From 4e4152c56f70367a98717f2329ca1b8be39c2eb0 Mon Sep 17 00:00:00 2001
From: unknown <gkodinov/kgeorge@macbook.gmz>
Date: Fri, 23 Feb 2007 18:49:41 +0200
Subject: [PATCH 01/16] Bug #26186: When handling DELETE ... FROM if there is
 no condition it is internally transformed to TRUNCATE for more efficient
 execution by the storage handler. The check for validity of the optional
 ORDER BY clause is done after the check for the above optimization and will
 not be performed if the optimization can be applied. Moved the validity check
 for ORDER BY before the optimization so it performed regardless of the
 optimization.

mysql-test/r/delete.result:
  Bug #26186: test case
mysql-test/t/delete.test:
  Bug #26186: test case
sql/sql_delete.cc:
  Bug #26186: do validity check of the ORDER BY
  before deciding to skip it.
---
 mysql-test/r/delete.result |  9 +++++++++
 mysql-test/t/delete.test   | 18 ++++++++++++++++++
 sql/sql_delete.cc          | 37 +++++++++++++++++++++----------------
 3 files changed, 48 insertions(+), 16 deletions(-)

diff --git a/mysql-test/r/delete.result b/mysql-test/r/delete.result
index ba4e9386312..4bdf1c770d3 100644
--- a/mysql-test/r/delete.result
+++ b/mysql-test/r/delete.result
@@ -214,3 +214,12 @@ select count(*) from t1;
 count(*)
 0
 drop table t1;
+CREATE TABLE t1 (a INT);
+INSERT INTO t1 VALUES (1);
+DELETE FROM t1 ORDER BY x;
+ERROR 42S22: Unknown column 'x' in 'order clause'
+DELETE FROM t1 ORDER BY t2.x;
+ERROR 42S22: Unknown column 't2.x' in 'order clause'
+DELETE FROM t1 ORDER BY (SELECT x);
+ERROR 42S22: Unknown column 'x' in 'field list'
+DROP TABLE t1;
diff --git a/mysql-test/t/delete.test b/mysql-test/t/delete.test
index 306447dbd5a..36d627209db 100644
--- a/mysql-test/t/delete.test
+++ b/mysql-test/t/delete.test
@@ -203,3 +203,21 @@ select * from t1 where a is null;
 delete from t1 where a is null;
 select count(*) from t1;
 drop table t1;
+
+#
+# Bug #26186: delete order by, sometimes accept unknown column
+#
+CREATE TABLE t1 (a INT); INSERT INTO t1 VALUES (1);
+
+--error ER_BAD_FIELD_ERROR
+DELETE FROM t1 ORDER BY x;
+
+# even columns from a table not used in query (and not even existing)
+--error ER_BAD_FIELD_ERROR
+DELETE FROM t1 ORDER BY t2.x;
+
+# subquery (as long as the subquery from is valid or DUAL)
+--error ER_BAD_FIELD_ERROR
+DELETE FROM t1 ORDER BY (SELECT x);
+
+DROP TABLE t1;
diff --git a/sql/sql_delete.cc b/sql/sql_delete.cc
index 749ee04493b..e4b013ef088 100644
--- a/sql/sql_delete.cc
+++ b/sql/sql_delete.cc
@@ -60,6 +60,27 @@ bool mysql_delete(THD *thd, TABLE_LIST *table_list, COND *conds,
   if (mysql_prepare_delete(thd, table_list, &conds))
     DBUG_RETURN(TRUE);
 
+  /* check ORDER BY even if it can be ignored */
+  if (order && order->elements)
+  {
+    TABLE_LIST   tables;
+    List<Item>   fields;
+    List<Item>   all_fields;
+
+    bzero((char*) &tables,sizeof(tables));
+    tables.table = table;
+    tables.alias = table_list->alias;
+
+      if (select_lex->setup_ref_array(thd, order->elements) ||
+	  setup_order(thd, select_lex->ref_pointer_array, &tables,
+                    fields, all_fields, (ORDER*) order->first))
+    {
+      delete select;
+      free_underlaid_joins(thd, &thd->lex->select_lex);
+      DBUG_RETURN(TRUE);
+    }
+  }
+
   const_cond= (!conds || conds->const_item());
   safe_update=test(thd->options & OPTION_SAFE_UPDATES);
   if (safe_update && const_cond)
@@ -148,23 +169,7 @@ bool mysql_delete(THD *thd, TABLE_LIST *table_list, COND *conds,
   {
     uint         length= 0;
     SORT_FIELD  *sortorder;
-    TABLE_LIST   tables;
-    List<Item>   fields;
-    List<Item>   all_fields;
     ha_rows examined_rows;
-
-    bzero((char*) &tables,sizeof(tables));
-    tables.table = table;
-    tables.alias = table_list->alias;
-
-      if (select_lex->setup_ref_array(thd, order->elements) ||
-	  setup_order(thd, select_lex->ref_pointer_array, &tables,
-                    fields, all_fields, (ORDER*) order->first))
-    {
-      delete select;
-      free_underlaid_joins(thd, &thd->lex->select_lex);
-      DBUG_RETURN(TRUE);
-    }
     
     if ((!select || table->quick_keys.is_clear_all()) && limit != HA_POS_ERROR)
       usable_index= get_index_for_order(table, (ORDER*)(order->first), limit);

From 1f8bdbe4eb61b15996b5a9a25c75a905487c083f Mon Sep 17 00:00:00 2001
From: unknown <igor@olga.mysql.com>
Date: Thu, 22 Mar 2007 14:48:03 -0700
Subject: [PATCH 02/16] Fixed bug #27229: crash when a set function aggregated
 in outer context was used as an argument of GROUP_CONCAT. Ensured correct
 setting of the depended_from field in references generated for set functions
 aggregated in outer selects. A wrong value of this field resulted in wrong
 maps returned by used_tables() for these references. Made sure that a
 temporary table field is added for any set function aggregated in outer
 context when creation of a temporary table is needed to execute the inner
 subquery.

mysql-test/r/subselect.result:
  Added a test case for bug #27229.
mysql-test/t/subselect.test:
  Added a test case for bug #27229.
sql/item.cc:
  Fixed bug #27229: crash when a set function aggregated in outer
  context was used as an argument of GROUP_CONCAT.
  Ensured correct setting of the depended_from field in references
  generated for set functions aggregated in outer selects.
sql/item_sum.cc:
  Fixed bug #27229: crash when a set function aggregated in outer
  context was used as an argument of GROUP_CONCAT.
  Added the field aggr_sel to the objects of the class Item_sum.
  In any Item_sum object created for a set function this field
  has to contain a pointer to the select where the set function
  is aggregated.
sql/item_sum.h:
  Fixed bug #27229: crash when a set function aggregated in outer
  context was used as an argument of GROUP_CONCAT.
  Added the field aggr_sel to the objects of the class Item_sum.
  In any Item_sum object created for a set function this field
  has to contain a pointer to the select where the set function
  is aggregated.
  Added a method that says whether a set function is aggregated
  in outer context and, if so, returns the aggregating select.
  Removed the field nest_level_tables_count introduced by the
  patch for bug 24484 as aggr_sel->join->tables contains the
  sane number.
sql/sql_base.cc:
  Fixed bug #27229: crash when a set function aggregated in outer
  context was used as an argument of GROUP_CONCAT.
  Added the field aggr_sel to the objects of the class Item_sum.
  Removed changes introduced by the patch for bug 24484 as
  the field leaf_count of the THD class is not used anymore.
sql/sql_class.h:
  Fixed bug #27229: crash when a set function aggregated in outer
  context was used as an argument of GROUP_CONCAT.
  Added the field aggr_sel to the objects of the class Item_sum.
  Removed changes introduce by the patch for bug 24484 as
  the field leaf_count of the THD class is not used anymore.
sql/sql_insert.cc:
  Fixed bug #27229: crash when a set function aggregated in outer
  context was used as an argument of GROUP_CONCAT.
  Added the field aggr_sel to the objects of the class Item_sum.
  Removed changes introduce by the patch for bug 24484 as
  the field leaf_count of the THD class is not used anymore.
sql/sql_select.cc:
  Fixed bug #27229: crash when a set function aggregated in outer
  context was used as an argument of GROUP_CONCAT.
  When creating a temporary table a field is added in it for any
  set function aggregated in outer context.
---
 mysql-test/r/subselect.result | 19 +++++++++++++++++++
 mysql-test/t/subselect.test   | 19 +++++++++++++++++++
 sql/item.cc                   |  9 ++++++---
 sql/item_sum.cc               | 33 ++++++++++++++++++---------------
 sql/item_sum.h                |  4 +++-
 sql/sql_base.cc               |  2 --
 sql/sql_class.h               |  3 ---
 sql/sql_insert.cc             |  6 ++----
 sql/sql_select.cc             | 11 +++++++++--
 9 files changed, 76 insertions(+), 30 deletions(-)

diff --git a/mysql-test/r/subselect.result b/mysql-test/r/subselect.result
index 72bde001e87..81f087fe8fa 100644
--- a/mysql-test/r/subselect.result
+++ b/mysql-test/r/subselect.result
@@ -3905,3 +3905,22 @@ COUNT(*)	a
 2	2
 3	3
 DROP TABLE t1,t2;
+CREATE TABLE t1 (a int, b int);
+CREATE TABLE t2 (m int, n int);
+INSERT INTO t1 VALUES (2,2), (2,2), (3,3), (3,3), (3,3), (4,4);
+INSERT INTO t2 VALUES (1,11), (2,22), (3,32), (4,44), (4,44);
+SELECT COUNT(*) c, a,
+(SELECT GROUP_CONCAT(COUNT(a)) FROM t2 WHERE m = a)
+FROM t1 GROUP BY a;
+c	a	(SELECT GROUP_CONCAT(COUNT(a)) FROM t2 WHERE m = a)
+2	2	2
+3	3	3
+1	4	1,1
+SELECT COUNT(*) c, a,
+(SELECT GROUP_CONCAT(COUNT(a)+1) FROM t2 WHERE m = a)
+FROM t1 GROUP BY a;
+c	a	(SELECT GROUP_CONCAT(COUNT(a)+1) FROM t2 WHERE m = a)
+2	2	3
+3	3	4
+1	4	2,2
+DROP table t1,t2;
diff --git a/mysql-test/t/subselect.test b/mysql-test/t/subselect.test
index a238c8f070b..efd54ca95d1 100644
--- a/mysql-test/t/subselect.test
+++ b/mysql-test/t/subselect.test
@@ -2763,3 +2763,22 @@ SELECT COUNT(*), a
     HAVING (SELECT MIN(m) FROM t2 WHERE m = count(*)) > 1;
 
 DROP TABLE t1,t2;
+
+#
+# Bug #27229: GROUP_CONCAT in subselect with COUNT() as an argument 
+#  
+
+CREATE TABLE t1 (a int, b int);
+CREATE TABLE t2 (m int, n int);
+INSERT INTO t1 VALUES (2,2), (2,2), (3,3), (3,3), (3,3), (4,4);
+INSERT INTO t2 VALUES (1,11), (2,22), (3,32), (4,44), (4,44);
+
+SELECT COUNT(*) c, a,
+       (SELECT GROUP_CONCAT(COUNT(a)) FROM t2 WHERE m = a)
+  FROM t1 GROUP BY a;
+
+SELECT COUNT(*) c, a,
+       (SELECT GROUP_CONCAT(COUNT(a)+1) FROM t2 WHERE m = a)
+  FROM t1 GROUP BY a;
+
+DROP table t1,t2;
diff --git a/sql/item.cc b/sql/item.cc
index 11a5039ca19..255a756b6d1 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -1261,15 +1261,18 @@ void Item::split_sum_func2(THD *thd, Item **ref_pointer_array,
       Exception is Item_direct_view_ref which we need to convert to
       Item_ref to allow fields from view being stored in tmp table.
     */
+    Item_aggregate_ref *item_ref;
     uint el= fields.elements;
-    Item *new_item, *real_itm= real_item();
+    Item *real_itm= real_item();
 
     ref_pointer_array[el]= real_itm;
-    if (!(new_item= new Item_aggregate_ref(&thd->lex->current_select->context,
+    if (!(item_ref= new Item_aggregate_ref(&thd->lex->current_select->context,
                                            ref_pointer_array + el, 0, name)))
       return;                                   // fatal_error is set
+    if (type() == SUM_FUNC_ITEM)
+      item_ref->depended_from= ((Item_sum *) this)->depended_from(); 
     fields.push_front(real_itm);
-    thd->change_item_tree(ref, new_item);
+    thd->change_item_tree(ref, item_ref);
   }
 }
 
diff --git a/sql/item_sum.cc b/sql/item_sum.cc
index fcebc89c6e9..03a1c32456a 100644
--- a/sql/item_sum.cc
+++ b/sql/item_sum.cc
@@ -61,9 +61,9 @@ bool Item_sum::init_sum_func_check(THD *thd)
   /* Save a pointer to object to be used in items for nested set functions */
   thd->lex->in_sum_func= this;
   nest_level= thd->lex->current_select->nest_level;
-  nest_level_tables_count= thd->lex->current_select->join->tables;
   ref_by= 0;
   aggr_level= -1;
+  aggr_sel= NULL;
   max_arg_level= -1;
   max_sum_func_level= -1;
   return FALSE;
@@ -151,7 +151,10 @@ bool Item_sum::check_sum_func(THD *thd, Item **ref)
     invalid= aggr_level < 0 && !(allow_sum_func & (1 << nest_level));
   }
   if (!invalid && aggr_level < 0)
+  {
     aggr_level= nest_level;
+    aggr_sel= thd->lex->current_select;
+  }
   /*
     By this moment we either found a subquery where the set function is
     to be aggregated  and assigned a value that is  >= 0 to aggr_level,
@@ -212,7 +215,6 @@ bool Item_sum::check_sum_func(THD *thd, Item **ref)
 bool Item_sum::register_sum_func(THD *thd, Item **ref)
 {
   SELECT_LEX *sl;
-  SELECT_LEX *aggr_sl= NULL;
   nesting_map allow_sum_func= thd->lex->allow_sum_func;
   for (sl= thd->lex->current_select->master_unit()->outer_select() ;
        sl && sl->nest_level > max_arg_level;
@@ -222,7 +224,7 @@ bool Item_sum::register_sum_func(THD *thd, Item **ref)
     {
       /* Found the most nested subquery where the function can be aggregated */
       aggr_level= sl->nest_level;
-      aggr_sl= sl;
+      aggr_sel= sl;
     }
   }
   if (sl && (allow_sum_func & (1 << sl->nest_level)))
@@ -233,21 +235,22 @@ bool Item_sum::register_sum_func(THD *thd, Item **ref)
       The set function will be aggregated in this subquery.
     */   
     aggr_level= sl->nest_level;
-    aggr_sl= sl;
+    aggr_sel= sl;
+
   }
   if (aggr_level >= 0)
   {
     ref_by= ref;
-    /* Add the object to the list of registered objects assigned to aggr_sl */
-    if (!aggr_sl->inner_sum_func_list)
+    /* Add the object to the list of registered objects assigned to aggr_sel */
+    if (!aggr_sel->inner_sum_func_list)
       next= this;
     else
     {
-      next= aggr_sl->inner_sum_func_list->next;
-      aggr_sl->inner_sum_func_list->next= this;
+      next= aggr_sel->inner_sum_func_list->next;
+      aggr_sel->inner_sum_func_list->next= this;
     }
-    aggr_sl->inner_sum_func_list= this;
-    aggr_sl->with_sum_func= 1;
+    aggr_sel->inner_sum_func_list= this;
+    aggr_sel->with_sum_func= 1;
 
     /* 
       Mark Item_subselect(s) as containing aggregate function all the way up
@@ -265,11 +268,11 @@ bool Item_sum::register_sum_func(THD *thd, Item **ref)
       has aggregate functions directly referenced (i.e. not through a sub-select).
     */
     for (sl= thd->lex->current_select; 
-         sl && sl != aggr_sl && sl->master_unit()->item;
+         sl && sl != aggr_sel && sl->master_unit()->item;
          sl= sl->master_unit()->outer_select() )
       sl->master_unit()->item->with_sum_func= 1;
   }
-  thd->lex->current_select->mark_as_dependent(aggr_sl);
+  thd->lex->current_select->mark_as_dependent(aggr_sel);
   return FALSE;
 }
 
@@ -299,10 +302,10 @@ Item_sum::Item_sum(List<Item> &list) :arg_count(list.elements),
 
 Item_sum::Item_sum(THD *thd, Item_sum *item):
   Item_result_field(thd, item), arg_count(item->arg_count),
+  aggr_sel(item->aggr_sel),
   nest_level(item->nest_level), aggr_level(item->aggr_level),
   quick_group(item->quick_group), used_tables_cache(item->used_tables_cache),
-  forced_const(item->forced_const), 
-  nest_level_tables_count(item->nest_level_tables_count)
+  forced_const(item->forced_const) 
 {
   if (arg_count <= 2)
     args=tmp_args;
@@ -447,7 +450,7 @@ void Item_sum::update_used_tables ()
 
     /* the aggregate function is aggregated into its local context */
     if (aggr_level == nest_level)
-      used_tables_cache |=  (1 << nest_level_tables_count) - 1;
+      used_tables_cache |=  (1 << aggr_sel->join->tables) - 1;
   }
 }
 
diff --git a/sql/item_sum.h b/sql/item_sum.h
index 9ddda94a8ee..66c73e1d416 100644
--- a/sql/item_sum.h
+++ b/sql/item_sum.h
@@ -233,6 +233,7 @@ public:
   Item_sum *next; /* next in the circular chain of registered objects  */
   uint arg_count;
   Item_sum *in_sum_func;  /* embedding set function if any */ 
+  st_select_lex * aggr_sel; /* select where the function is aggregated       */ 
   int8 nest_level;        /* number of the nesting level of the set function */
   int8 aggr_level;        /* nesting level of the aggregating subquery       */
   int8 max_arg_level;     /* max level of unbound column references          */
@@ -242,7 +243,6 @@ public:
 protected:  
   table_map used_tables_cache;
   bool forced_const;
-  byte nest_level_tables_count;
 
 public:  
 
@@ -365,6 +365,8 @@ public:
   bool init_sum_func_check(THD *thd);
   bool check_sum_func(THD *thd, Item **ref);
   bool register_sum_func(THD *thd, Item **ref);
+  st_select_lex *depended_from() 
+    { return (nest_level == aggr_level ? 0 : aggr_sel); }
 };
 
 
diff --git a/sql/sql_base.cc b/sql/sql_base.cc
index 13279abb1c8..77bb1d9642b 100644
--- a/sql/sql_base.cc
+++ b/sql/sql_base.cc
@@ -4864,7 +4864,6 @@ bool setup_tables_and_check_access(THD *thd,
   TABLE_LIST *leaves_tmp = NULL;
   bool first_table= true;
 
-  thd->leaf_count= 0;
   if (setup_tables (thd, context, from_clause, tables, conds, 
                     &leaves_tmp, select_insert))
     return TRUE;
@@ -4882,7 +4881,6 @@ bool setup_tables_and_check_access(THD *thd,
       return TRUE;
     }
     first_table= false;
-    thd->leaf_count++;
   }
   return FALSE;
 }
diff --git a/sql/sql_class.h b/sql/sql_class.h
index 048da718dfd..99803802001 100644
--- a/sql/sql_class.h
+++ b/sql/sql_class.h
@@ -1492,9 +1492,6 @@ public:
     query_id_t first_query_id;
   } binlog_evt_union;
 
-  /* pass up the count of "leaf" tables in a JOIN out of setup_tables() */
-  byte leaf_count;
-
   THD();
   ~THD();
 
diff --git a/sql/sql_insert.cc b/sql/sql_insert.cc
index 3c8f9fd5fc2..d9d32d14321 100644
--- a/sql/sql_insert.cc
+++ b/sql/sql_insert.cc
@@ -2349,14 +2349,12 @@ bool mysql_insert_select_prepare(THD *thd)
   DBUG_ASSERT(select_lex->leaf_tables != 0);
   lex->leaf_tables_insert= select_lex->leaf_tables;
   /* skip all leaf tables belonged to view where we are insert */
-  for (first_select_leaf_table= select_lex->leaf_tables->next_leaf,
-       thd->leaf_count --;
+  for (first_select_leaf_table= select_lex->leaf_tables->next_leaf;
        first_select_leaf_table &&
        first_select_leaf_table->belong_to_view &&
        first_select_leaf_table->belong_to_view ==
        lex->leaf_tables_insert->belong_to_view;
-       first_select_leaf_table= first_select_leaf_table->next_leaf,
-       thd->leaf_count --)
+       first_select_leaf_table= first_select_leaf_table->next_leaf)
   {}
   select_lex->leaf_tables= first_select_leaf_table;
   DBUG_RETURN(FALSE);
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index f46a212e7fb..c96ae153cf2 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -412,7 +412,12 @@ JOIN::prepare(Item ***rref_pointer_array,
                                     &select_lex->leaf_tables, FALSE, 
                                     SELECT_ACL, SELECT_ACL))
       DBUG_RETURN(-1);
-  tables= thd->leaf_count;
+ 
+  TABLE_LIST *table_ptr;
+  for (table_ptr= select_lex->leaf_tables;
+       table_ptr;
+       table_ptr= table_ptr->next_leaf)
+    tables++;
 
   if (setup_wild(thd, tables_list, fields_list, &all_fields, wild_num) ||
       select_lex->setup_ref_array(thd, og_num) ||
@@ -9186,7 +9191,9 @@ create_tmp_table(THD *thd,TMP_TABLE_PARAM *param,List<Item> &fields,
     Item::Type type=item->type();
     if (not_all_columns)
     {
-      if (item->with_sum_func && type != Item::SUM_FUNC_ITEM)
+      if (item->with_sum_func && type != Item::SUM_FUNC_ITEM &&
+          (type == Item::SUBSELECT_ITEM ||
+           (item->used_tables() & ~PSEUDO_TABLE_BITS)))
       {
 	/*
 	  Mark that the we have ignored an item that refers to a summary

From d95c307f1d3e7dcbd46db9c77f5303142243dc58 Mon Sep 17 00:00:00 2001
From: unknown <igor@olga.mysql.com>
Date: Sun, 25 Mar 2007 23:44:06 -0700
Subject: [PATCH 03/16] This is a fix for the memory corruption occurred in one
 of test cases from func_group.test after the patch for bug #27229 had been
 applied. The memory corruption happened because in some rare cases the
 function count_field_types underestimated the number of elements in in the
 array param->items_to_copy.

sql/item_sum.cc:
  The return value of the Item_sum::update_used_tables method
  should not depend on the place of aggregation of the set
  function for which the Item_sum object has been created.
sql/sql_select.cc:
  This is a fix for the memory corruption occurred in one of test cases
  from func_group.test after the patch for bug #27229 had been applied.
  The memory corruption happened because in some rare cases the function
  count_field_types underestimated the number of elements in
  in the array param->items_to_copy.

  Currently it's not guaranteed that after JOIN::prepare() the
  used_tables attribute is calculated for all items. For example
  for the expression SUM(outer_ref)+1 used_tables() must return
  OUTER_REF_TABLE_BIT. Yet by the moment when the used_tables
  attribute is calculated in JOIN::prepare SUM(outer_ref) has
  not been substituted for Item_aggregate_ref yet.
  By this reason additional calls of the method update_used_tables
  are needed for some items passed as parameters to the function
  create_tmp_table.
---
 sql/item_sum.cc   |  3 +--
 sql/sql_select.cc | 26 ++++++++++++++++----------
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/sql/item_sum.cc b/sql/item_sum.cc
index 422e9b4c6ea..368dc9a7d38 100644
--- a/sql/item_sum.cc
+++ b/sql/item_sum.cc
@@ -449,8 +449,7 @@ void Item_sum::update_used_tables ()
     used_tables_cache&= PSEUDO_TABLE_BITS;
 
     /* the aggregate function is aggregated into its local context */
-    if (aggr_level == nest_level)
-      used_tables_cache |=  (1 << aggr_sel->join->tables) - 1;
+    used_tables_cache |=  (1 << aggr_sel->join->tables) - 1;
   }
 }
 
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 4fbc5dddb07..bb57764700d 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -9196,17 +9196,21 @@ create_tmp_table(THD *thd,TMP_TABLE_PARAM *param,List<Item> &fields,
     Item::Type type=item->type();
     if (not_all_columns)
     {
-      if (item->with_sum_func && type != Item::SUM_FUNC_ITEM &&
-          (type == Item::SUBSELECT_ITEM ||
-           (item->used_tables() & ~PSEUDO_TABLE_BITS)))
+      if (item->with_sum_func && type != Item::SUM_FUNC_ITEM)
       {
-	/*
-	  Mark that the we have ignored an item that refers to a summary
-	  function. We need to know this if someone is going to use
-	  DISTINCT on the result.
-	*/
-	param->using_indirect_summary_function=1;
-	continue;
+        if (item->used_tables() & OUTER_REF_TABLE_BIT)
+          item->update_used_tables();
+        if (type == Item::SUBSELECT_ITEM ||
+            (item->used_tables() & ~OUTER_REF_TABLE_BIT))
+        {
+	  /*
+	    Mark that the we have ignored an item that refers to a summary
+	    function. We need to know this if someone is going to use
+	    DISTINCT on the result.
+	  */
+	  param->using_indirect_summary_function=1;
+	  continue;
+        }
       }
       if (item->const_item() && (int) hidden_field_count <= 0)
         continue; // We don't have to store this
@@ -9391,6 +9395,7 @@ create_tmp_table(THD *thd,TMP_TABLE_PARAM *param,List<Item> &fields,
     table->s->default_values= table->record[1]+alloc_length;
   }
   copy_func[0]=0;				// End marker
+  param->func_count= copy_func - param->items_to_copy; 
 
   recinfo=param->start_recinfo;
   null_flags=(uchar*) table->record[0];
@@ -13571,6 +13576,7 @@ count_field_types(TMP_TABLE_PARAM *param, List<Item> &fields,
 	if (!sum_item->quick_group)
 	  param->quick_group=0;			// UDF SUM function
 	param->sum_func_count++;
+        param->func_count++;
 
 	for (uint i=0 ; i < sum_item->arg_count ; i++)
 	{

From 3335f68d8902fdbbebb2c41d09253a4cafe675bb Mon Sep 17 00:00:00 2001
From: unknown <gkodinov/kgeorge@magare.gmz[kgeorge]>
Date: Mon, 26 Mar 2007 13:17:40 +0300
Subject: [PATCH 04/16] Bug #27164: not reseting the data pointer  to 0 causes
 wrong (large) length to be read  from the row in _mi_calc_blob_length() when 
 storing NULL values in (e.g) POINT columns.  This large length is then used
 to allocate  a block of memory that (on some OSes) causes  trouble.  Fixed by
 calling the base class's  Field_blob::reset() from Field_geom::reset()  that
 is called when storing a NULL value into  the column.

mysql-test/r/gis.result:
  Bug #27164: test case
mysql-test/t/gis.test:
  Bug #27164: test case
sql/field.h:
  Bug #27164: not reseting the data pointer
   to 0 causes wrong (large) length to be read
   from the row in _mi_calc_blob_length() when
   storing NULL values in (e.g) POINT columns.
   This large length is then used to allocate
   a block of memory that (on some OSes) causes
   trouble.
---
 mysql-test/r/gis.result | 6 ++++++
 mysql-test/t/gis.test   | 8 ++++++++
 sql/field.h             | 2 +-
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/mysql-test/r/gis.result b/mysql-test/r/gis.result
index de7e44ed7b2..643a3d6b434 100644
--- a/mysql-test/r/gis.result
+++ b/mysql-test/r/gis.result
@@ -718,4 +718,10 @@ point(b, b) IS NULL	linestring(b) IS NULL	polygon(b) IS NULL	multipoint(b) IS NU
 1	1	1	1	1	1	1
 0	1	1	1	1	1	1
 drop table t1;
+CREATE TABLE t1(a POINT) ENGINE=MyISAM;
+INSERT INTO t1 VALUES (NULL);
+SELECT * FROM t1;
+a
+NULL
+DROP TABLE t1;
 End of 4.1 tests
diff --git a/mysql-test/t/gis.test b/mysql-test/t/gis.test
index 6bd0db92152..7182e040d46 100644
--- a/mysql-test/t/gis.test
+++ b/mysql-test/t/gis.test
@@ -411,4 +411,12 @@ from t1;
 
 drop table t1;
 
+#
+# Bug #27164: Crash when mixing InnoDB and MyISAM Geospatial tables
+#
+CREATE TABLE t1(a POINT) ENGINE=MyISAM;
+INSERT INTO t1 VALUES (NULL);
+SELECT * FROM t1;
+DROP TABLE t1;
+
 --echo End of 4.1 tests
diff --git a/sql/field.h b/sql/field.h
index d3e38db83d1..58177747120 100644
--- a/sql/field.h
+++ b/sql/field.h
@@ -1115,7 +1115,7 @@ public:
   int  store(const char *to, uint length, CHARSET_INFO *charset);
   int  store(double nr) { return 1; }
   int  store(longlong nr) { return 1; }
-  int  reset(void) { return !maybe_null(); }
+  int  reset(void) { return !maybe_null() || Field_blob::reset(); }
 
   void get_key_image(char *buff,uint length, CHARSET_INFO *cs,imagetype type);
   void set_key_image(char *buff,uint length, CHARSET_INFO *cs);

From 6e93d2939df73eceb8b39e0c2e08e96fb4c764d2 Mon Sep 17 00:00:00 2001
From: unknown <gkodinov/kgeorge@magare.gmz>
Date: Mon, 26 Mar 2007 16:52:52 +0300
Subject: [PATCH 05/16] WL3527: 5.0 part: enabled the optional FOR JOIN to all
 the three clauses : USE, FORCE and IGNORE

mysql-test/r/select.result:
  WL3527: 5.0 part: test cases
mysql-test/t/select.test:
  WL3527: 5.0 part: test cases
---
 mysql-test/r/select.result |  6 ++++++
 mysql-test/t/select.test   |  2 ++
 sql/sql_yacc.yy            | 12 ++++--------
 3 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/mysql-test/r/select.result b/mysql-test/r/select.result
index 31d15981d93..b501d547e0a 100644
--- a/mysql-test/r/select.result
+++ b/mysql-test/r/select.result
@@ -3636,6 +3636,12 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 EXPLAIN SELECT 1 FROM t1 IGNORE INDEX FOR JOIN (a) WHERE a = 1;
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	t1	ALL	NULL	NULL	NULL	NULL	2	Using where
+EXPLAIN SELECT 1 FROM t1 USE INDEX FOR JOIN (a) WHERE a = 1;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	SIMPLE	t1	ref	a	a	5	const	1	Using where; Using index
+EXPLAIN SELECT 1 FROM t1 FORCE INDEX FOR JOIN (a) WHERE a = 1;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	SIMPLE	t1	ref	a	a	5	const	1	Using where; Using index
 DROP TABLE t1;
 CREATE TABLE t1 ( f1 int primary key, f2 int, f3 int, f4 int, f5 int, f6 int, checked_out int);
 CREATE TABLE t2 ( f11 int PRIMARY KEY );
diff --git a/mysql-test/t/select.test b/mysql-test/t/select.test
index 883ea7bf0b0..c5c7d07ee25 100644
--- a/mysql-test/t/select.test
+++ b/mysql-test/t/select.test
@@ -3111,6 +3111,8 @@ DROP TABLE t1,t2,t3;
 CREATE TABLE t1 (a INT, b INT, KEY (a)); INSERT INTO t1 VALUES (1,1),(2,2);
 EXPLAIN SELECT 1 FROM t1 WHERE a = 1;
 EXPLAIN SELECT 1 FROM t1 IGNORE INDEX FOR JOIN (a) WHERE a = 1;
+EXPLAIN SELECT 1 FROM t1 USE INDEX FOR JOIN (a) WHERE a = 1;
+EXPLAIN SELECT 1 FROM t1 FORCE INDEX FOR JOIN (a) WHERE a = 1;
 DROP TABLE t1;
 
 #
diff --git a/sql/sql_yacc.yy b/sql/sql_yacc.yy
index cc8d1ae9e6d..bbb0d11b942 100644
--- a/sql/sql_yacc.yy
+++ b/sql/sql_yacc.yy
@@ -1092,7 +1092,7 @@ bool my_yyoverflow(short **a, YYSTYPE **b, ulong *yystacksize);
 	key_alg opt_btree_or_rtree
 
 %type <string_list>
-	key_usage_list key_usage_list_inner using_list
+	key_usage_list using_list
 
 %type <key_part>
 	key_part
@@ -5907,19 +5907,15 @@ opt_key_definition:
 	    sel->use_index_ptr= &sel->use_index;
 	    sel->table_join_options|= TL_OPTION_FORCE_INDEX;
 	  }
-	| IGNORE_SYM key_or_index opt_for_join key_usage_list_inner
+	| IGNORE_SYM key_usage_list
 	  {
 	    SELECT_LEX *sel= Select;
-	    sel->ignore_index= *$4;
+	    sel->ignore_index= *$2;
 	    sel->ignore_index_ptr= &sel->ignore_index;
 	  };
 
 key_usage_list:
-	key_or_index key_usage_list_inner
-        { $$= $2; }
-	;
-
-key_usage_list_inner:
+        key_or_index opt_for_join      
 	{ Select->interval_list.empty(); }
         '(' key_list_or_empty ')'
         { $$= &Select->interval_list; }

From 8aa2d6bf920d513c6d9ffb260251ec893232f5da Mon Sep 17 00:00:00 2001
From: unknown <gkodinov/kgeorge@magare.gmz>
Date: Tue, 27 Mar 2007 19:28:04 +0300
Subject: [PATCH 06/16] Bug #26815:  When creating a temporary table the
 concise column type  of a string expression is decided based on its length: 
 - if its length is under 512 it is stored as either    varchar or char.  -
 otherwise it is stored as a BLOB.

 There is a flag (convert_blob_length) to create_tmp_field
 that, when >0 allows to force creation of a varchar if the
 max blob length is under convert_blob_length.
 However it must be verified that convert_blob_length
 (settable through a SQL option in some cases) is
 under the maximum that can be stored in a varchar column.
 While performing that check for expressions in
 create_tmp_field_from_item the max length of the blob was
 used instead. This causes blob columns to be created in the
 heap temp table used by GROUP_CONCAT (where blobs must not
 be created in the temp table because of the constant
 convert_blob_length that is passed to create_tmp_field() ).
 And since these blob columns are not expected in that place
 we get wrong results.
 Fixed by checking that the value of the flag variable is
 in the limits that fit into VARCHAR instead of the max length
 of the blob column.


mysql-test/r/func_gconcat.result:
  Bug #26815: test case
mysql-test/t/func_gconcat.test:
  Bug #26815: test case
sql/item_sum.cc:
  Bug #26815: wrong length was checked
sql/sql_select.cc:
  Bug #26815: wrong length was checked
---
 mysql-test/r/func_gconcat.result | 10 ++++++++++
 mysql-test/t/func_gconcat.test   | 12 +++++++++++-
 sql/item_sum.cc                  |  3 +--
 sql/sql_select.cc                |  3 +--
 4 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/mysql-test/r/func_gconcat.result b/mysql-test/r/func_gconcat.result
index 6989b89833b..71419b5b2c3 100644
--- a/mysql-test/r/func_gconcat.result
+++ b/mysql-test/r/func_gconcat.result
@@ -728,3 +728,13 @@ f2	group_concat(f1)
 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa	1
 bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb	2
 drop table t1;
+CREATE TABLE t1(a TEXT, b CHAR(20));
+INSERT INTO t1 VALUES ("one.1","one.1"),("two.2","two.2"),("one.3","one.3");
+SELECT GROUP_CONCAT(DISTINCT UCASE(a)) FROM t1;
+GROUP_CONCAT(DISTINCT UCASE(a))
+ONE.1,TWO.2,ONE.3
+SELECT GROUP_CONCAT(DISTINCT UCASE(b)) FROM t1;
+GROUP_CONCAT(DISTINCT UCASE(b))
+ONE.1,TWO.2,ONE.3
+DROP TABLE t1;
+End of 5.0 tests
diff --git a/mysql-test/t/func_gconcat.test b/mysql-test/t/func_gconcat.test
index 3ff4b35873b..0dd82864520 100644
--- a/mysql-test/t/func_gconcat.test
+++ b/mysql-test/t/func_gconcat.test
@@ -497,4 +497,14 @@ select f2,group_concat(f1) from t1 group by f2;
 --disable_metadata
 drop table t1;
 
-# End of 4.1 tests
+#
+# Bug #26815: Unexpected built-in function behavior: group_concat(distinct
+# substring_index())
+# 
+CREATE TABLE t1(a TEXT, b CHAR(20));
+INSERT INTO t1 VALUES ("one.1","one.1"),("two.2","two.2"),("one.3","one.3");
+SELECT GROUP_CONCAT(DISTINCT UCASE(a)) FROM t1;
+SELECT GROUP_CONCAT(DISTINCT UCASE(b)) FROM t1;
+DROP TABLE t1;
+
+--echo End of 5.0 tests
diff --git a/sql/item_sum.cc b/sql/item_sum.cc
index 368dc9a7d38..9d626cb7733 100644
--- a/sql/item_sum.cc
+++ b/sql/item_sum.cc
@@ -417,8 +417,7 @@ Field *Item_sum::create_tmp_field(bool group, TABLE *table,
       2-byte lenght. 
     */
     if (max_length/collation.collation->mbmaxlen > 255 && 
-        max_length/collation.collation->mbmaxlen < UINT_MAX16 &&
-        convert_blob_length)
+        convert_blob_length < UINT_MAX16 && convert_blob_length)
       return new Field_varstring(convert_blob_length, maybe_null,
                                  name, table,
                                  collation.collation);
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index bb57764700d..7e9b1fec12e 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -8805,8 +8805,7 @@ static Field *create_tmp_field_from_item(THD *thd, Item *item, TABLE *table,
       2-byte lenght. 
     */
     else if (item->max_length/item->collation.collation->mbmaxlen > 255 &&
-             item->max_length/item->collation.collation->mbmaxlen < UINT_MAX16
-             && convert_blob_length)
+             convert_blob_length < UINT_MAX16 && convert_blob_length)
       new_field= new Field_varstring(convert_blob_length, maybe_null,
                                      item->name, table,
                                      item->collation.collation);

From ec3de56263e748603b954e29ca35bacb3e386176 Mon Sep 17 00:00:00 2001
From: unknown <igor@olga.mysql.com>
Date: Tue, 27 Mar 2007 09:48:10 -0700
Subject: [PATCH 07/16] Fixed bug #27348. If a set function with a outer
 reference s(outer_ref) cannot be aggregated the outer query against which the
 reference has been resolved then MySQL interpretes s(outer_ref) in the same
 way as it would interpret s(const). Hovever the standard requires throwing an
 error in this situation. Added some code to support this requirement in ansi
 mode. Corrected another minor bug in Item_sum::check_sum_func.

mysql-test/r/subselect.result:
  Added a test case for bug #27348.
mysql-test/t/subselect.test:
  Added a test case for bug #27348.
sql/item_sum.cc:
  Fixed bug #27348.
  If a set function with a outer reference s(outer_ref) cannot be aggregated
  the outer query against which the reference has been resolved then MySQL
  interprets s(outer_ref) in the same way as it would interpret s(const).
  Hovever the standard requires throwing an error in this situation.
  Added some code to support this requirement in ansi mode.
  Corrected another minor bug in Item_sum::check_sum_func.
---
 mysql-test/r/subselect.result | 23 +++++++++++++++++++++++
 mysql-test/t/subselect.test   | 27 +++++++++++++++++++++++++++
 sql/item_sum.cc               |  7 +++++--
 3 files changed, 55 insertions(+), 2 deletions(-)

diff --git a/mysql-test/r/subselect.result b/mysql-test/r/subselect.result
index 81f087fe8fa..d5a1c0b2451 100644
--- a/mysql-test/r/subselect.result
+++ b/mysql-test/r/subselect.result
@@ -3924,3 +3924,26 @@ c	a	(SELECT GROUP_CONCAT(COUNT(a)+1) FROM t2 WHERE m = a)
 3	3	4
 1	4	2,2
 DROP table t1,t2;
+CREATE TABLE t1 (a int, b int);
+INSERT INTO t1 VALUES (2,22),(1,11),(2,22);
+SELECT a FROM t1 WHERE (SELECT COUNT(b) FROM DUAL) > 0 GROUP BY a;
+a
+1
+2
+SELECT a FROM t1 WHERE (SELECT COUNT(b) FROM DUAL) > 1 GROUP BY a;
+a
+SELECT a FROM t1 t0
+WHERE (SELECT COUNT(t0.b) FROM t1 t WHERE t.b>20) GROUP BY a;
+a
+1
+2
+SET @@sql_mode='ansi';
+SELECT a FROM t1 WHERE (SELECT COUNT(b) FROM DUAL) > 0 GROUP BY a;
+ERROR HY000: Invalid use of group function
+SELECT a FROM t1 WHERE (SELECT COUNT(b) FROM DUAL) > 1 GROUP BY a;
+ERROR HY000: Invalid use of group function
+SELECT a FROM t1 t0
+WHERE (SELECT COUNT(t0.b) FROM t1 t WHERE t.b>20) GROUP BY a;
+ERROR HY000: Invalid use of group function
+SET @@sql_mode=default;
+DROP TABLE t1;
diff --git a/mysql-test/t/subselect.test b/mysql-test/t/subselect.test
index efd54ca95d1..182b9b27ef7 100644
--- a/mysql-test/t/subselect.test
+++ b/mysql-test/t/subselect.test
@@ -2782,3 +2782,30 @@ SELECT COUNT(*) c, a,
   FROM t1 GROUP BY a;
 
 DROP table t1,t2;
+
+#
+# Bug #27348: SET FUNCTION used in  a subquery from WHERE condition 
+#  
+
+CREATE TABLE t1 (a int, b int);
+INSERT INTO t1 VALUES (2,22),(1,11),(2,22);
+
+SELECT a FROM t1 WHERE (SELECT COUNT(b) FROM DUAL) > 0 GROUP BY a;
+SELECT a FROM t1 WHERE (SELECT COUNT(b) FROM DUAL) > 1 GROUP BY a;
+
+SELECT a FROM t1 t0
+  WHERE (SELECT COUNT(t0.b) FROM t1 t WHERE t.b>20) GROUP BY a;
+
+SET @@sql_mode='ansi';
+--error 1111
+SELECT a FROM t1 WHERE (SELECT COUNT(b) FROM DUAL) > 0 GROUP BY a;
+--error 1111
+SELECT a FROM t1 WHERE (SELECT COUNT(b) FROM DUAL) > 1 GROUP BY a;
+
+--error 1111
+SELECT a FROM t1 t0
+  WHERE (SELECT COUNT(t0.b) FROM t1 t WHERE t.b>20) GROUP BY a;
+
+SET @@sql_mode=default;
+
+DROP TABLE t1;
diff --git a/sql/item_sum.cc b/sql/item_sum.cc
index 368dc9a7d38..e10357dc0e0 100644
--- a/sql/item_sum.cc
+++ b/sql/item_sum.cc
@@ -149,6 +149,8 @@ bool Item_sum::check_sum_func(THD *thd, Item **ref)
     if (register_sum_func(thd, ref))
       return TRUE;
     invalid= aggr_level < 0 && !(allow_sum_func & (1 << nest_level));
+    if (!invalid && thd->variables.sql_mode & MODE_ANSI)
+      invalid= aggr_level < 0 && max_arg_level < nest_level;
   }
   if (!invalid && aggr_level < 0)
   {
@@ -164,8 +166,9 @@ bool Item_sum::check_sum_func(THD *thd, Item **ref)
     Additionally we have to check whether possible nested set functions
     are acceptable here: they are not, if the level of aggregation of
     some of them is less than aggr_level.
-  */ 
-  invalid= aggr_level <= max_sum_func_level;
+  */
+  if (!invalid) 
+    invalid= aggr_level <= max_sum_func_level;
   if (invalid)  
   {
     my_message(ER_INVALID_GROUP_FUNC_USE, ER(ER_INVALID_GROUP_FUNC_USE),

From 04dc7c88309c270bb8607a2a195bb93aeccb4988 Mon Sep 17 00:00:00 2001
From: unknown <gkodinov/kgeorge@magare.gmz>
Date: Wed, 28 Mar 2007 12:09:30 +0300
Subject: [PATCH 08/16] disabled a test reuturning wrong result (reported
 separately)

---
 mysql-test/r/subselect3.result | 6 ------
 mysql-test/t/subselect3.test   | 5 +++--
 2 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/mysql-test/r/subselect3.result b/mysql-test/r/subselect3.result
index 6a7a601ccf9..96a3ee00a59 100644
--- a/mysql-test/r/subselect3.result
+++ b/mysql-test/r/subselect3.result
@@ -661,12 +661,6 @@ SELECT * FROM t1 GROUP by t1.a
 HAVING (MAX(t1.b) > (SELECT MAX(t2.b) FROM t2 WHERE t2.c < t1.c
 HAVING MAX(t2.b+t1.a) < 10));
 a	b	c
-SELECT a, AVG(b), (SELECT t.c FROM t1 AS t WHERE t1.a=t.a AND t.b=AVG(t1.b))
-AS test FROM t1 GROUP BY a;
-a	AVG(b)	test
-1	4.0000	NULL
-2	2.0000	k
-3	2.5000	NULL
 SELECT a,b,c FROM t1 WHERE b in (9,3,4) ORDER BY b,c;
 a	b	c
 1	3	c
diff --git a/mysql-test/t/subselect3.test b/mysql-test/t/subselect3.test
index e3703c0da16..e8eae3e2452 100644
--- a/mysql-test/t/subselect3.test
+++ b/mysql-test/t/subselect3.test
@@ -507,8 +507,9 @@ SELECT a, MAX(b), (SELECT t.c FROM t1 AS t WHERE t1.a=t.a AND t.b=MAX(t1.b))
 SELECT * FROM t1 GROUP by t1.a
   HAVING (MAX(t1.b) > (SELECT MAX(t2.b) FROM t2 WHERE t2.c < t1.c
                                                 HAVING MAX(t2.b+t1.a) < 10));
-SELECT a, AVG(b), (SELECT t.c FROM t1 AS t WHERE t1.a=t.a AND t.b=AVG(t1.b))
-  AS test FROM t1 GROUP BY a;
+#FIXME: Enable this test after fixing bug #27321
+#SELECT a, AVG(b), (SELECT t.c FROM t1 AS t WHERE t1.a=t.a AND t.b=AVG(t1.b))
+#  AS test FROM t1 GROUP BY a;
 
 SELECT a,b,c FROM t1 WHERE b in (9,3,4) ORDER BY b,c;
 

From c8f1cf4cf95279ad5726230603630cff2e6f7212 Mon Sep 17 00:00:00 2001
From: unknown <gkodinov/kgeorge@magare.gmz>
Date: Wed, 28 Mar 2007 14:35:23 +0300
Subject: [PATCH 09/16] Bug #27300:   Geometry fields have a result type string
 and a   special subclass to cater for the differences   between them and the
 base class (just like   DATE/TIME).   When creating temporary tables for
 results of   functions that return results of type GEOMETRY   we must
 construct fields of the derived class   instead of the base class.   Fixed by
 creating a GEOMETRY field (Field_geom)   instead of a generic BLOB
 (Field_blob) in temp   tables for the results of GIS functions that   have
 GEOMETRY return type (Item_geometry_func).

mysql-test/r/gis.result:
  Bug #27300: test case
mysql-test/t/gis.test:
  Bug #27300: test case
sql/item.cc:
  Bug #27300:
    Create a GEOMETRY field (Field_geom) instead of
    a generic BLOB (Field_blob) in temp tables for
    the results of GIS functions (Item_geometry_func).
sql/sql_select.cc:
  Bug #27300:
    Create a GEOMETRY field (Field_geom) instead of
    a generic BLOB (Field_blob) in temp tables for
    the results of GIS functions (Item_geometry_func).
---
 mysql-test/r/gis.result | 11 +++++++++++
 mysql-test/t/gis.test   | 11 +++++++++++
 sql/item.cc             |  5 ++++-
 sql/sql_select.cc       |  6 +++---
 4 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/mysql-test/r/gis.result b/mysql-test/r/gis.result
index 58149d68ca3..749c84a1a6f 100644
--- a/mysql-test/r/gis.result
+++ b/mysql-test/r/gis.result
@@ -769,3 +769,14 @@ create table t1 (g geometry not null);
 insert into t1 values(default);
 ERROR 22003: Cannot get geometry object from data you send to the GEOMETRY field
 drop table t1;
+CREATE TABLE t1 (a GEOMETRY);
+CREATE VIEW v1 AS SELECT GeomFromwkb(ASBINARY(a)) FROM t1;
+CREATE VIEW v2 AS SELECT a FROM t1;
+DESCRIBE v1;
+Field	Type	Null	Key	Default	Extra
+GeomFromwkb(ASBINARY(a))	geometry	YES		NULL	
+DESCRIBE v2;
+Field	Type	Null	Key	Default	Extra
+a	geometry	YES		NULL	
+DROP VIEW v1,v2;
+DROP TABLE t1;
diff --git a/mysql-test/t/gis.test b/mysql-test/t/gis.test
index d92ff804ccb..4f6104aab3e 100644
--- a/mysql-test/t/gis.test
+++ b/mysql-test/t/gis.test
@@ -479,3 +479,14 @@ create table t1 (g geometry not null);
 insert into t1 values(default);
 drop table t1;
 
+#
+# Bug #27300: create view with geometry functions lost columns types 
+#
+CREATE TABLE t1 (a GEOMETRY);
+CREATE VIEW v1 AS SELECT GeomFromwkb(ASBINARY(a)) FROM t1;
+CREATE VIEW v2 AS SELECT a FROM t1;
+DESCRIBE v1;
+DESCRIBE v2;
+
+DROP VIEW v1,v2;
+DROP TABLE t1;
diff --git a/sql/item.cc b/sql/item.cc
index 808e7925729..8568a44c547 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -4275,7 +4275,6 @@ Field *Item::tmp_table_field_from_field_type(TABLE *table)
   case MYSQL_TYPE_MEDIUM_BLOB:
   case MYSQL_TYPE_LONG_BLOB:
   case MYSQL_TYPE_BLOB:
-  case MYSQL_TYPE_GEOMETRY:
     if (this->type() == Item::TYPE_HOLDER)
       return new Field_blob(max_length, maybe_null, name, table,
                           collation.collation, 1);
@@ -4283,6 +4282,10 @@ Field *Item::tmp_table_field_from_field_type(TABLE *table)
       return new Field_blob(max_length, maybe_null, name, table,
                           collation.collation);
     break;					// Blob handled outside of case
+  case MYSQL_TYPE_GEOMETRY:
+    return new Field_geom(max_length, maybe_null, name, table,
+                          (Field::geometry_type)
+                          ((Item_geometry_func *)this)->get_geometry_type());
   }
 }
 
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index bb57764700d..d983146da93 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -8793,12 +8793,12 @@ static Field *create_tmp_field_from_item(THD *thd, Item *item, TABLE *table,
   
     enum enum_field_types type;
     /*
-      DATE/TIME fields have STRING_RESULT result type. To preserve
-      type they needed to be handled separately.
+      DATE/TIME and GEOMETRY fields have STRING_RESULT result type. 
+      To preserve type they needed to be handled separately.
     */
     if ((type= item->field_type()) == MYSQL_TYPE_DATETIME ||
         type == MYSQL_TYPE_TIME || type == MYSQL_TYPE_DATE ||
-        type == MYSQL_TYPE_TIMESTAMP)
+        type == MYSQL_TYPE_TIMESTAMP || type == MYSQL_TYPE_GEOMETRY)
       new_field= item->tmp_table_field_from_field_type(table);
     /* 
       Make sure that the blob fits into a Field_varstring which has 

From 425304f5626a2b2a0fc2ada1e0f306a3465341b4 Mon Sep 17 00:00:00 2001
From: unknown <sergefp@mysql.com>
Date: Wed, 28 Mar 2007 18:38:42 +0400
Subject: [PATCH 10/16] BUG#26625: crash in range optimizer (out of mem) -
 Define Sql_alloc::operator new() as thow() so that C++ compiler   handles
 NULL return values (there is no testcase as there is no portable way to set
 limit on the amount of memory that a process can allocate)

sql/sql_list.h:
  BUG#26625: crash in range optimizer (out of mem)
  - Define Sql_alloc::operator new() as thow() so that C++ compiler
    handles NULL return values
---
 sql/sql_list.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sql/sql_list.h b/sql/sql_list.h
index 47379ab1ddf..2075361a398 100644
--- a/sql/sql_list.h
+++ b/sql/sql_list.h
@@ -30,7 +30,7 @@
 class Sql_alloc
 {
 public:
-  static void *operator new(size_t size)
+  static void *operator new(size_t size) throw ()
   {
     return (void*) sql_alloc((uint) size);
   }
@@ -38,7 +38,7 @@ public:
   {
     return (void*) sql_alloc((uint) size);
   }
-  static void *operator new(size_t size, MEM_ROOT *mem_root)
+  static void *operator new(size_t size, MEM_ROOT *mem_root) throw ()
   { return (void*) alloc_root(mem_root, (uint) size); }
   static void operator delete(void *ptr, size_t size) { TRASH(ptr, size); }
   static void operator delete(void *ptr, MEM_ROOT *mem_root)

From 60189d3512798b054220f65468cddce88f8c3166 Mon Sep 17 00:00:00 2001
From: unknown <sergefp@mysql.com>
Date: Wed, 28 Mar 2007 19:05:30 +0400
Subject: [PATCH 11/16] Delete: sql/mysqld.cc.rej

---
 sql/mysqld.cc.rej | 161 ----------------------------------------------
 1 file changed, 161 deletions(-)
 delete mode 100644 sql/mysqld.cc.rej

diff --git a/sql/mysqld.cc.rej b/sql/mysqld.cc.rej
deleted file mode 100644
index bd7338143ae..00000000000
--- a/sql/mysqld.cc.rej
+++ /dev/null
@@ -1,161 +0,0 @@
-***************
-*** 177,188 ****
-  } /* cplusplus */
-  
-  
-- #if defined(HAVE_LINUXTHREADS)
-- #define THR_KILL_SIGNAL SIGINT
-- #else
-- #define THR_KILL_SIGNAL SIGUSR2		// Can't use this with LinuxThreads
-- #endif
-- 
-  #ifdef HAVE_GLIBC2_STYLE_GETHOSTBYNAME_R
-  #include <sys/types.h>
-  #else
---- 177,182 ----
-  } /* cplusplus */
-  
-  
-  #ifdef HAVE_GLIBC2_STYLE_GETHOSTBYNAME_R
-  #include <sys/types.h>
-  #else
-***************
-*** 505,510 ****
-  static void clean_up_mutexes(void);
-  static int test_if_case_insensitive(const char *dir_name);
-  static void create_pid_file();
-  
-  /****************************************************************************
-  ** Code to end mysqld
---- 499,505 ----
-  static void clean_up_mutexes(void);
-  static int test_if_case_insensitive(const char *dir_name);
-  static void create_pid_file();
-+ static uint get_thread_lib(void);
-  
-  /****************************************************************************
-  ** Code to end mysqld
-***************
-*** 544,550 ****
-      DBUG_PRINT("info",("Waiting for select_thread"));
-  
-  #ifndef DONT_USE_THR_ALARM
-!     if (pthread_kill(select_thread,THR_CLIENT_ALARM))
-        break;					// allready dead
-  #endif
-      set_timespec(abstime, 2);
---- 539,546 ----
-      DBUG_PRINT("info",("Waiting for select_thread"));
-  
-  #ifndef DONT_USE_THR_ALARM
-!     if (pthread_kill(select_thread,
-! 		     thd_lib_detected == THD_LIB_LT ? SIGALRM : SIGUSR1))
-        break;					// allready dead
-  #endif
-      set_timespec(abstime, 2);
-***************
-*** 844,850 ****
-  		      sig,my_thread_id());
-    }
-  #ifdef DONT_REMEMBER_SIGNAL
-!   sigset(sig,print_signal_warning);		/* int. thread system calls */
-  #endif
-  #if !defined(__WIN__) && !defined(OS2) && !defined(__NETWARE__)
-    if (sig == SIGALRM)
---- 840,846 ----
-  		      sig,my_thread_id());
-    }
-  #ifdef DONT_REMEMBER_SIGNAL
-!   my_sigset(sig, print_signal_warning);         /* int. thread system calls */
-  #endif
-  #if !defined(__WIN__) && !defined(OS2) && !defined(__NETWARE__)
-    if (sig == SIGALRM)
-***************
-*** 1841,1848 ****
-    DBUG_ENTER("init_signals");
-  
-    if (test_flags & TEST_SIGINT)
-!     sigset(THR_KILL_SIGNAL,end_thread_signal);
-!   sigset(THR_SERVER_ALARM,print_signal_warning); // Should never be called!
-  
-    if (!(test_flags & TEST_NO_STACKTRACE) || (test_flags & TEST_CORE_ON_SIGNAL))
-    {
---- 1837,1847 ----
-    DBUG_ENTER("init_signals");
-  
-    if (test_flags & TEST_SIGINT)
-!   {
-!     my_sigset(thd_lib_detected == THD_LIB_LT ? SIGINT : SIGUSR2,
-!               end_thread_signal);
-!   }
-!   my_sigset(THR_SERVER_ALARM, print_signal_warning); // Should never be called!
-  
-    if (!(test_flags & TEST_NO_STACKTRACE) || (test_flags & TEST_CORE_ON_SIGNAL))
-    {
-***************
-*** 1877,1883 ****
-  #endif
-    (void) sigemptyset(&set);
-  #ifdef THREAD_SPECIFIC_SIGPIPE
-!   sigset(SIGPIPE,abort_thread);
-    sigaddset(&set,SIGPIPE);
-  #else
-    (void) signal(SIGPIPE,SIG_IGN);		// Can't know which thread
---- 1876,1882 ----
-  #endif
-    (void) sigemptyset(&set);
-  #ifdef THREAD_SPECIFIC_SIGPIPE
-!   my_sigset(SIGPIPE, abort_thread);
-    sigaddset(&set,SIGPIPE);
-  #else
-    (void) signal(SIGPIPE,SIG_IGN);		// Can't know which thread
-***************
-*** 2237,2244 ****
-    MY_INIT(argv[0]);		// init my_sys library & pthreads
-    tzset();			// Set tzname
-  
-    start_time=time((time_t*) 0);
-- 
-  #ifdef OS2
-    {
-      // fix timezone for daylight saving
---- 2236,2243 ----
-    MY_INIT(argv[0]);		// init my_sys library & pthreads
-    tzset();			// Set tzname
-  
-+   thd_lib_detected= get_thread_lib();
-    start_time=time((time_t*) 0);
-  #ifdef OS2
-    {
-      // fix timezone for daylight saving
-***************
-*** 5547,5552 ****
-      (void) my_write(file, (byte*) buff, (uint) (end-buff),MYF(MY_WME));
-      (void) my_close(file, MYF(0));
-    }
-  }
-  
-  
---- 5546,5567 ----
-      (void) my_write(file, (byte*) buff, (uint) (end-buff),MYF(MY_WME));
-      (void) my_close(file, MYF(0));
-    }
-+ }
-+ 
-+ 
-+ static uint get_thread_lib(void)
-+ {
-+   char buff[64];
-+     
-+ #ifdef _CS_GNU_LIBPTHREAD_VERSION
-+   confstr(_CS_GNU_LIBPTHREAD_VERSION, buff, sizeof(buff));
-+ 
-+   if (!strncasecmp(buff, "NPTL", 4))
-+     return THD_LIB_NPTL;
-+   else if (!strncasecmp(buff, "linuxthreads", 12))
-+     return THD_LIB_LT;
-+ #endif
-+   return THD_LIB_OTHER;
-  }
-  
-  

From 9639eb3dda5347ecc342de94da3cc0e025e5c058 Mon Sep 17 00:00:00 2001
From: unknown <sergefp@mysql.com>
Date: Wed, 28 Mar 2007 20:16:01 +0400
Subject: [PATCH 12/16] BUG#26624: high mem usage (crash) in range optimizer -
 Added PARAM::alloced_sel_args where we count the # of SEL_ARGs   created by
 SEL_ARG tree cloning operations. - Made the range analyzer to shortcut and
 not do any more cloning   if we've already created MAX_SEL_ARGS SEL_ARG
 objects in cloning. - Added comments about space complexity of SEL_ARG-graph 
  representation.

mysql-test/r/range.result:
  BUG#26624: Testcase
mysql-test/t/range.test:
  BUG#26624: Testcase
---
 mysql-test/r/range.result |  28 +++++++
 mysql-test/t/range.test   |  32 ++++++++
 sql/opt_range.cc          | 162 ++++++++++++++++++++++++++++++--------
 3 files changed, 191 insertions(+), 31 deletions(-)

diff --git a/mysql-test/r/range.result b/mysql-test/r/range.result
index 4d6cafb61d1..15d5f1a0183 100644
--- a/mysql-test/r/range.result
+++ b/mysql-test/r/range.result
@@ -701,4 +701,32 @@ d8c4177d225791924.30714720
 d8c4177d2380fc201.39666693
 d8c4177d24ccef970.14957924
 DROP TABLE t1;
+create table t1 (
+c1  char(10), c2  char(10), c3  char(10), c4  char(10),
+c5  char(10), c6  char(10), c7  char(10), c8  char(10),
+c9  char(10), c10 char(10), c11 char(10), c12 char(10),
+c13 char(10), c14 char(10), c15 char(10), c16 char(10),
+index(c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12,c13,c14,c15,c16)
+);
+insert into t1 (c1) values ('1'),('1'),('1'),('1');
+select * from t1 where
+c1 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+and c2 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+and c3 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+and c4 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+and c5 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+and c6 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+and c7 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+and c8 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+and c9 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+and c10 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+and c11 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+and c12 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+and c13 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+and c14 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+and c15 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+and c16 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+;
+c1	c2	c3	c4	c5	c6	c7	c8	c9	c10	c11	c12	c13	c14	c15	c16
+drop table t1;
 End of 4.1 tests
diff --git a/mysql-test/t/range.test b/mysql-test/t/range.test
index 68ba43a8ba9..1e4cb91c03f 100644
--- a/mysql-test/t/range.test
+++ b/mysql-test/t/range.test
@@ -563,4 +563,36 @@ SELECT s.oxid FROM t1 v, t1 s
 
 DROP TABLE t1;
 
+# BUG#26624 high mem usage (crash) in range optimizer (depends on order of fields in where)
+create table t1 (
+  c1  char(10), c2  char(10), c3  char(10), c4  char(10),
+  c5  char(10), c6  char(10), c7  char(10), c8  char(10),
+  c9  char(10), c10 char(10), c11 char(10), c12 char(10),
+  c13 char(10), c14 char(10), c15 char(10), c16 char(10),
+  index(c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12,c13,c14,c15,c16)
+);
+
+insert into t1 (c1) values ('1'),('1'),('1'),('1');
+
+# This must run without crash and fast:
+select * from t1 where
+     c1 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+ and c2 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+ and c3 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+ and c4 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+ and c5 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+ and c6 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+ and c7 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+ and c8 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+ and c9 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+ and c10 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+ and c11 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+ and c12 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+ and c13 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+ and c14 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+ and c15 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+ and c16 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
+;
+drop table t1;
+
 --echo End of 4.1 tests
diff --git a/sql/opt_range.cc b/sql/opt_range.cc
index 06e42ff363f..11ba6c0e465 100644
--- a/sql/opt_range.cc
+++ b/sql/opt_range.cc
@@ -128,6 +128,89 @@ static char is_null_string[2]= {1,0};
    - get_quick_select()   - Walk the SEL_ARG, materialize the key intervals,
                             and create QUICK_RANGE_SELECT object that will
                             read records within these intervals.
+
+  4. SPACE COMPLEXITY NOTES 
+
+    SEL_ARG graph is a representation of an ordered disjoint sequence of
+    intervals over the ordered set of index tuple values.
+
+    For multi-part keys, one can construct a WHERE expression such that its
+    list of intervals will be of combinatorial size. Here is an example:
+     
+      (keypart1 IN (1,2, ..., n1)) AND 
+      (keypart2 IN (1,2, ..., n2)) AND 
+      (keypart3 IN (1,2, ..., n3))
+    
+    For this WHERE clause the list of intervals will have n1*n2*n3 intervals
+    of form
+     
+      (keypart1, keypart2, keypart3) = (k1, k2, k3), where 1 <= k{i} <= n{i}
+    
+    SEL_ARG graph structure aims to reduce the amount of required space by
+    "sharing" the elementary intervals when possible (the pic at the
+    beginning of this comment has examples of such sharing). The sharing may 
+    prevent combinatorial blowup:
+
+      There are WHERE clauses that have combinatorial-size interval lists but
+      will be represented by a compact SEL_ARG graph.
+      Example:
+        (keypartN IN (1,2, ..., n1)) AND 
+        ...
+        (keypart2 IN (1,2, ..., n2)) AND 
+        (keypart1 IN (1,2, ..., n3))
+
+    but not in all cases:
+
+    - There are WHERE clauses that do have a compact SEL_ARG-graph
+      representation but get_mm_tree() and its callees will construct a
+      graph of combinatorial size.
+      Example:
+        (keypart1 IN (1,2, ..., n1)) AND 
+        (keypart2 IN (1,2, ..., n2)) AND 
+        ...
+        (keypartN IN (1,2, ..., n3))
+
+    - There are WHERE clauses for which the minimal possible SEL_ARG graph
+      representation will have combinatorial size.
+      Example:
+        By induction: Let's take any interval on some keypart in the middle:
+
+           kp15=1 
+        
+        Then let's AND it with this interval 'structure' from preceding and
+        following keyparts:
+
+          (kp14=c1 AND kp16=c3) OR keypart14=c2) (*)
+        
+        We will obtain this SEL_ARG graph:
+ 
+             kp14     $      kp15     $      kp16
+                      $               $
+         +---------+  $   +--------+  $   +---------+
+         | kp14=c1 |--$-->| kp15=1 |--$-->| kp16=c3 |
+         +---------+  $   +--------+  $   +---------+
+              |       $               $              
+         +---------+  $   +--------+  $             
+         | kp14=c2 |--$-->| kp15=1 |  $             
+         +---------+  $   +--------+  $             
+                      $               $
+                      
+       Note that we had to duplicate "kp15=1" and there was no way to avoid
+       that. 
+       The induction step: AND the obtained expression with another "wrapping"
+       expression like (*).
+       When the process ends because of the limit on max. number of keyparts 
+       we'll have:
+
+         WHERE clause length  is O(3*#max_keyparts)
+         SEL_ARG graph size   is O(2^(#max_keyparts/2))
+
+       (it is also possible to construct a case where instead of 2 in 2^n we
+        have a bigger constant, e.g. 4, and get a graph with 4^(31/2)= 2^31
+        nodes)
+
+    We avoid consuming too much memory by setting a limit on the number of
+    SEL_ARG object we can construct during one range analysis invocation.
 */
 
 class SEL_ARG :public Sql_alloc
@@ -158,6 +241,8 @@ public:
   enum leaf_color { BLACK,RED } color;
   enum Type { IMPOSSIBLE, MAYBE, MAYBE_KEY, KEY_RANGE } type;
 
+  enum { MAX_SEL_ARGS = 64000 };
+
   SEL_ARG() {}
   SEL_ARG(SEL_ARG &);
   SEL_ARG(Field *,const char *,const char *);
@@ -227,7 +312,8 @@ public:
     return new SEL_ARG(field, part, min_value, arg->max_value,
 		       min_flag, arg->max_flag, maybe_flag | arg->maybe_flag);
   }
-  SEL_ARG *clone(SEL_ARG *new_parent,SEL_ARG **next);
+  SEL_ARG *clone(struct st_qsel_param *param, SEL_ARG *new_parent, 
+                  SEL_ARG **next);
 
   bool copy_min(SEL_ARG* arg)
   {						// Get overlapping range
@@ -365,7 +451,7 @@ public:
   {
     return parent->left == this ? &parent->left : &parent->right;
   }
-  SEL_ARG *clone_tree();
+  SEL_ARG *clone_tree(struct st_qsel_param *param);
 };
 
 
@@ -391,6 +477,8 @@ typedef struct st_qsel_param {
     max_key[MAX_KEY_LENGTH+MAX_FIELD_WIDTH];
   bool quick;				// Don't calulate possible keys
   COND *cond;
+  /* Numbr of SEL_ARG objects allocated by SEL_ARG::clone_tree operations */
+  uint alloced_sel_args; 
 } PARAM;
 
 static SEL_TREE * get_mm_parts(PARAM *param,COND *cond_func,Field *field,
@@ -413,8 +501,8 @@ static void print_quick(QUICK_SELECT *quick,const key_map* needed_reg);
 static SEL_TREE *tree_and(PARAM *param,SEL_TREE *tree1,SEL_TREE *tree2);
 static SEL_TREE *tree_or(PARAM *param,SEL_TREE *tree1,SEL_TREE *tree2);
 static SEL_ARG *sel_add(SEL_ARG *key1,SEL_ARG *key2);
-static SEL_ARG *key_or(SEL_ARG *key1,SEL_ARG *key2);
-static SEL_ARG *key_and(SEL_ARG *key1,SEL_ARG *key2,uint clone_flag);
+static SEL_ARG *key_or(PARAM *param, SEL_ARG *key1,SEL_ARG *key2);
+static SEL_ARG *key_and(PARAM *param, SEL_ARG *key1,SEL_ARG *key2,uint clone_flag);
 static bool get_range(SEL_ARG **e1,SEL_ARG **e2,SEL_ARG *root1);
 static bool get_quick_keys(PARAM *param,QUICK_SELECT *quick,KEY_PART *key,
 			   SEL_ARG *key_tree,char *min_key,uint min_key_flag,
@@ -424,6 +512,7 @@ static bool eq_tree(SEL_ARG* a,SEL_ARG *b);
 static SEL_ARG null_element(SEL_ARG::IMPOSSIBLE);
 static bool null_part_in_key(KEY_PART *key_part, const char *key, uint length);
 
+
 /***************************************************************************
 ** Basic functions for SQL_SELECT and QUICK_SELECT
 ***************************************************************************/
@@ -568,12 +657,17 @@ SEL_ARG::SEL_ARG(Field *field_,uint8 part_,char *min_value_,char *max_value_,
   left=right= &null_element;
 }
 
-SEL_ARG *SEL_ARG::clone(SEL_ARG *new_parent,SEL_ARG **next_arg)
+SEL_ARG *SEL_ARG::clone(PARAM *param, SEL_ARG *new_parent, SEL_ARG **next_arg)
 {
   SEL_ARG *tmp;
+
+  /* Bail out if we have already generated too many SEL_ARGs */
+  if (++param->alloced_sel_args > MAX_SEL_ARGS)
+    return 0;
+
   if (type != KEY_RANGE)
   {
-    if (!(tmp= new SEL_ARG(type)))
+    if (!(tmp= new (param->mem_root) SEL_ARG(type)))
       return 0;					// out of memory
     tmp->prev= *next_arg;			// Link into next/prev chain
     (*next_arg)->next=tmp;
@@ -581,20 +675,20 @@ SEL_ARG *SEL_ARG::clone(SEL_ARG *new_parent,SEL_ARG **next_arg)
   }
   else
   {
-    if (!(tmp= new SEL_ARG(field,part, min_value,max_value,
-			   min_flag, max_flag, maybe_flag)))
+    if (!(tmp= new (param->mem_root) SEL_ARG(field,part, min_value,max_value,
+                                             min_flag, max_flag, maybe_flag)))
       return 0;					// OOM
     tmp->parent=new_parent;
     tmp->next_key_part=next_key_part;
     if (left != &null_element)
-      tmp->left=left->clone(tmp,next_arg);
+      tmp->left=left->clone(param, tmp, next_arg);
 
     tmp->prev= *next_arg;			// Link into next/prev chain
     (*next_arg)->next=tmp;
     (*next_arg)= tmp;
 
     if (right != &null_element)
-      if (!(tmp->right= right->clone(tmp,next_arg)))
+      if (!(tmp->right= right->clone(param, tmp, next_arg)))
 	return 0;				// OOM
   }
   increment_use_count(1);
@@ -672,11 +766,12 @@ static int sel_cmp(Field *field, char *a,char *b,uint8 a_flag,uint8 b_flag)
 }
 
 
-SEL_ARG *SEL_ARG::clone_tree()
+SEL_ARG *SEL_ARG::clone_tree(PARAM *param)
 {
   SEL_ARG tmp_link,*next_arg,*root;
   next_arg= &tmp_link;
-  root= clone((SEL_ARG *) 0, &next_arg);
+  if (!(root= clone(param, (SEL_ARG *) 0, &next_arg)))
+    return 0;
   next_arg->next=0;				// Fix last link
   tmp_link.next->prev=0;			// Fix first link
   if (root)					// If not OOM
@@ -890,6 +985,7 @@ int SQL_SELECT::test_quick_select(THD *thd, key_map keys_to_use,
       param.real_keynr[param.keys++]=idx;
     }
     param.key_parts_end=key_parts;
+    param.alloced_sel_args= 0;
 
     if ((tree=get_mm_tree(&param,cond)))
     {
@@ -991,7 +1087,8 @@ static SEL_TREE *get_mm_tree(PARAM *param,COND *cond)
       while ((item=li++))
       {
 	SEL_TREE *new_tree=get_mm_tree(param,item);
-	if (param->thd->is_fatal_error)
+	if (param->thd->is_fatal_error || 
+            param->alloced_sel_args > SEL_ARG::MAX_SEL_ARGS)
 	  DBUG_RETURN(0);	// out of memory
 	tree=tree_and(param,tree,new_tree);
 	if (tree && tree->type == SEL_TREE::IMPOSSIBLE)
@@ -1524,7 +1621,7 @@ tree_and(PARAM *param,SEL_TREE *tree1,SEL_TREE *tree2)
     tree1->type=SEL_TREE::KEY_SMALLER;
     DBUG_RETURN(tree1);
   }
-
+  
   /* Join the trees key per key */
   SEL_ARG **key1,**key2,**end;
   for (key1= tree1->keys,key2= tree2->keys,end=key1+param->keys ;
@@ -1537,7 +1634,7 @@ tree_and(PARAM *param,SEL_TREE *tree1,SEL_TREE *tree2)
 	flag|=CLONE_KEY1_MAYBE;
       if (*key2 && !(*key2)->simple_key())
 	flag|=CLONE_KEY2_MAYBE;
-      *key1=key_and(*key1,*key2,flag);
+      *key1=key_and(param, *key1, *key2, flag);
       if (*key1 && (*key1)->type == SEL_ARG::IMPOSSIBLE)
       {
 	tree1->type= SEL_TREE::IMPOSSIBLE;
@@ -1574,7 +1671,7 @@ tree_or(PARAM *param,SEL_TREE *tree1,SEL_TREE *tree2)
   for (key1= tree1->keys,key2= tree2->keys,end=key1+param->keys ;
        key1 != end ; key1++,key2++)
   {
-    *key1=key_or(*key1,*key2);
+    *key1= key_or(param, *key1, *key2);
     if (*key1)
     {
       result=tree1;				// Added to tree1
@@ -1590,14 +1687,14 @@ tree_or(PARAM *param,SEL_TREE *tree1,SEL_TREE *tree2)
 /* And key trees where key1->part < key2 -> part */
 
 static SEL_ARG *
-and_all_keys(SEL_ARG *key1,SEL_ARG *key2,uint clone_flag)
+and_all_keys(PARAM *param, SEL_ARG *key1, SEL_ARG *key2, uint clone_flag)
 {
   SEL_ARG *next;
   ulong use_count=key1->use_count;
 
   if (key1->elements != 1)
   {
-    key2->use_count+=key1->elements-1;
+    key2->use_count+=key1->elements-1; //psergey: why we don't count that key1 has n-k-p?
     key2->increment_use_count((int) key1->elements-1);
   }
   if (key1->type == SEL_ARG::MAYBE_KEY)
@@ -1609,7 +1706,7 @@ and_all_keys(SEL_ARG *key1,SEL_ARG *key2,uint clone_flag)
   {
     if (next->next_key_part)
     {
-      SEL_ARG *tmp=key_and(next->next_key_part,key2,clone_flag);
+      SEL_ARG *tmp= key_and(param, next->next_key_part, key2, clone_flag);
       if (tmp && tmp->type == SEL_ARG::IMPOSSIBLE)
       {
 	key1=key1->tree_delete(next);
@@ -1618,6 +1715,8 @@ and_all_keys(SEL_ARG *key1,SEL_ARG *key2,uint clone_flag)
       next->next_key_part=tmp;
       if (use_count)
 	next->increment_use_count(use_count);
+      if (param->alloced_sel_args > SEL_ARG::MAX_SEL_ARGS)
+        break;
     }
     else
       next->next_key_part=key2;
@@ -1644,7 +1743,7 @@ and_all_keys(SEL_ARG *key1,SEL_ARG *key2,uint clone_flag)
 */
 
 static SEL_ARG *
-key_and(SEL_ARG *key1, SEL_ARG *key2, uint clone_flag)
+key_and(PARAM *param, SEL_ARG *key1, SEL_ARG *key2, uint clone_flag)
 {
   if (!key1)
     return key2;
@@ -1660,9 +1759,9 @@ key_and(SEL_ARG *key1, SEL_ARG *key2, uint clone_flag)
     // key1->part < key2->part
     key1->use_count--;
     if (key1->use_count > 0)
-      if (!(key1= key1->clone_tree()))
+      if (!(key1= key1->clone_tree(param)))
 	return 0;				// OOM
-    return and_all_keys(key1,key2,clone_flag);
+    return and_all_keys(param, key1, key2, clone_flag);
   }
 
   if (((clone_flag & CLONE_KEY2_MAYBE) &&
@@ -1680,14 +1779,14 @@ key_and(SEL_ARG *key1, SEL_ARG *key2, uint clone_flag)
     if (key1->use_count > 1)
     {
       key1->use_count--;
-      if (!(key1=key1->clone_tree()))
+      if (!(key1=key1->clone_tree(param)))
 	return 0;				// OOM
       key1->use_count++;
     }
     if (key1->type == SEL_ARG::MAYBE_KEY)
     {						// Both are maybe key
-      key1->next_key_part=key_and(key1->next_key_part,key2->next_key_part,
-				 clone_flag);
+      key1->next_key_part=key_and(param, key1->next_key_part, 
+                                  key2->next_key_part, clone_flag);
       if (key1->next_key_part &&
 	  key1->next_key_part->type == SEL_ARG::IMPOSSIBLE)
 	return key1;
@@ -1698,7 +1797,7 @@ key_and(SEL_ARG *key1, SEL_ARG *key2, uint clone_flag)
       if (key2->next_key_part)
       {
 	key1->use_count--;			// Incremented in and_all_keys
-	return and_all_keys(key1,key2,clone_flag);
+	return and_all_keys(param, key1, key2, clone_flag);
       }
       key2->use_count--;			// Key2 doesn't have a tree
     }
@@ -1727,7 +1826,8 @@ key_and(SEL_ARG *key1, SEL_ARG *key2, uint clone_flag)
     }
     else if (get_range(&e2,&e1,key2))
       continue;
-    SEL_ARG *next=key_and(e1->next_key_part,e2->next_key_part,clone_flag);
+    SEL_ARG *next=key_and(param, e1->next_key_part, e2->next_key_part,
+                          clone_flag);
     e1->increment_use_count(1);
     e2->increment_use_count(1);
     if (!next || next->type != SEL_ARG::IMPOSSIBLE)
@@ -1775,7 +1875,7 @@ get_range(SEL_ARG **e1,SEL_ARG **e2,SEL_ARG *root1)
 
 
 static SEL_ARG *
-key_or(SEL_ARG *key1,SEL_ARG *key2)
+key_or(PARAM *param, SEL_ARG *key1,SEL_ARG *key2)
 {
   if (!key1)
   {
@@ -1823,7 +1923,7 @@ key_or(SEL_ARG *key1,SEL_ARG *key2)
     {
       swap_variables(SEL_ARG *,key1,key2);
     }
-    if (key1->use_count > 0 || !(key1=key1->clone_tree()))
+    if (key1->use_count > 0 || !(key1=key1->clone_tree(param)))
       return 0;					// OOM
   }
 
@@ -1967,7 +2067,7 @@ key_or(SEL_ARG *key1,SEL_ARG *key2)
       {						// tmp.min. <= x <= tmp.max
 	tmp->maybe_flag|= key.maybe_flag;
 	key.increment_use_count(key1->use_count+1);
-	tmp->next_key_part=key_or(tmp->next_key_part,key.next_key_part);
+	tmp->next_key_part= key_or(param, tmp->next_key_part, key.next_key_part);
 	if (!cmp)				// Key2 is ready
 	  break;
 	key.copy_max_to_min(tmp);
@@ -1998,7 +2098,7 @@ key_or(SEL_ARG *key1,SEL_ARG *key2)
 	tmp->increment_use_count(key1->use_count+1);
 	/* Increment key count as it may be used for next loop */
 	key.increment_use_count(1);
-	new_arg->next_key_part=key_or(tmp->next_key_part,key.next_key_part);
+	new_arg->next_key_part= key_or(param, tmp->next_key_part, key.next_key_part);
 	key1=key1->insert(new_arg);
 	break;
       }

From 9b358f811b046ce5e188235d7e3d60424d5579e7 Mon Sep 17 00:00:00 2001
From: unknown <sergefp@mysql.com>
Date: Thu, 29 Mar 2007 10:27:58 +0400
Subject: [PATCH 13/16] BUG#26624: high mem usage (crash) in range optimizer  -
 Post-review fixes

---
 sql/opt_range.cc | 29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/sql/opt_range.cc b/sql/opt_range.cc
index 11ba6c0e465..ca8f31f5775 100644
--- a/sql/opt_range.cc
+++ b/sql/opt_range.cc
@@ -175,7 +175,7 @@ static char is_null_string[2]= {1,0};
       Example:
         By induction: Let's take any interval on some keypart in the middle:
 
-           kp15=1 
+           kp15=c0
         
         Then let's AND it with this interval 'structure' from preceding and
         following keyparts:
@@ -184,18 +184,18 @@ static char is_null_string[2]= {1,0};
         
         We will obtain this SEL_ARG graph:
  
-             kp14     $      kp15     $      kp16
-                      $               $
-         +---------+  $   +--------+  $   +---------+
-         | kp14=c1 |--$-->| kp15=1 |--$-->| kp16=c3 |
-         +---------+  $   +--------+  $   +---------+
-              |       $               $              
-         +---------+  $   +--------+  $             
-         | kp14=c2 |--$-->| kp15=1 |  $             
-         +---------+  $   +--------+  $             
-                      $               $
+             kp14     $      kp15      $      kp16
+                      $                $
+         +---------+  $   +---------+  $   +---------+
+         | kp14=c1 |--$-->| kp15=c0 |--$-->| kp16=c3 |
+         +---------+  $   +---------+  $   +---------+
+              |       $                $              
+         +---------+  $   +---------+  $             
+         | kp14=c2 |--$-->| kp15=c0 |  $             
+         +---------+  $   +---------+  $             
+                      $                $
                       
-       Note that we had to duplicate "kp15=1" and there was no way to avoid
+       Note that we had to duplicate "kp15=c0" and there was no way to avoid
        that. 
        The induction step: AND the obtained expression with another "wrapping"
        expression like (*).
@@ -477,7 +477,7 @@ typedef struct st_qsel_param {
     max_key[MAX_KEY_LENGTH+MAX_FIELD_WIDTH];
   bool quick;				// Don't calulate possible keys
   COND *cond;
-  /* Numbr of SEL_ARG objects allocated by SEL_ARG::clone_tree operations */
+  /* Number of SEL_ARG objects allocated by SEL_ARG::clone_tree operations */
   uint alloced_sel_args; 
 } PARAM;
 
@@ -681,7 +681,8 @@ SEL_ARG *SEL_ARG::clone(PARAM *param, SEL_ARG *new_parent, SEL_ARG **next_arg)
     tmp->parent=new_parent;
     tmp->next_key_part=next_key_part;
     if (left != &null_element)
-      tmp->left=left->clone(param, tmp, next_arg);
+      if (!(tmp->left=left->clone(param, tmp, next_arg)))
+	return 0;				// OOM
 
     tmp->prev= *next_arg;			// Link into next/prev chain
     (*next_arg)->next=tmp;

From 40c1a3f9a23e687c61e55419b5b56072c8e2e7f1 Mon Sep 17 00:00:00 2001
From: unknown <gkodinov/kgeorge@magare.gmz>
Date: Thu, 29 Mar 2007 19:19:31 +0300
Subject: [PATCH 14/16] Bug #26815:  When creating a temporary table the
 concise column type  of a string expression is decided based on its length: 
 - if its length is under 512 it is stored as either    varchar or char.  -
 otherwise it is stored as a BLOB.

 There is a flag (convert_blob_length) to create_tmp_field
 that, when >0 allows to force creation of a varchar if the
 max blob length is under convert_blob_length.
 However it must be verified that convert_blob_length
 (settable through a SQL option in some cases) is
 under the maximum that can be stored in a varchar column.
 While performing that check for expressions in
 create_tmp_field_from_item the max length of the blob was
 used instead. This causes blob columns to be created in the
 heap temp table used by GROUP_CONCAT (where blobs must not
 be created in the temp table because of the constant
 convert_blob_length that is passed to create_tmp_field() ).
 And since these blob columns are not expected in that place
 we get wrong results.
 Fixed by checking that the value of the flag variable is
 in the limits that fit into VARCHAR instead of the max length
 of the blob column.


mysql-test/r/func_gconcat.result:
  Bug #26815: test case
mysql-test/t/func_gconcat.test:
  Bug #26815: test case
sql/item_sum.cc:
  Bug #26815: wrong length was checked
sql/sql_select.cc:
  Bug #26815: wrong length was checked
---
 mysql-test/r/func_gconcat.result | 10 ++++++++++
 mysql-test/t/func_gconcat.test   | 12 +++++++++++-
 sql/item_sum.cc                  |  3 +--
 sql/sql_select.cc                |  3 +--
 4 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/mysql-test/r/func_gconcat.result b/mysql-test/r/func_gconcat.result
index 6989b89833b..71419b5b2c3 100644
--- a/mysql-test/r/func_gconcat.result
+++ b/mysql-test/r/func_gconcat.result
@@ -728,3 +728,13 @@ f2	group_concat(f1)
 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa	1
 bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb	2
 drop table t1;
+CREATE TABLE t1(a TEXT, b CHAR(20));
+INSERT INTO t1 VALUES ("one.1","one.1"),("two.2","two.2"),("one.3","one.3");
+SELECT GROUP_CONCAT(DISTINCT UCASE(a)) FROM t1;
+GROUP_CONCAT(DISTINCT UCASE(a))
+ONE.1,TWO.2,ONE.3
+SELECT GROUP_CONCAT(DISTINCT UCASE(b)) FROM t1;
+GROUP_CONCAT(DISTINCT UCASE(b))
+ONE.1,TWO.2,ONE.3
+DROP TABLE t1;
+End of 5.0 tests
diff --git a/mysql-test/t/func_gconcat.test b/mysql-test/t/func_gconcat.test
index 3ff4b35873b..0dd82864520 100644
--- a/mysql-test/t/func_gconcat.test
+++ b/mysql-test/t/func_gconcat.test
@@ -497,4 +497,14 @@ select f2,group_concat(f1) from t1 group by f2;
 --disable_metadata
 drop table t1;
 
-# End of 4.1 tests
+#
+# Bug #26815: Unexpected built-in function behavior: group_concat(distinct
+# substring_index())
+# 
+CREATE TABLE t1(a TEXT, b CHAR(20));
+INSERT INTO t1 VALUES ("one.1","one.1"),("two.2","two.2"),("one.3","one.3");
+SELECT GROUP_CONCAT(DISTINCT UCASE(a)) FROM t1;
+SELECT GROUP_CONCAT(DISTINCT UCASE(b)) FROM t1;
+DROP TABLE t1;
+
+--echo End of 5.0 tests
diff --git a/sql/item_sum.cc b/sql/item_sum.cc
index 368dc9a7d38..9d626cb7733 100644
--- a/sql/item_sum.cc
+++ b/sql/item_sum.cc
@@ -417,8 +417,7 @@ Field *Item_sum::create_tmp_field(bool group, TABLE *table,
       2-byte lenght. 
     */
     if (max_length/collation.collation->mbmaxlen > 255 && 
-        max_length/collation.collation->mbmaxlen < UINT_MAX16 &&
-        convert_blob_length)
+        convert_blob_length < UINT_MAX16 && convert_blob_length)
       return new Field_varstring(convert_blob_length, maybe_null,
                                  name, table,
                                  collation.collation);
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index bb57764700d..7e9b1fec12e 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -8805,8 +8805,7 @@ static Field *create_tmp_field_from_item(THD *thd, Item *item, TABLE *table,
       2-byte lenght. 
     */
     else if (item->max_length/item->collation.collation->mbmaxlen > 255 &&
-             item->max_length/item->collation.collation->mbmaxlen < UINT_MAX16
-             && convert_blob_length)
+             convert_blob_length < UINT_MAX16 && convert_blob_length)
       new_field= new Field_varstring(convert_blob_length, maybe_null,
                                      item->name, table,
                                      item->collation.collation);

From 86a0ffdd3c068edc63e3bda21d88980699c451dd Mon Sep 17 00:00:00 2001
From: unknown <evgen@sunlight.local>
Date: Fri, 30 Mar 2007 18:13:33 +0400
Subject: [PATCH 15/16] Bug#23233: 0 as LAST_INSERT_ID() after INSERT .. ON
 DUPLICATE in the NO_AUTO_VALUE_ON_ZERO mode.

In the NO_AUTO_VALUE_ON_ZERO mode the table->auto_increment_field_not_null
variable is used to indicate that a non-NULL value was specified by the user
for an auto_increment column. When an INSERT .. ON DUPLICATE updates the
auto_increment field this variable is set to true and stays unchanged for the
next insert operation. This makes the next inserted row sometimes wrongly have
0 as the value of the auto_increment field.

Now the fill_record() function resets the table->auto_increment_field_not_null
variable before filling the record.
The table->auto_increment_field_not_null variable is also reset by the
open_table() function for a case if we missed some auto_increment_field_not_null
handling bug.
Now the table->auto_increment_field_not_null is reset at the end of the
mysql_load() function.

Reset the table->auto_increment_field_not_null variable after each
write_row() call in the copy_data_between_tables() function.




sql/field_conv.cc:
  Bug#23233: 0 as LAST_INSERT_ID() after INSERT .. ON DUPLICATE in the
  NO_AUTO_VALUE_ON_ZERO mode.
  A comment is corrected.
sql/handler.cc:
  Bug#23233: 0 as LAST_INSERT_ID() after INSERT .. ON DUPLICATE in the
  NO_AUTO_VALUE_ON_ZERO mode.
  Now the handler::update_auto_increment() function doesn't reset the
  table->auto_increment_field_not_null variable as it is done in the
  fill_record() function.
sql/sql_base.cc:
  Bug#23233: 0 as LAST_INSERT_ID() after INSERT .. ON DUPLICATE in the
  NO_AUTO_VALUE_ON_ZERO mode.
  Now the fill_record() function resets the table->auto_increment_field_not_null
  variable before filling the record.
  The table->auto_increment_field_not_null variable is also reset by the
  open_table() function for a case if we missed some auto_increment_field_not_null
  handling bug.
sql/sql_insert.cc:
  Bug#23233: 0 as LAST_INSERT_ID() after INSERT .. ON DUPLICATE in the
  NO_AUTO_VALUE_ON_ZERO mode.
  Now the the table->auto_increment_field_not_null is reset at the end of the
  mysql_insert() an in the select_insert class destructor.
sql/sql_load.cc:
  Bug#23233: 0 as LAST_INSERT_ID() after INSERT .. ON DUPLICATE in the
  NO_AUTO_VALUE_ON_ZERO mode.
  Now the table->auto_increment_field_not_null is reset at the end of the
  mysql_load() function.
sql/sql_table.cc:
  Bug#23233: 0 as LAST_INSERT_ID() after INSERT .. ON DUPLICATE in the
  NO_AUTO_VALUE_ON_ZERO mode.
  Reset the table->auto_increment_field_not_null variable after each
  write_row() call in the copy_data_between_tables() function.
sql/table.h:
  Bug#23233: 0 as LAST_INSERT_ID() after INSERT .. ON DUPLICATE in the
  NO_AUTO_VALUE_ON_ZERO mode.
  A comment added.
mysql-test/r/insert_update.result:
  Added the test case for the bug#23233: 0 as LAST_INSERT_ID() after
  INSERT .. ON DUPLICATE in the NO_AUTO_VALUE_ON_ZERO mode.
mysql-test/t/insert_update.test:
  Added the test case for the bug#23233: 0 as LAST_INSERT_ID() after
  INSERT .. ON DUPLICATE in the NO_AUTO_VALUE_ON_ZERO mode.
---
 mysql-test/r/insert_update.result | 78 +++++++++++++++++++++++++++++++
 mysql-test/t/insert_update.test   | 52 +++++++++++++++++++++
 sql/field_conv.cc                 |  2 +-
 sql/handler.cc                    |  6 +--
 sql/sql_base.cc                   | 67 ++++++++++++++++++++++++--
 sql/sql_insert.cc                 |  2 +
 sql/sql_load.cc                   |  3 +-
 sql/sql_table.cc                  |  4 +-
 sql/table.h                       |  5 ++
 9 files changed, 205 insertions(+), 14 deletions(-)

diff --git a/mysql-test/r/insert_update.result b/mysql-test/r/insert_update.result
index ef0d8ec239e..fd70fcb9084 100644
--- a/mysql-test/r/insert_update.result
+++ b/mysql-test/r/insert_update.result
@@ -258,3 +258,81 @@ SELECT LAST_INSERT_ID();
 LAST_INSERT_ID()
 1
 DROP TABLE t1;
+SET SQL_MODE='NO_AUTO_VALUE_ON_ZERO';
+CREATE TABLE `t1` (
+`id` int(11) PRIMARY KEY auto_increment,
+`f1` varchar(10) NOT NULL UNIQUE
+);
+INSERT IGNORE INTO t1 (f1) VALUES ("test1")
+ON DUPLICATE KEY UPDATE id=LAST_INSERT_ID(id);
+INSERT IGNORE INTO t1 (f1) VALUES ("test1")
+ON DUPLICATE KEY UPDATE id=LAST_INSERT_ID(id);
+SELECT LAST_INSERT_ID();
+LAST_INSERT_ID()
+1
+SELECT * FROM t1;
+id	f1
+1	test1
+INSERT IGNORE INTO t1 (f1) VALUES ("test2")
+ON DUPLICATE KEY UPDATE id=LAST_INSERT_ID(id);
+SELECT * FROM t1;
+id	f1
+1	test1
+2	test2
+INSERT IGNORE INTO t1 (f1) VALUES ("test2")
+ON DUPLICATE KEY UPDATE id=LAST_INSERT_ID(id);
+SELECT LAST_INSERT_ID();
+LAST_INSERT_ID()
+2
+SELECT * FROM t1;
+id	f1
+1	test1
+2	test2
+INSERT IGNORE INTO t1 (f1) VALUES ("test3")
+ON DUPLICATE KEY UPDATE id=LAST_INSERT_ID(id);
+SELECT LAST_INSERT_ID();
+LAST_INSERT_ID()
+3
+SELECT * FROM t1;
+id	f1
+1	test1
+2	test2
+3	test3
+DROP TABLE t1;
+CREATE TABLE `t1` (
+`id` int(11) PRIMARY KEY auto_increment,
+`f1` varchar(10) NOT NULL UNIQUE
+);
+INSERT IGNORE INTO t1 (f1) VALUES ("test1")
+ON DUPLICATE KEY UPDATE id=LAST_INSERT_ID(id);
+SELECT LAST_INSERT_ID();
+LAST_INSERT_ID()
+1
+SELECT * FROM t1;
+id	f1
+1	test1
+INSERT IGNORE INTO t1 (f1) VALUES ("test1"),("test4")
+ON DUPLICATE KEY UPDATE id=LAST_INSERT_ID(id);
+SELECT LAST_INSERT_ID();
+LAST_INSERT_ID()
+1
+SELECT * FROM t1;
+id	f1
+1	test1
+2	test4
+DROP TABLE t1;
+CREATE TABLE `t1` (
+`id` int(11) PRIMARY KEY auto_increment,
+`f1` varchar(10) NOT NULL UNIQUE,
+tim1 timestamp default '2003-01-01 00:00:00' on update current_timestamp
+);
+INSERT INTO t1 (f1) VALUES ("test1");
+SELECT id, f1 FROM t1;
+id	f1
+1	test1
+REPLACE INTO t1 VALUES (0,"test1",null);
+SELECT id, f1 FROM t1;
+id	f1
+0	test1
+DROP TABLE t1;
+SET SQL_MODE='';
diff --git a/mysql-test/t/insert_update.test b/mysql-test/t/insert_update.test
index b0de66f7fc6..76df4502769 100644
--- a/mysql-test/t/insert_update.test
+++ b/mysql-test/t/insert_update.test
@@ -195,3 +195,55 @@ SELECT LAST_INSERT_ID();
 INSERT t1 (f2) VALUES ('test') ON DUPLICATE KEY UPDATE f1 = LAST_INSERT_ID(f1);
 SELECT LAST_INSERT_ID();
 DROP TABLE t1;
+
+#
+# Bug#23233: 0 as LAST_INSERT_ID() after INSERT .. ON DUPLICATE in the
+#            NO_AUTO_VALUE_ON_ZERO mode.
+#
+SET SQL_MODE='NO_AUTO_VALUE_ON_ZERO';
+CREATE TABLE `t1` (
+  `id` int(11) PRIMARY KEY auto_increment,
+  `f1` varchar(10) NOT NULL UNIQUE
+);
+INSERT IGNORE INTO t1 (f1) VALUES ("test1")
+	ON DUPLICATE KEY UPDATE id=LAST_INSERT_ID(id);
+INSERT IGNORE INTO t1 (f1) VALUES ("test1")
+	ON DUPLICATE KEY UPDATE id=LAST_INSERT_ID(id);
+SELECT LAST_INSERT_ID();
+SELECT * FROM t1;
+INSERT IGNORE INTO t1 (f1) VALUES ("test2")
+	ON DUPLICATE KEY UPDATE id=LAST_INSERT_ID(id);
+SELECT * FROM t1;
+INSERT IGNORE INTO t1 (f1) VALUES ("test2")
+	ON DUPLICATE KEY UPDATE id=LAST_INSERT_ID(id);
+SELECT LAST_INSERT_ID();
+SELECT * FROM t1;
+INSERT IGNORE INTO t1 (f1) VALUES ("test3")
+	ON DUPLICATE KEY UPDATE id=LAST_INSERT_ID(id);
+SELECT LAST_INSERT_ID();
+SELECT * FROM t1;
+DROP TABLE t1;
+CREATE TABLE `t1` (
+  `id` int(11) PRIMARY KEY auto_increment,
+  `f1` varchar(10) NOT NULL UNIQUE
+);
+INSERT IGNORE INTO t1 (f1) VALUES ("test1")
+	ON DUPLICATE KEY UPDATE id=LAST_INSERT_ID(id);
+SELECT LAST_INSERT_ID();
+SELECT * FROM t1;
+INSERT IGNORE INTO t1 (f1) VALUES ("test1"),("test4")
+	ON DUPLICATE KEY UPDATE id=LAST_INSERT_ID(id);
+SELECT LAST_INSERT_ID();
+SELECT * FROM t1;
+DROP TABLE t1;
+CREATE TABLE `t1` (
+  `id` int(11) PRIMARY KEY auto_increment,
+  `f1` varchar(10) NOT NULL UNIQUE,
+  tim1 timestamp default '2003-01-01 00:00:00' on update current_timestamp
+);
+INSERT INTO t1 (f1) VALUES ("test1");
+SELECT id, f1 FROM t1;
+REPLACE INTO t1 VALUES (0,"test1",null);
+SELECT id, f1 FROM t1;
+DROP TABLE t1;
+SET SQL_MODE='';
diff --git a/sql/field_conv.cc b/sql/field_conv.cc
index 32180f0a93e..429d914db97 100644
--- a/sql/field_conv.cc
+++ b/sql/field_conv.cc
@@ -173,7 +173,7 @@ set_field_to_null_with_conversions(Field *field, bool no_conversions)
   if (field == field->table->next_number_field)
   {
     field->table->auto_increment_field_not_null= FALSE;
-    return 0;					// field is set in handler.cc
+    return 0;				  // field is set in fill_record()
   }
   if (current_thd->count_cuted_fields == CHECK_FIELD_WARN)
   {
diff --git a/sql/handler.cc b/sql/handler.cc
index 524f47209dc..6cba079e736 100644
--- a/sql/handler.cc
+++ b/sql/handler.cc
@@ -1598,7 +1598,6 @@ int handler::update_auto_increment()
   ulonglong nr;
   THD *thd= table->in_use;
   struct system_variables *variables= &thd->variables;
-  bool auto_increment_field_not_null;
   DBUG_ENTER("handler::update_auto_increment");
 
   /*
@@ -1606,14 +1605,11 @@ int handler::update_auto_increment()
     row was not inserted
   */
   thd->prev_insert_id= thd->next_insert_id;
-  auto_increment_field_not_null= table->auto_increment_field_not_null;
-  table->auto_increment_field_not_null= FALSE;
 
   if ((nr= table->next_number_field->val_int()) != 0 ||
-      auto_increment_field_not_null &&
+      table->auto_increment_field_not_null &&
       thd->variables.sql_mode & MODE_NO_AUTO_VALUE_ON_ZERO)
   {
-    /* Clear flag for next row */
     /* Mark that we didn't generate a new value **/
     auto_increment_column_changed=0;
     adjust_next_insert_id_after_explicit_value(nr);
diff --git a/sql/sql_base.cc b/sql/sql_base.cc
index 97cb2d00689..1689e5c65c0 100644
--- a/sql/sql_base.cc
+++ b/sql/sql_base.cc
@@ -1640,6 +1640,9 @@ TABLE *open_table(THD *thd, TABLE_LIST *table_list, MEM_ROOT *mem_root,
   table->used_keys= table->s->keys_for_keyread;
   table->fulltext_searched= 0;
   table->file->ft_handler= 0;
+  /* Catch wrong handling of the auto_increment_field_not_null. */
+  DBUG_ASSERT(!table->auto_increment_field_not_null);
+  table->auto_increment_field_not_null= FALSE;
   if (table->timestamp_field)
     table->timestamp_field_type= table->timestamp_field->get_auto_set_type();
   table->pos_in_table_list= table_list;
@@ -5272,6 +5275,11 @@ err_no_arena:
     values        values to fill with
     ignore_errors TRUE if we should ignore errors
 
+  NOTE
+    fill_record() may set table->auto_increment_field_not_null and a
+    caller should make sure that it is reset after their last call to this
+    function.
+
   RETURN
     FALSE   OK
     TRUE    error occured
@@ -5284,27 +5292,52 @@ fill_record(THD * thd, List<Item> &fields, List<Item> &values,
   List_iterator_fast<Item> f(fields),v(values);
   Item *value, *fld;
   Item_field *field;
+  TABLE *table= 0;
   DBUG_ENTER("fill_record");
 
+  /*
+    Reset the table->auto_increment_field_not_null as it is valid for
+    only one row.
+  */
+  if (fields.elements)
+  {
+    /*
+      On INSERT or UPDATE fields are checked to be from the same table,
+      thus we safely can take table from the first field.
+    */
+    fld= (Item_field*)f++;
+    if (!(field= fld->filed_for_view_update()))
+    {
+      my_error(ER_NONUPDATEABLE_COLUMN, MYF(0), fld->name);
+      goto err;
+    }
+    table= field->field->table;
+    table->auto_increment_field_not_null= FALSE;
+    f.rewind();
+  }
   while ((fld= f++))
   {
     if (!(field= fld->filed_for_view_update()))
     {
       my_error(ER_NONUPDATEABLE_COLUMN, MYF(0), fld->name);
-      DBUG_RETURN(TRUE);
+      goto err;
     }
     value=v++;
     Field *rfield= field->field;
-    TABLE *table= rfield->table;
+    table= rfield->table;
     if (rfield == table->next_number_field)
       table->auto_increment_field_not_null= TRUE;
     if ((value->save_in_field(rfield, 0) < 0) && !ignore_errors)
     {
       my_message(ER_UNKNOWN_ERROR, ER(ER_UNKNOWN_ERROR), MYF(0));
-      DBUG_RETURN(TRUE);
+      goto err;
     }
   }
   DBUG_RETURN(thd->net.report_error);
+err:
+  if (table)
+    table->auto_increment_field_not_null= FALSE;
+  DBUG_RETURN(TRUE);
 }
 
 
@@ -5353,6 +5386,11 @@ fill_record_n_invoke_before_triggers(THD *thd, List<Item> &fields,
     values        list of fields
     ignore_errors TRUE if we should ignore errors
 
+  NOTE
+    fill_record() may set table->auto_increment_field_not_null and a
+    caller should make sure that it is reset after their last call to this
+    function.
+
   RETURN
     FALSE   OK
     TRUE    error occured
@@ -5363,19 +5401,38 @@ fill_record(THD *thd, Field **ptr, List<Item> &values, bool ignore_errors)
 {
   List_iterator_fast<Item> v(values);
   Item *value;
+  TABLE *table= 0;
   DBUG_ENTER("fill_record");
 
   Field *field;
+  /*
+    Reset the table->auto_increment_field_not_null as it is valid for
+    only one row.
+  */
+  if (*ptr)
+  {
+    /*
+      On INSERT or UPDATE fields are checked to be from the same table,
+      thus we safely can take table from the first field.
+    */
+    table= (*ptr)->table;
+    table->auto_increment_field_not_null= FALSE;
+  }
   while ((field = *ptr++))
   {
     value=v++;
-    TABLE *table= field->table;
+    table= field->table;
     if (field == table->next_number_field)
       table->auto_increment_field_not_null= TRUE;
     if (value->save_in_field(field, 0) == -1)
-      DBUG_RETURN(TRUE);
+      goto err;
   }
   DBUG_RETURN(thd->net.report_error);
+
+err:
+  if (table)
+    table->auto_increment_field_not_null= FALSE;
+  DBUG_RETURN(TRUE);
 }
 
 
diff --git a/sql/sql_insert.cc b/sql/sql_insert.cc
index d9d32d14321..0fa027f89d6 100644
--- a/sql/sql_insert.cc
+++ b/sql/sql_insert.cc
@@ -757,6 +757,7 @@ bool mysql_insert(THD *thd,TABLE_LIST *table_list,
   table->next_number_field=0;
   thd->count_cuted_fields= CHECK_FIELD_IGNORE;
   thd->next_insert_id=0;			// Reset this if wrongly used
+  table->auto_increment_field_not_null= FALSE;
   if (duplic != DUP_ERROR || ignore)
     table->file->extra(HA_EXTRA_NO_IGNORE_DUP_KEY);
   if (duplic == DUP_REPLACE &&
@@ -2571,6 +2572,7 @@ select_insert::~select_insert()
   if (table)
   {
     table->next_number_field=0;
+    table->auto_increment_field_not_null= FALSE;
     table->file->reset();
   }
   thd->count_cuted_fields= CHECK_FIELD_IGNORE;
diff --git a/sql/sql_load.cc b/sql/sql_load.cc
index 3f67a0c3f5d..7a535381c01 100644
--- a/sql/sql_load.cc
+++ b/sql/sql_load.cc
@@ -493,6 +493,7 @@ err:
     mysql_unlock_tables(thd, thd->lock);
     thd->lock=0;
   }
+  table->auto_increment_field_not_null= FALSE;
   thd->abort_on_warning= 0;
   DBUG_RETURN(error);
 }
@@ -589,8 +590,6 @@ read_fixed_length(THD *thd, COPY_INFO &info, TABLE_LIST *table_list,
       {
 	uint length;
 	byte save_chr;
-        if (field == table->next_number_field)
-          table->auto_increment_field_not_null= TRUE;
 	if ((length=(uint) (read_info.row_end-pos)) >
 	    field->field_length)
 	  length=field->field_length;
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index c75aff7fab6..8b3028f5370 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -4058,7 +4058,9 @@ copy_data_between_tables(TABLE *from,TABLE *to,
     {
       copy_ptr->do_copy(copy_ptr);
     }
-    if ((error=to->file->write_row((byte*) to->record[0])))
+    error=to->file->write_row((byte*) to->record[0]);
+    to->auto_increment_field_not_null= FALSE;
+    if (error)
     {
       if (!ignore ||
 	  (error != HA_ERR_FOUND_DUPP_KEY &&
diff --git a/sql/table.h b/sql/table.h
index e2bd5ba0a7d..b795fa78e51 100644
--- a/sql/table.h
+++ b/sql/table.h
@@ -273,6 +273,11 @@ struct st_table {
   my_bool no_cache;
   /* To signal that we should reset query_id for tables and cols */
   my_bool clear_query_id;
+  /*
+    To indicate that a non-null value of the auto_increment field
+    was provided by the user or retrieved from the current record.
+    Used only in the MODE_NO_AUTO_VALUE_ON_ZERO mode.
+  */
   my_bool auto_increment_field_not_null;
   my_bool insert_or_update;             /* Can be used by the handler */
   my_bool alias_name_used;		/* true if table_name is alias */

From 080c0c7ac8df45e6d6eb544e611183d029f4fb63 Mon Sep 17 00:00:00 2001
From: unknown <sergefp@mysql.com>
Date: Sat, 31 Mar 2007 00:29:18 +0400
Subject: [PATCH 16/16] BUG#26624: high mem usage (crash) in range optimizer
 Pushbuild fixes:  - Make MAX_SEL_ARGS smaller (even 16K records_in_range()
 calls is    more than it makes sense to do in typical cases)  - Don't call
 sel_arg->test_use_count() if we've already allocated    more than
 MAX_SEL_ARGs elements. The test will succeed but will take    too much time
 for the test suite (and not provide much value).

mysql-test/r/range.result:
  BUG#26624: high mem usage (crash) in range optimizer
  Pushbuild fixes: make the test go faster
mysql-test/t/range.test:
  BUG#26624: high mem usage (crash) in range optimizer
  Pushbuild fixes: make the test go faster
---
 mysql-test/r/range.result | 147 ++++++++++++++++++++++++++++++++-----
 mysql-test/t/range.test   | 149 +++++++++++++++++++++++++++++++++-----
 sql/opt_range.cc          |   8 +-
 3 files changed, 265 insertions(+), 39 deletions(-)

diff --git a/mysql-test/r/range.result b/mysql-test/r/range.result
index 15d5f1a0183..4aaa114c0f9 100644
--- a/mysql-test/r/range.result
+++ b/mysql-test/r/range.result
@@ -710,23 +710,136 @@ index(c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12,c13,c14,c15,c16)
 );
 insert into t1 (c1) values ('1'),('1'),('1'),('1');
 select * from t1 where
-c1 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-and c2 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-and c3 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-and c4 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-and c5 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-and c6 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-and c7 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-and c8 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-and c9 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-and c10 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-and c11 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-and c12 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-and c13 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-and c14 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-and c15 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-and c16 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-;
+c1 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+"abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+"abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+"abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+"abcdefg4", "123456784", "qwertyui4", "asddfg4",
+"abcdefg5", "123456785", "qwertyui5", "asddfg5",
+"abcdefg6", "123456786", "qwertyui6", "asddfg6",
+"abcdefg7", "123456787", "qwertyui7", "asddfg7",
+"abcdefg8", "123456788", "qwertyui8", "asddfg8",
+"abcdefg9", "123456789", "qwertyui9", "asddfg9",
+"abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+"abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+"abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+and c2 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+"abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+"abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+"abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+"abcdefg4", "123456784", "qwertyui4", "asddfg4", 
+"abcdefg5", "123456785", "qwertyui5", "asddfg5",
+"abcdefg6", "123456786", "qwertyui6", "asddfg6",
+"abcdefg7", "123456787", "qwertyui7", "asddfg7",
+"abcdefg8", "123456788", "qwertyui8", "asddfg8",
+"abcdefg9", "123456789", "qwertyui9", "asddfg9",
+"abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+"abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+"abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+and c3 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+"abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+"abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+"abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+"abcdefg4", "123456784", "qwertyui4", "asddfg4", 
+"abcdefg5", "123456785", "qwertyui5", "asddfg5",
+"abcdefg6", "123456786", "qwertyui6", "asddfg6",
+"abcdefg7", "123456787", "qwertyui7", "asddfg7",
+"abcdefg8", "123456788", "qwertyui8", "asddfg8",
+"abcdefg9", "123456789", "qwertyui9", "asddfg9",
+"abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+"abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+"abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+and c4 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+"abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+"abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+"abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+"abcdefg4", "123456784", "qwertyui4", "asddfg4", 
+"abcdefg5", "123456785", "qwertyui5", "asddfg5", 
+"abcdefg6", "123456786", "qwertyui6", "asddfg6",
+"abcdefg7", "123456787", "qwertyui7", "asddfg7",
+"abcdefg8", "123456788", "qwertyui8", "asddfg8",
+"abcdefg9", "123456789", "qwertyui9", "asddfg9",
+"abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+"abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+"abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+and c5 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+"abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+"abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+"abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+"abcdefg4", "123456784", "qwertyui4", "asddfg4",
+"abcdefg5", "123456785", "qwertyui5", "asddfg5",
+"abcdefg6", "123456786", "qwertyui6", "asddfg6",
+"abcdefg7", "123456787", "qwertyui7", "asddfg7",
+"abcdefg8", "123456788", "qwertyui8", "asddfg8",
+"abcdefg9", "123456789", "qwertyui9", "asddfg9",
+"abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+"abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+"abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+and c6 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+"abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+"abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+"abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+"abcdefg4", "123456784", "qwertyui4", "asddfg4",
+"abcdefg5", "123456785", "qwertyui5", "asddfg5",
+"abcdefg6", "123456786", "qwertyui6", "asddfg6",
+"abcdefg7", "123456787", "qwertyui7", "asddfg7",
+"abcdefg8", "123456788", "qwertyui8", "asddfg8",
+"abcdefg9", "123456789", "qwertyui9", "asddfg9",
+"abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+"abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+"abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+and c7 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+"abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+"abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+"abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+"abcdefg4", "123456784", "qwertyui4", "asddfg4", 
+"abcdefg5", "123456785", "qwertyui5", "asddfg5",
+"abcdefg6", "123456786", "qwertyui6", "asddfg6",
+"abcdefg7", "123456787", "qwertyui7", "asddfg7",
+"abcdefg8", "123456788", "qwertyui8", "asddfg8",
+"abcdefg9", "123456789", "qwertyui9", "asddfg9",
+"abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+"abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+"abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+and c8 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+"abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+"abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+"abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+"abcdefg4", "123456784", "qwertyui4", "asddfg4", 
+"abcdefg5", "123456785", "qwertyui5", "asddfg5",
+"abcdefg6", "123456786", "qwertyui6", "asddfg6",
+"abcdefg7", "123456787", "qwertyui7", "asddfg7",
+"abcdefg8", "123456788", "qwertyui8", "asddfg8",
+"abcdefg9", "123456789", "qwertyui9", "asddfg9",
+"abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+"abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+"abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+and c9 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+"abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+"abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+"abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+"abcdefg4", "123456784", "qwertyui4", "asddfg4", 
+"abcdefg5", "123456785", "qwertyui5", "asddfg5",
+"abcdefg6", "123456786", "qwertyui6", "asddfg6",
+"abcdefg7", "123456787", "qwertyui7", "asddfg7",
+"abcdefg8", "123456788", "qwertyui8", "asddfg8",
+"abcdefg9", "123456789", "qwertyui9", "asddfg9",
+"abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+"abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+"abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+and c10 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+"abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+"abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+"abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+"abcdefg4", "123456784", "qwertyui4", "asddfg4", 
+"abcdefg5", "123456785", "qwertyui5", "asddfg5",
+"abcdefg6", "123456786", "qwertyui6", "asddfg6",
+"abcdefg7", "123456787", "qwertyui7", "asddfg7",
+"abcdefg8", "123456788", "qwertyui8", "asddfg8",
+"abcdefg9", "123456789", "qwertyui9", "asddfg9",
+"abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+"abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+"abcdefgC", "12345678C", "qwertyuiC", "asddfgC");
 c1	c2	c3	c4	c5	c6	c7	c8	c9	c10	c11	c12	c13	c14	c15	c16
 drop table t1;
 End of 4.1 tests
diff --git a/mysql-test/t/range.test b/mysql-test/t/range.test
index 1e4cb91c03f..0dbfde92bd5 100644
--- a/mysql-test/t/range.test
+++ b/mysql-test/t/range.test
@@ -571,28 +571,139 @@ create table t1 (
   c13 char(10), c14 char(10), c15 char(10), c16 char(10),
   index(c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12,c13,c14,c15,c16)
 );
-
 insert into t1 (c1) values ('1'),('1'),('1'),('1');
 
 # This must run without crash and fast:
 select * from t1 where
-     c1 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
- and c2 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
- and c3 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
- and c4 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
- and c5 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
- and c6 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
- and c7 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
- and c8 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
- and c9 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
- and c10 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
- and c11 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
- and c12 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
- and c13 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
- and c14 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
- and c15 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
- and c16 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh")
-;
+     c1 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+            "abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+            "abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+            "abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+            "abcdefg4", "123456784", "qwertyui4", "asddfg4",
+            "abcdefg5", "123456785", "qwertyui5", "asddfg5",
+            "abcdefg6", "123456786", "qwertyui6", "asddfg6",
+            "abcdefg7", "123456787", "qwertyui7", "asddfg7",
+            "abcdefg8", "123456788", "qwertyui8", "asddfg8",
+            "abcdefg9", "123456789", "qwertyui9", "asddfg9",
+            "abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+            "abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+            "abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+ and c2 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+            "abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+            "abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+            "abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+            "abcdefg4", "123456784", "qwertyui4", "asddfg4", 
+            "abcdefg5", "123456785", "qwertyui5", "asddfg5",
+            "abcdefg6", "123456786", "qwertyui6", "asddfg6",
+            "abcdefg7", "123456787", "qwertyui7", "asddfg7",
+            "abcdefg8", "123456788", "qwertyui8", "asddfg8",
+            "abcdefg9", "123456789", "qwertyui9", "asddfg9",
+            "abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+            "abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+            "abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+ and c3 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+            "abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+            "abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+            "abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+            "abcdefg4", "123456784", "qwertyui4", "asddfg4", 
+            "abcdefg5", "123456785", "qwertyui5", "asddfg5",
+            "abcdefg6", "123456786", "qwertyui6", "asddfg6",
+            "abcdefg7", "123456787", "qwertyui7", "asddfg7",
+            "abcdefg8", "123456788", "qwertyui8", "asddfg8",
+            "abcdefg9", "123456789", "qwertyui9", "asddfg9",
+            "abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+            "abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+            "abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+ and c4 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+            "abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+            "abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+            "abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+            "abcdefg4", "123456784", "qwertyui4", "asddfg4", 
+            "abcdefg5", "123456785", "qwertyui5", "asddfg5", 
+            "abcdefg6", "123456786", "qwertyui6", "asddfg6",
+            "abcdefg7", "123456787", "qwertyui7", "asddfg7",
+            "abcdefg8", "123456788", "qwertyui8", "asddfg8",
+            "abcdefg9", "123456789", "qwertyui9", "asddfg9",
+            "abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+            "abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+            "abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+ and c5 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+            "abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+            "abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+            "abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+            "abcdefg4", "123456784", "qwertyui4", "asddfg4",
+            "abcdefg5", "123456785", "qwertyui5", "asddfg5",
+            "abcdefg6", "123456786", "qwertyui6", "asddfg6",
+            "abcdefg7", "123456787", "qwertyui7", "asddfg7",
+            "abcdefg8", "123456788", "qwertyui8", "asddfg8",
+            "abcdefg9", "123456789", "qwertyui9", "asddfg9",
+            "abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+            "abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+            "abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+ and c6 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+            "abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+            "abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+            "abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+            "abcdefg4", "123456784", "qwertyui4", "asddfg4",
+            "abcdefg5", "123456785", "qwertyui5", "asddfg5",
+            "abcdefg6", "123456786", "qwertyui6", "asddfg6",
+            "abcdefg7", "123456787", "qwertyui7", "asddfg7",
+            "abcdefg8", "123456788", "qwertyui8", "asddfg8",
+            "abcdefg9", "123456789", "qwertyui9", "asddfg9",
+            "abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+            "abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+            "abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+ and c7 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+            "abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+            "abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+            "abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+            "abcdefg4", "123456784", "qwertyui4", "asddfg4", 
+            "abcdefg5", "123456785", "qwertyui5", "asddfg5",
+            "abcdefg6", "123456786", "qwertyui6", "asddfg6",
+            "abcdefg7", "123456787", "qwertyui7", "asddfg7",
+            "abcdefg8", "123456788", "qwertyui8", "asddfg8",
+            "abcdefg9", "123456789", "qwertyui9", "asddfg9",
+            "abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+            "abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+            "abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+ and c8 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+            "abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+            "abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+            "abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+            "abcdefg4", "123456784", "qwertyui4", "asddfg4", 
+            "abcdefg5", "123456785", "qwertyui5", "asddfg5",
+            "abcdefg6", "123456786", "qwertyui6", "asddfg6",
+            "abcdefg7", "123456787", "qwertyui7", "asddfg7",
+            "abcdefg8", "123456788", "qwertyui8", "asddfg8",
+            "abcdefg9", "123456789", "qwertyui9", "asddfg9",
+            "abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+            "abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+            "abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+ and c9 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+            "abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+            "abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+            "abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+            "abcdefg4", "123456784", "qwertyui4", "asddfg4", 
+            "abcdefg5", "123456785", "qwertyui5", "asddfg5",
+            "abcdefg6", "123456786", "qwertyui6", "asddfg6",
+            "abcdefg7", "123456787", "qwertyui7", "asddfg7",
+            "abcdefg8", "123456788", "qwertyui8", "asddfg8",
+            "abcdefg9", "123456789", "qwertyui9", "asddfg9",
+            "abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+            "abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+            "abcdefgC", "12345678C", "qwertyuiC", "asddfgC")
+ and c10 in ("abcdefgh", "123456789", "qwertyuio", "asddfgh", 
+            "abcdefg1", "123456781", "qwertyui1", "asddfg1", 
+            "abcdefg2", "123456782", "qwertyui2", "asddfg2", 
+            "abcdefg3", "123456783", "qwertyui3", "asddfg3", 
+            "abcdefg4", "123456784", "qwertyui4", "asddfg4", 
+            "abcdefg5", "123456785", "qwertyui5", "asddfg5",
+            "abcdefg6", "123456786", "qwertyui6", "asddfg6",
+            "abcdefg7", "123456787", "qwertyui7", "asddfg7",
+            "abcdefg8", "123456788", "qwertyui8", "asddfg8",
+            "abcdefg9", "123456789", "qwertyui9", "asddfg9",
+            "abcdefgA", "12345678A", "qwertyuiA", "asddfgA",
+            "abcdefgB", "12345678B", "qwertyuiB", "asddfgB",
+            "abcdefgC", "12345678C", "qwertyuiC", "asddfgC");
 drop table t1;
-
 --echo End of 4.1 tests
diff --git a/sql/opt_range.cc b/sql/opt_range.cc
index ca8f31f5775..01b366077b0 100644
--- a/sql/opt_range.cc
+++ b/sql/opt_range.cc
@@ -241,7 +241,7 @@ public:
   enum leaf_color { BLACK,RED } color;
   enum Type { IMPOSSIBLE, MAYBE, MAYBE_KEY, KEY_RANGE } type;
 
-  enum { MAX_SEL_ARGS = 64000 };
+  enum { MAX_SEL_ARGS = 16000 };
 
   SEL_ARG() {}
   SEL_ARG(SEL_ARG &);
@@ -1640,7 +1640,8 @@ tree_and(PARAM *param,SEL_TREE *tree1,SEL_TREE *tree2)
       {
 	tree1->type= SEL_TREE::IMPOSSIBLE;
 #ifdef EXTRA_DEBUG
-        (*key1)->test_use_count(*key1);
+        if (param->alloced_sel_args < SEL_ARG::MAX_SEL_ARGS) 
+          (*key1)->test_use_count(*key1);
 #endif
 	break;
       }
@@ -1677,7 +1678,8 @@ tree_or(PARAM *param,SEL_TREE *tree1,SEL_TREE *tree2)
     {
       result=tree1;				// Added to tree1
 #ifdef EXTRA_DEBUG
-      (*key1)->test_use_count(*key1);
+      if (param->alloced_sel_args < SEL_ARG::MAX_SEL_ARGS) 
+        (*key1)->test_use_count(*key1);
 #endif
     }
   }