From 4b7916f0ea400e14f1593f0a6d89e56851899125 Mon Sep 17 00:00:00 2001
From: unknown <timothy.smith@sun.com>
Date: Tue, 22 Sep 2009 20:52:24 +0200
Subject: [PATCH 01/13] Set version number for mysql-5.1.37sp1 release

---
 configure.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure.in b/configure.in
index d68a4121642..8013307facc 100644
--- a/configure.in
+++ b/configure.in
@@ -10,7 +10,7 @@ AC_CANONICAL_SYSTEM
 #
 # When changing major version number please also check switch statement
 # in mysqlbinlog::check_master_version().
-AM_INIT_AUTOMAKE(mysql, 5.1.37)
+AM_INIT_AUTOMAKE(mysql, 5.1.37sp1)
 AM_CONFIG_HEADER([include/config.h:config.h.in])
 
 PROTOCOL_VERSION=10

From afa6e7a482a69dfd5ffd1cd1d81237bda3dcec94 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Sep 2009 22:38:25 +0200
Subject: [PATCH 02/13] Backport into build-200909221805-5.1.37sp1

> ------------------------------------------------------------
> revno: 2949.5.6
> revision-id: jperkin@sun.com-20090824091334-6ktgrhq218vl7zq1
> parent: joerg@mysql.com-20090821095644-12woawc4d2d3u7k4
> committer: Jonathan Perkin <jperkin@sun.com>
> branch nick: mysql-5.1-build
> timestamp: Mon 2009-08-24 10:13:34 +0100
> message:
>   Apply changes from mysql-5.1.38-release clone:
>
>    - Add conditionals for bundled zlib and innodb plugin.
>    - Apply patch from bug#46834 to install the test suite in RPMs.
>    - Add plugins to RPMs.  Disable example plugins.
---
 support-files/mysql.spec.sh | 41 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 40 insertions(+), 1 deletion(-)

diff --git a/support-files/mysql.spec.sh b/support-files/mysql.spec.sh
index 778b04b30fe..5b8d7a5922d 100644
--- a/support-files/mysql.spec.sh
+++ b/support-files/mysql.spec.sh
@@ -31,6 +31,20 @@
 %{?_with_yassl:%define YASSL_BUILD 1}
 %{!?_with_yassl:%define YASSL_BUILD 0}
 
+# ----------------------------------------------------------------------
+# use "rpmbuild --with bundled_zlib" or "rpm --define '_with_bundled_zlib 1'"
+# (for RPM 3.x) to build using the bundled zlib (off by default)
+# ----------------------------------------------------------------------
+%{?_with_bundled_zlib:%define WITH_BUNDLED_ZLIB 1}
+%{!?_with_bundled_zlib:%define WITH_BUNDLED_ZLIB 0}
+
+# ----------------------------------------------------------------------
+# use "rpmbuild --without innodb_plugin" or "rpm --define '_without_innodb_plugin 1'"
+# (for RPM 3.x) to not build the innodb plugin (on by default with innodb builds)
+# ----------------------------------------------------------------------
+%{?_without_innodb_plugin:%define WITHOUT_INNODB_PLUGIN 1}
+%{!?_without_innodb_plugin:%define WITHOUT_INNODB_PLUGIN 0}
+
 # use "rpmbuild --with cluster" or "rpm --define '_with_cluster 1'" (for RPM 3.x)
 # to build with cluster support (off by default)
 %{?_with_cluster:%define CLUSTER_BUILD 1}
@@ -292,6 +306,9 @@ sh -c  "PATH=\"${MYSQL_BUILD_PATH:-$PATH}\" \
 	    --enable-thread-safe-client \
 	    --with-readline \
 		--with-innodb \
+%if %{WITHOUT_INNODB_PLUGIN}
+		--without-plugin-innodb_plugin \
+%endif
 %if %{CLUSTER_BUILD}
 		--with-ndbcluster \
 %else
@@ -301,8 +318,13 @@ sh -c  "PATH=\"${MYSQL_BUILD_PATH:-$PATH}\" \
 		--with-csv-storage-engine \
 		--with-blackhole-storage-engine \
 		--with-federated-storage-engine \
+		--without-plugin-daemon_example \
+		--without-plugin-example \
 		--with-partition \
 		--with-big-tables \
+%if %{WITH_BUNDLED_ZLIB}
+		--with-zlib-dir=bundled \
+%endif
 		--enable-shared \
 		"
  make
@@ -426,7 +448,7 @@ install -d $RBR%{_sbindir}
 
 
 # Install all binaries 
-(cd $MBD && make install DESTDIR=$RBR benchdir_root=%{_datadir})
+(cd $MBD && make install DESTDIR=$RBR testroot=%{_datadir})
 # Old packages put shared libs in %{_libdir}/ (not %{_libdir}/mysql), so do
 # the same here.
 mv $RBR/%{_libdir}/mysql/*.so* $RBR/%{_libdir}/
@@ -693,6 +715,8 @@ fi
 %attr(755, root, root) %{_bindir}/resolve_stack_dump
 %attr(755, root, root) %{_bindir}/resolveip
 
+%attr(755, root, root) %{_libdir}/plugin/*.so*
+
 %attr(755, root, root) %{_sbindir}/mysqld
 %attr(755, root, root) %{_sbindir}/mysqld-debug
 %attr(755, root, root) %{_sbindir}/mysqlmanager
@@ -818,6 +842,8 @@ fi
 %{_libdir}/mysql/libvio.a
 %{_libdir}/mysql/libz.a
 %{_libdir}/mysql/libz.la
+%{_libdir}/plugin/*.a
+%{_libdir}/plugin/*.la
 
 %files shared
 %defattr(-, root, root, 0755)
@@ -847,6 +873,19 @@ fi
 # itself - note that they must be ordered by date (important when
 # merging BK trees)
 %changelog
+* Mon Aug 24 2009 Jonathan Perkin <jperkin@sun.com>
+
+- Add conditionals for bundled zlib and innodb plugin
+
+* Fri Aug 21 2009 Jonathan Perkin <jperkin@sun.com>
+
+- Install plugin libraries in appropriate packages.
+- Disable example plugins.
+
+* Thu Aug 20 2009 Jonathan Perkin <jperkin@stripped>
+
+- Update variable used for mysql-test suite location to match source.
+
 * Fri Nov 07 2008 Joerg Bruehe <joerg@mysql.com>
 
 - Correct yesterday's fix, so that it also works for the last flag,

From 6000fd23d2df00cc565ed4c651cd972d1ac78ecc Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Sep 2009 22:40:02 +0200
Subject: [PATCH 03/13] Backport into build-200909221805-5.1.37sp1

> ------------------------------------------------------------
> revno: 3019.1.3
> revision-id: ramil@mysql.com-20090714150729-xqv7aicsnoz6epy6
> parent: jimw@mysql.com-20090713191116-c8qxsrjagzbvbytj
> committer: Ramil Kalimullin <ramil@mysql.com>
> branch nick: b45998-5.1-bugteam
> timestamp: Tue 2009-07-14 20:07:29 +0500
> message:
>   Fix for bug#45998: database crashes when running
>   "create as select" (innodb table)
>
>   Problem: code constructing "CREATE TABLE..." statement
>   doesn't take into account that current database is not set
>   in some cases. That may lead to a server crash.
>
>   Fix: check if current database is set.
---
 mysql-test/extra/binlog_tests/binlog.test          | 12 ++++++++++++
 mysql-test/suite/binlog/r/binlog_row_binlog.result | 11 +++++++++++
 sql/sql_show.cc                                    |  2 +-
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/mysql-test/extra/binlog_tests/binlog.test b/mysql-test/extra/binlog_tests/binlog.test
index d72dc693cee..5d898d41a54 100644
--- a/mysql-test/extra/binlog_tests/binlog.test
+++ b/mysql-test/extra/binlog_tests/binlog.test
@@ -258,3 +258,15 @@ dec $it;
 }
 show master status /* must show new binlog index after rotating */;
 drop table t3;
+
+--echo #
+--echo # Bug #45998: database crashes when running "create as select"
+--echo #
+CREATE DATABASE test1;
+USE test1;
+DROP DATABASE test1;
+CREATE TABLE test.t1(a int);
+INSERT INTO test.t1 VALUES (1), (2);
+CREATE TABLE test.t2 SELECT * FROM test.t1;
+USE test;
+DROP TABLES t1, t2;
diff --git a/mysql-test/suite/binlog/r/binlog_row_binlog.result b/mysql-test/suite/binlog/r/binlog_row_binlog.result
index 4baa47db129..f6b5392dbc8 100644
--- a/mysql-test/suite/binlog/r/binlog_row_binlog.result
+++ b/mysql-test/suite/binlog/r/binlog_row_binlog.result
@@ -1298,3 +1298,14 @@ show master status /* must show new binlog index after rotating */;
 File	Position	Binlog_Do_DB	Binlog_Ignore_DB
 master-bin.000002	106		
 drop table t3;
+#
+# Bug #45998: database crashes when running "create as select"
+#
+CREATE DATABASE test1;
+USE test1;
+DROP DATABASE test1;
+CREATE TABLE test.t1(a int);
+INSERT INTO test.t1 VALUES (1), (2);
+CREATE TABLE test.t2 SELECT * FROM test.t1;
+USE test;
+DROP TABLES t1, t2;
diff --git a/sql/sql_show.cc b/sql/sql_show.cc
index d07e951bfd1..a1f6798244e 100644
--- a/sql/sql_show.cc
+++ b/sql/sql_show.cc
@@ -1151,7 +1151,7 @@ int store_create_info(THD *thd, TABLE_LIST *table_list, String *packet,
   {
     const LEX_STRING *const db=
       table_list->schema_table ? &INFORMATION_SCHEMA_NAME : &table->s->db;
-    if (strcmp(db->str, thd->db) != 0)
+    if (!thd->db || strcmp(db->str, thd->db))
     {
       append_identifier(thd, packet, db->str, db->length);
       packet->append(STRING_WITH_LEN("."));

From 4526ba5b5667c9558bbcc48cfadd6cb2bff83d9d Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Sep 2009 22:41:25 +0200
Subject: [PATCH 04/13] Backport into build-200909221805-5.1.37sp1

> ------------------------------------------------------------
> revno: 3027
> revision-id: ramil@mysql.com-20090715102544-ejid81yz8k39m2fa
> parent: anurag.shekhar@sun.com-20090715101345-6n3o8wf8woyaqlwc
> committer: Ramil Kalimullin <ramil@mysql.com>
> branch nick: mysql-5.1-bugteam
> timestamp: Wed 2009-07-15 15:25:44 +0500
> message:
>   Addition to #45998 fix, result adjusted.
---
 mysql-test/suite/binlog/r/binlog_stm_binlog.result | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/mysql-test/suite/binlog/r/binlog_stm_binlog.result b/mysql-test/suite/binlog/r/binlog_stm_binlog.result
index d151e31269f..d05d3ccdb7a 100644
--- a/mysql-test/suite/binlog/r/binlog_stm_binlog.result
+++ b/mysql-test/suite/binlog/r/binlog_stm_binlog.result
@@ -773,3 +773,14 @@ show master status /* must show new binlog index after rotating */;
 File	Position	Binlog_Do_DB	Binlog_Ignore_DB
 master-bin.000002	106		
 drop table t3;
+#
+# Bug #45998: database crashes when running "create as select"
+#
+CREATE DATABASE test1;
+USE test1;
+DROP DATABASE test1;
+CREATE TABLE test.t1(a int);
+INSERT INTO test.t1 VALUES (1), (2);
+CREATE TABLE test.t2 SELECT * FROM test.t1;
+USE test;
+DROP TABLES t1, t2;

From d99ddf7abad42fa694aab4cbba058c2ad1859562 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Sep 2009 22:43:48 +0200
Subject: [PATCH 05/13] Backport into build-200909221805-5.1.37sp1

> ------------------------------------------------------------
> revno: 3028 [merge]
> revision-id: davi.arnaut@sun.com-20090715182250-ru0l00nqqlcfqe8n
> parent: ramil@mysql.com-20090715102544-ejid81yz8k39m2fa
> parent: kostja@sun.com-20090715170034-kjzpmq3px90pedw7
> committer: Davi Arnaut <Davi.Arnaut@Sun.COM>
> branch nick: 44495-5.1
> timestamp: Wed 2009-07-15 15:22:50 -0300
> message:
>   Bug#44495: Prepared Statement: CALL p(<x>) - `thd->protocol == &thd->protocol_text' failed
>
>   Merge Konstantin's patch and add a test case.
> ------------------------------------------------------------
> Use --include-merges or -n0 to see merged revisions.
---
 sql/sql_prepare.cc        | 43 ++++++++++++++++++--------------
 tests/mysql_client_test.c | 52 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 77 insertions(+), 18 deletions(-)

diff --git a/sql/sql_prepare.cc b/sql/sql_prepare.cc
index e7e821dd4ae..c1839b7220f 100644
--- a/sql/sql_prepare.cc
+++ b/sql/sql_prepare.cc
@@ -127,12 +127,12 @@ class Prepared_statement: public Statement
 public:
   enum flag_values
   {
-    IS_IN_USE= 1
+    IS_IN_USE= 1,
+    IS_SQL_PREPARE= 2
   };
 
   THD *thd;
   Select_fetch_protocol_binary result;
-  Protocol *protocol;
   Item_param **param_array;
   uint param_count;
   uint last_errno;
@@ -148,7 +148,7 @@ public:
                                List<LEX_STRING>& varnames,
                                String *expanded_query);
 public:
-  Prepared_statement(THD *thd_arg, Protocol *protocol_arg);
+  Prepared_statement(THD *thd_arg);
   virtual ~Prepared_statement();
   void setup_set_params();
   virtual Query_arena::Type type() const;
@@ -156,7 +156,8 @@ public:
   bool set_name(LEX_STRING *name);
   inline void close_cursor() { delete cursor; cursor= 0; }
   inline bool is_in_use() { return flags & (uint) IS_IN_USE; }
-  inline bool is_protocol_text() const { return protocol == &thd->protocol_text; }
+  inline bool is_sql_prepare() const { return flags & (uint) IS_SQL_PREPARE; }
+  void set_sql_prepare() { flags|= (uint) IS_SQL_PREPARE; }
   bool prepare(const char *packet, uint packet_length);
   bool execute_loop(String *expanded_query,
                     bool open_cursor,
@@ -1358,7 +1359,7 @@ static int mysql_test_select(Prepared_statement *stmt,
   */
   if (unit->prepare(thd, 0, 0))
     goto error;
-  if (!lex->describe && !stmt->is_protocol_text())
+  if (!lex->describe && !stmt->is_sql_prepare())
   {
     /* Make copy of item list, as change_columns may change it */
     List<Item> fields(lex->select_lex.item_list);
@@ -1988,7 +1989,7 @@ static bool check_prepared_statement(Prepared_statement *stmt)
     break;
   }
   if (res == 0)
-    DBUG_RETURN(stmt->is_protocol_text() ?
+    DBUG_RETURN(stmt->is_sql_prepare() ?
                 FALSE : (send_prep_stmt(stmt, 0) || thd->protocol->flush()));
 error:
   DBUG_RETURN(TRUE);
@@ -2058,6 +2059,7 @@ static bool init_param_array(Prepared_statement *stmt)
 
 void mysqld_stmt_prepare(THD *thd, const char *packet, uint packet_length)
 {
+  Protocol *save_protocol= thd->protocol;
   Prepared_statement *stmt;
   bool error;
   DBUG_ENTER("mysqld_stmt_prepare");
@@ -2067,7 +2069,7 @@ void mysqld_stmt_prepare(THD *thd, const char *packet, uint packet_length)
   /* First of all clear possible warnings from the previous command */
   mysql_reset_thd_for_next_command(thd);
 
-  if (! (stmt= new Prepared_statement(thd, &thd->protocol_binary)))
+  if (! (stmt= new Prepared_statement(thd)))
     DBUG_VOID_RETURN; /* out of memory: error is set in Sql_alloc */
 
   if (thd->stmt_map.insert(thd, stmt))
@@ -2084,6 +2086,8 @@ void mysqld_stmt_prepare(THD *thd, const char *packet, uint packet_length)
   sp_cache_flush_obsolete(&thd->sp_proc_cache);
   sp_cache_flush_obsolete(&thd->sp_func_cache);
 
+  thd->protocol= &thd->protocol_binary;
+
   if (!(specialflag & SPECIAL_NO_PRIOR))
     my_pthread_setprio(pthread_self(),QUERY_PRIOR);
 
@@ -2097,6 +2101,9 @@ void mysqld_stmt_prepare(THD *thd, const char *packet, uint packet_length)
     /* Statement map deletes statement on erase */
     thd->stmt_map.erase(stmt);
   }
+
+  thd->protocol= save_protocol;
+
   /* check_prepared_statemnt sends the metadata packet in case of success */
   DBUG_VOID_RETURN;
 }
@@ -2229,7 +2236,6 @@ void mysql_sql_stmt_prepare(THD *thd)
   const char *query;
   uint query_len= 0;
   DBUG_ENTER("mysql_sql_stmt_prepare");
-  DBUG_ASSERT(thd->protocol == &thd->protocol_text);
 
   if ((stmt= (Prepared_statement*) thd->stmt_map.find_by_name(name)))
   {
@@ -2247,11 +2253,13 @@ void mysql_sql_stmt_prepare(THD *thd)
   }
 
   if (! (query= get_dynamic_sql_string(lex, &query_len)) ||
-      ! (stmt= new Prepared_statement(thd, &thd->protocol_text)))
+      ! (stmt= new Prepared_statement(thd)))
   {
     DBUG_VOID_RETURN;                           /* out of memory */
   }
 
+  stmt->set_sql_prepare();
+
   /* Set the name first, insert should know that this statement has a name */
   if (stmt->set_name(name))
   {
@@ -2431,6 +2439,7 @@ void mysqld_stmt_execute(THD *thd, char *packet_arg, uint packet_length)
   String expanded_query;
   uchar *packet_end= packet + packet_length;
   Prepared_statement *stmt;
+  Protocol *save_protocol= thd->protocol;
   bool open_cursor;
   DBUG_ENTER("mysqld_stmt_execute");
 
@@ -2458,7 +2467,9 @@ void mysqld_stmt_execute(THD *thd, char *packet_arg, uint packet_length)
 
   open_cursor= test(flags & (ulong) CURSOR_TYPE_READ_ONLY);
 
+  thd->protocol= &thd->protocol_binary;
   stmt->execute_loop(&expanded_query, open_cursor, packet, packet_end);
+  thd->protocol= save_protocol;
 
   /* Close connection socket; for use with client testing (Bug#43560). */
   DBUG_EXECUTE_IF("close_conn_after_stmt_execute", vio_close(thd->net.vio););
@@ -2814,12 +2825,11 @@ Select_fetch_protocol_binary::send_data(List<Item> &fields)
  Prepared_statement
 ****************************************************************************/
 
-Prepared_statement::Prepared_statement(THD *thd_arg, Protocol *protocol_arg)
+Prepared_statement::Prepared_statement(THD *thd_arg)
   :Statement(NULL, &main_mem_root,
              INITIALIZED, ++thd_arg->statement_id_counter),
   thd(thd_arg),
   result(thd_arg),
-  protocol(protocol_arg),
   param_array(0),
   param_count(0),
   last_errno(0),
@@ -3288,7 +3298,9 @@ Prepared_statement::reprepare()
   bool cur_db_changed;
   bool error;
 
-  Prepared_statement copy(thd, &thd->protocol_text);
+  Prepared_statement copy(thd);
+
+  copy.set_sql_prepare(); /* To suppress sending metadata to the client. */
 
   status_var_increment(thd->status_var.com_stmt_reprepare);
 
@@ -3346,7 +3358,7 @@ bool Prepared_statement::validate_metadata(Prepared_statement *copy)
     return FALSE -- the metadata of the original SELECT,
     if any, has not been sent to the client.
   */
-  if (is_protocol_text() || lex->describe)
+  if (is_sql_prepare() || lex->describe)
     return FALSE;
 
   if (lex->select_lex.item_list.elements !=
@@ -3409,7 +3421,6 @@ Prepared_statement::swap_prepared_statement(Prepared_statement *copy)
   DBUG_ASSERT(thd == copy->thd);
   last_error[0]= '\0';
   last_errno= 0;
-  /* Do not swap protocols, the copy always has protocol_text */
 }
 
 
@@ -3550,8 +3561,6 @@ bool Prepared_statement::execute(String *expanded_query, bool open_cursor)
   thd->stmt_arena= this;
   reinit_stmt_before_use(thd, lex);
 
-  thd->protocol= protocol;                      /* activate stmt protocol */
-
   /* Go! */
 
   if (open_cursor)
@@ -3582,8 +3591,6 @@ bool Prepared_statement::execute(String *expanded_query, bool open_cursor)
   if (cur_db_changed)
     mysql_change_db(thd, &saved_cur_db_name, TRUE);
 
-  thd->protocol= &thd->protocol_text;         /* use normal protocol */
-
   /* Assert that if an error, no cursor is open */
   DBUG_ASSERT(! (error && cursor));
 
diff --git a/tests/mysql_client_test.c b/tests/mysql_client_test.c
index b836293442a..c51e3984fc9 100644
--- a/tests/mysql_client_test.c
+++ b/tests/mysql_client_test.c
@@ -17940,6 +17940,57 @@ static void test_bug41078(void)
   DBUG_VOID_RETURN;
 }
 
+
+/**
+  Bug#44495: Prepared Statement:
+             CALL p(<x>) - `thd->protocol == &thd->protocol_text' failed
+*/
+
+static void test_bug44495()
+{
+  int rc;
+  MYSQL con;
+  MYSQL_STMT *stmt;
+
+  DBUG_ENTER("test_bug44495");
+  myheader("test_44495");
+
+  rc= mysql_query(mysql, "DROP PROCEDURE IF EXISTS p1");
+  myquery(rc);
+
+  rc= mysql_query(mysql, "CREATE PROCEDURE p1(IN arg VARCHAR(25))"
+                         "  BEGIN SET @stmt = CONCAT('SELECT \"', arg, '\"');"
+                         "  PREPARE ps1 FROM @stmt;"
+                         "  EXECUTE ps1;"
+                         "  DROP PREPARE ps1;"
+                         "END;");
+  myquery(rc);
+
+  DIE_UNLESS(mysql_init(&con));
+
+  DIE_UNLESS(mysql_real_connect(&con, opt_host, opt_user, opt_password,
+                                current_db, opt_port, opt_unix_socket,
+                                CLIENT_MULTI_RESULTS));
+
+  stmt= mysql_simple_prepare(&con, "CALL p1('abc')");
+  check_stmt(stmt);
+
+  rc= mysql_stmt_execute(stmt);
+  check_execute(stmt, rc);
+
+  rc= my_process_stmt_result(stmt);
+  DIE_UNLESS(rc == 1);
+
+  mysql_stmt_close(stmt);
+
+  mysql_close(&con);
+
+  rc= mysql_query(mysql, "DROP PROCEDURE p1");
+  myquery(rc);
+
+  DBUG_VOID_RETURN;
+}
+
 /*
   Read and parse arguments and MySQL options from my.cnf
 */
@@ -18255,6 +18306,7 @@ static struct my_tests_st my_tests[]= {
   { "test_bug36326", test_bug36326 },
 #endif
   { "test_bug41078", test_bug41078 },
+  { "test_bug44495", test_bug44495 },
   { 0, 0 }
 };
 

From c42a04fd4306975216498c1198539f97230d794c Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Sep 2009 22:52:30 +0200
Subject: [PATCH 06/13] Backport into build-200909221805-5.1.37sp1

> ------------------------------------------------------------
> revno: 3044.1.1
> revision-id: kristofer.pettersson@sun.com-20090729200708-cb0td7n9r5md0aa0
> parent: davi.arnaut@sun.com-20090728195938-qabe9ldm2l4k8xns
> committer: Kristofer Pettersson <kristofer.pettersson@sun.com>
> branch nick: mysql-5.1-bugteam
> timestamp: Wed 2009-07-29 22:07:08 +0200
> message:
>   Bug#44521 Executing a stored procedure as a prepared statement can sometimes cause
>             an assertion in a debug build.
>
>   The reason is that the C API doesn't support multiple result sets for prepared
>   statements and attempting to execute a stored routine which returns multiple result
>   sets sometimes lead to a network error. The network error sets the diagnostic area
>   prematurely which later leads to the assert when an attempt is made to set a second
>   server state.
>
>   This patch fixes the issue by changing the scope of the error code returned by
>   sp_instr_stmt::execute() to include any error which happened during the execution.
>   To assure that Diagnostic_area::is_sent really mean that the message was sent all
>   network related functions are checked for return status.
---
 libmysqld/lib_sql.cc               |  32 ++++---
 mysql-test/r/sp_notembedded.result |  22 +++++
 mysql-test/t/sp_notembedded.test   |  36 ++++++++
 sql/protocol.cc                    | 130 ++++++++++++++++++++---------
 sql/protocol.h                     |   2 +-
 sql/sp_head.cc                     |   4 +-
 6 files changed, 171 insertions(+), 55 deletions(-)

diff --git a/libmysqld/lib_sql.cc b/libmysqld/lib_sql.cc
index d644c45a66a..4034414cd12 100644
--- a/libmysqld/lib_sql.cc
+++ b/libmysqld/lib_sql.cc
@@ -803,11 +803,11 @@ MYSQL_DATA *THD::alloc_new_dataset()
 */
 
 static
-void
+bool
 write_eof_packet(THD *thd, uint server_status, uint total_warn_count)
 {
   if (!thd->mysql)            // bootstrap file handling
-    return;
+    return FALSE;
   /*
     The following test should never be true, but it's better to do it
     because if 'is_fatal_error' is set the server is not going to execute
@@ -822,6 +822,7 @@ write_eof_packet(THD *thd, uint server_status, uint total_warn_count)
   */
   thd->cur_data->embedded_info->warning_count=
     (thd->spcont ? 0 : min(total_warn_count, 65535));
+  return FALSE;
 }
 
 
@@ -1032,31 +1033,34 @@ bool Protocol_binary::write()
   @sa Server implementation of net_send_ok in protocol.cc for
   description of the arguments.
 
-  @return The function does not return errors.
+  @return
+    @retval TRUE An error occurred
+    @retval FALSE Success
 */
 
-void
+bool
 net_send_ok(THD *thd,
             uint server_status, uint total_warn_count,
             ha_rows affected_rows, ulonglong id, const char *message)
 {
   DBUG_ENTER("emb_net_send_ok");
   MYSQL_DATA *data;
+  bool error;
   MYSQL *mysql= thd->mysql;
 
   if (!mysql)            // bootstrap file handling
-    DBUG_VOID_RETURN;
+    DBUG_RETURN(FALSE);
   if (!(data= thd->alloc_new_dataset()))
-    return;
+    return TRUE;
   data->embedded_info->affected_rows= affected_rows;
   data->embedded_info->insert_id= id;
   if (message)
     strmake(data->embedded_info->info, message,
             sizeof(data->embedded_info->info)-1);
 
-  write_eof_packet(thd, server_status, total_warn_count);
+  error= write_eof_packet(thd, server_status, total_warn_count);
   thd->cur_data= 0;
-  DBUG_VOID_RETURN;
+  DBUG_RETURN(error);
 }
 
 
@@ -1065,18 +1069,21 @@ net_send_ok(THD *thd,
 
   @sa net_send_ok
 
-  @return This function does not return errors.
+  @return
+    @retval TRUE  An error occurred
+    @retval FALSE Success
 */
 
-void
+bool
 net_send_eof(THD *thd, uint server_status, uint total_warn_count)
 {
-  write_eof_packet(thd, server_status, total_warn_count);
+  bool error= write_eof_packet(thd, server_status, total_warn_count);
   thd->cur_data= 0;
+  return error;
 }
 
 
-void net_send_error_packet(THD *thd, uint sql_errno, const char *err)
+bool net_send_error_packet(THD *thd, uint sql_errno, const char *err)
 {
   MYSQL_DATA *data= thd->cur_data ? thd->cur_data : thd->alloc_new_dataset();
   struct embedded_query_result *ei= data->embedded_info;
@@ -1086,6 +1093,7 @@ void net_send_error_packet(THD *thd, uint sql_errno, const char *err)
   strmov(ei->sqlstate, mysql_errno_to_sqlstate(sql_errno));
   ei->server_status= thd->server_status;
   thd->cur_data= 0;
+  return FALSE;
 }
 
 
diff --git a/mysql-test/r/sp_notembedded.result b/mysql-test/r/sp_notembedded.result
index c6641e673ee..831616f491b 100644
--- a/mysql-test/r/sp_notembedded.result
+++ b/mysql-test/r/sp_notembedded.result
@@ -249,3 +249,25 @@ DROP PROCEDURE p1;
 DELETE FROM mysql.user WHERE User='mysqltest_1';
 FLUSH PRIVILEGES;
 set @@global.concurrent_insert= @old_concurrent_insert;
+#
+# Bug#44521 Prepared Statement: CALL p() - crashes: `! thd->main_da.is_sent' failed et.al.
+#
+SELECT GET_LOCK('Bug44521', 0);
+GET_LOCK('Bug44521', 0)
+1
+** Connection con1
+CREATE PROCEDURE p()
+BEGIN
+SELECT 1;
+SELECT GET_LOCK('Bug44521', 100);
+SELECT 2;
+END$
+CALL p();;
+** Default connection
+SELECT RELEASE_LOCK('Bug44521');
+RELEASE_LOCK('Bug44521')
+1
+DROP PROCEDURE p;
+# ------------------------------------------------------------------
+# -- End of 5.1 tests
+# ------------------------------------------------------------------
diff --git a/mysql-test/t/sp_notembedded.test b/mysql-test/t/sp_notembedded.test
index ecb37c1299c..f593e184ad2 100644
--- a/mysql-test/t/sp_notembedded.test
+++ b/mysql-test/t/sp_notembedded.test
@@ -380,3 +380,39 @@ set @@global.concurrent_insert= @old_concurrent_insert;
 # Wait till all disconnects are completed
 --source include/wait_until_count_sessions.inc
 
+
+--echo #
+--echo # Bug#44521 Prepared Statement: CALL p() - crashes: `! thd->main_da.is_sent' failed et.al.
+--echo #
+SELECT GET_LOCK('Bug44521', 0);
+--connect (con1,localhost,root,,)
+--echo ** Connection con1
+delimiter $;
+CREATE PROCEDURE p()
+BEGIN
+  SELECT 1;
+  SELECT GET_LOCK('Bug44521', 100);
+  SELECT 2;
+END$
+delimiter ;$
+--send CALL p();
+--connection default
+--echo ** Default connection
+let $wait_condition=
+  SELECT count(*) = 1 FROM information_schema.processlist
+  WHERE state = "User lock" AND info = "SELECT GET_LOCK('Bug44521', 100)";
+--source include/wait_condition.inc
+let $conid =
+  `SELECT id FROM information_schema.processlist
+   WHERE state = "User lock" AND info = "SELECT GET_LOCK('Bug44521', 100)"`;
+dirty_close con1;
+SELECT RELEASE_LOCK('Bug44521');
+let $wait_condition=
+  SELECT count(*) = 0 FROM information_schema.processlist
+  WHERE id = $conid;
+--source include/wait_condition.inc 
+DROP PROCEDURE p;
+
+--echo # ------------------------------------------------------------------
+--echo # -- End of 5.1 tests
+--echo # ------------------------------------------------------------------
diff --git a/sql/protocol.cc b/sql/protocol.cc
index 16975c68a54..4f69a0fdb52 100644
--- a/sql/protocol.cc
+++ b/sql/protocol.cc
@@ -29,11 +29,11 @@
 
 static const unsigned int PACKET_BUFFER_EXTRA_ALLOC= 1024;
 /* Declared non-static only because of the embedded library. */
-void net_send_error_packet(THD *thd, uint sql_errno, const char *err);
-void net_send_ok(THD *, uint, uint, ha_rows, ulonglong, const char *);
-void net_send_eof(THD *thd, uint server_status, uint total_warn_count);
+bool net_send_error_packet(THD *thd, uint sql_errno, const char *err);
+bool net_send_ok(THD *, uint, uint, ha_rows, ulonglong, const char *);
+bool net_send_eof(THD *thd, uint server_status, uint total_warn_count);
 #ifndef EMBEDDED_LIBRARY
-static void write_eof_packet(THD *thd, NET *net,
+static bool write_eof_packet(THD *thd, NET *net,
                              uint server_status, uint total_warn_count);
 #endif
 
@@ -70,8 +70,17 @@ bool Protocol_binary::net_store_data(const uchar *from, size_t length)
   For SIGNAL/RESIGNAL and GET DIAGNOSTICS functionality it's
   critical that every error that can be intercepted is issued in one
   place only, my_message_sql.
+
+  @param thd Thread handler
+  @param sql_errno The error code to send
+  @param err A pointer to the error message
+
+  @return
+    @retval FALSE The message was sent to the client
+    @retval TRUE An error occurred and the message wasn't sent properly
 */
-void net_send_error(THD *thd, uint sql_errno, const char *err)
+
+bool net_send_error(THD *thd, uint sql_errno, const char *err)
 {
   DBUG_ENTER("net_send_error");
 
@@ -80,6 +89,7 @@ void net_send_error(THD *thd, uint sql_errno, const char *err)
   DBUG_ASSERT(err && err[0]);
 
   DBUG_PRINT("enter",("sql_errno: %d  err: %s", sql_errno, err));
+  bool error;
 
   /*
     It's one case when we can push an error even though there
@@ -90,11 +100,11 @@ void net_send_error(THD *thd, uint sql_errno, const char *err)
   /* Abort multi-result sets */
   thd->server_status&= ~SERVER_MORE_RESULTS_EXISTS;
 
-  net_send_error_packet(thd, sql_errno, err);
+  error= net_send_error_packet(thd, sql_errno, err);
 
   thd->main_da.can_overwrite_status= FALSE;
 
-  DBUG_VOID_RETURN;
+  DBUG_RETURN(error);
 }
 
 /**
@@ -113,25 +123,33 @@ void net_send_error(THD *thd, uint sql_errno, const char *err)
   Is not stored if no message.
 
   @param thd		   Thread handler
+  @param server_status     The server status
+  @param total_warn_count  Total number of warnings
   @param affected_rows	   Number of rows changed by statement
   @param id		   Auto_increment id for first row (if used)
   @param message	   Message to send to the client (Used by mysql_status)
+ 
+  @return
+    @retval FALSE The message was successfully sent
+    @retval TRUE An error occurred and the messages wasn't sent properly
+
 */
 
 #ifndef EMBEDDED_LIBRARY
-void
+bool
 net_send_ok(THD *thd,
             uint server_status, uint total_warn_count,
             ha_rows affected_rows, ulonglong id, const char *message)
 {
   NET *net= &thd->net;
   uchar buff[MYSQL_ERRMSG_SIZE+10],*pos;
+  bool error= FALSE;
   DBUG_ENTER("my_ok");
 
   if (! net->vio)	// hack for re-parsing queries
   {
     DBUG_PRINT("info", ("vio present: NO"));
-    DBUG_VOID_RETURN;
+    DBUG_RETURN(FALSE);
   }
 
   buff[0]=0;					// No fields
@@ -162,13 +180,14 @@ net_send_ok(THD *thd,
 
   if (message && message[0])
     pos= net_store_data(pos, (uchar*) message, strlen(message));
-  VOID(my_net_write(net, buff, (size_t) (pos-buff)));
-  VOID(net_flush(net));
+  error= my_net_write(net, buff, (size_t) (pos-buff));
+  if (!error)
+    error= net_flush(net);
 
   thd->main_da.can_overwrite_status= FALSE;
   DBUG_PRINT("info", ("OK sent, so no more error sending allowed"));
 
-  DBUG_VOID_RETURN;
+  DBUG_RETURN(error);
 }
 
 static uchar eof_buff[1]= { (uchar) 254 };      /* Marker for end of fields */
@@ -188,37 +207,54 @@ static uchar eof_buff[1]= { (uchar) 254 };      /* Marker for end of fields */
   client.
 
   @param thd		Thread handler
-  @param no_flush	Set to 1 if there will be more data to the client,
-                    like in send_fields().
+  @param server_status The server status
+  @param total_warn_count Total number of warnings
+
+  @return
+    @retval FALSE The message was successfully sent
+    @retval TRUE An error occurred and the message wasn't sent properly
 */    
 
-void
+bool
 net_send_eof(THD *thd, uint server_status, uint total_warn_count)
 {
   NET *net= &thd->net;
+  bool error= FALSE;
   DBUG_ENTER("net_send_eof");
   /* Set to TRUE if no active vio, to work well in case of --init-file */
   if (net->vio != 0)
   {
     thd->main_da.can_overwrite_status= TRUE;
-    write_eof_packet(thd, net, server_status, total_warn_count);
-    VOID(net_flush(net));
+    error= write_eof_packet(thd, net, server_status, total_warn_count);
+    if (!error)
+      error= net_flush(net);
     thd->main_da.can_overwrite_status= FALSE;
     DBUG_PRINT("info", ("EOF sent, so no more error sending allowed"));
   }
-  DBUG_VOID_RETURN;
+  DBUG_RETURN(error);
 }
 
 
 /**
   Format EOF packet according to the current protocol and
   write it to the network output buffer.
+
+  @param thd The thread handler
+  @param net The network handler
+  @param server_status The server status
+  @param total_warn_count The number of warnings
+
+
+  @return
+    @retval FALSE The message was sent successfully
+    @retval TRUE An error occurred and the messages wasn't sent properly
 */
 
-static void write_eof_packet(THD *thd, NET *net,
+static bool write_eof_packet(THD *thd, NET *net,
                              uint server_status,
                              uint total_warn_count)
 {
+  bool error;
   if (thd->client_capabilities & CLIENT_PROTOCOL_41)
   {
     uchar buff[5];
@@ -237,10 +273,12 @@ static void write_eof_packet(THD *thd, NET *net,
     if (thd->is_fatal_error)
       server_status&= ~SERVER_MORE_RESULTS_EXISTS;
     int2store(buff + 3, server_status);
-    VOID(my_net_write(net, buff, 5));
+    error= my_net_write(net, buff, 5);
   }
   else
-    VOID(my_net_write(net, eof_buff, 1));
+    error= my_net_write(net, eof_buff, 1);
+  
+  return error;
 }
 
 /**
@@ -261,7 +299,17 @@ bool send_old_password_request(THD *thd)
 }
 
 
-void net_send_error_packet(THD *thd, uint sql_errno, const char *err)
+/**
+  @param thd Thread handler
+  @param sql_errno The error code to send
+  @param err A pointer to the error message
+
+  @return
+   @retval FALSE The message was successfully sent
+   @retval TRUE  An error occurred and the messages wasn't sent properly
+*/
+
+bool net_send_error_packet(THD *thd, uint sql_errno, const char *err)
 {
   NET *net= &thd->net;
   uint length;
@@ -279,7 +327,7 @@ void net_send_error_packet(THD *thd, uint sql_errno, const char *err)
       /* In bootstrap it's ok to print on stderr */
       fprintf(stderr,"ERROR: %d  %s\n",sql_errno,err);
     }
-    DBUG_VOID_RETURN;
+    DBUG_RETURN(FALSE);
   }
 
   if (net->return_errno)
@@ -301,9 +349,8 @@ void net_send_error_packet(THD *thd, uint sql_errno, const char *err)
     length=(uint) strlen(err);
     set_if_smaller(length,MYSQL_ERRMSG_SIZE-1);
   }
-  VOID(net_write_command(net,(uchar) 255, (uchar*) "", 0, (uchar*) err,
+  DBUG_RETURN(net_write_command(net,(uchar) 255, (uchar*) "", 0, (uchar*) err,
                          length));
-  DBUG_VOID_RETURN;
 }
 
 #endif /* EMBEDDED_LIBRARY */
@@ -389,36 +436,39 @@ void net_end_statement(THD *thd)
   if (thd->main_da.is_sent)
     return;
 
+  bool error= FALSE;
+
   switch (thd->main_da.status()) {
   case Diagnostics_area::DA_ERROR:
     /* The query failed, send error to log and abort bootstrap. */
-    net_send_error(thd,
-                   thd->main_da.sql_errno(),
-                   thd->main_da.message());
+    error= net_send_error(thd,
+                          thd->main_da.sql_errno(),
+                          thd->main_da.message());
     break;
   case Diagnostics_area::DA_EOF:
-    net_send_eof(thd,
-                 thd->main_da.server_status(),
-                 thd->main_da.total_warn_count());
+    error= net_send_eof(thd,
+                        thd->main_da.server_status(),
+                        thd->main_da.total_warn_count());
     break;
   case Diagnostics_area::DA_OK:
-    net_send_ok(thd,
-                thd->main_da.server_status(),
-                thd->main_da.total_warn_count(),
-                thd->main_da.affected_rows(),
-                thd->main_da.last_insert_id(),
-                thd->main_da.message());
+    error= net_send_ok(thd,
+                       thd->main_da.server_status(),
+                       thd->main_da.total_warn_count(),
+                       thd->main_da.affected_rows(),
+                       thd->main_da.last_insert_id(),
+                       thd->main_da.message());
     break;
   case Diagnostics_area::DA_DISABLED:
     break;
   case Diagnostics_area::DA_EMPTY:
   default:
     DBUG_ASSERT(0);
-    net_send_ok(thd, thd->server_status, thd->total_warn_count,
-                0, 0, NULL);
+    error= net_send_ok(thd, thd->server_status, thd->total_warn_count,
+                       0, 0, NULL);
     break;
   }
-  thd->main_da.is_sent= TRUE;
+  if (!error)
+    thd->main_da.is_sent= TRUE;
 }
 
 
diff --git a/sql/protocol.h b/sql/protocol.h
index a4770e9b6e3..251ba6fbc33 100644
--- a/sql/protocol.h
+++ b/sql/protocol.h
@@ -173,7 +173,7 @@ public:
 };
 
 void send_warning(THD *thd, uint sql_errno, const char *err=0);
-void net_send_error(THD *thd, uint sql_errno=0, const char *err=0);
+bool net_send_error(THD *thd, uint sql_errno=0, const char *err=0);
 void net_end_statement(THD *thd);
 bool send_old_password_request(THD *thd);
 uchar *net_store_data(uchar *to,const uchar *from, size_t length);
diff --git a/sql/sp_head.cc b/sql/sp_head.cc
index 8a8a5b06cc1..f65c3455944 100644
--- a/sql/sp_head.cc
+++ b/sql/sp_head.cc
@@ -1249,7 +1249,7 @@ sp_head::execute(THD *thd)
     */
     if (thd->prelocked_mode == NON_PRELOCKED)
       thd->user_var_events_alloc= thd->mem_root;
-    
+
     err_status= i->execute(thd, &ip);
 
     if (i->free_list)
@@ -2865,7 +2865,7 @@ sp_instr_stmt::execute(THD *thd, uint *nextp)
     if (!thd->is_error())
       thd->main_da.reset_diagnostics_area();
   }
-  DBUG_RETURN(res);
+  DBUG_RETURN(res || thd->is_error());
 }
 
 

From 3eca4ba85eb944a1e5e6d7744697fd076dfe90fa Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Sep 2009 22:54:06 +0200
Subject: [PATCH 07/13] Backport into build-200909221805-5.1.37sp1

> ------------------------------------------------------------
> revno: 3044.1.3
> revision-id: kristofer.pettersson@sun.com-20090729224404-hwevly1cbi7gojf0
> parent: kristofer.pettersson@sun.com-20090729202743-tp9ihd5xavq8eguw
> committer: Kristofer Pettersson <kristofer.pettersson@sun.com>
> branch nick: mysql-5.1-bugteam
> timestamp: Thu 2009-07-30 00:44:04 +0200
> message:
>   Bug#44521 Prepared Statement: CALL p() - crashes: `! thd->main_da.is_sent' failed et.al.
>
>   Fixed wrong prototype declaration which cased build failure on solaris.
---
 libmysqld/emb_qcache.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libmysqld/emb_qcache.h b/libmysqld/emb_qcache.h
index 67413739f2c..ecf91487667 100644
--- a/libmysqld/emb_qcache.h
+++ b/libmysqld/emb_qcache.h
@@ -79,4 +79,4 @@ public:
 uint emb_count_querycache_size(THD *thd);
 int emb_load_querycache_result(THD *thd, Querycache_stream *src);
 void emb_store_querycache_result(Querycache_stream *dst, THD* thd);
-void net_send_eof(THD *thd, uint server_status, uint total_warn_count);
+bool net_send_eof(THD *thd, uint server_status, uint total_warn_count);

From 8ef621e1e8467317586b0161af4e4cf317c855ce Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Sep 2009 22:55:02 +0200
Subject: [PATCH 08/13] Backport into build-200909221805-5.1.37sp1

> ------------------------------------------------------------
> revno: 3059 [merge]
> revision-id: martin.hansson@sun.com-20090810140851-aw5peehzdxi4gjja
> parent: iggy@mysql.com-20090806145453-ion37sfdsldwwjrj
> parent: martin.hansson@sun.com-20090807115140-7fn6wjx0mrui7zl5
> committer: Martin Hansson <martin.hansson@sun.com>
> branch nick: 5.1bt
> timestamp: Mon 2009-08-10 16:08:51 +0200
> message:
>   Merge
> ------------------------------------------------------------
> Use --include-merges or -n0 to see merged revisions.
---
 mysql-test/r/order_by.result | 57 ++++++++++++++++++++++++++++++++++++
 mysql-test/t/order_by.test   | 41 ++++++++++++++++++++++++++
 sql/sql_select.cc            | 25 ++++++++--------
 sql/table.h                  |  8 ++++-
 4 files changed, 118 insertions(+), 13 deletions(-)

diff --git a/mysql-test/r/order_by.result b/mysql-test/r/order_by.result
index dc29c5ec226..306fce1f3c2 100644
--- a/mysql-test/r/order_by.result
+++ b/mysql-test/r/order_by.result
@@ -1500,3 +1500,60 @@ id1
 15
 16
 DROP TABLE t1;
+CREATE TABLE t1 (
+a INT,
+b INT NOT NULL,
+c char(100),
+KEY (b, c),
+KEY (b, a, c)
+)
+DEFAULT CHARSET = utf8;
+INSERT INTO t1 VALUES 
+(1,  1, 1),
+(2,  2, 2),
+(3,  3, 3),
+(4,  4, 4),
+(5,  5, 5),
+(6,  6, 6),
+(7,  7, 7),
+(8,  8, 8),
+(9,  9, 9);
+INSERT INTO t1 SELECT a + 10,  b, c FROM t1;
+INSERT INTO t1 SELECT a + 20,  b, c FROM t1;
+INSERT INTO t1 SELECT a + 40,  b, c FROM t1;
+INSERT INTO t1 SELECT a + 80,  b, c FROM t1;
+INSERT INTO t1 SELECT a + 160, b, c FROM t1;
+INSERT INTO t1 SELECT a + 320, b, c FROM t1;
+INSERT INTO t1 SELECT a + 640, b, c FROM t1;
+INSERT INTO t1 SELECT a + 1280, b, c FROM t1 LIMIT 80;
+EXPLAIN
+SELECT a FROM t1 WHERE b = 1 ORDER BY c DESC LIMIT 9;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	SIMPLE	t1	range	b,b_2	b	4	NULL	226	Using where
+SELECT a FROM t1 WHERE b = 1 ORDER BY c DESC LIMIT 9;
+a
+2071
+2061
+2051
+2041
+2031
+2021
+2011
+2001
+1991
+EXPLAIN
+SELECT DISTINCT a FROM t1 WHERE b = 1 ORDER BY c DESC LIMIT 0, 9;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	SIMPLE	t1	range	b,b_2	b	4	NULL	226	Using where; Using temporary
+SELECT DISTINCT a FROM t1 WHERE b = 1 ORDER BY c DESC LIMIT 0, 9;
+a
+2071
+2061
+2051
+2041
+2031
+2021
+2011
+2001
+1991
+DROP TABLE t1;
diff --git a/mysql-test/t/order_by.test b/mysql-test/t/order_by.test
index f09c1aa7bd4..cca1e3209cc 100644
--- a/mysql-test/t/order_by.test
+++ b/mysql-test/t/order_by.test
@@ -1361,3 +1361,44 @@ DROP TABLE t1;
 
 
 
+#
+# Bug#46454: MySQL wrong index optimisation leads to incorrect result & crashes 
+#
+CREATE TABLE t1 (
+  a INT,
+  b INT NOT NULL,
+  c char(100),
+  KEY (b, c),
+  KEY (b, a, c)
+)
+DEFAULT CHARSET = utf8;
+
+INSERT INTO t1 VALUES 
+(1,  1, 1),
+(2,  2, 2),
+(3,  3, 3),
+(4,  4, 4),
+(5,  5, 5),
+(6,  6, 6),
+(7,  7, 7),
+(8,  8, 8),
+(9,  9, 9);
+
+INSERT INTO t1 SELECT a + 10,  b, c FROM t1;
+INSERT INTO t1 SELECT a + 20,  b, c FROM t1;
+INSERT INTO t1 SELECT a + 40,  b, c FROM t1;
+INSERT INTO t1 SELECT a + 80,  b, c FROM t1;
+INSERT INTO t1 SELECT a + 160, b, c FROM t1;
+INSERT INTO t1 SELECT a + 320, b, c FROM t1;
+INSERT INTO t1 SELECT a + 640, b, c FROM t1;
+INSERT INTO t1 SELECT a + 1280, b, c FROM t1 LIMIT 80;
+
+EXPLAIN
+SELECT a FROM t1 WHERE b = 1 ORDER BY c DESC LIMIT 9;
+SELECT a FROM t1 WHERE b = 1 ORDER BY c DESC LIMIT 9;
+
+EXPLAIN
+SELECT DISTINCT a FROM t1 WHERE b = 1 ORDER BY c DESC LIMIT 0, 9;
+SELECT DISTINCT a FROM t1 WHERE b = 1 ORDER BY c DESC LIMIT 0, 9;
+
+DROP TABLE t1;
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 401745bd9b8..b40ab8f71f4 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -6141,7 +6141,7 @@ make_join_select(JOIN *join,SQL_SELECT *select,COND *cond)
         }
 
       }
-      if (tmp || !cond)
+      if (tmp || !cond || tab->type == JT_REF)
       {
         DBUG_EXECUTE("where",print_where(tmp,tab->table->alias, QT_ORDINARY););
 	SQL_SELECT *sel= tab->select= ((SQL_SELECT*)
@@ -6155,7 +6155,7 @@ make_join_select(JOIN *join,SQL_SELECT *select,COND *cond)
           The guard will turn the predicate on only after
           the first match for outer tables is encountered.
 	*/        
-        if (cond)
+        if (cond && tmp)
         {
           /*
             Because of QUICK_GROUP_MIN_MAX_SELECT there may be a select without
@@ -12931,6 +12931,8 @@ find_field_in_item_list (Field *field, void *data)
 
   The index must cover all fields in <order>, or it will not be considered.
 
+  @param no_changes No changes will be made to the query plan.
+
   @todo
     - sergeyp: Results of all index merge selects actually are ordered 
     by clustered PK values.
@@ -13265,6 +13267,15 @@ test_if_skip_sort_order(JOIN_TAB *tab,ORDER *order,ha_rows select_limit,
       }
       if (!no_changes)
       {
+        /* 
+           If ref_key used index tree reading only ('Using index' in EXPLAIN),
+           and best_key doesn't, then revert the decision.
+        */
+        if (!table->covering_keys.is_set(best_key) && table->key_read)
+        {
+          table->key_read= 0;
+          table->file->extra(HA_EXTRA_NO_KEYREAD);          
+        }        
         if (!quick_created)
 	{
           tab->index= best_key;
@@ -13281,16 +13292,6 @@ test_if_skip_sort_order(JOIN_TAB *tab,ORDER *order,ha_rows select_limit,
             table->key_read=1;
             table->file->extra(HA_EXTRA_KEYREAD);
           }
-          else if (table->key_read)
-          {
-            /*
-              Clear the covering key read flags that might have been
-              previously set for some key other than the current best_key.
-            */
-            table->key_read= 0;
-            table->file->extra(HA_EXTRA_NO_KEYREAD);
-          }
-
           table->file->ha_index_or_rnd_end();
           if (join->select_options & SELECT_DESCRIBE)
           {
diff --git a/sql/table.h b/sql/table.h
index cb53013cd59..1d2ed294833 100644
--- a/sql/table.h
+++ b/sql/table.h
@@ -753,7 +753,13 @@ struct st_table {
   */
   my_bool force_index;
   my_bool distinct,const_table,no_rows;
-  my_bool key_read, no_keyread;
+
+  /**
+     If set, the optimizer has found that row retrieval should access index 
+     tree only.
+   */
+  my_bool key_read;
+  my_bool no_keyread;
   /*
     Placeholder for an open table which prevents other connections
     from taking name-locks on this table. Typically used with

From 507c1ebbb7b91a1168b36eaf71c9692607d46efd Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Sep 2009 22:59:11 +0200
Subject: [PATCH 09/13] Backport into build-200909221805-5.1.37sp1

> ------------------------------------------------------------
> revno: 3068
> revision-id: ramil@mysql.com-20090813194928-3djdqvpock0pxhgp
> parent: li-bing.song@sun.com-20090813024857-1emgf5lhj0zikoj8
> committer: Ramil Kalimullin <ramil@mysql.com>
> branch nick: mysql-5.1-bugteam
> timestamp: Fri 2009-08-14 00:49:28 +0500
> message:
>   Fix for bug #46614: Assertion in show_create_trigger()
>   on SHOW CREATE TRIGGER + MERGE table
>
>   Problem: SHOW CREATE TRIGGER erroneously relies on fact
>   that we have the only underlying table for a trigger
>   (wrong for merge tables).
>
>   Fix: remove erroneous assert().
---
 mysql-test/r/merge.result | 12 ++++++++++++
 mysql-test/t/merge.test   | 11 +++++++++++
 sql/sql_show.cc           |  2 --
 3 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/mysql-test/r/merge.result b/mysql-test/r/merge.result
index bf9108459d7..d1d0370e528 100644
--- a/mysql-test/r/merge.result
+++ b/mysql-test/r/merge.result
@@ -2141,4 +2141,16 @@ SELECT * FROM m1;
 c1
 DROP TABLE m1;
 DROP TABLE t1;
+#
+# Bug #46614: Assertion in show_create_trigger()
+#
+CREATE TABLE t1(a int);
+CREATE TABLE t2(a int);
+CREATE TABLE t3(a int) ENGINE = MERGE UNION(t1, t2);
+CREATE TRIGGER tr1 AFTER INSERT ON t3 FOR EACH ROW CALL foo();
+SHOW CREATE TRIGGER tr1;
+Trigger	sql_mode	SQL Original Statement	character_set_client	collation_connection	Database Collation
+tr1		CREATE DEFINER=`root`@`localhost` TRIGGER tr1 AFTER INSERT ON t3 FOR EACH ROW CALL foo()	latin1	latin1_swedish_ci	latin1_swedish_ci
+DROP TRIGGER tr1;
+DROP TABLE t1, t2, t3;
 End of 5.1 tests
diff --git a/mysql-test/t/merge.test b/mysql-test/t/merge.test
index 8760876b7ee..95d1100d4d7 100644
--- a/mysql-test/t/merge.test
+++ b/mysql-test/t/merge.test
@@ -1555,4 +1555,15 @@ SELECT * FROM m1;
 DROP TABLE m1;
 DROP TABLE t1;
 
+--echo #
+--echo # Bug #46614: Assertion in show_create_trigger()
+--echo #
+CREATE TABLE t1(a int);
+CREATE TABLE t2(a int);
+CREATE TABLE t3(a int) ENGINE = MERGE UNION(t1, t2);
+CREATE TRIGGER tr1 AFTER INSERT ON t3 FOR EACH ROW CALL foo();
+SHOW CREATE TRIGGER tr1;
+DROP TRIGGER tr1;
+DROP TABLE t1, t2, t3;
+
 --echo End of 5.1 tests
diff --git a/sql/sql_show.cc b/sql/sql_show.cc
index a1f6798244e..4b028688373 100644
--- a/sql/sql_show.cc
+++ b/sql/sql_show.cc
@@ -7098,8 +7098,6 @@ bool show_create_trigger(THD *thd, const sp_name *trg_name)
     /* Perform closing actions and return error status. */
   }
 
-  DBUG_ASSERT(num_tables == 1);
-
   Table_triggers_list *triggers= lst->table->triggers;
 
   if (!triggers)

From b3ee09b2fd6f24acc4b605f89889294882a6e754 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Sep 2009 23:00:30 +0200
Subject: [PATCH 10/13] Backport into build-200909221805-5.1.37sp1

> ------------------------------------------------------------
> revno: 3075
> revision-id: ramil@mysql.com-20090821055535-a5aeas33epokjjnp
> parent: joro@sun.com-20090820141122-gq6eyozybvar4o4s
> committer: Ramil Kalimullin <ramil@mysql.com>
> branch nick: mysql-5.1-bugteam
> timestamp: Fri 2009-08-21 10:55:35 +0500
> message:
>   Fix for bug #46456 [Ver->Prg]: HANDLER OPEN + TRUNCATE + DROP
>   (temporary) TABLE, crash
>
>   Problem: if one has an open "HANDLER t1", further "TRUNCATE t1"
>   doesn't close the handler and leaves handler table hash in an
>   inconsistent state, that may lead to a server crash.
>
>   Fix: TRUNCATE should implicitly close all open handlers.
>
>   Doc. request: the fact should be described in the manual accordingly.
---
 mysql-test/r/handler_myisam.result | 16 ++++++++++++++++
 mysql-test/t/handler_myisam.test   | 19 +++++++++++++++++++
 sql/sql_delete.cc                  |  4 ++++
 3 files changed, 39 insertions(+)

diff --git a/mysql-test/r/handler_myisam.result b/mysql-test/r/handler_myisam.result
index dde6a4586bc..90a1bdfe6be 100644
--- a/mysql-test/r/handler_myisam.result
+++ b/mysql-test/r/handler_myisam.result
@@ -741,3 +741,19 @@ USE information_schema;
 HANDLER COLUMNS OPEN;
 ERROR HY000: Incorrect usage of HANDLER OPEN and information_schema
 USE test;
+#
+# BUG #46456: HANDLER OPEN + TRUNCATE + DROP (temporary) TABLE, crash 
+#
+CREATE TABLE t1 AS SELECT 1 AS f1;
+HANDLER t1 OPEN;
+TRUNCATE t1;
+HANDLER t1 READ FIRST;
+ERROR 42S02: Unknown table 't1' in HANDLER
+DROP TABLE t1;
+CREATE TEMPORARY TABLE t1 AS SELECT 1 AS f1;
+HANDLER t1 OPEN;
+TRUNCATE t1;
+HANDLER t1 READ FIRST;
+ERROR 42S02: Unknown table 't1' in HANDLER
+DROP TABLE t1;
+End of 5.1 tests
diff --git a/mysql-test/t/handler_myisam.test b/mysql-test/t/handler_myisam.test
index 644c28de5b2..da02a90af0f 100644
--- a/mysql-test/t/handler_myisam.test
+++ b/mysql-test/t/handler_myisam.test
@@ -19,3 +19,22 @@ let $other_engine_type= MEMORY;
 let $other_handler_engine_type= MyISAM;
 
 --source include/handler.inc
+
+--echo #
+--echo # BUG #46456: HANDLER OPEN + TRUNCATE + DROP (temporary) TABLE, crash 
+--echo #
+CREATE TABLE t1 AS SELECT 1 AS f1; 
+HANDLER t1 OPEN;
+TRUNCATE t1;
+--error ER_UNKNOWN_TABLE
+HANDLER t1 READ FIRST;
+DROP TABLE t1;
+
+CREATE TEMPORARY TABLE t1 AS SELECT 1 AS f1; 
+HANDLER t1 OPEN;
+TRUNCATE t1;
+--error ER_UNKNOWN_TABLE
+HANDLER t1 READ FIRST;
+DROP TABLE t1;
+
+--echo End of 5.1 tests
diff --git a/sql/sql_delete.cc b/sql/sql_delete.cc
index 677098d275a..c56e783e03f 100644
--- a/sql/sql_delete.cc
+++ b/sql/sql_delete.cc
@@ -1058,6 +1058,10 @@ bool mysql_truncate(THD *thd, TABLE_LIST *table_list, bool dont_send_ok)
   DBUG_ENTER("mysql_truncate");
 
   bzero((char*) &create_info,sizeof(create_info));
+
+  /* Remove tables from the HANDLER's hash. */
+  mysql_ha_rm_tables(thd, table_list, FALSE);
+
   /* If it is a temporary table, close and regenerate it */
   if (!dont_send_ok && (table= find_temporary_table(thd, table_list)))
   {

From 9c9458db6a16af7fa1f6496dda22cc5e53fbbea9 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Sep 2009 23:01:19 +0200
Subject: [PATCH 11/13] Backport into build-200909221805-5.1.37sp1

> ------------------------------------------------------------
> revno: 3085 [merge]
> revision-id: sergey.glukhov@sun.com-20090827105925-j56pdghdzb8nlw3p
> parent: alfranio.correia@sun.com-20090827093227-9exafl3k6362bvq7
> parent: sergey.glukhov@sun.com-20090827102219-sgjz0v5t1rfccs14
> committer: Sergey Glukhov <Sergey.Glukhov@sun.com>
> branch nick: mysql-5.1-bugteam
> timestamp: Thu 2009-08-27 15:59:25 +0500
> message:
>   5.0-bugteam->5.1-bugteam merge
> ------------------------------------------------------------
> Use --include-merges or -n0 to see merged revisions.
---
 mysql-test/r/analyse.result   |  9 ++++++---
 mysql-test/r/subselect.result |  2 +-
 mysql-test/t/analyse.test     | 10 ++++++++++
 mysql-test/t/subselect.test   |  2 +-
 sql/sql_yacc.yy               |  3 ++-
 5 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/mysql-test/r/analyse.result b/mysql-test/r/analyse.result
index c0b16778f9c..6eaa8731dc6 100644
--- a/mysql-test/r/analyse.result
+++ b/mysql-test/r/analyse.result
@@ -28,9 +28,7 @@ test.t1.bool	N	Y	1	1	0	0	1.0000	NULL	ENUM('N','Y') NOT NULL
 test.t1.d	2002-03-03	2002-03-05	10	10	0	0	10.0000	NULL	ENUM('2002-03-03','2002-03-04','2002-03-05') NOT NULL
 drop table t1,t2;
 EXPLAIN SELECT 1 FROM (SELECT 1) a PROCEDURE ANALYSE();
-id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
-1	PRIMARY	<derived2>	system	NULL	NULL	NULL	NULL	1	
-2	DERIVED	NULL	NULL	NULL	NULL	NULL	NULL	NULL	No tables used
+ERROR HY000: Incorrect usage of PROCEDURE and subquery
 create table t1 (a int not null);
 create table t2 select * from t1 where 0=1 procedure analyse();
 show create table t2;
@@ -153,4 +151,9 @@ select f3 from t1 procedure analyse(1, 1);
 Field_name	Min_value	Max_value	Min_length	Max_length	Empties_or_zeros	Nulls	Avg_value_or_avg_length	Std	Optimal_fieldtype
 test.t1.f3	5.99999	9.55555	7	7	0	0	7.77777	1.77778	FLOAT(6,5) NOT NULL
 drop table t1;
+CREATE TABLE t1(a INT,b INT,c INT,d INT,e INT,f INT,g INT,h INT,i INT,j INT,k INT);
+INSERT INTO t1 VALUES ();
+SELECT * FROM (SELECT * FROM t1) d PROCEDURE ANALYSE();
+ERROR HY000: Incorrect usage of PROCEDURE and subquery
+DROP TABLE t1;
 End of 4.1 tests
diff --git a/mysql-test/r/subselect.result b/mysql-test/r/subselect.result
index 7f6ebb14c3e..ee6865fe764 100644
--- a/mysql-test/r/subselect.result
+++ b/mysql-test/r/subselect.result
@@ -75,7 +75,7 @@ SELECT 1 FROM (SELECT 1 as a) b WHERE 1 IN (SELECT (SELECT a));
 select (SELECT 1 FROM (SELECT 1) a PROCEDURE ANALYSE(1));
 ERROR HY000: Incorrect usage of PROCEDURE and subquery
 SELECT 1 FROM (SELECT 1) a PROCEDURE ANALYSE((SELECT 1));
-ERROR HY000: Incorrect parameters to procedure 'ANALYSE'
+ERROR HY000: Incorrect usage of PROCEDURE and subquery
 SELECT (SELECT 1) as a FROM (SELECT 1) b WHERE (SELECT a) IS NULL;
 ERROR 42S22: Unknown column 'a' in 'field list'
 SELECT (SELECT 1) as a FROM (SELECT 1) b WHERE (SELECT a) IS NOT NULL;
diff --git a/mysql-test/t/analyse.test b/mysql-test/t/analyse.test
index efcf5f6421c..d8466df14bf 100644
--- a/mysql-test/t/analyse.test
+++ b/mysql-test/t/analyse.test
@@ -14,6 +14,7 @@ create table t2 select * from t1 procedure analyse();
 select * from t2;
 drop table t1,t2;
 
+--error ER_WRONG_USAGE
 EXPLAIN SELECT 1 FROM (SELECT 1) a PROCEDURE ANALYSE();
 
 #
@@ -102,4 +103,13 @@ select f2 from t1 procedure analyse(1, 1);
 select f3 from t1 procedure analyse(1, 1);
 drop table t1;
 
+#
+# Bug#46184 Crash, SELECT ... FROM derived table procedure analyze
+#
+CREATE TABLE t1(a INT,b INT,c INT,d INT,e INT,f INT,g INT,h INT,i INT,j INT,k INT);
+INSERT INTO t1 VALUES ();
+--error ER_WRONG_USAGE
+SELECT * FROM (SELECT * FROM t1) d PROCEDURE ANALYSE();
+DROP TABLE t1;
+
 --echo End of 4.1 tests
diff --git a/mysql-test/t/subselect.test b/mysql-test/t/subselect.test
index e82764d6ac4..bc3d6d44798 100644
--- a/mysql-test/t/subselect.test
+++ b/mysql-test/t/subselect.test
@@ -30,7 +30,7 @@ SELECT 1 IN (SELECT 1);
 SELECT 1 FROM (SELECT 1 as a) b WHERE 1 IN (SELECT (SELECT a));
 -- error ER_WRONG_USAGE
 select (SELECT 1 FROM (SELECT 1) a PROCEDURE ANALYSE(1));
--- error ER_WRONG_PARAMETERS_TO_PROCEDURE
+-- error ER_WRONG_USAGE
 SELECT 1 FROM (SELECT 1) a PROCEDURE ANALYSE((SELECT 1));
 -- error ER_BAD_FIELD_ERROR
 SELECT (SELECT 1) as a FROM (SELECT 1) b WHERE (SELECT a) IS NULL;
diff --git a/sql/sql_yacc.yy b/sql/sql_yacc.yy
index 7d6a7ade540..2eedbf5d1e7 100644
--- a/sql/sql_yacc.yy
+++ b/sql/sql_yacc.yy
@@ -9069,7 +9069,8 @@ procedure_clause:
               MYSQL_YYABORT;
             }
 
-            if (&lex->select_lex != lex->current_select)
+            if (&lex->select_lex != lex->current_select ||
+                lex->select_lex.get_table_list()->derived)
             {
               my_error(ER_WRONG_USAGE, MYF(0), "PROCEDURE", "subquery");
               MYSQL_YYABORT;

From 152e207ddf984cb2f98d1dbe9e742153b3c5537a Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Sep 2009 23:05:28 +0200
Subject: [PATCH 12/13] Backport into build-200909221805-5.1.37sp1

> ------------------------------------------------------------
> revno: 3092.1.2 [merge]
> revision-id: joro@sun.com-20090831134035-wndnw04gy8kzogpm
> parent: anurag.shekhar@sun.com-20090831075609-tkpqu41hxtupdeip
> parent: joro@sun.com-20090827114042-h55n7qp9990bl6ge
> committer: Georgi Kodinov <joro@sun.com>
> branch nick: B46749-5.1-bugteam
> timestamp: Mon 2009-08-31 16:40:35 +0300
> message:
>   automerge
> ------------------------------------------------------------
> Use --include-merges or -n0 to see merged revisions.
---
 mysql-test/r/subselect.result | 28 ++++++++++++++++++++++++
 mysql-test/t/subselect.test   | 32 +++++++++++++++++++++++++++
 sql/sql_select.cc             | 41 +++++++++++++++++++++++++----------
 3 files changed, 89 insertions(+), 12 deletions(-)

diff --git a/mysql-test/r/subselect.result b/mysql-test/r/subselect.result
index ee6865fe764..164a65ac47d 100644
--- a/mysql-test/r/subselect.result
+++ b/mysql-test/r/subselect.result
@@ -4361,6 +4361,34 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	filtered	Extra
 Warnings:
 Note	1003	select 1 AS `1` from `test`.`t1` where <in_optimizer>(1,<exists>(select 1 AS `1` from `test`.`t1` where (`test`.`t1`.`a` > 3) group by `test`.`t1`.`a` having (<cache>(1) = <ref_null_helper>(1))))
 DROP TABLE t1;
+#
+# Bug #46749: Segfault in add_key_fields() with outer subquery level 
+#   field references
+#
+CREATE TABLE t1 (
+a int,
+b int,
+UNIQUE (a), KEY (b)
+);
+INSERT INTO t1 VALUES (1,1), (2,1);
+CREATE TABLE st1 like t1;
+INSERT INTO st1 VALUES (1,1), (2,1);
+CREATE TABLE st2 like t1;
+INSERT INTO st2 VALUES (1,1), (2,1);
+EXPLAIN
+SELECT MAX(b), (SELECT COUNT(*) FROM st1,st2 WHERE st2.b <= t1.b)
+FROM t1 
+WHERE a = 230;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+2	DEPENDENT SUBQUERY	st1	index	NULL	a	5	NULL	2	Using index
+2	DEPENDENT SUBQUERY	st2	index	b	b	5	NULL	2	Using where; Using index; Using join buffer
+SELECT MAX(b), (SELECT COUNT(*) FROM st1,st2 WHERE st2.b <= t1.b)
+FROM t1 
+WHERE a = 230;
+MAX(b)	(SELECT COUNT(*) FROM st1,st2 WHERE st2.b <= t1.b)
+NULL	0
+DROP TABLE t1, st1, st2;
 End of 5.0 tests.
 CREATE TABLE t1 (a INT, b INT);
 INSERT INTO t1 VALUES (2,22),(1,11),(2,22);
diff --git a/mysql-test/t/subselect.test b/mysql-test/t/subselect.test
index bc3d6d44798..0bf844f23af 100644
--- a/mysql-test/t/subselect.test
+++ b/mysql-test/t/subselect.test
@@ -3315,6 +3315,38 @@ EXPLAIN EXTENDED SELECT 1 FROM t1 WHERE 1 IN (SELECT 1 FROM t1 GROUP BY a);
 EXPLAIN EXTENDED SELECT 1 FROM t1 WHERE 1 IN (SELECT 1 FROM t1 WHERE a > 3 GROUP BY a);
 DROP TABLE t1;
 
+
+--echo #
+--echo # Bug #46749: Segfault in add_key_fields() with outer subquery level 
+--echo #   field references
+--echo #
+
+CREATE TABLE t1 (
+  a int,
+  b int,
+  UNIQUE (a), KEY (b)
+);
+INSERT INTO t1 VALUES (1,1), (2,1);
+
+CREATE TABLE st1 like t1;
+INSERT INTO st1 VALUES (1,1), (2,1);
+
+CREATE TABLE st2 like t1;
+INSERT INTO st2 VALUES (1,1), (2,1);
+
+# should have "impossible where"
+EXPLAIN
+SELECT MAX(b), (SELECT COUNT(*) FROM st1,st2 WHERE st2.b <= t1.b)
+FROM t1 
+WHERE a = 230;
+
+# should not crash
+SELECT MAX(b), (SELECT COUNT(*) FROM st1,st2 WHERE st2.b <= t1.b)
+FROM t1 
+WHERE a = 230;
+
+DROP TABLE t1, st1, st2;
+
 --echo End of 5.0 tests.
 
 #
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index b40ab8f71f4..6b16ebc3406 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -3289,6 +3289,28 @@ add_key_equal_fields(KEY_FIELD **key_fields, uint and_level,
   }
 }
 
+
+/**
+  Check if an expression is a non-outer field.
+
+  Checks if an expression is a field and belongs to the current select.
+
+  @param   field  Item expression to check
+
+  @return boolean
+     @retval TRUE   the expression is a local field
+     @retval FALSE  it's something else
+*/
+
+inline static bool
+is_local_field (Item *field)
+{
+  field= field->real_item();
+  return field->type() == Item::FIELD_ITEM && 
+    !((Item_field *)field)->depended_from;
+}
+
+
 static void
 add_key_fields(JOIN *join, KEY_FIELD **key_fields, uint *and_level,
                COND *cond, table_map usable_tables,
@@ -3364,13 +3386,12 @@ add_key_fields(JOIN *join, KEY_FIELD **key_fields, uint *and_level,
   {
     Item **values;
     // BETWEEN, IN, NE
-    if (cond_func->key_item()->real_item()->type() == Item::FIELD_ITEM &&
+    if (is_local_field (cond_func->key_item()) &&
 	!(cond_func->used_tables() & OUTER_REF_TABLE_BIT))
     {
       values= cond_func->arguments()+1;
       if (cond_func->functype() == Item_func::NE_FUNC &&
-        cond_func->arguments()[1]->real_item()->type() == Item::FIELD_ITEM &&
-	     !(cond_func->arguments()[0]->used_tables() & OUTER_REF_TABLE_BIT))
+        is_local_field (cond_func->arguments()[1]))
         values--;
       DBUG_ASSERT(cond_func->functype() != Item_func::IN_FUNC ||
                   cond_func->argument_count() != 2);
@@ -3386,9 +3407,7 @@ add_key_fields(JOIN *join, KEY_FIELD **key_fields, uint *and_level,
       for (uint i= 1 ; i < cond_func->argument_count() ; i++)
       {
         Item_field *field_item;
-        if (cond_func->arguments()[i]->real_item()->type() == Item::FIELD_ITEM
-            &&
-            !(cond_func->arguments()[i]->used_tables() & OUTER_REF_TABLE_BIT))
+        if (is_local_field (cond_func->arguments()[i]))
         {
           field_item= (Item_field *) (cond_func->arguments()[i]->real_item());
           add_key_equal_fields(key_fields, *and_level, cond_func,
@@ -3404,8 +3423,7 @@ add_key_fields(JOIN *join, KEY_FIELD **key_fields, uint *and_level,
     bool equal_func=(cond_func->functype() == Item_func::EQ_FUNC ||
 		     cond_func->functype() == Item_func::EQUAL_FUNC);
 
-    if (cond_func->arguments()[0]->real_item()->type() == Item::FIELD_ITEM &&
-	!(cond_func->arguments()[0]->used_tables() & OUTER_REF_TABLE_BIT))
+    if (is_local_field (cond_func->arguments()[0]))
     {
       add_key_equal_fields(key_fields, *and_level, cond_func,
 	                (Item_field*) (cond_func->arguments()[0])->real_item(),
@@ -3413,9 +3431,8 @@ add_key_fields(JOIN *join, KEY_FIELD **key_fields, uint *and_level,
                            cond_func->arguments()+1, 1, usable_tables,
                            sargables);
     }
-    if (cond_func->arguments()[1]->real_item()->type() == Item::FIELD_ITEM &&
-	cond_func->functype() != Item_func::LIKE_FUNC &&
-	!(cond_func->arguments()[1]->used_tables() & OUTER_REF_TABLE_BIT))
+    if (is_local_field (cond_func->arguments()[1]) &&
+	cond_func->functype() != Item_func::LIKE_FUNC)
     {
       add_key_equal_fields(key_fields, *and_level, cond_func, 
                        (Item_field*) (cond_func->arguments()[1])->real_item(),
@@ -3427,7 +3444,7 @@ add_key_fields(JOIN *join, KEY_FIELD **key_fields, uint *and_level,
   }
   case Item_func::OPTIMIZE_NULL:
     /* column_name IS [NOT] NULL */
-    if (cond_func->arguments()[0]->real_item()->type() == Item::FIELD_ITEM &&
+    if (is_local_field (cond_func->arguments()[0]) &&
 	!(cond_func->used_tables() & OUTER_REF_TABLE_BIT))
     {
       Item *tmp=new Item_null;

From cab23cd6a28e80007c3969dc5484649bd905a54d Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Mon, 5 Oct 2009 20:14:43 +0200
Subject: [PATCH 13/13] Add fixes for Bug#46834: Test suite missing from RPMs

Additional changes from the following commits:

http://lists.mysql.com/commits/81279
http://lists.mysql.com/commits/81607

These were missed when scanning 'bzr log' for changes.
---
 mysql-test/Makefile.am                    | 3 ++-
 mysql-test/lib/My/SafeProcess/Makefile.am | 3 ++-
 mysql-test/lib/mtr_cases.pm               | 3 ++-
 storage/ndb/test/run-test/Makefile.am     | 3 ++-
 support-files/mysql.spec.sh               | 4 ++++
 5 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/mysql-test/Makefile.am b/mysql-test/Makefile.am
index 7a56584190d..c183553f963 100644
--- a/mysql-test/Makefile.am
+++ b/mysql-test/Makefile.am
@@ -17,7 +17,8 @@
 
 ## Process this file with automake to create Makefile.in
 
-testdir =	$(prefix)/mysql-test
+testroot = $(prefix)
+testdir =  $(testroot)/mysql-test
 
 test_SCRIPTS =	mtr \
 		mysql-test-run \
diff --git a/mysql-test/lib/My/SafeProcess/Makefile.am b/mysql-test/lib/My/SafeProcess/Makefile.am
index 623c0e9a87a..722331453fe 100644
--- a/mysql-test/lib/My/SafeProcess/Makefile.am
+++ b/mysql-test/lib/My/SafeProcess/Makefile.am
@@ -13,7 +13,8 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 
-safedir = $(prefix)/mysql-test/lib/My/SafeProcess
+testroot = $(prefix)
+safedir = $(testroot)/mysql-test/lib/My/SafeProcess
 #nobase_bin_PROGRAMS = ...
 safe_PROGRAMS =		my_safe_process
 
diff --git a/mysql-test/lib/mtr_cases.pm b/mysql-test/lib/mtr_cases.pm
index 2a7b07debd0..841def4d0ad 100644
--- a/mysql-test/lib/mtr_cases.pm
+++ b/mysql-test/lib/mtr_cases.pm
@@ -239,7 +239,8 @@ sub collect_one_suite($)
     else
     {
       $suitedir= my_find_dir($::basedir,
-			     ["mysql-test/suite",
+			     ["share/mysql-test/suite",
+			      "mysql-test/suite",
 			      "mysql-test",
 			      # Look in storage engine specific suite dirs
 			      "storage/*/mysql-test-suites"
diff --git a/storage/ndb/test/run-test/Makefile.am b/storage/ndb/test/run-test/Makefile.am
index 65aa62d11f0..54ca0c009b2 100644
--- a/storage/ndb/test/run-test/Makefile.am
+++ b/storage/ndb/test/run-test/Makefile.am
@@ -13,7 +13,8 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 
-testdir=$(prefix)/mysql-test/ndb
+testroot=$(prefix)
+testdir=$(testroot)/mysql-test/ndb
 
 include $(top_srcdir)/storage/ndb/config/common.mk.am
 include $(top_srcdir)/storage/ndb/config/type_util.mk.am
diff --git a/support-files/mysql.spec.sh b/support-files/mysql.spec.sh
index 5b8d7a5922d..bd2098b1aca 100644
--- a/support-files/mysql.spec.sh
+++ b/support-files/mysql.spec.sh
@@ -886,6 +886,10 @@ fi
 
 - Update variable used for mysql-test suite location to match source.
 
+* Thu Aug 20 2009 Jonathan Perkin <jperkin@stripped>
+
+- Update variable used for mysql-test suite location to match source.
+
 * Fri Nov 07 2008 Joerg Bruehe <joerg@mysql.com>
 
 - Correct yesterday's fix, so that it also works for the last flag,