charset_info,
                USER_VARS_HASH_SIZE, 0, 0, (my_hash_get_key) get_var_key,
                (my_hash_free_key) free_user_var, HASH_THREAD_SPECIFIC);
-  my_hash_init(PSI_INSTRUMENT_ME, &sequences, system_charset_info,
+  my_hash_init(PSI_INSTRUMENT_ME, &sequences, Lex_ident_fs::charset_info(),
                SEQUENCES_HASH_SIZE, 0, 0, (my_hash_get_key)
                get_sequence_last_key, (my_hash_free_key) free_sequence_last,
                HASH_THREAD_SPECIFIC);
@@ -1439,7 +1439,8 @@ void THD::change_user(void)
   my_hash_init(key_memory_user_var_entry, &user_vars, system_charset_info,
                USER_VARS_HASH_SIZE, 0, 0, (my_hash_get_key) get_var_key,
                (my_hash_free_key) free_user_var, HASH_THREAD_SPECIFIC);
-  my_hash_init(key_memory_user_var_entry, &sequences, system_charset_info,
+  my_hash_init(key_memory_user_var_entry, &sequences,
+               Lex_ident_fs::charset_info(),
                SEQUENCES_HASH_SIZE, 0, 0, (my_hash_get_key)
                get_sequence_last_key, (my_hash_free_key) free_sequence_last,
                HASH_THREAD_SPECIFIC);
@@ -2492,6 +2493,8 @@ bool THD::copy_with_error(CHARSET_INFO *dstcs, LEX_STRING *dst,
                           CHARSET_INFO *srccs,
                           const char *src, size_t src_length)
 {
+  // Don't allow NULL to avoid UB in the called functions: nullptr+0
+  DBUG_ASSERT(src);
   String_copier_with_error status;
   return copy_fix(dstcs, dst, srccs, src, src_length, &status) ||
          status.check_errors(srccs, src, src_length);
diff --git a/sql/sql_class.h b/sql/sql_class.h
index 19e10850e15..0422f4ffff5 100644
--- a/sql/sql_class.h
+++ b/sql/sql_class.h
@@ -23,6 +23,7 @@
 #include "dur_prop.h"
 #include <waiting_threads.h>
 #include "sql_const.h"
+#include "lex_ident.h"
 #include <mysql/plugin_audit.h>
 #include "log.h"
 #include "rpl_tblmap.h"
diff --git a/sql/sql_connect.cc b/sql/sql_connect.cc
index 6149cc49ebb..c25b43f4eb5 100644
--- a/sql/sql_connect.cc
+++ b/sql/sql_connect.cc
@@ -509,7 +509,8 @@ extern "C" void free_table_stats(TABLE_STATS* table_stats)
 
 void init_global_table_stats(void)
 {
-  my_hash_init(PSI_INSTRUMENT_ME, &global_table_stats, system_charset_info,
+  my_hash_init(PSI_INSTRUMENT_ME, &global_table_stats,
+               Lex_ident_fs::charset_info(),
                max_connections, 0, 0, (my_hash_get_key) get_key_table_stats,
                (my_hash_free_key) free_table_stats, 0);
 }
@@ -528,7 +529,8 @@ extern "C" void free_index_stats(INDEX_STATS* index_stats)
 
 void init_global_index_stats(void)
 {
-  my_hash_init(PSI_INSTRUMENT_ME, &global_index_stats, system_charset_info,
+  my_hash_init(PSI_INSTRUMENT_ME, &global_index_stats,
+               Lex_ident_fs::charset_info(),
                max_connections, 0, 0, (my_hash_get_key) get_key_index_stats,
                (my_hash_free_key) free_index_stats, 0);
 }
@@ -986,7 +988,7 @@ static int check_connection(THD *thd)
                       /* See RFC 5737, 192.0.2.0/24 is reserved. */
                       const char* fake= "192.0.2.4";
                       inet_pton(AF_INET,fake, ip4);
-                      strcpy(ip, fake);
+                      safe_strcpy(ip, sizeof(ip), fake);
                       peer_rc= 0;
                     }
                     );
@@ -1016,7 +1018,7 @@ static int check_connection(THD *thd)
                       ip6->s6_addr[13] = 0x06;
                       ip6->s6_addr[14] = 0x00;
                       ip6->s6_addr[15] = 0x06;
-                      strcpy(ip, fake);
+                      safe_strcpy(ip, sizeof(ip), fake);
                       peer_rc= 0;
                     }
                     );
diff --git a/sql/sql_db.cc b/sql/sql_db.cc
index 2d582eb8702..73a9925865c 100644
--- a/sql/sql_db.cc
+++ b/sql/sql_db.cc
@@ -1089,8 +1089,7 @@ mysql_rm_db_internal(THD *thd, const LEX_CSTRING *db, bool if_exists,
     Disable drop of enabled log tables, must be done before name locking.
     This check is only needed if we are dropping the "mysql" database.
   */
-  if ((rm_mysql_schema=
-        (my_strcasecmp(system_charset_info, MYSQL_SCHEMA_NAME.str, db->str) == 0)))
+  if ((rm_mysql_schema= MYSQL_SCHEMA_NAME.streq(*db)))
   {
     for (table= tables; table; table= table->next_local)
       if (check_if_log_table(table, TRUE, "DROP"))
diff --git a/sql/sql_explain.cc b/sql/sql_explain.cc
index b8c9c87ce62..08d9159bb02 100644
--- a/sql/sql_explain.cc
+++ b/sql/sql_explain.cc
@@ -239,6 +239,9 @@ int Explain_query::send_explain(THD *thd, bool extended)
 int Explain_query::print_explain(select_result_sink *output, 
                                  uint8 explain_flags, bool is_analyze)
 {
+  /* A sanity check for ANALYZE: */
+  DBUG_ASSERT(timer_tracker_frequency() != 0.0);
+
   if (upd_del_plan)
   {
     upd_del_plan->print_explain(this, output, explain_flags, is_analyze);
@@ -1948,7 +1951,7 @@ static void trace_engine_stats(handler *file, Json_writer *writer)
       writer->add_member("pages_read_count").add_ull(hs->pages_read_count);
     if (hs->pages_read_time)
       writer->add_member("pages_read_time_ms").
-        add_double(hs->pages_read_time / 1000.0);
+        add_double(hs->pages_read_time * 1000. / timer_tracker_frequency());
     if (hs->undo_records_read)
       writer->add_member("old_rows_read").add_ull(hs->undo_records_read);
     writer->end_object();
diff --git a/sql/sql_handler.cc b/sql/sql_handler.cc
index bd7f04d2ce8..b0610e2c848 100644
--- a/sql/sql_handler.cc
+++ b/sql/sql_handler.cc
@@ -1079,10 +1079,9 @@ static SQL_HANDLER *mysql_ha_find_match(THD *thd, TABLE_LIST *tables)
       if (tables->is_anonymous_derived_table())
         continue;
       if ((! tables->db.str[0] ||
-          ! my_strcasecmp(&my_charset_latin1, hash_tables->db.str,
-                          tables->get_db_name())) &&
-          ! my_strcasecmp(&my_charset_latin1, hash_tables->table_name.str,
-                          tables->get_table_name()))
+          Lex_ident_db(tables->get_db_name()).streq(hash_tables->db)) &&
+          Lex_ident_table(tables->get_table_name()).
+            streq(hash_tables->table_name))
       {
         /* Link into hash_tables list */
         hash_tables->next= head;
diff --git a/sql/sql_lex.cc b/sql/sql_lex.cc
index deb3abc03e8..87482a139f2 100644
--- a/sql/sql_lex.cc
+++ b/sql/sql_lex.cc
@@ -3027,6 +3027,7 @@ void st_select_lex::init_query()
   is_correlated= 0;
   first_natural_join_processing= 1;
   first_cond_optimization= 1;
+  first_rownum_optimization= true;
   no_wrap_view_item= 0;
   exclude_from_table_unique_test= 0;
   in_tvc= 0;
diff --git a/sql/sql_lex.h b/sql/sql_lex.h
index 9c9d6a9aa60..3fdb780d051 100644
--- a/sql/sql_lex.h
+++ b/sql/sql_lex.h
@@ -1279,6 +1279,13 @@ public:
   bool is_correlated:1;
   bool first_natural_join_processing:1;
   bool first_cond_optimization:1;
+  /**
+    The purpose of this flag is to run initialization phase for rownum
+    only once. This flag is set on at st_select_lex::init_query and reset to
+    the value false after the method optimize_rownum() has been called
+    from the method JOIN::optimize_inner.
+  */
+  bool first_rownum_optimization:1;
   /* do not wrap view fields with Item_ref */
   bool no_wrap_view_item:1;
   /* exclude this select from check of unique_table() */
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 01cf2fb70e7..99fd65b7582 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -1130,8 +1130,9 @@ static bool wsrep_tables_accessible_when_detached(const TABLE_LIST *tables)
 {
   for (const TABLE_LIST *table= tables; table; table= table->next_global)
   {
-    LEX_CSTRING db= table->db, tn= table->table_name;
-    if (get_table_category(&db, &tn)  < TABLE_CATEGORY_INFORMATION)
+    if (get_table_category(Lex_ident_db(table->db),
+                           Lex_ident_table(table->table_name))
+                           < TABLE_CATEGORY_INFORMATION)
       return false;
   }
   return tables != NULL;
@@ -6233,15 +6234,15 @@ static TABLE *find_temporary_table_for_rename(THD *thd,
   {
     TABLE_LIST *next= table->next_local;
 
-    if (!strcmp(table->get_db_name(),   cur_table->get_db_name()) &&
-        !strcmp(table->get_table_name(), cur_table->get_table_name()))
+    if (!strcmp(table->get_db_name().str,    cur_table->get_db_name().str) &&
+        !strcmp(table->get_table_name().str, cur_table->get_table_name().str))
     {
       /* Table was moved away, can't be same as 'table' */
       found= 1;
       res= 0;                      // Table can't be a temporary table
     }
-    if (!strcmp(next->get_db_name(),    cur_table->get_db_name()) &&
-        !strcmp(next->get_table_name(), cur_table->get_table_name()))
+    if (!strcmp(next->get_db_name().str,    cur_table->get_db_name().str) &&
+        !strcmp(next->get_table_name().str, cur_table->get_table_name().str))
     {
       /*
         Table has matching name with new name of this table. cur_table should
@@ -7000,8 +7001,7 @@ check_table_access(THD *thd, privilege_t requirements, TABLE_LIST *tables,
                     INSERT_ACL : SELECT_ACL);
     }
 
-    if (check_access(thd, want_access,
-                     table_ref->get_db_name(),
+    if (check_access(thd, want_access, table_ref->get_db_name().str,
                      &table_ref->grant.privilege,
                      &table_ref->grant.m_internal,
                      0, no_errors))
@@ -9201,7 +9201,7 @@ sql_kill_user(THD *thd, LEX_USER *user, killed_state state)
     break;
   case ER_KILL_DENIED_ERROR:
     char buf[DEFINER_LENGTH+1];
-    strxnmov(buf, sizeof(buf), user->user.str, "@", user->host.str, NULL);
+    strxnmov(buf, sizeof(buf)-1, user->user.str, "@", user->host.str, NULL);
     my_printf_error(ER_KILL_DENIED_ERROR, ER_THD(thd, ER_CANNOT_USER), MYF(0),
                     "KILL USER", buf);
     break;
diff --git a/sql/sql_partition.cc b/sql/sql_partition.cc
index 590c2a508f4..3b3e0a081e3 100644
--- a/sql/sql_partition.cc
+++ b/sql/sql_partition.cc
@@ -2178,7 +2178,7 @@ static int add_keyword_path(String *str, const char *keyword,
                             const char *path)
 {
   char temp_path[FN_REFLEN];
-  strcpy(temp_path, path);
+  safe_strcpy(temp_path, sizeof(temp_path), path);
 #ifdef _WIN32
   /* Convert \ to / to be able to create table on unix */
   char *pos, *end;
diff --git a/sql/sql_plugin.cc b/sql/sql_plugin.cc
index 32d6d6909ee..38416f02669 100644
--- a/sql/sql_plugin.cc
+++ b/sql/sql_plugin.cc
@@ -379,9 +379,10 @@ static void fix_dl_name(MEM_ROOT *root, LEX_CSTRING *dl)
       my_strcasecmp(&my_charset_latin1, dl->str + dl->length - so_ext_len,
                     SO_EXT))
   {
-    char *s= (char*)alloc_root(root, dl->length + so_ext_len + 1);
+    size_t s_size= dl->length + so_ext_len + 1;
+    char *s= (char*)alloc_root(root, s_size);
     memcpy(s, dl->str, dl->length);
-    strcpy(s + dl->length, SO_EXT);
+    safe_strcpy(s + dl->length, s_size - dl->length, SO_EXT);
     dl->str= s;
     dl->length+= so_ext_len;
   }
@@ -3845,7 +3846,7 @@ static int construct_options(MEM_ROOT *mem_root, struct st_plugin_int *tmp,
   DBUG_ENTER("construct_options");
 
   plugin_name_ptr= (char*) alloc_root(mem_root, plugin_name_len + 1);
-  strcpy(plugin_name_ptr, plugin_name);
+  safe_strcpy(plugin_name_ptr, plugin_name_len + 1, plugin_name);
   my_casedn_str(&my_charset_latin1, plugin_name_ptr);
   convert_underscore_to_dash(plugin_name_ptr, plugin_name_len);
   plugin_name_with_prefix_ptr= (char*) alloc_root(mem_root,
diff --git a/sql/sql_repl.cc b/sql/sql_repl.cc
index 95e3ce42f78..224c569b2ad 100644
--- a/sql/sql_repl.cc
+++ b/sql/sql_repl.cc
@@ -3094,7 +3094,7 @@ err:
     info->error= ER_MASTER_FATAL_ERROR_READING_BINLOG;
   }
   else if (info->errmsg != NULL)
-    strcpy(info->error_text, info->errmsg);
+    safe_strcpy(info->error_text, sizeof(info->error_text), info->errmsg);
 
   my_message(info->error, info->error_text, MYF(0));
 
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index fc521347408..dc6813802de 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -2401,8 +2401,12 @@ JOIN::optimize_inner()
     DBUG_RETURN(1);
   }
   if (select_lex->with_rownum && ! order && ! group_list &&
-      !select_distinct && conds && select_lex == unit->global_parameters())
+      !select_distinct && conds && select_lex == unit->global_parameters() &&
+      select_lex->first_rownum_optimization)
+  {
     optimize_rownum(thd, unit, conds);
+    select_lex->first_rownum_optimization= false;
+  }
 
   having= optimize_cond(this, having, join_list, TRUE,
                         &having_value, &having_equal);
diff --git a/sql/sql_show.cc b/sql/sql_show.cc
index dc06b34757d..e54f6e01a4d 100644
--- a/sql/sql_show.cc
+++ b/sql/sql_show.cc
@@ -1075,7 +1075,8 @@ public:
                   ER_THD(thd, ER_TABLEACCESS_DENIED_ERROR), "SHOW VIEW",
                   m_sctx->priv_user,
                   m_sctx->host_or_ip,
-                  m_top_view->get_db_name(), m_top_view->get_table_name());
+                  m_top_view->get_db_name().str,
+                  m_top_view->get_table_name().str);
     }
     return m_view_access_denied_message_ptr;
   }
@@ -1120,8 +1121,8 @@ public:
       push_warning_printf(thd, Sql_condition::WARN_LEVEL_WARN, 
                           ER_VIEW_INVALID,
                           ER_THD(thd, ER_VIEW_INVALID),
-                          m_top_view->get_db_name(),
-                          m_top_view->get_table_name());
+                          m_top_view->get_db_name().str,
+                          m_top_view->get_table_name().str);
       is_handled= TRUE;
       break;
 
@@ -7113,8 +7114,7 @@ static int get_schema_views_record(THD *thd, TABLE_LIST *tables,
     Security_context *sctx= thd->security_ctx;
     if (!tables->allowed_show)
     {
-      if (!my_strcasecmp(system_charset_info, tables->definer.user.str,
-                         sctx->priv_user) &&
+      if (!strcmp(tables->definer.user.str, sctx->priv_user) &&
           !my_strcasecmp(system_charset_info, tables->definer.host.str,
                          sctx->priv_host))
         tables->allowed_show= TRUE;
@@ -8187,7 +8187,7 @@ int fill_open_tables(THD *thd, TABLE_LIST *tables, COND *cond)
   TABLE *table= tables->table;
   CHARSET_INFO *cs= system_charset_info;
   OPEN_TABLE_LIST *open_list;
-  if (!(open_list= list_open_tables(thd, thd->lex->first_select_lex()->db.str,
+  if (!(open_list= list_open_tables(thd, thd->lex->first_select_lex()->db,
                                     wild))
             && thd->is_fatal_error)
     DBUG_RETURN(1);
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index a52bc3601d0..89df0040485 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -921,7 +921,7 @@ bool mysql_write_frm(ALTER_PARTITION_PARAM_TYPE *lpt, uint flags)
     */
     build_table_filename(path, sizeof(path) - 1, lpt->alter_info->db.str,
                          lpt->alter_info->table_name.str, "", 0);
-    strxnmov(frm_name, sizeof(frm_name), path, reg_ext, NullS);
+    strxnmov(frm_name, sizeof(frm_name)-1, path, reg_ext, NullS);
     /*
       When we are changing to use new frm file we need to ensure that we
       don't collide with another thread in process to open the frm file.
diff --git a/sql/sql_time.cc b/sql/sql_time.cc
index 753f78ccc22..8136c2d6ec0 100644
--- a/sql/sql_time.cc
+++ b/sql/sql_time.cc
@@ -930,7 +930,7 @@ void make_truncated_value_warning(THD *thd,
 bool date_add_interval(THD *thd, MYSQL_TIME *ltime, interval_type int_type,
                        const INTERVAL &interval, bool push_warn)
 {
-  long period, sign;
+  long sign;
 
   sign= (interval.neg == (bool)ltime->neg ? 1 : -1);
 
@@ -1001,13 +1001,17 @@ bool date_add_interval(THD *thd, MYSQL_TIME *ltime, interval_type int_type,
     break;
   }
   case INTERVAL_WEEK:
-    period= (calc_daynr(ltime->year,ltime->month,ltime->day) +
-             sign * (long) interval.day);
+  {
+    longlong period= calc_daynr(ltime->year, ltime->month, ltime->day) +
+                     (longlong) sign * (longlong) interval.day;
+    if (period < 0 || period > 0x7FFFFFFF)
+      goto invalid_date;
     /* Daynumber from year 0 to 9999-12-31 */
     if (get_date_from_daynr((long) period,&ltime->year,&ltime->month,
                             &ltime->day))
       goto invalid_date;
     break;
+  }
   case INTERVAL_YEAR:
     ltime->year+= sign * (long) interval.year;
     if ((ulong) ltime->year >= 10000L)
@@ -1019,8 +1023,9 @@ bool date_add_interval(THD *thd, MYSQL_TIME *ltime, interval_type int_type,
   case INTERVAL_YEAR_MONTH:
   case INTERVAL_QUARTER:
   case INTERVAL_MONTH:
-    period= (ltime->year*12 + sign * (long) interval.year*12 +
-	     ltime->month-1 + sign * (long) interval.month);
+  {
+    long period= (ltime->year*12 + sign * (long) interval.year*12 +
+	         ltime->month-1 + sign * (long) interval.month);
     if ((ulong) period >= 120000L)
       goto invalid_date;
     ltime->year= (uint) (period / 12);
@@ -1033,6 +1038,7 @@ bool date_add_interval(THD *thd, MYSQL_TIME *ltime, interval_type int_type,
 	ltime->day++;				// Leap-year
     }
     break;
+  }
   default:
     goto null_date;
   }
diff --git a/sql/sql_trigger.cc b/sql/sql_trigger.cc
index d760010810c..f56814c7228 100644
--- a/sql/sql_trigger.cc
+++ b/sql/sql_trigger.cc
@@ -470,7 +470,7 @@ bool mysql_create_or_drop_trigger(THD *thd, TABLE_LIST *tables, bool create)
   /*
     We don't allow creating triggers on tables in the 'mysql' schema
   */
-  if (create && lex_string_eq(&tables->db, STRING_WITH_LEN("mysql")))
+  if (create && Lex_ident_db(tables->db).streq(MYSQL_SCHEMA_NAME))
   {
     my_error(ER_NO_TRIGGERS_ON_SYSTEM_SCHEMA, MYF(0));
     DBUG_RETURN(TRUE);
diff --git a/sql/sys_vars.cc b/sql/sys_vars.cc
index a06f455801c..01681991017 100644
--- a/sql/sys_vars.cc
+++ b/sql/sys_vars.cc
@@ -4849,7 +4849,7 @@ bool is_set_timestamp_forbidden(THD *thd)
     break;
   }
   char buf[1024];
-  strxnmov(buf, sizeof(buf), "--secure-timestamp=",
+  strxnmov(buf, sizeof(buf)-1, "--secure-timestamp=",
            secure_timestamp_levels[opt_secure_timestamp], NULL);
   my_error(ER_OPTION_PREVENTS_STATEMENT, MYF(0), buf);
   return true;
diff --git a/sql/table.cc b/sql/table.cc
index c0729bafaa3..b083596a040 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -97,7 +97,7 @@ LEX_CSTRING INFORMATION_SCHEMA_NAME= {STRING_WITH_LEN("information_schema")};
 LEX_CSTRING PERFORMANCE_SCHEMA_DB_NAME= {STRING_WITH_LEN("performance_schema")};
 
 /* MYSQL_SCHEMA name */
-LEX_CSTRING MYSQL_SCHEMA_NAME= {STRING_WITH_LEN("mysql")};
+Lex_ident_db MYSQL_SCHEMA_NAME= {STRING_WITH_LEN("mysql")};
 
 /* GENERAL_LOG name */
 LEX_CSTRING GENERAL_LOG_NAME= {STRING_WITH_LEN("general_log")};
@@ -282,42 +282,38 @@ const char *fn_frm_ext(const char *name)
 }
 
 
-TABLE_CATEGORY get_table_category(const LEX_CSTRING *db,
-                                  const LEX_CSTRING *name)
+TABLE_CATEGORY get_table_category(const Lex_ident_db &db,
+                                  const Lex_ident_table &name)
 {
-  DBUG_ASSERT(db != NULL);
-  DBUG_ASSERT(name != NULL);
-
 #ifdef WITH_WSREP
-  if (db->str &&
-      my_strcasecmp(system_charset_info, db->str, WSREP_SCHEMA) == 0)
+  if (db.str && db.streq(MYSQL_SCHEMA_NAME))
   {
-    if ((my_strcasecmp(system_charset_info, name->str, WSREP_STREAMING_TABLE) == 0 ||
-         my_strcasecmp(system_charset_info, name->str, WSREP_CLUSTER_TABLE) == 0 ||
-         my_strcasecmp(system_charset_info, name->str, WSREP_MEMBERS_TABLE) == 0))
+    if (name.streq(Lex_ident_table{STRING_WITH_LEN(WSREP_STREAMING_TABLE)}) ||
+        name.streq(Lex_ident_table{STRING_WITH_LEN(WSREP_CLUSTER_TABLE)}) ||
+        name.streq(Lex_ident_table{STRING_WITH_LEN(WSREP_MEMBERS_TABLE)}))
     {
       return TABLE_CATEGORY_INFORMATION;
     }
   }
 #endif /* WITH_WSREP */
-  if (is_infoschema_db(db))
+  if (is_infoschema_db(&db))
     return TABLE_CATEGORY_INFORMATION;
 
-  if (is_perfschema_db(db))
+  if (is_perfschema_db(&db))
     return TABLE_CATEGORY_PERFORMANCE;
 
-  if (lex_string_eq(&MYSQL_SCHEMA_NAME, db))
+  if (db.streq(MYSQL_SCHEMA_NAME))
   {
-    if (is_system_table_name(name->str, name->length))
+    if (is_system_table_name(name.str, name.length))
       return TABLE_CATEGORY_SYSTEM;
 
-    if (lex_string_eq(&GENERAL_LOG_NAME, name))
+    if (name.streq(GENERAL_LOG_NAME))
       return TABLE_CATEGORY_LOG;
 
-    if (lex_string_eq(&SLOW_LOG_NAME, name))
+    if (name.streq(SLOW_LOG_NAME))
       return TABLE_CATEGORY_LOG;
 
-    if (lex_string_eq(&TRANSACTION_REG_NAME, name))
+    if (name.streq(TRANSACTION_REG_NAME))
       return TABLE_CATEGORY_LOG;
   }
 
@@ -370,7 +366,8 @@ TABLE_SHARE *alloc_table_share(const char *db, const char *table_name,
     strmov(path_buff, path);
     share->normalized_path.str=    share->path.str;
     share->normalized_path.length= path_length;
-    share->table_category= get_table_category(&share->db, &share->table_name);
+    share->table_category= get_table_category(Lex_ident_db(share->db),
+                                           Lex_ident_table(share->table_name));
     share->open_errno= ENOENT;
     /* The following will be updated in open_table_from_share */
     share->can_do_row_logging= 1;
diff --git a/sql/table.h b/sql/table.h
index 16529c53bbf..7cd5a684b94 100644
--- a/sql/table.h
+++ b/sql/table.h
@@ -22,6 +22,7 @@
 #include "datadict.h"
 #include "sql_string.h"                         /* String */
 #include "lex_string.h"
+#include "lex_ident.h"
 
 #ifndef MYSQL_CLIENT
 
@@ -534,8 +535,8 @@ enum enum_table_category
 
 typedef enum enum_table_category TABLE_CATEGORY;
 
-TABLE_CATEGORY get_table_category(const LEX_CSTRING *db,
-                                  const LEX_CSTRING *name);
+TABLE_CATEGORY get_table_category(const Lex_ident_db &db,
+                                  const Lex_ident_table &name);
 
 
 typedef struct st_table_field_type
@@ -3001,7 +3002,10 @@ struct TABLE_LIST
      @brief Returns the name of the database that the referenced table belongs
      to.
   */
-  const char *get_db_name() const { return view != NULL ? view_db.str : db.str; }
+  const LEX_CSTRING get_db_name() const
+  {
+    return view != NULL ? view_db : db;
+  }
 
   /**
      @brief Returns the name of the table that this TABLE_LIST represents.
@@ -3009,7 +3013,10 @@ struct TABLE_LIST
      @details The unqualified table name or view name for a table or view,
      respectively.
    */
-  const char *get_table_name() const { return view != NULL ? view_name.str : table_name.str; }
+  const LEX_CSTRING get_table_name() const
+  {
+    return view != NULL ? view_name : table_name;
+  }
   bool is_active_sjm();
   bool is_sjm_scan_table();
   bool is_jtbm() { return MY_TEST(jtbm_subselect != NULL); }
@@ -3415,7 +3422,7 @@ extern LEX_CSTRING TRANSACTION_REG_NAME;
 
 /* information schema */
 extern LEX_CSTRING INFORMATION_SCHEMA_NAME;
-extern LEX_CSTRING MYSQL_SCHEMA_NAME;
+extern Lex_ident_db MYSQL_SCHEMA_NAME;
 
 /* table names */
 extern LEX_CSTRING MYSQL_PROC_NAME;
diff --git a/sql/temporary_tables.cc b/sql/temporary_tables.cc
index a018ba5a6ff..32e51dbe6a0 100644
--- a/sql/temporary_tables.cc
+++ b/sql/temporary_tables.cc
@@ -154,7 +154,8 @@ TABLE *THD::find_temporary_table(const TABLE_LIST *tl,
                                  Temporary_table_state state)
 {
   DBUG_ENTER("THD::find_temporary_table");
-  TABLE *table= find_temporary_table(tl->get_db_name(), tl->get_table_name(),
+  TABLE *table= find_temporary_table(tl->get_db_name().str,
+                                     tl->get_table_name().str,
                                      state);
   DBUG_RETURN(table);
 }
@@ -243,8 +244,8 @@ TMP_TABLE_SHARE *THD::find_tmp_table_share(const char *db,
 TMP_TABLE_SHARE *THD::find_tmp_table_share(const TABLE_LIST *tl)
 {
   DBUG_ENTER("THD::find_tmp_table_share");
-  TMP_TABLE_SHARE *share= find_tmp_table_share(tl->get_db_name(),
-                                               tl->get_table_name());
+  TMP_TABLE_SHARE *share= find_tmp_table_share(tl->get_db_name().str,
+                                               tl->get_table_name().str);
   DBUG_RETURN(share);
 }
 
@@ -386,7 +387,7 @@ bool THD::open_temporary_table(TABLE_LIST *tl)
   */
   if (!table && (share= find_tmp_table_share(tl)))
   {
-    table= open_temporary_table(share, tl->get_table_name());
+    table= open_temporary_table(share, tl->get_table_name().str);
     /*
        Temporary tables are not safe for parallel replication. They were
        designed to be visible to one thread only, so have no table locking.
@@ -1181,8 +1182,8 @@ bool THD::find_and_use_tmp_table(const TABLE_LIST *tl, TABLE **out_table)
   bool result;
   DBUG_ENTER("THD::find_and_use_tmp_table");
 
-  key_length= create_tmp_table_def_key(key, tl->get_db_name(),
-                                        tl->get_table_name());
+  key_length= create_tmp_table_def_key(key, tl->get_db_name().str,
+                                        tl->get_table_name().str);
   result= use_temporary_table(find_temporary_table(key, key_length,
                                                    TMP_TABLE_NOT_IN_USE),
                               out_table);
diff --git a/storage/csv/ha_tina.cc b/storage/csv/ha_tina.cc
index e705ff0e7c0..e9b7d84a703 100644
--- a/storage/csv/ha_tina.cc
+++ b/storage/csv/ha_tina.cc
@@ -184,7 +184,8 @@ static int tina_init_func(void *p)
   tina_hton= (handlerton *)p;
   mysql_mutex_init(csv_key_mutex_tina, &tina_mutex, MY_MUTEX_INIT_FAST);
   (void) my_hash_init(csv_key_memory_tina_share, &tina_open_tables,
-                      system_charset_info, 32, 0, 0, (my_hash_get_key)
+                      Lex_ident_table::charset_info(),
+                      32, 0, 0, (my_hash_get_key)
                       tina_get_key, 0, 0);
   tina_hton->db_type= DB_TYPE_CSV_DB;
   tina_hton->create= tina_create_handler;
diff --git a/storage/heap/hp_info.c b/storage/heap/hp_info.c
index 41596d864a2..47b1ed6e846 100644
--- a/storage/heap/hp_info.c
+++ b/storage/heap/hp_info.c
@@ -40,6 +40,10 @@ int heap_info(reg1 HP_INFO *info,reg2 HEAPINFO *x, int flag )
   x->errkey          = info->errkey;
   x->create_time     = info->s->create_time;
   if (flag & HA_STATUS_AUTO)
-    x->auto_increment= info->s->auto_increment + 1;
+  {
+    x->auto_increment= info->s->auto_increment+1;
+    if (!x->auto_increment)			/* This shouldn't happen */
+      x->auto_increment= ~(ulonglong) 0;
+  }
   DBUG_RETURN(0);
 } /* heap_info */
diff --git a/storage/innobase/buf/buf0flu.cc b/storage/innobase/buf/buf0flu.cc
index a69877ba34f..7b561695988 100644
--- a/storage/innobase/buf/buf0flu.cc
+++ b/storage/innobase/buf/buf0flu.cc
@@ -1220,9 +1220,21 @@ static void buf_flush_LRU_list_batch(ulint max, flush_counters_t *n)
   static_assert(FIL_NULL > SRV_TMP_SPACE_ID, "consistency");
   static_assert(FIL_NULL > SRV_SPACE_ID_UPPER_BOUND, "consistency");
 
+  /* BUF_LRU_MIN_LEN (256) is too high value for low buffer pool(BP) size. For
+  example, for BP size lower than 80M and 16 K page size, the limit is more than
+  5% of total BP and for lowest BP 5M, it is 80% of the BP. Non-data objects
+  like explicit locks could occupy part of the BP pool reducing the pages
+  available for LRU. If LRU reaches minimum limit and if no free pages are
+  available, server would hang with page cleaner not able to free any more
+  pages. To avoid such hang, we adjust the LRU limit lower than the limit for
+  data objects as checked in buf_LRU_check_size_of_non_data_objects() i.e. one
+  page less than 5% of BP. */
+  size_t pool_limit= buf_pool.curr_size / 20 - 1;
+  auto buf_lru_min_len= std::min<size_t>(pool_limit, BUF_LRU_MIN_LEN);
+
   for (buf_page_t *bpage= UT_LIST_GET_LAST(buf_pool.LRU);
        bpage &&
-       ((UT_LIST_GET_LEN(buf_pool.LRU) > BUF_LRU_MIN_LEN &&
+       ((UT_LIST_GET_LEN(buf_pool.LRU) > buf_lru_min_len &&
          UT_LIST_GET_LEN(buf_pool.free) < free_limit) ||
         recv_recovery_is_on());
        ++scanned, bpage= buf_pool.lru_hp.get())
diff --git a/storage/innobase/buf/buf0lru.cc b/storage/innobase/buf/buf0lru.cc
index e1626b6cee3..fb70ace1243 100644
--- a/storage/innobase/buf/buf0lru.cc
+++ b/storage/innobase/buf/buf0lru.cc
@@ -458,7 +458,10 @@ got_block:
     mysql_mutex_unlock(&buf_pool.flush_list_mutex);
     if (my_cond_timedwait(&buf_pool.done_free, &buf_pool.mutex.m_mutex,
                           &abstime))
+    {
       buf_pool.LRU_warn();
+      buf_LRU_check_size_of_non_data_objects();
+    }
   }
 
   goto got_block;
diff --git a/storage/innobase/fsp/fsp0fsp.cc b/storage/innobase/fsp/fsp0fsp.cc
index 71cb573f2e9..72415f7eefb 100644
--- a/storage/innobase/fsp/fsp0fsp.cc
+++ b/storage/innobase/fsp/fsp0fsp.cc
@@ -966,6 +966,7 @@ corrupted:
 			first = flst_get_first(FSP_HEADER_OFFSET + FSP_FREE
 					       + header->page.frame);
 			if (first.page == FIL_NULL) {
+				*err = DB_OUT_OF_FILE_SPACE;
 				return nullptr;	/* No free extents left */
 			}
 			if (first.page >= space->free_limit) {
diff --git a/storage/innobase/handler/handler0alter.cc b/storage/innobase/handler/handler0alter.cc
index bd918d2615f..c9a48f54a35 100644
--- a/storage/innobase/handler/handler0alter.cc
+++ b/storage/innobase/handler/handler0alter.cc
@@ -8520,6 +8520,15 @@ field_changed:
 			DBUG_RETURN(true);
 		}
 
+		if ((ha_alter_info->handler_flags & ALTER_OPTIONS)
+		    && ctx->page_compression_level
+		    && !ctx->old_table->not_redundant()) {
+			my_error(ER_ILLEGAL_HA_CREATE_OPTION, MYF(0),
+				 table_type(),
+				 "PAGE_COMPRESSED=1 ROW_FORMAT=REDUNDANT");
+			DBUG_RETURN(true);
+		}
+
 		if (!(ha_alter_info->handler_flags & INNOBASE_ALTER_DATA)
 		    && alter_templ_needs_rebuild(altered_table, ha_alter_info,
 						 ctx->new_table)
diff --git a/storage/innobase/include/buf0buf.h b/storage/innobase/include/buf0buf.h
index b30763fa232..5c436c1092a 100644
--- a/storage/innobase/include/buf0buf.h
+++ b/storage/innobase/include/buf0buf.h
@@ -1366,7 +1366,7 @@ public:
   {
     return !recv_recovery_is_on() &&
       UT_LIST_GET_LEN(free) + UT_LIST_GET_LEN(LRU) <
-        n_chunks_new / 4 * chunks->size;
+        (n_chunks_new * chunks->size) / 4;
   }
 
   /** @return whether the buffer pool is running low */
diff --git a/storage/innobase/lock/lock0lock.cc b/storage/innobase/lock/lock0lock.cc
index 27a0d15482c..b12fec737eb 100644
--- a/storage/innobase/lock/lock0lock.cc
+++ b/storage/innobase/lock/lock0lock.cc
@@ -1242,6 +1242,13 @@ lock_rec_create_low(
 		type_mode = type_mode & ~(LOCK_GAP | LOCK_REC_NOT_GAP);
 	}
 
+	/* Extra bitmap size in bytes over and above the current number of
+	records when a record lock is created. 8 x LOCK_PAGE_DEFAULT_BITMAP_SIZE
+	extra record locks of same type for newly inserted records can be added
+	without needing to create a new lock object. Useful when the number of
+	records in a page is growing. */
+	static constexpr size_t LOCK_PAGE_DEFAULT_BITMAP_SIZE = 8;
+
 	if (UNIV_LIKELY(!(type_mode & (LOCK_PREDICATE | LOCK_PRDT_PAGE)))) {
 		n_bytes = (page_dir_get_n_heap(page) + 7) / 8;
 	} else {
@@ -1270,13 +1277,19 @@ lock_rec_create_low(
 	ut_ad(trx->mutex_is_owner());
 	ut_ad(trx->state != TRX_STATE_NOT_STARTED);
 
+	auto cached_bytes = sizeof *trx->lock.rec_pool - sizeof *lock;
+
 	if (trx->lock.rec_cached >= UT_ARR_SIZE(trx->lock.rec_pool)
-	    || sizeof *lock + n_bytes > sizeof *trx->lock.rec_pool) {
+	    || n_bytes > cached_bytes) {
+		n_bytes += LOCK_PAGE_DEFAULT_BITMAP_SIZE;
 		lock = static_cast<lock_t*>(
 			mem_heap_alloc(trx->lock.lock_heap,
 				       sizeof *lock + n_bytes));
 	} else {
 		lock = &trx->lock.rec_pool[trx->lock.rec_cached++].lock;
+		/* Use all the extra bytes for lock bitmap. */
+		ut_ad(n_bytes <= cached_bytes);
+		n_bytes = cached_bytes;
 	}
 
 	lock->trx = trx;
@@ -1404,6 +1417,11 @@ lock_rec_find_similar_on_page(
 	const trx_t*    trx)            /*!< in: transaction */
 {
 	lock_sys.rec_hash.assert_locked(lock->un_member.rec_lock.page_id);
+	DBUG_EXECUTE_IF("innodb_skip_lock_bitmap", {
+		if (!trx->in_rollback) {
+			return nullptr;
+		}
+	});
 
 	for (/* No op */;
 	     lock != NULL;
diff --git a/storage/innobase/mtr/mtr0mtr.cc b/storage/innobase/mtr/mtr0mtr.cc
index 2e8aa63818a..6fbcf4c8ab6 100644
--- a/storage/innobase/mtr/mtr0mtr.cc
+++ b/storage/innobase/mtr/mtr0mtr.cc
@@ -891,7 +891,7 @@ ATTRIBUTE_COLD static void log_overwrite_warning(lsn_t lsn)
                   " last checkpoint LSN=" LSN_PF ", current LSN=" LSN_PF
                   "%s.",
                   lsn_t{log_sys.last_checkpoint_lsn}, lsn,
-                  srv_shutdown_state != SRV_SHUTDOWN_INITIATED
+                  srv_shutdown_state > SRV_SHUTDOWN_INITIATED
                   ? ". Shutdown is in progress" : "");
 }
 
diff --git a/storage/innobase/srv/srv0start.cc b/storage/innobase/srv/srv0start.cc
index c2b8d1cc183..6f03fd3b690 100644
--- a/storage/innobase/srv/srv0start.cc
+++ b/storage/innobase/srv/srv0start.cc
@@ -680,13 +680,9 @@ err_exit:
     space_id= id;
     fsp_flags= mach_read_from_4(FSP_HEADER_OFFSET + FSP_SPACE_FLAGS + page);
 
-    if (buf_page_is_corrupted(false, page, fsp_flags))
-    {
-      sql_print_error("InnoDB: Checksum mismatch in the first page of file %s",
-                      name);
-      if (recv_sys.dblwr.restore_first_page(space_id, name, fh))
-        goto err_exit;
-    }
+    if (buf_page_is_corrupted(false, page, fsp_flags) &&
+        recv_sys.dblwr.restore_first_page(space_id, name, fh))
+      goto err_exit;
 
     aligned_free(page);
   }
diff --git a/storage/innobase/trx/trx0trx.cc b/storage/innobase/trx/trx0trx.cc
index ff9d8c55119..77a8b0e249b 100644
--- a/storage/innobase/trx/trx0trx.cc
+++ b/storage/innobase/trx/trx0trx.cc
@@ -538,6 +538,7 @@ TRANSACTIONAL_TARGET void trx_free_at_shutdown(trx_t *trx)
 	DBUG_LOG("trx", "Free prepared: " << trx);
 	trx->state = TRX_STATE_NOT_STARTED;
 	ut_ad(!UT_LIST_GET_LEN(trx->lock.trx_locks));
+	ut_d(*trx->detailed_error = '\0');
 	trx->free();
 }
 
diff --git a/storage/perfschema/unittest/pfs_noop-t.cc b/storage/perfschema/unittest/pfs_noop-t.cc
index 57e8cfd8a0a..6d5e4eb152f 100644
--- a/storage/perfschema/unittest/pfs_noop-t.cc
+++ b/storage/perfschema/unittest/pfs_noop-t.cc
@@ -240,6 +240,7 @@ int main(int, char **)
 
   MY_INIT("pfs_noop-t");
   test_noop();
+  my_end(MY_CHECK_ERROR);
   return (exit_status());
 }
 
diff --git a/storage/spider/ha_spider.cc b/storage/spider/ha_spider.cc
index c2fbb77621d..7785542a58f 100644
--- a/storage/spider/ha_spider.cc
+++ b/storage/spider/ha_spider.cc
@@ -482,7 +482,8 @@ error_get_share:
     owner->wide_handler = NULL;
     owner->wide_handler_owner = FALSE;
   }
-  wide_handler = NULL;
+  if (!wide_handler_owner)
+    wide_handler = NULL;
 error_wide_handler_alloc:
   DBUG_RETURN(error_num);
 }
@@ -6539,8 +6540,6 @@ int ha_spider::info(
                   spider_init_error_table->init_error_time =
                     (time_t) time((time_t*) 0);
                 }
-                share->init_error = TRUE;
-                share->init = TRUE;
               }
               if (wide_handler->sql_command == SQLCOM_SHOW_CREATE ||
                   wide_handler->sql_command == SQLCOM_SHOW_FIELDS)
@@ -6591,10 +6590,6 @@ int ha_spider::info(
                       share, TRUE))
                 ) {
                   spider_init_error_table->init_error = error_num;
-/*
-                  if (!thd->is_error())
-                    my_error(error_num, MYF(0), "");
-*/
                   if ((spider_init_error_table->init_error_with_message =
                     thd->is_error()))
                     strmov(spider_init_error_table->init_error_msg,
@@ -6602,8 +6597,6 @@ int ha_spider::info(
                   spider_init_error_table->init_error_time =
                     (time_t) time((time_t*) 0);
                 }
-                share->init_error = TRUE;
-                share->init = TRUE;
               }
               if (wide_handler->sql_command == SQLCOM_SHOW_CREATE ||
                   wide_handler->sql_command == SQLCOM_SHOW_FIELDS)
@@ -6883,8 +6876,6 @@ ha_rows ha_spider::records_in_range(
                   spider_init_error_table->init_error_time =
                     (time_t) time((time_t*) 0);
                 }
-                share->init_error = TRUE;
-                share->init = TRUE;
               }
               if (check_error_mode(error_num))
                 my_errno = error_num;
@@ -7174,8 +7165,6 @@ int ha_spider::check_crd()
                 spider_init_error_table->init_error_time =
                   (time_t) time((time_t*) 0);
               }
-              share->init_error = TRUE;
-              share->init = TRUE;
             }
             DBUG_RETURN(check_error_mode(error_num));
           }
@@ -7562,18 +7551,6 @@ int ha_spider::update_auto_increment()
   DBUG_ENTER("ha_spider::update_auto_increment");
   DBUG_PRINT("info",("spider this=%p", this));
   force_auto_increment = TRUE;
-/*
-  if (
-    next_insert_id >= auto_inc_interval_for_cur_row.maximum() &&
-    wide_handler->trx->thd->auto_inc_intervals_forced.get_current()
-  ) {
-    force_auto_increment = TRUE;
-    DBUG_PRINT("info",("spider force_auto_increment=TRUE"));
-  } else {
-    force_auto_increment = FALSE;
-    DBUG_PRINT("info",("spider force_auto_increment=FALSE"));
-  }
-*/
   DBUG_PRINT("info",("spider auto_increment_mode=%d",
     auto_increment_mode));
   DBUG_PRINT("info",("spider next_number_field=%lld",
@@ -7803,7 +7780,12 @@ int ha_spider::write_row(
         pthread_mutex_lock(&share->lgtm_tblhnd_share->auto_increment_mutex);
         if (!share->lgtm_tblhnd_share->auto_increment_init)
         {
-          info(HA_STATUS_AUTO);
+          if ((error_num= info(HA_STATUS_AUTO)))
+          {
+            pthread_mutex_unlock(
+              &share->lgtm_tblhnd_share->auto_increment_mutex);
+            DBUG_RETURN(error_num);
+          }
           share->lgtm_tblhnd_share->auto_increment_lclval =
             stats.auto_increment_value;
           share->lgtm_tblhnd_share->auto_increment_init = TRUE;
diff --git a/storage/spider/ha_spider.h b/storage/spider/ha_spider.h
index 2e638269ef9..022f3c54321 100644
--- a/storage/spider/ha_spider.h
+++ b/storage/spider/ha_spider.h
@@ -78,6 +78,7 @@ public:
   SPIDER_POSITION    *pushed_pos;
   SPIDER_POSITION    pushed_pos_buf;
   SPIDER_PARTITION_HANDLER *partition_handler;
+  /* Whether this ha_spider is the owner of its wide_handler. */
   bool                wide_handler_owner = FALSE;
   SPIDER_WIDE_HANDLER *wide_handler = NULL;
 
diff --git a/storage/spider/mysql-test/spider/bugfix/r/mdev_28105.result b/storage/spider/mysql-test/spider/bugfix/r/mdev_28105.result
new file mode 100644
index 00000000000..1932f6b2624
--- /dev/null
+++ b/storage/spider/mysql-test/spider/bugfix/r/mdev_28105.result
@@ -0,0 +1,10 @@
+install soname 'ha_spider';
+Warnings:
+Warning	1105	Cannot enable tc-log at run-time. XA features of SPIDER are disabled
+SET @@insert_id=128;
+CREATE TABLE t(c TINYINT AUTO_INCREMENT KEY) ENGINE=Spider;
+INSERT IGNORE INTO t VALUES(0);
+ERROR HY000: Unable to connect to foreign data source: localhost
+drop table t;
+Warnings:
+Warning	1620	Plugin is busy and will be uninstalled on shutdown
diff --git a/storage/spider/mysql-test/spider/bugfix/r/mdev_29027.result b/storage/spider/mysql-test/spider/bugfix/r/mdev_29027.result
new file mode 100644
index 00000000000..1d9bc01fdb2
--- /dev/null
+++ b/storage/spider/mysql-test/spider/bugfix/r/mdev_29027.result
@@ -0,0 +1,24 @@
+#
+# MDEV-29027 ASAN errors in spider_db_free_result after partition DDL
+#
+for master_1
+for child2
+child2_1
+child2_2
+child2_3
+for child3
+CREATE DATABASE auto_test_local;
+USE auto_test_local;
+CREATE TABLE tbl_a (
+c INT
+) ENGINE=Spider DEFAULT CHARSET=utf8 PARTITION BY HASH(c) (
+PARTITION pt1
+);
+ALTER TABLE tbl_a ADD PARTITION (PARTITION pt2);
+DROP DATABASE auto_test_local;
+for master_1
+for child2
+child2_1
+child2_2
+child2_3
+for child3
diff --git a/storage/spider/mysql-test/spider/bugfix/r/mdev_29027_original.result b/storage/spider/mysql-test/spider/bugfix/r/mdev_29027_original.result
new file mode 100644
index 00000000000..56391bd5212
--- /dev/null
+++ b/storage/spider/mysql-test/spider/bugfix/r/mdev_29027_original.result
@@ -0,0 +1,15 @@
+for master_1
+for child2
+for child3
+set spider_same_server_link= 1;
+CREATE SERVER srv FOREIGN DATA WRAPPER mysql
+OPTIONS (SOCKET "$MASTER_1_MYSOCK", DATABASE 'test',user 'root');
+CREATE TABLE t1 (a INT);
+CREATE TABLE t_spider (a INT) ENGINE=SPIDER PARTITION BY HASH(a) (PARTITION p1 COMMENT = "wrapper 'mysql', srv 'srv', table 't1'");
+CREATE TABLE t2 (a INT);
+ALTER TABLE t_spider ADD PARTITION (PARTITION p2 COMMENT = "wrapper 'mysql', srv 'srv', table 't2'");
+DROP TABLE t_spider, t1, t2;
+drop server srv;
+for master_1
+for child2
+for child3
diff --git a/storage/spider/mysql-test/spider/bugfix/r/mdev_31475.result b/storage/spider/mysql-test/spider/bugfix/r/mdev_31475.result
new file mode 100644
index 00000000000..b4ad3692432
--- /dev/null
+++ b/storage/spider/mysql-test/spider/bugfix/r/mdev_31475.result
@@ -0,0 +1,23 @@
+for master_1
+for child2
+for child3
+CREATE TABLE t3 (c1 MEDIUMINT NULL, c2 CHAR(5)) ENGINE=Spider PARTITION BY KEY(c1) PARTITIONS 2;
+ALTER TABLE t3 DROP PRIMARY KEY;
+ERROR 42000: Can't DROP INDEX `PRIMARY`; check that it exists
+SELECT * FROM t3 WHERE c1 <=> '1000-00-01 00:00:00' ORDER BY c1,c2 LIMIT 2;
+ERROR HY000: Unable to connect to foreign data source: localhost
+CREATE TABLE t1 (a INT UNSIGNED NOT NULL PRIMARY KEY, b INT UNSIGNED NOT NULL, c INT UNSIGNED, UNIQUE (b, c) USING HASH) ENGINE=Spider;
+SELECT t1.c1 FROM t3 RIGHT JOIN t1 ON t1.c1=current_date() UNION SELECT t1.c2 FROM t1 LEFT OUTER JOIN t3 ON t1.c2;
+ERROR HY000: Unable to connect to foreign data source: localhost
+drop table t1, t3;
+set spider_same_server_link= 1;
+CREATE SERVER srv FOREIGN DATA WRAPPER mysql
+OPTIONS (SOCKET "$MASTER_1_MYSOCK", DATABASE 'test',user 'root');
+CREATE TABLE t1 (a INT, b VARCHAR(255), PRIMARY KEY(a)) ENGINE=Spider PARTITION BY RANGE (a) (PARTITION p1 VALUES LESS THAN (3), PARTITION p2 VALUES LESS THAN MAXVALUE COMMENT='srv "srv"');
+DROP SERVER srv;
+SELECT * FROM t1;
+ERROR HY000: The foreign server name you are trying to reference does not exist. Data source error:  srv
+drop table t1;
+for master_1
+for child2
+for child3
diff --git a/storage/spider/mysql-test/spider/bugfix/t/mdev_28105.opt b/storage/spider/mysql-test/spider/bugfix/t/mdev_28105.opt
new file mode 100644
index 00000000000..789275fa25e
--- /dev/null
+++ b/storage/spider/mysql-test/spider/bugfix/t/mdev_28105.opt
@@ -0,0 +1 @@
+--skip-log-bin
diff --git a/storage/spider/mysql-test/spider/bugfix/t/mdev_28105.test b/storage/spider/mysql-test/spider/bugfix/t/mdev_28105.test
new file mode 100644
index 00000000000..219835075ba
--- /dev/null
+++ b/storage/spider/mysql-test/spider/bugfix/t/mdev_28105.test
@@ -0,0 +1,8 @@
+install soname 'ha_spider';
+SET @@insert_id=128;  # 127 does not crash
+CREATE TABLE t(c TINYINT AUTO_INCREMENT KEY) ENGINE=Spider;
+--error ER_CONNECT_TO_FOREIGN_DATA_SOURCE
+INSERT IGNORE INTO t VALUES(0);
+drop table t;
+--disable_query_log
+--source ../../include/clean_up_spider.inc
diff --git a/storage/spider/mysql-test/spider/bugfix/t/mdev_29027.cnf b/storage/spider/mysql-test/spider/bugfix/t/mdev_29027.cnf
new file mode 100644
index 00000000000..05dfd8a0bce
--- /dev/null
+++ b/storage/spider/mysql-test/spider/bugfix/t/mdev_29027.cnf
@@ -0,0 +1,3 @@
+!include include/default_mysqld.cnf
+!include ../my_1_1.cnf
+!include ../my_2_1.cnf
diff --git a/storage/spider/mysql-test/spider/bugfix/t/mdev_29027.test b/storage/spider/mysql-test/spider/bugfix/t/mdev_29027.test
new file mode 100644
index 00000000000..f18154a1d28
--- /dev/null
+++ b/storage/spider/mysql-test/spider/bugfix/t/mdev_29027.test
@@ -0,0 +1,28 @@
+--echo #
+--echo # MDEV-29027 ASAN errors in spider_db_free_result after partition DDL
+--echo #
+
+--disable_query_log
+--disable_result_log
+--source ../../t/test_init.inc
+--enable_result_log
+--enable_query_log
+
+CREATE DATABASE auto_test_local;
+USE auto_test_local;
+
+eval CREATE TABLE tbl_a (
+    c INT
+) $MASTER_1_ENGINE $MASTER_1_CHARSET PARTITION BY HASH(c) (
+    PARTITION pt1
+);
+
+ALTER TABLE tbl_a ADD PARTITION (PARTITION pt2);
+
+DROP DATABASE auto_test_local;
+
+--disable_query_log
+--disable_result_log
+--source ../../t/test_deinit.inc
+--enable_result_log
+--enable_query_log
diff --git a/storage/spider/mysql-test/spider/bugfix/t/mdev_29027_original.test b/storage/spider/mysql-test/spider/bugfix/t/mdev_29027_original.test
new file mode 100644
index 00000000000..3a52c11c834
--- /dev/null
+++ b/storage/spider/mysql-test/spider/bugfix/t/mdev_29027_original.test
@@ -0,0 +1,22 @@
+--disable_query_log
+--disable_result_log
+--source ../../t/test_init.inc
+--enable_result_log
+--enable_query_log
+--source include/have_partition.inc
+set spider_same_server_link= 1;
+evalp CREATE SERVER srv FOREIGN DATA WRAPPER mysql
+OPTIONS (SOCKET "$MASTER_1_MYSOCK", DATABASE 'test',user 'root');
+
+CREATE TABLE t1 (a INT);
+CREATE TABLE t_spider (a INT) ENGINE=SPIDER PARTITION BY HASH(a) (PARTITION p1 COMMENT = "wrapper 'mysql', srv 'srv', table 't1'");
+CREATE TABLE t2 (a INT);
+ALTER TABLE t_spider ADD PARTITION (PARTITION p2 COMMENT = "wrapper 'mysql', srv 'srv', table 't2'");
+
+DROP TABLE t_spider, t1, t2;
+drop server srv;
+--disable_query_log
+--disable_result_log
+--source ../../t/test_deinit.inc
+--enable_result_log
+--enable_query_log
diff --git a/storage/spider/mysql-test/spider/bugfix/t/mdev_31475.test b/storage/spider/mysql-test/spider/bugfix/t/mdev_31475.test
new file mode 100644
index 00000000000..6794e9df19e
--- /dev/null
+++ b/storage/spider/mysql-test/spider/bugfix/t/mdev_31475.test
@@ -0,0 +1,32 @@
+--disable_query_log
+--disable_result_log
+--source ../../t/test_init.inc
+--enable_result_log
+--enable_query_log
+
+# test 1
+CREATE TABLE t3 (c1 MEDIUMINT NULL, c2 CHAR(5)) ENGINE=Spider PARTITION BY KEY(c1) PARTITIONS 2;
+--error ER_CANT_DROP_FIELD_OR_KEY
+ALTER TABLE t3 DROP PRIMARY KEY;
+--error ER_CONNECT_TO_FOREIGN_DATA_SOURCE
+SELECT * FROM t3 WHERE c1 <=> '1000-00-01 00:00:00' ORDER BY c1,c2 LIMIT 2;
+CREATE TABLE t1 (a INT UNSIGNED NOT NULL PRIMARY KEY, b INT UNSIGNED NOT NULL, c INT UNSIGNED, UNIQUE (b, c) USING HASH) ENGINE=Spider;
+--error ER_CONNECT_TO_FOREIGN_DATA_SOURCE
+SELECT t1.c1 FROM t3 RIGHT JOIN t1 ON t1.c1=current_date() UNION SELECT t1.c2 FROM t1 LEFT OUTER JOIN t3 ON t1.c2;
+drop table t1, t3;
+
+# test 2
+set spider_same_server_link= 1;
+evalp CREATE SERVER srv FOREIGN DATA WRAPPER mysql
+OPTIONS (SOCKET "$MASTER_1_MYSOCK", DATABASE 'test',user 'root');
+CREATE TABLE t1 (a INT, b VARCHAR(255), PRIMARY KEY(a)) ENGINE=Spider PARTITION BY RANGE (a) (PARTITION p1 VALUES LESS THAN (3), PARTITION p2 VALUES LESS THAN MAXVALUE COMMENT='srv "srv"');
+DROP SERVER srv;
+--error 1477
+SELECT * FROM t1;
+drop table t1;
+
+--disable_query_log
+--disable_result_log
+--source ../../t/test_deinit.inc
+--enable_result_log
+--enable_query_log
diff --git a/storage/spider/spd_db_conn.cc b/storage/spider/spd_db_conn.cc
index 5f816d47b70..abb7f187de0 100644
--- a/storage/spider/spd_db_conn.cc
+++ b/storage/spider/spd_db_conn.cc
@@ -2857,7 +2857,7 @@ int spider_db_free_result(
   SPIDER_RESULT *result;
   SPIDER_RESULT *prev;
   SPIDER_SHARE *share = spider->share;
-  SPIDER_TRX *trx = spider->wide_handler->trx;
+  THD *thd= current_thd;
   SPIDER_POSITION *position;
   int roop_count, error_num;
   DBUG_ENTER("spider_db_free_result");
@@ -2873,10 +2873,10 @@ int spider_db_free_result(
 
   if (
     final ||
-    spider_param_reset_sql_alloc(trx->thd, share->reset_sql_alloc) == 1
+    spider_param_reset_sql_alloc(thd, share->reset_sql_alloc) == 1
   ) {
     int alloc_size = final ? 0 :
-      (spider_param_init_sql_alloc_size(trx->thd, share->init_sql_alloc_size));
+      (spider_param_init_sql_alloc_size(thd, share->init_sql_alloc_size));
     while (result)
     {
       position = result->first_position;
@@ -2919,7 +2919,7 @@ int spider_db_free_result(
     {
       ulong realloced = 0;
       int init_sql_alloc_size =
-        spider_param_init_sql_alloc_size(trx->thd, share->init_sql_alloc_size);
+        spider_param_init_sql_alloc_size(thd, share->init_sql_alloc_size);
       for (roop_count = 0; roop_count < (int) share->use_dbton_count;
         roop_count++)
       {
diff --git a/storage/spider/spd_include.h b/storage/spider/spd_include.h
index 33fd26af4b4..d829bb4ebfc 100644
--- a/storage/spider/spd_include.h
+++ b/storage/spider/spd_include.h
@@ -847,6 +847,10 @@ enum spider_hnd_stage {
   SPD_HND_STAGE_CLEAR_TOP_TABLE_FIELDS
 };
 
+/*
+  A wide handler is shared among ha_spider of partitions of the same
+  table. It is owned by the last partition.
+*/
 typedef struct st_spider_wide_handler
 {
   spider_hnd_stage   stage;
diff --git a/strings/ctype.c b/strings/ctype.c
index 3d13fe55be8..a0b51c20b10 100644
--- a/strings/ctype.c
+++ b/strings/ctype.c
@@ -871,7 +871,7 @@ static void
 my_string_metadata_get_mb(MY_STRING_METADATA *metadata,
                           CHARSET_INFO *cs, const char *str, ulong length)
 {
-  const char *strend= str + length;
+  const char *strend= str ? str + length : NULL; // Avoid UB nullptr+0
   for (my_string_metadata_init(metadata) ;
        str < strend;
        metadata->char_length++)
diff --git a/strings/my_strtoll10.c b/strings/my_strtoll10.c
index 183829d7074..74baef080eb 100644
--- a/strings/my_strtoll10.c
+++ b/strings/my_strtoll10.c
@@ -241,7 +241,7 @@ end4:
   *endptr= (char*) s;
   if (negative)
   {
-   if (li > MAX_NEGATIVE_NUMBER)
+   if (li >= MAX_NEGATIVE_NUMBER) // Avoid undefined behavior
      goto overflow;
    return -((longlong) li);
   }