From f5f9c922c864556044c606e804bec3780236b885 Mon Sep 17 00:00:00 2001
From: "karen.langford@oracle.com" <>
Date: Tue, 22 Jun 2010 19:21:25 +0200
Subject: [PATCH 01/45] Set version number for mysql-5.1.46sp1 release

---
 configure.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure.in b/configure.in
index 904c54abb5f..9098ed1f3cb 100644
--- a/configure.in
+++ b/configure.in
@@ -12,7 +12,7 @@ dnl
 dnl When changing the major version number please also check the switch
 dnl statement in mysqlbinlog::check_master_version().  You may also need
 dnl to update version.c in ndb.
-AC_INIT([MySQL Server], [5.1.46], [], [mysql])
+AC_INIT([MySQL Server], [5.1.46sp1], [], [mysql])
 
 AC_CONFIG_SRCDIR([sql/mysqld.cc])
 AC_CANONICAL_SYSTEM

From d4858b96d3ffdd162f0273f106e99f76a334ed2f Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:42:14 +0200
Subject: [PATCH 02/45] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 3362
> revision-id: davi.arnaut@sun.com-20100401131522-895y8uzvv8ag44gs
> parent: ramil@mysql.com-20100429045409-r7r5lcyiruis15v7
> committer: Davi Arnaut <Davi.Arnaut@Sun.COM>
> branch nick: 50755-5.1
> timestamp: Thu 2010-04-01 10:15:22 -0300
> message:
>   Bug#50755: Crash if stored routine def contains version comments
>
>   The problem was that a syntactically invalid trigger could cause
>   the server to crash when trying to list triggers. The crash would
>   happen due to a mishap in the backup/restore procedure that should
>   protect parser items which are not associated with the trigger. The
>   backup/restore is used to isolate the parse tree (and context) of
>   a statement from the load (and parsing) of a trigger. In this case,
>   a error during the parsing of a trigger could cause the improper
>   backup/restore sequence.
>
>   The solution is to properly restore the original statement context
>   before the parser is exited due to syntax errors in the trigger body.
---
 mysql-test/r/trigger.result | 23 +++++++++++++++++++++++
 mysql-test/t/trigger.test   | 31 +++++++++++++++++++++++++++++++
 sql/sp_head.cc              | 36 ++++++++++++++----------------------
 sql/sp_head.h               |  4 ----
 sql/sql_lex.cc              |  1 +
 5 files changed, 69 insertions(+), 26 deletions(-)

diff --git a/mysql-test/r/trigger.result b/mysql-test/r/trigger.result
index 3446babbb52..e3c0b0e1dd9 100644
--- a/mysql-test/r/trigger.result
+++ b/mysql-test/r/trigger.result
@@ -2128,4 +2128,27 @@ Warning	1048	Column 'id' cannot be null
 Warning	1048	Column 'id' cannot be null
 DROP TRIGGER t1_bu;
 DROP TABLE t1,t2;
+#
+# Bug#50755: Crash if stored routine def contains version comments
+#
+DROP DATABASE IF EXISTS db1;
+DROP TRIGGER IF EXISTS trg1;
+DROP TABLE IF EXISTS t1, t2;
+CREATE DATABASE db1;
+USE db1;
+CREATE TABLE t1 (b INT);
+CREATE TABLE t2 (a INT);
+CREATE TRIGGER trg1 BEFORE INSERT ON t2 FOR EACH ROW INSERT/*!INTO*/t1 VALUES (1);
+# Used to crash
+SHOW TRIGGERS IN db1;
+Trigger	Event	Table	Statement	Timing	Created	sql_mode	Definer	character_set_client	collation_connection	Database Collation
+Warnings:
+Warning	1064	You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'VALUES (1)' at line 1
+INSERT INTO t2 VALUES (1);
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'VALUES (1)' at line 1
+SELECT * FROM t1;
+b
+# Work around Bug#45235
+DROP DATABASE db1;
+USE test;
 End of 5.1 tests.
diff --git a/mysql-test/t/trigger.test b/mysql-test/t/trigger.test
index 368271f1fb2..bcbca4d2139 100644
--- a/mysql-test/t/trigger.test
+++ b/mysql-test/t/trigger.test
@@ -2439,4 +2439,35 @@ UPDATE t1 SET id=NULL;
 DROP TRIGGER t1_bu;
 DROP TABLE t1,t2;
 
+--echo #
+--echo # Bug#50755: Crash if stored routine def contains version comments
+--echo #
+
+--disable_warnings
+DROP DATABASE IF EXISTS db1;
+DROP TRIGGER IF EXISTS trg1;
+DROP TABLE IF EXISTS t1, t2;
+--enable_warnings
+
+CREATE DATABASE db1;
+USE db1;
+
+CREATE TABLE t1 (b INT);
+CREATE TABLE t2 (a INT);
+
+CREATE TRIGGER trg1 BEFORE INSERT ON t2 FOR EACH ROW INSERT/*!INTO*/t1 VALUES (1);
+--echo # Used to crash
+SHOW TRIGGERS IN db1;
+--error ER_PARSE_ERROR
+INSERT INTO t2 VALUES (1);
+SELECT * FROM t1;
+
+--echo # Work around Bug#45235
+let $MYSQLD_DATADIR = `select @@datadir`;
+--remove_file $MYSQLD_DATADIR/db1/t2.TRG
+--remove_file $MYSQLD_DATADIR/db1/trg1.TRN
+
+DROP DATABASE db1;
+USE test;
+
 --echo End of 5.1 tests.
diff --git a/sql/sp_head.cc b/sql/sp_head.cc
index 11d5e5f830b..cadda38053c 100644
--- a/sql/sp_head.cc
+++ b/sql/sp_head.cc
@@ -745,21 +745,12 @@ sp_head::create(THD *thd)
 
 sp_head::~sp_head()
 {
-  DBUG_ENTER("sp_head::~sp_head");
-  destroy();
-  delete m_next_cached_sp;
-  if (m_thd)
-    restore_thd_mem_root(m_thd);
-  DBUG_VOID_RETURN;
-}
-
-void
-sp_head::destroy()
-{
-  sp_instr *i;
   LEX *lex;
-  DBUG_ENTER("sp_head::destroy");
-  DBUG_PRINT("info", ("name: %s", m_name.str));
+  sp_instr *i;
+  DBUG_ENTER("sp_head::~sp_head");
+
+  /* sp_head::restore_thd_mem_root() must already have been called. */
+  DBUG_ASSERT(m_thd == NULL);
 
   for (uint ip = 0 ; (i = get_instr(ip)) ; ip++)
     delete i;
@@ -770,21 +761,22 @@ sp_head::destroy()
   /*
     If we have non-empty LEX stack then we just came out of parser with
     error. Now we should delete all auxilary LEXes and restore original
-    THD::lex (In this case sp_head::restore_thd_mem_root() was not called
-    too, so m_thd points to the current thread context).
-    It is safe to not update LEX::ptr because further query string parsing
-    and execution will be stopped anyway.
+    THD::lex. It is safe to not update LEX::ptr because further query
+    string parsing and execution will be stopped anyway.
   */
-  DBUG_ASSERT(m_lex.is_empty() || m_thd);
   while ((lex= (LEX *)m_lex.pop()))
   {
-    lex_end(m_thd->lex);
-    delete m_thd->lex;
-    m_thd->lex= lex;
+    THD *thd= lex->thd;
+    lex_end(thd->lex);
+    delete thd->lex;
+    thd->lex= lex;
   }
 
   hash_free(&m_sptabs);
   hash_free(&m_sroutines);
+
+  delete m_next_cached_sp;
+
   DBUG_VOID_RETURN;
 }
 
diff --git a/sql/sp_head.h b/sql/sp_head.h
index 00c96d44f70..d422adc8927 100644
--- a/sql/sp_head.h
+++ b/sql/sp_head.h
@@ -289,10 +289,6 @@ public:
 
   virtual ~sp_head();
 
-  /// Free memory
-  void
-  destroy();
-
   bool
   execute_trigger(THD *thd,
                   const LEX_STRING *db_name,
diff --git a/sql/sql_lex.cc b/sql/sql_lex.cc
index 5097ca2ad5b..a3776f59241 100644
--- a/sql/sql_lex.cc
+++ b/sql/sql_lex.cc
@@ -2106,6 +2106,7 @@ void st_lex::cleanup_lex_after_parse_error(THD *thd)
   */
   if (thd->lex->sphead)
   {
+    thd->lex->sphead->restore_thd_mem_root(thd);
     delete thd->lex->sphead;
     thd->lex->sphead= NULL;
   }

From 98cfc9e61e9d061ff6803c3e371febde282a97a1 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:50:47 +0200
Subject: [PATCH 03/45] Backport into build-201006221614-5.1.46sp1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> ------------------------------------------------------------
> revno: 3351.14.50
> revision-id: marko.makela@oracle.com-20100421185359-8qaxoa2yyrpzwdd7
> parent: marko.makela@oracle.com-20100421102723-0i80uezbyu0ekj5d
> committer: Marko Mäkelä <marko.makela@oracle.com>
> branch nick: 5.1-innodb
> timestamp: Wed 2010-04-21 21:53:59 +0300
> message:
>   btr_page_split_and_insert(): Avoid an infinite loop. (Bug #52964)
>
>   btr_page_tuple_smaller(): New function, refactored from
>   btr_page_split_and_insert().
>
>   btr_page_get_split_rec(): Renamed from btr_page_get_sure_split_rec().
>   Note that a NULL return may mean that the tuple is to be inserted into
>   either the lower or upper page, to be determined by btr_page_tuple_smaller().
>
>   btr_page_split_and_insert(): When btr_page_get_split_rec() returns NULL,
>   invoke btr_page_tuple_smaller() to determine which half-page the tuple
>   belongs to.
>
>   Reviewed by Sunny Bains
---
 storage/innodb_plugin/btr/btr0btr.c | 91 +++++++++++++++++++----------
 1 file changed, 59 insertions(+), 32 deletions(-)

diff --git a/storage/innodb_plugin/btr/btr0btr.c b/storage/innodb_plugin/btr/btr0btr.c
index fa4fc05d96b..cd8f42b3818 100644
--- a/storage/innodb_plugin/btr/btr0btr.c
+++ b/storage/innodb_plugin/btr/btr0btr.c
@@ -1451,11 +1451,11 @@ Calculates a split record such that the tuple will certainly fit on
 its half-page when the split is performed. We assume in this function
 only that the cursor page has at least one user record.
 @return split record, or NULL if tuple will be the first record on
-upper half-page */
+the lower or upper half-page (determined by btr_page_tuple_smaller()) */
 static
 rec_t*
-btr_page_get_sure_split_rec(
-/*========================*/
+btr_page_get_split_rec(
+/*===================*/
 	btr_cur_t*	cursor,	/*!< in: cursor at which insert should be made */
 	const dtuple_t*	tuple,	/*!< in: tuple to insert */
 	ulint		n_ext)	/*!< in: number of externally stored columns */
@@ -1831,6 +1831,37 @@ btr_attach_half_pages(
 	btr_page_set_next(upper_page, upper_page_zip, next_page_no, mtr);
 }
 
+/*************************************************************//**
+Determine if a tuple is smaller than any record on the page.
+@return TRUE if smaller */
+static
+ibool
+btr_page_tuple_smaller(
+/*===================*/
+	btr_cur_t*	cursor,	/*!< in: b-tree cursor */
+	const dtuple_t*	tuple,	/*!< in: tuple to consider */
+	ulint*		offsets,/*!< in/out: temporary storage */
+	ulint		n_uniq,	/*!< in: number of unique fields
+				in the index page records */
+	mem_heap_t**	heap)	/*!< in/out: heap for offsets */
+{
+	buf_block_t*	block;
+	const rec_t*	first_rec;
+	page_cur_t	pcur;
+
+	/* Read the first user record in the page. */
+	block = btr_cur_get_block(cursor);
+	page_cur_set_before_first(block, &pcur);
+	page_cur_move_to_next(&pcur);
+	first_rec = page_cur_get_rec(&pcur);
+
+	offsets = rec_get_offsets(
+		first_rec, cursor->index, offsets,
+		n_uniq, heap);
+
+	return(cmp_dtuple_rec(tuple, first_rec, offsets) < 0);
+}
+
 /*************************************************************//**
 Splits an index page to halves and inserts the tuple. It is assumed
 that mtr holds an x-latch to the index tree. NOTE: the tree x-latch is
@@ -1905,49 +1936,45 @@ func_start:
 	if (n_iterations > 0) {
 		direction = FSP_UP;
 		hint_page_no = page_no + 1;
-		split_rec = btr_page_get_sure_split_rec(cursor, tuple, n_ext);
+		split_rec = btr_page_get_split_rec(cursor, tuple, n_ext);
 
+		if (UNIV_UNLIKELY(split_rec == NULL)) {
+			insert_left = btr_page_tuple_smaller(
+				cursor, tuple, offsets, n_uniq, &heap);
+		}
 	} else if (btr_page_get_split_rec_to_right(cursor, &split_rec)) {
 		direction = FSP_UP;
 		hint_page_no = page_no + 1;
+		insert_left = FALSE;
 
 	} else if (btr_page_get_split_rec_to_left(cursor, &split_rec)) {
 		direction = FSP_DOWN;
 		hint_page_no = page_no - 1;
+		ut_ad(split_rec);
 	} else {
 		direction = FSP_UP;
 		hint_page_no = page_no + 1;
 
-		if (page_get_n_recs(page) == 1) {
-			page_cur_t	pcur;
+		/* If there is only one record in the index page, we
+		can't split the node in the middle by default. We need
+		to determine whether the new record will be inserted
+		to the left or right. */
 
-			/* There is only one record in the index page
-			therefore we can't split the node in the middle
-			by default. We need to determine whether the
-			new record will be inserted to the left or right. */
-
-			/* Read the first (and only) record in the page. */
-			page_cur_set_before_first(block, &pcur);
-			page_cur_move_to_next(&pcur);
-			first_rec = page_cur_get_rec(&pcur);
-
-			offsets = rec_get_offsets(
-				first_rec, cursor->index, offsets,
-				n_uniq, &heap);
-
-			/* If the new record is less than the existing record
-			the split in the middle will copy the existing
-			record to the new node. */
-			if (cmp_dtuple_rec(tuple, first_rec, offsets) < 0) {
-				split_rec = page_get_middle_rec(page);
-			} else {
-				split_rec = NULL;
-			}
-		} else {
+		if (page_get_n_recs(page) > 1) {
 			split_rec = page_get_middle_rec(page);
+		} else if (btr_page_tuple_smaller(cursor, tuple,
+						  offsets, n_uniq, &heap)) {
+			split_rec = page_rec_get_next(
+				page_get_infimum_rec(page));
+		} else {
+			split_rec = NULL;
+			insert_left = FALSE;
 		}
 	}
 
+	/* At this point, insert_left is initialized if split_rec == NULL
+	and may be uninitialized otherwise. */
+
 	/* 2. Allocate a new page to the index */
 	new_block = btr_page_alloc(cursor->index, hint_page_no, direction,
 				   btr_page_get_level(page, mtr), mtr);
@@ -1974,11 +2001,11 @@ func_start:
 			avoid further splits by inserting the record
 			to an empty page. */
 			split_rec = NULL;
-			goto insert_right;
+			goto insert_empty;
 		}
 	} else {
-insert_right:
-		insert_left = FALSE;
+insert_empty:
+		ut_ad(!split_rec);
 		buf = mem_alloc(rec_get_converted_size(cursor->index,
 						       tuple, n_ext));
 

From 01ca7cff6fd255a630f26f9112774d324aa8a4f7 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:52:43 +0200
Subject: [PATCH 04/45] Backport into build-201006221614-5.1.46sp1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> ------------------------------------------------------------
> revno: 3351.14.74
> revision-id: marko.makela@oracle.com-20100504093128-44v6glupe1dsh0ug
> parent: marko.makela@oracle.com-20100503122859-k73bl51re93o0mt4
> committer: Marko Mäkelä <marko.makela@oracle.com>
> branch nick: 5.1-innodb
> timestamp: Tue 2010-05-04 12:31:28 +0300
> message:
>   btr_page_split_and_insert(): Correct the fix of Bug #52964.
>   When split_rec==NULL, choose the correct node pointer key (first_rec).
---
 storage/innodb_plugin/btr/btr0btr.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/storage/innodb_plugin/btr/btr0btr.c b/storage/innodb_plugin/btr/btr0btr.c
index cd8f42b3818..1d6b4f5a0e6 100644
--- a/storage/innodb_plugin/btr/btr0btr.c
+++ b/storage/innodb_plugin/btr/btr0btr.c
@@ -2003,9 +2003,13 @@ func_start:
 			split_rec = NULL;
 			goto insert_empty;
 		}
+	} else if (UNIV_UNLIKELY(insert_left)) {
+		first_rec = page_rec_get_next(page_get_infimum_rec(page));
+		move_limit = page_rec_get_next(btr_cur_get_rec(cursor));
 	} else {
 insert_empty:
 		ut_ad(!split_rec);
+		ut_ad(!insert_left);
 		buf = mem_alloc(rec_get_converted_size(cursor->index,
 						       tuple, n_ext));
 
@@ -2029,7 +2033,11 @@ insert_empty:
 			&& btr_page_insert_fits(cursor, split_rec,
 						offsets, tuple, n_ext, heap);
 	} else {
-		mem_free(buf);
+		if (!insert_left) {
+			mem_free(buf);
+			buf = NULL;
+		}
+
 		insert_will_fit = !new_page_zip
 			&& btr_page_insert_fits(cursor, NULL,
 						NULL, tuple, n_ext, heap);

From 5121205d5753efb69a5dfeb45a1f3c47fd2ada04 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:54:41 +0200
Subject: [PATCH 05/45] Backport into build-201006221614-5.1.46sp1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> ------------------------------------------------------------
> revno: 3351.47.1
> revision-id: marko.makela@oracle.com-20100511104500-c6kzd0bg5s42p8e9
> parent: vasil.dimov@oracle.com-20100510132852-cz457uqvj8iiy9mm
> committer: Marko Mäkelä <marko.makela@oracle.com>
> branch nick: mysql-5.1-innodb2
> timestamp: Tue 2010-05-11 13:45:00 +0300
> message:
>   Remove a stray expression. Spotted by Sunny Bains.
---
 storage/innodb_plugin/page/page0zip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/storage/innodb_plugin/page/page0zip.c b/storage/innodb_plugin/page/page0zip.c
index aa5e39ff04a..a64a41ea518 100644
--- a/storage/innodb_plugin/page/page0zip.c
+++ b/storage/innodb_plugin/page/page0zip.c
@@ -571,7 +571,7 @@ page_zip_dir_encode(
 	/* Traverse the list of stored records in the collation order,
 	starting from the first user record. */
 
-	rec = page + PAGE_NEW_INFIMUM, TRUE;
+	rec = page + PAGE_NEW_INFIMUM;
 
 	i = 0;
 

From 0e40579c13aefe908cd3ac249ae17c1d7c13b4b2 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:56:18 +0200
Subject: [PATCH 06/45] Backport into build-201006221614-5.1.46sp1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> ------------------------------------------------------------
> revno: 3351.47.2
> revision-id: marko.makela@oracle.com-20100511104910-nim8kgguawpis7zo
> parent: marko.makela@oracle.com-20100511104500-c6kzd0bg5s42p8e9
> committer: Marko Mäkelä <marko.makela@oracle.com>
> branch nick: mysql-5.1-innodb2
> timestamp: Tue 2010-05-11 13:49:10 +0300
> message:
>   btr_page_split_and_insert(): Add an assertion
>   suggested by Sunny Bains when reviewing Bug #52964.
---
 storage/innodb_plugin/btr/btr0btr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/storage/innodb_plugin/btr/btr0btr.c b/storage/innodb_plugin/btr/btr0btr.c
index 1d6b4f5a0e6..0fd209e0216 100644
--- a/storage/innodb_plugin/btr/btr0btr.c
+++ b/storage/innodb_plugin/btr/btr0btr.c
@@ -2004,6 +2004,7 @@ func_start:
 			goto insert_empty;
 		}
 	} else if (UNIV_UNLIKELY(insert_left)) {
+		ut_a(n_iterations > 0);
 		first_rec = page_rec_get_next(page_get_infimum_rec(page));
 		move_limit = page_rec_get_next(btr_cur_get_rec(cursor));
 	} else {

From 8763eab5097231b32a387be03383ae5685d91162 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 21:59:35 +0200
Subject: [PATCH 07/45] Backport into build-201006221614-5.1.46sp1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> ------------------------------------------------------------
> revno: 3351.14.47
> revision-id: marko.makela@oracle.com-20100421095033-0acvzxb8um8cms0a
> parent: marko.makela@oracle.com-20100421094032-ir4glqk46qvg2ywn
> committer: Marko Mäkelä <marko.makela@oracle.com>
> branch nick: 5.1-innodb
> timestamp: Wed 2010-04-21 12:50:33 +0300
> message:
>   dtuple_convert_big_rec(): Store locally any fields whose maximum length
>   is less than 256 bytes. (Bug #52745)
>   Add related comments and debug assertions to the "offsets"
>   functions in rem0rec.c.
>   Approved by Sunny Bains
---
 storage/innodb_plugin/data/data0data.c | 15 +++++++
 storage/innodb_plugin/rem/rem0rec.c    | 59 +++++++++++++++++++++++++-
 2 files changed, 72 insertions(+), 2 deletions(-)

diff --git a/storage/innodb_plugin/data/data0data.c b/storage/innodb_plugin/data/data0data.c
index e3c1f1b4f23..0715b49bf9c 100644
--- a/storage/innodb_plugin/data/data0data.c
+++ b/storage/innodb_plugin/data/data0data.c
@@ -666,6 +666,21 @@ dtuple_convert_big_rec(
 				goto skip_field;
 			}
 
+			/* In DYNAMIC and COMPRESSED format, store
+			locally any non-BLOB columns whose maximum
+			length does not exceed 256 bytes.  This is
+			because there is no room for the "external
+			storage" flag when the maximum length is 255
+			bytes or less. This restriction trivially
+			holds in REDUNDANT and COMPACT format, because
+			there we always store locally columns whose
+			length is up to local_len == 788 bytes.
+			@see rec_init_offsets_comp_ordinary */
+			if (ifield->col->mtype != DATA_BLOB
+			    && ifield->col->len < 256) {
+				goto skip_field;
+			}
+
 			longest_i = i;
 			longest = savings;
 
diff --git a/storage/innodb_plugin/rem/rem0rec.c b/storage/innodb_plugin/rem/rem0rec.c
index 27c11dacc8c..59cf6e887d1 100644
--- a/storage/innodb_plugin/rem/rem0rec.c
+++ b/storage/innodb_plugin/rem/rem0rec.c
@@ -212,6 +212,13 @@ rec_get_n_extern_new(
 			const dict_col_t*	col
 				= dict_field_get_col(field);
 			len = *lens--;
+			/* If the maximum length of the field is up
+			to 255 bytes, the actual length is always
+			stored in one byte. If the maximum length is
+			more than 255 bytes, the actual length is
+			stored in one byte for 0..127.  The length
+			will be encoded in two bytes when it is 128 or
+			more, or when the field is stored externally. */
 			if (UNIV_UNLIKELY(col->len > 255)
 			    || UNIV_UNLIKELY(col->mtype == DATA_BLOB)) {
 				if (len & 0x80) {
@@ -294,6 +301,13 @@ rec_init_offsets_comp_ordinary(
 			const dict_col_t*	col
 				= dict_field_get_col(field);
 			len = *lens--;
+			/* If the maximum length of the field is up
+			to 255 bytes, the actual length is always
+			stored in one byte. If the maximum length is
+			more than 255 bytes, the actual length is
+			stored in one byte for 0..127.  The length
+			will be encoded in two bytes when it is 128 or
+			more, or when the field is stored externally. */
 			if (UNIV_UNLIKELY(col->len > 255)
 			    || UNIV_UNLIKELY(col->mtype
 					     == DATA_BLOB)) {
@@ -425,6 +439,15 @@ rec_init_offsets(
 				const dict_col_t*	col
 					= dict_field_get_col(field);
 				len = *lens--;
+				/* If the maximum length of the field
+				is up to 255 bytes, the actual length
+				is always stored in one byte. If the
+				maximum length is more than 255 bytes,
+				the actual length is stored in one
+				byte for 0..127.  The length will be
+				encoded in two bytes when it is 128 or
+				more, or when the field is stored
+				externally. */
 				if (UNIV_UNLIKELY(col->len > 255)
 				    || UNIV_UNLIKELY(col->mtype
 						     == DATA_BLOB)) {
@@ -647,6 +670,13 @@ rec_get_offsets_reverse(
 			const dict_col_t*	col
 				= dict_field_get_col(field);
 			len = *lens++;
+			/* If the maximum length of the field is up
+			to 255 bytes, the actual length is always
+			stored in one byte. If the maximum length is
+			more than 255 bytes, the actual length is
+			stored in one byte for 0..127.  The length
+			will be encoded in two bytes when it is 128 or
+			more, or when the field is stored externally. */
 			if (UNIV_UNLIKELY(col->len > 255)
 			    || UNIV_UNLIKELY(col->mtype == DATA_BLOB)) {
 				if (len & 0x80) {
@@ -781,12 +811,20 @@ rec_get_converted_size_comp_prefix(
 
 		ut_ad(len <= col->len || col->mtype == DATA_BLOB);
 
+		/* If the maximum length of a variable-length field
+		is up to 255 bytes, the actual length is always stored
+		in one byte. If the maximum length is more than 255
+		bytes, the actual length is stored in one byte for
+		0..127.  The length will be encoded in two bytes when
+		it is 128 or more, or when the field is stored externally. */
+
 		if (field->fixed_len) {
 			ut_ad(len == field->fixed_len);
 			/* dict_index_add_col() should guarantee this */
 			ut_ad(!field->prefix_len
 			      || field->fixed_len == field->prefix_len);
 		} else if (dfield_is_ext(&fields[i])) {
+			ut_ad(col->len >= 256 || col->mtype == DATA_BLOB);
 			extra_size += 2;
 		} else if (len < 128
 			   || (col->len < 256 && col->mtype != DATA_BLOB)) {
@@ -1086,6 +1124,8 @@ rec_convert_dtuple_to_rec_comp(
 	/* Store the data and the offsets */
 
 	for (i = 0, field = fields; i < n_fields; i++, field++) {
+		const dict_field_t*	ifield;
+
 		type = dfield_get_type(field);
 		len = dfield_get_len(field);
 
@@ -1120,12 +1160,20 @@ rec_convert_dtuple_to_rec_comp(
 		/* only nullable fields can be null */
 		ut_ad(!dfield_is_null(field));
 
-		fixed_len = dict_index_get_nth_field(index, i)->fixed_len;
-
+		ifield = dict_index_get_nth_field(index, i);
+		fixed_len = ifield->fixed_len;
+		/* If the maximum length of a variable-length field
+		is up to 255 bytes, the actual length is always stored
+		in one byte. If the maximum length is more than 255
+		bytes, the actual length is stored in one byte for
+		0..127.  The length will be encoded in two bytes when
+		it is 128 or more, or when the field is stored externally. */
 		if (fixed_len) {
 			ut_ad(len == fixed_len);
 			ut_ad(!dfield_is_ext(field));
 		} else if (dfield_is_ext(field)) {
+			ut_ad(ifield->col->len >= 256
+			      || ifield->col->mtype == DATA_BLOB);
 			ut_ad(len <= REC_MAX_INDEX_COL_LEN
 			      + BTR_EXTERN_FIELD_REF_SIZE);
 			*lens-- = (byte) (len >> 8) | 0xc0;
@@ -1402,6 +1450,13 @@ rec_copy_prefix_to_buf(
 			prefix_len += field->fixed_len;
 		} else {
 			ulint	len = *lens--;
+			/* If the maximum length of the column is up
+			to 255 bytes, the actual length is always
+			stored in one byte. If the maximum length is
+			more than 255 bytes, the actual length is
+			stored in one byte for 0..127.  The length
+			will be encoded in two bytes when it is 128 or
+			more, or when the column is stored externally. */
 			if (col->len > 255 || col->mtype == DATA_BLOB) {
 				if (len & 0x80) {
 					/* 1exxxxxx */

From 25d938b691c0d6b8261985b2ac4d9e5e2aad4fa9 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 22:09:31 +0200
Subject: [PATCH 08/45] Backport into 5.1.46sp1:

> revno: 3351.14.56
> committer: Marko Mdkeld <marko.makela@oracle.com>
> branch nick: 5.1-innodb
> timestamp: Mon 2010-04-26 14:08:56 +0300
> message:
>   Add a test case for Bug #52745.
---
 .../innodb_plugin/r/innodb_bug52745.result    | 130 ++++++++++++++++++
 .../innodb_plugin/t/innodb_bug52745.test      | 109 +++++++++++++++
 2 files changed, 239 insertions(+)
 create mode 100644 mysql-test/suite/innodb_plugin/r/innodb_bug52745.result
 create mode 100644 mysql-test/suite/innodb_plugin/t/innodb_bug52745.test

diff --git a/mysql-test/suite/innodb_plugin/r/innodb_bug52745.result b/mysql-test/suite/innodb_plugin/r/innodb_bug52745.result
new file mode 100644
index 00000000000..254c6525257
--- /dev/null
+++ b/mysql-test/suite/innodb_plugin/r/innodb_bug52745.result
@@ -0,0 +1,130 @@
+SET GLOBAL innodb_file_format='Barracuda';
+SET GLOBAL innodb_file_per_table=on;
+CREATE TABLE bug52745 (
+a2 int(10) unsigned DEFAULT NULL,
+col37 time DEFAULT NULL,
+col38 char(229) CHARACTER SET utf8 DEFAULT NULL,
+col39 text,
+col40 timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+col41 int(10) unsigned DEFAULT NULL,
+col42 varchar(248) CHARACTER SET utf8 DEFAULT NULL,
+col43 smallint(5) unsigned zerofill DEFAULT NULL,
+col44 varchar(150) CHARACTER SET utf8 DEFAULT NULL,
+col45 float unsigned zerofill DEFAULT NULL,
+col46 binary(1) DEFAULT NULL,
+col47 tinyint(4) DEFAULT NULL,
+col48 tinyint(1) DEFAULT NULL,
+col49 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+col50 binary(1) DEFAULT NULL,
+col51 double unsigned zerofill DEFAULT NULL,
+col52 int(10) unsigned DEFAULT NULL,
+col53 time DEFAULT NULL,
+col54 double unsigned DEFAULT NULL,
+col55 time DEFAULT NULL,
+col56 mediumtext CHARACTER SET latin2,
+col57 blob,
+col58 decimal(52,16) unsigned zerofill NOT NULL DEFAULT '000000000000000000000000000000000000.0000000000000000',
+col59 binary(1) DEFAULT NULL,
+col60 longblob,
+col61 time DEFAULT NULL,
+col62 longtext CHARACTER SET utf8 COLLATE utf8_persian_ci,
+col63 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+col64 int(10) unsigned DEFAULT NULL,
+col65 date DEFAULT NULL,
+col66 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+col67 binary(1) DEFAULT NULL,
+col68 tinyblob,
+col69 date DEFAULT NULL,
+col70 tinyint(3) unsigned zerofill DEFAULT NULL,
+col71 varchar(44) CHARACTER SET utf8 DEFAULT NULL,
+col72 datetime DEFAULT NULL,
+col73 smallint(5) unsigned zerofill DEFAULT NULL,
+col74 longblob,
+col75 bit(34) DEFAULT NULL,
+col76 float unsigned zerofill DEFAULT NULL,
+col77 year(2) DEFAULT NULL,
+col78 tinyint(3) unsigned DEFAULT NULL,
+col79 set('msfheowh','tbpxbgf','by','wahnrjw','myqfasxz','rsokyumrt') CHARACTER SET latin2 DEFAULT NULL,
+col80 datetime DEFAULT NULL,
+col81 smallint(6) DEFAULT NULL,
+col82 enum('xtaurnqfqz','rifrse','kuzwpbvb','niisabk','zxavro','rbvasv','','uulrfaove','','') DEFAULT NULL,
+col83 bigint(20) unsigned zerofill DEFAULT NULL,
+col84 float unsigned zerofill DEFAULT NULL,
+col85 double DEFAULT NULL,
+col86 enum('ylannv','','vlkhycqc','snke','cxifustp','xiaxaswzp','oxl') CHARACTER SET latin1 COLLATE latin1_german2_ci DEFAULT NULL,
+col87 varbinary(221) DEFAULT NULL,
+col88 double unsigned DEFAULT NULL,
+col89 float unsigned zerofill DEFAULT NULL,
+col90 tinyblob
+) ENGINE=InnoDB DEFAULT CHARSET=latin1 ROW_FORMAT=COMPRESSED KEY_BLOCK_SIZE=1;
+Warnings:
+Note	1291	Column 'col82' has duplicated value '' in ENUM
+Note	1291	Column 'col82' has duplicated value '' in ENUM
+INSERT INTO bug52745 SET
+col40='0000-00-00 00:00:00',
+col51=16547,
+col53='7711484',
+col54=-28604,
+col55='7112612',
+col56='wakefulness\'',
+col57=repeat('absorbefacient\'',106),
+col58=11027,
+col59='AM09gW7',
+col60=repeat('Noelani\'',16),
+col61='2520576',
+col62='substitutiv',
+col63='19950106155112',
+col64=-12038,
+col65='86238806',
+col66='19600719080256',
+col68=repeat('Sagittarius\'',54),
+col69='38943902',
+col70=1232,
+col71='Elora\'',
+col74=repeat('zipp',11),
+col75='0',
+col76=23254,
+col78=13247,
+col79='56219',
+col80='20500609035724',
+col81=11632,
+col82=7,
+col84=-23863,
+col85=6341,
+col87='HZdkf.4 s7t,5Rmq	8so fmr,ruGLUG25TrtI.yQ	2SuHq0ML7rw7.4 b2yf2E5TJxOtBBZImezDnzpj,uPYfznnEUDN1e9aQoO 2DsplB7TFWy	oQJ br  HLF :F,eQ p4i1oWsr lL3PG,hjCz6hYqN h1QTjLCjrv:QCdSzpYBibJAtZCxLOk3l6Blsh.W',
+col88=16894,
+col89=6161,
+col90=repeat('gale',48);
+Warnings:
+Warning	1265	Data truncated for column 'col53' at row 1
+Warning	1264	Out of range value for column 'col54' at row 1
+Warning	1265	Data truncated for column 'col59' at row 1
+Warning	1265	Data truncated for column 'col61' at row 1
+Warning	1264	Out of range value for column 'col64' at row 1
+Warning	1265	Data truncated for column 'col65' at row 1
+Warning	1264	Out of range value for column 'col66' at row 1
+Warning	1265	Data truncated for column 'col68' at row 1
+Warning	1265	Data truncated for column 'col69' at row 1
+Warning	1264	Out of range value for column 'col70' at row 1
+Warning	1264	Out of range value for column 'col78' at row 1
+Warning	1265	Data truncated for column 'col79' at row 1
+Warning	1264	Out of range value for column 'col84' at row 1
+SHOW WARNINGS;
+Level	Code	Message
+Warning	1265	Data truncated for column 'col53' at row 1
+Warning	1264	Out of range value for column 'col54' at row 1
+Warning	1265	Data truncated for column 'col59' at row 1
+Warning	1265	Data truncated for column 'col61' at row 1
+Warning	1264	Out of range value for column 'col64' at row 1
+Warning	1265	Data truncated for column 'col65' at row 1
+Warning	1264	Out of range value for column 'col66' at row 1
+Warning	1265	Data truncated for column 'col68' at row 1
+Warning	1265	Data truncated for column 'col69' at row 1
+Warning	1264	Out of range value for column 'col70' at row 1
+Warning	1264	Out of range value for column 'col78' at row 1
+Warning	1265	Data truncated for column 'col79' at row 1
+Warning	1264	Out of range value for column 'col84' at row 1
+DROP TABLE bug52745;
+SET GLOBAL innodb_file_format=Antelope;
+SET GLOBAL innodb_file_format_check=Antelope;
+SET GLOBAL innodb_file_per_table=0;
diff --git a/mysql-test/suite/innodb_plugin/t/innodb_bug52745.test b/mysql-test/suite/innodb_plugin/t/innodb_bug52745.test
new file mode 100644
index 00000000000..b20a993a2d1
--- /dev/null
+++ b/mysql-test/suite/innodb_plugin/t/innodb_bug52745.test
@@ -0,0 +1,109 @@
+-- source include/have_innodb_plugin.inc
+
+let $file_format=`select @@innodb_file_format`;
+let $file_format_check=`select @@innodb_file_format_check`;
+let $file_per_table=`select @@innodb_file_per_table`;
+SET GLOBAL innodb_file_format='Barracuda';
+SET GLOBAL innodb_file_per_table=on;
+
+CREATE TABLE bug52745 (
+  a2 int(10) unsigned DEFAULT NULL,
+  col37 time DEFAULT NULL,
+  col38 char(229) CHARACTER SET utf8 DEFAULT NULL,
+  col39 text,
+  col40 timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  col41 int(10) unsigned DEFAULT NULL,
+  col42 varchar(248) CHARACTER SET utf8 DEFAULT NULL,
+  col43 smallint(5) unsigned zerofill DEFAULT NULL,
+  col44 varchar(150) CHARACTER SET utf8 DEFAULT NULL,
+  col45 float unsigned zerofill DEFAULT NULL,
+  col46 binary(1) DEFAULT NULL,
+  col47 tinyint(4) DEFAULT NULL,
+  col48 tinyint(1) DEFAULT NULL,
+  col49 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+  col50 binary(1) DEFAULT NULL,
+  col51 double unsigned zerofill DEFAULT NULL,
+  col52 int(10) unsigned DEFAULT NULL,
+  col53 time DEFAULT NULL,
+  col54 double unsigned DEFAULT NULL,
+  col55 time DEFAULT NULL,
+  col56 mediumtext CHARACTER SET latin2,
+  col57 blob,
+  col58 decimal(52,16) unsigned zerofill NOT NULL DEFAULT '000000000000000000000000000000000000.0000000000000000',
+  col59 binary(1) DEFAULT NULL,
+  col60 longblob,
+  col61 time DEFAULT NULL,
+  col62 longtext CHARACTER SET utf8 COLLATE utf8_persian_ci,
+  col63 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+  col64 int(10) unsigned DEFAULT NULL,
+  col65 date DEFAULT NULL,
+  col66 timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
+  col67 binary(1) DEFAULT NULL,
+  col68 tinyblob,
+  col69 date DEFAULT NULL,
+  col70 tinyint(3) unsigned zerofill DEFAULT NULL,
+  col71 varchar(44) CHARACTER SET utf8 DEFAULT NULL,
+  col72 datetime DEFAULT NULL,
+  col73 smallint(5) unsigned zerofill DEFAULT NULL,
+  col74 longblob,
+  col75 bit(34) DEFAULT NULL,
+  col76 float unsigned zerofill DEFAULT NULL,
+  col77 year(2) DEFAULT NULL,
+  col78 tinyint(3) unsigned DEFAULT NULL,
+  col79 set('msfheowh','tbpxbgf','by','wahnrjw','myqfasxz','rsokyumrt') CHARACTER SET latin2 DEFAULT NULL,
+  col80 datetime DEFAULT NULL,
+  col81 smallint(6) DEFAULT NULL,
+  col82 enum('xtaurnqfqz','rifrse','kuzwpbvb','niisabk','zxavro','rbvasv','','uulrfaove','','') DEFAULT NULL,
+  col83 bigint(20) unsigned zerofill DEFAULT NULL,
+  col84 float unsigned zerofill DEFAULT NULL,
+  col85 double DEFAULT NULL,
+  col86 enum('ylannv','','vlkhycqc','snke','cxifustp','xiaxaswzp','oxl') CHARACTER SET latin1 COLLATE latin1_german2_ci DEFAULT NULL,
+  col87 varbinary(221) DEFAULT NULL,
+  col88 double unsigned DEFAULT NULL,
+  col89 float unsigned zerofill DEFAULT NULL,
+  col90 tinyblob
+) ENGINE=InnoDB DEFAULT CHARSET=latin1 ROW_FORMAT=COMPRESSED KEY_BLOCK_SIZE=1;
+
+INSERT INTO bug52745 SET
+col40='0000-00-00 00:00:00',
+col51=16547,
+col53='7711484',
+col54=-28604,
+col55='7112612',
+col56='wakefulness\'',
+col57=repeat('absorbefacient\'',106),
+col58=11027,
+col59='AM09gW7',
+col60=repeat('Noelani\'',16),
+col61='2520576',
+col62='substitutiv',
+col63='19950106155112',
+col64=-12038,
+col65='86238806',
+col66='19600719080256',
+col68=repeat('Sagittarius\'',54),
+col69='38943902',
+col70=1232,
+col71='Elora\'',
+col74=repeat('zipp',11),
+col75='0',
+col76=23254,
+col78=13247,
+col79='56219',
+col80='20500609035724',
+col81=11632,
+col82=7,
+col84=-23863,
+col85=6341,
+col87='HZdkf.4 s7t,5Rmq	8so fmr,ruGLUG25TrtI.yQ	2SuHq0ML7rw7.4 b2yf2E5TJxOtBBZImezDnzpj,uPYfznnEUDN1e9aQoO 2DsplB7TFWy	oQJ br  HLF :F,eQ p4i1oWsr lL3PG,hjCz6hYqN h1QTjLCjrv:QCdSzpYBibJAtZCxLOk3l6Blsh.W',
+col88=16894,
+col89=6161,
+col90=repeat('gale',48);
+
+SHOW WARNINGS;
+
+DROP TABLE bug52745;
+
+EVAL SET GLOBAL innodb_file_format=$file_format;
+EVAL SET GLOBAL innodb_file_format_check=$file_format_check;
+EVAL SET GLOBAL innodb_file_per_table=$file_per_table;

From 33042e6db5dd86ebb9af6d502ed7b6c069d60a27 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 22:34:48 +0200
Subject: [PATCH 09/45] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 1810.3987.13
> revision-id: ramil@mysql.com-20100429044232-f0pkyx8fnpszf142
> parent: alexey.kopytov@sun.com-20100426200600-op06qy98llzpzgl1
> committer: Ramil Kalimullin <ramil@mysql.com>
> branch nick: b53237-5.0-bugteam
> timestamp: Thu 2010-04-29 08:42:32 +0400
> message:
>   Fix for bug #53237: mysql_list_fields/COM_FIELD_LIST stack smashing
>
>   Problem: "COM_FIELD_LIST is an old command of the MySQL server, before there was real move to only
>   SQL. Seems that the data sent to COM_FIELD_LIST( mysql_list_fields() function) is not
>   checked for sanity. By sending long data for the table a buffer is overflown, which can
>   be used deliberately to include code that harms".
>
>   Fix: check incoming data length.

The patch did not apply cleanly:
- Line numbers are completely off, roughly it is 2030 -> 1313
- What is called "pend" in the patch, is "arg_end" in the source.
---
 sql/sql_parse.cc | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 5228a37f490..11481933c8a 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -1300,8 +1300,16 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
       We have name + wildcard in packet, separated by endzero
     */
     arg_end= strend(packet);
+    uint arg_length= arg_end - packet;
+    
+    /* Check given table name length. */
+    if (arg_length >= packet_length || arg_length > NAME_LEN)
+    {
+      my_message(ER_UNKNOWN_COM_ERROR, ER(ER_UNKNOWN_COM_ERROR), MYF(0));
+      break;
+    }
     thd->convert_string(&conv_name, system_charset_info,
-			packet, (uint) (arg_end - packet), thd->charset());
+			packet, arg_length, thd->charset());
     table_list.alias= table_list.table_name= conv_name.str;
     packet= arg_end + 1;
 

From 74a077b0b67dbf9dd449972e9a3c954de12e8399 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 22:51:35 +0200
Subject: [PATCH 10/45] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 1810.3987.14
> revision-id: davi.arnaut@sun.com-20100429132816-ictyul6d75itek22
> parent: ramil@mysql.com-20100429044232-f0pkyx8fnpszf142
> committer: Davi Arnaut <Davi.Arnaut@Sun.COM>
> branch nick: 50974-5.0
> timestamp: Thu 2010-04-29 10:28:16 -0300
> message:
>   Bug#50974: Server keeps receiving big (> max_allowed_packet) packets indefinitely.
>
>   The server could be tricked to read packets indefinitely if it
>   received a packet larger than the maximum size of one packet.
>   This problem is aggravated by the fact that it can be triggered
>   before authentication.
>
>   The solution is to no skip big packets for non-authenticated
>   sessions. If a big packet is sent before a session is authen-
>   ticated, a error is returned and the connection is closed.

> ------------------------------------------------------------
> revno: 3363 [merge]
> revision-id: davi.arnaut@sun.com-20100429231819-i3anwzrdasjmezvt
> parent: davi.arnaut@sun.com-20100401131522-895y8uzvv8ag44gs
> parent: davi.arnaut@sun.com-20100429132816-ictyul6d75itek22
> committer: Davi Arnaut <Davi.Arnaut@Sun.COM>
> branch nick: mysql-5.1-bugteam
> timestamp: Thu 2010-04-29 20:18:19 -0300
> message:
>   Manual merge.
> ------------------------------------------------------------
> Use --include-merges or -n0 to see merged revisions.
---
 include/mysql_com.h | 10 ++++++++++
 sql/net_serv.cc     |  4 ++++
 sql/sql_connect.cc  |  7 +++++++
 3 files changed, 21 insertions(+)

diff --git a/include/mysql_com.h b/include/mysql_com.h
index db5a5eb8741..7d3dd3d4f34 100644
--- a/include/mysql_com.h
+++ b/include/mysql_com.h
@@ -277,6 +277,16 @@ typedef struct st_net {
   /** Client library sqlstate buffer. Set along with the error message. */
   char sqlstate[SQLSTATE_LENGTH+1];
   void *extension;
+#if defined(MYSQL_SERVER) && !defined(EMBEDDED_LIBRARY)
+  /*
+    Controls whether a big packet should be skipped.
+
+    Initially set to FALSE by default. Unauthenticated sessions must have
+    this set to FALSE so that the server can't be tricked to read packets
+    indefinitely.
+  */
+  my_bool skip_big_packet;
+#endif
 } NET;
 
 
diff --git a/sql/net_serv.cc b/sql/net_serv.cc
index 73892f31ccf..15c0c581108 100644
--- a/sql/net_serv.cc
+++ b/sql/net_serv.cc
@@ -136,6 +136,9 @@ my_bool my_net_init(NET *net, Vio* vio)
 #else
   net->query_cache_query= 0;
 #endif
+#if defined(MYSQL_SERVER) && !defined(EMBEDDED_LIBRARY)
+  net->skip_big_packet= FALSE;
+#endif
 
   if (vio != 0)					/* If real connection */
   {
@@ -949,6 +952,7 @@ my_real_read(NET *net, size_t *complen)
 	  {
 #if defined(MYSQL_SERVER) && !defined(NO_ALARM)
 	    if (!net->compress &&
+                net->skip_big_packet &&
 		!my_net_skip_rest(net, (uint32) len, &alarmed, &alarm_buff))
 	      net->error= 3;		/* Successfully skiped packet */
 #endif
diff --git a/sql/sql_connect.cc b/sql/sql_connect.cc
index 16f11fe22c4..2039c7f7449 100644
--- a/sql/sql_connect.cc
+++ b/sql/sql_connect.cc
@@ -471,6 +471,13 @@ check_user(THD *thd, enum enum_server_command command,
       }
       my_ok(thd);
       thd->password= test(passwd_len);          // remember for error messages 
+      /*
+        Allow the network layer to skip big packets. Although a malicious
+        authenticated session might use this to trick the server to read
+        big packets indefinitely, this is a previously established behavior
+        that needs to be preserved as to not break backwards compatibility.
+      */
+      thd->net.skip_big_packet= TRUE;
       /* Ready to handle queries */
       DBUG_RETURN(0);
     }

From dacd3e4a77bb4015ca0e2fb55088dbb852f6bd15 Mon Sep 17 00:00:00 2001
From: MySQL Build Team <build@mysql.com>
Date: Tue, 22 Jun 2010 22:53:01 +0200
Subject: [PATCH 11/45] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 3351.41.1
> revision-id: alexey.kopytov@sun.com-20100430111048-jdls6ofn4kkmpt09
> parent: sergey.glukhov@sun.com-20100329134249-03wyhzp5k92dzhcb
> committer: Alexey Kopytov <Alexey.Kopytov@Sun.com>
> branch nick: my51-bug48419
> timestamp: Fri 2010-04-30 15:10:48 +0400
> message:
>   Bug #48419: another explain crash..
>
>   WHERE predicates containing references to empty tables in a
>   subquery were handled incorrectly by the optimizer when
>   executing EXPLAIN. As a result, the optimizer could try to
>   evaluate such predicates rather than just stop with
>   "Impossible WHERE noticed after reading const tables" as
>   it would do in a non-subquery case. This led to valgrind
>   errors and crashes.
>
>   Fixed the code checking the above condition so that subqueries
>   are not excluded and hence are handled in the same way as top
>   level SELECTs.
---
 mysql-test/r/explain.result | 12 ++++++++++++
 mysql-test/r/ps.result      | 12 ++++++------
 mysql-test/t/explain.test   | 15 +++++++++++++++
 sql/sql_select.cc           |  3 +--
 4 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/mysql-test/r/explain.result b/mysql-test/r/explain.result
index b8db8b53e06..8f2d704b312 100644
--- a/mysql-test/r/explain.result
+++ b/mysql-test/r/explain.result
@@ -226,4 +226,16 @@ Warnings:
 Note	1276	Field or reference 'test.t1.c' of SELECT #2 was resolved in SELECT #1
 Note	1003	select (select 1 from `test`.`t2` where (`test`.`t2`.`d` = NULL)) AS `(SELECT 1 FROM t2 WHERE d = c)` from `test`.`t1`
 DROP TABLE t1, t2;
+#
+# Bug #48419: another explain crash..
+#
+CREATE TABLE t1 (a INT);
+CREATE TABLE t2 (b BLOB, KEY b(b(100)));
+INSERT INTO t2 VALUES ('1'), ('2'), ('3');
+FLUSH TABLES;
+EXPLAIN SELECT 1 FROM t1 WHERE a = (SELECT 1 FROM t1 t JOIN t2 WHERE b <= 1 AND t.a);
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+2	SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+DROP TABLE t1, t2;
 End of 5.1 tests.
diff --git a/mysql-test/r/ps.result b/mysql-test/r/ps.result
index cf08d763e5c..84b9cdf930c 100644
--- a/mysql-test/r/ps.result
+++ b/mysql-test/r/ps.result
@@ -155,24 +155,24 @@ execute stmt1 ;
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	PRIMARY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 6	DERIVED	NULL	NULL	NULL	NULL	NULL	NULL	NULL	no matching row in const table
-5	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
-4	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
+5	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+4	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 3	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 2	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 execute stmt1 ;
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	PRIMARY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 6	DERIVED	NULL	NULL	NULL	NULL	NULL	NULL	NULL	no matching row in const table
-5	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
-4	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
+5	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+4	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 3	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 2	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 explain SELECT (SELECT SUM(c1 + c12 + 0.0) FROM t2 where (t1.c2 - 0e-3) = t2.c2 GROUP BY t1.c15 LIMIT 1) as scalar_s, exists (select 1.0e+0 from t2 where t2.c3 * 9.0000000000 = t1.c4) as exists_s, c5 * 4 in (select c6 + 0.3e+1 from t2) as in_s, (c7 - 4, c8 - 4) in (select c9 + 4.0, c10 + 40e-1 from t2) as in_row_s FROM t1, (select c25 x, c32 y from t2) tt WHERE x * 1 = c25;
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	PRIMARY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 6	DERIVED	NULL	NULL	NULL	NULL	NULL	NULL	NULL	no matching row in const table
-5	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
-4	DEPENDENT SUBQUERY	t2	system	NULL	NULL	NULL	NULL	0	const row not found
+5	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+4	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 3	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 2	DEPENDENT SUBQUERY	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
 deallocate prepare stmt1;
diff --git a/mysql-test/t/explain.test b/mysql-test/t/explain.test
index 3c2f7bbbe96..ba6be72dbdc 100644
--- a/mysql-test/t/explain.test
+++ b/mysql-test/t/explain.test
@@ -198,4 +198,19 @@ INSERT INTO t2 VALUES (NULL), (0);
 EXPLAIN EXTENDED SELECT (SELECT 1 FROM t2 WHERE d = c) FROM t1;
 DROP TABLE t1, t2;
 
+
+--echo #
+--echo # Bug #48419: another explain crash..
+--echo #
+
+CREATE TABLE t1 (a INT);
+CREATE TABLE t2 (b BLOB, KEY b(b(100)));
+INSERT INTO t2 VALUES ('1'), ('2'), ('3');
+
+FLUSH TABLES;
+
+EXPLAIN SELECT 1 FROM t1 WHERE a = (SELECT 1 FROM t1 t JOIN t2 WHERE b <= 1 AND t.a);
+
+DROP TABLE t1, t2;
+
 --echo End of 5.1 tests.
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index a426f4b68a1..291432c2bb6 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -1107,8 +1107,7 @@ JOIN::optimize()
   }
 
   if (conds && const_table_map != found_const_table_map &&
-      (select_options & SELECT_DESCRIBE) &&
-      select_lex->master_unit() == &thd->lex->unit) // upper level SELECT
+      (select_options & SELECT_DESCRIBE))
   {
     conds=new Item_int((longlong) 0,1);	// Always false
   }

From d72f61396b0883cd0cc624a33cdfdb9079a070fd Mon Sep 17 00:00:00 2001
From: sunanda <sunanda.menon@sun.com>
Date: Wed, 23 Jun 2010 12:03:22 +0200
Subject: [PATCH 12/45] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 3367 [merge]
> revision-id: joro@sun.com-20100504140328-srxf3c088j2twnq6
> parent: kristofer.pettersson@sun.com-20100503172109-f9hracq5pqsaomb1
> parent: joro@sun.com-20100503151651-nakknn8amrapmdp7
> committer: Georgi Kodinov <joro@sun.com>
> branch nick: B53371-5.1-bugteam
> timestamp: Tue 2010-05-04 17:03:28 +0300
> message:
>   Bug #53371: COM_FIELD_LIST can be abused to bypass table level grants.
>
>   This is the 5.1 merge and extension of the fix.
>   The server was happily accepting paths in table name in all places a table
>   name is accepted (e.g. a SELECT). This allowed all users that have some
>   privilege over some database to read all tables in all databases in all
>   mysql server instances that the server file system has access to.
>   Fixed by :
>   1. making sure no path elements are allowed in quoted table name when
>   constructing the path (note that the path symbols are still valid in table names
>   when they're properly escaped by the server).
>   2. checking the #mysql50# prefixed names the same way they're checked for
>   path elements in mysql-5.0.
> ------------------------------------------------------------
> Use --include-merges or -n0 to see merged revisions.
---
 mysql-test/r/grant.result | 16 ++++++++++++++
 mysql-test/t/grant.test   | 25 ++++++++++++++++++++++
 sql/mysql_priv.h          |  2 +-
 sql/partition_info.cc     |  4 ++--
 sql/sql_parse.cc          |  9 +++++++-
 sql/sql_table.cc          | 14 ++++++++++++
 sql/sql_yacc.yy           |  2 +-
 sql/table.cc              | 29 ++++++++++++++++++++++---
 tests/mysql_client_test.c | 45 +++++++++++++++++++++++++++++++++++++++
 9 files changed, 138 insertions(+), 8 deletions(-)

diff --git a/mysql-test/r/grant.result b/mysql-test/r/grant.result
index 92beccd2a9e..6831ef6183d 100644
--- a/mysql-test/r/grant.result
+++ b/mysql-test/r/grant.result
@@ -1413,3 +1413,19 @@ DROP USER 'user1';
 DROP USER 'user1'@'localhost';
 DROP USER 'user2';
 DROP DATABASE db1;
+CREATE DATABASE db1;
+CREATE DATABASE db2;
+GRANT SELECT ON db1.* to 'testbug'@localhost;
+USE db2;
+CREATE TABLE t1 (a INT);
+USE test;
+SELECT * FROM `../db2/tb2`;
+ERROR 42S02: Table 'db1.../db2/tb2' doesn't exist
+SELECT * FROM `../db2`.tb2;
+ERROR 42000: SELECT command denied to user 'testbug'@'localhost' for table 'tb2'
+SELECT * FROM `#mysql50#/../db2/tb2`;
+ERROR 42S02: Table 'db1.#mysql50#/../db2/tb2' doesn't exist
+DROP USER 'testbug'@localhost;
+DROP TABLE db2.t1;
+DROP DATABASE db1;
+DROP DATABASE db2;
diff --git a/mysql-test/t/grant.test b/mysql-test/t/grant.test
index bcd393bd6ab..cb8d3c63be8 100644
--- a/mysql-test/t/grant.test
+++ b/mysql-test/t/grant.test
@@ -1525,5 +1525,30 @@ DROP USER 'user1'@'localhost';
 DROP USER 'user2';
 DROP DATABASE db1;
 
+
+#
+# Bug #53371: COM_FIELD_LIST can be abused to bypass table level grants.
+#
+
+CREATE DATABASE db1;
+CREATE DATABASE db2;
+GRANT SELECT ON db1.* to 'testbug'@localhost;
+USE db2;
+CREATE TABLE t1 (a INT);
+USE test;
+connect (con1,localhost,testbug,,db1);
+--error ER_NO_SUCH_TABLE
+SELECT * FROM `../db2/tb2`;
+--error ER_TABLEACCESS_DENIED_ERROR
+SELECT * FROM `../db2`.tb2;
+--error ER_NO_SUCH_TABLE
+SELECT * FROM `#mysql50#/../db2/tb2`;
+connection default;
+disconnect con1;
+DROP USER 'testbug'@localhost;
+DROP TABLE db2.t1;
+DROP DATABASE db1;
+DROP DATABASE db2;
+
 # Wait till we reached the initial number of concurrent sessions
 --source include/wait_until_count_sessions.inc
diff --git a/sql/mysql_priv.h b/sql/mysql_priv.h
index 56175d069c5..3ecbef4d456 100644
--- a/sql/mysql_priv.h
+++ b/sql/mysql_priv.h
@@ -2263,7 +2263,7 @@ void update_create_info_from_table(HA_CREATE_INFO *info, TABLE *form);
 int rename_file_ext(const char * from,const char * to,const char * ext);
 bool check_db_name(LEX_STRING *db);
 bool check_column_name(const char *name);
-bool check_table_name(const char *name, uint length);
+bool check_table_name(const char *name, uint length, bool check_for_path_chars);
 char *get_field(MEM_ROOT *mem, Field *field);
 bool get_field(MEM_ROOT *mem, Field *field, class String *res);
 int wild_case_compare(CHARSET_INFO *cs, const char *str,const char *wildstr);
diff --git a/sql/partition_info.cc b/sql/partition_info.cc
index ba9ea0e876e..6e2f7dfad26 100644
--- a/sql/partition_info.cc
+++ b/sql/partition_info.cc
@@ -972,7 +972,7 @@ bool partition_info::check_partition_info(THD *thd, handlerton **eng_type,
           part_elem->engine_type= default_engine_type;
         }
         if (check_table_name(part_elem->partition_name,
-                             strlen(part_elem->partition_name)))
+                             strlen(part_elem->partition_name), FALSE))
         {
           my_error(ER_WRONG_PARTITION_NAME, MYF(0));
           goto end;
@@ -990,7 +990,7 @@ bool partition_info::check_partition_info(THD *thd, handlerton **eng_type,
         {
           sub_elem= sub_it++;
           if (check_table_name(sub_elem->partition_name,
-                               strlen(sub_elem->partition_name)))
+                               strlen(sub_elem->partition_name), FALSE))
           {
             my_error(ER_WRONG_PARTITION_NAME, MYF(0));
             goto end;
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 11481933c8a..93d80164ffb 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -1310,6 +1310,13 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
     }
     thd->convert_string(&conv_name, system_charset_info,
 			packet, arg_length, thd->charset());
+    if (check_table_name(conv_name.str, conv_name.length, FALSE))
+    {
+      /* this is OK due to convert_string() null-terminating the string */
+      my_error(ER_WRONG_TABLE_NAME, MYF(0), conv_name.str);
+      break;
+    }
+
     table_list.alias= table_list.table_name= conv_name.str;
     packet= arg_end + 1;
 
@@ -6233,7 +6240,7 @@ TABLE_LIST *st_select_lex::add_table_to_list(THD *thd,
     DBUG_RETURN(0);				// End of memory
   alias_str= alias ? alias->str : table->table.str;
   if (!test(table_options & TL_OPTION_ALIAS) && 
-      check_table_name(table->table.str, table->table.length))
+      check_table_name(table->table.str, table->table.length, FALSE))
   {
     my_error(ER_WRONG_TABLE_NAME, MYF(0), table->table.str);
     DBUG_RETURN(0);
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index ad72cab664e..84e6c721d72 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -435,7 +435,21 @@ uint tablename_to_filename(const char *from, char *to, uint to_length)
   DBUG_PRINT("enter", ("from '%s'", from));
 
   if ((length= check_n_cut_mysql50_prefix(from, to, to_length)))
+  {
+    /*
+      Check if the name supplied is a valid mysql 5.0 name and 
+      make the name a zero length string if it's not.
+      Note that just returning zero length is not enough : 
+      a lot of places don't check the return value and expect 
+      a zero terminated string.
+    */  
+    if (check_table_name(to, length, TRUE))
+    {
+      to[0]= 0;
+      length= 0;
+    }
     DBUG_RETURN(length);
+  }
   length= strconvert(system_charset_info, from,
                      &my_charset_filename, to, to_length, &errors);
   if (check_if_legal_tablename(to) &&
diff --git a/sql/sql_yacc.yy b/sql/sql_yacc.yy
index 4f43ab8bebd..f815da006b1 100644
--- a/sql/sql_yacc.yy
+++ b/sql/sql_yacc.yy
@@ -6133,7 +6133,7 @@ alter_list_item:
             {
               MYSQL_YYABORT;
             }
-            if (check_table_name($3->table.str,$3->table.length) ||
+            if (check_table_name($3->table.str,$3->table.length, FALSE) ||
                 ($3->db.str && check_db_name(&$3->db)))
             {
               my_error(ER_WRONG_TABLE_NAME, MYF(0), $3->table.str);
diff --git a/sql/table.cc b/sql/table.cc
index a4e2c59fb87..04d7b3a8d0a 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -494,6 +494,26 @@ inline bool is_system_table_name(const char *name, uint length)
 }
 
 
+/**
+  Check if a string contains path elements
+*/  
+
+static inline bool has_disabled_path_chars(const char *str)
+{
+  for (; *str; str++)
+    switch (*str)
+    {
+      case FN_EXTCHAR:
+      case '/':
+      case '\\':
+      case '~':
+      case '@':
+        return TRUE;
+    }
+  return FALSE;
+}
+
+
 /*
   Read table definition from a binary / text based .frm file
   
@@ -549,7 +569,8 @@ int open_table_def(THD *thd, TABLE_SHARE *share, uint db_flags)
         This kind of tables must have been opened only by the
         my_open() above.
     */
-    if (strchr(share->table_name.str, '@') ||
+    if (has_disabled_path_chars(share->table_name.str) ||
+        has_disabled_path_chars(share->db.str) ||
         !strncmp(share->db.str, MYSQL50_TABLE_NAME_PREFIX,
                  MYSQL50_TABLE_NAME_PREFIX_LENGTH) ||
         !strncmp(share->table_name.str, MYSQL50_TABLE_NAME_PREFIX,
@@ -2711,7 +2732,6 @@ bool check_db_name(LEX_STRING *org_name)
             (name_length > NAME_CHAR_LEN)); /* purecov: inspected */
 }
 
-
 /*
   Allow anything as a table name, as long as it doesn't contain an
   ' ' at the end
@@ -2719,7 +2739,7 @@ bool check_db_name(LEX_STRING *org_name)
 */
 
 
-bool check_table_name(const char *name, uint length)
+bool check_table_name(const char *name, uint length, bool check_for_path_chars)
 {
   uint name_length= 0;  // name length in symbols
   const char *end= name+length;
@@ -2746,6 +2766,9 @@ bool check_table_name(const char *name, uint length)
         continue;
       }
     }
+    if (check_for_path_chars &&
+        (*name == '/' || *name == '\\' || *name == '~' || *name == FN_EXTCHAR))
+      return 1;
 #endif
     name++;
     name_length++;
diff --git a/tests/mysql_client_test.c b/tests/mysql_client_test.c
index f65e549fd96..b99461ecd06 100644
--- a/tests/mysql_client_test.c
+++ b/tests/mysql_client_test.c
@@ -18049,6 +18049,50 @@ static void test_bug44495()
   DBUG_VOID_RETURN;
 }
 
+static void test_bug53371()
+{
+  int rc;
+  MYSQL_RES *result;
+
+  myheader("test_bug53371");
+
+  rc= mysql_query(mysql, "DROP TABLE IF EXISTS t1");
+  myquery(rc);
+  rc= mysql_query(mysql, "DROP DATABASE IF EXISTS bug53371");
+  myquery(rc);
+  rc= mysql_query(mysql, "DROP USER 'testbug'@localhost");
+
+  rc= mysql_query(mysql, "CREATE TABLE t1 (a INT)");
+  myquery(rc);
+  rc= mysql_query(mysql, "CREATE DATABASE bug53371");
+  myquery(rc);
+  rc= mysql_query(mysql, "GRANT SELECT ON bug53371.* to 'testbug'@localhost");
+  myquery(rc);
+
+  rc= mysql_change_user(mysql, "testbug", NULL, "bug53371");
+  myquery(rc);
+
+  rc= mysql_query(mysql, "SHOW COLUMNS FROM client_test_db.t1");
+  DIE_UNLESS(rc);
+  DIE_UNLESS(mysql_errno(mysql) == 1142);
+
+  result= mysql_list_fields(mysql, "../client_test_db/t1", NULL);
+  DIE_IF(result);
+
+  result= mysql_list_fields(mysql, "#mysql50#/../client_test_db/t1", NULL);
+  DIE_IF(result);
+
+  rc= mysql_change_user(mysql, opt_user, opt_password, current_db);
+  myquery(rc);
+  rc= mysql_query(mysql, "DROP TABLE t1");
+  myquery(rc);
+  rc= mysql_query(mysql, "DROP DATABASE bug53371");
+  myquery(rc);
+  rc= mysql_query(mysql, "DROP USER 'testbug'@localhost");
+  myquery(rc);
+}
+
+
 /*
   Read and parse arguments and MySQL options from my.cnf
 */
@@ -18358,6 +18402,7 @@ static struct my_tests_st my_tests[]= {
   { "test_bug30472", test_bug30472 },
   { "test_bug20023", test_bug20023 },
   { "test_bug45010", test_bug45010 },
+  { "test_bug53371", test_bug53371 },
   { "test_bug31418", test_bug31418 },
   { "test_bug31669", test_bug31669 },
   { "test_bug28386", test_bug28386 },

From b722f546b6e4f9f4819910535aae37cb48194823 Mon Sep 17 00:00:00 2001
From: sunanda <sunanda.menon@sun.com>
Date: Wed, 23 Jun 2010 12:14:23 +0200
Subject: [PATCH 13/45] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 3386
> revision-id: sergey.glukhov@sun.com-20100518082821-yajhvbv1ghmlpu1n
> parent: aelkin@mysql.com-20100516170332-x8priwrdjwolc065
> committer: Sergey Glukhov <Sergey.Glukhov@sun.com>
> branch nick: mysql-5.1-bugteam
> timestamp: Tue 2010-05-18 13:28:21 +0500
> message:
>   Bug#48729 SELECT ... FROM INFORMATION_SCHEMA.ROUTINES causes memory to grow
>   Analysis showed that in case of accessing I_S table
>   ROUTINES we perform unnecessary allocations
>   with get_field() function for every processed row that
>   in their turn causes significant memory growth.
>   the fix is to avoid use of get_field().
---
 sql/sql_show.cc | 74 ++++++++++++++++++++++++-------------------------
 1 file changed, 37 insertions(+), 37 deletions(-)

diff --git a/sql/sql_show.cc b/sql/sql_show.cc
index cb60027842d..b4881125b14 100644
--- a/sql/sql_show.cc
+++ b/sql/sql_show.cc
@@ -4180,24 +4180,37 @@ int fill_schema_coll_charset_app(THD *thd, TABLE_LIST *tables, COND *cond)
 }
 
 
+static inline void copy_field_as_string(Field *to_field, Field *from_field)
+{
+  char buff[MAX_FIELD_WIDTH];
+  String tmp_str(buff, sizeof(buff), system_charset_info);
+  from_field->val_str(&tmp_str);
+  to_field->store(tmp_str.ptr(), tmp_str.length(), system_charset_info);
+}
+
+
 bool store_schema_proc(THD *thd, TABLE *table, TABLE *proc_table,
                        const char *wild, bool full_access, const char *sp_user)
 {
-  String tmp_string;
-  String sp_db, sp_name, definer;
   MYSQL_TIME time;
   LEX *lex= thd->lex;
   CHARSET_INFO *cs= system_charset_info;
-  get_field(thd->mem_root, proc_table->field[0], &sp_db);
-  get_field(thd->mem_root, proc_table->field[1], &sp_name);
-  get_field(thd->mem_root, proc_table->field[11], &definer);
+  char sp_db_buff[NAME_LEN + 1], sp_name_buff[NAME_LEN + 1],
+    definer_buff[USERNAME_LENGTH + HOSTNAME_LENGTH + 2];
+  String sp_db(sp_db_buff, sizeof(sp_db_buff), cs);
+  String sp_name(sp_name_buff, sizeof(sp_name_buff), cs);
+  String definer(definer_buff, sizeof(definer_buff), cs);
+
+  proc_table->field[0]->val_str(&sp_db);
+  proc_table->field[1]->val_str(&sp_name);
+  proc_table->field[11]->val_str(&definer);
+
   if (!full_access)
-    full_access= !strcmp(sp_user, definer.ptr());
-  if (!full_access && check_some_routine_access(thd, sp_db.ptr(),
-                                                sp_name.ptr(),
-                                                proc_table->field[2]->
-                                                val_int() ==
-                                                TYPE_ENUM_PROCEDURE))
+    full_access= !strcmp(sp_user, definer.c_ptr_safe());
+  if (!full_access &&
+      check_some_routine_access(thd, sp_db.c_ptr_safe(), sp_name.c_ptr_safe(),
+                                proc_table->field[2]->val_int() ==
+                                TYPE_ENUM_PROCEDURE))
     return 0;
 
   if ((lex->sql_command == SQLCOM_SHOW_STATUS_PROC &&
@@ -4207,55 +4220,42 @@ bool store_schema_proc(THD *thd, TABLE *table, TABLE *proc_table,
       (sql_command_flags[lex->sql_command] & CF_STATUS_COMMAND) == 0)
   {
     restore_record(table, s->default_values);
-    if (!wild || !wild[0] || !wild_compare(sp_name.ptr(), wild, 0))
+    if (!wild || !wild[0] || !wild_compare(sp_name.c_ptr_safe(), wild, 0))
     {
       int enum_idx= (int) proc_table->field[5]->val_int();
       table->field[3]->store(sp_name.ptr(), sp_name.length(), cs);
-      get_field(thd->mem_root, proc_table->field[3], &tmp_string);
-      table->field[0]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[0], proc_table->field[3]);
       table->field[2]->store(sp_db.ptr(), sp_db.length(), cs);
-      get_field(thd->mem_root, proc_table->field[2], &tmp_string);
-      table->field[4]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[4], proc_table->field[2]);
       if (proc_table->field[2]->val_int() == TYPE_ENUM_FUNCTION)
       {
-        get_field(thd->mem_root, proc_table->field[9], &tmp_string);
-        table->field[5]->store(tmp_string.ptr(), tmp_string.length(), cs);
+        copy_field_as_string(table->field[5], proc_table->field[9]);
         table->field[5]->set_notnull();
       }
       if (full_access)
       {
-        get_field(thd->mem_root, proc_table->field[19], &tmp_string);
-        table->field[7]->store(tmp_string.ptr(), tmp_string.length(), cs);
+        copy_field_as_string(table->field[7], proc_table->field[19]);
         table->field[7]->set_notnull();
       }
       table->field[6]->store(STRING_WITH_LEN("SQL"), cs);
       table->field[10]->store(STRING_WITH_LEN("SQL"), cs);
-      get_field(thd->mem_root, proc_table->field[6], &tmp_string);
-      table->field[11]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[11], proc_table->field[6]);
       table->field[12]->store(sp_data_access_name[enum_idx].str, 
                               sp_data_access_name[enum_idx].length , cs);
-      get_field(thd->mem_root, proc_table->field[7], &tmp_string);
-      table->field[14]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[14], proc_table->field[7]);
+
       bzero((char *)&time, sizeof(time));
       ((Field_timestamp *) proc_table->field[12])->get_time(&time);
       table->field[15]->store_time(&time, MYSQL_TIMESTAMP_DATETIME);
       bzero((char *)&time, sizeof(time));
       ((Field_timestamp *) proc_table->field[13])->get_time(&time);
       table->field[16]->store_time(&time, MYSQL_TIMESTAMP_DATETIME);
-      get_field(thd->mem_root, proc_table->field[14], &tmp_string);
-      table->field[17]->store(tmp_string.ptr(), tmp_string.length(), cs);
-      get_field(thd->mem_root, proc_table->field[15], &tmp_string);
-      table->field[18]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[17], proc_table->field[14]);
+      copy_field_as_string(table->field[18], proc_table->field[15]);
       table->field[19]->store(definer.ptr(), definer.length(), cs);
-
-      get_field(thd->mem_root, proc_table->field[16], &tmp_string);
-      table->field[20]->store(tmp_string.ptr(), tmp_string.length(), cs);
-
-      get_field(thd->mem_root, proc_table->field[17], &tmp_string);
-      table->field[21]->store(tmp_string.ptr(), tmp_string.length(), cs);
-
-      get_field(thd->mem_root, proc_table->field[18], &tmp_string);
-      table->field[22]->store(tmp_string.ptr(), tmp_string.length(), cs);
+      copy_field_as_string(table->field[20], proc_table->field[16]);
+      copy_field_as_string(table->field[21], proc_table->field[17]);
+      copy_field_as_string(table->field[22], proc_table->field[18]);
 
       return schema_table_store_record(thd, table);
     }

From 120717da681f027fb9c55597fa2753645d90631a Mon Sep 17 00:00:00 2001
From: sunanda <sunanda.menon@sun.com>
Date: Wed, 23 Jun 2010 12:22:05 +0200
Subject: [PATCH 14/45] Backport into build-201006221614-5.1.46sp1

> ------------------------------------------------------------
> revno: 3392.1.1
> revision-id: gshchepa@mysql.com-20100521184732-0jvpzinv0uwyvr2d
> parent: sven.sandberg@sun.com-20100520153801-yyhujm1qqa4eyfn0
> committer: Gleb Shchepa <gshchepa@mysql.com>
> branch nick: 53804-5.1
> timestamp: Fri 2010-05-21 22:47:32 +0400
> message:
>   Bug #53804: serious flaws in the alter database .. upgrade
>               data directory name command
>
>   The check_db_name function has been modified to validate tails of
>   #mysql50#-prefixed database names for compliance with MySQL 5.0
>   database name encoding rules (the check_table_name function call
>   has been reused).
---
 mysql-test/r/renamedb.result |  2 +-
 mysql-test/r/upgrade.result  | 28 ++++++++++++++++++++++++++++
 mysql-test/t/renamedb.test   |  2 +-
 mysql-test/t/upgrade.test    | 34 ++++++++++++++++++++++++++++++++++
 sql/mysql_priv.h             |  1 +
 sql/sql_table.cc             | 23 ++++++++++++++++++++---
 sql/table.cc                 | 34 ++++++++++------------------------
 7 files changed, 95 insertions(+), 29 deletions(-)

diff --git a/mysql-test/r/renamedb.result b/mysql-test/r/renamedb.result
index ff8f89592fc..e77aca0d0b7 100644
--- a/mysql-test/r/renamedb.result
+++ b/mysql-test/r/renamedb.result
@@ -7,6 +7,6 @@ ERROR HY000: Incorrect usage of ALTER DATABASE UPGRADE DATA DIRECTORY NAME and n
 ALTER DATABASE `#mysql51#not-yet` UPGRADE DATA DIRECTORY NAME;
 ERROR HY000: Incorrect usage of ALTER DATABASE UPGRADE DATA DIRECTORY NAME and name
 ALTER DATABASE `#mysql50#` UPGRADE DATA DIRECTORY NAME;
-ERROR HY000: Incorrect usage of ALTER DATABASE UPGRADE DATA DIRECTORY NAME and name
+ERROR 42000: Incorrect database name '#mysql50#'
 ALTER DATABASE `#mysql50#upgrade-me` UPGRADE DATA DIRECTORY NAME;
 ERROR 42000: Unknown database '#mysql50#upgrade-me'
diff --git a/mysql-test/r/upgrade.result b/mysql-test/r/upgrade.result
index 034242079b1..da2f55b5bb1 100644
--- a/mysql-test/r/upgrade.result
+++ b/mysql-test/r/upgrade.result
@@ -112,3 +112,31 @@ select * from `a-b-c`.v1;
 f1
 drop database `a-b-c`;
 use test;
+# End of 5.0 tests
+#
+# Bug #53804: serious flaws in the alter database .. upgrade data
+#             directory name command
+#
+ALTER DATABASE `#mysql50#:` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Unknown database '#mysql50#:'
+ALTER DATABASE `#mysql50#.` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#.'
+ALTER DATABASE `#mysql50#../` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#../'
+ALTER DATABASE `#mysql50#../..` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#../..'
+ALTER DATABASE `#mysql50#../../` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#../../'
+ALTER DATABASE `#mysql50#./blablabla` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#./blablabla'
+ALTER DATABASE `#mysql50#../blablabla` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#../blablabla'
+ALTER DATABASE `#mysql50#/` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#/'
+ALTER DATABASE `#mysql50#/.` UPGRADE DATA DIRECTORY NAME;
+ERROR 42000: Incorrect database name '#mysql50#/.'
+USE `#mysql50#.`;
+ERROR 42000: Incorrect database name '#mysql50#.'
+USE `#mysql50#../blablabla`;
+ERROR 42000: Incorrect database name '#mysql50#../blablabla'
+# End of 5.1 tests
diff --git a/mysql-test/t/renamedb.test b/mysql-test/t/renamedb.test
index 84315090b7a..71d0c127058 100644
--- a/mysql-test/t/renamedb.test
+++ b/mysql-test/t/renamedb.test
@@ -44,7 +44,7 @@ ALTER DATABASE `#mysql41#not-supported` UPGRADE DATA DIRECTORY NAME;
 --error ER_WRONG_USAGE
 ALTER DATABASE `#mysql51#not-yet` UPGRADE DATA DIRECTORY NAME;
 
---error ER_WRONG_USAGE
+--error ER_WRONG_DB_NAME
 ALTER DATABASE `#mysql50#` UPGRADE DATA DIRECTORY NAME;
 
 --error ER_BAD_DB_ERROR
diff --git a/mysql-test/t/upgrade.test b/mysql-test/t/upgrade.test
index e390e8a1253..a7b9a1531ff 100644
--- a/mysql-test/t/upgrade.test
+++ b/mysql-test/t/upgrade.test
@@ -137,3 +137,37 @@ select * from `a-b-c`.v1;
 --enable_ps_protocol
 drop database `a-b-c`;
 use test;
+
+--echo # End of 5.0 tests
+
+--echo #
+--echo # Bug #53804: serious flaws in the alter database .. upgrade data
+--echo #             directory name command
+--echo #
+
+--error ER_BAD_DB_ERROR
+ALTER DATABASE `#mysql50#:` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#.` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#../` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#../..` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#../../` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#./blablabla` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#../blablabla` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#/` UPGRADE DATA DIRECTORY NAME;
+--error ER_WRONG_DB_NAME
+ALTER DATABASE `#mysql50#/.` UPGRADE DATA DIRECTORY NAME;
+
+--error ER_WRONG_DB_NAME
+USE `#mysql50#.`;
+--error ER_WRONG_DB_NAME
+USE `#mysql50#../blablabla`;
+
+--echo # End of 5.1 tests
+
diff --git a/sql/mysql_priv.h b/sql/mysql_priv.h
index 3ecbef4d456..30f3a1af437 100644
--- a/sql/mysql_priv.h
+++ b/sql/mysql_priv.h
@@ -2287,6 +2287,7 @@ uint explain_filename(THD* thd, const char *from, char *to, uint to_length,
 uint filename_to_tablename(const char *from, char *to, uint to_length);
 uint tablename_to_filename(const char *from, char *to, uint to_length);
 uint check_n_cut_mysql50_prefix(const char *from, char *to, uint to_length);
+bool check_mysql50_prefix(const char *name);
 #endif /* MYSQL_SERVER || INNODB_COMPATIBILITY_HOOKS */
 #ifdef MYSQL_SERVER
 uint build_table_filename(char *buff, size_t bufflen, const char *db,
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index 84e6c721d72..babc025db87 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -391,6 +391,25 @@ uint filename_to_tablename(const char *from, char *to, uint to_length)
 }
 
 
+/**
+  Check if given string begins with "#mysql50#" prefix
+  
+  @param   name          string to check cut 
+  
+  @retval
+    FALSE  no prefix found
+  @retval
+    TRUE   prefix found
+*/
+
+bool check_mysql50_prefix(const char *name)
+{
+  return (name[0] == '#' && 
+         !strncmp(name, MYSQL50_TABLE_NAME_PREFIX,
+                  MYSQL50_TABLE_NAME_PREFIX_LENGTH));
+}
+
+
 /**
   Check if given string begins with "#mysql50#" prefix, cut it if so.
   
@@ -406,9 +425,7 @@ uint filename_to_tablename(const char *from, char *to, uint to_length)
 
 uint check_n_cut_mysql50_prefix(const char *from, char *to, uint to_length)
 {
-  if (from[0] == '#' && 
-      !strncmp(from, MYSQL50_TABLE_NAME_PREFIX,
-               MYSQL50_TABLE_NAME_PREFIX_LENGTH))
+  if (check_mysql50_prefix(from))
     return (uint) (strmake(to, from + MYSQL50_TABLE_NAME_PREFIX_LENGTH,
                            to_length - 1) - to);
   return 0;
diff --git a/sql/table.cc b/sql/table.cc
index 04d7b3a8d0a..23d41760495 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -2701,44 +2701,30 @@ bool check_db_name(LEX_STRING *org_name)
 {
   char *name= org_name->str;
   uint name_length= org_name->length;
+  bool check_for_path_chars;
 
   if (!name_length || name_length > NAME_LEN)
     return 1;
 
+  if ((check_for_path_chars= check_mysql50_prefix(name)))
+  {
+    name+= MYSQL50_TABLE_NAME_PREFIX_LENGTH;
+    name_length-= MYSQL50_TABLE_NAME_PREFIX_LENGTH;
+  }
+
   if (lower_case_table_names && name != any_db)
     my_casedn_str(files_charset_info, name);
 
-#if defined(USE_MB) && defined(USE_MB_IDENT)
-  if (use_mb(system_charset_info))
-  {
-    name_length= 0;
-    bool last_char_is_space= TRUE;
-    char *end= name + org_name->length;
-    while (name < end)
-    {
-      int len;
-      last_char_is_space= my_isspace(system_charset_info, *name);
-      len= my_ismbchar(system_charset_info, name, end);
-      if (!len)
-        len= 1;
-      name+= len;
-      name_length++;
-    }
-    return (last_char_is_space || name_length > NAME_CHAR_LEN);
-  }
-  else
-#endif
-    return ((org_name->str[org_name->length - 1] != ' ') ||
-            (name_length > NAME_CHAR_LEN)); /* purecov: inspected */
+  return check_table_name(name, name_length, check_for_path_chars);
 }
 
+
 /*
   Allow anything as a table name, as long as it doesn't contain an
   ' ' at the end
   returns 1 on error
 */
 
-
 bool check_table_name(const char *name, uint length, bool check_for_path_chars)
 {
   uint name_length= 0;  // name length in symbols
@@ -2766,10 +2752,10 @@ bool check_table_name(const char *name, uint length, bool check_for_path_chars)
         continue;
       }
     }
+#endif
     if (check_for_path_chars &&
         (*name == '/' || *name == '\\' || *name == '~' || *name == FN_EXTCHAR))
       return 1;
-#endif
     name++;
     name_length++;
   }

From dec24a7dd8b6ed6b2d8e92649ffb3b8df3edffdc Mon Sep 17 00:00:00 2001
From: Jimmy Yang <jimmy.yang@oracle.com>
Date: Mon, 28 Jun 2010 19:41:37 -0700
Subject: [PATCH 15/45] Check in fix for bug #53756: "ALTER TABLE ADD PRIMARY
 KEY affects crash recovery"

rb://369 approved by Marko
---
 .../suite/innodb/r/innodb_bug53756.result     | 118 +++++++++++
 .../suite/innodb/t/innodb_bug53756.test       | 184 ++++++++++++++++++
 storage/innobase/dict/dict0load.c             |  27 ++-
 3 files changed, 315 insertions(+), 14 deletions(-)
 create mode 100644 mysql-test/suite/innodb/r/innodb_bug53756.result
 create mode 100644 mysql-test/suite/innodb/t/innodb_bug53756.test

diff --git a/mysql-test/suite/innodb/r/innodb_bug53756.result b/mysql-test/suite/innodb/r/innodb_bug53756.result
new file mode 100644
index 00000000000..67797f9c90f
--- /dev/null
+++ b/mysql-test/suite/innodb/r/innodb_bug53756.result
@@ -0,0 +1,118 @@
+DROP TABLE IF EXISTS bug_53756 ;
+CREATE TABLE bug_53756 (pk INT, c1 INT) ENGINE=InnoDB;
+ALTER TABLE bug_53756 ADD PRIMARY KEY (pk);
+INSERT INTO bug_53756 VALUES(1, 11), (2, 22), (3, 33), (4, 44);
+
+# Select a less restrictive isolation level.
+SET GLOBAL TRANSACTION ISOLATION LEVEL READ COMMITTED;
+SET SESSION TRANSACTION ISOLATION LEVEL READ COMMITTED;
+COMMIT;
+
+# Start a transaction in the default connection for isolation.
+START TRANSACTION;
+SELECT @@tx_isolation;
+@@tx_isolation
+READ-COMMITTED
+SELECT * FROM bug_53756;
+pk	c1
+1	11
+2	22
+3	33
+4	44
+
+# connection con1 deletes row 1
+START TRANSACTION;
+SELECT @@tx_isolation;
+@@tx_isolation
+READ-COMMITTED
+DELETE FROM bug_53756 WHERE pk=1;
+
+# connection con2 deletes row 2
+START TRANSACTION;
+SELECT @@tx_isolation;
+@@tx_isolation
+READ-COMMITTED
+DELETE FROM bug_53756 WHERE pk=2;
+
+# connection con3 updates row 3
+START TRANSACTION;
+SELECT @@tx_isolation;
+@@tx_isolation
+READ-COMMITTED
+UPDATE bug_53756 SET c1=77 WHERE pk=3;
+
+# connection con4 updates row 4
+START TRANSACTION;
+SELECT @@tx_isolation;
+@@tx_isolation
+READ-COMMITTED
+UPDATE bug_53756 SET c1=88 WHERE pk=4;
+
+# connection con5 inserts row 5
+START TRANSACTION;
+SELECT @@tx_isolation;
+@@tx_isolation
+READ-COMMITTED
+INSERT INTO bug_53756 VALUES(5, 55);
+
+# connection con6 inserts row 6
+START TRANSACTION;
+SELECT @@tx_isolation;
+@@tx_isolation
+READ-COMMITTED
+INSERT INTO bug_53756 VALUES(6, 66);
+
+# connection con1 commits.
+COMMIT;
+
+# connection con3 commits.
+COMMIT;
+
+# connection con4 rolls back.
+ROLLBACK;
+
+# connection con6 rolls back.
+ROLLBACK;
+
+# The connections 2 and 5 stay open.
+
+# connection default selects resulting data.
+# Delete of row 1 was committed.
+# Dpdate of row 3 was committed.
+# Due to isolation level read committed, these should be included.
+# All other changes should not be included.
+SELECT * FROM bug_53756;
+pk	c1
+2	22
+3	77
+4	44
+
+# connection default
+#
+# Crash server.
+START TRANSACTION;
+INSERT INTO bug_53756 VALUES (666,666);
+SET SESSION debug="+d,crash_commit_before";
+COMMIT;
+ERROR HY000: Lost connection to MySQL server during query
+
+#
+# disconnect con1, con2, con3, con4, con5, con6.
+#
+# Restart server.
+
+#
+# Select recovered data.
+# Delete of row 1 was committed.
+# Update of row 3 was committed.
+# These should be included.
+# All other changes should not be included.
+# Delete of row 2 and insert of row 5 should be rolled back
+SELECT * FROM bug_53756;
+pk	c1
+2	22
+3	77
+4	44
+
+# Clean up.
+DROP TABLE bug_53756;
diff --git a/mysql-test/suite/innodb/t/innodb_bug53756.test b/mysql-test/suite/innodb/t/innodb_bug53756.test
new file mode 100644
index 00000000000..85a09478486
--- /dev/null
+++ b/mysql-test/suite/innodb/t/innodb_bug53756.test
@@ -0,0 +1,184 @@
+# This is the test case for bug #53756. Alter table operation could
+# leave a deleted record for the temp table (later renamed to the altered
+# table) in the SYS_TABLES secondary index, we should ignore this row and
+# find the first non-deleted row for the specified table_id when load table
+# metadata in the function dict_load_table_on_id() during crash recovery.
+
+#
+# innobackup needs to connect to the server. Not supported in embedded.
+--source include/not_embedded.inc
+#
+# This test case needs to crash the server. Needs a debug server.
+--source include/have_debug.inc
+#
+# Don't test this under valgrind, memory leaks will occur.
+--source include/not_valgrind.inc
+#
+# This test case needs InnoDB.
+--source include/have_innodb.inc
+
+#
+# Precautionary clean up.
+#
+--disable_warnings
+DROP TABLE IF EXISTS bug_53756 ;
+--enable_warnings
+
+#
+# Create test data.
+#
+CREATE TABLE bug_53756 (pk INT, c1 INT) ENGINE=InnoDB;
+ALTER TABLE bug_53756 ADD PRIMARY KEY (pk);
+INSERT INTO bug_53756 VALUES(1, 11), (2, 22), (3, 33), (4, 44);
+
+--echo
+--echo # Select a less restrictive isolation level.
+# Don't use user variables. They won't survive server crash.
+--let $global_isolation= `SELECT @@global.tx_isolation`;
+--let $session_isolation= `SELECT @@session.tx_isolation`;
+SET GLOBAL TRANSACTION ISOLATION LEVEL READ COMMITTED;
+SET SESSION TRANSACTION ISOLATION LEVEL READ COMMITTED;
+COMMIT;
+
+--echo
+--echo # Start a transaction in the default connection for isolation.
+START TRANSACTION;
+SELECT @@tx_isolation;
+SELECT * FROM bug_53756;
+
+--echo
+--echo # connection con1 deletes row 1
+--connect (con1,localhost,root,,)
+START TRANSACTION;
+SELECT @@tx_isolation;
+DELETE FROM bug_53756 WHERE pk=1;
+
+--echo
+--echo # connection con2 deletes row 2
+--connect (con2,localhost,root,,)
+START TRANSACTION;
+SELECT @@tx_isolation;
+DELETE FROM bug_53756 WHERE pk=2;
+
+--echo
+--echo # connection con3 updates row 3
+--connect (con3,localhost,root,,)
+START TRANSACTION;
+SELECT @@tx_isolation;
+UPDATE bug_53756 SET c1=77 WHERE pk=3;
+
+--echo
+--echo # connection con4 updates row 4
+--connect (con4,localhost,root,,)
+START TRANSACTION;
+SELECT @@tx_isolation;
+UPDATE bug_53756 SET c1=88 WHERE pk=4;
+
+--echo
+--echo # connection con5 inserts row 5
+--connect (con5,localhost,root,,)
+START TRANSACTION;
+SELECT @@tx_isolation;
+INSERT INTO bug_53756 VALUES(5, 55);
+
+--echo
+--echo # connection con6 inserts row 6
+--connect (con6,localhost,root,,)
+START TRANSACTION;
+SELECT @@tx_isolation;
+INSERT INTO bug_53756 VALUES(6, 66);
+
+--echo
+--echo # connection con1 commits.
+--connection con1
+COMMIT;
+
+--echo
+--echo # connection con3 commits.
+--connection con3
+COMMIT;
+
+--echo
+--echo # connection con4 rolls back.
+--connection con4
+ROLLBACK;
+
+--echo
+--echo # connection con6 rolls back.
+--connection con6
+ROLLBACK;
+
+--echo
+--echo # The connections 2 and 5 stay open.
+
+--echo
+--echo # connection default selects resulting data.
+--echo # Delete of row 1 was committed.
+--echo # Dpdate of row 3 was committed.
+--echo # Due to isolation level read committed, these should be included.
+--echo # All other changes should not be included.
+--connection default
+SELECT * FROM bug_53756;
+
+--echo
+--echo # connection default
+--connection default
+--echo #
+--echo # Crash server.
+#
+# Write file to make mysql-test-run.pl expect the "crash", but don't start
+# it until it's told to
+--exec echo "wait" > $MYSQLTEST_VARDIR/tmp/mysqld.1.expect
+#
+START TRANSACTION;
+INSERT INTO bug_53756 VALUES (666,666);
+#
+# Request a crash on next execution of commit.
+SET SESSION debug="+d,crash_commit_before";
+#
+# Execute the statement that causes the crash.
+--error 2013
+COMMIT;
+--echo
+--echo #
+--echo # disconnect con1, con2, con3, con4, con5, con6.
+--disconnect con1
+--disconnect con2
+--disconnect con3
+--disconnect con4
+--disconnect con5
+--disconnect con6
+--echo #
+--echo # Restart server.
+#
+# Write file to make mysql-test-run.pl start up the server again
+--exec echo "restart" > $MYSQLTEST_VARDIR/tmp/mysqld.1.expect
+#
+# Turn on reconnect
+--enable_reconnect
+#
+# Call script that will poll the server waiting for it to be back online again
+--source include/wait_until_connected_again.inc
+#
+# Turn off reconnect again
+--disable_reconnect
+--echo
+
+--echo #
+--echo # Select recovered data.
+--echo # Delete of row 1 was committed.
+--echo # Update of row 3 was committed.
+--echo # These should be included.
+--echo # All other changes should not be included.
+--echo # Delete of row 2 and insert of row 5 should be rolled back
+SELECT * FROM bug_53756;
+
+--echo
+--echo # Clean up.
+DROP TABLE bug_53756;
+
+--disable_query_log
+eval SET GLOBAL tx_isolation= '$global_isolation';
+eval SET SESSION tx_isolation= '$session_isolation';
+--enable_query_log
+
diff --git a/storage/innobase/dict/dict0load.c b/storage/innobase/dict/dict0load.c
index 65f1c9536bd..d5e7600f4d0 100644
--- a/storage/innobase/dict/dict0load.c
+++ b/storage/innobase/dict/dict0load.c
@@ -927,6 +927,8 @@ dict_load_table_on_id(
 
 	ut_ad(mutex_own(&(dict_sys->mutex)));
 
+	table = NULL;
+
 	/* NOTE that the operation of this function is protected by
 	the dictionary mutex, and therefore no deadlocks can occur
 	with other dictionary operations. */
@@ -953,15 +955,17 @@ dict_load_table_on_id(
 				  BTR_SEARCH_LEAF, &pcur, &mtr);
 	rec = btr_pcur_get_rec(&pcur);
 
-	if (!btr_pcur_is_on_user_rec(&pcur, &mtr)
-	    || rec_get_deleted_flag(rec, 0)) {
+	if (!btr_pcur_is_on_user_rec(&pcur, &mtr)) {
 		/* Not found */
+		goto func_exit;
+	}
 
-		btr_pcur_close(&pcur);
-		mtr_commit(&mtr);
-		mem_heap_free(heap);
-
-		return(NULL);
+	/* Find the first record that is not delete marked */
+	while (rec_get_deleted_flag(rec, 0)) {
+		if (!btr_pcur_move_to_next_user_rec(&pcur, &mtr)) {
+			goto func_exit;
+		}
+		rec = btr_pcur_get_rec(&pcur);
 	}
 
 	/*---------------------------------------------------*/
@@ -974,19 +978,14 @@ dict_load_table_on_id(
 
 	/* Check if the table id in record is the one searched for */
 	if (ut_dulint_cmp(table_id, mach_read_from_8(field)) != 0) {
-
-		btr_pcur_close(&pcur);
-		mtr_commit(&mtr);
-		mem_heap_free(heap);
-
-		return(NULL);
+		goto func_exit;
 	}
 
 	/* Now we get the table name from the record */
 	field = rec_get_nth_field_old(rec, 1, &len);
 	/* Load the table definition to memory */
 	table = dict_load_table(mem_heap_strdupl(heap, (char*) field, len));
-
+func_exit:
 	btr_pcur_close(&pcur);
 	mtr_commit(&mtr);
 	mem_heap_free(heap);

From 48a74d7472d92915c12671d2b0563df5d44614b4 Mon Sep 17 00:00:00 2001
From: Dmitry Shulga <Dmitry.Shulga@Sun.COM>
Date: Tue, 29 Jun 2010 16:32:03 +0700
Subject: [PATCH 16/45] Fixed bug #51855. Race condition in XA START. If
 several threads concurrently execute the statement XA START 'x', then mysqld
 server could crash.

---
 sql/sql_class.cc | 10 +++++++---
 sql/sql_parse.cc | 26 ++++++++++++++++++--------
 2 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/sql/sql_class.cc b/sql/sql_class.cc
index 93aa6a8268c..99792f2b262 100644
--- a/sql/sql_class.cc
+++ b/sql/sql_class.cc
@@ -3365,9 +3365,13 @@ bool xid_cache_insert(XID *xid, enum xa_states xa_state)
 bool xid_cache_insert(XID_STATE *xid_state)
 {
   pthread_mutex_lock(&LOCK_xid_cache);
-  DBUG_ASSERT(hash_search(&xid_cache, xid_state->xid.key(),
-                          xid_state->xid.key_length())==0);
-  my_bool res=my_hash_insert(&xid_cache, (uchar*)xid_state);
+  if (hash_search(&xid_cache, xid_state->xid.key(), xid_state->xid.key_length()))
+  {
+    pthread_mutex_unlock(&LOCK_xid_cache);
+    my_error(ER_XAER_DUPID, MYF(0));
+    return TRUE;
+  }
+  my_bool res= my_hash_insert(&xid_cache, (uchar*)xid_state);
   pthread_mutex_unlock(&LOCK_xid_cache);
   return res;
 }
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index ed2c76fdcb8..a8dede3e7f5 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -4730,7 +4730,7 @@ create_sp_error:
         my_error(ER_XAER_NOTA, MYF(0));
         break;
       }
-      thd->transaction.xid_state.xa_state=XA_ACTIVE;
+      thd->transaction.xid_state.xa_state= XA_ACTIVE;
       my_ok(thd);
       break;
     }
@@ -4750,16 +4750,16 @@ create_sp_error:
       my_error(ER_XAER_OUTSIDE, MYF(0));
       break;
     }
-    if (xid_cache_search(thd->lex->xid))
-    {
-      my_error(ER_XAER_DUPID, MYF(0));
-      break;
-    }
     DBUG_ASSERT(thd->transaction.xid_state.xid.is_null());
-    thd->transaction.xid_state.xa_state=XA_ACTIVE;
+    thd->transaction.xid_state.xa_state= XA_ACTIVE;
     thd->transaction.xid_state.rm_error= 0;
     thd->transaction.xid_state.xid.set(thd->lex->xid);
-    xid_cache_insert(&thd->transaction.xid_state);
+    if (xid_cache_insert(&thd->transaction.xid_state))
+    {
+      thd->transaction.xid_state.xa_state= XA_NOTR;
+      thd->transaction.xid_state.xid.null();
+      break;
+    }
     thd->transaction.all.modified_non_trans_table= FALSE;
     thd->options= ((thd->options & ~(OPTION_KEEP_LOG)) | OPTION_BEGIN);
     thd->server_status|= SERVER_STATUS_IN_TRANS;
@@ -4813,6 +4813,16 @@ create_sp_error:
   case SQLCOM_XA_COMMIT:
     if (!thd->transaction.xid_state.xid.eq(thd->lex->xid))
     {
+      /*
+        xid_state.in_thd is always true beside of xa recovery
+        procedure. Note, that there is no race condition here
+        between xid_cache_search and xid_cache_delete, since we're always
+        deleting our own XID (thd->lex->xid == thd->transaction.xid_state.xid).
+        The only case when thd->lex->xid != thd->transaction.xid_state.xid
+        and xid_state->in_thd == 0 is in ha_recover() functionality,
+        which is called before starting client connections, and thus is
+        always single-threaded.
+      */
       XID_STATE *xs=xid_cache_search(thd->lex->xid);
       if (!xs || xs->in_thd)
         my_error(ER_XAER_NOTA, MYF(0));

From 7271bcb4ec9efbfffd9c963f22c1779ba797cf6f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20M=C3=A4kel=C3=A4?= <marko.makela@oracle.com>
Date: Tue, 29 Jun 2010 15:55:18 +0300
Subject: [PATCH 17/45] Bug#54358: READ UNCOMMITTED access failure of off-page
 DYNAMIC or COMPRESSED columns

When the server crashes after a record stub has been inserted and
before all its off-page columns have been written, the record will
contain incomplete off-page columns after crash recovery. Such records
may only be accessed at the READ UNCOMMITTED isolation level or when
rolling back a recovered transaction in recv_recovery_rollback_active().
Skip these records at the READ UNCOMMITTED isolation level.

TODO: Add assertions for checking the above assumptions hold when an
incomplete BLOB is encountered.

btr_rec_copy_externally_stored_field(): Return NULL if the field is
incomplete.

row_prebuilt_t::templ_contains_blob: Clarify what "BLOB" means in this
context. Hint: MySQL BLOBs are not the same as InnoDB BLOBs.

row_sel_store_mysql_rec(): Return FALSE if not all columns could be
retrieved. Previously this function always returned TRUE.  Assert that
the record is not delete-marked.

row_sel_push_cache_row_for_mysql(): Return FALSE if not all columns
could be retrieved.

row_search_for_mysql(): Skip records containing incomplete off-page
columns. Assert that the transaction isolation level is READ
UNCOMMITTED.

rb://380 approved by Jimmy Yang
---
 storage/innodb_plugin/btr/btr0cur.c       |  24 ++++-
 storage/innodb_plugin/include/btr0cur.h   |   2 +-
 storage/innodb_plugin/include/row0mysql.h |   6 +-
 storage/innodb_plugin/row/row0merge.c     |   5 +
 storage/innodb_plugin/row/row0sel.c       | 113 +++++++++++++++++++---
 5 files changed, 133 insertions(+), 17 deletions(-)

diff --git a/storage/innodb_plugin/btr/btr0cur.c b/storage/innodb_plugin/btr/btr0cur.c
index 50531ad3bd7..9b28f26f054 100644
--- a/storage/innodb_plugin/btr/btr0cur.c
+++ b/storage/innodb_plugin/btr/btr0cur.c
@@ -4814,7 +4814,7 @@ btr_copy_externally_stored_field(
 
 /*******************************************************************//**
 Copies an externally stored field of a record to mem heap.
-@return	the field copied to heap */
+@return	the field copied to heap, or NULL if the field is incomplete */
 UNIV_INTERN
 byte*
 btr_rec_copy_externally_stored_field(
@@ -4844,6 +4844,28 @@ btr_rec_copy_externally_stored_field(
 
 	data = rec_get_nth_field(rec, offsets, no, &local_len);
 
+	ut_a(local_len >= BTR_EXTERN_FIELD_REF_SIZE);
+
+	if (UNIV_UNLIKELY
+	    (!memcmp(data + local_len - BTR_EXTERN_FIELD_REF_SIZE,
+		     field_ref_zero, BTR_EXTERN_FIELD_REF_SIZE))) {
+		/* The externally stored field was not written
+		yet. This is only a valid condition when the server
+		crashed after the time a record stub was freshly
+		inserted but before all its columns were written. This
+		record should only be seen by
+		recv_recovery_rollback_active() or any
+		TRX_ISO_READ_UNCOMMITTED transactions. */
+
+		/* TODO: assert that there is an owner_trx with
+		owner_trx->id == DB_TRX_ID and owner_trx->is_recovered */
+
+		/* TODO: assert that for the current transaction trx,
+		either (trx == owner_trx && trx_is_recv(trx)) or
+		trx->isolation_level == TRX_ISO_READ_UNCOMMITTED. */
+		return(NULL);
+	}
+
 	return(btr_copy_externally_stored_field(len, data,
 						zip_size, local_len, heap));
 }
diff --git a/storage/innodb_plugin/include/btr0cur.h b/storage/innodb_plugin/include/btr0cur.h
index 716f15c4267..7dc2eb63cf5 100644
--- a/storage/innodb_plugin/include/btr0cur.h
+++ b/storage/innodb_plugin/include/btr0cur.h
@@ -570,7 +570,7 @@ btr_copy_externally_stored_field_prefix(
 	ulint		local_len);/*!< in: length of data, in bytes */
 /*******************************************************************//**
 Copies an externally stored field of a record to mem heap.
-@return	the field copied to heap */
+@return	the field copied to heap, or NULL if the field is incomplete */
 UNIV_INTERN
 byte*
 btr_rec_copy_externally_stored_field(
diff --git a/storage/innodb_plugin/include/row0mysql.h b/storage/innodb_plugin/include/row0mysql.h
index 39ea240772c..b69e657361b 100644
--- a/storage/innodb_plugin/include/row0mysql.h
+++ b/storage/innodb_plugin/include/row0mysql.h
@@ -622,7 +622,11 @@ struct row_prebuilt_struct {
 					the secondary index, then this is
 					set to TRUE */
 	unsigned	templ_contains_blob:1;/*!< TRUE if the template contains
-					BLOB column(s) */
+					a column with DATA_BLOB ==
+					get_innobase_type_from_mysql_type();
+					not to be confused with InnoDB
+					externally stored columns
+					(VARCHAR can be off-page too) */
 	mysql_row_templ_t* mysql_template;/*!< template used to transform
 					rows fast between MySQL and Innobase
 					formats; memory for this template
diff --git a/storage/innodb_plugin/row/row0merge.c b/storage/innodb_plugin/row/row0merge.c
index 70cc7912fad..56a68b58225 100644
--- a/storage/innodb_plugin/row/row0merge.c
+++ b/storage/innodb_plugin/row/row0merge.c
@@ -1780,6 +1780,11 @@ row_merge_copy_blobs(
 		(below). */
 		data = btr_rec_copy_externally_stored_field(
 			mrec, offsets, zip_size, i, &len, heap);
+		/* Because we have locked the table, any records
+		written by incomplete transactions must have been
+		rolled back already. There must not be any incomplete
+		BLOB columns. */
+		ut_a(data);
 
 		dfield_set_data(field, data, len);
 	}
diff --git a/storage/innodb_plugin/row/row0sel.c b/storage/innodb_plugin/row/row0sel.c
index 2861235a995..ab8c78e4f4a 100644
--- a/storage/innodb_plugin/row/row0sel.c
+++ b/storage/innodb_plugin/row/row0sel.c
@@ -416,7 +416,7 @@ row_sel_fetch_columns(
 							      field_no))) {
 
 				/* Copy an externally stored field to the
-				temporary heap */
+				temporary heap, if possible. */
 
 				heap = mem_heap_create(1);
 
@@ -425,6 +425,21 @@ row_sel_fetch_columns(
 					dict_table_zip_size(index->table),
 					field_no, &len, heap);
 
+				/* data == NULL means that the
+				externally stored field was not
+				written yet. This is only a valid
+				condition when the server crashed
+				after the time a record stub was
+				freshly inserted but before all its
+				columns were written. This record
+				should only be seen by
+				recv_recovery_rollback_active() or any
+				TRX_ISO_READ_UNCOMMITTED
+				transactions. The InnoDB SQL parser
+				(the sole caller of this function)
+				does not implement READ UNCOMMITTED,
+				and it is not involved during rollback. */
+				ut_a(data);
 				ut_a(len != UNIV_SQL_NULL);
 
 				needs_copy = TRUE;
@@ -926,6 +941,7 @@ row_sel_get_clust_rec(
 	when plan->clust_pcur was positioned.  The latch will not be
 	released until mtr_commit(mtr). */
 
+	ut_ad(!rec_get_deleted_flag(clust_rec, rec_offs_comp(offsets)));
 	row_sel_fetch_columns(index, clust_rec, offsets,
 			      UT_LIST_GET_FIRST(plan->columns));
 	*out_rec = clust_rec;
@@ -1628,6 +1644,13 @@ skip_lock:
 				}
 
 				if (old_vers == NULL) {
+					/* The record does not exist
+					in our read view. Skip it, but
+					first attempt to determine
+					whether the index segment we
+					are searching through has been
+					exhausted. */
+
 					offsets = rec_get_offsets(
 						rec, index, offsets,
 						ULINT_UNDEFINED, &heap);
@@ -2647,9 +2670,8 @@ Convert a row in the Innobase format to a row in the MySQL format.
 Note that the template in prebuilt may advise us to copy only a few
 columns to mysql_rec, other columns are left blank. All columns may not
 be needed in the query.
-@return TRUE if success, FALSE if could not allocate memory for a BLOB
-(though we may also assert in that case) */
-static
+@return TRUE on success, FALSE if not all columns could be retrieved */
+static __attribute__((warn_unused_result))
 ibool
 row_sel_store_mysql_rec(
 /*====================*/
@@ -2672,6 +2694,7 @@ row_sel_store_mysql_rec(
 	ut_ad(prebuilt->mysql_template);
 	ut_ad(prebuilt->default_rec);
 	ut_ad(rec_offs_validate(rec, NULL, offsets));
+	ut_ad(!rec_get_deleted_flag(rec, rec_offs_comp(offsets)));
 
 	if (UNIV_LIKELY_NULL(prebuilt->blob_heap)) {
 		mem_heap_free(prebuilt->blob_heap);
@@ -2719,6 +2742,26 @@ row_sel_store_mysql_rec(
 				dict_table_zip_size(prebuilt->table),
 				templ->rec_field_no, &len, heap);
 
+			if (UNIV_UNLIKELY(!data)) {
+				/* The externally stored field
+				was not written yet. This is
+				only a valid condition when
+				the server crashed after the
+				time a record stub was freshly
+				inserted but before all its
+				columns were written. This
+				record should only be seen by
+				recv_recovery_rollback_active()
+				or any TRX_ISO_READ_UNCOMMITTED
+				transactions. */
+
+				if (extern_field_heap) {
+					mem_heap_free(extern_field_heap);
+				}
+
+				return(FALSE);
+			}
+
 			ut_a(len != UNIV_SQL_NULL);
 		} else {
 			/* Field is stored in the row. */
@@ -3136,9 +3179,10 @@ row_sel_pop_cached_row_for_mysql(
 }
 
 /********************************************************************//**
-Pushes a row for MySQL to the fetch cache. */
-UNIV_INLINE
-void
+Pushes a row for MySQL to the fetch cache.
+@return TRUE on success, FALSE if the record contains incomplete BLOBs */
+UNIV_INLINE __attribute__((warn_unused_result))
+ibool
 row_sel_push_cache_row_for_mysql(
 /*=============================*/
 	row_prebuilt_t*	prebuilt,	/*!< in: prebuilt struct */
@@ -3180,10 +3224,11 @@ row_sel_push_cache_row_for_mysql(
 				  prebuilt->fetch_cache[
 					  prebuilt->n_fetch_cached],
 				  prebuilt, rec, offsets))) {
-		ut_error;
+		return(FALSE);
 	}
 
 	prebuilt->n_fetch_cached++;
+	return(TRUE);
 }
 
 /*********************************************************************//**
@@ -3578,6 +3623,24 @@ row_search_for_mysql(
 
 				if (!row_sel_store_mysql_rec(buf, prebuilt,
 							     rec, offsets)) {
+					/* Only fresh inserts at
+					server crash time may contain
+					incomplete externally stored
+					columns. Pretend that such
+					records do not exist. Such
+					records may only be accessed
+					at the READ UNCOMMITTED
+					isolation level or when
+					rolling back a recovered
+					transaction. Rollback happens
+					at a lower level, not here. */
+					ut_a(trx->isolation_level
+					     == TRX_ISO_READ_UNCOMMITTED);
+					/* TODO: assert that there is
+					an owner_trx with
+					owner_trx->id == DB_TRX_ID and
+					owner_trx->is_recovered */
+
 					err = DB_TOO_BIG_RECORD;
 
 					/* We let the main loop to do the
@@ -4357,9 +4420,20 @@ requires_clust_rec:
 		not cache rows because there the cursor is a scrollable
 		cursor. */
 
-		row_sel_push_cache_row_for_mysql(prebuilt, result_rec,
-						 offsets);
-		if (prebuilt->n_fetch_cached == MYSQL_FETCH_CACHE_SIZE) {
+		if (!row_sel_push_cache_row_for_mysql(prebuilt, result_rec,
+						      offsets)) {
+			/* Only fresh inserts at server crash time may contain
+			incomplete externally stored columns. Pretend that
+			such records do not exist. Such records may only be
+			accessed at the READ UNCOMMITTED isolation level or
+			when rolling back a recovered transaction. Rollback
+			happens at a lower level, not here. */
+			ut_a(trx->isolation_level == TRX_ISO_READ_UNCOMMITTED);
+			/* TODO: assert that there is an owner_trx
+			with owner_trx->id == DB_TRX_ID and
+			owner_trx->is_recovered */
+		} else if (prebuilt->n_fetch_cached
+			   == MYSQL_FETCH_CACHE_SIZE) {
 
 			goto got_row;
 		}
@@ -4375,9 +4449,20 @@ requires_clust_rec:
 		} else {
 			if (!row_sel_store_mysql_rec(buf, prebuilt,
 						     result_rec, offsets)) {
-				err = DB_TOO_BIG_RECORD;
-
-				goto lock_wait_or_error;
+				/* Only fresh inserts at server crash
+				time may contain incomplete externally
+				stored columns. Pretend that such
+				records do not exist. Such records may
+				only be accessed at the READ UNCOMMITTED
+				isolation level or when rolling back a
+				recovered transaction. Rollback happens
+				at a lower level, not here. */
+				ut_a(trx->isolation_level
+				     == TRX_ISO_READ_UNCOMMITTED);
+				/* TODO: assert that there is an owner_trx
+				with owner_trx->id == DB_TRX_ID and
+				owner_trx->is_recovered */
+				goto next_rec;
 			}
 		}
 

From c43070dabefc472b88b6d8092747e1cdc592f76e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20M=C3=A4kel=C3=A4?= <marko.makela@oracle.com>
Date: Tue, 29 Jun 2010 15:56:53 +0300
Subject: [PATCH 18/45] ChangeLog entry for Bug #54358

---
 storage/innodb_plugin/ChangeLog | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/storage/innodb_plugin/ChangeLog b/storage/innodb_plugin/ChangeLog
index 328fcf8e0bb..5e41c5f180a 100644
--- a/storage/innodb_plugin/ChangeLog
+++ b/storage/innodb_plugin/ChangeLog
@@ -1,3 +1,10 @@
+2010-06-29	The InnoDB Team
+
+	* btr/btr0cur.c, include/btr0cur.h,
+	include/row0mysql.h, row/row0merge.c, row/row0sel.c:
+	Fix Bug#54358 READ UNCOMMITTED access failure of off-page DYNAMIC
+	or COMPRESSED columns
+
 2010-06-24	The InnoDB Team
 
 	* handler/ha_innodb.cc:

From c8e48de2610cf65b65b1ea01e22c612aafce7fcb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20M=C3=A4kel=C3=A4?= <marko.makela@oracle.com>
Date: Tue, 29 Jun 2010 16:00:58 +0300
Subject: [PATCH 19/45] Bug#54408: txn rollback after recovery: row0umod.c:673
 dict_table_get_format(index->table)

The REDUNDANT and COMPACT formats store a local 768-byte prefix of
each externally stored column. No row_ext cache is needed, but we
initialized one nevertheless. When the BLOB pointer was zero, we would
ignore the locally stored prefix as well. This triggered an assertion
failure in row_undo_mod_upd_exist_sec().

row_build(): Allow ext==NULL when a REDUNDANT or COMPACT table
contains externally stored columns.

row_undo_search_clust_to_pcur(), row_upd_store_row(): Invoke
row_build() with ext==NULL on REDUNDANT and COMPACT tables.

rb://382 approved by Jimmy Yang
---
 storage/innodb_plugin/row/row0row.c  |  8 +++++++-
 storage/innodb_plugin/row/row0undo.c | 18 +++++++++++++++++-
 storage/innodb_plugin/row/row0upd.c  | 17 ++++++++++++++++-
 3 files changed, 40 insertions(+), 3 deletions(-)

diff --git a/storage/innodb_plugin/row/row0row.c b/storage/innodb_plugin/row/row0row.c
index cb7dfa2b7c9..8e806a14a98 100644
--- a/storage/innodb_plugin/row/row0row.c
+++ b/storage/innodb_plugin/row/row0row.c
@@ -294,7 +294,13 @@ row_build(
 
 	ut_ad(dtuple_check_typed(row));
 
-	if (j) {
+	if (!ext) {
+		/* REDUNDANT and COMPACT formats store a local
+		768-byte prefix of each externally stored
+		column. No cache is needed. */
+		ut_ad(dict_table_get_format(index->table)
+		      < DICT_TF_FORMAT_ZIP);
+	} else if (j) {
 		*ext = row_ext_create(j, ext_cols, row,
 				      dict_table_zip_size(index->table),
 				      heap);
diff --git a/storage/innodb_plugin/row/row0undo.c b/storage/innodb_plugin/row/row0undo.c
index 9ef842b5114..fd28a4f6520 100644
--- a/storage/innodb_plugin/row/row0undo.c
+++ b/storage/innodb_plugin/row/row0undo.c
@@ -199,8 +199,24 @@ row_undo_search_clust_to_pcur(
 
 		ret = FALSE;
 	} else {
+		row_ext_t**	ext;
+
+		if (dict_table_get_format(node->table) >= DICT_TF_FORMAT_ZIP) {
+			/* In DYNAMIC or COMPRESSED format, there is
+			no prefix of externally stored columns in the
+			clustered index record. Build a cache of
+			column prefixes. */
+			ext = &node->ext;
+		} else {
+			/* REDUNDANT and COMPACT formats store a local
+			768-byte prefix of each externally stored
+			column. No cache is needed. */
+			ext = NULL;
+			node->ext = NULL;
+		}
+
 		node->row = row_build(ROW_COPY_DATA, clust_index, rec,
-				      offsets, NULL, &node->ext, node->heap);
+				      offsets, NULL, ext, node->heap);
 		if (node->update) {
 			node->undo_row = dtuple_copy(node->row, node->heap);
 			row_upd_replace(node->undo_row, &node->undo_ext,
diff --git a/storage/innodb_plugin/row/row0upd.c b/storage/innodb_plugin/row/row0upd.c
index d0aaecd3dae..397b117c067 100644
--- a/storage/innodb_plugin/row/row0upd.c
+++ b/storage/innodb_plugin/row/row0upd.c
@@ -1398,6 +1398,7 @@ row_upd_store_row(
 	dict_index_t*	clust_index;
 	rec_t*		rec;
 	mem_heap_t*	heap		= NULL;
+	row_ext_t**	ext;
 	ulint		offsets_[REC_OFFS_NORMAL_SIZE];
 	const ulint*	offsets;
 	rec_offs_init(offsets_);
@@ -1414,8 +1415,22 @@ row_upd_store_row(
 
 	offsets = rec_get_offsets(rec, clust_index, offsets_,
 				  ULINT_UNDEFINED, &heap);
+
+	if (dict_table_get_format(node->table) >= DICT_TF_FORMAT_ZIP) {
+		/* In DYNAMIC or COMPRESSED format, there is no prefix
+		of externally stored columns in the clustered index
+		record. Build a cache of column prefixes. */
+		ext = &node->ext;
+	} else {
+		/* REDUNDANT and COMPACT formats store a local
+		768-byte prefix of each externally stored column.
+		No cache is needed. */
+		ext = NULL;
+		node->ext = NULL;
+	}
+
 	node->row = row_build(ROW_COPY_DATA, clust_index, rec, offsets,
-			      NULL, &node->ext, node->heap);
+			      NULL, ext, node->heap);
 	if (node->is_delete) {
 		node->upd_row = NULL;
 		node->upd_ext = NULL;

From 5a25f4081570b539a20a845320e92b1018aef3b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20M=C3=A4kel=C3=A4?= <marko.makela@oracle.com>
Date: Tue, 29 Jun 2010 16:12:19 +0300
Subject: [PATCH 20/45] ChangeLog entry for Bug #54408

---
 storage/innodb_plugin/ChangeLog | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/storage/innodb_plugin/ChangeLog b/storage/innodb_plugin/ChangeLog
index 5e41c5f180a..f7e9a3df943 100644
--- a/storage/innodb_plugin/ChangeLog
+++ b/storage/innodb_plugin/ChangeLog
@@ -1,3 +1,8 @@
+2010-06-29	The InnoDB Team
+	* row/row0row.c, row/row0undo.c, row/row0upd.c:
+	Fix Bug#54408 txn rollback after recovery: row0umod.c:673
+	dict_table_get_format(index->table)
+
 2010-06-29	The InnoDB Team
 
 	* btr/btr0cur.c, include/btr0cur.h,

From 5754382c31b85ab4bbcded9691efd7f3891daa17 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20M=C3=A4kel=C3=A4?= <marko.makela@oracle.com>
Date: Wed, 30 Jun 2010 12:31:49 +0300
Subject: [PATCH 21/45] Correct some comments that were added in the fix of Bug
 #54358 (READ UNCOMMITTED access failure of off-page DYNAMIC or COMPRESSED
 columns).

Records that lack incompletely written externally stored columns may
be accessed by READ UNCOMMITTED transaction even without involving a
crash during an INSERT or UPDATE operation. I verified this as follows.

(1) added a delay after the mini-transaction for writing the clustered
index 'stub' record was committed (patch attached)
(2) started mysqld in gdb, setting breakpoints to the where the
assertions about READ UNCOMMITTED were added in the bug fix
(3) invoked ibtest3 --create-options=key_block_size=2
to create BLOBs in a COMPRESSED table
(4) invoked the following:
yes 'set transaction isolation level read uncommitted;
checksum table blobt3;select sleep(1);'|mysql -uroot test
(5) noted that one of the breakpoints was triggered
(return(NULL) in btr_rec_copy_externally_stored_field())

=== modified file 'storage/innodb_plugin/row/row0ins.c'
--- storage/innodb_plugin/row/row0ins.c	2010-06-30 08:17:25 +0000
+++ storage/innodb_plugin/row/row0ins.c	2010-06-30 08:17:25 +0000
@@ -2120,6 +2120,7 @@ function_exit:
 		rec_t*	rec;
 		ulint*	offsets;
 		mtr_start(&mtr);
+		os_thread_sleep(5000000);

 		btr_cur_search_to_nth_level(index, 0, entry, PAGE_CUR_LE,
 					    BTR_MODIFY_TREE, &cursor, 0,

=== modified file 'storage/innodb_plugin/row/row0upd.c'
--- storage/innodb_plugin/row/row0upd.c	2010-06-30 08:11:55 +0000
+++ storage/innodb_plugin/row/row0upd.c	2010-06-30 08:11:55 +0000
@@ -1763,6 +1763,7 @@ row_upd_clust_rec(
 		rec_offs_init(offsets_);

 		mtr_start(mtr);
+		os_thread_sleep(5000000);

 		ut_a(btr_pcur_restore_position(BTR_MODIFY_TREE, pcur, mtr));
 		rec = btr_cur_get_rec(btr_cur);
---
 storage/innodb_plugin/btr/btr0cur.c | 14 ++------
 storage/innodb_plugin/row/row0sel.c | 53 +++++++++--------------------
 2 files changed, 19 insertions(+), 48 deletions(-)

diff --git a/storage/innodb_plugin/btr/btr0cur.c b/storage/innodb_plugin/btr/btr0cur.c
index 9b28f26f054..7fa7d42320a 100644
--- a/storage/innodb_plugin/btr/btr0cur.c
+++ b/storage/innodb_plugin/btr/btr0cur.c
@@ -4849,20 +4849,10 @@ btr_rec_copy_externally_stored_field(
 	if (UNIV_UNLIKELY
 	    (!memcmp(data + local_len - BTR_EXTERN_FIELD_REF_SIZE,
 		     field_ref_zero, BTR_EXTERN_FIELD_REF_SIZE))) {
-		/* The externally stored field was not written
-		yet. This is only a valid condition when the server
-		crashed after the time a record stub was freshly
-		inserted but before all its columns were written. This
-		record should only be seen by
+		/* The externally stored field was not written yet.
+		This record should only be seen by
 		recv_recovery_rollback_active() or any
 		TRX_ISO_READ_UNCOMMITTED transactions. */
-
-		/* TODO: assert that there is an owner_trx with
-		owner_trx->id == DB_TRX_ID and owner_trx->is_recovered */
-
-		/* TODO: assert that for the current transaction trx,
-		either (trx == owner_trx && trx_is_recv(trx)) or
-		trx->isolation_level == TRX_ISO_READ_UNCOMMITTED. */
 		return(NULL);
 	}
 
diff --git a/storage/innodb_plugin/row/row0sel.c b/storage/innodb_plugin/row/row0sel.c
index ab8c78e4f4a..d0c59862fce 100644
--- a/storage/innodb_plugin/row/row0sel.c
+++ b/storage/innodb_plugin/row/row0sel.c
@@ -427,11 +427,7 @@ row_sel_fetch_columns(
 
 				/* data == NULL means that the
 				externally stored field was not
-				written yet. This is only a valid
-				condition when the server crashed
-				after the time a record stub was
-				freshly inserted but before all its
-				columns were written. This record
+				written yet. This record
 				should only be seen by
 				recv_recovery_rollback_active() or any
 				TRX_ISO_READ_UNCOMMITTED
@@ -2744,12 +2740,7 @@ row_sel_store_mysql_rec(
 
 			if (UNIV_UNLIKELY(!data)) {
 				/* The externally stored field
-				was not written yet. This is
-				only a valid condition when
-				the server crashed after the
-				time a record stub was freshly
-				inserted but before all its
-				columns were written. This
+				was not written yet. This
 				record should only be seen by
 				recv_recovery_rollback_active()
 				or any TRX_ISO_READ_UNCOMMITTED
@@ -3623,8 +3614,7 @@ row_search_for_mysql(
 
 				if (!row_sel_store_mysql_rec(buf, prebuilt,
 							     rec, offsets)) {
-					/* Only fresh inserts at
-					server crash time may contain
+					/* Only fresh inserts may contain
 					incomplete externally stored
 					columns. Pretend that such
 					records do not exist. Such
@@ -3636,10 +3626,6 @@ row_search_for_mysql(
 					at a lower level, not here. */
 					ut_a(trx->isolation_level
 					     == TRX_ISO_READ_UNCOMMITTED);
-					/* TODO: assert that there is
-					an owner_trx with
-					owner_trx->id == DB_TRX_ID and
-					owner_trx->is_recovered */
 
 					err = DB_TOO_BIG_RECORD;
 
@@ -4422,16 +4408,14 @@ requires_clust_rec:
 
 		if (!row_sel_push_cache_row_for_mysql(prebuilt, result_rec,
 						      offsets)) {
-			/* Only fresh inserts at server crash time may contain
-			incomplete externally stored columns. Pretend that
-			such records do not exist. Such records may only be
-			accessed at the READ UNCOMMITTED isolation level or
-			when rolling back a recovered transaction. Rollback
-			happens at a lower level, not here. */
+			/* Only fresh inserts may contain incomplete
+			externally stored columns. Pretend that such
+			records do not exist. Such records may only be
+			accessed at the READ UNCOMMITTED isolation
+			level or when rolling back a recovered
+			transaction. Rollback happens at a lower
+			level, not here. */
 			ut_a(trx->isolation_level == TRX_ISO_READ_UNCOMMITTED);
-			/* TODO: assert that there is an owner_trx
-			with owner_trx->id == DB_TRX_ID and
-			owner_trx->is_recovered */
 		} else if (prebuilt->n_fetch_cached
 			   == MYSQL_FETCH_CACHE_SIZE) {
 
@@ -4449,19 +4433,16 @@ requires_clust_rec:
 		} else {
 			if (!row_sel_store_mysql_rec(buf, prebuilt,
 						     result_rec, offsets)) {
-				/* Only fresh inserts at server crash
-				time may contain incomplete externally
-				stored columns. Pretend that such
-				records do not exist. Such records may
-				only be accessed at the READ UNCOMMITTED
+				/* Only fresh inserts may contain
+				incomplete externally stored
+				columns. Pretend that such records do
+				not exist. Such records may only be
+				accessed at the READ UNCOMMITTED
 				isolation level or when rolling back a
-				recovered transaction. Rollback happens
-				at a lower level, not here. */
+				recovered transaction. Rollback
+				happens at a lower level, not here. */
 				ut_a(trx->isolation_level
 				     == TRX_ISO_READ_UNCOMMITTED);
-				/* TODO: assert that there is an owner_trx
-				with owner_trx->id == DB_TRX_ID and
-				owner_trx->is_recovered */
 				goto next_rec;
 			}
 		}

From 81d3dadb540321a7d88f3bbce0b3a456f90328cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20M=C3=A4kel=C3=A4?= <marko.makela@oracle.com>
Date: Wed, 30 Jun 2010 12:38:47 +0300
Subject: [PATCH 22/45] Bug#54358 follow-up: Correct some error handling.

---
 storage/innodb_plugin/row/row0sel.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/storage/innodb_plugin/row/row0sel.c b/storage/innodb_plugin/row/row0sel.c
index d0c59862fce..76c144e5a8c 100644
--- a/storage/innodb_plugin/row/row0sel.c
+++ b/storage/innodb_plugin/row/row0sel.c
@@ -3627,11 +3627,8 @@ row_search_for_mysql(
 					ut_a(trx->isolation_level
 					     == TRX_ISO_READ_UNCOMMITTED);
 
-					err = DB_TOO_BIG_RECORD;
-
-					/* We let the main loop to do the
-					error handling */
-					goto shortcut_fails_too_big_rec;
+					/* Proceed as in case SEL_RETRY. */
+					break;
 				}
 
 				mtr_commit(&mtr);
@@ -3671,7 +3668,7 @@ release_search_latch_if_needed:
 			default:
 				ut_ad(0);
 			}
-shortcut_fails_too_big_rec:
+
 			mtr_commit(&mtr);
 			mtr_start(&mtr);
 		}

From 0d328677636fecd29af032c59309a36c98981381 Mon Sep 17 00:00:00 2001
From: Jimmy Yang <jimmy.yang@oracle.com>
Date: Wed, 30 Jun 2010 22:06:01 -0700
Subject: [PATCH 23/45] Port fix for bug #54311 from mysql-trunk-innodb to
 mysql-5.1-innodb codeline. Bug #54311: Crash on CHECK PARTITION after
 concurrent LOAD DATA and adaptive_hash_index=OFF

---
 storage/innodb_plugin/ChangeLog            |  6 ++++++
 storage/innodb_plugin/btr/btr0sea.c        | 11 ++++++++++-
 storage/innodb_plugin/ha/ha0ha.c           | 15 +++++++++++----
 storage/innodb_plugin/handler/ha_innodb.cc |  1 +
 storage/innodb_plugin/include/btr0sea.h    |  8 +++++++-
 5 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/storage/innodb_plugin/ChangeLog b/storage/innodb_plugin/ChangeLog
index f7e9a3df943..a49a6b54a39 100644
--- a/storage/innodb_plugin/ChangeLog
+++ b/storage/innodb_plugin/ChangeLog
@@ -1,3 +1,9 @@
+2010-06-30	The InnoDB Team
+
+	* btr/btr0sea.c, ha/ha0ha.c, handler/ha_innodb.cc, include/btr0sea.h:
+	Fix Bug#54311 Crash on CHECK PARTITION after concurrent LOAD DATA
+	and adaptive_hash_index=OFF
+
 2010-06-29	The InnoDB Team
 	* row/row0row.c, row/row0undo.c, row/row0upd.c:
 	Fix Bug#54408 txn rollback after recovery: row0umod.c:673
diff --git a/storage/innodb_plugin/btr/btr0sea.c b/storage/innodb_plugin/btr/btr0sea.c
index c91afa31bf0..ac7248fef20 100644
--- a/storage/innodb_plugin/btr/btr0sea.c
+++ b/storage/innodb_plugin/btr/btr0sea.c
@@ -46,6 +46,7 @@ Created 2/17/1996 Heikki Tuuri
 /** Flag: has the search system been enabled?
 Protected by btr_search_latch and btr_search_enabled_mutex. */
 UNIV_INTERN char		btr_search_enabled	= TRUE;
+UNIV_INTERN ibool		btr_search_fully_disabled = FALSE;
 
 /** Mutex protecting btr_search_enabled */
 static mutex_t			btr_search_enabled_mutex;
@@ -201,12 +202,19 @@ btr_search_disable(void)
 	mutex_enter(&btr_search_enabled_mutex);
 	rw_lock_x_lock(&btr_search_latch);
 
+	/* Disable access to hash index, also tell ha_insert_for_fold()
+	stop adding new nodes to hash index, but still allow updating
+	existing nodes */
 	btr_search_enabled = FALSE;
 
 	/* Clear all block->is_hashed flags and remove all entries
 	from btr_search_sys->hash_index. */
 	buf_pool_drop_hash_index();
 
+	/* hash index has been cleaned up, disallow any operation to
+	the hash index */
+	btr_search_fully_disabled = TRUE;
+
 	/* btr_search_enabled_mutex should guarantee this. */
 	ut_ad(!btr_search_enabled);
 
@@ -225,6 +233,7 @@ btr_search_enable(void)
 	rw_lock_x_lock(&btr_search_latch);
 
 	btr_search_enabled = TRUE;
+	btr_search_fully_disabled = FALSE;
 
 	rw_lock_x_unlock(&btr_search_latch);
 	mutex_exit(&btr_search_enabled_mutex);
@@ -1363,7 +1372,7 @@ btr_search_build_page_hash_index(
 
 	rw_lock_x_lock(&btr_search_latch);
 
-	if (UNIV_UNLIKELY(!btr_search_enabled)) {
+	if (UNIV_UNLIKELY(btr_search_fully_disabled)) {
 		goto exit_func;
 	}
 
diff --git a/storage/innodb_plugin/ha/ha0ha.c b/storage/innodb_plugin/ha/ha0ha.c
index 9d9d341ad39..f9e798012f8 100644
--- a/storage/innodb_plugin/ha/ha0ha.c
+++ b/storage/innodb_plugin/ha/ha0ha.c
@@ -31,9 +31,7 @@ Created 8/22/1994 Heikki Tuuri
 #ifdef UNIV_DEBUG
 # include "buf0buf.h"
 #endif /* UNIV_DEBUG */
-#ifdef UNIV_SYNC_DEBUG
-# include "btr0sea.h"
-#endif /* UNIV_SYNC_DEBUG */
+#include "btr0sea.h"
 #include "page0page.h"
 
 /*************************************************************//**
@@ -127,7 +125,8 @@ ha_clear(
 /*************************************************************//**
 Inserts an entry into a hash table. If an entry with the same fold number
 is found, its node is updated to point to the new data, and no new node
-is inserted.
+is inserted. If btr_search_enabled is set to FALSE, we will only allow
+updating existing nodes, but no new node is allowed to be added.
 @return	TRUE if succeed, FALSE if no more memory could be allocated */
 UNIV_INTERN
 ibool
@@ -174,6 +173,7 @@ ha_insert_for_fold_func(
 				prev_block->n_pointers--;
 				block->n_pointers++;
 			}
+			ut_ad(!btr_search_fully_disabled);
 # endif /* !UNIV_HOTBACKUP */
 
 			prev_node->block = block;
@@ -186,6 +186,13 @@ ha_insert_for_fold_func(
 		prev_node = prev_node->next;
 	}
 
+	/* We are in the process of disabling hash index, do not add
+	new chain node */
+	if (!btr_search_enabled) {
+		ut_ad(!btr_search_fully_disabled);
+		return(TRUE);
+	}
+
 	/* We have to allocate a new chain node */
 
 	node = mem_heap_alloc(hash_get_heap(table, fold), sizeof(ha_node_t));
diff --git a/storage/innodb_plugin/handler/ha_innodb.cc b/storage/innodb_plugin/handler/ha_innodb.cc
index aa80814dbe0..c6042815e6c 100644
--- a/storage/innodb_plugin/handler/ha_innodb.cc
+++ b/storage/innodb_plugin/handler/ha_innodb.cc
@@ -2270,6 +2270,7 @@ innobase_change_buffering_inited_ok:
 	/* Get the current high water mark format. */
 	innobase_file_format_check = (char*) trx_sys_file_format_max_get();
 
+	btr_search_fully_disabled = (!btr_search_enabled);
 	DBUG_RETURN(FALSE);
 error:
 	DBUG_RETURN(TRUE);
diff --git a/storage/innodb_plugin/include/btr0sea.h b/storage/innodb_plugin/include/btr0sea.h
index f98ba386f9c..20a2be7f877 100644
--- a/storage/innodb_plugin/include/btr0sea.h
+++ b/storage/innodb_plugin/include/btr0sea.h
@@ -190,7 +190,13 @@ btr_search_validate(void);
 
 /** Flag: has the search system been enabled?
 Protected by btr_search_latch and btr_search_enabled_mutex. */
-extern char btr_search_enabled;
+extern char	btr_search_enabled;
+
+/** Flag: whether the search system has completed its disabling process,
+It is set to TRUE right after buf_pool_drop_hash_index() in
+btr_search_disable(), indicating hash index entries are cleaned up.
+Protected by btr_search_latch and btr_search_enabled_mutex. */
+extern ibool	btr_search_fully_disabled;
 
 /** The search info struct in an index */
 struct btr_search_struct{

From f0fe99523c6fe6bb85031415bbd6098c1c17ce97 Mon Sep 17 00:00:00 2001
From: Jimmy Yang <jimmy.yang@oracle.com>
Date: Mon, 5 Jul 2010 19:26:38 -0700
Subject: [PATCH 24/45] Add innodb_bug53756-master.opt for innodb_bug53756
 test.

---
 mysql-test/suite/innodb/r/innodb_bug53756.result     | 2 +-
 mysql-test/suite/innodb/t/innodb_bug53756-master.opt | 1 +
 mysql-test/suite/innodb/t/innodb_bug53756.test       | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)
 create mode 100644 mysql-test/suite/innodb/t/innodb_bug53756-master.opt

diff --git a/mysql-test/suite/innodb/r/innodb_bug53756.result b/mysql-test/suite/innodb/r/innodb_bug53756.result
index 67797f9c90f..37453be8201 100644
--- a/mysql-test/suite/innodb/r/innodb_bug53756.result
+++ b/mysql-test/suite/innodb/r/innodb_bug53756.result
@@ -78,7 +78,7 @@ ROLLBACK;
 
 # connection default selects resulting data.
 # Delete of row 1 was committed.
-# Dpdate of row 3 was committed.
+# Update of row 3 was committed.
 # Due to isolation level read committed, these should be included.
 # All other changes should not be included.
 SELECT * FROM bug_53756;
diff --git a/mysql-test/suite/innodb/t/innodb_bug53756-master.opt b/mysql-test/suite/innodb/t/innodb_bug53756-master.opt
new file mode 100644
index 00000000000..425fda95086
--- /dev/null
+++ b/mysql-test/suite/innodb/t/innodb_bug53756-master.opt
@@ -0,0 +1 @@
+--skip-stack-trace --skip-core-file
diff --git a/mysql-test/suite/innodb/t/innodb_bug53756.test b/mysql-test/suite/innodb/t/innodb_bug53756.test
index 85a09478486..8324f2640a2 100644
--- a/mysql-test/suite/innodb/t/innodb_bug53756.test
+++ b/mysql-test/suite/innodb/t/innodb_bug53756.test
@@ -114,7 +114,7 @@ ROLLBACK;
 --echo
 --echo # connection default selects resulting data.
 --echo # Delete of row 1 was committed.
---echo # Dpdate of row 3 was committed.
+--echo # Update of row 3 was committed.
 --echo # Due to isolation level read committed, these should be included.
 --echo # All other changes should not be included.
 --connection default

From 75690d7b267fa51609e1e4a9a81878274b725801 Mon Sep 17 00:00:00 2001
From: Vasil Dimov <vasil.dimov@oracle.com>
Date: Wed, 7 Jul 2010 20:51:30 +0300
Subject: [PATCH 25/45] Add the innodb_plugin tests to "make dist".

---
 mysql-test/Makefile.am | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mysql-test/Makefile.am b/mysql-test/Makefile.am
index 06aea68b52d..13e2388858f 100644
--- a/mysql-test/Makefile.am
+++ b/mysql-test/Makefile.am
@@ -100,6 +100,8 @@ TEST_DIRS = t r include std_data std_data/parts collections \
 	suite/rpl_ndb suite/rpl_ndb/t suite/rpl_ndb/r \
 	suite/parts suite/parts/t suite/parts/r suite/parts/inc \
 	suite/innodb suite/innodb/t suite/innodb/r suite/innodb/include \
+	suite/innodb_plugin suite/innodb_plugin/t suite/innodb_plugin/r \
+	suite/innodb_plugin/include \
 	suite/engines suite/engines/funcs suite/engines/iuds suite/engines/rr_trx \
 	suite/engines/funcs/r suite/engines/funcs/t suite/engines/iuds/r \
 	suite/engines/iuds/t suite/engines/rr_trx/include suite/engines/rr_trx/r \

From aff388cd09ff30373cd02c8080911a51bc671817 Mon Sep 17 00:00:00 2001
From: sunanda <sunanda.menon@sun.com>
Date: Wed, 7 Jul 2010 20:34:50 +0200
Subject: [PATCH 26/45] rko Mdkeld change, revision 3351.14.134 add
 innodb_plugin to mysql-test-run default suites was not complete. Bootstrap
 failed to pick up necessary files needed by test and hence all tests failed.

---
 mysql-test/Makefile.am | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mysql-test/Makefile.am b/mysql-test/Makefile.am
index 06aea68b52d..066c8d53c14 100644
--- a/mysql-test/Makefile.am
+++ b/mysql-test/Makefile.am
@@ -100,6 +100,7 @@ TEST_DIRS = t r include std_data std_data/parts collections \
 	suite/rpl_ndb suite/rpl_ndb/t suite/rpl_ndb/r \
 	suite/parts suite/parts/t suite/parts/r suite/parts/inc \
 	suite/innodb suite/innodb/t suite/innodb/r suite/innodb/include \
+	suite/innodb_plugin suite/innodb_plugin/t suite/innodb_plugin/r suite/innodb_plugin/include \
 	suite/engines suite/engines/funcs suite/engines/iuds suite/engines/rr_trx \
 	suite/engines/funcs/r suite/engines/funcs/t suite/engines/iuds/r \
 	suite/engines/iuds/t suite/engines/rr_trx/include suite/engines/rr_trx/r \

From 8349522bde173c1c2306b9edc4073aa9e02827d9 Mon Sep 17 00:00:00 2001
From: "karen.langford@oracle.com" <>
Date: Fri, 9 Jul 2010 14:23:48 +0200
Subject: [PATCH 27/45] Fix bug #55039 Failing assertion: space_id > 0 in
 fil0fil.c.

---
 storage/innodb_plugin/dict/dict0crea.c | 18 +++++++++++++++---
 storage/innodb_plugin/os/os0file.c     | 12 ++++++++++--
 2 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/storage/innodb_plugin/dict/dict0crea.c b/storage/innodb_plugin/dict/dict0crea.c
index f185371bfca..09353c45c8c 100644
--- a/storage/innodb_plugin/dict/dict0crea.c
+++ b/storage/innodb_plugin/dict/dict0crea.c
@@ -240,17 +240,29 @@ dict_build_table_def_step(
 	ibool		is_path;
 	mtr_t		mtr;
 	ulint		space = 0;
+	ibool		file_per_table;
 
 	ut_ad(mutex_own(&(dict_sys->mutex)));
 
 	table = node->table;
 
-	dict_hdr_get_new_id(&table->id, NULL,
-			    srv_file_per_table ? &space : NULL);
+	/* Cache the global variable "srv_file_per_table" to
+	a local variable before using it. Please note
+	"srv_file_per_table" is not under dict_sys mutex
+	protection, and could be changed while executing
+	this function. So better to cache the current value
+	to a local variable, and all future reference to
+	"srv_file_per_table" should use this local variable. */
+	file_per_table = srv_file_per_table;
+
+	dict_hdr_get_new_id(&table->id, NULL, NULL);
 
 	thr_get_trx(thr)->table_id = table->id;
 
-	if (srv_file_per_table) {
+	if (file_per_table) {
+		/* Get a new space id if srv_file_per_table is set */
+		dict_hdr_get_new_id(NULL, NULL, &space);
+
 		if (UNIV_UNLIKELY(space == ULINT_UNDEFINED)) {
 			return(DB_ERROR);
 		}
diff --git a/storage/innodb_plugin/os/os0file.c b/storage/innodb_plugin/os/os0file.c
index b244e3974b3..9f937b9def2 100644
--- a/storage/innodb_plugin/os/os0file.c
+++ b/storage/innodb_plugin/os/os0file.c
@@ -1339,7 +1339,11 @@ try_again:
 
 		/* When srv_file_per_table is on, file creation failure may not
 		be critical to the whole instance. Do not crash the server in
-		case of unknown errors. */
+		case of unknown errors.
+		Please note "srv_file_per_table" is a global variable with
+		no explicit synchronization protection. It could be
+		changed during this execution path. It might not have the
+		same value as the one when building the table definition */
 		if (srv_file_per_table) {
 			retry = os_file_handle_error_no_exit(name,
 						create_mode == OS_FILE_CREATE ?
@@ -1426,7 +1430,11 @@ try_again:
 
 		/* When srv_file_per_table is on, file creation failure may not
 		be critical to the whole instance. Do not crash the server in
-		case of unknown errors. */
+		case of unknown errors.
+		Please note "srv_file_per_table" is a global variable with
+		no explicit synchronization protection. It could be
+		changed during this execution path. It might not have the
+		same value as the one when building the table definition */
 		if (srv_file_per_table) {
 			retry = os_file_handle_error_no_exit(name,
 						create_mode == OS_FILE_CREATE ?

From e59f416691c9e9bb58c4158158783f35f3568f98 Mon Sep 17 00:00:00 2001
From: Alexey Kopytov <Alexey.Kopytov@sun.com>
Date: Mon, 12 Jul 2010 18:58:55 +0400
Subject: [PATCH 28/45] Bug#55061: Build failing on sol 8 x86 - assembler code
 vs            compiler problem

GCC-style inline assembly is not supported by the Sun Studio
compilers prior to version 12.

Added a check for the Sun Studio version to avoid using
_FPU_GETCW() / _FPU_SETCW() when inline assembly is
 unsupported. This can lead to some differences in floating
point calculations on Solaris 8/x86 which, however, is not worth
bothering with Sun-style assembly .il templates.
---
 sql/mysqld.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sql/mysqld.cc b/sql/mysqld.cc
index 99f16b36dfa..598db8d993c 100644
--- a/sql/mysqld.cc
+++ b/sql/mysqld.cc
@@ -190,7 +190,7 @@ typedef fp_except fp_except_t;
 # define fpu_control_t unsigned int
 # define _FPU_EXTENDED 0x300
 # define _FPU_DOUBLE 0x200
-# if defined(__GNUC__) || defined(__SUNPRO_CC)
+# if defined(__GNUC__) || (defined(__SUNPRO_CC) && __SUNPRO_CC >= 0x590)
 #  define _FPU_GETCW(cw) asm volatile ("fnstcw %0" : "=m" (*&cw))
 #  define _FPU_SETCW(cw) asm volatile ("fldcw %0" : : "m" (*&cw))
 # else

From 32dcc26b33a8516e5957e7c052593e69ec46a4b9 Mon Sep 17 00:00:00 2001
From: Georgi Kodinov <Georgi.Kodinov@Oracle.com>
Date: Mon, 19 Jul 2010 17:47:17 +0300
Subject: [PATCH 29/45] fix tree names

---
 .bzr-mysql/default.conf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.bzr-mysql/default.conf b/.bzr-mysql/default.conf
index 77df77c6021..f044f8e62da 100644
--- a/.bzr-mysql/default.conf
+++ b/.bzr-mysql/default.conf
@@ -1,4 +1,4 @@
 [MYSQL]
-post_commit_to = "dbg_mysql_security@sun.com"
-post_push_to = "dbg_mysql_security@sun.com"
-tree_name = "mysql-5.1-security"
+post_commit_to = "commits@lists.mysql.com"
+post_push_to = "commits@lists.mysql.com"
+tree_name = "mysql-5.1"

From cf5e69c9042614459b9098548be0b33cb4a4671d Mon Sep 17 00:00:00 2001
From: Sven Sandberg <sven.sandberg@oracle.com>
Date: Tue, 20 Jul 2010 17:27:13 +0200
Subject: [PATCH 30/45] BUG#55322: SHOW BINLOG EVENTS increases
 @@SESSION.MAX_ALLOWED_PACKET

Problem: when SHOW BINLOG EVENTS was issued, it increased the value of
@@session.max_allowed_packet. This allowed a non-root user to increase
the amount of memory used by her thread arbitrarily. Thus, it removes
the bound on the amount of system resources used by a client, so it
presents a security risk (DoS attack).

Fix: it is correct to increase the value of @@session.max_allowed_packet
while executing SHOW BINLOG EVENTS (see BUG 30435). However, the
increase should only be temporary. Thus, the fix is to restore the value
when SHOW BINLOG EVENTS ends.
The value of @@session.max_allowed_packet is also increased in
mysql_binlog_send (i.e., the binlog dump thread). It is not clear if this
can cause any trouble, since normally the client that issues
COM_BINLOG_DUMP will not issue any other commands that would be affected
by the increased value of @@session.max_allowed_packet. However, we
restore the value just in case.
---
 mysql-test/suite/rpl/r/rpl_packet.result |  8 +++++
 mysql-test/suite/rpl/t/rpl_packet.test   | 39 +++++++++++++++++++++++-
 sql/sql_repl.cc                          |  5 +++
 3 files changed, 51 insertions(+), 1 deletion(-)

diff --git a/mysql-test/suite/rpl/r/rpl_packet.result b/mysql-test/suite/rpl/r/rpl_packet.result
index 0a9495751fe..1ec9259a1fb 100644
--- a/mysql-test/suite/rpl/r/rpl_packet.result
+++ b/mysql-test/suite/rpl/r/rpl_packet.result
@@ -49,6 +49,14 @@ Slave_IO_Running = No (expect No)
 SELECT "Got fatal error 1236 from master when reading data from binary log: 'log event entry exceeded max_allowed_packet; Increase max_allowed_packet on master'" AS Last_IO_Error;
 Last_IO_Error
 Got fatal error 1236 from master when reading data from binary log: 'log event entry exceeded max_allowed_packet; Increase max_allowed_packet on master'
+STOP SLAVE;
+RESET SLAVE;
+RESET MASTER;
+SET @max_allowed_packet_0= @@session.max_allowed_packet;
+SHOW BINLOG EVENTS;
+SET @max_allowed_packet_1= @@session.max_allowed_packet;
+SHOW BINLOG EVENTS;
+SET @max_allowed_packet_2= @@session.max_allowed_packet;
 ==== clean up ====
 DROP TABLE t1;
 SET @@global.max_allowed_packet= 1024;
diff --git a/mysql-test/suite/rpl/t/rpl_packet.test b/mysql-test/suite/rpl/t/rpl_packet.test
index bfc144c759b..08a533e22ca 100644
--- a/mysql-test/suite/rpl/t/rpl_packet.test
+++ b/mysql-test/suite/rpl/t/rpl_packet.test
@@ -1,7 +1,12 @@
+# ==== Purpose ====
 #
 # Check replication protocol packet size handling
-# Bug#19402 SQL close to the size of the max_allowed_packet fails on slave
 #
+# ==== Related bugs ====
+# Bug#19402 SQL close to the size of the max_allowed_packet fails on slave
+# BUG#23755: Replicated event larger that max_allowed_packet infinitely re-transmits
+# BUG#42914: No LAST_IO_ERROR for max_allowed_packet errors
+# BUG#55322: SHOW BINLOG EVENTS increases @@SESSION.MAX_ALLOWED_PACKET
 
 # max-out size db name 
 source include/master-slave.inc;
@@ -119,6 +124,38 @@ let $slave_io_running= query_get_value(SHOW SLAVE STATUS, Slave_IO_Running, 1);
 let $last_io_error= query_get_value(SHOW SLAVE STATUS, Last_IO_Error, 1);
 eval SELECT "$last_io_error" AS Last_IO_Error;
 
+# Remove the bad binlog and clear error status on slave.
+STOP SLAVE;
+RESET SLAVE;
+--connection master
+RESET MASTER;
+
+
+#
+# BUG#55322: SHOW BINLOG EVENTS increases @@SESSION.MAX_ALLOWED_PACKET
+#
+# In BUG#55322, @@session.max_allowed_packet increased each time SHOW
+# BINLOG EVENTS was issued. To verify that this bug is fixed, we
+# execute SHOW BINLOG EVENTS twice and check that max_allowed_packet
+# never changes.  We turn off the result log because we don't care
+# about the contents of the binlog.
+
+--disable_result_log
+SET @max_allowed_packet_0= @@session.max_allowed_packet;
+SHOW BINLOG EVENTS;
+SET @max_allowed_packet_1= @@session.max_allowed_packet;
+SHOW BINLOG EVENTS;
+SET @max_allowed_packet_2= @@session.max_allowed_packet;
+--enable_result_log
+if (`SELECT NOT(@max_allowed_packet_0 = @max_allowed_packet_1 AND @max_allowed_packet_1 = @max_allowed_packet_2)`)
+{
+  --echo ERROR: max_allowed_packet changed after executing SHOW BINLOG EVENTS
+  --source include/show_rpl_debug_info.inc
+  SELECT @max_allowed_packet_0, @max_allowed_packet_1, @max_allowed_packet_2;
+  --die @max_allowed_packet changed after executing SHOW BINLOG EVENTS
+}
+
+
 --echo ==== clean up ====
 connection master;
 DROP TABLE t1;
diff --git a/sql/sql_repl.cc b/sql/sql_repl.cc
index c220f609c09..dcbc982b4aa 100644
--- a/sql/sql_repl.cc
+++ b/sql/sql_repl.cc
@@ -357,6 +357,7 @@ void mysql_binlog_send(THD* thd, char* log_ident, my_off_t pos,
 #ifndef DBUG_OFF
   int left_events = max_binlog_dump_events;
 #endif
+  int old_max_allowed_packet= thd->variables.max_allowed_packet;
   DBUG_ENTER("mysql_binlog_send");
   DBUG_PRINT("enter",("log_ident: '%s'  pos: %ld", log_ident, (long) pos));
 
@@ -762,6 +763,7 @@ end:
   pthread_mutex_lock(&LOCK_thread_count);
   thd->current_linfo = 0;
   pthread_mutex_unlock(&LOCK_thread_count);
+  thd->variables.max_allowed_packet= old_max_allowed_packet;
   DBUG_VOID_RETURN;
 
 err:
@@ -779,6 +781,7 @@ err:
   pthread_mutex_unlock(&LOCK_thread_count);
   if (file >= 0)
     (void) my_close(file, MYF(MY_WME));
+  thd->variables.max_allowed_packet= old_max_allowed_packet;
 
   my_message(my_errno, errmsg, MYF(0));
   DBUG_VOID_RETURN;
@@ -1422,6 +1425,7 @@ bool mysql_show_binlog_events(THD* thd)
   bool ret = TRUE;
   IO_CACHE log;
   File file = -1;
+  int old_max_allowed_packet= thd->variables.max_allowed_packet;
   DBUG_ENTER("mysql_show_binlog_events");
 
   Log_event::init_show_field_list(&field_list);
@@ -1560,6 +1564,7 @@ err:
   pthread_mutex_lock(&LOCK_thread_count);
   thd->current_linfo = 0;
   pthread_mutex_unlock(&LOCK_thread_count);
+  thd->variables.max_allowed_packet= old_max_allowed_packet;
   DBUG_RETURN(ret);
 }
 

From 17b9155f00f9f80c1c1f15bb98baebe21ac2a9e1 Mon Sep 17 00:00:00 2001
From: Davi Arnaut <davi.arnaut@oracle.com>
Date: Tue, 20 Jul 2010 14:36:15 -0300
Subject: [PATCH 31/45] Bug#54453: Failing assertion: trx->active_trans when
 renaming a            table with active trx

Essentially, the problem is that InnoDB does a implicit commit
when a cursor (table handler) is unlocked/closed, creating
a dissonance between the transaction state within the server
layer and the storage engine layer. Theoretically, a statement
transaction can encompass several table instances in a similar
manner to a multiple statement transaction, hence it does not
make sense to limit a statement transaction to the lifetime of
the table instances (cursors) used within it.

Since this particular instance of the problem is only triggerable
on 5.1 and is masked on 5.5 due 2PC being skipped (assertion is in
the prepare phase of a 2PC), the solution (which is less risky) is
to explicitly end the transaction before the cached table is unlock
on rename table.

The patch is to be null merged into trunk.
---
 mysql-test/include/commit.inc                     |  4 ++--
 mysql-test/r/commit_1innodb.result                |  4 ++--
 .../suite/innodb_plugin/r/innodb_bug54453.result  |  9 +++++++++
 .../suite/innodb_plugin/t/innodb_bug54453.test    | 15 +++++++++++++++
 sql/sql_table.cc                                  |  8 ++++++++
 5 files changed, 36 insertions(+), 4 deletions(-)
 create mode 100644 mysql-test/suite/innodb_plugin/r/innodb_bug54453.result
 create mode 100644 mysql-test/suite/innodb_plugin/t/innodb_bug54453.test

diff --git a/mysql-test/include/commit.inc b/mysql-test/include/commit.inc
index d91ba8291fd..d412eae8364 100644
--- a/mysql-test/include/commit.inc
+++ b/mysql-test/include/commit.inc
@@ -725,9 +725,9 @@ call p_verify_status_increment(4, 4, 4, 4);
 alter table t3 add column (b int);
 call p_verify_status_increment(2, 0, 2, 0);
 alter table t3 rename t4;
-call p_verify_status_increment(2, 2, 2, 2);
+call p_verify_status_increment(1, 0, 1, 0);
 rename table t4 to t3;
-call p_verify_status_increment(2, 2, 2, 2);
+call p_verify_status_increment(1, 0, 1, 0);
 truncate table t3;
 call p_verify_status_increment(4, 4, 4, 4);
 create view v1 as select * from t2;
diff --git a/mysql-test/r/commit_1innodb.result b/mysql-test/r/commit_1innodb.result
index 51c4ac3002c..1f0b2c8019b 100644
--- a/mysql-test/r/commit_1innodb.result
+++ b/mysql-test/r/commit_1innodb.result
@@ -841,11 +841,11 @@ call p_verify_status_increment(2, 0, 2, 0);
 SUCCESS
 
 alter table t3 rename t4;
-call p_verify_status_increment(2, 2, 2, 2);
+call p_verify_status_increment(1, 0, 1, 0);
 SUCCESS
 
 rename table t4 to t3;
-call p_verify_status_increment(2, 2, 2, 2);
+call p_verify_status_increment(1, 0, 1, 0);
 SUCCESS
 
 truncate table t3;
diff --git a/mysql-test/suite/innodb_plugin/r/innodb_bug54453.result b/mysql-test/suite/innodb_plugin/r/innodb_bug54453.result
new file mode 100644
index 00000000000..e623989a9d4
--- /dev/null
+++ b/mysql-test/suite/innodb_plugin/r/innodb_bug54453.result
@@ -0,0 +1,9 @@
+#
+# Bug#54453: Failing assertion: trx->active_trans when renaming a table with active trx
+#
+DROP TABLE IF EXISTS bug54453;
+CREATE TABLE bug54453(a INT) ENGINE=InnoDB;
+ALTER TABLE bug54453 RENAME TO bug54453_2;
+SELECT * FROM bug54453_2;
+a
+DROP TABLE bug54453_2;
diff --git a/mysql-test/suite/innodb_plugin/t/innodb_bug54453.test b/mysql-test/suite/innodb_plugin/t/innodb_bug54453.test
new file mode 100644
index 00000000000..486695d326d
--- /dev/null
+++ b/mysql-test/suite/innodb_plugin/t/innodb_bug54453.test
@@ -0,0 +1,15 @@
+--source include/have_innodb_plugin.inc
+--source include/have_log_bin.inc
+
+--echo #
+--echo # Bug#54453: Failing assertion: trx->active_trans when renaming a table with active trx
+--echo #
+
+--disable_warnings
+DROP TABLE IF EXISTS bug54453;
+--enable_warnings
+
+CREATE TABLE bug54453(a INT) ENGINE=InnoDB;
+ALTER TABLE bug54453 RENAME TO bug54453_2;
+SELECT * FROM bug54453_2;
+DROP TABLE bug54453_2;
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index 50045ec6d90..47b91fcca0e 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -6848,6 +6848,14 @@ view_err:
     if (!error && (new_name != table_name || new_db != db))
     {
       thd_proc_info(thd, "rename");
+
+      /*
+        Workaround InnoDB ending the transaction when the table instance
+        is unlocked/closed (close_cached_table below), otherwise the trx
+        state will differ between the server and storage engine layers.
+      */
+      ha_autocommit_or_rollback(thd, 0);
+
       /*
         Then do a 'simple' rename of the table. First we need to close all
         instances of 'source' table.

From d676c3ff0eef8613ac689df8ed07ecdd0a39817b Mon Sep 17 00:00:00 2001
From: Davi Arnaut <davi.arnaut@oracle.com>
Date: Tue, 20 Jul 2010 14:44:29 -0300
Subject: [PATCH 32/45] Bug#52514: mysql 5.1 do_abi_check does not compile w/
 gcc4.5            due to GCC preprocessor change

The problem is that newer GCC versions treats missing headers
as fatal errors. The solution is to use a guard macro to prevent
the inclusion of system headers when checking the ABI with the
C Preprocessor.

Reference: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=15638
           http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44836
---
 Makefile.am        |  2 +-
 configure.in       | 11 +----------
 include/mysql.h    |  2 ++
 include/mysql.h.pp |  1 -
 4 files changed, 4 insertions(+), 12 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 7953b81fb7b..4ce753ad8aa 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -314,7 +314,7 @@ abi_check_all:	$(TEST_PREPROCESSOR_HEADER)
 do_abi_check:
 	set -ex; \
 	for file in $(abi_headers); do \
-	         @CC@ -E -nostdinc -dI \
+	         @CC@ -E -nostdinc -dI -DMYSQL_ABI_CHECK \
 	                  -I$(top_srcdir)/include \
 	                  -I$(top_srcdir)/include/mysql \
 	                  -I$(top_srcdir)/sql \
diff --git a/configure.in b/configure.in
index 0264c351b07..8dcdecf8ea2 100644
--- a/configure.in
+++ b/configure.in
@@ -444,16 +444,7 @@ if test "$GCC" != "yes" || expr "$CC" : ".*icc.*"
 then
   ABI_CHECK=""
 else
-  # Workaround GCC >= 4.5 - See Bug#52514
-  case `$CC -dumpversion` in
-    [[4-9]].[[5-9]]*)
-      AC_MSG_WARN([ABI check disabled (GCC >= 4.5)])
-      ABI_CHECK=""
-      ;;
-    *)
-      ABI_CHECK="abi_check"
-      ;;
-  esac
+  ABI_CHECK="abi_check"
 fi
 
 AC_SUBST(ABI_CHECK)
diff --git a/include/mysql.h b/include/mysql.h
index d114afb6c93..dcf3e167e6a 100644
--- a/include/mysql.h
+++ b/include/mysql.h
@@ -44,7 +44,9 @@ extern "C" {
 #endif
 
 #ifndef _global_h				/* If not standard header */
+#ifndef MYSQL_ABI_CHECK
 #include <sys/types.h>
+#endif
 #ifdef __LCC__
 #include <winsock2.h>				/* For windows */
 #endif
diff --git a/include/mysql.h.pp b/include/mysql.h.pp
index 633cde41130..0a397863022 100644
--- a/include/mysql.h.pp
+++ b/include/mysql.h.pp
@@ -1,4 +1,3 @@
-#include <sys/types.h>
 typedef char my_bool;
 typedef int my_socket;
 #include "mysql_version.h"

From 8d407c5f704c523205d52eabd89ca7fd366cf6eb Mon Sep 17 00:00:00 2001
From: Davi Arnaut <davi.arnaut@oracle.com>
Date: Tue, 20 Jul 2010 14:55:16 -0300
Subject: [PATCH 33/45] Fix tree name.

---
 .bzr-mysql/default.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.bzr-mysql/default.conf b/.bzr-mysql/default.conf
index 4eab3d239d0..658c8ba845b 100644
--- a/.bzr-mysql/default.conf
+++ b/.bzr-mysql/default.conf
@@ -1,4 +1,4 @@
 [MYSQL]
 post_commit_to = "commits@lists.mysql.com"
 post_push_to = "commits@lists.mysql.com"
-tree_name = "mysql-trunk-bugfixing"
+tree_name = "mysql-trunk-merge"

From c96b249fc3912f7a86f885cc62da1a3eeed537c6 Mon Sep 17 00:00:00 2001
From: Davi Arnaut <davi.arnaut@oracle.com>
Date: Tue, 20 Jul 2010 15:07:36 -0300
Subject: [PATCH 34/45] Bug#45288: pb2 returns a lot of compilation warnings on
 linux

Fix warnings flagged by the new warning option -Wunused-but-set-variable
that was added to GCC 4.6 and that is enabled by -Wunused and -Wall. The
option causes a warning whenever a local variable is assigned to but is
later unused. It also warns about meaningless pointer dereferences.
---
 client/mysql.cc                               |  4 +-
 client/mysql_upgrade.c                        |  5 +-
 extra/comp_err.c                              |  2 -
 extra/yassl/src/yassl_imp.cpp                 | 24 ++----
 include/my_pthread.h                          |  5 +-
 include/mysys_err.h                           |  4 +-
 mysys/errors.c                                |  6 +-
 mysys/mf_iocache.c                            | 11 ++-
 mysys/my_copy.c                               | 20 ++++-
 mysys/my_redel.c                              | 24 ++++--
 regex/engine.c                                | 17 ++---
 .../instance-manager/instance_options.cc      |  3 -
 sql/field.cc                                  |  2 -
 sql/item.cc                                   |  7 +-
 sql/log.cc                                    | 73 ++++++++++---------
 sql/mysqld.cc                                 |  7 +-
 sql/partition_info.cc                         |  2 -
 sql/slave.cc                                  |  7 +-
 sql/spatial.cc                                |  3 +-
 sql/sql_acl.cc                                |  2 -
 sql/sql_base.cc                               | 14 +---
 sql/sql_load.cc                               | 13 ++--
 sql/sql_parse.cc                              | 17 +++--
 sql/sql_repl.cc                               |  7 +-
 sql/sql_show.cc                               |  4 +-
 sql/sql_table.cc                              |  2 -
 sql/table.cc                                  |  3 +-
 sql/udf_example.c                             |  2 +-
 storage/csv/ha_tina.cc                        | 12 +--
 storage/example/ha_example.cc                 |  2 +-
 storage/myisam/mi_locking.c                   | 14 +---
 storage/myisam/rt_split.c                     |  3 -
 storage/myisammrg/myrg_open.c                 |  5 --
 strings/decimal.c                             |  3 +-
 34 files changed, 155 insertions(+), 174 deletions(-)

diff --git a/client/mysql.cc b/client/mysql.cc
index edcc72b60bf..5b90f318629 100644
--- a/client/mysql.cc
+++ b/client/mysql.cc
@@ -3639,7 +3639,7 @@ xmlencode_print(const char *src, uint length)
     tee_fputs("NULL", PAGER);
   else
   {
-    for (const char *p = src; length; *p++, length--)
+    for (const char *p = src; length; p++, length--)
     {
       const char *t;
       if ((t = array_value(xmlmeta, *p)))
@@ -4726,7 +4726,7 @@ static const char* construct_prompt()
   struct tm *t = localtime(&lclock);
 
   /* parse thru the settings for the prompt */
-  for (char *c = current_prompt; *c ; *c++)
+  for (char *c = current_prompt; *c ; c++)
   {
     if (*c != PROMPT_CHAR)
 	processed_prompt.append(*c);
diff --git a/client/mysql_upgrade.c b/client/mysql_upgrade.c
index 0b8b43775ed..3122cc25731 100644
--- a/client/mysql_upgrade.c
+++ b/client/mysql_upgrade.c
@@ -595,7 +595,10 @@ static int upgrade_already_done(void)
 
   my_fclose(in, MYF(0));
 
-  return (strncmp(buf, MYSQL_SERVER_VERSION,
+  if (!res)
+    return 0; /* Could not read from file => not sure */
+
+  return (strncmp(res, MYSQL_SERVER_VERSION,
                   sizeof(MYSQL_SERVER_VERSION)-1)==0);
 }
 
diff --git a/extra/comp_err.c b/extra/comp_err.c
index c02c7ca3d2a..7e0b47a7dc7 100644
--- a/extra/comp_err.c
+++ b/extra/comp_err.c
@@ -831,7 +831,6 @@ static struct message *parse_message_string(struct message *new_message,
 static struct errors *parse_error_string(char *str, int er_count)
 {
   struct errors *new_error;
-  char *start;
   DBUG_ENTER("parse_error_string");
   DBUG_PRINT("enter", ("str: %s", str));
 
@@ -842,7 +841,6 @@ static struct errors *parse_error_string(char *str, int er_count)
     DBUG_RETURN(0);				/* OOM: Fatal error */
 
   /* getting the error name */
-  start= str;
   str= skip_delimiters(str);
 
   if (!(new_error->er_name= get_word(&str)))
diff --git a/extra/yassl/src/yassl_imp.cpp b/extra/yassl/src/yassl_imp.cpp
index f079df8c7ce..86799f961ae 100644
--- a/extra/yassl/src/yassl_imp.cpp
+++ b/extra/yassl/src/yassl_imp.cpp
@@ -884,21 +884,19 @@ void Alert::Process(input_buffer& input, SSL& ssl)
         else
             hmac(ssl, verify, data, aSz, alert, true);
 
-        // read mac and fill
+        // read mac and skip fill
         int    digestSz = ssl.getCrypto().get_digest().get_digestSize();
         opaque mac[SHA_LEN];
         input.read(mac, digestSz);
 
         if (ssl.getSecurity().get_parms().cipher_type_ == block) {
             int    ivExtra = 0;
-        opaque fill;
 
             if (ssl.isTLSv1_1())
                 ivExtra = ssl.getCrypto().get_cipher().get_blockSize();
             int padSz = ssl.getSecurity().get_parms().encrypt_size_ - ivExtra -
                         aSz - digestSz;
-        for (int i = 0; i < padSz; i++) 
-            fill = input[AUTO];
+            input.set_current(input.get_current() + padSz);
         }
 
         // verify
@@ -981,17 +979,17 @@ output_buffer& operator<<(output_buffer& output, const Data& data)
 void Data::Process(input_buffer& input, SSL& ssl)
 {
     int msgSz = ssl.getSecurity().get_parms().encrypt_size_;
-    int pad   = 0, padByte = 0;
+    int pad   = 0, padSz = 0;
     int ivExtra = 0;
 
     if (ssl.getSecurity().get_parms().cipher_type_ == block) {
         if (ssl.isTLSv1_1())  // IV
             ivExtra = ssl.getCrypto().get_cipher().get_blockSize();
         pad = *(input.get_buffer() + input.get_current() + msgSz -ivExtra - 1);
-        padByte = 1;
+        padSz = 1;
     }
     int digestSz = ssl.getCrypto().get_digest().get_digestSize();
-    int dataSz = msgSz - ivExtra - digestSz - pad - padByte;   
+    int dataSz = msgSz - ivExtra - digestSz - pad - padSz;
     opaque verify[SHA_LEN];
 
     const byte* rawData = input.get_buffer() + input.get_current();
@@ -1020,14 +1018,10 @@ void Data::Process(input_buffer& input, SSL& ssl)
             hmac(ssl, verify, rawData, dataSz, application_data, true);
     }
 
-    // read mac and fill
+    // read mac and skip fill
     opaque mac[SHA_LEN];
-    opaque fill;
     input.read(mac, digestSz);
-    for (int i = 0; i < pad; i++) 
-        fill = input[AUTO];
-    if (padByte)
-        fill = input[AUTO];    
+    input.set_current(input.get_current() + pad + padSz);
 
     // verify
     if (dataSz) {
@@ -2073,11 +2067,9 @@ void Finished::Process(input_buffer& input, SSL& ssl)
         if (ssl.isTLSv1_1())
             ivExtra = ssl.getCrypto().get_cipher().get_blockSize();
 
-    opaque fill;
     int    padSz = ssl.getSecurity().get_parms().encrypt_size_ - ivExtra -
                      HANDSHAKE_HEADER - finishedSz - digestSz;
-    for (int i = 0; i < padSz; i++) 
-        fill = input[AUTO];
+    input.set_current(input.get_current() + padSz);
 
     // verify mac
     if (memcmp(mac, verifyMAC, digestSz)) {
diff --git a/include/my_pthread.h b/include/my_pthread.h
index eff6a677192..fec7c972a7b 100644
--- a/include/my_pthread.h
+++ b/include/my_pthread.h
@@ -269,13 +269,14 @@ int sigwait(sigset_t *setp, int *sigp);		/* Use our implemention */
   we want to make sure that no such flags are set.
 */
 #if defined(HAVE_SIGACTION) && !defined(my_sigset)
-#define my_sigset(A,B) do { struct sigaction l_s; sigset_t l_set; int l_rc; \
+#define my_sigset(A,B) do { struct sigaction l_s; sigset_t l_set;           \
+                            IF_DBUG(int l_rc);                              \
                             DBUG_ASSERT((A) != 0);                          \
                             sigemptyset(&l_set);                            \
                             l_s.sa_handler = (B);                           \
                             l_s.sa_mask   = l_set;                          \
                             l_s.sa_flags   = 0;                             \
-                            l_rc= sigaction((A), &l_s, (struct sigaction *) NULL);\
+                            IF_DBUG(l_rc=) sigaction((A), &l_s, NULL);      \
                             DBUG_ASSERT(l_rc == 0);                         \
                           } while (0)
 #elif defined(HAVE_SIGSET) && !defined(my_sigset)
diff --git a/include/mysys_err.h b/include/mysys_err.h
index 09e77248c17..6294b37f773 100644
--- a/include/mysys_err.h
+++ b/include/mysys_err.h
@@ -62,7 +62,9 @@ extern const char * NEAR globerrs[];	/* my_error_messages is here */
 #define EE_UNKNOWN_COLLATION	28
 #define EE_FILENOTFOUND		29
 #define EE_FILE_NOT_CLOSED	30
-#define EE_ERROR_LAST           30 /* Copy last error nr */
+#define EE_CHANGE_OWNERSHIP     31
+#define EE_CHANGE_PERMISSIONS   32
+#define EE_ERROR_LAST           32 /* Copy last error nr */
 /* Add error numbers before EE_ERROR_LAST and change it accordingly. */
 
   /* exit codes for all MySQL programs */
diff --git a/mysys/errors.c b/mysys/errors.c
index 8d3303cac9f..a5ad4a956ab 100644
--- a/mysys/errors.c
+++ b/mysys/errors.c
@@ -49,7 +49,9 @@ const char * NEAR globerrs[GLOBERRS]=
   "Can't sync file '%s' to disk (Errcode: %d)",
   "Collation '%s' is not a compiled collation and is not specified in the '%s' file",
   "File '%s' not found (Errcode: %d)",
-  "File '%s' (fileno: %d) was not closed"
+  "File '%s' (fileno: %d) was not closed",
+  "Can't change ownership of the file '%s' (Errcode: %d)",
+  "Can't change permissions of the file '%s' (Errcode: %d)",
 };
 
 void init_glob_errs(void)
@@ -90,6 +92,8 @@ void init_glob_errs()
   EE(EE_UNKNOWN_COLLATION)= "Collation '%s' is not a compiled collation and is not specified in the %s file";
   EE(EE_FILENOTFOUND)	= "File '%s' not found (Errcode: %d)";
   EE(EE_FILE_NOT_CLOSED) = "File '%s' (fileno: %d) was not closed";
+  EE(EE_CHANGE_OWNERSHIP)   = "Can't change ownership of the file '%s' (Errcode: %d)";
+  EE(EE_CHANGE_PERMISSIONS) = "Can't change permissions of the file '%s' (Errcode: %d)";
 }
 #endif
 
diff --git a/mysys/mf_iocache.c b/mysys/mf_iocache.c
index 1a47982b221..e9b947b04a6 100644
--- a/mysys/mf_iocache.c
+++ b/mysys/mf_iocache.c
@@ -1701,16 +1701,19 @@ int my_block_write(register IO_CACHE *info, const uchar *Buffer, size_t Count,
 #endif
 
 
-int my_b_flush_io_cache(IO_CACHE *info, int need_append_buffer_lock)
+int my_b_flush_io_cache(IO_CACHE *info,
+                        int need_append_buffer_lock __attribute__((unused)))
 {
   size_t length;
-  my_bool append_cache;
   my_off_t pos_in_file;
+  my_bool append_cache= (info->type == SEQ_READ_APPEND);
   DBUG_ENTER("my_b_flush_io_cache");
   DBUG_PRINT("enter", ("cache: 0x%lx", (long) info));
 
-  if (!(append_cache = (info->type == SEQ_READ_APPEND)))
-    need_append_buffer_lock=0;
+#ifdef THREAD
+  if (!append_cache)
+    need_append_buffer_lock= 0;
+#endif
 
   if (info->type == WRITE_CACHE || append_cache)
   {
diff --git a/mysys/my_copy.c b/mysys/my_copy.c
index 418e2b6f8a2..d0c1fc29229 100644
--- a/mysys/my_copy.c
+++ b/mysys/my_copy.c
@@ -16,6 +16,7 @@
 #include "mysys_priv.h"
 #include <my_dir.h> /* for stat */
 #include <m_string.h>
+#include "mysys_err.h"
 #if defined(HAVE_UTIME_H)
 #include <utime.h>
 #elif defined(HAVE_SYS_UTIME_H)
@@ -56,7 +57,6 @@ int my_copy(const char *from, const char *to, myf MyFlags)
   File from_file,to_file;
   uchar buff[IO_SIZE];
   MY_STAT stat_buff,new_stat_buff;
-  int res;
   DBUG_ENTER("my_copy");
   DBUG_PRINT("my",("from %s to %s MyFlags %d", from, to, MyFlags));
 
@@ -102,9 +102,23 @@ int my_copy(const char *from, const char *to, myf MyFlags)
 
     if (MyFlags & MY_HOLD_ORIGINAL_MODES && !new_file_stat)
 	DBUG_RETURN(0);			/* File copyed but not stat */
-    res= chmod(to, stat_buff.st_mode & 07777); /* Copy modes */
+    /* Copy modes */
+    if (chmod(to, stat_buff.st_mode & 07777))
+    {
+      my_errno= errno;
+      if (MyFlags & (MY_FAE+MY_WME))
+        my_error(EE_CHANGE_PERMISSIONS, MYF(ME_BELL+ME_WAITTANG), from, errno);
+      goto err;
+    }
 #if !defined(__WIN__) && !defined(__NETWARE__)
-    res= chown(to, stat_buff.st_uid,stat_buff.st_gid); /* Copy ownership */
+    /* Copy ownership */
+    if (chown(to, stat_buff.st_uid,stat_buff.st_gid))
+    {
+      my_errno= errno;
+      if (MyFlags & (MY_FAE+MY_WME))
+        my_error(EE_CHANGE_OWNERSHIP, MYF(ME_BELL+ME_WAITTANG), from, errno);
+      goto err;
+    }
 #endif
 #if !defined(VMS) && !defined(__ZTC__)
     if (MyFlags & MY_COPYTIME)
diff --git a/mysys/my_redel.c b/mysys/my_redel.c
index 6521253f949..4013c5c8323 100644
--- a/mysys/my_redel.c
+++ b/mysys/my_redel.c
@@ -76,11 +76,8 @@ end:
 int my_copystat(const char *from, const char *to, int MyFlags)
 {
   struct stat statbuf;
-#if !defined(__WIN__) && !defined(__NETWARE__)
-  int res;
-#endif
 
-  if (stat((char*) from, &statbuf))
+  if (stat(from, &statbuf))
   {
     my_errno=errno;
     if (MyFlags & (MY_FAE+MY_WME))
@@ -89,7 +86,15 @@ int my_copystat(const char *from, const char *to, int MyFlags)
   }
   if ((statbuf.st_mode & S_IFMT) != S_IFREG)
     return 1;
-  VOID(chmod(to, statbuf.st_mode & 07777));		/* Copy modes */
+
+  /* Copy modes */
+  if (chmod(to, statbuf.st_mode & 07777))
+  {
+    my_errno= errno;
+    if (MyFlags & (MY_FAE+MY_WME))
+      my_error(EE_CHANGE_PERMISSIONS, MYF(ME_BELL+ME_WAITTANG), from, errno);
+    return -1;
+  }
 
 #if !defined(__WIN__) && !defined(__NETWARE__)
   if (statbuf.st_nlink > 1 && MyFlags & MY_LINK_WARNING)
@@ -97,7 +102,14 @@ int my_copystat(const char *from, const char *to, int MyFlags)
     if (MyFlags & MY_LINK_WARNING)
       my_error(EE_LINK_WARNING,MYF(ME_BELL+ME_WAITTANG),from,statbuf.st_nlink);
   }
-  res= chown(to, statbuf.st_uid, statbuf.st_gid);	/* Copy ownership */
+  /* Copy ownership */
+  if (chown(to, statbuf.st_uid, statbuf.st_gid))
+  {
+    my_errno= errno;
+    if (MyFlags & (MY_FAE+MY_WME))
+      my_error(EE_CHANGE_OWNERSHIP, MYF(ME_BELL+ME_WAITTANG), from, errno);
+    return -1;
+  }
 #endif /* !__WIN__ && !__NETWARE__ */
 
 #ifndef VMS
diff --git a/regex/engine.c b/regex/engine.c
index 1968ca61a96..be08adf8601 100644
--- a/regex/engine.c
+++ b/regex/engine.c
@@ -256,7 +256,6 @@ sopno stopst;
 	register char *ssp;	/* start of string matched by subsubRE */
 	register char *sep;	/* end of string matched by subsubRE */
 	register char *oldssp;	/* previous ssp */
-	register char *dp;      /* used in debug mode to check asserts */
 
 	AT("diss", start, stop, startst, stopst);
 	sp = start;
@@ -314,11 +313,9 @@ sopno stopst;
 			ssub = ss + 1;
 			esub = es - 1;
 			/* did innards match? */
-			if (slow(charset, m, sp, rest, ssub, esub) != NULL) {
-				dp = dissect(charset, m, sp, rest, ssub, esub);
-				assert(dp == rest);
-			} else		/* no */
-				assert(sp == rest);
+			if (slow(charset, m, sp, rest, ssub, esub) != NULL)
+				sp = dissect(charset, m, sp, rest, ssub, esub);
+			assert(sp == rest);
 			sp = rest;
 			break;
 		case OPLUS_:
@@ -353,8 +350,8 @@ sopno stopst;
 			}
 			assert(sep == rest);	/* must exhaust substring */
 			assert(slow(charset, m, ssp, sep, ssub, esub) == rest);
-			dp = dissect(charset, m, ssp, sep, ssub, esub);
-			assert(dp == sep);
+			sp = dissect(charset, m, ssp, sep, ssub, esub);
+			assert(sp == sep);
 			sp = rest;
 			break;
 		case OCH_:
@@ -388,8 +385,8 @@ sopno stopst;
 				else
 					assert(OP(m->g->strip[esub]) == O_CH);
 			}
-			dp = dissect(charset, m, sp, rest, ssub, esub);
-			assert(dp == rest);
+			sp = dissect(charset, m, sp, rest, ssub, esub);
+			assert(sp == rest);
 			sp = rest;
 			break;
 		case O_PLUS:
diff --git a/server-tools/instance-manager/instance_options.cc b/server-tools/instance-manager/instance_options.cc
index 8b96d6f0f96..725089e2f42 100644
--- a/server-tools/instance-manager/instance_options.cc
+++ b/server-tools/instance-manager/instance_options.cc
@@ -303,7 +303,6 @@ bool Instance_options::fill_log_options()
   enum { MAX_LOG_OPTION_LENGTH= 256 };
   char datadir[MAX_LOG_OPTION_LENGTH];
   char hostname[MAX_LOG_OPTION_LENGTH];
-  uint hostname_length;
   struct log_files_st
   {
     const char *name;
@@ -335,8 +334,6 @@ bool Instance_options::fill_log_options()
     strmov(hostname, "mysql");
 
   hostname[MAX_LOG_OPTION_LENGTH - 1]= 0; /* Safety */
-  hostname_length= strlen(hostname);
-
 
   for (log_files= logs_st; log_files->name; log_files++)
   {
diff --git a/sql/field.cc b/sql/field.cc
index c648b53e139..c887a5f1c9b 100644
--- a/sql/field.cc
+++ b/sql/field.cc
@@ -5541,7 +5541,6 @@ int Field_date::store(const char *from, uint len,CHARSET_INFO *cs)
 int Field_date::store(double nr)
 {
   longlong tmp;
-  int error= 0;
   if (nr >= 19000000000000.0 && nr <= 99991231235959.0)
     nr=floor(nr/1000000.0);			// Timestamp to date
   if (nr < 0.0 || nr > 99991231.0)
@@ -5550,7 +5549,6 @@ int Field_date::store(double nr)
     set_datetime_warning(MYSQL_ERROR::WARN_LEVEL_WARN,
                          ER_WARN_DATA_OUT_OF_RANGE,
                          nr, MYSQL_TIMESTAMP_DATE);
-    error= 1;
   }
   else
     tmp= (longlong) rint(nr);
diff --git a/sql/item.cc b/sql/item.cc
index db2c4c0974b..66c5314c16e 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -255,11 +255,10 @@ my_decimal *Item::val_decimal_from_int(my_decimal *decimal_value)
 my_decimal *Item::val_decimal_from_string(my_decimal *decimal_value)
 {
   String *res;
-  char *end_ptr;
-  if (!(res= val_str(&str_value)))
-    return 0;                                   // NULL or EOM
 
-  end_ptr= (char*) res->ptr()+ res->length();
+  if (!(res= val_str(&str_value)))
+    return NULL;
+
   if (str2my_decimal(E_DEC_FATAL_ERROR & ~E_DEC_BAD_NUM,
                      res->ptr(), res->length(), res->charset(),
                      decimal_value) & E_DEC_BAD_NUM)
diff --git a/sql/log.cc b/sql/log.cc
index d8d5f6fa418..614a07e6b63 100644
--- a/sql/log.cc
+++ b/sql/log.cc
@@ -5050,6 +5050,22 @@ void sql_perror(const char *message)
 }
 
 
+/*
+  Unfortunately, there seems to be no good way
+  to restore the original streams upon failure.
+*/
+static bool redirect_std_streams(const char *file)
+{
+  if (freopen(file, "a+", stdout) && freopen(file, "a+", stderr))
+  {
+    setbuf(stderr, NULL);
+    return FALSE;
+  }
+
+  return TRUE;
+}
+
+
 bool flush_error_log()
 {
   bool result=0;
@@ -5077,11 +5093,7 @@ bool flush_error_log()
       setbuf(stderr, NULL);
       (void) my_delete(err_renamed, MYF(0));
       my_rename(log_error_file,err_renamed,MYF(0));
-      if (freopen(log_error_file,"a+",stdout))
-      {
-        freopen(log_error_file,"a+",stderr);
-        setbuf(stderr, NULL);
-      }
+      redirect_std_streams(log_error_file);
 
       if ((fd = my_open(err_temp, O_RDONLY, MYF(0))) >= 0)
       {
@@ -5096,13 +5108,7 @@ bool flush_error_log()
      result= 1;
 #else
    my_rename(log_error_file,err_renamed,MYF(0));
-   if (freopen(log_error_file,"a+",stdout))
-   {
-     FILE *reopen;
-     reopen= freopen(log_error_file,"a+",stderr);
-     setbuf(stderr, NULL);
-   }
-   else
+   if (redirect_std_streams(log_error_file))
      result= 1;
 #endif
     VOID(pthread_mutex_unlock(&LOCK_error_log));
@@ -5153,25 +5159,9 @@ static void print_buffer_to_nt_eventlog(enum loglevel level, char *buff,
 #endif /* __NT__ */
 
 
-/**
-  Prints a printf style message to the error log and, under NT, to the
-  Windows event log.
-
-  This function prints the message into a buffer and then sends that buffer
-  to other functions to write that message to other logging sources.
-
-  @param event_type          Type of event to write (Error, Warning, or Info)
-  @param format              Printf style format of message
-  @param args                va_list list of arguments for the message
-
-  @returns
-    The function always returns 0. The return value is present in the
-    signature to be compatible with other logging routines, which could
-    return an error (e.g. logging to the log tables)
-*/
-
 #ifndef EMBEDDED_LIBRARY
-static void print_buffer_to_file(enum loglevel level, const char *buffer)
+static void print_buffer_to_file(enum loglevel level, const char *buffer,
+                                 size_t length)
 {
   time_t skr;
   struct tm tm_tmp;
@@ -5185,7 +5175,7 @@ static void print_buffer_to_file(enum loglevel level, const char *buffer)
   localtime_r(&skr, &tm_tmp);
   start=&tm_tmp;
 
-  fprintf(stderr, "%02d%02d%02d %2d:%02d:%02d [%s] %s\n",
+  fprintf(stderr, "%02d%02d%02d %2d:%02d:%02d [%s] %.*s\n",
           start->tm_year % 100,
           start->tm_mon+1,
           start->tm_mday,
@@ -5194,7 +5184,7 @@ static void print_buffer_to_file(enum loglevel level, const char *buffer)
           start->tm_sec,
           (level == ERROR_LEVEL ? "ERROR" : level == WARNING_LEVEL ?
            "Warning" : "Note"),
-          buffer);
+          (int) length, buffer);
 
   fflush(stderr);
 
@@ -5202,7 +5192,22 @@ static void print_buffer_to_file(enum loglevel level, const char *buffer)
   DBUG_VOID_RETURN;
 }
 
+/**
+  Prints a printf style message to the error log and, under NT, to the
+  Windows event log.
 
+  This function prints the message into a buffer and then sends that buffer
+  to other functions to write that message to other logging sources.
+
+  @param level          The level of the msg significance
+  @param format         Printf style format of message
+  @param args           va_list list of arguments for the message
+
+  @returns
+    The function always returns 0. The return value is present in the
+    signature to be compatible with other logging routines, which could
+    return an error (e.g. logging to the log tables)
+*/
 int vprint_msg_to_log(enum loglevel level, const char *format, va_list args)
 {
   char   buff[1024];
@@ -5210,7 +5215,7 @@ int vprint_msg_to_log(enum loglevel level, const char *format, va_list args)
   DBUG_ENTER("vprint_msg_to_log");
 
   length= my_vsnprintf(buff, sizeof(buff), format, args);
-  print_buffer_to_file(level, buff);
+  print_buffer_to_file(level, buff, length);
 
 #ifdef __NT__
   print_buffer_to_nt_eventlog(level, buff, length, sizeof(buff));
@@ -5218,7 +5223,7 @@ int vprint_msg_to_log(enum loglevel level, const char *format, va_list args)
 
   DBUG_RETURN(0);
 }
-#endif /*EMBEDDED_LIBRARY*/
+#endif /* EMBEDDED_LIBRARY */
 
 
 void sql_print_error(const char *format, ...) 
diff --git a/sql/mysqld.cc b/sql/mysqld.cc
index 99f16b36dfa..fda64e5a1ea 100644
--- a/sql/mysqld.cc
+++ b/sql/mysqld.cc
@@ -3783,7 +3783,6 @@ static void end_ssl()
 
 static int init_server_components()
 {
-  FILE* reopen;
   DBUG_ENTER("init_server_components");
   /*
     We need to call each of these following functions to ensure that
@@ -3826,8 +3825,8 @@ static int init_server_components()
       if (freopen(log_error_file, "a+", stdout))
 #endif
       {
-        reopen= freopen(log_error_file, "a+", stderr);
-        setbuf(stderr, NULL);
+        if (freopen(log_error_file, "a+", stderr))
+          setbuf(stderr, NULL);
       }
     }
   }
@@ -8222,7 +8221,7 @@ mysqld_get_one_option(int optid,
     *val= 0;
     val+= 2;
     while (*val && my_isspace(mysqld_charset, *val))
-      *val++;
+      val++;
     if (!*val)
     {
       sql_print_error("Bad syntax in replicate-rewrite-db - empty TO db!\n");
diff --git a/sql/partition_info.cc b/sql/partition_info.cc
index d85888e295c..f37151ea51d 100644
--- a/sql/partition_info.cc
+++ b/sql/partition_info.cc
@@ -1206,13 +1206,11 @@ bool partition_info::set_up_charset_field_preps()
     i= 0;
     while ((field= *(ptr++)))
     {
-      CHARSET_INFO *cs;
       uchar *field_buf;
       LINT_INIT(field_buf);
 
       if (!field_is_partition_charset(field))
         continue;
-      cs= ((Field_str*)field)->charset();
       size= field->pack_length();
       if (!(field_buf= (uchar*) sql_calloc(size)))
         goto error;
diff --git a/sql/slave.cc b/sql/slave.cc
index 795bc481071..f1e0962e7e8 100644
--- a/sql/slave.cc
+++ b/sql/slave.cc
@@ -3035,11 +3035,8 @@ log '%s' at position %s, relay log '%s' position: %s", RPL_LOG_NAME,
   pthread_mutex_lock(&rli->data_lock);
   if (rli->slave_skip_counter)
   {
-    char *pos;
-    pos= strmake(saved_log_name, rli->group_relay_log_name, FN_REFLEN - 1);
-    pos= '\0';
-    pos= strmake(saved_master_log_name, rli->group_master_log_name, FN_REFLEN - 1);
-    pos= '\0';
+    strmake(saved_log_name, rli->group_relay_log_name, FN_REFLEN - 1);
+    strmake(saved_master_log_name, rli->group_master_log_name, FN_REFLEN - 1);
     saved_log_pos= rli->group_relay_log_pos;
     saved_master_log_pos= rli->group_master_log_pos;
     saved_skip= rli->slave_skip_counter;
diff --git a/sql/spatial.cc b/sql/spatial.cc
index 11df6c00dc5..2305a8eb97d 100644
--- a/sql/spatial.cc
+++ b/sql/spatial.cc
@@ -159,11 +159,10 @@ Geometry *Geometry::construct(Geometry_buffer *buffer,
 {
   uint32 geom_type;
   Geometry *result;
-  char byte_order;
 
   if (data_len < SRID_SIZE + WKB_HEADER_SIZE)   // < 4 + (1 + 4)
     return NULL;
-  byte_order= data[SRID_SIZE];
+  /* + 1 to skip the byte order (stored in position SRID_SIZE). */
   geom_type= uint4korr(data + SRID_SIZE + 1);
   if (!(result= create_by_typeid(buffer, (int) geom_type)))
     return NULL;
diff --git a/sql/sql_acl.cc b/sql/sql_acl.cc
index 90eef872115..b507b70d1fb 100644
--- a/sql/sql_acl.cc
+++ b/sql/sql_acl.cc
@@ -5701,7 +5701,6 @@ bool mysql_create_user(THD *thd, List <LEX_USER> &list)
 {
   int result;
   String wrong_users;
-  ulong sql_mode;
   LEX_USER *user_name, *tmp_user_name;
   List_iterator <LEX_USER> user_list(list);
   TABLE_LIST tables[GRANT_TABLES];
@@ -5748,7 +5747,6 @@ bool mysql_create_user(THD *thd, List <LEX_USER> &list)
     }
 
     some_users_created= TRUE;
-    sql_mode= thd->variables.sql_mode;
     if (replace_user_table(thd, tables[0].table, *user_name, 0, 0, 1, 0))
     {
       append_user(&wrong_users, user_name);
diff --git a/sql/sql_base.cc b/sql/sql_base.cc
index d2392bdd9b1..c38526a6d0b 100644
--- a/sql/sql_base.cc
+++ b/sql/sql_base.cc
@@ -5674,7 +5674,7 @@ static void update_field_dependencies(THD *thd, Field *field, TABLE *table)
   DBUG_ENTER("update_field_dependencies");
   if (thd->mark_used_columns != MARK_COLUMNS_NONE)
   {
-    MY_BITMAP *current_bitmap, *other_bitmap;
+    MY_BITMAP *bitmap;
 
     /*
       We always want to register the used keys, as the column bitmap may have
@@ -5685,15 +5685,9 @@ static void update_field_dependencies(THD *thd, Field *field, TABLE *table)
     table->merge_keys.merge(field->part_of_key);
 
     if (thd->mark_used_columns == MARK_COLUMNS_READ)
-    {
-      current_bitmap= table->read_set;
-      other_bitmap=   table->write_set;
-    }
+      bitmap= table->read_set;
     else
-    {
-      current_bitmap= table->write_set;
-      other_bitmap=   table->read_set;
-    }
+      bitmap= table->write_set;
 
     /* 
        The test-and-set mechanism in the bitmap is not reliable during
@@ -5702,7 +5696,7 @@ static void update_field_dependencies(THD *thd, Field *field, TABLE *table)
        only those columns that are used in the SET clause. I.e they are being
        set here. See multi_update::prepare()
     */
-    if (bitmap_fast_test_and_set(current_bitmap, field->field_index))
+    if (bitmap_fast_test_and_set(bitmap, field->field_index))
     {
       if (thd->mark_used_columns == MARK_COLUMNS_WRITE)
       {
diff --git a/sql/sql_load.cc b/sql/sql_load.cc
index ee7481234a4..a4cf46b35e8 100644
--- a/sql/sql_load.cc
+++ b/sql/sql_load.cc
@@ -128,6 +128,7 @@ int mysql_load(THD *thd,sql_exchange *ex,TABLE_LIST *table_list,
   bool is_fifo=0;
 #ifndef EMBEDDED_LIBRARY
   LOAD_FILE_INFO lf_info;
+  THD::killed_state killed_status;
 #endif
   char *db = table_list->db;			// This is never null
   /*
@@ -138,7 +139,6 @@ int mysql_load(THD *thd,sql_exchange *ex,TABLE_LIST *table_list,
   char *tdb= thd->db ? thd->db : db;		// Result is never null
   ulong skip_lines= ex->skip_lines;
   bool transactional_table;
-  THD::killed_state killed_status= THD::NOT_KILLED;
   DBUG_ENTER("mysql_load");
 
 #ifdef EMBEDDED_LIBRARY
@@ -455,7 +455,11 @@ int mysql_load(THD *thd,sql_exchange *ex,TABLE_LIST *table_list,
                     error=1;
                     thd->killed= THD::KILL_QUERY;
                   };);
-  killed_status= (error == 0)? THD::NOT_KILLED : thd->killed;
+
+#ifndef EMBEDDED_LIBRARY
+  killed_status= (error == 0) ? THD::NOT_KILLED : thd->killed;
+#endif
+
   /*
     We must invalidate the table in query cache before binlog writing and
     ha_autocommit_...
@@ -708,12 +712,9 @@ read_fixed_length(THD *thd, COPY_INFO &info, TABLE_LIST *table_list,
   List_iterator_fast<Item> it(fields_vars);
   Item_field *sql_field;
   TABLE *table= table_list->table;
-  ulonglong id;
   bool err;
   DBUG_ENTER("read_fixed_length");
 
-  id= 0;
- 
   while (!read_info.read_fixed_length())
   {
     if (thd->killed)
@@ -839,12 +840,10 @@ read_sep_field(THD *thd, COPY_INFO &info, TABLE_LIST *table_list,
   Item *item;
   TABLE *table= table_list->table;
   uint enclosed_length;
-  ulonglong id;
   bool err;
   DBUG_ENTER("read_sep_field");
 
   enclosed_length=enclosed.length();
-  id= 0;
 
   for (;;it.rewind())
   {
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 1f3d29ffec0..134517e5bf7 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -465,6 +465,12 @@ static void handle_bootstrap_impl(THD *thd)
       }
       buff= (char*) thd->net.buff;
       res= fgets(buff + length, thd->net.max_packet - length, file);
+      if (!res && !feof(file))
+      {
+        net_end_statement(thd);
+        bootstrap_error= 1;
+        break;
+      }
       length+= (ulong) strlen(buff + length);
       /* purecov: end */
     }
@@ -1535,7 +1541,7 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
   {
     STATUS_VAR current_global_status_var;
     ulong uptime;
-    uint length;
+    uint length __attribute__((unused));
     ulonglong queries_per_second1000;
     char buff[250];
     uint buff_len= sizeof(buff);
@@ -1548,7 +1554,7 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
     else
       queries_per_second1000= thd->query_id * LL(1000) / uptime;
 
-    length= my_snprintf((char*) buff, buff_len - 1,
+    length= my_snprintf(buff, buff_len - 1,
                         "Uptime: %lu  Threads: %d  Questions: %lu  "
                         "Slow queries: %lu  Opens: %lu  Flush tables: %lu  "
                         "Open tables: %u  Queries per second avg: %u.%u",
@@ -1560,10 +1566,6 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
                         cached_open_tables(),
                         (uint) (queries_per_second1000 / 1000),
                         (uint) (queries_per_second1000 % 1000));
-#ifdef EMBEDDED_LIBRARY
-    /* Store the buffer in permanent memory */
-    my_ok(thd, 0, 0, buff);
-#endif
 #ifdef SAFEMALLOC
     if (sf_malloc_cur_memory)				// Using SAFEMALLOC
     {
@@ -1578,6 +1580,9 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
     VOID(my_net_write(net, (uchar*) buff, length));
     VOID(net_flush(net));
     thd->main_da.disable_status();
+#else
+    /* Store the buffer in permanent memory */
+    my_ok(thd, 0, 0, buff);
 #endif
     break;
   }
diff --git a/sql/sql_repl.cc b/sql/sql_repl.cc
index f6045e4704e..d7dd3eb63f2 100644
--- a/sql/sql_repl.cc
+++ b/sql/sql_repl.cc
@@ -1168,12 +1168,9 @@ bool change_master(THD* thd, Master_info* mi)
   /*
     Before processing the command, save the previous state.
   */
-  char *pos;
-  pos= strmake(saved_host, mi->host, HOSTNAME_LENGTH);
-  pos= '\0';
+  strmake(saved_host, mi->host, HOSTNAME_LENGTH);
   saved_port= mi->port;
-  pos= strmake(saved_log_name, mi->master_log_name, FN_REFLEN - 1);
-  pos= '\0';
+  strmake(saved_log_name, mi->master_log_name, FN_REFLEN - 1);
   saved_log_pos= mi->master_log_pos;
 
   /*
diff --git a/sql/sql_show.cc b/sql/sql_show.cc
index d0e76e501e2..eb5d3a1965d 100644
--- a/sql/sql_show.cc
+++ b/sql/sql_show.cc
@@ -3868,7 +3868,6 @@ static int get_schema_column_record(THD *thd, TABLE_LIST *tables,
     uint flags=field->flags;
     char tmp[MAX_FIELD_WIDTH];
     String type(tmp,sizeof(tmp), system_charset_info);
-    char *end;
     int decimals, field_length;
 
     if (wild && wild[0] &&
@@ -3889,7 +3888,7 @@ static int get_schema_column_record(THD *thd, TABLE_LIST *tables,
                                  field->field_name) & COL_ACLS;
     if (!tables->schema_table && !col_access)
       continue;
-    end= tmp;
+    char *end= tmp;
     for (uint bitnr=0; col_access ; col_access>>=1,bitnr++)
     {
       if (col_access & 1)
@@ -4015,7 +4014,6 @@ static int get_schema_column_record(THD *thd, TABLE_LIST *tables,
     table->field[15]->store((const char*) pos,
                             strlen((const char*) pos), cs);
 
-    end= tmp;
     if (field->unireg_check == Field::NEXT_NUMBER)
       table->field[16]->store(STRING_WITH_LEN("auto_increment"), cs);
     if (show_table->timestamp_field == field &&
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index 47b91fcca0e..f765e5c5cae 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -6507,7 +6507,6 @@ bool mysql_alter_table(THD *thd,char *new_db, char *new_name,
   uint index_add_count= 0;
   uint *index_add_buffer= NULL;
   uint candidate_key_count= 0;
-  bool committed= 0;
   bool no_pk;
   DBUG_ENTER("mysql_alter_table");
 
@@ -7380,7 +7379,6 @@ view_err:
     DBUG_PRINT("info", ("Committing before unlocking table"));
     if (ha_autocommit_or_rollback(thd, 0) || end_active_trans(thd))
       goto err1;
-    committed= 1;
   }
   /*end of if (! new_table) for add/drop index*/
 
diff --git a/sql/table.cc b/sql/table.cc
index dde3654dab1..e989ab039a0 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -534,7 +534,7 @@ int open_table_def(THD *thd, TABLE_SHARE *share, uint db_flags)
   int error, table_type;
   bool error_given;
   File file;
-  uchar head[288], *disk_buff;
+  uchar head[288];
   char	path[FN_REFLEN];
   MEM_ROOT **root_ptr, *old_root;
   DBUG_ENTER("open_table_def");
@@ -543,7 +543,6 @@ int open_table_def(THD *thd, TABLE_SHARE *share, uint db_flags)
 
   error= 1;
   error_given= 0;
-  disk_buff= NULL;
 
   strxmov(path, share->normalized_path.str, reg_ext, NullS);
   if ((file= my_open(path, O_RDONLY | O_SHARE, MYF(0))) < 0)
diff --git a/sql/udf_example.c b/sql/udf_example.c
index 637293209e0..468118b44ef 100644
--- a/sql/udf_example.c
+++ b/sql/udf_example.c
@@ -1067,7 +1067,7 @@ char *myfunc_argument_name(UDF_INIT *initid __attribute__((unused)),
 {
   if (!args->attributes[0])
   {
-    null_value= 0;
+    *null_value= 1;
     return 0;
   }
   (*length)--; /* space for ending \0 (for debugging purposes) */
diff --git a/storage/csv/ha_tina.cc b/storage/csv/ha_tina.cc
index e3bc7f55dd2..5a3399b2401 100644
--- a/storage/csv/ha_tina.cc
+++ b/storage/csv/ha_tina.cc
@@ -468,7 +468,7 @@ int ha_tina::encode_quote(uchar *buf)
     const char *ptr;
     const char *end_ptr;
     const bool was_null= (*field)->is_null();
-    
+
     /*
       assistance for backwards compatibility in production builds.
       note: this will not work for ENUM columns.
@@ -480,7 +480,7 @@ int ha_tina::encode_quote(uchar *buf)
     }
 
     (*field)->val_str(&attribute,&attribute);
-    
+
     if (was_null)
       (*field)->set_null();
 
@@ -491,34 +491,30 @@ int ha_tina::encode_quote(uchar *buf)
 
       buffer.append('"');
 
-      while (ptr < end_ptr) 
+      for (; ptr < end_ptr; ptr++)
       {
         if (*ptr == '"')
         {
           buffer.append('\\');
           buffer.append('"');
-          *ptr++;
         }
         else if (*ptr == '\r')
         {
           buffer.append('\\');
           buffer.append('r');
-          *ptr++;
         }
         else if (*ptr == '\\')
         {
           buffer.append('\\');
           buffer.append('\\');
-          *ptr++;
         }
         else if (*ptr == '\n')
         {
           buffer.append('\\');
           buffer.append('n');
-          *ptr++;
         }
         else
-          buffer.append(*ptr++);
+          buffer.append(*ptr);
       }
       buffer.append('"');
     }
diff --git a/storage/example/ha_example.cc b/storage/example/ha_example.cc
index 604722c3c8c..2a4fe538c85 100644
--- a/storage/example/ha_example.cc
+++ b/storage/example/ha_example.cc
@@ -153,7 +153,7 @@ static int example_done_func(void *p)
   hash_free(&example_open_tables);
   pthread_mutex_destroy(&example_mutex);
 
-  DBUG_RETURN(0);
+  DBUG_RETURN(error);
 }
 
 
diff --git a/storage/myisam/mi_locking.c b/storage/myisam/mi_locking.c
index 342efff4842..589b9cf89b7 100644
--- a/storage/myisam/mi_locking.c
+++ b/storage/myisam/mi_locking.c
@@ -29,7 +29,6 @@ int mi_lock_database(MI_INFO *info, int lock_type)
   int error;
   uint count;
   MYISAM_SHARE *share=info->s;
-  uint flag;
   DBUG_ENTER("mi_lock_database");
   DBUG_PRINT("enter",("lock_type: %d  old lock %d  r_locks: %u  w_locks: %u "
                       "global_changed:  %d  open_count: %u  name: '%s'",
@@ -48,7 +47,7 @@ int mi_lock_database(MI_INFO *info, int lock_type)
     DBUG_RETURN(0);
   }
 
-  flag=error=0;
+  error= 0;
   pthread_mutex_lock(&share->intern_lock);
   if (share->kfile >= 0)		/* May only be false on windows */
   {
@@ -120,14 +119,12 @@ int mi_lock_database(MI_INFO *info, int lock_type)
 	{
 	  if (share->r_locks)
 	  {					/* Only read locks left */
-	    flag=1;
 	    if (my_lock(share->kfile,F_RDLCK,0L,F_TO_EOF,
 			MYF(MY_WME | MY_SEEK_NOT_DONE)) && !error)
 	      error=my_errno;
 	  }
 	  else if (!share->w_locks)
 	  {					/* No more locks */
-	    flag=1;
 	    if (my_lock(share->kfile,F_UNLCK,0L,F_TO_EOF,
 			MYF(MY_WME | MY_SEEK_NOT_DONE)) && !error)
 	      error=my_errno;
@@ -148,7 +145,6 @@ int mi_lock_database(MI_INFO *info, int lock_type)
         */
 	if (share->w_locks == 1)
 	{
-	  flag=1;
           if (my_lock(share->kfile,lock_type,0L,F_TO_EOF,
 		      MYF(MY_SEEK_NOT_DONE)))
 	  {
@@ -163,7 +159,6 @@ int mi_lock_database(MI_INFO *info, int lock_type)
       }
       if (!share->r_locks && !share->w_locks)
       {
-	flag=1;
 	if (my_lock(share->kfile,lock_type,0L,F_TO_EOF,
 		    info->lock_wait | MY_SEEK_NOT_DONE))
 	{
@@ -188,7 +183,6 @@ int mi_lock_database(MI_INFO *info, int lock_type)
       {						/* Change READONLY to RW */
 	if (share->r_locks == 1)
 	{
-	  flag=1;
 	  if (my_lock(share->kfile,lock_type,0L,F_TO_EOF,
 		      MYF(info->lock_wait | MY_SEEK_NOT_DONE)))
 	  {
@@ -205,7 +199,6 @@ int mi_lock_database(MI_INFO *info, int lock_type)
       {
 	if (!share->w_locks)
 	{
-	  flag=1;
 	  if (my_lock(share->kfile,lock_type,0L,F_TO_EOF,
 		      info->lock_wait | MY_SEEK_NOT_DONE))
 	  {
@@ -252,11 +245,6 @@ int mi_lock_database(MI_INFO *info, int lock_type)
   }
 #endif
   pthread_mutex_unlock(&share->intern_lock);
-#if defined(FULL_LOG) || defined(_lint)
-  lock_type|=(int) (flag << 8);		/* Set bit to set if real lock */
-  myisam_log_command(MI_LOG_LOCK,info,(uchar*) &lock_type,sizeof(lock_type),
-		     error);
-#endif
   DBUG_RETURN(error);
 } /* mi_lock_database */
 
diff --git a/storage/myisam/rt_split.c b/storage/myisam/rt_split.c
index 88cf643faf9..03d22de68fa 100644
--- a/storage/myisam/rt_split.c
+++ b/storage/myisam/rt_split.c
@@ -255,7 +255,6 @@ int rtree_split_page(MI_INFO *info, MI_KEYDEF *keyinfo, uchar *page, uchar *key,
   SplitStruct *stop;
   double *coord_buf;
   double *next_coord;
-  double *old_coord;
   int n_dim;
   uchar *source_cur, *cur1, *cur2;
   uchar *new_page= info->buff;
@@ -293,8 +292,6 @@ int rtree_split_page(MI_INFO *info, MI_KEYDEF *keyinfo, uchar *page, uchar *key,
   rtree_d_mbr(keyinfo->seg, key, key_length, cur->coords);
   cur->key = key;
 
-  old_coord = next_coord;
-
   if (split_rtree_node(task, max_keys + 1,
        mi_getint(page) + full_length + 2, full_length, 
        rt_PAGE_MIN_SIZE(keyinfo->block_length),
diff --git a/storage/myisammrg/myrg_open.c b/storage/myisammrg/myrg_open.c
index 5fcbe0c3297..18f8aa8d2c0 100644
--- a/storage/myisammrg/myrg_open.c
+++ b/storage/myisammrg/myrg_open.c
@@ -227,9 +227,7 @@ MYRG_INFO *myrg_parent_open(const char *parent_name,
   int       save_errno;
   int       insert_method;
   uint      length;
-  uint      dir_length;
   uint      child_count;
-  size_t    name_buff_length;
   File      fd;
   IO_CACHE  file_cache;
   char      parent_name_buff[FN_REFLEN * 2];
@@ -299,7 +297,6 @@ MYRG_INFO *myrg_parent_open(const char *parent_name,
   }
 
   /* Call callback for each child. */
-  dir_length= dirname_part(parent_name_buff, parent_name, &name_buff_length);
   my_b_seek(&file_cache, 0);
   while ((length= my_b_gets(&file_cache, child_name_buff, FN_REFLEN - 1)))
   {
@@ -379,7 +376,6 @@ int myrg_attach_children(MYRG_INFO *m_info, int handle_locking,
 {
   ulonglong  file_offset;
   MI_INFO    *myisam;
-  int        rc;
   int        errpos;
   int        save_errno;
   uint       idx;
@@ -398,7 +394,6 @@ int myrg_attach_children(MYRG_INFO *m_info, int handle_locking,
     here and in ha_myisammrg::store_lock() forces consistent data.
   */
   pthread_mutex_lock(&m_info->mutex);
-  rc= 1;
   errpos= 0;
   file_offset= 0;
   min_keys= 0;
diff --git a/strings/decimal.c b/strings/decimal.c
index 4403fc9fd6b..bda296ce832 100644
--- a/strings/decimal.c
+++ b/strings/decimal.c
@@ -1934,8 +1934,7 @@ static int do_sub(decimal_t *from1, decimal_t *from2, decimal_t *to)
 int decimal_intg(decimal_t *from)
 {
   int res;
-  dec1 *tmp_res;
-  tmp_res= remove_leading_zeroes(from, &res);
+  remove_leading_zeroes(from, &res);
   return res;
 }
 

From 5b19c1593f2fce7c6e912b176f3b8ff34b61c280 Mon Sep 17 00:00:00 2001
From: Davi Arnaut <davi.arnaut@oracle.com>
Date: Tue, 20 Jul 2010 16:34:20 -0300
Subject: [PATCH 35/45] Bug#52514: mysql 5.1 do_abi_check does not compile w/
 gcc4.5            due to GCC preprocessor change

Addendum for trunk: do not include system header when checking
the ABI.
---
 include/mysql/plugin.h.pp           | 3 ---
 include/mysql/service_my_snprintf.h | 3 +++
 include/mysql/service_thd_alloc.h   | 2 ++
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/include/mysql/plugin.h.pp b/include/mysql/plugin.h.pp
index 3a1b03742da..ce9902ee418 100644
--- a/include/mysql/plugin.h.pp
+++ b/include/mysql/plugin.h.pp
@@ -1,7 +1,5 @@
 #include <mysql/services.h>
 #include <mysql/service_my_snprintf.h>
-#include <stdarg.h>
-#include <stdlib.h>
 extern struct my_snprintf_service_st {
   size_t (*my_snprintf_type)(char*, size_t, const char*, ...);
   size_t (*my_vsnprintf_type)(char *, size_t, const char*, va_list);
@@ -9,7 +7,6 @@ extern struct my_snprintf_service_st {
 size_t my_snprintf(char* to, size_t n, const char* fmt, ...);
 size_t my_vsnprintf(char *to, size_t n, const char* fmt, va_list ap);
 #include <mysql/service_thd_alloc.h>
-#include <stdlib.h>
 struct st_mysql_lex_string
 {
   char *str;
diff --git a/include/mysql/service_my_snprintf.h b/include/mysql/service_my_snprintf.h
index 9e5fe7f9c9f..d7f8d07e110 100644
--- a/include/mysql/service_my_snprintf.h
+++ b/include/mysql/service_my_snprintf.h
@@ -70,8 +70,11 @@
 extern "C" {
 #endif
 
+#ifndef MYSQL_ABI_CHECK
 #include <stdarg.h>
 #include <stdlib.h>
+#endif
+
 extern struct my_snprintf_service_st {
   size_t (*my_snprintf_type)(char*, size_t, const char*, ...);
   size_t (*my_vsnprintf_type)(char *, size_t, const char*, va_list);
diff --git a/include/mysql/service_thd_alloc.h b/include/mysql/service_thd_alloc.h
index 86158ba1359..7061c2bd4d5 100644
--- a/include/mysql/service_thd_alloc.h
+++ b/include/mysql/service_thd_alloc.h
@@ -27,7 +27,9 @@
   allocations - they are better served with my_malloc.
 */
 
+#ifndef MYSQL_ABI_CHECK
 #include <stdlib.h>
+#endif
 
 #ifdef __cplusplus
 extern "C" {

From 3ff34a4a325b675b12d3ef12c0fa907c5ad670d1 Mon Sep 17 00:00:00 2001
From: Davi Arnaut <davi.arnaut@oracle.com>
Date: Tue, 20 Jul 2010 16:53:39 -0300
Subject: [PATCH 36/45] Bug#52514: mysql 5.1 do_abi_check does not compile w/
 gcc4.5            due to GCC preprocessor change

Addendum for trunk: add -DMYSQL_ABI_CHECK to the cmake ABI check.
---
 Makefile.am           | 2 +-
 cmake/abi_check.cmake | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 9a9a53ebd16..a736a61fb59 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -63,7 +63,7 @@ dist-hook:
 	test ! -f $(top_srcdir)/configure.am  || \
 	$(INSTALL_DATA)  $(top_srcdir)/configure.am $(distdir)
 
-all-local:		@ABI_CHECK@	
+all-local:		@ABI_CHECK@
 
 tags:
 	support-files/build-tags
diff --git a/cmake/abi_check.cmake b/cmake/abi_check.cmake
index 0d5bf21f540..7911b7848a8 100644
--- a/cmake/abi_check.cmake
+++ b/cmake/abi_check.cmake
@@ -38,7 +38,7 @@ IF(CMAKE_COMPILER_IS_GNUCC AND CMAKE_SYSTEM_NAME MATCHES "Linux")
     -DCOMPILER=${COMPILER}
     -DSOURCE_DIR=${CMAKE_SOURCE_DIR}
     -DBINARY_DIR=${CMAKE_BINARY_DIR}
-    "-DABI_HEADERS=${API_PREPROCESSOR_HEADER}"
+    "-DDMYSQL_ABI_CHECK -DABI_HEADERS=${API_PREPROCESSOR_HEADER}"
     -P ${CMAKE_SOURCE_DIR}/cmake/do_abi_check.cmake
     VERBATIM
   )
@@ -48,7 +48,7 @@ IF(CMAKE_COMPILER_IS_GNUCC AND CMAKE_SYSTEM_NAME MATCHES "Linux")
     -DCMAKE_C_COMPILER=${COMPILER} 
     -DCMAKE_SOURCE_DIR=${CMAKE_SOURCE_DIR}
     -DCMAKE_BINARY_DIR=${CMAKE_BINARY_DIR}
-    "-DABI_HEADERS=${API_PREPROCESSOR_HEADER}"
+    "-DMYSQL_ABI_CHECK -DABI_HEADERS=${API_PREPROCESSOR_HEADER}"
     -P ${CMAKE_SOURCE_DIR}/cmake/scripts/do_abi_check.cmake
     VERBATIM
   )

From 49d327ebf763dca23969ac4afe814617815d1411 Mon Sep 17 00:00:00 2001
From: Dmitry Shulga <Dmitry.Shulga@Sun.COM>
Date: Wed, 21 Jul 2010 14:56:43 +0700
Subject: [PATCH 37/45] Fixed bug #42496 - the server could crash on a debug
 assert after a failure to write into a closed socket

---
 sql/protocol.cc    | 15 +++++++++++----
 sql/sql_cache.cc   |  3 ++-
 sql/sql_cursor.cc  |  7 ++++++-
 sql/sql_prepare.cc |  7 +++++--
 4 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/sql/protocol.cc b/sql/protocol.cc
index dc53e029647..dfb78462f13 100644
--- a/sql/protocol.cc
+++ b/sql/protocol.cc
@@ -534,7 +534,11 @@ void Protocol::end_partial_result_set(THD *thd_arg)
 bool Protocol::flush()
 {
 #ifndef EMBEDDED_LIBRARY
-  return net_flush(&thd->net);
+  bool error;
+  thd->main_da.can_overwrite_status= TRUE;
+  error= net_flush(&thd->net);
+  thd->main_da.can_overwrite_status= FALSE;
+  return error;
 #else
   return 0;
 #endif
@@ -574,7 +578,8 @@ bool Protocol::send_fields(List<Item> *list, uint flags)
   if (flags & SEND_NUM_ROWS)
   {				// Packet with number of elements
     uchar *pos= net_store_length(buff, list->elements);
-    (void) my_net_write(&thd->net, buff, (size_t) (pos-buff));
+    if (my_net_write(&thd->net, buff, (size_t) (pos-buff)))
+      DBUG_RETURN(1);
   }
 
 #ifndef DBUG_OFF
@@ -698,7 +703,7 @@ bool Protocol::send_fields(List<Item> *list, uint flags)
     if (flags & SEND_DEFAULTS)
       item->send(&prot, &tmp);			// Send default value
     if (prot.write())
-      break;					/* purecov: inspected */
+      DBUG_RETURN(1);
 #ifndef DBUG_OFF
     field_types[count++]= field.type;
 #endif
@@ -711,7 +716,9 @@ bool Protocol::send_fields(List<Item> *list, uint flags)
       to show that there is no cursor.
       Send no warning information, as it will be sent at statement end.
     */
-    write_eof_packet(thd, &thd->net, thd->server_status, thd->total_warn_count);
+    if (write_eof_packet(thd, &thd->net, thd->server_status,
+                         thd->total_warn_count))
+      DBUG_RETURN(1);
   }
   DBUG_RETURN(prepare_for_send(list));
 
diff --git a/sql/sql_cache.cc b/sql/sql_cache.cc
index f862cbed4f1..fcf4edbdc22 100644
--- a/sql/sql_cache.cc
+++ b/sql/sql_cache.cc
@@ -1653,7 +1653,8 @@ def_week_frmt: %lu, in_trans: %d, autocommit: %d",
 
   thd->limit_found_rows = query->found_rows();
   thd->status_var.last_query_cost= 0.0;
-  thd->main_da.disable_status();
+  if (!thd->main_da.is_set())
+    thd->main_da.disable_status();
 
   BLOCK_UNLOCK_RD(query_block);
   DBUG_RETURN(1);				// Result sent to client
diff --git a/sql/sql_cursor.cc b/sql/sql_cursor.cc
index 6f61dc40f66..d7d029d28d4 100644
--- a/sql/sql_cursor.cc
+++ b/sql/sql_cursor.cc
@@ -658,7 +658,12 @@ void Materialized_cursor::fetch(ulong num_rows)
     if ((res= table->file->rnd_next(table->record[0])))
       break;
     /* Send data only if the read was successful. */
-    result->send_data(item_list);
+    /*
+      If network write failed (i.e. due to a closed socked),
+      the error has already been set. Just return.
+    */
+    if (result->send_data(item_list))
+      return;
   }
 
   switch (res) {
diff --git a/sql/sql_prepare.cc b/sql/sql_prepare.cc
index 041d9f7c30b..bd152866deb 100644
--- a/sql/sql_prepare.cc
+++ b/sql/sql_prepare.cc
@@ -263,8 +263,11 @@ static bool send_prep_stmt(Prepared_statement *stmt, uint columns)
                                           &stmt->lex->param_list,
                                           Protocol::SEND_EOF);
   }
-  /* Flag that a response has already been sent */
-  thd->main_da.disable_status();
+
+  if (!error)
+    /* Flag that a response has already been sent */
+    thd->main_da.disable_status();
+
   DBUG_RETURN(error);
 }
 #else

From 047d47241c6e0eff1e5b55f9f34b28049c4ed989 Mon Sep 17 00:00:00 2001
From: Georgi Kodinov <Georgi.Kodinov@Oracle.com>
Date: Wed, 21 Jul 2010 18:05:57 +0300
Subject: [PATCH 38/45] Addendum #4 to bug #53095

SHOW DATABASES LIKE ... was not converting to lowercase on comparison as the
documentation is suggesting.
Fixed it to behave similarly to SHOW TABLES LIKE ... and updated the failing
on MacOSX lowercase_table2 test case.
---
 mysql-test/r/lowercase_table2.result |  3 ++-
 sql/sql_show.cc                      | 15 +++++++++++++--
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/mysql-test/r/lowercase_table2.result b/mysql-test/r/lowercase_table2.result
index 51c2ac0faf5..c9a46b70fab 100644
--- a/mysql-test/r/lowercase_table2.result
+++ b/mysql-test/r/lowercase_table2.result
@@ -56,6 +56,7 @@ CREATE DATABASE `TEST_$1`;
 SHOW DATABASES LIKE "TEST%";
 Database (TEST%)
 TEST_$1
+test
 DROP DATABASE `test_$1`;
 CREATE TABLE T1 (a int) engine=innodb;
 INSERT INTO T1 VALUES (1);
@@ -171,6 +172,6 @@ create table myUC (i int);
 select TABLE_SCHEMA,TABLE_NAME FROM information_schema.TABLES
 where TABLE_SCHEMA ='mysqltest_LC2';
 TABLE_SCHEMA	TABLE_NAME
-mysqltest_LC2	myUC
+mysqltest_lc2	myUC
 use test;
 drop database mysqltest_LC2;
diff --git a/sql/sql_show.cc b/sql/sql_show.cc
index eb5d3a1965d..616bced8f4a 100644
--- a/sql/sql_show.cc
+++ b/sql/sql_show.cc
@@ -521,8 +521,19 @@ find_files(THD *thd, List<LEX_STRING> *files, const char *db,
         continue;
 
       file_name_len= filename_to_tablename(file->name, uname, sizeof(uname));
-      if (wild && wild_compare(uname, wild, 0))
-        continue;
+      if (wild)
+      {
+	if (lower_case_table_names)
+	{
+          if (my_wildcmp(files_charset_info,
+                         uname, uname + file_name_len,
+                         wild, wild + wild_length,
+                         wild_prefix, wild_one,wild_many))
+            continue;
+	}
+	else if (wild_compare(uname, wild, 0))
+	  continue;
+      }
       if (!(file_name= 
             thd->make_lex_string(file_name, uname, file_name_len, TRUE)))
       {

From 11b0caf1d6fe5311784e8d4129b1fef7b84caa72 Mon Sep 17 00:00:00 2001
From: "kevin.lewis@oracle.com" <>
Date: Thu, 22 Jul 2010 11:15:15 -0500
Subject: [PATCH 39/45] Bug#49542 - Do as the comment suggests and downgrade
 directory errors from find_file() to a warning unless they happen during a
 SHOW command.

---
 sql/sql_show.cc | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/sql/sql_show.cc b/sql/sql_show.cc
index eb5d3a1965d..c979d44dc1c 100644
--- a/sql/sql_show.cc
+++ b/sql/sql_show.cc
@@ -1,4 +1,4 @@
-/* Copyright 2000-2008 MySQL AB, 2008 Sun Microsystems, Inc.
+/* Copyright 2000, 2010 Oracle and/or its affiliates. All rights reserved.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -9,9 +9,9 @@
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
 
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA */
+   You should have received a copy of the GNU General Public License along
+   with this program; if not, write to the Free Software Foundation, Inc.,
+   51 Franklin Street, Fifth Floor, Boston, MA 02110-1301  USA */
 
 
 /* Function with list databases, tables or fields */
@@ -2986,7 +2986,7 @@ make_table_name_list(THD *thd, List<LEX_STRING> *table_names, LEX *lex,
     */
     if (res == FIND_FILES_DIR)
     {
-      if (lex->sql_command != SQLCOM_SELECT)
+      if (sql_command_flags[lex->sql_command] & CF_STATUS_COMMAND)
         return 1;
       thd->clear_error();
       return 2;

From 6af3c0f94723c1c51c0185277966239c971b66d2 Mon Sep 17 00:00:00 2001
From: Vasil Dimov <vasil.dimov@oracle.com>
Date: Fri, 23 Jul 2010 19:32:38 +0300
Subject: [PATCH 40/45] Increment InnoDB Plugin version to 1.0.11. InnoDB
 Plugin 1.0.10 has been released with MySQL 5.1.49.

---
 storage/innodb_plugin/include/univ.i | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/storage/innodb_plugin/include/univ.i b/storage/innodb_plugin/include/univ.i
index b8e595161b9..aa56c18e44e 100644
--- a/storage/innodb_plugin/include/univ.i
+++ b/storage/innodb_plugin/include/univ.i
@@ -46,7 +46,7 @@ Created 1/20/1994 Heikki Tuuri
 
 #define INNODB_VERSION_MAJOR	1
 #define INNODB_VERSION_MINOR	0
-#define INNODB_VERSION_BUGFIX	10
+#define INNODB_VERSION_BUGFIX	11
 
 /* The following is the InnoDB version as shown in
 SELECT plugin_version FROM information_schema.plugins;

From f860873c0d1a16b85388f7d02c5bd2d201087513 Mon Sep 17 00:00:00 2001
From: Davi Arnaut <davi.arnaut@oracle.com>
Date: Fri, 23 Jul 2010 21:55:03 -0300
Subject: [PATCH 41/45] Bug#55501: Disable innodb plugin usage in the embedded
 server on certain OSes

Do not attempt to test the innodb plugin with the embedded server,
it's not supported for now.
---
 mysql-test/include/have_innodb_plugin.inc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mysql-test/include/have_innodb_plugin.inc b/mysql-test/include/have_innodb_plugin.inc
index 99a79465f52..df876deb2d7 100644
--- a/mysql-test/include/have_innodb_plugin.inc
+++ b/mysql-test/include/have_innodb_plugin.inc
@@ -1,3 +1,4 @@
+--source include/not_embedded.inc
 disable_query_log;
 --require r/true.require
 SELECT (plugin_library LIKE 'ha_innodb_plugin%') AS `TRUE` FROM information_schema.plugins WHERE LOWER(plugin_name) = 'innodb' AND LOWER(plugin_status) = 'active';

From e497d6e6e1a45ffdd235e965c54ba8354bb18b83 Mon Sep 17 00:00:00 2001
From: Alexander Barkov <bar@mysql.com>
Date: Mon, 26 Jul 2010 09:06:18 +0400
Subject: [PATCH 42/45] Bug#45012 my_like_range_cp932 generates invalid string

Problem: The functions my_like_range_xxx() returned
badly formed maximum strings for Asian character sets,
which made problems for storage engines.

Fix:
- Removed a number my_like_range_xxx() implementations,
  which were in fact dumplicate code pieces.
- Using generic my_like_range_mb() instead.
- Setting max_sort_char member properly for Asian character sets
- Adding unittest/strings/strings-t.c,
  to test that my_like_range_xxx() return well-formed
  min and max strings.

Notes:

- No additional tests in mysql/t/ available.
  Old tests cover the affected code well enough.
---
 configure.in                 |   3 +-
 strings/ctype-big5.c         |  86 +-------------------------
 strings/ctype-cp932.c        |  76 +----------------------
 strings/ctype-euc_kr.c       |   4 +-
 strings/ctype-eucjpms.c      |   4 +-
 strings/ctype-gb2312.c       |   4 +-
 strings/ctype-gbk.c          |  86 +-------------------------
 strings/ctype-mb.c           |  22 +++++--
 strings/ctype-sjis.c         |  85 +-------------------------
 strings/ctype-ujis.c         |   4 +-
 unittest/Makefile.am         |   4 +-
 unittest/strings/Makefile.am |  27 +++++++++
 unittest/strings/strings-t.c | 114 +++++++++++++++++++++++++++++++++++
 13 files changed, 181 insertions(+), 338 deletions(-)
 create mode 100644 unittest/strings/Makefile.am
 create mode 100644 unittest/strings/strings-t.c

diff --git a/configure.in b/configure.in
index 0af6a92fcc9..efd291f953c 100644
--- a/configure.in
+++ b/configure.in
@@ -2880,7 +2880,8 @@ fi
 
 AC_CONFIG_FILES(Makefile extra/Makefile mysys/Makefile dnl
  unittest/Makefile unittest/mytap/Makefile unittest/mytap/t/Makefile dnl
- unittest/mysys/Makefile unittest/examples/Makefile dnl
+ unittest/mysys/Makefile unittest/strings/Makefile dnl
+ unittest/examples/Makefile dnl
  strings/Makefile regex/Makefile storage/Makefile dnl
  man/Makefile BUILD/Makefile vio/Makefile dnl
  libmysql/Makefile libmysql_r/Makefile client/Makefile dnl
diff --git a/strings/ctype-big5.c b/strings/ctype-big5.c
index 3da307b82fc..2cb40c266d2 100644
--- a/strings/ctype-big5.c
+++ b/strings/ctype-big5.c
@@ -377,86 +377,6 @@ static int my_strxfrm_big5(uchar *dest, const uchar *src, int len)
 #endif
 
 
-/*
-** Calculate min_str and max_str that ranges a LIKE string.
-** Arguments:
-** ptr		Pointer to LIKE string.
-** ptr_length	Length of LIKE string.
-** escape	Escape character in LIKE.  (Normally '\').
-**		All escape characters should be removed from min_str and max_str
-** res_length   Length of min_str and max_str.
-** min_str      Smallest case sensitive string that ranges LIKE.
-**		Should be space padded to res_length.
-** max_str	Largest case sensitive string that ranges LIKE.
-**		Normally padded with the biggest character sort value.
-**
-** The function should return 0 if ok and 1 if the LIKE string can't be
-** optimized !
-*/
-
-#define max_sort_char ((char) 255)
-
-static my_bool my_like_range_big5(CHARSET_INFO *cs __attribute__((unused)),
-				  const char *ptr,size_t ptr_length,
-				  pbool escape, pbool w_one, pbool w_many,
-				  size_t res_length,
-                                  char *min_str, char *max_str,
-				  size_t *min_length, size_t *max_length)
-{
-  const char *end= ptr + ptr_length;
-  char *min_org=min_str;
-  char *min_end=min_str+res_length;
-  size_t charlen= res_length / cs->mbmaxlen;
-
-  for (; ptr != end && min_str != min_end && charlen > 0; ptr++, charlen--)
-  {
-    if (ptr+1 != end && isbig5code(ptr[0],ptr[1]))
-    {
-      *min_str++= *max_str++ = *ptr++;
-      *min_str++= *max_str++ = *ptr;
-      continue;
-    }
-    if (*ptr == escape && ptr+1 != end)
-    {
-      ptr++;				/* Skip escape */
-      if (isbig5code(ptr[0], ptr[1]))
-        *min_str++= *max_str++ = *ptr++;
-      if (min_str < min_end)
-        *min_str++= *max_str++= *ptr;
-      continue;
-    }
-    if (*ptr == w_one)			/* '_' in SQL */
-    {
-      *min_str++='\0';			/* This should be min char */
-      *max_str++=max_sort_char;
-      continue;
-    }
-    if (*ptr == w_many)		/* '%' in SQL */
-    {
-      /*
-        Calculate length of keys:
-        'a\0\0... is the smallest possible string when we have space expand
-        a\ff\ff... is the biggest possible string
-      */
-      *min_length= ((cs->state & MY_CS_BINSORT) ? (size_t) (min_str - min_org) :
-                    res_length);
-      *max_length= res_length;
-      do {
-	*min_str++ = 0;
-	*max_str++ = max_sort_char;
-      } while (min_str != min_end);
-      return 0;
-    }
-    *min_str++= *max_str++ = *ptr;
-  }
-
- *min_length= *max_length= (size_t) (min_str-min_org);
-  while (min_str != min_end)
-    *min_str++= *max_str++= ' ';
-  return 0;
-}
-
-
 static uint ismbchar_big5(CHARSET_INFO *cs __attribute__((unused)),
                          const char* p, const char *e)
 {
@@ -6338,7 +6258,7 @@ static MY_COLLATION_HANDLER my_collation_big5_chinese_ci_handler =
   my_strnncollsp_big5,
   my_strnxfrm_big5,
   my_strnxfrmlen_simple,
-  my_like_range_big5,
+  my_like_range_mb,
   my_wildcmp_mb,
   my_strcasecmp_mb,
   my_instr_mb,
@@ -6402,7 +6322,7 @@ CHARSET_INFO my_charset_big5_chinese_ci=
     1,			/* mbminlen   */
     2,			/* mbmaxlen   */
     0,			/* min_sort_char */
-    255,		/* max_sort_char */
+    0xF9D5,		/* max_sort_char */
     ' ',                /* pad char      */
     1,                  /* escape_with_backslash_is_dangerous */
     &my_charset_big5_handler,
@@ -6435,7 +6355,7 @@ CHARSET_INFO my_charset_big5_bin=
     1,			/* mbminlen   */
     2,			/* mbmaxlen   */
     0,			/* min_sort_char */
-    255,		/* max_sort_char */
+    0xF9FE,		/* max_sort_char */
     ' ',                /* pad char      */
     1,                  /* escape_with_backslash_is_dangerous */
     &my_charset_big5_handler,
diff --git a/strings/ctype-cp932.c b/strings/ctype-cp932.c
index 07191c436b7..238c6f61baa 100644
--- a/strings/ctype-cp932.c
+++ b/strings/ctype-cp932.c
@@ -306,76 +306,6 @@ static size_t my_strnxfrm_cp932(CHARSET_INFO *cs __attribute__((unused)),
 }
 
 
-/*
-** Calculate min_str and max_str that ranges a LIKE string.
-** Arguments:
-** ptr		Pointer to LIKE string.
-** ptr_length	Length of LIKE string.
-** escape	Escape character in LIKE.  (Normally '\').
-**		All escape characters should be removed from min_str and max_str
-** res_length	Length of min_str and max_str.
-** min_str	Smallest case sensitive string that ranges LIKE.
-**		Should be space padded to res_length.
-** max_str	Largest case sensitive string that ranges LIKE.
-**		Normally padded with the biggest character sort value.
-**
-** The function should return 0 if ok and 1 if the LIKE string can't be
-** optimized !
-*/
-
-#define max_sort_char ((char) 255)
-
-static my_bool my_like_range_cp932(CHARSET_INFO *cs __attribute__((unused)),
-                                   const char *ptr,size_t ptr_length,
-                                   pbool escape, pbool w_one, pbool w_many,
-                                   size_t res_length,
-                                   char *min_str,char *max_str,
-                                   size_t *min_length, size_t *max_length)
-{
-  const char *end=ptr+ptr_length;
-  char *min_org=min_str;
-  char *min_end=min_str+res_length;
-
-  while (ptr < end && min_str < min_end) {
-    if (ismbchar_cp932(cs, ptr, end)) {
-      *min_str++ = *max_str++ = *ptr++;
-      if (min_str < min_end)
-	*min_str++ = *max_str++ = *ptr++;
-      continue;
-    }
-    if (*ptr == escape && ptr+1 < end) {
-      ptr++;				/* Skip escape */
-      if (ismbchar_cp932(cs, ptr, end))
-	*min_str++ = *max_str++ = *ptr++;
-      if (min_str < min_end)
-	*min_str++ = *max_str++ = *ptr++;
-      continue;
-    }
-    if (*ptr == w_one) {		/* '_' in SQL */
-      *min_str++ = '\0';		/* This should be min char */
-      *max_str++ = max_sort_char;
-      ptr++;
-      continue;
-    }
-    if (*ptr == w_many)
-    {						/* '%' in SQL */
-      *min_length = (size_t)(min_str - min_org);
-      *max_length = res_length;
-      do
-      {
-	*min_str++= 0;
-	*max_str++= max_sort_char;
-      } while (min_str < min_end);
-      return 0;
-    }
-    *min_str++ = *max_str++ = *ptr++;
-  }
-  *min_length = *max_length = (size_t) (min_str - min_org);
-  while (min_str < min_end)
-    *min_str++ = *max_str++ = ' ';	/* Because if key compression */
-  return 0;
-}
-
 /* page 0 0x00A1-0x00DF */
 static uint16 tab_cp932_uni0[]={
 0xFF61,0xFF62,0xFF63,0xFF64,0xFF65,0xFF66,0xFF67,0xFF68,
@@ -5467,7 +5397,7 @@ static MY_COLLATION_HANDLER my_collation_ci_handler =
   my_strnncollsp_cp932,
   my_strnxfrm_cp932,
   my_strnxfrmlen_simple,
-  my_like_range_cp932,
+  my_like_range_mb,
   my_wildcmp_mb,	/* wildcmp  */
   my_strcasecmp_8bit,
   my_instr_mb,
@@ -5533,7 +5463,7 @@ CHARSET_INFO my_charset_cp932_japanese_ci=
     1,			/* mbminlen   */
     2,			/* mbmaxlen */
     0,			/* min_sort_char */
-    255,		/* max_sort_char */
+    0xFCFC,		/* max_sort_char */
     ' ',                /* pad char      */
     1,                  /* escape_with_backslash_is_dangerous */
     &my_charset_handler,
@@ -5565,7 +5495,7 @@ CHARSET_INFO my_charset_cp932_bin=
     1,			/* mbminlen   */
     2,			/* mbmaxlen */
     0,			/* min_sort_char */
-    255,		/* max_sort_char */
+    0xFCFC,		/* max_sort_char */
     ' ',                /* pad char      */
     1,                  /* escape_with_backslash_is_dangerous */
     &my_charset_handler,
diff --git a/strings/ctype-euc_kr.c b/strings/ctype-euc_kr.c
index fc0af7e35d5..ee957304716 100644
--- a/strings/ctype-euc_kr.c
+++ b/strings/ctype-euc_kr.c
@@ -8762,7 +8762,7 @@ CHARSET_INFO my_charset_euckr_korean_ci=
     1,			/* mbminlen   */
     2,			/* mbmaxlen   */
     0,			/* min_sort_char */
-    255,		/* max_sort_char */
+    0xFEFE,		/* max_sort_char */
     ' ',                /* pad char      */
     0,                  /* escape_with_backslash_is_dangerous */
     &my_charset_handler,
@@ -8795,7 +8795,7 @@ CHARSET_INFO my_charset_euckr_bin=
     1,			/* mbminlen   */
     2,			/* mbmaxlen   */
     0,			/* min_sort_char */
-    255,		/* max_sort_char */
+    0xFEFE,		/* max_sort_char */
     ' ',                /* pad char      */
     0,                  /* escape_with_backslash_is_dangerous */
     &my_charset_handler,
diff --git a/strings/ctype-eucjpms.c b/strings/ctype-eucjpms.c
index b8b04dfca6b..615981b4d27 100644
--- a/strings/ctype-eucjpms.c
+++ b/strings/ctype-eucjpms.c
@@ -8710,7 +8710,7 @@ CHARSET_INFO my_charset_eucjpms_japanese_ci=
     1,			/* mbminlen     */
     3,			/* mbmaxlen     */
     0,			/* min_sort_char */
-    255,		/* max_sort_char */
+    0xFEFE,		/* max_sort_char */
     ' ',		/* pad_char      */
     0,                  /* escape_with_backslash_is_dangerous */
     &my_charset_handler,
@@ -8743,7 +8743,7 @@ CHARSET_INFO my_charset_eucjpms_bin=
     1,			/* mbminlen     */
     3,			/* mbmaxlen     */
     0,			/* min_sort_char */
-    255,		/* max_sort_char */
+    0xFEFE,		/* max_sort_char */
     ' ',		/* pad_char      */
     0,                  /* escape_with_backslash_is_dangerous */
     &my_charset_handler,
diff --git a/strings/ctype-gb2312.c b/strings/ctype-gb2312.c
index 0267f35ff5c..84f67dbbc2e 100644
--- a/strings/ctype-gb2312.c
+++ b/strings/ctype-gb2312.c
@@ -5790,7 +5790,7 @@ CHARSET_INFO my_charset_gb2312_chinese_ci=
     1,			/* mbminlen   */
     2,			/* mbmaxlen   */
     0,			/* min_sort_char */
-    255,		/* max_sort_char */
+    0xF7FE,		/* max_sort_char */
     ' ',                /* pad char      */
     0,                  /* escape_with_backslash_is_dangerous */
     &my_charset_handler,
@@ -5822,7 +5822,7 @@ CHARSET_INFO my_charset_gb2312_bin=
     1,			/* mbminlen   */
     2,			/* mbmaxlen   */
     0,			/* min_sort_char */
-    255,		/* max_sort_char */
+    0xF7FE,		/* max_sort_char */
     ' ',                /* pad char      */
     0,                  /* escape_with_backslash_is_dangerous */
     &my_charset_handler,
diff --git a/strings/ctype-gbk.c b/strings/ctype-gbk.c
index 7b8bb85652b..89607823d34 100644
--- a/strings/ctype-gbk.c
+++ b/strings/ctype-gbk.c
@@ -2690,86 +2690,6 @@ static size_t my_strnxfrm_gbk(CHARSET_INFO *cs __attribute__((unused)),
 }
 
 
-/*
-** Calculate min_str and max_str that ranges a LIKE string.
-** Arguments:
-** ptr		Pointer to LIKE string.
-** ptr_length	Length of LIKE string.
-** escape	Escape character in LIKE.  (Normally '\').
-**		All escape characters should be removed from min_str and max_str
-** res_length   Length of min_str and max_str.
-** min_str      Smallest case sensitive string that ranges LIKE.
-**		Should be space padded to res_length.
-** max_str	Largest case sensitive string that ranges LIKE.
-**		Normally padded with the biggest character sort value.
-**
-** The function should return 0 if ok and 1 if the LIKE string can't be
-** optimized !
-*/
-
-#define max_sort_char ((uchar) 255)
-
-static my_bool my_like_range_gbk(CHARSET_INFO *cs __attribute__((unused)),
-                                 const char *ptr,size_t ptr_length,
-                                 pbool escape, pbool w_one, pbool w_many,
-                                 size_t res_length,
-                                 char *min_str,char *max_str,
-                                 size_t *min_length,size_t *max_length)
-{
-  const char *end= ptr + ptr_length;
-  char *min_org=min_str;
-  char *min_end=min_str+res_length;
-  size_t charlen= res_length / cs->mbmaxlen;
-
-  for (; ptr != end && min_str != min_end && charlen > 0; ptr++, charlen--)
-  {
-    if (ptr+1 != end && isgbkcode(ptr[0],ptr[1]))
-    {
-      *min_str++= *max_str++ = *ptr++;
-      *min_str++= *max_str++ = *ptr;
-      continue;
-    }
-    if (*ptr == escape && ptr+1 != end)
-    {
-      ptr++;				/* Skip escape */
-      if (isgbkcode(ptr[0], ptr[1]))
-        *min_str++= *max_str++ = *ptr;
-      if (min_str < min_end)
-        *min_str++= *max_str++= *ptr;
-      continue;
-    }
-    if (*ptr == w_one)		/* '_' in SQL */
-    {
-      *min_str++='\0';			/* This should be min char */
-      *max_str++=max_sort_char;
-      continue;
-    }
-    if (*ptr == w_many)		/* '%' in SQL */
-    {
-      /*
-        Calculate length of keys:
-        'a\0\0... is the smallest possible string when we have space expand
-        a\ff\ff... is the biggest possible string
-      */
-      *min_length= ((cs->state & MY_CS_BINSORT) ? (size_t) (min_str - min_org) :
-                    res_length);
-      *max_length= res_length;
-      do {
-	*min_str++= 0;
-	*max_str++= max_sort_char;
-      } while (min_str != min_end);
-      return 0;
-    }
-    *min_str++= *max_str++ = *ptr;
-  }
-
-  *min_length= *max_length = (size_t) (min_str - min_org);
-  while (min_str != min_end)
-    *min_str++= *max_str++= ' ';           /* Because if key compression */
-  return 0;
-}
-
-
 static uint ismbchar_gbk(CHARSET_INFO *cs __attribute__((unused)),
 		 const char* p, const char *e)
 {
@@ -9983,7 +9903,7 @@ static MY_COLLATION_HANDLER my_collation_ci_handler =
   my_strnncollsp_gbk,
   my_strnxfrm_gbk,
   my_strnxfrmlen_simple,
-  my_like_range_gbk,
+  my_like_range_mb,
   my_wildcmp_mb,
   my_strcasecmp_mb,
   my_instr_mb,
@@ -10048,7 +9968,7 @@ CHARSET_INFO my_charset_gbk_chinese_ci=
     1,			/* mbminlen   */
     2,			/* mbmaxlen */
     0,			/* min_sort_char */
-    255,		/* max_sort_char */
+    0xA967,		/* max_sort_char */
     ' ',                /* pad char      */
     1,                  /* escape_with_backslash_is_dangerous */
     &my_charset_handler,
@@ -10080,7 +10000,7 @@ CHARSET_INFO my_charset_gbk_bin=
     1,			/* mbminlen   */
     2,			/* mbmaxlen */
     0,			/* min_sort_char */
-    255,		/* max_sort_char */
+    0xFEFE,		/* max_sort_char */
     ' ',                /* pad char      */
     1,                  /* escape_with_backslash_is_dangerous */
     &my_charset_handler,
diff --git a/strings/ctype-mb.c b/strings/ctype-mb.c
index 903811e2ab9..e3788fc4dff 100644
--- a/strings/ctype-mb.c
+++ b/strings/ctype-mb.c
@@ -498,7 +498,9 @@ static void my_hash_sort_mb_bin(CHARSET_INFO *cs __attribute__((unused)),
   DESCRIPTION
       Write max key:
       - for non-Unicode character sets:
-        just set to 255.
+        just bfill using max_sort_char if max_sort_char is one byte.
+        In case when max_sort_char is two bytes, fill with double-byte pairs
+        and optionally pad with a single space character.
       - for Unicode character set (utf-8):
         create a buffer with multibyte representation of the max_sort_char
         character, and copy it into max_str in a loop. 
@@ -510,12 +512,20 @@ static void pad_max_char(CHARSET_INFO *cs, char *str, char *end)
   
   if (!(cs->state & MY_CS_UNICODE))
   {
-    bfill(str, end - str, 255);
-    return;
+    if (cs->max_sort_char <= 255)
+    {
+      bfill(str, end - str, cs->max_sort_char);
+      return;
+    }
+    buf[0]= cs->max_sort_char >> 8;
+    buf[1]= cs->max_sort_char & 0xFF;
+    buflen= 2;
+  }
+  else
+  {
+    buflen= cs->cset->wc_mb(cs, cs->max_sort_char, (uchar*) buf,
+                            (uchar*) buf + sizeof(buf));
   }
-  
-  buflen= cs->cset->wc_mb(cs, cs->max_sort_char, (uchar*) buf,
-                          (uchar*) buf + sizeof(buf));
   
   DBUG_ASSERT(buflen > 0);
   do
diff --git a/strings/ctype-sjis.c b/strings/ctype-sjis.c
index ac426e0d7b5..3f479ffc102 100644
--- a/strings/ctype-sjis.c
+++ b/strings/ctype-sjis.c
@@ -304,85 +304,6 @@ static size_t my_strnxfrm_sjis(CHARSET_INFO *cs __attribute__((unused)),
 }
 
 
-/*
-** Calculate min_str and max_str that ranges a LIKE string.
-** Arguments:
-** ptr		Pointer to LIKE string.
-** ptr_length	Length of LIKE string.
-** escape	Escape character in LIKE.  (Normally '\').
-**		All escape characters should be removed from min_str and max_str
-** res_length	Length of min_str and max_str.
-** min_str	Smallest case sensitive string that ranges LIKE.
-**		Should be space padded to res_length.
-** max_str	Largest case sensitive string that ranges LIKE.
-**		Normally padded with the biggest character sort value.
-**
-** The function should return 0 if ok and 1 if the LIKE string can't be
-** optimized !
-*/
-
-#define max_sort_char ((char) 255)
-
-static my_bool my_like_range_sjis(CHARSET_INFO *cs __attribute__((unused)),
-				  const char *ptr,size_t ptr_length,
-				  pbool escape, pbool w_one, pbool w_many,
-				  size_t res_length,
-                                  char *min_str,char *max_str,
-				  size_t *min_length,size_t *max_length)
-{
-  const char *end= ptr + ptr_length;
-  char *min_org=min_str;
-  char *min_end=min_str+res_length;
-  size_t charlen= res_length / cs->mbmaxlen;
-
-  for ( ; ptr < end && min_str < min_end && charlen > 0 ; charlen--)
-  {
-    if (ismbchar_sjis(cs, ptr, end)) {
-      *min_str++ = *max_str++ = *ptr++;
-      if (min_str < min_end)
-	*min_str++ = *max_str++ = *ptr++;
-      continue;
-    }
-    if (*ptr == escape && ptr+1 < end) {
-      ptr++;				/* Skip escape */
-      if (ismbchar_sjis(cs, ptr, end))
-	*min_str++ = *max_str++ = *ptr++;
-      if (min_str < min_end)
-	*min_str++ = *max_str++ = *ptr++;
-      continue;
-    }
-    if (*ptr == w_one) {		/* '_' in SQL */
-      *min_str++ = '\0';		/* This should be min char */
-      *max_str++ = max_sort_char;
-      ptr++;
-      continue;
-    }
-    if (*ptr == w_many)
-    {						/* '%' in SQL */
-      /*
-        Calculate length of keys:
-        'a\0\0... is the smallest possible string when we have space expand
-        a\ff\ff... is the biggest possible string
-      */
-      *min_length= ((cs->state & MY_CS_BINSORT) ? (size_t) (min_str - min_org) :
-                    res_length);
-      *max_length= res_length;
-      do
-      {
-	*min_str++= 0;
-	*max_str++= max_sort_char;
-      } while (min_str < min_end);
-      return 0;
-    }
-    *min_str++ = *max_str++ = *ptr++;
-  }
-
-  *min_length= *max_length= (size_t) (min_str - min_org);
-  while (min_str != min_end)
-    *min_str++= *max_str++= ' ';              /* Because if key compression */
-  return 0;
-}
-
 /* page 0 0x00A1-0x00DF */
 static uint16 tab_sjis_uni0[]={
 0xFF61,0xFF62,0xFF63,0xFF64,0xFF65,0xFF66,0xFF67,0xFF68,
@@ -4628,7 +4549,7 @@ static MY_COLLATION_HANDLER my_collation_ci_handler =
   my_strnncollsp_sjis,
   my_strnxfrm_sjis,
   my_strnxfrmlen_simple,
-  my_like_range_sjis,
+  my_like_range_mb,
   my_wildcmp_mb,	/* wildcmp  */
   my_strcasecmp_8bit,
   my_instr_mb,
@@ -4694,7 +4615,7 @@ CHARSET_INFO my_charset_sjis_japanese_ci=
     1,			/* mbminlen   */
     2,			/* mbmaxlen */
     0,			/* min_sort_char */
-    255,		/* max_sort_char */
+    0xFCFC,		/* max_sort_char */
     ' ',                /* pad char      */
     1,                  /* escape_with_backslash_is_dangerous */
     &my_charset_handler,
@@ -4726,7 +4647,7 @@ CHARSET_INFO my_charset_sjis_bin=
     1,			/* mbminlen   */
     2,			/* mbmaxlen */
     0,			/* min_sort_char */
-    255,		/* max_sort_char */
+    0xFCFC,		/* max_sort_char */
     ' ',                /* pad char      */
     1,                  /* escape_with_backslash_is_dangerous */
     &my_charset_handler,
diff --git a/strings/ctype-ujis.c b/strings/ctype-ujis.c
index 1a872a92595..4474bd0cf96 100644
--- a/strings/ctype-ujis.c
+++ b/strings/ctype-ujis.c
@@ -8567,7 +8567,7 @@ CHARSET_INFO my_charset_ujis_japanese_ci=
     1,			/* mbminlen     */
     3,			/* mbmaxlen     */
     0,			/* min_sort_char */
-    255,		/* max_sort_char */
+    0xFEFE,		/* max_sort_char */
     ' ',                /* pad char      */
     0,                  /* escape_with_backslash_is_dangerous */
     &my_charset_handler,
@@ -8600,7 +8600,7 @@ CHARSET_INFO my_charset_ujis_bin=
     1,			/* mbminlen     */
     3,			/* mbmaxlen     */
     0,			/* min_sort_char */
-    255,		/* max_sort_char */
+    0xFEFE,		/* max_sort_char */
     ' ',                /* pad char      */
     0,                  /* escape_with_backslash_is_dangerous */
     &my_charset_handler,
diff --git a/unittest/Makefile.am b/unittest/Makefile.am
index 65fa615fb98..889e029f6ef 100644
--- a/unittest/Makefile.am
+++ b/unittest/Makefile.am
@@ -13,12 +13,12 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 
-SUBDIRS      = mytap . mysys examples
+SUBDIRS      = mytap . mysys examples strings
 
 EXTRA_DIST = unit.pl
 CLEANFILES = unit
 
-unittests = mytap mysys @mysql_se_unittest_dirs@  @mysql_pg_unittest_dirs@
+unittests = mytap mysys strings @mysql_se_unittest_dirs@  @mysql_pg_unittest_dirs@
 
 test:
 	perl unit.pl run $(unittests)
diff --git a/unittest/strings/Makefile.am b/unittest/strings/Makefile.am
new file mode 100644
index 00000000000..5b18d89f58e
--- /dev/null
+++ b/unittest/strings/Makefile.am
@@ -0,0 +1,27 @@
+# Copyright 2000, 2010, Oracle and/or its affiliates. All rights reserved.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
+AM_CPPFLAGS      = @ZLIB_INCLUDES@ -I$(top_builddir)/include 
+AM_CPPFLAGS     += -I$(top_srcdir)/include -I$(top_srcdir)/unittest/mytap
+
+LDADD 		= $(top_builddir)/unittest/mytap/libmytap.a \
+		  $(top_builddir)/mysys/libmysys.a \
+		  $(top_builddir)/dbug/libdbug.a \
+		  $(top_builddir)/strings/libmystrings.a
+
+noinst_PROGRAMS  = strings-t
+
+# Don't update the files from bitkeeper
+%::SCCS/s.%
diff --git a/unittest/strings/strings-t.c b/unittest/strings/strings-t.c
new file mode 100644
index 00000000000..2d246cfa17f
--- /dev/null
+++ b/unittest/strings/strings-t.c
@@ -0,0 +1,114 @@
+/* Copyright 2000, 2010, Oracle and/or its affiliates. All rights reserved.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 of the License.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA */
+
+#include <tap.h>
+#include <my_global.h>
+#include <my_sys.h>
+
+
+/*
+  Test that like_range() returns well-formed results.
+*/
+static int
+test_like_range_for_charset(CHARSET_INFO *cs, const char *src, size_t src_len)
+{
+  char min_str[32], max_str[32];
+  size_t min_len, max_len, min_well_formed_len, max_well_formed_len;
+  int error= 0;
+  
+  cs->coll->like_range(cs, src, src_len, '\\', '_', '%',
+                       sizeof(min_str),  min_str, max_str, &min_len, &max_len);
+  diag("min_len=%d\tmax_len=%d\t%s", min_len, max_len, cs->name);
+  min_well_formed_len= cs->cset->well_formed_len(cs,
+                                                 min_str, min_str + min_len,
+                                                 10000, &error);
+  max_well_formed_len= cs->cset->well_formed_len(cs,
+                                                 max_str, max_str + max_len,
+                                                 10000, &error);
+  if (min_len != min_well_formed_len)
+    diag("Bad min_str: min_well_formed_len=%d min_str[%d]=0x%02X",
+          min_well_formed_len, min_well_formed_len,
+          (uchar) min_str[min_well_formed_len]);
+  if (max_len != max_well_formed_len)
+    diag("Bad max_str: max_well_formed_len=%d max_str[%d]=0x%02X",
+          max_well_formed_len, max_well_formed_len,
+          (uchar) max_str[max_well_formed_len]);
+  return
+    min_len == min_well_formed_len &&
+    max_len == max_well_formed_len ? 0 : 1;
+}
+
+
+static CHARSET_INFO *charset_list[]=
+{
+#ifdef HAVE_CHARSET_big5
+  &my_charset_big5_chinese_ci,
+  &my_charset_big5_bin,
+#endif
+#ifdef HAVE_CHARSET_euckr
+  &my_charset_euckr_korean_ci,
+  &my_charset_euckr_bin,
+#endif
+#ifdef HAVE_CHARSET_gb2312
+  &my_charset_gb2312_chinese_ci,
+  &my_charset_gb2312_bin,
+#endif
+#ifdef HAVE_CHARSET_gbk
+  &my_charset_gbk_chinese_ci,
+  &my_charset_gbk_bin,
+#endif
+#ifdef HAVE_CHARSET_latin1
+  &my_charset_latin1,
+  &my_charset_latin1_bin,
+#endif
+#ifdef HAVE_CHARSET_sjis
+  &my_charset_sjis_japanese_ci,
+  &my_charset_sjis_bin,
+#endif
+#ifdef HAVE_CHARSET_tis620
+  &my_charset_tis620_thai_ci,
+  &my_charset_tis620_bin,
+#endif
+#ifdef HAVE_CHARSET_ujis
+  &my_charset_ujis_japanese_ci,
+  &my_charset_ujis_bin,
+#endif
+#ifdef HAVE_CHARSET_utf8
+  &my_charset_utf8_general_ci,
+  &my_charset_utf8_unicode_ci,
+  &my_charset_utf8_bin,
+#endif
+};
+
+
+int main()
+{
+  size_t i, failed= 0;
+  
+  plan(1);
+  diag("Testing my_like_range_xxx() functions");
+  
+  for (i= 0; i < array_elements(charset_list); i++)
+  {
+    CHARSET_INFO *cs= charset_list[i];
+    if (test_like_range_for_charset(cs, "abc%", 4))
+    {
+      ++failed;
+      diag("Failed for %s", cs->name);
+    }
+  }
+  ok(failed == 0, "Testing my_like_range_xxx() functions");
+  return exit_status();
+}

From 8d28ec7c77cd7d67ea574c2d4717560f7b3c7ebb Mon Sep 17 00:00:00 2001
From: Jimmy Yang <jimmy.yang@oracle.com>
Date: Wed, 28 Jul 2010 03:20:44 -0700
Subject: [PATCH 43/45] Fix bug #55581 by backporting fix of #52546 from
 mysql-trunk-innodb to mysql-5.1-innodb plugin.

---
 storage/innodb_plugin/ChangeLog          |  6 ++++
 storage/innodb_plugin/include/mem0pool.h | 12 -------
 storage/innodb_plugin/mem/mem0mem.c      | 12 +++----
 storage/innodb_plugin/mem/mem0pool.c     | 41 +++++++++++++++---------
 storage/innodb_plugin/srv/srv0start.c    |  6 +++-
 5 files changed, 43 insertions(+), 34 deletions(-)

diff --git a/storage/innodb_plugin/ChangeLog b/storage/innodb_plugin/ChangeLog
index 5bc4ea7c303..3e802360d23 100644
--- a/storage/innodb_plugin/ChangeLog
+++ b/storage/innodb_plugin/ChangeLog
@@ -1,3 +1,9 @@
+2010-07-27	The InnoDB Team
+
+	* include/mem0pool.h, mem/mem0mem.c, mem/mem0pool.c, srv/srv0start.c:
+	Fix Bug#55581 shutdown with innodb-use-sys-malloc=0: assert
+	mutex->magic_n == MUTEX_MAGIC_N.
+
 2010-06-30	The InnoDB Team
 
 	* btr/btr0sea.c, ha/ha0ha.c, handler/ha_innodb.cc, include/btr0sea.h:
diff --git a/storage/innodb_plugin/include/mem0pool.h b/storage/innodb_plugin/include/mem0pool.h
index 5e93bf88a47..fa8be296ec9 100644
--- a/storage/innodb_plugin/include/mem0pool.h
+++ b/storage/innodb_plugin/include/mem0pool.h
@@ -100,18 +100,6 @@ mem_pool_get_reserved(
 /*==================*/
 	mem_pool_t*	pool);	/*!< in: memory pool */
 /********************************************************************//**
-Reserves the mem pool mutex. */
-UNIV_INTERN
-void
-mem_pool_mutex_enter(void);
-/*======================*/
-/********************************************************************//**
-Releases the mem pool mutex. */
-UNIV_INTERN
-void
-mem_pool_mutex_exit(void);
-/*=====================*/
-/********************************************************************//**
 Validates a memory pool.
 @return	TRUE if ok */
 UNIV_INTERN
diff --git a/storage/innodb_plugin/mem/mem0mem.c b/storage/innodb_plugin/mem/mem0mem.c
index c0ce8a3e1ac..1dd4db30841 100644
--- a/storage/innodb_plugin/mem/mem0mem.c
+++ b/storage/innodb_plugin/mem/mem0mem.c
@@ -367,7 +367,7 @@ mem_heap_create_block(
 	block->line = line;
 
 #ifdef MEM_PERIODIC_CHECK
-	mem_pool_mutex_enter();
+	mutex_enter(&(mem_comm_pool->mutex));
 
 	if (!mem_block_list_inited) {
 		mem_block_list_inited = TRUE;
@@ -376,7 +376,7 @@ mem_heap_create_block(
 
 	UT_LIST_ADD_LAST(mem_block_list, mem_block_list, block);
 
-	mem_pool_mutex_exit();
+	mutex_exit(&(mem_comm_pool->mutex));
 #endif
 	mem_block_set_len(block, len);
 	mem_block_set_type(block, type);
@@ -479,11 +479,11 @@ mem_heap_block_free(
 	UT_LIST_REMOVE(list, heap->base, block);
 
 #ifdef MEM_PERIODIC_CHECK
-	mem_pool_mutex_enter();
+	mutex_enter(&(mem_comm_pool->mutex));
 
 	UT_LIST_REMOVE(mem_block_list, mem_block_list, block);
 
-	mem_pool_mutex_exit();
+	mutex_exit(&(mem_comm_pool->mutex));
 #endif
 
 	ut_ad(heap->total_size >= block->len);
@@ -556,7 +556,7 @@ mem_validate_all_blocks(void)
 {
 	mem_block_t*	block;
 
-	mem_pool_mutex_enter();
+	mutex_enter(&(mem_comm_pool->mutex));
 
 	block = UT_LIST_GET_FIRST(mem_block_list);
 
@@ -568,6 +568,6 @@ mem_validate_all_blocks(void)
 		block = UT_LIST_GET_NEXT(mem_block_list, block);
 	}
 
-	mem_pool_mutex_exit();
+	mutex_exit(&(mem_comm_pool->mutex));
 }
 #endif
diff --git a/storage/innodb_plugin/mem/mem0pool.c b/storage/innodb_plugin/mem/mem0pool.c
index c4f8af607e0..3291453eeb5 100644
--- a/storage/innodb_plugin/mem/mem0pool.c
+++ b/storage/innodb_plugin/mem/mem0pool.c
@@ -34,6 +34,7 @@ Created 5/12/1997 Heikki Tuuri
 #include "ut0lst.h"
 #include "ut0byte.h"
 #include "mem0mem.h"
+#include "srv0start.h"
 
 /* We would like to use also the buffer frames to allocate memory. This
 would be desirable, because then the memory consumption of the database
@@ -121,23 +122,33 @@ mysql@lists.mysql.com */
 UNIV_INTERN ulint	mem_n_threads_inside		= 0;
 
 /********************************************************************//**
-Reserves the mem pool mutex. */
-UNIV_INTERN
+Reserves the mem pool mutex if we are not in server shutdown. Use
+this function only in memory free functions, since only memory
+free functions are used during server shutdown. */
+UNIV_INLINE
 void
-mem_pool_mutex_enter(void)
-/*======================*/
+mem_pool_mutex_enter(
+/*=================*/
+	mem_pool_t*	pool)		/*!< in: memory pool */
 {
-	mutex_enter(&(mem_comm_pool->mutex));
+	if (srv_shutdown_state < SRV_SHUTDOWN_EXIT_THREADS) {
+		mutex_enter(&(pool->mutex));
+	}
 }
 
 /********************************************************************//**
-Releases the mem pool mutex. */
-UNIV_INTERN
+Releases the mem pool mutex if we are not in server shutdown. As
+its corresponding mem_pool_mutex_enter() function, use it only
+in memory free functions */
+UNIV_INLINE
 void
-mem_pool_mutex_exit(void)
-/*=====================*/
+mem_pool_mutex_exit(
+/*================*/
+	mem_pool_t*	pool)		/*!< in: memory pool */
 {
-	mutex_exit(&(mem_comm_pool->mutex));
+	if (srv_shutdown_state < SRV_SHUTDOWN_EXIT_THREADS) {
+		mutex_exit(&(pool->mutex));
+	}
 }
 
 /********************************************************************//**
@@ -567,7 +578,7 @@ mem_area_free(
 
 	n = ut_2_log(size);
 
-	mutex_enter(&(pool->mutex));
+	mem_pool_mutex_enter(pool);
 	mem_n_threads_inside++;
 
 	ut_a(mem_n_threads_inside == 1);
@@ -595,7 +606,7 @@ mem_area_free(
 		pool->reserved += ut_2_exp(n);
 
 		mem_n_threads_inside--;
-		mutex_exit(&(pool->mutex));
+		mem_pool_mutex_exit(pool);
 
 		mem_area_free(new_ptr, pool);
 
@@ -611,7 +622,7 @@ mem_area_free(
 	}
 
 	mem_n_threads_inside--;
-	mutex_exit(&(pool->mutex));
+	mem_pool_mutex_exit(pool);
 
 	ut_ad(mem_pool_validate(pool));
 }
@@ -630,7 +641,7 @@ mem_pool_validate(
 	ulint		free;
 	ulint		i;
 
-	mutex_enter(&(pool->mutex));
+	mem_pool_mutex_enter(pool);
 
 	free = 0;
 
@@ -658,7 +669,7 @@ mem_pool_validate(
 
 	ut_a(free + pool->reserved == pool->size);
 
-	mutex_exit(&(pool->mutex));
+	mem_pool_mutex_exit(pool);
 
 	return(TRUE);
 }
diff --git a/storage/innodb_plugin/srv/srv0start.c b/storage/innodb_plugin/srv/srv0start.c
index e517b9a86b0..ba9fc831b39 100644
--- a/storage/innodb_plugin/srv/srv0start.c
+++ b/storage/innodb_plugin/srv/srv0start.c
@@ -2018,9 +2018,13 @@ innobase_shutdown_for_mysql(void)
 	pars_lexer_close();
 	log_mem_free();
 	buf_pool_free();
-	ut_free_all_mem();
 	mem_close();
 
+	/* ut_free_all_mem() frees all allocated memory not freed yet
+	in shutdown, and it will also free the ut_list_mutex, so it
+	should be the last one for all operation */
+	ut_free_all_mem();
+
 	if (os_thread_count != 0
 	    || os_event_count != 0
 	    || os_mutex_count != 0

From 2ad690fdf8a1141be8439a7e2d53974a0d3ec923 Mon Sep 17 00:00:00 2001
From:  <Li-Bing.Song@sun.com>
Date: Thu, 29 Jul 2010 11:00:57 +0800
Subject: [PATCH 44/45] BUG#49124 Security issue with /*!-versioned */ SQL
 statements on Slave

/*![:version:] Query Code */, where [:version:] is a sequence of 5
digits representing the mysql server version(e.g /*!50200 ... */),
is a special comment that the query in it can be executed on those
servers whose versions are larger than the version appearing in the
comment. It leads to a security issue when slave's version is larger
than master's. A malicious user can improve his privileges on slaves.
Because slave SQL thread is running with SUPER privileges, so it can
execute queries that he/she does not have privileges on master.

This bug is fixed with the logic below:
- To replace '!' with ' ' in the magic comments which are not applied on
  master. So they become common comments and will not be applied on slave.

- Example:
  'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /*!99999 ,(3)*/
  will be binlogged as
  'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /* 99999 ,(3)*/
---
 .../rpl/r/rpl_conditional_comments.result     | 57 ++++++++++++++
 .../suite/rpl/t/rpl_conditional_comments.test | 74 +++++++++++++++++++
 sql/mysql_priv.h                              |  2 +-
 sql/sql_lex.cc                                | 19 ++++-
 sql/sql_lex.h                                 | 20 ++++-
 sql/sql_parse.cc                              | 12 +--
 sql/sql_partition.cc                          |  2 +-
 sql/sql_partition.h                           |  2 +-
 sql/table.h                                   |  2 +-
 9 files changed, 173 insertions(+), 17 deletions(-)
 create mode 100644 mysql-test/suite/rpl/r/rpl_conditional_comments.result
 create mode 100644 mysql-test/suite/rpl/t/rpl_conditional_comments.test

diff --git a/mysql-test/suite/rpl/r/rpl_conditional_comments.result b/mysql-test/suite/rpl/r/rpl_conditional_comments.result
new file mode 100644
index 00000000000..105d3bc59f3
--- /dev/null
+++ b/mysql-test/suite/rpl/r/rpl_conditional_comments.result
@@ -0,0 +1,57 @@
+stop slave;
+drop table if exists t1,t2,t3,t4,t5,t6,t7,t8,t9;
+reset master;
+reset slave;
+drop table if exists t1,t2,t3,t4,t5,t6,t7,t8,t9;
+start slave;
+CREATE TABLE t1(c1 INT);
+show binlog events from <binlog_start>;
+Log_name	Pos	Event_type	Server_id	End_log_pos	Info
+master-bin.000001	#	Query	#	#	use `test`; CREATE TABLE t1(c1 INT)
+
+# Case 1:
+# ------------------------------------------------------------------
+# In a statement, some CCs are applied while others are not. The CCs
+# which are not applied on master will be binlogged as common comments.
+/*!99999 --- */INSERT /*!INTO*/ /*!10000 t1 */ VALUES(10) /*!99999 ,(11)*/;
+show binlog events from <binlog_start>;
+Log_name	Pos	Event_type	Server_id	End_log_pos	Info
+master-bin.000001	#	Query	#	#	use `test`; /* 99999 --- */INSERT /*!INTO*/ /*!10000 t1 */ VALUES(10) /* 99999 ,(11)*/
+Comparing tables master:test.t1 and slave:test.t1
+
+# Case 2:
+# -----------------------------------------------------------------
+# Verify whether it can be binlogged correctly when executing prepared
+# statement.
+PREPARE stmt FROM 'INSERT INTO /*!99999 blabla*/ t1 VALUES(60) /*!99999 ,(61)*/';
+EXECUTE stmt;
+DROP TABLE t1;
+CREATE TABLE t1(c1 INT);
+EXECUTE stmt;
+Comparing tables master:test.t1 and slave:test.t1
+
+SET @value=62;
+PREPARE stmt FROM 'INSERT INTO /*!99999 blabla */ t1 VALUES(?) /*!99999 ,(63)*/';
+EXECUTE stmt USING @value;
+DROP TABLE t1;
+CREATE TABLE t1(c1 INT);
+EXECUTE stmt USING @value;
+show binlog events from <binlog_start>;
+Log_name	Pos	Event_type	Server_id	End_log_pos	Info
+master-bin.000001	#	Query	#	#	use `test`; INSERT INTO /* 99999 blabla*/ t1 VALUES(60) /* 99999 ,(61)*/
+master-bin.000001	#	Query	#	#	use `test`; DROP TABLE t1
+master-bin.000001	#	Query	#	#	use `test`; CREATE TABLE t1(c1 INT)
+master-bin.000001	#	Query	#	#	use `test`; INSERT INTO /* 99999 blabla*/ t1 VALUES(60) /* 99999 ,(61)*/
+master-bin.000001	#	Query	#	#	use `test`; INSERT INTO /* 99999 blabla */ t1 VALUES(62) /* 99999 ,(63)*/
+master-bin.000001	#	Query	#	#	use `test`; DROP TABLE t1
+master-bin.000001	#	Query	#	#	use `test`; CREATE TABLE t1(c1 INT)
+master-bin.000001	#	Query	#	#	use `test`; INSERT INTO /* 99999 blabla */ t1 VALUES(62) /* 99999 ,(63)*/
+Comparing tables master:test.t1 and slave:test.t1
+
+# Case 3:
+# -----------------------------------------------------------------
+# Verify it can restore the '!', if the it is an uncomplete conditional
+# comments
+SELECT c1 FROM /*!99999 t1 WHEREN;
+ERROR 42000: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '/*!99999 t1 WHEREN' at line 1
+DROP TABLE t1;
diff --git a/mysql-test/suite/rpl/t/rpl_conditional_comments.test b/mysql-test/suite/rpl/t/rpl_conditional_comments.test
new file mode 100644
index 00000000000..14251d5eb37
--- /dev/null
+++ b/mysql-test/suite/rpl/t/rpl_conditional_comments.test
@@ -0,0 +1,74 @@
+###############################################################################
+# After the patch for BUG#49124:
+#  - Use ' ' instead of '!' in the conditional comments which are not applied on
+#  master. So they become common comments and will not be applied on slave.
+#
+#  - Example: 
+#  'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /*!99999 ,(3)*/ 
+#  will be binlogged as 
+#  'INSERT INTO t1 VALUES (1) /*!10000, (2)*/ /* 99999 ,(3)*/'.
+###############################################################################
+source include/master-slave.inc;
+source include/have_binlog_format_statement.inc;
+
+CREATE TABLE t1(c1 INT);
+source include/show_binlog_events.inc;
+let $binlog_start= query_get_value(SHOW MASTER STATUS, Position, 1);
+
+--echo
+--echo # Case 1:
+--echo # ------------------------------------------------------------------
+--echo # In a statement, some CCs are applied while others are not. The CCs
+--echo # which are not applied on master will be binlogged as common comments.
+
+/*!99999 --- */INSERT /*!INTO*/ /*!10000 t1 */ VALUES(10) /*!99999 ,(11)*/;
+
+source include/show_binlog_events.inc;
+let $binlog_start= query_get_value(SHOW MASTER STATUS, Position, 1);
+sync_slave_with_master;
+let $diff_table_1=master:test.t1;
+let $diff_table_2=slave:test.t1;
+source include/diff_tables.inc;
+
+--echo
+--echo # Case 2:
+--echo # -----------------------------------------------------------------
+--echo # Verify whether it can be binlogged correctly when executing prepared
+--echo # statement.
+PREPARE stmt FROM 'INSERT INTO /*!99999 blabla*/ t1 VALUES(60) /*!99999 ,(61)*/';
+EXECUTE stmt;
+DROP TABLE t1;
+CREATE TABLE t1(c1 INT);
+EXECUTE stmt;
+
+sync_slave_with_master;
+let $diff_table_1=master:test.t1;
+let $diff_table_2=slave:test.t1;
+source include/diff_tables.inc;
+
+--echo
+SET @value=62;
+PREPARE stmt FROM 'INSERT INTO /*!99999 blabla */ t1 VALUES(?) /*!99999 ,(63)*/';
+EXECUTE stmt USING @value;
+DROP TABLE t1;
+CREATE TABLE t1(c1 INT);
+EXECUTE stmt USING @value;
+
+source include/show_binlog_events.inc;
+let $binlog_start= query_get_value(SHOW MASTER STATUS, Position, 1);
+
+sync_slave_with_master;
+let $diff_table_1=master:test.t1;
+let $diff_table_2=slave:test.t1;
+source include/diff_tables.inc;
+
+--echo
+--echo # Case 3:
+--echo # -----------------------------------------------------------------
+--echo # Verify it can restore the '!', if the it is an uncomplete conditional
+--echo # comments
+--error 1064
+SELECT c1 FROM /*!99999 t1 WHEREN;
+
+DROP TABLE t1;
+source include/master-slave-end.inc;
diff --git a/sql/mysql_priv.h b/sql/mysql_priv.h
index 88f3763ef50..9f2c0b04f2c 100644
--- a/sql/mysql_priv.h
+++ b/sql/mysql_priv.h
@@ -1024,7 +1024,7 @@ bool mysql_opt_change_db(THD *thd,
                          bool force_switch,
                          bool *cur_db_changed);
 
-void mysql_parse(THD *thd, const char *inBuf, uint length,
+void mysql_parse(THD *thd, char *rawbuf, uint length,
                  const char ** semicolon);
 
 bool mysql_test_parse_for_slave(THD *thd,char *inBuf,uint length);
diff --git a/sql/sql_lex.cc b/sql/sql_lex.cc
index 6bfd6f3906c..2bff036b1f1 100644
--- a/sql/sql_lex.cc
+++ b/sql/sql_lex.cc
@@ -111,7 +111,7 @@ st_parsing_options::reset()
 }
 
 
-bool Lex_input_stream::init(THD *thd, const char *buff, unsigned int length)
+bool Lex_input_stream::init(THD *thd, char *buff, unsigned int length)
 {
   DBUG_EXECUTE_IF("bug42064_simulate_oom",
                   DBUG_SET("+d,simulate_out_of_memory"););
@@ -1292,11 +1292,10 @@ int MYSQLlex(void *arg, void *yythd)
           ulong version;
           version=strtol(version_str, NULL, 10);
 
-          /* Accept 'M' 'm' 'm' 'd' 'd' */
-          lip->yySkipn(5);
-
           if (version <= MYSQL_VERSION_ID)
           {
+            /* Accept 'M' 'm' 'm' 'd' 'd' */
+            lip->yySkipn(5);
             /* Expand the content of the special comment as real code */
             lip->set_echo(TRUE);
             state=MY_LEX_START;
@@ -1304,7 +1303,19 @@ int MYSQLlex(void *arg, void *yythd)
           }
           else
           {
+            const char* version_mark= lip->get_ptr() - 1;
+            DBUG_ASSERT(*version_mark == '!');
+            /*
+              Patch and skip the conditional comment to avoid it
+              being propagated infinitely (eg. to a slave).
+            */
+            char *pcom= lip->yyUnput(' ');
             comment_closed= ! consume_comment(lip, 1);
+            if (! comment_closed)
+            {
+              DBUG_ASSERT(pcom == version_mark);
+              *pcom= '!';
+            }
             /* version allowed to have one level of comment inside. */
           }
         }
diff --git a/sql/sql_lex.h b/sql/sql_lex.h
index cefb0cb49fb..7403bb5a1a4 100644
--- a/sql/sql_lex.h
+++ b/sql/sql_lex.h
@@ -1180,7 +1180,7 @@ public:
      @retval FALSE OK
      @retval TRUE  Error
   */
-  bool init(THD *thd, const char *buff, unsigned int length);
+  bool init(THD *thd, char *buff, unsigned int length);
   /**
     Set the echo mode.
 
@@ -1294,6 +1294,20 @@ public:
     m_ptr += n;
   }
 
+  /**
+    Puts a character back into the stream, canceling
+    the effect of the last yyGet() or yySkip().
+    Note that the echo mode should not change between calls
+    to unput, get, or skip from the stream.
+  */
+  char *yyUnput(char ch)
+  {
+    *--m_ptr= ch;
+    if (m_echo)
+      m_cpp_ptr--;
+    return m_ptr;
+  }
+
   /**
     End of file indicator for the query text to parse.
     @return true if there are no more characters to parse
@@ -1440,7 +1454,7 @@ public:
 
 private:
   /** Pointer to the current position in the raw input stream. */
-  const char *m_ptr;
+  char *m_ptr;
 
   /** Starting position of the last token parsed, in the raw buffer. */
   const char *m_tok_start;
@@ -1972,7 +1986,7 @@ public:
      @retval FALSE OK
      @retval TRUE  Error
   */
-  bool init(THD *thd, const char *buff, unsigned int length)
+  bool init(THD *thd, char *buff, unsigned int length)
   {
     return m_lip.init(thd, buff, length);
   }
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 0a509f62849..9ec03ea1d5f 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -5946,13 +5946,13 @@ void mysql_init_multi_delete(LEX *lex)
   Parse a query.
 
   @param       thd     Current thread
-  @param       inBuf   Begining of the query text
+  @param       rawbuf  Begining of the query text
   @param       length  Length of the query text
   @param[out]  found_semicolon For multi queries, position of the character of
                                the next query in the query text.
 */
 
-void mysql_parse(THD *thd, const char *inBuf, uint length,
+void mysql_parse(THD *thd, char *rawbuf, uint length,
                  const char ** found_semicolon)
 {
   DBUG_ENTER("mysql_parse");
@@ -5978,7 +5978,7 @@ void mysql_parse(THD *thd, const char *inBuf, uint length,
   lex_start(thd);
   mysql_reset_thd_for_next_command(thd);
 
-  if (query_cache_send_result_to_client(thd, (char*) inBuf, length) <= 0)
+  if (query_cache_send_result_to_client(thd, rawbuf, length) <= 0)
   {
     LEX *lex= thd->lex;
 
@@ -5987,7 +5987,7 @@ void mysql_parse(THD *thd, const char *inBuf, uint length,
 
     Parser_state parser_state;
     bool err;
-    if (!(err= parser_state.init(thd, inBuf, length)))
+    if (!(err= parser_state.init(thd, rawbuf, length)))
     {
       err= parse_sql(thd, & parser_state, NULL);
       *found_semicolon= parser_state.m_lip.found_semicolon;
@@ -6073,14 +6073,14 @@ void mysql_parse(THD *thd, const char *inBuf, uint length,
     1	can be ignored
 */
 
-bool mysql_test_parse_for_slave(THD *thd, char *inBuf, uint length)
+bool mysql_test_parse_for_slave(THD *thd, char *rawbuf, uint length)
 {
   LEX *lex= thd->lex;
   bool error= 0;
   DBUG_ENTER("mysql_test_parse_for_slave");
 
   Parser_state parser_state;
-  if (!(error= parser_state.init(thd, inBuf, length)))
+  if (!(error= parser_state.init(thd, rawbuf, length)))
   {
     lex_start(thd);
     mysql_reset_thd_for_next_command(thd);
diff --git a/sql/sql_partition.cc b/sql/sql_partition.cc
index 122ae661046..76caa2b0c8d 100644
--- a/sql/sql_partition.cc
+++ b/sql/sql_partition.cc
@@ -3876,7 +3876,7 @@ void get_partition_set(const TABLE *table, uchar *buf, const uint index,
 */
 
 bool mysql_unpack_partition(THD *thd,
-                            const char *part_buf, uint part_info_len,
+                            char *part_buf, uint part_info_len,
                             const char *part_state, uint part_state_len,
                             TABLE* table, bool is_create_table_ind,
                             handlerton *default_db_type,
diff --git a/sql/sql_partition.h b/sql/sql_partition.h
index b9efbf25a00..02a5ead1117 100644
--- a/sql/sql_partition.h
+++ b/sql/sql_partition.h
@@ -78,7 +78,7 @@ void get_full_part_id_from_key(const TABLE *table, uchar *buf,
                                KEY *key_info,
                                const key_range *key_spec,
                                part_id_range *part_spec);
-bool mysql_unpack_partition(THD *thd, const char *part_buf,
+bool mysql_unpack_partition(THD *thd, char *part_buf,
                             uint part_info_len,
                             const char *part_state, uint part_state_len,
                             TABLE *table, bool is_create_table_ind,
diff --git a/sql/table.h b/sql/table.h
index 3ef3c5e0cb2..8ea7175eec4 100644
--- a/sql/table.h
+++ b/sql/table.h
@@ -442,7 +442,7 @@ typedef struct st_table_share
 #ifdef WITH_PARTITION_STORAGE_ENGINE
   /** @todo: Move into *ha_data for partitioning */
   bool auto_partitioned;
-  const char *partition_info;
+  char *partition_info;
   uint  partition_info_len;
   uint  partition_info_buffer_size;
   const char *part_state;

From c7071a7214114e224fcd63b4be77867783185c4c Mon Sep 17 00:00:00 2001
From: Alexander Barkov <bar@mysql.com>
Date: Thu, 29 Jul 2010 10:12:44 +0400
Subject: [PATCH 45/45] Postfix for BUG#45012.

Problem: The original patch didn't compile on debug_werror
due to wrong format in printf("%d") for size_t variables.

Fix: Adding cast to (int).
---
 unittest/strings/strings-t.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/unittest/strings/strings-t.c b/unittest/strings/strings-t.c
index 2d246cfa17f..278f42e56a5 100644
--- a/unittest/strings/strings-t.c
+++ b/unittest/strings/strings-t.c
@@ -30,7 +30,7 @@ test_like_range_for_charset(CHARSET_INFO *cs, const char *src, size_t src_len)
   
   cs->coll->like_range(cs, src, src_len, '\\', '_', '%',
                        sizeof(min_str),  min_str, max_str, &min_len, &max_len);
-  diag("min_len=%d\tmax_len=%d\t%s", min_len, max_len, cs->name);
+  diag("min_len=%d\tmax_len=%d\t%s", (int) min_len, (int) max_len, cs->name);
   min_well_formed_len= cs->cset->well_formed_len(cs,
                                                  min_str, min_str + min_len,
                                                  10000, &error);
@@ -39,11 +39,11 @@ test_like_range_for_charset(CHARSET_INFO *cs, const char *src, size_t src_len)
                                                  10000, &error);
   if (min_len != min_well_formed_len)
     diag("Bad min_str: min_well_formed_len=%d min_str[%d]=0x%02X",
-          min_well_formed_len, min_well_formed_len,
+          (int) min_well_formed_len, (int) min_well_formed_len,
           (uchar) min_str[min_well_formed_len]);
   if (max_len != max_well_formed_len)
     diag("Bad max_str: max_well_formed_len=%d max_str[%d]=0x%02X",
-          max_well_formed_len, max_well_formed_len,
+          (int) max_well_formed_len, (int) max_well_formed_len,
           (uchar) max_str[max_well_formed_len]);
   return
     min_len == min_well_formed_len &&