diff --git a/innobase/btr/btr0sea.c b/innobase/btr/btr0sea.c
index de3fe6e196e..5c5ed934a9b 100644
--- a/innobase/btr/btr0sea.c
+++ b/innobase/btr/btr0sea.c
@@ -508,6 +508,14 @@ btr_search_check_guess(
 /*===================*/
 				/* out: TRUE if success */
 	btr_cur_t*	cursor,	/* in: guessed cursor position */
+	ibool           can_only_compare_to_cursor_rec,
+	                        /* in: if we do not have a latch on the page
+				of cursor, but only a latch on
+			        btr_search_latch, then ONLY the columns
+				of the record UNDER the cursor are
+				protected, not the next or previous record
+				in the chain: we cannot look at the next or
+				previous record to check our guess! */
 	dtuple_t* 	tuple,	/* in: data tuple */
 	ulint		mode,	/* in: PAGE_CUR_L, PAGE_CUR_LE, PAGE_CUR_G,
 				or PAGE_CUR_GE */
@@ -566,6 +574,13 @@ btr_search_check_guess(
 		}
 	}
 
+	if (can_only_compare_to_cursor_rec) {
+	        /* Since we could not determine if our guess is right just by
+	        looking at the record under the cursor, return FALSE */
+
+	        return(FALSE);
+	}
+
 	match = 0;
 	bytes = 0;
 
@@ -670,6 +685,7 @@ btr_search_guess_on_hash(
 	ulint		fold;
 	ulint		tuple_n_fields;
 	dulint		tree_id;
+	ibool           can_only_compare_to_cursor_rec = TRUE;
 #ifdef notdefined
 	btr_cur_t	cursor2;
 	btr_pcur_t	pcur;
@@ -744,6 +760,8 @@ btr_search_guess_on_hash(
 			goto failure;
 		}
 
+		can_only_compare_to_cursor_rec = FALSE;
+
 		buf_page_dbg_add_level(page, SYNC_TREE_NODE_FROM_HASH);
 	}
 
@@ -775,7 +793,15 @@ btr_search_guess_on_hash(
 				fold);
 */				
 	} else {
-		success = btr_search_check_guess(cursor, tuple, mode, mtr);
+	        /* If we only have the latch on btr_search_latch, not on the
+		page, it only protects the columns of the record the cursor
+		is positioned on. We cannot look at the next of the previous
+		record to determine if our guess for the cursor position is
+		right. */
+
+		success = btr_search_check_guess(cursor,
+				               can_only_compare_to_cursor_rec,
+					       tuple, mode, mtr);
 	}
 	
 	if (!success) {
diff --git a/innobase/include/btr0sea.h b/innobase/include/btr0sea.h
index 14feca5d5c5..ee762a12221 100644
--- a/innobase/include/btr0sea.h
+++ b/innobase/include/btr0sea.h
@@ -234,10 +234,16 @@ struct btr_search_sys_struct{
 extern btr_search_sys_t*	btr_search_sys;
 
 /* The latch protecting the adaptive search system: this latch protects the
-(1) positions of records on those pages where a hash index has been built.
-NOTE: It does not protect values of non-ordering fields within a record from
-being updated in-place! We can use fact (1) to perform unique searches to
-indexes. */
+(1) hash index;
+(2) columns of a record to which we have a pointer in the hash index;
+
+but does NOT protect:
+
+(3) next record offset field in a record;
+(4) next or previous records on the same page.
+
+Bear in mind (3) and (4) when using the hash index.
+*/
 
 extern rw_lock_t*	btr_search_latch_temp;
 
diff --git a/sql/log_event.cc b/sql/log_event.cc
index 1d27e48f14f..d2fcc83a98f 100644
--- a/sql/log_event.cc
+++ b/sql/log_event.cc
@@ -867,10 +867,11 @@ int Query_log_event::exec_event(struct st_relay_log_info* rli)
 
   if (db_ok(thd->db, replicate_do_db, replicate_ignore_db))
   {
-    thd->query = (char*)query;
     thd->set_time((time_t)when);
     thd->current_tablenr = 0;
+    thd->query_length= q_len;
     VOID(pthread_mutex_lock(&LOCK_thread_count));
+    thd->query = (char*)query;
     thd->query_id = query_id++;
     VOID(pthread_mutex_unlock(&LOCK_thread_count));
     thd->query_error= 0;			// clear error
@@ -928,7 +929,9 @@ int Query_log_event::exec_event(struct st_relay_log_info* rli)
     else
     {
       // master could be inconsistent, abort and tell DBA to check/fix it
+      VOID(pthread_mutex_lock(&LOCK_thread_count));
       thd->db = thd->query = 0;
+      VOID(pthread_mutex_unlock(&LOCK_thread_count));
       thd->variables.convert_set = 0;
       close_thread_tables(thd);
       free_root(&thd->mem_root,0);
@@ -936,7 +939,9 @@ int Query_log_event::exec_event(struct st_relay_log_info* rli)
     }
   }
   thd->db= 0;				// prevent db from being freed
+  VOID(pthread_mutex_lock(&LOCK_thread_count));
   thd->query= 0;			// just to be sure
+  VOID(pthread_mutex_unlock(&LOCK_thread_count));
   // assume no convert for next query unless set explictly
   thd->variables.convert_set = 0;
   close_thread_tables(thd);
@@ -1513,7 +1518,8 @@ int Load_log_event::exec_event(NET* net, struct st_relay_log_info* rli,
 {
   init_sql_alloc(&thd->mem_root, 8192,0);
   thd->db = rewrite_db((char*)db);
-  thd->query = 0;
+  DBUG_ASSERT(thd->query == 0);
+  thd->query = 0;				// Should not be needed
   thd->query_error = 0;
 	    
   if (db_ok(thd->db, replicate_do_db, replicate_ignore_db))
diff --git a/sql/slave.cc b/sql/slave.cc
index 271fe8bc2d6..97961eb00f8 100644
--- a/sql/slave.cc
+++ b/sql/slave.cc
@@ -1011,6 +1011,7 @@ static int create_table_from_dump(THD* thd, NET* net, const char* db,
 				  const char* table_name)
 {
   ulong packet_len = my_net_read(net); // read create table statement
+  char *query;
   Vio* save_vio;
   HA_CHECK_OPT check_opt;
   TABLE_LIST tables;
@@ -1030,15 +1031,23 @@ static int create_table_from_dump(THD* thd, NET* net, const char* db,
     return 1;
   }
   thd->command = COM_TABLE_DUMP;
-  thd->query = sql_alloc(packet_len + 1);
-  if (!thd->query)
+  /* Note that we should not set thd->query until the area is initalized */
+  if (!(query = sql_alloc(packet_len + 1)))
   {
     sql_print_error("create_table_from_dump: out of memory");
     net_printf(thd, ER_GET_ERRNO, "Out of memory");
     return 1;
   }
-  memcpy(thd->query, net->read_pos, packet_len);
-  thd->query[packet_len] = 0;
+  memcpy(query, net->read_pos, packet_len);
+  query[packet_len]= 0;
+  thd->query_length= packet_len;
+  /*
+    We make the following lock in an attempt to ensure that the compiler will
+    not rearrange the code so that thd->query is set too soon
+  */
+  VOID(pthread_mutex_lock(&LOCK_thread_count));
+  thd->query= query;
+  VOID(pthread_mutex_unlock(&LOCK_thread_count));
   thd->current_tablenr = 0;
   thd->query_error = 0;
   thd->net.no_send_ok = 1;
@@ -2272,7 +2281,9 @@ err:
   // print the current replication position
   sql_print_error("Slave I/O thread exiting, read up to log '%s', position %s",
 		  IO_RPL_LOG_NAME, llstr(mi->master_log_pos,llbuff));
+  VOID(pthread_mutex_lock(&LOCK_thread_count));
   thd->query = thd->db = 0; // extra safety
+  VOID(pthread_mutex_unlock(&LOCK_thread_count));
   if (mysql)
   {
     mc_mysql_close(mysql);
@@ -2407,7 +2418,9 @@ the slave SQL thread with \"SLAVE START\". We stopped at log \
 		  RPL_LOG_NAME, llstr(rli->master_log_pos,llbuff));
 
  err:
+  VOID(pthread_mutex_lock(&LOCK_thread_count));
   thd->query = thd->db = 0; // extra safety
+  VOID(pthread_mutex_unlock(&LOCK_thread_count));
   thd->proc_info = "Waiting for slave mutex on exit";
   pthread_mutex_lock(&rli->run_lock);
   DBUG_ASSERT(rli->slave_running == 1); // tracking buffer overrun
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index a09b3e9cad4..6719c9021a6 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -949,7 +949,7 @@ int mysql_table_dump(THD* thd, char* db, char* tbl_name, int fd)
     goto err;
   }
   net_flush(&thd->net);
-  if ((error = table->file->dump(thd,fd)))
+  if ((error= table->file->dump(thd,fd)))
     my_error(ER_GET_ERRNO, MYF(0));
 
 err:
@@ -1054,7 +1054,6 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
       tbl_name[tbl_len] = 0;
       if (mysql_table_dump(thd, db, tbl_name, -1))
 	send_error(thd); // dump to NET
-
       break;
     }
   case COM_CHANGE_USER: