From cfb7d5d78a8aa6a683cd7a2f745d98ecfaca0100 Mon Sep 17 00:00:00 2001
From: Alexey Botchkov <holyfoot@askmonty.org>
Date: Tue, 10 Feb 2015 16:16:31 +0400
Subject: [PATCH] MDEV-7516 Assertion `!cur_p->event' failed in
 Gcalc_scan_iterator::arrange_event(int, int).     When the distance in
 ST_BUFFER is too far negative the coordinates can run out of the operational 
    area. We should just return an empty geometry in this case.

---
 mysql-test/r/gis.result | 3 +++
 mysql-test/t/gis.test   | 5 +++++
 sql/item_geofunc.cc     | 8 ++++++++
 3 files changed, 16 insertions(+)

diff --git a/mysql-test/r/gis.result b/mysql-test/r/gis.result
index ba69416b0ef..700b5de44f5 100644
--- a/mysql-test/r/gis.result
+++ b/mysql-test/r/gis.result
@@ -1607,4 +1607,7 @@ create table t1 (pt point);
 insert into t1 values(Geomfromtext('POLYGON((1 1, 2 2, 2 1, 1 1))'));
 ERROR 22007: Incorrect POINT value: 'POLYGON' for column 'pt' at row 1
 drop table t1;
+SELECT st_astext(ST_Buffer(ST_PolygonFromText('POLYGON((3 5, 2 4, 2 5, 3 5))'), -100));
+st_astext(ST_Buffer(ST_PolygonFromText('POLYGON((3 5, 2 4, 2 5, 3 5))'), -100))
+GEOMETRYCOLLECTION EMPTY
 End of 5.5 tests
diff --git a/mysql-test/t/gis.test b/mysql-test/t/gis.test
index 4d421e15d58..bce1fa2c226 100644
--- a/mysql-test/t/gis.test
+++ b/mysql-test/t/gis.test
@@ -1465,4 +1465,9 @@ create table t1 (pt point);
 insert into t1 values(Geomfromtext('POLYGON((1 1, 2 2, 2 1, 1 1))'));
 drop table t1;
 
+#
+# MDEV-7516 Assertion `!cur_p->event' failed in Gcalc_scan_iterator::arrange_event(int, int)
+#
+SELECT st_astext(ST_Buffer(ST_PolygonFromText('POLYGON((3 5, 2 4, 2 5, 3 5))'), -100));
+
 --echo End of 5.5 tests
diff --git a/sql/item_geofunc.cc b/sql/item_geofunc.cc
index a38e9d416a7..5e1c0add54b 100644
--- a/sql/item_geofunc.cc
+++ b/sql/item_geofunc.cc
@@ -1286,6 +1286,13 @@ String *Item_func_buffer::val_str(String *str_value)
 
   if (dist > 0.0)
     mbr.buffer(dist);
+  else
+  {
+    /* This happens when dist is too far negative. */
+    if (mbr.xmax + dist < mbr.xmin || mbr.ymax + dist < mbr.ymin)
+      goto return_empty_result;
+  }
+
   collector.set_extent(mbr.xmin, mbr.xmax, mbr.ymin, mbr.ymax);
   /*
     If the distance given is 0, the Buffer function is in fact NOOP,
@@ -1313,6 +1320,7 @@ String *Item_func_buffer::val_str(String *str_value)
     goto mem_error;
 
 
+return_empty_result:
   str_value->set_charset(&my_charset_bin);
   if (str_value->reserve(SRID_SIZE, 512))
     goto mem_error;