From 1108ba23e080a20686931d17298316e0dd982498 Mon Sep 17 00:00:00 2001
From: Serge Kozlov <skozlov@mysql.com>
Date: Sun, 26 Oct 2008 21:53:21 +0300
Subject: [PATCH 1/5] Bug#22442. 1. Replace --sleep by wait_* primitive 2.
 Vertical output for SHOW SLAVE STATUS 3. Updated result file

---
 mysql-test/r/rpl_flush_log_loop.result | 35 ++++++++++++++++++++++++--
 mysql-test/t/rpl_flush_log_loop.test   | 19 +++++++++++---
 2 files changed, 48 insertions(+), 6 deletions(-)

diff --git a/mysql-test/r/rpl_flush_log_loop.result b/mysql-test/r/rpl_flush_log_loop.result
index 3b1db804da9..271e37247d4 100644
--- a/mysql-test/r/rpl_flush_log_loop.result
+++ b/mysql-test/r/rpl_flush_log_loop.result
@@ -20,5 +20,36 @@ master_password='',master_port=SLAVE_PORT;
 start slave;
 flush logs;
 show slave status;
-Slave_IO_State	Master_Host	Master_User	Master_Port	Connect_Retry	Master_Log_File	Read_Master_Log_Pos	Relay_Log_File	Relay_Log_Pos	Relay_Master_Log_File	Slave_IO_Running	Slave_SQL_Running	Replicate_Do_DB	Replicate_Ignore_DB	Replicate_Do_Table	Replicate_Ignore_Table	Replicate_Wild_Do_Table	Replicate_Wild_Ignore_Table	Last_Errno	Last_Error	Skip_Counter	Exec_Master_Log_Pos	Relay_Log_Space	Until_Condition	Until_Log_File	Until_Log_Pos	Master_SSL_Allowed	Master_SSL_CA_File	Master_SSL_CA_Path	Master_SSL_Cert	Master_SSL_Cipher	Master_SSL_Key	Seconds_Behind_Master
-#	127.0.0.1	root	SLAVE_PORT	60	slave-bin.000001	208	#	#	slave-bin.000001	Yes	Yes							0		0	208	#	None		0	No						#
+Slave_IO_State	#
+Master_Host	127.0.0.1
+Master_User	root
+Master_Port	9306
+Connect_Retry	1
+Master_Log_File	master-bin.000001
+Read_Master_Log_Pos	98
+Relay_Log_File	#
+Relay_Log_Pos	#
+Relay_Master_Log_File	master-bin.000001
+Slave_IO_Running	Yes
+Slave_SQL_Running	Yes
+Replicate_Do_DB	
+Replicate_Ignore_DB	
+Replicate_Do_Table	
+Replicate_Ignore_Table	#
+Replicate_Wild_Do_Table	
+Replicate_Wild_Ignore_Table	
+Last_Errno	0
+Last_Error	
+Skip_Counter	0
+Exec_Master_Log_Pos	98
+Relay_Log_Space	#
+Until_Condition	None
+Until_Log_File	
+Until_Log_Pos	0
+Master_SSL_Allowed	No
+Master_SSL_CA_File	
+Master_SSL_CA_Path	
+Master_SSL_Cert	
+Master_SSL_Cipher	
+Master_SSL_Key	
+Seconds_Behind_Master	#
diff --git a/mysql-test/t/rpl_flush_log_loop.test b/mysql-test/t/rpl_flush_log_loop.test
index f0b368c285b..0092ec3875e 100644
--- a/mysql-test/t/rpl_flush_log_loop.test
+++ b/mysql-test/t/rpl_flush_log_loop.test
@@ -12,16 +12,27 @@ stop slave;
 eval change master to master_host='127.0.0.1',master_user='root',
  master_password='',master_port=$MASTER_MYPORT;
 start slave;
+
 connection master;
 --replace_result $SLAVE_MYPORT SLAVE_PORT
 eval change master to master_host='127.0.0.1',master_user='root',
  master_password='',master_port=$SLAVE_MYPORT;
 start slave;
-sleep 5;
+--source include/wait_for_slave_to_start.inc
+
+# Calculate file name of relay log after flush logs 
+let $relay_file= query_get_value(show slave status, Relay_Log_File,1);
+let $relay_name= `select substring_index('$relay_file','.',1);`;
+let $relay_index= `select substring_index('$relay_file','.',-1);`;
+let $relay_index_len= `select length(substring_index('$relay_file','.',-1));`;
+let $relay_index_next=`select $relay_index+1`;
+let $relay_file=`select concat('$relay_name','.',repeat('0',($relay_index_len-length($relay_index_next))),$relay_index_next);`;
 flush logs;
-sleep 5;
+let $slave_param= Relay_Log_File;
+let $slave_param_value= $relay_file;
+source include/wait_for_slave_param.inc;
 --replace_result $SLAVE_MYPORT SLAVE_PORT
---replace_column 1 # 8 # 9 # 23 # 33 #
-show slave status;
+--replace_column 1 # 8 # 9 # 16 # 23 # 33 # 34 # 35 #
+--query_vertical show slave status
 
 # End of 4.1 tests

From eafe728fc53cac1fb5e80f0f54e040e395010d7e Mon Sep 17 00:00:00 2001
From: Serge Kozlov <skozlov@mysql.com>
Date: Sun, 26 Oct 2008 22:34:24 +0300
Subject: [PATCH 2/5] Bug#22442, removed number of port

---
 mysql-test/r/rpl_flush_log_loop.result | 2 +-
 mysql-test/t/rpl_flush_log_loop.test   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/mysql-test/r/rpl_flush_log_loop.result b/mysql-test/r/rpl_flush_log_loop.result
index 271e37247d4..d9bb93810d0 100644
--- a/mysql-test/r/rpl_flush_log_loop.result
+++ b/mysql-test/r/rpl_flush_log_loop.result
@@ -23,7 +23,7 @@ show slave status;
 Slave_IO_State	#
 Master_Host	127.0.0.1
 Master_User	root
-Master_Port	9306
+Master_Port	MASTER_PORT
 Connect_Retry	1
 Master_Log_File	master-bin.000001
 Read_Master_Log_Pos	98
diff --git a/mysql-test/t/rpl_flush_log_loop.test b/mysql-test/t/rpl_flush_log_loop.test
index 0092ec3875e..c3707372e08 100644
--- a/mysql-test/t/rpl_flush_log_loop.test
+++ b/mysql-test/t/rpl_flush_log_loop.test
@@ -31,7 +31,7 @@ flush logs;
 let $slave_param= Relay_Log_File;
 let $slave_param_value= $relay_file;
 source include/wait_for_slave_param.inc;
---replace_result $SLAVE_MYPORT SLAVE_PORT
+--replace_result $SLAVE_MYPORT SLAVE_PORT $MASTER_MYPORT MASTER_PORT
 --replace_column 1 # 8 # 9 # 16 # 23 # 33 # 34 # 35 #
 --query_vertical show slave status
 

From e27e56078388c2005b46073b5b295edcba79f359 Mon Sep 17 00:00:00 2001
From: Evgeny Potemkin <epotemkin@mysql.com>
Date: Mon, 27 Oct 2008 12:26:32 +0300
Subject: [PATCH 3/5] Bug#37870: Usage of uninitialized value caused failed
 assertion.

The convert_constant_item function converts a constant to integer using
field for condition like 'field = a_constant'. When the convert_constant_item
is called for a subquery the outer select is already being executed, so
convert_constant_item saves field's value to prevent its corruption.
For EXPLAIN field's value isn't initialized thus when convert_constant_item
tries to restore saved value it fails assertion.

Now the convert_constant_item doesn't save/restore field's value
for EXPLAIN.


mysql-test/r/explain.result:
  Added a test case for the bug#37870.
mysql-test/t/explain.test:
  Added a test case for the bug#37870.
sql/item_cmpfunc.cc:
  Bug#37870: Usage of uninitialized value caused failed assertion.
  Now the convert_constant_item doesn't save/restore field's value
  for EXPLAIN.
---
 mysql-test/r/explain.result | 15 +++++++++++++++
 mysql-test/t/explain.test   | 12 ++++++++++++
 sql/item_cmpfunc.cc         |  5 +++--
 3 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/mysql-test/r/explain.result b/mysql-test/r/explain.result
index 2ce8b8c384f..f3822fe370d 100644
--- a/mysql-test/r/explain.result
+++ b/mysql-test/r/explain.result
@@ -107,3 +107,18 @@ X	X	X	X	X	X	X	X	X
 X	X	X	X	X	X	X	X	X	Range checked for each record (index map: 0xFFFFFFFFFF)
 DROP TABLE t2;
 DROP TABLE t1;
+#
+# Bug#37870: Usage of uninitialized value caused failed assertion.
+#
+create table t1 (dt datetime not null);
+create table t2 (dt datetime not null);
+insert into t1 values ('2001-01-01 1:1:1'), ('2001-01-01 1:1:1');
+insert into t2 values ('2001-01-01 1:1:1'), ('2001-01-01 1:1:1');
+flush tables;
+EXPLAIN SELECT OUTR.dt FROM t1 AS OUTR WHERE OUTR.dt IN (SELECT INNR.dt FROM t2 AS INNR WHERE OUTR.dt IS NULL );
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	OUTR	ALL	NULL	NULL	NULL	NULL	2	Using where
+2	DEPENDENT SUBQUERY	INNR	ALL	NULL	NULL	NULL	NULL	2	Using where
+SELECT OUTR.dt FROM t1 AS OUTR WHERE OUTR.dt IN (SELECT INNR.dt FROM t2 AS INNR WHERE OUTR.dt IS NULL );
+dt
+drop tables t1, t2;
diff --git a/mysql-test/t/explain.test b/mysql-test/t/explain.test
index c9ae8aceaf6..09a8245b27b 100644
--- a/mysql-test/t/explain.test
+++ b/mysql-test/t/explain.test
@@ -94,4 +94,16 @@ EXPLAIN SELECT 1 FROM
 DROP TABLE t2;
 DROP TABLE t1;
 
+--echo #
+--echo # Bug#37870: Usage of uninitialized value caused failed assertion.
+--echo #
+create table t1 (dt datetime not null);
+create table t2 (dt datetime not null);
+insert into t1 values ('2001-01-01 1:1:1'), ('2001-01-01 1:1:1');
+insert into t2 values ('2001-01-01 1:1:1'), ('2001-01-01 1:1:1');
+flush tables;
+EXPLAIN SELECT OUTR.dt FROM t1 AS OUTR WHERE OUTR.dt IN (SELECT INNR.dt FROM t2 AS INNR WHERE OUTR.dt IS NULL );
+SELECT OUTR.dt FROM t1 AS OUTR WHERE OUTR.dt IN (SELECT INNR.dt FROM t2 AS INNR WHERE OUTR.dt IS NULL );
+drop tables t1, t2;
+
 # End of 5.0 tests.
diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc
index bd6065c9403..0c95336251b 100644
--- a/sql/item_cmpfunc.cc
+++ b/sql/item_cmpfunc.cc
@@ -415,8 +415,9 @@ static bool convert_constant_item(THD *thd, Item_field *field_item,
     /*
       Store the value of the field if it references an outer field because
       the call to save_in_field below overrides that value.
+      Don't store it for EXPLAIN since it's not initialized.
     */
-    if (field_item->depended_from)
+    if (field_item->depended_from && !thd->lex->describe)
       orig_field_val= field->val_int();
     if (!(*item)->is_null() && !(*item)->save_in_field(field, 1))
     {
@@ -427,7 +428,7 @@ static bool convert_constant_item(THD *thd, Item_field *field_item,
       result= 1;					// Item was replaced
     }
     /* Restore the original field value. */
-    if (field_item->depended_from)
+    if (field_item->depended_from && !thd->lex->describe)
     {
       result= field->store(orig_field_val, TRUE);
       /* orig_field_val must be a valid value that can be restored back. */

From 380f1a84403a88b4b45f3d14fe98882a04c4773d Mon Sep 17 00:00:00 2001
From: Sergey Glukhov <Sergey.Glukhov@sun.com>
Date: Mon, 27 Oct 2008 14:22:38 +0400
Subject: [PATCH 4/5] Bug#39040 valgrind errors/crash when creating views with
 binlog logging enabled A string buffers which were included in the 'view'
 data structure were allocated on the stack, causing an invalid pointer when
 used after the function returned. The fix: use copy of values for view->md5 &
 view->queries

mysql-test/r/view.result:
  test result
mysql-test/t/view.test:
  test case
sql/sql_view.cc:
  A string buffers which were included in the 'view' data structure
  were allocated on the stack, causing an invalid pointer when used
  after the function returned.
  The fix: use copy of values for view->md5 & view->queries
---
 mysql-test/r/view.result |  2 ++
 mysql-test/t/view.test   |  9 +++++++++
 sql/sql_view.cc          | 16 +++++++++++++---
 3 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/mysql-test/r/view.result b/mysql-test/r/view.result
index eb7a89c3d12..8cbe3fc36cf 100644
--- a/mysql-test/r/view.result
+++ b/mysql-test/r/view.result
@@ -3677,6 +3677,8 @@ DROP VIEW v1;
 
 # -- End of test case for Bug#35193.
 
+CREATE VIEW v1 AS SELECT 1;
+DROP VIEW v1;
 # -----------------------------------------------------------------
 # -- End of 5.0 tests.
 # -----------------------------------------------------------------
diff --git a/mysql-test/t/view.test b/mysql-test/t/view.test
index 9fa981ccb9a..bcf31a4501d 100644
--- a/mysql-test/t/view.test
+++ b/mysql-test/t/view.test
@@ -3560,6 +3560,15 @@ DROP VIEW v1;
 
 ###########################################################################
 
+#
+# Bug#39040: valgrind errors/crash when creating views with binlog logging 
+# enabled
+#
+# Bug is visible only when running in valgrind with binary logging.
+CREATE VIEW v1 AS SELECT 1;
+DROP VIEW v1;
+
+
 --echo # -----------------------------------------------------------------
 --echo # -- End of 5.0 tests.
 --echo # -----------------------------------------------------------------
diff --git a/sql/sql_view.cc b/sql/sql_view.cc
index dffad0cc575..8e6d3ed583a 100644
--- a/sql/sql_view.cc
+++ b/sql/sql_view.cc
@@ -774,8 +774,13 @@ static int mysql_register_view(THD *thd, TABLE_LIST *view,
   DBUG_PRINT("info", ("View: %s", str.ptr()));
 
   /* fill structure */
-  view->query.str= str.c_ptr_safe();
-  view->query.length= str.length();
+  if (!make_lex_string(thd, &view->query, str.ptr(), str.length(), false))
+  {
+    my_error(ER_OUT_OF_RESOURCES, MYF(0));
+    error= -1;
+    goto err;   
+  }
+
   view->source.str= thd->query + thd->lex->create_view_select_start;
   view->source.length= (char *)skip_rear_comments(thd->charset(),
                                                   (char *)view->source.str,
@@ -784,7 +789,12 @@ static int mysql_register_view(THD *thd, TABLE_LIST *view,
                         view->source.str;
   view->file_version= 1;
   view->calc_md5(md5);
-  view->md5.str= md5;
+  if (!(view->md5.str= thd->memdup(md5, 32)))
+  {
+    my_error(ER_OUT_OF_RESOURCES, MYF(0));
+    error= -1;
+    goto err;   
+  }
   view->md5.length= 32;
   can_be_merged= lex->can_be_merged();
   if (lex->create_view_algorithm == VIEW_ALGORITHM_MERGE &&

From 545e4c58b273ca7eadfcfe52a3ac5885cabf5798 Mon Sep 17 00:00:00 2001
From: Evgeny Potemkin <epotemkin@mysql.com>
Date: Mon, 27 Oct 2008 19:19:26 +0300
Subject: [PATCH 5/5] Corrected fix for the bug#37870.

---
 sql/item_cmpfunc.cc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc
index 0c95336251b..cefa479fea6 100644
--- a/sql/item_cmpfunc.cc
+++ b/sql/item_cmpfunc.cc
@@ -413,11 +413,11 @@ static bool convert_constant_item(THD *thd, Item_field *field_item,
     thd->count_cuted_fields= CHECK_FIELD_IGNORE;
 
     /*
-      Store the value of the field if it references an outer field because
+      Store the value of the field/constant if it references an outer field because
       the call to save_in_field below overrides that value.
-      Don't store it for EXPLAIN since it's not initialized.
+      Don't save value of the field for EXPLAIN since it's not initialized.
     */
-    if (field_item->depended_from && !thd->lex->describe)
+    if (field_item->depended_from && (!thd->lex->describe || field_item->const_item()))
       orig_field_val= field->val_int();
     if (!(*item)->is_null() && !(*item)->save_in_field(field, 1))
     {
@@ -428,7 +428,7 @@ static bool convert_constant_item(THD *thd, Item_field *field_item,
       result= 1;					// Item was replaced
     }
     /* Restore the original field value. */
-    if (field_item->depended_from && !thd->lex->describe)
+    if (field_item->depended_from && (!thd->lex->describe || field_item->const_item()))
     {
       result= field->store(orig_field_val, TRUE);
       /* orig_field_val must be a valid value that can be restored back. */