merge

26 files changed, 514 insertions, 14 deletions

diff --git a/mysql-test/r/ctype_utf8.result b/mysql-test/r/ctype_utf8.result
index f207d056b51..935348aa95c 100644
--- a/mysql-test/r/ctype_utf8.result
+++ b/mysql-test/r/ctype_utf8.result
@@ -1898,6 +1898,37 @@ CONVERT(a, CHAR)	CONVERT(b, CHAR)
 70000	1092
 DROP TABLE t1;
 End of 5.0 tests
+SELECT LENGTH(RPAD(0.0115E88, 61297, _utf8'яэюя'));
+LENGTH(RPAD(0.0115E88, 61297, _utf8'яэюя'))
+122587
+SELECT LENGTH(RPAD(0.0115E88, 61297, _utf8'йцуя'));
+LENGTH(RPAD(0.0115E88, 61297, _utf8'йцуя'))
+122587
+SELECT HEX(RPAD(0x20, 2, _utf8 0xD18F));
+HEX(RPAD(0x20, 2, _utf8 0xD18F))
+20D1
+SELECT HEX(RPAD(0x20, 4, _utf8 0xD18F));
+HEX(RPAD(0x20, 4, _utf8 0xD18F))
+20D18FD1
+SELECT HEX(LPAD(0x20, 2, _utf8 0xD18F));
+HEX(LPAD(0x20, 2, _utf8 0xD18F))
+D120
+SELECT HEX(LPAD(0x20, 4, _utf8 0xD18F));
+HEX(LPAD(0x20, 4, _utf8 0xD18F))
+D18FD120
+SELECT HEX(RPAD(_utf8 0xD18F, 3, 0x20));
+HEX(RPAD(_utf8 0xD18F, 3, 0x20))
+D18F20
+SELECT HEX(LPAD(_utf8 0xD18F, 3, 0x20));
+HEX(LPAD(_utf8 0xD18F, 3, 0x20))
+20D18F
+SELECT HEX(INSERT(_utf8 0xD18F, 2, 1, 0x20));
+HEX(INSERT(_utf8 0xD18F, 2, 1, 0x20))
+D120
+SELECT HEX(INSERT(_utf8 0xD18FD18E, 2, 1, 0x20));
+HEX(INSERT(_utf8 0xD18FD18E, 2, 1, 0x20))
+D120D18E
+End of 5.1 tests
 Start of 5.4 tests
 SET NAMES utf8mb3;
 SHOW VARIABLES LIKE 'character_set_results%';
diff --git a/mysql-test/r/explain.result b/mysql-test/r/explain.result
index b8dbb54e5fb..b9ae362f6cd 100644
--- a/mysql-test/r/explain.result
+++ b/mysql-test/r/explain.result
@@ -271,4 +271,50 @@ EXPLAIN SELECT c1 FROM t1 WHERE c2 = 1 AND c4 = 1 AND c5 = 1;
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	t1	ref	c2,c2_2	c2	10	const,const	3	Using where
 DROP TABLE t1;
+#
+# Bug#56814 Explain + subselect + fulltext crashes server
+#
+CREATE TABLE t1(f1 VARCHAR(6) NOT NULL,
+FULLTEXT KEY(f1),UNIQUE(f1));
+INSERT INTO t1 VALUES ('test');
+EXPLAIN SELECT 1 FROM t1
+WHERE 1 > ALL((SELECT 1 FROM t1 JOIN t1 a ON (MATCH(t1.f1) AGAINST (""))
+WHERE t1.f1 GROUP BY t1.f1));
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	t1	system	NULL	NULL	NULL	NULL	1	
+2	SUBQUERY	a	system	NULL	NULL	NULL	NULL	1	Using filesort
+2	SUBQUERY	t1	fulltext	f1	f1	0		1	Using where
+PREPARE stmt FROM
+'EXPLAIN SELECT 1 FROM t1
+ WHERE 1 > ALL((SELECT 1 FROM t1 RIGHT OUTER JOIN t1 a
+ ON (MATCH(t1.f1) AGAINST (""))
+ WHERE t1.f1 GROUP BY t1.f1))';
+EXECUTE stmt;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	t1	system	NULL	NULL	NULL	NULL	1	
+2	SUBQUERY	a	system	NULL	NULL	NULL	NULL	1	Using filesort
+2	SUBQUERY	t1	fulltext	f1	f1	0		1	Using where
+EXECUTE stmt;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	t1	system	NULL	NULL	NULL	NULL	1	
+2	SUBQUERY	a	system	NULL	NULL	NULL	NULL	1	Using filesort
+2	SUBQUERY	t1	fulltext	f1	f1	0		1	Using where
+DEALLOCATE PREPARE stmt;
+PREPARE stmt FROM
+'EXPLAIN SELECT 1 FROM t1
+ WHERE 1 > ALL((SELECT 1 FROM t1 JOIN t1 a
+ ON (MATCH(t1.f1) AGAINST (""))
+ WHERE t1.f1 GROUP BY t1.f1))';
+EXECUTE stmt;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	t1	system	NULL	NULL	NULL	NULL	1	
+2	SUBQUERY	a	system	NULL	NULL	NULL	NULL	1	Using filesort
+2	SUBQUERY	t1	fulltext	f1	f1	0		1	Using where
+EXECUTE stmt;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	t1	system	NULL	NULL	NULL	NULL	1	
+2	SUBQUERY	a	system	NULL	NULL	NULL	NULL	1	Using filesort
+2	SUBQUERY	t1	fulltext	f1	f1	0		1	Using where
+DEALLOCATE PREPARE stmt;
+DROP TABLE t1;
 End of 5.1 tests.
diff --git a/mysql-test/r/fulltext.result b/mysql-test/r/fulltext.result
index a75f502c735..8c66156152e 100644
--- a/mysql-test/r/fulltext.result
+++ b/mysql-test/r/fulltext.result
@@ -652,4 +652,49 @@ Table	Op	Msg_type	Msg_text
 test.t1	repair	status	OK
 SET myisam_sort_buffer_size=@@global.myisam_sort_buffer_size;
 DROP TABLE t1;
+#
+# Bug#54484 explain + prepared statement: crash and Got error -1 from storage engine
+#
+CREATE TABLE t1(f1 VARCHAR(6) NOT NULL, FULLTEXT KEY(f1), UNIQUE(f1));
+INSERT INTO t1 VALUES ('test');
+SELECT 1 FROM t1 WHERE 1 >
+ALL((SELECT 1 FROM t1 JOIN t1 a
+ON (MATCH(t1.f1) against (""))
+WHERE t1.f1 GROUP BY t1.f1)) xor f1;
+1
+1
+Warnings:
+Warning	1292	Truncated incorrect INTEGER value: 'test'
+Warning	1292	Truncated incorrect INTEGER value: 'test'
+PREPARE stmt FROM
+'SELECT 1 FROM t1 WHERE 1 >
+ ALL((SELECT 1 FROM t1 RIGHT OUTER JOIN t1 a
+ ON (MATCH(t1.f1) against (""))
+ WHERE t1.f1 GROUP BY t1.f1)) xor f1';
+EXECUTE stmt;
+1
+1
+Warnings:
+Warning	1292	Truncated incorrect INTEGER value: 'test'
+Warning	1292	Truncated incorrect INTEGER value: 'test'
+EXECUTE stmt;
+1
+1
+Warnings:
+Warning	1292	Truncated incorrect INTEGER value: 'test'
+Warning	1292	Truncated incorrect INTEGER value: 'test'
+DEALLOCATE PREPARE stmt;
+PREPARE stmt FROM
+'SELECT 1 FROM t1 WHERE 1 >
+ ALL((SELECT 1 FROM t1 JOIN t1 a
+ ON (MATCH(t1.f1) against (""))
+ WHERE t1.f1 GROUP BY t1.f1))';
+EXECUTE stmt;
+1
+1
+EXECUTE stmt;
+1
+1
+DEALLOCATE PREPARE stmt;
+DROP TABLE t1;
 End of 5.1 tests
diff --git a/mysql-test/r/func_gconcat.result b/mysql-test/r/func_gconcat.result
index 302de9de9f7..69be0107b8f 100644
--- a/mysql-test/r/func_gconcat.result
+++ b/mysql-test/r/func_gconcat.result
@@ -1038,6 +1038,14 @@ GROUP_CONCAT(t1.a ORDER BY t1.a)
 1,1,2,2
 DEALLOCATE PREPARE stmt;
 DROP TABLE t1;
+#
+# Bug#57194 group_concat cause crash and/or invalid memory reads with type errors
+#
+CREATE TABLE t1(f1 int);
+INSERT INTO t1 values (0),(0);
+SELECT POLYGON((SELECT 1 FROM (SELECT 1 IN (GROUP_CONCAT(t1.f1)) FROM t1, t1 t GROUP BY t.f1 ) d));
+ERROR 22007: Illegal non geometric '(select 1 from (select (1 = group_concat(`test`.`t1`.`f1` separator ',')) AS `1 IN (GROUP_CONCAT(t1.f1))` from `test`.`t1` join `test`.`t1` `t` group by `t`.`f1`) `d`)' value found during parsing
+DROP TABLE t1;
 End of 5.1 tests
 DROP TABLE IF EXISTS t1, t2;
 CREATE TABLE t1 (a VARCHAR(6), b INT);
diff --git a/mysql-test/r/func_math.result b/mysql-test/r/func_math.result
index 835715ac51e..ac9a22a0b82 100644
--- a/mysql-test/r/func_math.result
+++ b/mysql-test/r/func_math.result
@@ -481,6 +481,18 @@ RAND(i)
 0.15522042769493574
 DROP TABLE t1;
 #
+# Bug#57477 SIGFPE when dividing a huge number a negative number
+#
+SELECT -9999999999999999991 DIV -1;
+ERROR 22003: BIGINT value is out of range in '(-(9999999999999999991) DIV -(1))'
+SELECT -9223372036854775808 DIV -1;
+ERROR 22003: BIGINT value is out of range in '(-(9223372036854775808) DIV -(1))'
+SELECT -9223372036854775808 MOD -1;
+-9223372036854775808 MOD -1
+0
+SELECT -9223372036854775808999 MOD -1;
+-9223372036854775808999 MOD -1
+0
 select 123456789012345678901234567890.123456789012345678901234567890 div 1 as x;
 ERROR 22003: BIGINT value is out of range in '(123456789012345678901234567890.123456789012345678901234567890 DIV 1)'
 select "123456789012345678901234567890.123456789012345678901234567890" div 1 as x;
diff --git a/mysql-test/r/func_misc.result b/mysql-test/r/func_misc.result
index 3c5dc0faa0c..0a0158708de 100644
--- a/mysql-test/r/func_misc.result
+++ b/mysql-test/r/func_misc.result
@@ -351,6 +351,12 @@ GREATEST(a, (SELECT b FROM t1 LIMIT 1))
 3
 1
 DROP TABLE t1;
+SELECT INET_NTOA(0);
+INET_NTOA(0)
+0.0.0.0
+SELECT '1' IN ('1', INET_NTOA(0));
+'1' IN ('1', INET_NTOA(0))
+1
 #
 # Bug #52165: Assertion failed: file .\dtoa.c, line 465
 # 
@@ -382,3 +388,4 @@ CREATE TABLE t1 (a INT);
 SELECT 1 from t1 HAVING NAME_CONST('', a);
 ERROR HY000: Incorrect arguments to NAME_CONST
 DROP TABLE t1;
+End of tests
diff --git a/mysql-test/r/group_by.result b/mysql-test/r/group_by.result
index 2621f69da06..188485d366f 100644
--- a/mysql-test/r/group_by.result
+++ b/mysql-test/r/group_by.result
@@ -1846,6 +1846,16 @@ SELECT SUBSTRING(a,1,10), LENGTH(a) FROM t1 GROUP BY a;
 SUBSTRING(a,1,10)	LENGTH(a)
 1111111111	1300
 DROP TABLE t1;
+#
+# Bug#57688 Assertion `!table || (!table->write_set || bitmap_is_set(table->write_set, field
+#
+CREATE TABLE t1(f1 INT NOT NULL);
+INSERT INTO t1 VALUES (16777214),(0);
+SELECT COUNT(*) FROM t1 LEFT JOIN t1 t2
+ON 1 WHERE t2.f1 > 1 GROUP BY t2.f1;
+COUNT(*)
+2
+DROP TABLE t1;
 # End of 5.1 tests
 #
 # Bug#49771: Incorrect MIN (date) when minimum value is 0000-00-00
diff --git a/mysql-test/r/join_outer.result b/mysql-test/r/join_outer.result
index 0af32d8f749..99ca9f05535 100644
--- a/mysql-test/r/join_outer.result
+++ b/mysql-test/r/join_outer.result
@@ -1402,4 +1402,34 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	filtered	Extra
 Warnings:
 Note	1003	select straight_join `test`.`jt1`.`f1` AS `f1` from `test`.`t1` `jt6` left join (`test`.`t1` `jt3` join `test`.`t1` `jt4` left join `test`.`t1` `jt5` on(1) left join `test`.`t1` `jt2` on(1)) on((`test`.`jt6`.`f1` and 1)) left join `test`.`t1` `jt1` on(1) where 1
 DROP TABLE t1;
+#
+# Bug#57688 Assertion `!table || (!table->write_set || bitmap_is_set(table->write_set, field
+#
+CREATE TABLE t1 (f1 INT NOT NULL, PRIMARY KEY (f1));
+CREATE TABLE t2 (f1 INT NOT NULL, f2 INT NOT NULL, PRIMARY KEY (f1, f2));
+INSERT INTO t1 VALUES (4);
+INSERT INTO t2 VALUES (3, 3);
+INSERT INTO t2 VALUES (7, 7);
+EXPLAIN SELECT * FROM t1 LEFT JOIN t2 ON t2.f1 = t1.f1
+WHERE t1.f1 = 4
+GROUP BY t2.f1, t2.f2;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	SIMPLE	t1	system	PRIMARY	NULL	NULL	NULL	1	Using temporary; Using filesort
+1	SIMPLE	t2	ref	PRIMARY	PRIMARY	4	const	1	Using index
+SELECT * FROM t1 LEFT JOIN t2 ON t2.f1 = t1.f1
+WHERE t1.f1 = 4
+GROUP BY t2.f1, t2.f2;
+f1	f1	f2
+4	NULL	NULL
+EXPLAIN SELECT * FROM t1 LEFT JOIN t2 ON t2.f1 = t1.f1
+WHERE t1.f1 = 4 AND t2.f1 IS NOT NULL AND t2.f2 IS NOT NULL
+GROUP BY t2.f1, t2.f2;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	SIMPLE	t1	system	PRIMARY	NULL	NULL	NULL	1	Using filesort
+1	SIMPLE	t2	ref	PRIMARY	PRIMARY	4	const	1	Using where; Using index
+SELECT * FROM t1 LEFT JOIN t2 ON t2.f1 = t1.f1
+WHERE t1.f1 = 4 AND t2.f1 IS NOT NULL AND t2.f2 IS NOT NULL
+GROUP BY t2.f1, t2.f2;
+f1	f1	f2
+DROP TABLE t1,t2;
 End of 5.1 tests
diff --git a/mysql-test/r/partition_innodb.result b/mysql-test/r/partition_innodb.result
index 525cc439cd1..6515d2a4e0c 100644
--- a/mysql-test/r/partition_innodb.result
+++ b/mysql-test/r/partition_innodb.result
@@ -1,5 +1,31 @@
 drop table if exists t1, t2;
 #
+# Bug#56287: crash when using Partition datetime in sub in query
+#
+CREATE TABLE t1
+(c1 bigint(20) unsigned NOT NULL AUTO_INCREMENT,
+c2 varchar(40) not null default '',
+c3 datetime not  NULL,
+PRIMARY KEY (c1,c3),
+KEY partidx(c3))
+ENGINE=InnoDB
+PARTITION BY RANGE (TO_DAYS(c3))
+(PARTITION p200912 VALUES LESS THAN (to_days('2010-01-01')),
+PARTITION p201103 VALUES LESS THAN (to_days('2011-04-01')),
+PARTITION p201912 VALUES LESS THAN MAXVALUE);
+insert into t1(c2,c3) values ("Test row",'2010-01-01 00:00:00');
+SELECT PARTITION_NAME, TABLE_ROWS FROM INFORMATION_SCHEMA.PARTITIONS WHERE TABLE_NAME = 't1' AND TABLE_SCHEMA = 'test';
+PARTITION_NAME	TABLE_ROWS
+p200912	0
+p201103	1
+p201912	0
+SELECT count(*) FROM t1 p where c3 in
+(select c3 from t1 t where t.c3 < date '2011-04-26 19:19:44'
+ and t.c3 > date '2011-04-26 19:18:44') ;
+count(*)
+0
+DROP TABLE t1;
+#
 # Bug#54747: Deadlock between REORGANIZE PARTITION and
 #            SELECT is not detected
 #
diff --git a/mysql-test/t/ctype_utf8.test b/mysql-test/t/ctype_utf8.test
index c7586c71229..4cd9a635e24 100644
--- a/mysql-test/t/ctype_utf8.test
+++ b/mysql-test/t/ctype_utf8.test
@@ -1439,6 +1439,25 @@ DROP TABLE t1;
 --echo End of 5.0 tests
 
 
+#
+# Bug #57272: crash in rpad() when using utf8
+#
+SELECT LENGTH(RPAD(0.0115E88, 61297, _utf8'яэюя'));
+SELECT LENGTH(RPAD(0.0115E88, 61297, _utf8'йцуя'));
+SELECT HEX(RPAD(0x20, 2, _utf8 0xD18F));
+SELECT HEX(RPAD(0x20, 4, _utf8 0xD18F));
+SELECT HEX(LPAD(0x20, 2, _utf8 0xD18F));
+SELECT HEX(LPAD(0x20, 4, _utf8 0xD18F));
+
+SELECT HEX(RPAD(_utf8 0xD18F, 3, 0x20));
+SELECT HEX(LPAD(_utf8 0xD18F, 3, 0x20));
+
+SELECT HEX(INSERT(_utf8 0xD18F, 2, 1, 0x20));
+SELECT HEX(INSERT(_utf8 0xD18FD18E, 2, 1, 0x20));
+
+
+--echo End of 5.1 tests
+
 --echo Start of 5.4 tests
 
 #
diff --git a/mysql-test/t/explain.test b/mysql-test/t/explain.test
index 60108b3b038..931948b1b65 100644
--- a/mysql-test/t/explain.test
+++ b/mysql-test/t/explain.test
@@ -238,4 +238,40 @@ EXPLAIN SELECT c1 FROM t1 WHERE c2 = 1 AND c4 = 1 AND c5 = 1;
 
 DROP TABLE t1;
 
+--echo #
+--echo # Bug#56814 Explain + subselect + fulltext crashes server
+--echo #
+
+CREATE TABLE t1(f1 VARCHAR(6) NOT NULL,
+FULLTEXT KEY(f1),UNIQUE(f1));
+INSERT INTO t1 VALUES ('test');
+
+EXPLAIN SELECT 1 FROM t1
+WHERE 1 > ALL((SELECT 1 FROM t1 JOIN t1 a ON (MATCH(t1.f1) AGAINST (""))
+WHERE t1.f1 GROUP BY t1.f1));
+
+PREPARE stmt FROM
+'EXPLAIN SELECT 1 FROM t1
+ WHERE 1 > ALL((SELECT 1 FROM t1 RIGHT OUTER JOIN t1 a
+ ON (MATCH(t1.f1) AGAINST (""))
+ WHERE t1.f1 GROUP BY t1.f1))';
+
+EXECUTE stmt;
+EXECUTE stmt;
+
+DEALLOCATE PREPARE stmt;
+
+PREPARE stmt FROM
+'EXPLAIN SELECT 1 FROM t1
+ WHERE 1 > ALL((SELECT 1 FROM t1 JOIN t1 a
+ ON (MATCH(t1.f1) AGAINST (""))
+ WHERE t1.f1 GROUP BY t1.f1))';
+
+EXECUTE stmt;
+EXECUTE stmt;
+
+DEALLOCATE PREPARE stmt;
+
+DROP TABLE t1;
+
 --echo End of 5.1 tests.
diff --git a/mysql-test/t/fulltext.test b/mysql-test/t/fulltext.test
index 388b1432390..8631932d5c0 100644
--- a/mysql-test/t/fulltext.test
+++ b/mysql-test/t/fulltext.test
@@ -594,4 +594,40 @@ REPAIR TABLE t1;
 SET myisam_sort_buffer_size=@@global.myisam_sort_buffer_size;
 DROP TABLE t1;
 
+--echo #
+--echo # Bug#54484 explain + prepared statement: crash and Got error -1 from storage engine
+--echo #
+
+CREATE TABLE t1(f1 VARCHAR(6) NOT NULL, FULLTEXT KEY(f1), UNIQUE(f1));
+INSERT INTO t1 VALUES ('test');
+
+SELECT 1 FROM t1 WHERE 1 >
+ ALL((SELECT 1 FROM t1 JOIN t1 a
+ ON (MATCH(t1.f1) against (""))
+ WHERE t1.f1 GROUP BY t1.f1)) xor f1;
+
+PREPARE stmt FROM
+'SELECT 1 FROM t1 WHERE 1 >
+ ALL((SELECT 1 FROM t1 RIGHT OUTER JOIN t1 a
+ ON (MATCH(t1.f1) against (""))
+ WHERE t1.f1 GROUP BY t1.f1)) xor f1';
+
+EXECUTE stmt;
+EXECUTE stmt;
+
+DEALLOCATE PREPARE stmt;
+
+PREPARE stmt FROM
+'SELECT 1 FROM t1 WHERE 1 >
+ ALL((SELECT 1 FROM t1 JOIN t1 a
+ ON (MATCH(t1.f1) against (""))
+ WHERE t1.f1 GROUP BY t1.f1))';
+
+EXECUTE stmt;
+EXECUTE stmt;
+
+DEALLOCATE PREPARE stmt;
+
+DROP TABLE t1;
+
 --echo End of 5.1 tests
diff --git a/mysql-test/t/func_gconcat.test b/mysql-test/t/func_gconcat.test
index 0624fce3a34..13b3697cbf6 100644
--- a/mysql-test/t/func_gconcat.test
+++ b/mysql-test/t/func_gconcat.test
@@ -738,6 +738,17 @@ EXECUTE stmt;
 DEALLOCATE PREPARE stmt;
 DROP TABLE t1;
 
+--echo #
+--echo # Bug#57194 group_concat cause crash and/or invalid memory reads with type errors
+--echo #
+
+CREATE TABLE t1(f1 int);
+INSERT INTO t1 values (0),(0);
+--disable_ps_protocol
+--error ER_ILLEGAL_VALUE_FOR_TYPE
+SELECT POLYGON((SELECT 1 FROM (SELECT 1 IN (GROUP_CONCAT(t1.f1)) FROM t1, t1 t GROUP BY t.f1 ) d));
+--enable_ps_protocol
+DROP TABLE t1;
 
 --echo End of 5.1 tests
 
diff --git a/mysql-test/t/func_math.test b/mysql-test/t/func_math.test
index 5d5dea74e28..7f9ed6d8a93 100644
--- a/mysql-test/t/func_math.test
+++ b/mysql-test/t/func_math.test
@@ -316,6 +316,14 @@ SELECT RAND(i) FROM t1;
 DROP TABLE t1;
 
 --echo #
+--echo # Bug#57477 SIGFPE when dividing a huge number a negative number
+--echo #
+--error ER_DATA_OUT_OF_RANGE
+SELECT -9999999999999999991 DIV -1;
+--error ER_DATA_OUT_OF_RANGE
+SELECT -9223372036854775808 DIV -1;
+SELECT -9223372036854775808 MOD -1;
+SELECT -9223372036854775808999 MOD -1;
 
 #
 # Bug #8457: Precision math:
diff --git a/mysql-test/t/func_misc.test b/mysql-test/t/func_misc.test
index 8cea850b184..31462d83c41 100644
--- a/mysql-test/t/func_misc.test
+++ b/mysql-test/t/func_misc.test
@@ -480,6 +480,13 @@ SELECT DISTINCT GREATEST(a, (SELECT b FROM t1 LIMIT 1)) FROM t1 UNION SELECT 1;
 DROP TABLE t1;
 
 
+#
+# Bug #57283: inet_ntoa() crashes
+#
+SELECT INET_NTOA(0);
+SELECT '1' IN ('1', INET_NTOA(0));
+
+
 --echo #
 --echo # Bug #52165: Assertion failed: file .\dtoa.c, line 465
 --echo # 
@@ -516,3 +523,4 @@ SELECT 1 from t1 HAVING NAME_CONST('', a);
 
 DROP TABLE t1;
 
+--echo End of tests
diff --git a/mysql-test/t/group_by.test b/mysql-test/t/group_by.test
index 2fb73af0c99..282b286749a 100644
--- a/mysql-test/t/group_by.test
+++ b/mysql-test/t/group_by.test
@@ -1236,6 +1236,17 @@ SELECT SUBSTRING(a,1,10), LENGTH(a) FROM t1 GROUP BY a;
 SELECT SUBSTRING(a,1,10), LENGTH(a) FROM t1 GROUP BY a;
 DROP TABLE t1;
 
+--echo #
+--echo # Bug#57688 Assertion `!table || (!table->write_set || bitmap_is_set(table->write_set, field
+--echo #
+
+CREATE TABLE t1(f1 INT NOT NULL);
+INSERT INTO t1 VALUES (16777214),(0);
+
+SELECT COUNT(*) FROM t1 LEFT JOIN t1 t2
+ON 1 WHERE t2.f1 > 1 GROUP BY t2.f1;
+
+DROP TABLE t1;
 
 --echo # End of 5.1 tests
 
diff --git a/mysql-test/t/join_outer.test b/mysql-test/t/join_outer.test
index cf881e6aaa2..3251ff292b6 100644
--- a/mysql-test/t/join_outer.test
+++ b/mysql-test/t/join_outer.test
@@ -981,4 +981,33 @@ EXPLAIN EXTENDED SELECT STRAIGHT_JOIN jt1.f1 FROM t1 AS jt1
 
 DROP TABLE t1;
 
+--echo #
+--echo # Bug#57688 Assertion `!table || (!table->write_set || bitmap_is_set(table->write_set, field
+--echo #
+
+CREATE TABLE t1 (f1 INT NOT NULL, PRIMARY KEY (f1));
+CREATE TABLE t2 (f1 INT NOT NULL, f2 INT NOT NULL, PRIMARY KEY (f1, f2));
+
+INSERT INTO t1 VALUES (4);
+INSERT INTO t2 VALUES (3, 3);
+INSERT INTO t2 VALUES (7, 7);
+
+EXPLAIN SELECT * FROM t1 LEFT JOIN t2 ON t2.f1 = t1.f1
+WHERE t1.f1 = 4
+GROUP BY t2.f1, t2.f2;
+
+SELECT * FROM t1 LEFT JOIN t2 ON t2.f1 = t1.f1
+WHERE t1.f1 = 4
+GROUP BY t2.f1, t2.f2;
+
+EXPLAIN SELECT * FROM t1 LEFT JOIN t2 ON t2.f1 = t1.f1
+WHERE t1.f1 = 4 AND t2.f1 IS NOT NULL AND t2.f2 IS NOT NULL
+GROUP BY t2.f1, t2.f2;
+
+SELECT * FROM t1 LEFT JOIN t2 ON t2.f1 = t1.f1
+WHERE t1.f1 = 4 AND t2.f1 IS NOT NULL AND t2.f2 IS NOT NULL
+GROUP BY t2.f1, t2.f2;
+
+DROP TABLE t1,t2;
+
 --echo End of 5.1 tests
diff --git a/mysql-test/t/partition_innodb.test b/mysql-test/t/partition_innodb.test
index ddc2812f617..84dd516d153 100644
--- a/mysql-test/t/partition_innodb.test
+++ b/mysql-test/t/partition_innodb.test
@@ -9,6 +9,31 @@ drop table if exists t1, t2;
 let $MYSQLD_DATADIR= `SELECT @@datadir`;
 
 --echo #
+--echo # Bug#56287: crash when using Partition datetime in sub in query
+--echo #
+CREATE TABLE t1
+(c1 bigint(20) unsigned NOT NULL AUTO_INCREMENT,
+ c2 varchar(40) not null default '',
+ c3 datetime not  NULL,
+ PRIMARY KEY (c1,c3),
+ KEY partidx(c3))
+ENGINE=InnoDB
+PARTITION BY RANGE (TO_DAYS(c3))
+(PARTITION p200912 VALUES LESS THAN (to_days('2010-01-01')),
+ PARTITION p201103 VALUES LESS THAN (to_days('2011-04-01')),
+ PARTITION p201912 VALUES LESS THAN MAXVALUE);
+
+insert into t1(c2,c3) values ("Test row",'2010-01-01 00:00:00');
+
+SELECT PARTITION_NAME, TABLE_ROWS FROM INFORMATION_SCHEMA.PARTITIONS WHERE TABLE_NAME = 't1' AND TABLE_SCHEMA = 'test';
+SELECT count(*) FROM t1 p where c3 in
+(select c3 from t1 t where t.c3 < date '2011-04-26 19:19:44'
+ and t.c3 > date '2011-04-26 19:18:44') ;
+
+DROP TABLE t1;
+
+
+--echo #
 --echo # Bug#54747: Deadlock between REORGANIZE PARTITION and
 --echo #            SELECT is not detected
 --echo #
@@ -109,6 +134,7 @@ SELECT * FROM t1;
 COMMIT;
 DROP TABLE t1;
 
+
 --echo #
 --echo # Bug#51830: Incorrect partition pruning on range partition (regression)
 --echo #
@@ -552,6 +578,19 @@ connection default;
 SELECT * FROM t1;
 COMMIT;
 DROP TABLE t1;
+
+#
+# Bug #55146    Assertion `m_part_spec.start_part == m_part_spec.end_part' in index_read_idx_map
+#
+
+CREATE TABLE t1 (i1 int NOT NULL primary key, f1 int) ENGINE = InnoDB
+    PARTITION BY HASH(i1) PARTITIONS 2;
+
+INSERT INTO t1 VALUES (1,1), (2,2);
+
+SELECT * FROM t1 WHERE i1 = ( SELECT i1 FROM t1 WHERE f1=0 LIMIT 1 );
+
+DROP TABLE t1;
 --enable_parsing
 
 --echo #
diff --git a/mysys/my_symlink.c b/mysys/my_symlink.c
index 258e227bb7b..b57edd2179a 100644
--- a/mysys/my_symlink.c
+++ b/mysys/my_symlink.c
@@ -113,7 +113,6 @@ int my_is_symlink(const char *filename __attribute__((unused)))
 #endif
 }
 
-
 /*
   Resolve all symbolic links in path
   'to' may be equal to 'filename'
@@ -147,7 +146,23 @@ int my_realpath(char *to, const char *filename,
   }
   DBUG_RETURN(result);
 #else
+#ifdef _WIN32
+  int ret= GetFullPathName(filename,FN_REFLEN,

+                           to,

+                           NULL);
+  if (ret == 0 || ret > FN_REFLEN)
+  {
+    if (ret > FN_REFLEN)
+      my_errno= ENAMETOOLONG;
+    else
+      my_errno= EACCES;
+    if (MyFlags & MY_WME)
+      my_error(EE_REALPATH, MYF(0), filename, my_errno);
+	  return -1;
+  }
+#else
   my_load_path(to, filename, NullS);
+#endif
   return 0;
 #endif
 }
diff --git a/sql/ha_partition.cc b/sql/ha_partition.cc
index 3958cbf4387..f4e240e5cc1 100644
--- a/sql/ha_partition.cc
+++ b/sql/ha_partition.cc
@@ -4425,8 +4425,12 @@ int ha_partition::index_read_idx_map(uchar *buf, uint index,
 
     get_partition_set(table, buf, index, &m_start_key, &m_part_spec);
 
-    /* How can it be more than one partition with the current use? */
-    DBUG_ASSERT(m_part_spec.start_part == m_part_spec.end_part);
+    /* 
+      We have either found exactly 1 partition
+      (in which case start_part == end_part)
+      or no matching partitions (start_part > end_part)
+    */
+    DBUG_ASSERT(m_part_spec.start_part >= m_part_spec.end_part);
 
     for (part= m_part_spec.start_part; part <= m_part_spec.end_part; part++)
     {
@@ -4661,6 +4665,7 @@ int ha_partition::partition_scan_set_up(uchar * buf, bool idx_read_flag)
       key not found.
     */
     DBUG_PRINT("info", ("scan with no partition to scan"));
+    table->status= STATUS_NOT_FOUND;
     DBUG_RETURN(HA_ERR_END_OF_FILE);
   }
   if (m_part_spec.start_part == m_part_spec.end_part)
@@ -4685,6 +4690,7 @@ int ha_partition::partition_scan_set_up(uchar * buf, bool idx_read_flag)
     if (start_part == MY_BIT_NONE)
     {
       DBUG_PRINT("info", ("scan with no partition to scan"));
+      table->status= STATUS_NOT_FOUND;
       DBUG_RETURN(HA_ERR_END_OF_FILE);
     }
     if (start_part > m_part_spec.start_part)
diff --git a/sql/item_func.cc b/sql/item_func.cc
index 4551962a2c1..92b80e274f4 100644
--- a/sql/item_func.cc
+++ b/sql/item_func.cc
@@ -5734,7 +5734,17 @@ void Item_func_match::init_search(bool no_order)
 
   /* Check if init_search() has been called before */
   if (ft_handler)
+  {
+    /*
+      We should reset ft_handler as it is cleaned up
+      on destruction of FT_SELECT object
+      (necessary in case of re-execution of subquery).
+      TODO: FT_SELECT should not clean up ft_handler.
+    */
+    if (join_key)
+      table->file->ft_handler= ft_handler;
     DBUG_VOID_RETURN;
+  }
 
   if (key == NO_SUCH_KEY)
   {
diff --git a/sql/item_func.h b/sql/item_func.h
index 15730516c71..63662d97019 100644
--- a/sql/item_func.h
+++ b/sql/item_func.h
@@ -1595,7 +1595,7 @@ public:
        join_key(0), ft_handler(0), table(0), master(0), concat_ws(0) { }
   void cleanup()
   {
-    DBUG_ENTER("Item_func_match");
+    DBUG_ENTER("Item_func_match::cleanup");
     Item_real_func::cleanup();
     if (!master && ft_handler)
       ft_handler->please->close_search(ft_handler);
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
index 89c1e785c71..6d8a113d4a4 100644
--- a/sql/item_strfunc.cc
+++ b/sql/item_strfunc.cc
@@ -1184,6 +1184,20 @@ String *Item_func_insert::val_str(String *str)
   if ((length < 0) || (length > res->length()))
     length= res->length();
 
+  /*
+    There is one exception not handled (intentionaly) by the character set
+    aggregation code. If one string is strong side and is binary, and
+    another one is weak side and is a multi-byte character string,
+    then we need to operate on the second string in terms on bytes when
+    calling ::numchars() and ::charpos(), rather than in terms of characters.
+    Lets substitute its character set to binary.
+  */
+  if (collation.collation == &my_charset_bin)
+  {
+    res->set_charset(&my_charset_bin);
+    res2->set_charset(&my_charset_bin);
+  }
+
   /* start and length are now sufficiently valid to pass to charpos function */
    start= res->charpos((int) start);
    length= res->charpos((int) length, (uint32) start);
@@ -2725,6 +2739,20 @@ String *Item_func_rpad::val_str(String *str)
   /* Set here so that rest of code sees out-of-bound value as such. */
   if ((ulonglong) count > INT_MAX32)
     count= INT_MAX32;
+  /*
+    There is one exception not handled (intentionaly) by the character set
+    aggregation code. If one string is strong side and is binary, and
+    another one is weak side and is a multi-byte character string,
+    then we need to operate on the second string in terms on bytes when
+    calling ::numchars() and ::charpos(), rather than in terms of characters.
+    Lets substitute its character set to binary.
+  */
+  if (collation.collation == &my_charset_bin)
+  {
+    res->set_charset(&my_charset_bin);
+    rpad->set_charset(&my_charset_bin);
+  }
+
   if (count <= (res_char_length= res->numchars()))
   {						// String to pad is big enough
     res->length(res->charpos((int) count));	// Shorten result if longer
@@ -2814,6 +2842,20 @@ String *Item_func_lpad::val_str(String *str)
   if ((ulonglong) count > INT_MAX32)
     count= INT_MAX32;
 
+  /*
+    There is one exception not handled (intentionaly) by the character set
+    aggregation code. If one string is strong side and is binary, and
+    another one is weak side and is a multi-byte character string,
+    then we need to operate on the second string in terms on bytes when
+    calling ::numchars() and ::charpos(), rather than in terms of characters.
+    Lets substitute its character set to binary.
+  */
+  if (collation.collation == &my_charset_bin)
+  {
+    res->set_charset(&my_charset_bin);
+    pad->set_charset(&my_charset_bin);
+  }
+
   res_char_length= res->numchars();
 
   if (count <= res_char_length)
diff --git a/sql/item_subselect.cc b/sql/item_subselect.cc
index 5cf585e1a56..c1b1f47e5e9 100644
--- a/sql/item_subselect.cc
+++ b/sql/item_subselect.cc
@@ -1910,21 +1910,26 @@ int subselect_single_select_engine::exec()
       DBUG_RETURN(join->error ? join->error : 1);
     }
     if (!select_lex->uncacheable && thd->lex->describe && 
-        !(join->select_options & SELECT_DESCRIBE) && 
-        join->need_tmp)
+        !(join->select_options & SELECT_DESCRIBE))
     {
       item->update_used_tables();
       if (item->const_item())
       {
         /*
+          It's necessary to keep original JOIN table because
+          create_sort_index() function may overwrite original
+          JOIN_TAB::type and wrong optimization method can be
+          selected on re-execution.
+        */
+        select_lex->uncacheable|= UNCACHEABLE_EXPLAIN;
+        select_lex->master_unit()->uncacheable|= UNCACHEABLE_EXPLAIN;
+        /*
           Force join->join_tmp creation, because this subquery will be replaced
           by a simple select from the materialization temp table by optimize()
           called by EXPLAIN and we need to preserve the initial query structure
           so we can display it.
         */
-        select_lex->uncacheable|= UNCACHEABLE_EXPLAIN;
-        select_lex->master_unit()->uncacheable|= UNCACHEABLE_EXPLAIN;
-        if (join->init_save_join_tab())
+        if (join->need_tmp && join->init_save_join_tab())
           DBUG_RETURN(1);                        /* purecov: inspected */
       }
     }
diff --git a/sql/item_sum.cc b/sql/item_sum.cc
index b6e5d6d3182..8cd8e1bb222 100644
--- a/sql/item_sum.cc
+++ b/sql/item_sum.cc
@@ -3395,8 +3395,6 @@ String* Item_func_group_concat::val_str(String* str)
 
 void Item_func_group_concat::print(String *str, enum_query_type query_type)
 {
-  /* orig_args is not filled with valid values until fix_fields() */
-  Item **pargs= fixed ? orig_args : args;
   str->append(STRING_WITH_LEN("group_concat("));
   if (distinct)
     str->append(STRING_WITH_LEN("distinct "));
@@ -3404,7 +3402,7 @@ void Item_func_group_concat::print(String *str, enum_query_type query_type)
   {
     if (i)
       str->append(',');
-    pargs[i]->print(str, query_type);
+    orig_args[i]->print(str, query_type);
   }
   if (arg_count_order)
   {
@@ -3413,7 +3411,7 @@ void Item_func_group_concat::print(String *str, enum_query_type query_type)
     {
       if (i)
         str->append(',');
-      pargs[i + arg_count_field]->print(str, query_type);
+      orig_args[i + arg_count_field]->print(str, query_type);
       if (order[i]->asc)
         str->append(STRING_WITH_LEN(" ASC"));
       else
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 066b279cba0..ef2dd1d76e1 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -1756,6 +1756,9 @@ JOIN::reinit()
       func->clear();
   }
 
+  if (!(select_options & SELECT_DESCRIBE))
+    init_ftfuncs(thd, select_lex, test(order));
+
   DBUG_RETURN(0);
 }
 
@@ -2513,6 +2516,13 @@ mysql_select(THD *thd, Item ***rref_pointer_array,
 	{
 	  DBUG_RETURN(TRUE);
 	}
+        /*
+          Original join tabs might be overwritten at first
+          subselect execution. So we need to restore them.
+        */
+        Item_subselect *subselect= select_lex->master_unit()->item;
+        if (subselect && subselect->is_uncacheable() && join->reinit())
+          DBUG_RETURN(TRUE);
       }
       else
       {
@@ -13435,6 +13445,8 @@ static bool
 list_contains_unique_index(TABLE *table,
                           bool (*find_func) (Field *, void *), void *data)
 {
+  if (table->pos_in_table_list->outer_join)
+    return 0;
   for (uint keynr= 0; keynr < table->s->keys; keynr++)
   {
     if (keynr == table->s->primary_key ||
@@ -13448,7 +13460,7 @@ list_contains_unique_index(TABLE *table,
            key_part < key_part_end;
            key_part++)
       {
-        if (key_part->field->maybe_null() || 
+        if (key_part->field->real_maybe_null() || 
             !find_func(key_part->field, data))
           break;
       }