Merge 10.1 into 10.2

70 files changed, 687 insertions, 269 deletions

diff --git a/client/mysqltest.cc b/client/mysqltest.cc
index 95165b63e42..a05305a85e3 100644
--- a/client/mysqltest.cc
+++ b/client/mysqltest.cc
@@ -1461,7 +1461,7 @@ void close_statements()
   for (con= connections; con < next_con; con++)
   {
     if (con->stmt)
-      mysql_stmt_close(con->stmt);
+      do_stmt_close(con);
     con->stmt= 0;
   }
   DBUG_VOID_RETURN;
diff --git a/extra/mariabackup/xtrabackup.cc b/extra/mariabackup/xtrabackup.cc
index 30bbf67807e..fed66c844c5 100644
--- a/extra/mariabackup/xtrabackup.cc
+++ b/extra/mariabackup/xtrabackup.cc
@@ -3056,7 +3056,7 @@ static dberr_t xb_assign_undo_space_start()
 		name[dirnamelen++] = OS_PATH_SEPARATOR;
 	}
 
-	snprintf(name + dirnamelen, strlen(name) + strlen("ibdata1"),
+	snprintf(name + dirnamelen, (sizeof name) - dirnamelen,
 		 "%s", "ibdata1");
 
 	file = os_file_create(0, name, OS_FILE_OPEN,
diff --git a/mysql-test/include/galera_wait_ready.inc b/mysql-test/include/galera_wait_ready.inc
index e20f01fad90..a726116f000 100644
--- a/mysql-test/include/galera_wait_ready.inc
+++ b/mysql-test/include/galera_wait_ready.inc
@@ -1,2 +1,32 @@
-let $wait_condition = SELECT 1 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'wsrep_ready' AND VARIABLE_VALUE = 'ON';
---source include/wait_condition.inc
+# include/galera_wait_ready.inc
+#
+# Waits for galera node to transition to READY state.
+#
+
+--enable_reconnect
+--disable_query_log
+--disable_result_log
+let $wait_counter = 600;
+while ($wait_counter)
+{
+  --disable_abort_on_error
+  let $success = `SELECT VARIABLE_VALUE = 'ON' FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'wsrep_ready'`;
+  --enable_abort_on_error
+  if ($success)
+  {
+    let $wait_counter = 0;
+  }
+  if (!$success)
+  {
+     real_sleep 0.1;
+     dec $wait_counter;
+  }
+}
+
+if (!$success)
+{
+  die "Server did not transition to READY state";
+}
+--disable_reconnect
+--enable_query_log
+--enable_result_log
diff --git a/mysql-test/mysql-test-run.pl b/mysql-test/mysql-test-run.pl
index f8f1e0af45a..e8b40d156b1 100755
--- a/mysql-test/mysql-test-run.pl
+++ b/mysql-test/mysql-test-run.pl
@@ -2,7 +2,7 @@
 # -*- cperl -*-
 
 # Copyright (c) 2004, 2014, Oracle and/or its affiliates.
-# Copyright (c) 2009, 2017, MariaDB Corporation
+# Copyright (c) 2009, 2018, MariaDB Corporation
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
diff --git a/mysql-test/r/ctype_ucs.result b/mysql-test/r/ctype_ucs.result
index 9c5ca0482a1..f6d3d86e2cd 100644
--- a/mysql-test/r/ctype_ucs.result
+++ b/mysql-test/r/ctype_ucs.result
@@ -4596,6 +4596,37 @@ c1	mediumtext	YES		NULL
 DROP TABLE t1;
 set sql_mode=default;
 #
+# MDEV-15624 Changing the default character set to utf8mb4 changes query evaluation in a very surprising way
+#
+SET NAMES utf8;
+CREATE TABLE t1 (id INT);
+INSERT INTO t1 VALUES (1),(2),(3);
+SELECT COUNT(DISTINCT c) FROM (SELECT id, REPLACE(uuid_short(), '0', CAST('o' AS CHAR CHARACTER SET ucs2)) AS c FROM t1) AS d1;
+COUNT(DISTINCT c)
+3
+SELECT DISTINCT REPLACE(uuid_short(), '0', CAST('o' AS CHAR CHARACTER SET ucs2)) AS c FROM t1;
+c
+xxxxxxxxxxxxxxxxx
+xxxxxxxxxxxxxxxxx
+xxxxxxxxxxxxxxxxx
+SELECT COUNT(DISTINCT c) FROM (SELECT id, INSERT(uuid_short(), 1, 1, CAST('0' AS CHAR CHARACTER SET ucs2)) AS c FROM t1) AS d1;
+COUNT(DISTINCT c)
+3
+SELECT DISTINCT INSERT(uuid_short(), 1, 1, CAST('0' AS CHAR CHARACTER SET ucs2)) AS c FROM t1;
+c
+xxxxxxxxxxxxxxxxx
+xxxxxxxxxxxxxxxxx
+xxxxxxxxxxxxxxxxx
+SELECT COUNT(DISTINCT c) FROM (SELECT id, CONCAT(uuid_short(), CAST('0' AS CHAR CHARACTER SET ucs2)) AS c FROM t1) AS d1;
+COUNT(DISTINCT c)
+3
+SELECT DISTINCT CONCAT(uuid_short(), CAST('0' AS CHAR CHARACTER SET ucs2)) AS c FROM t1;
+c
+xxxxxxxxxxxxxxxxx
+xxxxxxxxxxxxxxxxx
+xxxxxxxxxxxxxxxxx
+DROP TABLE t1;
+#
 # End of 5.5 tests
 #
 #
diff --git a/mysql-test/r/ctype_utf8mb4.result b/mysql-test/r/ctype_utf8mb4.result
index fbe95d9f44b..7e5e99354ea 100644
--- a/mysql-test/r/ctype_utf8mb4.result
+++ b/mysql-test/r/ctype_utf8mb4.result
@@ -2868,6 +2868,29 @@ SELECT LENGTH(data) AS len FROM (SELECT REPEAT('☃', 65536) AS data ) AS sub;
 len
 196608
 #
+# MDEV-15624 Changing the default character set to utf8mb4 changes query evaluation in a very surprising way
+#
+SET NAMES utf8mb4;
+CREATE TABLE t1 (id INT);
+INSERT INTO t1 VALUES (1),(2),(3);
+SELECT COUNT(DISTINCT c) FROM (SELECT id, REPLACE(UUID(), "-", "") AS c FROM t1) AS d1;
+COUNT(DISTINCT c)
+3
+SELECT DISTINCT INSERT(uuid(), 9, 1, "X") AS c FROM t1;
+c
+xxxxxxxxxxxxx-xxxx-xxxx-xxxxxxxxxxxx
+xxxxxxxxxxxxx-xxxx-xxxx-xxxxxxxxxxxx
+xxxxxxxxxxxxx-xxxx-xxxx-xxxxxxxxxxxx
+SELECT COUNT(DISTINCT c) FROM (SELECT id, INSERT(UUID(), 9, 1, "X") AS c FROM t1) AS d1;
+COUNT(DISTINCT c)
+3
+SELECT DISTINCT INSERT(UUID(), 9, 1, "X") AS c FROM t1;
+c
+xxxxxxxxxxxxx-xxxx-xxxx-xxxxxxxxxxxx
+xxxxxxxxxxxxx-xxxx-xxxx-xxxxxxxxxxxx
+xxxxxxxxxxxxx-xxxx-xxxx-xxxxxxxxxxxx
+DROP TABLE t1;
+#
 # End of 5.5 tests
 #
 #
diff --git a/mysql-test/r/mysqld--help.result b/mysql-test/r/mysqld--help.result
index c1afe42695a..3b7d5e21c00 100644
--- a/mysql-test/r/mysqld--help.result
+++ b/mysql-test/r/mysqld--help.result
@@ -2,8 +2,10 @@ Windows bug: happens when a new line is exactly at the right offset.
 The following options may be given as the first argument:
 --print-defaults Print the program argument list and exit.
 --no-defaults Don't read default options from any option file.
+The following specify which files/extra groups are read (specified before remaining options):
 --defaults-file=# Only read default options from the given file #.
 --defaults-extra-file=# Read this file after the global files are read.
+--defaults-group-suffix=# Additionally read default groups with # appended as a suffix.
 
  --allow-suspicious-udfs 
  Allows use of UDFs consisting of only one symbol xxx()
diff --git a/mysql-test/r/read_only_innodb.result b/mysql-test/r/read_only_innodb.result
index abfc5322ed0..b6e294b633c 100644
--- a/mysql-test/r/read_only_innodb.result
+++ b/mysql-test/r/read_only_innodb.result
@@ -237,6 +237,14 @@ a	a
 5	10
 DROP TABLE temp1, temp2;
 
+# MDEV-14185 CREATE TEMPORARY TABLE AS SELECT causes error 1290 with read_only and InnoDB.
+
+CREATE TEMPORARY TABLE temp1 ENGINE=INNODB AS SELECT a FROM t1;
+SELECT * FROM temp1;
+a
+1
+DROP TABLE temp1;
+
 # Disconnect and cleanup
 
 disconnect con1;
diff --git a/mysql-test/r/sp-destruct.result b/mysql-test/r/sp-destruct.result
index 5bb3b17d4b8..3cd0e4773b9 100644
--- a/mysql-test/r/sp-destruct.result
+++ b/mysql-test/r/sp-destruct.result
@@ -171,3 +171,9 @@ create database mysqltest1;
 create procedure mysqltest1.foo() select "foo";
 update mysql.proc set name='' where db='mysqltest1';
 drop database mysqltest1;
+create procedure p1() set @foo = 10;
+alter table mysql.proc drop primary key;
+drop procedure p1;
+ERROR HY000: Cannot load from mysql.proc. The table is probably corrupted
+alter table mysql.proc add primary key (db,name,type);
+drop procedure p1;
diff --git a/mysql-test/r/subselect4.result b/mysql-test/r/subselect4.result
index 35e3273c459..2fc87a9e0d8 100644
--- a/mysql-test/r/subselect4.result
+++ b/mysql-test/r/subselect4.result
@@ -2503,6 +2503,26 @@ SELECT 2 IN (SELECT 2 from DUAL WHERE 1 != 1);
 SET optimizer_switch= @@global.optimizer_switch;
 set @@tmp_table_size= @@global.tmp_table_size;
 #
+# MDEV-14515: Wrong results for tableless query with subquery in WHERE
+#             and implicit aggregation
+#
+create table t1 (i1 int, i2 int);
+insert into t1 values (1314, 1084),(1330, 1084),(1401, 1084),(580, 1084);
+create table t2 (cd int);
+insert into t2 values
+(1330), (1330), (1330), (1330), (1330), (1330), (1330), (1330),
+(1330), (1330), (1330), (1330), (1330), (1330), (1330), (1330);
+select max(10) from dual
+where exists (select 1 from t2 join t1 on t1.i1 = t2.cd  and t1.i2 = 345);
+max(10)
+NULL
+insert into t2 select * from t2;
+select max(10) from dual
+where exists (select 1 from t2 join t1 on t1.i1 = t2.cd  and t1.i2 = 345);
+max(10)
+NULL
+DROP TABLE t1,t2;
+#
 # MDEV-10232 Scalar result of subquery changes after adding an outer select stmt
 #
 create table t1(c1 int, c2 int, primary key(c2));
diff --git a/mysql-test/suite/galera/include/galera_load_provider.inc b/mysql-test/suite/galera/include/galera_load_provider.inc
index 761a1a89fd3..aeab7e6ea19 100644
--- a/mysql-test/suite/galera/include/galera_load_provider.inc
+++ b/mysql-test/suite/galera/include/galera_load_provider.inc
@@ -5,6 +5,4 @@
 --eval SET GLOBAL wsrep_cluster_address = '$wsrep_cluster_address_orig';
 --enable_query_log
 
---enable_reconnect
---source include/wait_until_connected_again.inc
---source include/wait_until_ready.inc
+--source include/galera_wait_ready.inc
diff --git a/mysql-test/suite/galera/include/galera_st_clean_slave.inc b/mysql-test/suite/galera/include/galera_st_clean_slave.inc
index 81ba54aa6f5..3a49f4f6ad2 100644
--- a/mysql-test/suite/galera/include/galera_st_clean_slave.inc
+++ b/mysql-test/suite/galera/include/galera_st_clean_slave.inc
@@ -64,7 +64,9 @@ INSERT INTO t1 VALUES ('node1_to_be_rollbacked_after');
 --connection node_2
 --echo Starting server ...
 --source include/start_mysqld.inc
---source include/wait_until_ready.inc
+
+--let $wait_condition = SELECT VARIABLE_VALUE = 2 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'wsrep_cluster_size'
+--source include/wait_condition.inc
 
 SET AUTOCOMMIT=OFF;
 START TRANSACTION;
diff --git a/mysql-test/suite/galera/include/galera_st_kill_slave.inc b/mysql-test/suite/galera/include/galera_st_kill_slave.inc
index bae37755c65..0b96de55a32 100644
--- a/mysql-test/suite/galera/include/galera_st_kill_slave.inc
+++ b/mysql-test/suite/galera/include/galera_st_kill_slave.inc
@@ -24,7 +24,6 @@ COMMIT;
 --source include/kill_galera.inc
 
 --connection node_1
---source include/wait_until_connected_again.inc
 --let $wait_condition = SELECT VARIABLE_VALUE = 1 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'wsrep_cluster_size'
 --source include/wait_condition.inc
 
@@ -59,7 +58,9 @@ INSERT INTO t1 VALUES ('node1_to_be_rollbacked_after');
 
 --echo Starting server ...
 --source include/start_mysqld.inc
---source include/wait_until_ready.inc
+
+--let $wait_condition = SELECT VARIABLE_VALUE = 2 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'wsrep_cluster_size'
+--source include/wait_condition.inc
 
 SET AUTOCOMMIT=OFF;
 START TRANSACTION;
diff --git a/mysql-test/suite/galera/include/galera_st_kill_slave_ddl.inc b/mysql-test/suite/galera/include/galera_st_kill_slave_ddl.inc
index 72e80505870..44a1513fa6e 100644
--- a/mysql-test/suite/galera/include/galera_st_kill_slave_ddl.inc
+++ b/mysql-test/suite/galera/include/galera_st_kill_slave_ddl.inc
@@ -72,7 +72,9 @@ INSERT INTO t1 (f1) VALUES ('node1_to_be_rollbacked_after');
 --connection node_2
 --echo Starting server ...
 --source include/start_mysqld.inc
---source include/wait_until_ready.inc
+
+--let $wait_condition = SELECT VARIABLE_VALUE = 2 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'wsrep_cluster_size'
+--source include/wait_condition.inc
 
 SET AUTOCOMMIT=OFF;
 START TRANSACTION;
diff --git a/mysql-test/suite/galera/include/galera_st_shutdown_slave.inc b/mysql-test/suite/galera/include/galera_st_shutdown_slave.inc
index 1a65ef1bd94..6c09b0ceb0c 100644
--- a/mysql-test/suite/galera/include/galera_st_shutdown_slave.inc
+++ b/mysql-test/suite/galera/include/galera_st_shutdown_slave.inc
@@ -56,7 +56,9 @@ INSERT INTO t1 VALUES ('node1_to_be_rollbacked_after');
 --connection node_2
 --echo Starting server ...
 --source include/start_mysqld.inc
---source include/wait_until_ready.inc
+
+--let $wait_condition = SELECT VARIABLE_VALUE = 2 FROM INFORMATION_SCHEMA.GLOBAL_STATUS WHERE VARIABLE_NAME = 'wsrep_cluster_size'
+--source include/wait_condition.inc
 
 SET AUTOCOMMIT=OFF;
 START TRANSACTION;
diff --git a/mysql-test/suite/galera/include/start_mysqld.inc b/mysql-test/suite/galera/include/start_mysqld.inc
index 4ee3d17810c..57af9203d0f 100644
--- a/mysql-test/suite/galera/include/start_mysqld.inc
+++ b/mysql-test/suite/galera/include/start_mysqld.inc
@@ -12,11 +12,4 @@ if ($galera_wsrep_start_position == '') {
 	--exec echo "restart:$start_mysqld_params" > $_expect_file_name
 }
 
-# Turn on reconnect
---enable_reconnect
-
-# Call script that will poll the server waiting for it to be back online again
---source include/wait_until_connected_again.inc
-
-# Turn off reconnect again
---disable_reconnect
+--source include/galera_wait_ready.inc
diff --git a/mysql-test/suite/galera/r/galera_many_rows.result b/mysql-test/suite/galera/r/galera_many_rows.result
index 6f9e76f010e..b06925fea60 100644
--- a/mysql-test/suite/galera/r/galera_many_rows.result
+++ b/mysql-test/suite/galera/r/galera_many_rows.result
@@ -35,6 +35,6 @@ connection node_1;
 COMMIT;
 connection node_2;
 COMMIT;
-ERROR 40001: Deadlock found when trying to get lock; try restarting transaction
+ERROR 40001: Deadlock: wsrep aborted transaction
 DROP TABLE t1;
 DROP TABLE ten;
diff --git a/mysql-test/suite/galera/r/galera_many_tables_nopk.result b/mysql-test/suite/galera/r/galera_many_tables_nopk.result
index 3e30b333250..573ce758a13 100644
--- a/mysql-test/suite/galera/r/galera_many_tables_nopk.result
+++ b/mysql-test/suite/galera/r/galera_many_tables_nopk.result
@@ -18,6 +18,6 @@ connection node_1;
 COMMIT;
 connection node_2;
 COMMIT;
-ERROR 40001: Deadlock found when trying to get lock; try restarting transaction
+ERROR 40001: Deadlock: wsrep aborted transaction
 DROP SCHEMA test;
 CREATE SCHEMA test;
diff --git a/mysql-test/suite/innodb/r/innodb-alter-nullable.result b/mysql-test/suite/innodb/r/innodb-alter-nullable.result
index 7048f49f4a2..ddf1ac7de7a 100644
--- a/mysql-test/suite/innodb/r/innodb-alter-nullable.result
+++ b/mysql-test/suite/innodb/r/innodb-alter-nullable.result
@@ -57,3 +57,7 @@ WHERE NAME='test/t';
 TABLE_ID	NAME	FLAG	N_COLS	SPACE	FILE_FORMAT	ROW_FORMAT	ZIP_PAGE_SIZE	SPACE_TYPE
 #	test/t	33	6	#	Barracuda	Dynamic	0	Single
 DROP TABLE t;
+CREATE TABLE t1(c1 INT) ENGINE=InnoDB;
+ALTER TABLE t1 ADD CONSTRAINT UNIQUE KEY i1(c1);
+ALTER TABLE t1 CHANGE c1 c1 INT NOT NULL,ADD KEY(c1);
+DROP TABLE t1;
diff --git a/mysql-test/suite/innodb/r/innodb_bug27216817.result b/mysql-test/suite/innodb/r/innodb_bug27216817.result
new file mode 100644
index 00000000000..0210ced9f91
--- /dev/null
+++ b/mysql-test/suite/innodb/r/innodb_bug27216817.result
@@ -0,0 +1,24 @@
+create table t1 (a int not null, b int not null) engine=innodb;
+insert t1 values (1,2),(3,4);
+lock table t1 write, t1 tr read;
+flush status;
+alter table t1 add primary key (b);
+show status like 'Handler_read_rnd_next';
+Variable_name	Value
+Handler_read_rnd_next	0
+unlock tables;
+alter table t1 drop primary key;
+lock table t1 write;
+flush status;
+alter table t1 add primary key (b);
+show status like 'Handler_read_rnd_next';
+Variable_name	Value
+Handler_read_rnd_next	0
+unlock tables;
+alter table t1 drop primary key;
+flush status;
+alter table t1 add primary key (b);
+show status like 'Handler_read_rnd_next';
+Variable_name	Value
+Handler_read_rnd_next	0
+drop table t1;
diff --git a/mysql-test/suite/innodb/t/innodb-alter-nullable.test b/mysql-test/suite/innodb/t/innodb-alter-nullable.test
index bb5cdee000a..d039459f91f 100644
--- a/mysql-test/suite/innodb/t/innodb-alter-nullable.test
+++ b/mysql-test/suite/innodb/t/innodb-alter-nullable.test
@@ -71,6 +71,11 @@ WHERE NAME='test/t';
 
 DROP TABLE t;
 
+CREATE TABLE t1(c1 INT) ENGINE=InnoDB;
+ALTER TABLE t1 ADD CONSTRAINT UNIQUE KEY i1(c1);
+ALTER TABLE t1 CHANGE c1 c1 INT NOT NULL,ADD KEY(c1);
+DROP TABLE t1;
+
 # Check that all connections opened by test cases in this file are really
 # gone so execution of other tests won't be affected by their presence.
 --source include/wait_until_count_sessions.inc
diff --git a/mysql-test/suite/innodb/t/innodb_bug27216817.test b/mysql-test/suite/innodb/t/innodb_bug27216817.test
new file mode 100644
index 00000000000..a93932b4a04
--- /dev/null
+++ b/mysql-test/suite/innodb/t/innodb_bug27216817.test
@@ -0,0 +1,28 @@
+#
+# BUG#27216817: INNODB: FAILING ASSERTION:
+#               PREBUILT->TABLE->N_MYSQL_HANDLES_OPENED == 1
+#
+
+source include/have_innodb.inc;
+create table t1 (a int not null, b int not null) engine=innodb;
+insert t1 values (1,2),(3,4);
+
+lock table t1 write, t1 tr read;
+flush status;
+alter table t1 add primary key (b);
+show status like 'Handler_read_rnd_next';
+unlock tables;
+alter table t1 drop primary key;
+
+lock table t1 write;
+flush status;
+alter table t1 add primary key (b);
+show status like 'Handler_read_rnd_next';
+unlock tables;
+alter table t1 drop primary key;
+
+flush status;
+alter table t1 add primary key (b);
+show status like 'Handler_read_rnd_next';
+
+drop table t1;
diff --git a/mysql-test/suite/parts/inc/part_alter_values.inc b/mysql-test/suite/parts/inc/part_alter_values.inc
index 0d4929d9820..1b0605ff57b 100644
--- a/mysql-test/suite/parts/inc/part_alter_values.inc
+++ b/mysql-test/suite/parts/inc/part_alter_values.inc
@@ -35,3 +35,13 @@ ALTER TABLE t1 REORGANIZE PARTITION p1 INTO
   PARTITION p3 VALUES IN (4,5,6)
 );
 DROP TABLE t1;
+
+#
+# MDEV-15456 Server crashes upon adding or dropping a partition in ALTER under LOCK TABLE after ER_SAME_NAME_PARTITION
+#
+create table t1 (i int) partition by range(i) (partition p0 values less than (10));
+lock table t1 write;
+--error ER_SAME_NAME_PARTITION
+alter table t1 add partition (partition p0 values less than (20));
+alter table t1 add partition (partition p1 values less than (20)) /* comment */;
+drop table t1;
diff --git a/mysql-test/suite/parts/r/partition_alter_innodb.result b/mysql-test/suite/parts/r/partition_alter_innodb.result
index 99697086170..bb9e229fba5 100644
--- a/mysql-test/suite/parts/r/partition_alter_innodb.result
+++ b/mysql-test/suite/parts/r/partition_alter_innodb.result
@@ -42,3 +42,9 @@ PARTITION p3 VALUES IN (4,5,6)
 );
 ERROR HY000: Syntax error: LIST PARTITIONING requires definition of VALUES IN for each partition
 DROP TABLE t1;
+create table t1 (i int) partition by range(i) (partition p0 values less than (10));
+lock table t1 write;
+alter table t1 add partition (partition p0 values less than (20));
+ERROR HY000: Duplicate partition name p0
+alter table t1 add partition (partition p1 values less than (20)) /* comment */;
+drop table t1;
diff --git a/mysql-test/suite/parts/r/partition_alter_maria.result b/mysql-test/suite/parts/r/partition_alter_maria.result
index c7e9028a29c..0607bad2d9b 100644
--- a/mysql-test/suite/parts/r/partition_alter_maria.result
+++ b/mysql-test/suite/parts/r/partition_alter_maria.result
@@ -69,3 +69,9 @@ PARTITION p3 VALUES IN (4,5,6)
 );
 ERROR HY000: Syntax error: LIST PARTITIONING requires definition of VALUES IN for each partition
 DROP TABLE t1;
+create table t1 (i int) partition by range(i) (partition p0 values less than (10));
+lock table t1 write;
+alter table t1 add partition (partition p0 values less than (20));
+ERROR HY000: Duplicate partition name p0
+alter table t1 add partition (partition p1 values less than (20)) /* comment */;
+drop table t1;
diff --git a/mysql-test/suite/parts/r/partition_alter_myisam.result b/mysql-test/suite/parts/r/partition_alter_myisam.result
index 50b8b802ad4..36639397d56 100644
--- a/mysql-test/suite/parts/r/partition_alter_myisam.result
+++ b/mysql-test/suite/parts/r/partition_alter_myisam.result
@@ -42,6 +42,12 @@ PARTITION p3 VALUES IN (4,5,6)
 );
 ERROR HY000: Syntax error: LIST PARTITIONING requires definition of VALUES IN for each partition
 DROP TABLE t1;
+create table t1 (i int) partition by range(i) (partition p0 values less than (10));
+lock table t1 write;
+alter table t1 add partition (partition p0 values less than (20));
+ERROR HY000: Duplicate partition name p0
+alter table t1 add partition (partition p1 values less than (20)) /* comment */;
+drop table t1;
 create table t1 ( c1 int, c2 int, c3 varchar(100)) delay_key_write=1
 partition by key(c1) (
 partition p01 data directory = 'MYSQL_TMP_DIR'
diff --git a/mysql-test/suite/sys_vars/r/sysvars_innodb,32bit,xtradb.rdiff-disabled b/mysql-test/suite/sys_vars/r/sysvars_innodb,32bit,xtradb.rdiff-disabled
index f04fd5ed399..14ab4de4f94 100644
--- a/mysql-test/suite/sys_vars/r/sysvars_innodb,32bit,xtradb.rdiff-disabled
+++ b/mysql-test/suite/sys_vars/r/sysvars_innodb,32bit,xtradb.rdiff-disabled
@@ -298,7 +298,7 @@
  VARIABLE_NAME	INNODB_DATA_FILE_PATH
  SESSION_VALUE	NULL
  GLOBAL_VALUE	ibdata1:12M:autoextend
-@@ -767,7 +907,7 @@
+@@ -781,7 +921,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	120
  VARIABLE_SCOPE	GLOBAL
@@ -307,7 +307,7 @@
  VARIABLE_COMMENT	Number of pages reserved in doublewrite buffer for batch flushing
  NUMERIC_MIN_VALUE	1
  NUMERIC_MAX_VALUE	127
-@@ -775,6 +915,20 @@
+@@ -789,6 +929,20 @@
  ENUM_VALUE_LIST	NULL
  READ_ONLY	YES
  COMMAND_LINE_ARGUMENT	OPTIONAL
@@ -328,7 +328,7 @@
  VARIABLE_NAME	INNODB_ENCRYPTION_ROTATE_KEY_AGE
  SESSION_VALUE	NULL
  GLOBAL_VALUE	1
-@@ -845,13 +999,27 @@
+@@ -859,13 +1013,27 @@
  ENUM_VALUE_LIST	OFF,ON,FORCE
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	OPTIONAL
@@ -357,7 +357,7 @@
  VARIABLE_COMMENT	Speeds up the shutdown process of the InnoDB storage engine. Possible values are 0, 1 (faster) or 2 (fastest - crash-like).
  NUMERIC_MIN_VALUE	0
  NUMERIC_MAX_VALUE	2
-@@ -865,7 +1033,7 @@
+@@ -879,7 +1047,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	600
  VARIABLE_SCOPE	GLOBAL
@@ -366,7 +366,7 @@
  VARIABLE_COMMENT	Maximum number of seconds that semaphore times out in InnoDB.
  NUMERIC_MIN_VALUE	1
  NUMERIC_MAX_VALUE	4294967295
-@@ -935,7 +1103,7 @@
+@@ -949,7 +1117,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	0
  VARIABLE_SCOPE	GLOBAL
@@ -375,7 +375,7 @@
  VARIABLE_COMMENT	Make the first page of the given tablespace dirty.
  NUMERIC_MIN_VALUE	0
  NUMERIC_MAX_VALUE	4294967295
-@@ -949,7 +1117,7 @@
+@@ -963,7 +1131,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	30
  VARIABLE_SCOPE	GLOBAL
@@ -384,7 +384,7 @@
  VARIABLE_COMMENT	Number of iterations over which the background flushing is averaged.
  NUMERIC_MIN_VALUE	1
  NUMERIC_MAX_VALUE	1000
-@@ -972,12 +1140,12 @@
+@@ -986,12 +1154,12 @@
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	OPTIONAL
  VARIABLE_NAME	INNODB_FLUSH_LOG_AT_TRX_COMMIT
@@ -400,7 +400,7 @@
  VARIABLE_COMMENT	Controls the durability/speed trade-off for commits. Set to 0 (write and flush redo log to disk only once per second), 1 (flush to disk at each commit), 2 (write to log at commit but flush to disk only once per second) or 3 (flush to disk at prepare and at commit, slower and usually redundant). 1 and 3 guarantees that after a crash, committed transactions will not be lost and will be consistent with the binlog and other transactional engines. 2 can get inconsistent and lose transactions if there is a power failure or kernel crash but not if mysqld crashes. 0 has no guarantees in case of crash. 0 and 2 can be faster than 1 or 3.
  NUMERIC_MIN_VALUE	0
  NUMERIC_MAX_VALUE	3
-@@ -1005,7 +1173,7 @@
+@@ -1019,7 +1187,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	1
  VARIABLE_SCOPE	GLOBAL
@@ -409,7 +409,7 @@
  VARIABLE_COMMENT	Set to 0 (don't flush neighbors from buffer pool), 1 (flush contiguous neighbors from buffer pool) or 2 (flush neighbors from buffer pool), when flushing a block
  NUMERIC_MIN_VALUE	0
  NUMERIC_MAX_VALUE	2
-@@ -1047,7 +1215,7 @@
+@@ -1061,7 +1229,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	0
  VARIABLE_SCOPE	GLOBAL
@@ -418,7 +418,7 @@
  VARIABLE_COMMENT	Helps to save your data in case the disk image of the database becomes corrupt.
  NUMERIC_MIN_VALUE	0
  NUMERIC_MAX_VALUE	6
-@@ -1055,6 +1223,20 @@
+@@ -1069,6 +1237,20 @@
  ENUM_VALUE_LIST	NULL
  READ_ONLY	YES
  COMMAND_LINE_ARGUMENT	REQUIRED
@@ -439,7 +439,7 @@
  VARIABLE_NAME	INNODB_FT_AUX_TABLE
  SESSION_VALUE	NULL
  GLOBAL_VALUE	
-@@ -1075,7 +1257,7 @@
+@@ -1089,7 +1271,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	8000000
  VARIABLE_SCOPE	GLOBAL
@@ -448,7 +448,7 @@
  VARIABLE_COMMENT	InnoDB Fulltext search cache size in bytes
  NUMERIC_MIN_VALUE	1600000
  NUMERIC_MAX_VALUE	80000000
-@@ -1117,7 +1299,7 @@
+@@ -1131,7 +1313,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	84
  VARIABLE_SCOPE	GLOBAL
@@ -457,7 +457,7 @@
  VARIABLE_COMMENT	InnoDB Fulltext search maximum token size in characters
  NUMERIC_MIN_VALUE	10
  NUMERIC_MAX_VALUE	84
-@@ -1131,7 +1313,7 @@
+@@ -1145,7 +1327,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	3
  VARIABLE_SCOPE	GLOBAL
@@ -466,7 +466,7 @@
  VARIABLE_COMMENT	InnoDB Fulltext search minimum token size in characters
  NUMERIC_MIN_VALUE	0
  NUMERIC_MAX_VALUE	16
-@@ -1145,7 +1327,7 @@
+@@ -1159,7 +1341,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	2000
  VARIABLE_SCOPE	GLOBAL
@@ -475,7 +475,7 @@
  VARIABLE_COMMENT	InnoDB Fulltext search number of words to optimize for each optimize table call 
  NUMERIC_MIN_VALUE	1000
  NUMERIC_MAX_VALUE	10000
-@@ -1159,7 +1341,7 @@
+@@ -1173,7 +1355,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	2000000000
  VARIABLE_SCOPE	GLOBAL
@@ -484,7 +484,7 @@
  VARIABLE_COMMENT	InnoDB Fulltext search query result cache limit in bytes
  NUMERIC_MIN_VALUE	1000000
  NUMERIC_MAX_VALUE	4294967295
-@@ -1187,7 +1369,7 @@
+@@ -1201,7 +1383,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	2
  VARIABLE_SCOPE	GLOBAL
@@ -493,7 +493,7 @@
  VARIABLE_COMMENT	InnoDB Fulltext search parallel sort degree, will round up to nearest power of 2 number
  NUMERIC_MIN_VALUE	1
  NUMERIC_MAX_VALUE	16
-@@ -1201,7 +1383,7 @@
+@@ -1215,7 +1397,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	640000000
  VARIABLE_SCOPE	GLOBAL
@@ -502,7 +502,7 @@
  VARIABLE_COMMENT	Total memory allocated for InnoDB Fulltext Search cache
  NUMERIC_MIN_VALUE	32000000
  NUMERIC_MAX_VALUE	1600000000
-@@ -1229,7 +1411,7 @@
+@@ -1243,7 +1425,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	100
  VARIABLE_SCOPE	GLOBAL
@@ -511,7 +511,7 @@
  VARIABLE_COMMENT	Up to what percentage of dirty pages should be flushed when innodb finds it has spare resources to do so.
  NUMERIC_MIN_VALUE	0
  NUMERIC_MAX_VALUE	100
-@@ -1271,10 +1453,10 @@
+@@ -1285,10 +1467,10 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	200
  VARIABLE_SCOPE	GLOBAL
@@ -524,7 +524,7 @@
  NUMERIC_BLOCK_SIZE	0
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
-@@ -1283,12 +1465,26 @@
+@@ -1297,12 +1479,26 @@
  SESSION_VALUE	NULL
  GLOBAL_VALUE	2000
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
@@ -554,7 +554,7 @@
  NUMERIC_BLOCK_SIZE	0
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
-@@ -1321,6 +1517,20 @@
+@@ -1335,6 +1531,20 @@
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	REQUIRED
@@ -575,7 +575,7 @@
  VARIABLE_NAME	INNODB_LOCKS_UNSAFE_FOR_BINLOG
  SESSION_VALUE	NULL
  GLOBAL_VALUE	OFF
-@@ -1355,7 +1565,7 @@
+@@ -1369,7 +1579,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	50
  VARIABLE_SCOPE	SESSION
@@ -584,44 +584,26 @@
  VARIABLE_COMMENT	Timeout in seconds an InnoDB transaction may wait for a lock before being rolled back. Values above 100000000 disable the timeout.
  NUMERIC_MIN_VALUE	1
  NUMERIC_MAX_VALUE	1073741824
-@@ -1363,37 +1573,107 @@
+@@ -1377,16 +1587,72 @@
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	REQUIRED
--VARIABLE_NAME	INNODB_LOG_BUFFER_SIZE
--SESSION_VALUE	NULL
--GLOBAL_VALUE	1048576
--GLOBAL_VALUE_ORIGIN	CONFIG
--DEFAULT_VALUE	16777216
--VARIABLE_SCOPE	GLOBAL
--VARIABLE_TYPE	BIGINT
--VARIABLE_COMMENT	The size of the buffer which InnoDB uses to write log to the log files on disk.
--NUMERIC_MIN_VALUE	262144
--NUMERIC_MAX_VALUE	9223372036854775807
--NUMERIC_BLOCK_SIZE	1024
--ENUM_VALUE_LIST	NULL
--READ_ONLY	YES
--COMMAND_LINE_ARGUMENT	REQUIRED
--VARIABLE_NAME	INNODB_LOG_CHECKPOINT_NOW
 +VARIABLE_NAME	INNODB_LOG_ARCHIVE
- SESSION_VALUE	NULL
- GLOBAL_VALUE	OFF
- GLOBAL_VALUE_ORIGIN	COMPILE-TIME
- DEFAULT_VALUE	OFF
- VARIABLE_SCOPE	GLOBAL
- VARIABLE_TYPE	BOOLEAN
--VARIABLE_COMMENT	Force checkpoint now
++SESSION_VALUE	NULL
++GLOBAL_VALUE	OFF
++GLOBAL_VALUE_ORIGIN	COMPILE-TIME
++DEFAULT_VALUE	OFF
++VARIABLE_SCOPE	GLOBAL
++VARIABLE_TYPE	BOOLEAN
 +VARIABLE_COMMENT	Set to 1 if you want to have logs archived.
- NUMERIC_MIN_VALUE	NULL
- NUMERIC_MAX_VALUE	NULL
- NUMERIC_BLOCK_SIZE	NULL
- ENUM_VALUE_LIST	OFF,ON
- READ_ONLY	NO
- COMMAND_LINE_ARGUMENT	OPTIONAL
--VARIABLE_NAME	INNODB_LOG_COMPRESSED_PAGES
++NUMERIC_MIN_VALUE	NULL
++NUMERIC_MAX_VALUE	NULL
++NUMERIC_BLOCK_SIZE	NULL
++ENUM_VALUE_LIST	OFF,ON
++READ_ONLY	NO
++COMMAND_LINE_ARGUMENT	OPTIONAL
 +VARIABLE_NAME	INNODB_LOG_ARCH_DIR
- SESSION_VALUE	NULL
--GLOBAL_VALUE	ON
++SESSION_VALUE	NULL
 +GLOBAL_VALUE	PATH
 +GLOBAL_VALUE_ORIGIN	COMPILE-TIME
 +DEFAULT_VALUE	
@@ -662,34 +644,25 @@
 +ENUM_VALUE_LIST	NULL
 +READ_ONLY	YES
 +COMMAND_LINE_ARGUMENT	REQUIRED
-+VARIABLE_NAME	INNODB_LOG_BUFFER_SIZE
-+SESSION_VALUE	NULL
-+GLOBAL_VALUE	1048576
-+GLOBAL_VALUE_ORIGIN	CONFIG
-+DEFAULT_VALUE	16777216
-+VARIABLE_SCOPE	GLOBAL
+ VARIABLE_NAME	INNODB_LOG_BUFFER_SIZE
+ SESSION_VALUE	NULL
+ GLOBAL_VALUE	1048576
+ GLOBAL_VALUE_ORIGIN	CONFIG
+ DEFAULT_VALUE	16777216
+ VARIABLE_SCOPE	GLOBAL
+-VARIABLE_TYPE	BIGINT
 +VARIABLE_TYPE	INT
-+VARIABLE_COMMENT	The size of the buffer which InnoDB uses to write log to the log files on disk.
-+NUMERIC_MIN_VALUE	262144
+ VARIABLE_COMMENT	The size of the buffer which InnoDB uses to write log to the log files on disk.
+ NUMERIC_MIN_VALUE	262144
+-NUMERIC_MAX_VALUE	9223372036854775807
 +NUMERIC_MAX_VALUE	2147483647
-+NUMERIC_BLOCK_SIZE	1024
-+ENUM_VALUE_LIST	NULL
-+READ_ONLY	YES
-+COMMAND_LINE_ARGUMENT	REQUIRED
-+VARIABLE_NAME	INNODB_LOG_CHECKPOINT_NOW
-+SESSION_VALUE	NULL
-+GLOBAL_VALUE	OFF
-+GLOBAL_VALUE_ORIGIN	COMPILE-TIME
-+DEFAULT_VALUE	OFF
-+VARIABLE_SCOPE	GLOBAL
-+VARIABLE_TYPE	BOOLEAN
-+VARIABLE_COMMENT	Force checkpoint now
-+NUMERIC_MIN_VALUE	NULL
-+NUMERIC_MAX_VALUE	NULL
-+NUMERIC_BLOCK_SIZE	NULL
-+ENUM_VALUE_LIST	OFF,ON
-+READ_ONLY	NO
-+COMMAND_LINE_ARGUMENT	OPTIONAL
+ NUMERIC_BLOCK_SIZE	1024
+ ENUM_VALUE_LIST	NULL
+ READ_ONLY	YES
+@@ -1405,6 +1671,20 @@
+ ENUM_VALUE_LIST	OFF,ON
+ READ_ONLY	NO
+ COMMAND_LINE_ARGUMENT	OPTIONAL
 +VARIABLE_NAME	INNODB_LOG_CHECKSUM_ALGORITHM
 +SESSION_VALUE	NULL
 +GLOBAL_VALUE	INNODB
@@ -704,13 +677,10 @@
 +ENUM_VALUE_LIST	CRC32,STRICT_CRC32,INNODB,STRICT_INNODB,NONE,STRICT_NONE
 +READ_ONLY	NO
 +COMMAND_LINE_ARGUMENT	REQUIRED
-+VARIABLE_NAME	INNODB_LOG_COMPRESSED_PAGES
-+SESSION_VALUE	NULL
-+GLOBAL_VALUE	ON
- GLOBAL_VALUE_ORIGIN	COMPILE-TIME
- DEFAULT_VALUE	ON
- VARIABLE_SCOPE	GLOBAL
-@@ -1411,7 +1691,7 @@
+ VARIABLE_NAME	INNODB_LOG_COMPRESSED_PAGES
+ SESSION_VALUE	NULL
+ GLOBAL_VALUE	ON
+@@ -1425,7 +1705,7 @@
  GLOBAL_VALUE_ORIGIN	CONFIG
  DEFAULT_VALUE	2
  VARIABLE_SCOPE	GLOBAL
@@ -719,7 +689,7 @@
  VARIABLE_COMMENT	Number of log files in the log group. InnoDB writes to the files in a circular fashion.
  NUMERIC_MIN_VALUE	2
  NUMERIC_MAX_VALUE	100
-@@ -1453,9 +1733,37 @@
+@@ -1467,9 +1747,37 @@
  GLOBAL_VALUE_ORIGIN	CONFIG
  DEFAULT_VALUE	1024
  VARIABLE_SCOPE	GLOBAL
@@ -758,7 +728,7 @@
  NUMERIC_MAX_VALUE	18446744073709551615
  NUMERIC_BLOCK_SIZE	0
  ENUM_VALUE_LIST	NULL
-@@ -1495,10 +1803,10 @@
+@@ -1509,10 +1817,10 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	0
  VARIABLE_SCOPE	GLOBAL
@@ -771,7 +741,7 @@
  NUMERIC_BLOCK_SIZE	0
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
-@@ -1509,7 +1817,7 @@
+@@ -1523,7 +1831,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	0
  VARIABLE_SCOPE	GLOBAL
@@ -780,7 +750,7 @@
  VARIABLE_COMMENT	Maximum delay of user threads in micro-seconds
  NUMERIC_MIN_VALUE	0
  NUMERIC_MAX_VALUE	10000000
-@@ -1523,7 +1831,7 @@
+@@ -1537,7 +1845,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	0
  VARIABLE_SCOPE	GLOBAL
@@ -789,7 +759,7 @@
  VARIABLE_COMMENT	Number of identical copies of log groups we keep for the database. Currently this should be set to 1.
  NUMERIC_MIN_VALUE	0
  NUMERIC_MAX_VALUE	10
-@@ -1593,7 +1901,7 @@
+@@ -1607,7 +1915,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	8
  VARIABLE_SCOPE	GLOBAL
@@ -798,7 +768,12 @@
  VARIABLE_COMMENT	Number of multi-threaded flush threads
  NUMERIC_MIN_VALUE	1
  NUMERIC_MAX_VALUE	64
-@@ -1649,10 +1957,10 @@
+@@ -1659,14 +1967,14 @@
+ COMMAND_LINE_ARGUMENT	REQUIRED
+ VARIABLE_NAME	INNODB_OPEN_FILES
+ SESSION_VALUE	NULL
+-GLOBAL_VALUE	2000
++GLOBAL_VALUE	300
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	0
  VARIABLE_SCOPE	GLOBAL
@@ -811,7 +786,7 @@
  NUMERIC_BLOCK_SIZE	0
  ENUM_VALUE_LIST	NULL
  READ_ONLY	YES
-@@ -1677,7 +1985,7 @@
+@@ -1691,7 +1999,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	16
  VARIABLE_SCOPE	GLOBAL
@@ -820,7 +795,7 @@
  VARIABLE_COMMENT	Number of rw_locks protecting buffer pool page_hash. Rounded up to the next power of 2
  NUMERIC_MIN_VALUE	1
  NUMERIC_MAX_VALUE	1024
-@@ -1691,7 +1999,7 @@
+@@ -1705,7 +2013,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	16384
  VARIABLE_SCOPE	GLOBAL
@@ -829,7 +804,7 @@
  VARIABLE_COMMENT	Page size to use for all InnoDB tablespaces.
  NUMERIC_MIN_VALUE	4096
  NUMERIC_MAX_VALUE	65536
-@@ -1727,13 +2035,83 @@
+@@ -1741,13 +2049,83 @@
  ENUM_VALUE_LIST	OFF,ON
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	OPTIONAL
@@ -914,7 +889,7 @@
  VARIABLE_COMMENT	Number of UNDO log pages to purge in one batch from the history list.
  NUMERIC_MIN_VALUE	1
  NUMERIC_MAX_VALUE	5000
-@@ -1775,7 +2139,7 @@
+@@ -1789,7 +2167,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	1
  VARIABLE_SCOPE	GLOBAL
@@ -923,7 +898,7 @@
  VARIABLE_COMMENT	Purge threads can be from 1 to 32. Default is 1.
  NUMERIC_MIN_VALUE	1
  NUMERIC_MAX_VALUE	32
-@@ -1803,7 +2167,7 @@
+@@ -1817,7 +2195,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	56
  VARIABLE_SCOPE	GLOBAL
@@ -932,7 +907,7 @@
  VARIABLE_COMMENT	Number of pages that must be accessed sequentially for InnoDB to trigger a readahead.
  NUMERIC_MIN_VALUE	0
  NUMERIC_MAX_VALUE	64
-@@ -1817,7 +2181,7 @@
+@@ -1831,7 +2209,7 @@
  GLOBAL_VALUE_ORIGIN	CONFIG
  DEFAULT_VALUE	4
  VARIABLE_SCOPE	GLOBAL
@@ -941,7 +916,7 @@
  VARIABLE_COMMENT	Number of background read I/O threads in InnoDB.
  NUMERIC_MIN_VALUE	1
  NUMERIC_MAX_VALUE	64
-@@ -1845,10 +2209,10 @@
+@@ -1859,10 +2237,10 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	0
  VARIABLE_SCOPE	GLOBAL
@@ -954,7 +929,7 @@
  NUMERIC_BLOCK_SIZE	0
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
-@@ -1873,7 +2237,7 @@
+@@ -1887,7 +2265,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	128
  VARIABLE_SCOPE	GLOBAL
@@ -963,7 +938,7 @@
  VARIABLE_COMMENT	Number of undo logs to use (deprecated).
  NUMERIC_MIN_VALUE	1
  NUMERIC_MAX_VALUE	128
-@@ -1887,7 +2251,7 @@
+@@ -1901,7 +2279,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	0
  VARIABLE_SCOPE	GLOBAL
@@ -972,7 +947,7 @@
  VARIABLE_COMMENT	An InnoDB page number.
  NUMERIC_MIN_VALUE	0
  NUMERIC_MAX_VALUE	4294967295
-@@ -1895,6 +2259,48 @@
+@@ -1909,6 +2287,48 @@
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	OPTIONAL
@@ -1021,7 +996,7 @@
  VARIABLE_NAME	INNODB_SCRUB_LOG
  SESSION_VALUE	NULL
  GLOBAL_VALUE	OFF
-@@ -1923,6 +2329,34 @@
+@@ -1937,6 +2357,34 @@
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	OPTIONAL
@@ -1056,7 +1031,7 @@
  VARIABLE_NAME	INNODB_SIMULATE_COMP_FAILURES
  SESSION_VALUE	NULL
  GLOBAL_VALUE	0
-@@ -1943,7 +2377,7 @@
+@@ -1957,7 +2405,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	1048576
  VARIABLE_SCOPE	GLOBAL
@@ -1065,7 +1040,7 @@
  VARIABLE_COMMENT	Memory buffer size for index creation
  NUMERIC_MIN_VALUE	65536
  NUMERIC_MAX_VALUE	67108864
-@@ -1957,10 +2391,10 @@
+@@ -1971,10 +2419,10 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	6
  VARIABLE_SCOPE	GLOBAL
@@ -1078,7 +1053,7 @@
  NUMERIC_BLOCK_SIZE	0
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
-@@ -2000,7 +2434,7 @@
+@@ -2014,7 +2462,7 @@
  DEFAULT_VALUE	nulls_equal
  VARIABLE_SCOPE	GLOBAL
  VARIABLE_TYPE	ENUM
@@ -1087,7 +1062,7 @@
  NUMERIC_MIN_VALUE	NULL
  NUMERIC_MAX_VALUE	NULL
  NUMERIC_BLOCK_SIZE	NULL
-@@ -2167,7 +2601,7 @@
+@@ -2181,7 +2629,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	1
  VARIABLE_SCOPE	GLOBAL
@@ -1096,7 +1071,7 @@
  VARIABLE_COMMENT	Size of the mutex/lock wait array.
  NUMERIC_MIN_VALUE	1
  NUMERIC_MAX_VALUE	1024
-@@ -2181,10 +2615,10 @@
+@@ -2195,10 +2643,10 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	30
  VARIABLE_SCOPE	GLOBAL
@@ -1109,7 +1084,7 @@
  NUMERIC_BLOCK_SIZE	0
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
-@@ -2209,7 +2643,7 @@
+@@ -2223,7 +2671,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	0
  VARIABLE_SCOPE	GLOBAL
@@ -1118,7 +1093,7 @@
  VARIABLE_COMMENT	Helps in performance tuning in heavily concurrent environments. Sets the maximum number of threads allowed inside InnoDB. Value 0 will disable the thread throttling.
  NUMERIC_MIN_VALUE	0
  NUMERIC_MAX_VALUE	1000
-@@ -2223,7 +2657,7 @@
+@@ -2237,7 +2685,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	10000
  VARIABLE_SCOPE	GLOBAL
@@ -1127,7 +1102,7 @@
  VARIABLE_COMMENT	Time of innodb thread sleeping before joining InnoDB queue (usec). Value 0 disable a sleep
  NUMERIC_MIN_VALUE	0
  NUMERIC_MAX_VALUE	1000000
-@@ -2245,6 +2679,34 @@
+@@ -2259,6 +2707,34 @@
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	OPTIONAL
@@ -1162,7 +1137,7 @@
  VARIABLE_NAME	INNODB_TRX_PURGE_VIEW_UPDATE_ONLY_DEBUG
  SESSION_VALUE	NULL
  GLOBAL_VALUE	OFF
-@@ -2293,7 +2755,7 @@
+@@ -2307,7 +2783,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	128
  VARIABLE_SCOPE	GLOBAL
@@ -1171,7 +1146,7 @@
  VARIABLE_COMMENT	Number of undo logs to use.
  NUMERIC_MIN_VALUE	1
  NUMERIC_MAX_VALUE	128
-@@ -2307,7 +2769,7 @@
+@@ -2321,7 +2797,7 @@
  GLOBAL_VALUE_ORIGIN	COMPILE-TIME
  DEFAULT_VALUE	0
  VARIABLE_SCOPE	GLOBAL
@@ -1180,7 +1155,7 @@
  VARIABLE_COMMENT	Number of undo tablespaces to use. 
  NUMERIC_MIN_VALUE	0
  NUMERIC_MAX_VALUE	126
-@@ -2322,7 +2784,7 @@
+@@ -2336,7 +2812,7 @@
  DEFAULT_VALUE	OFF
  VARIABLE_SCOPE	GLOBAL
  VARIABLE_TYPE	BOOLEAN
@@ -1189,7 +1164,7 @@
  NUMERIC_MIN_VALUE	NULL
  NUMERIC_MAX_VALUE	NULL
  NUMERIC_BLOCK_SIZE	NULL
-@@ -2343,6 +2805,20 @@
+@@ -2357,6 +2833,20 @@
  ENUM_VALUE_LIST	OFF,ON
  READ_ONLY	YES
  COMMAND_LINE_ARGUMENT	NONE
@@ -1210,7 +1185,7 @@
  VARIABLE_NAME	INNODB_USE_MTFLUSH
  SESSION_VALUE	NULL
  GLOBAL_VALUE	OFF
-@@ -2357,6 +2833,20 @@
+@@ -2371,6 +2861,20 @@
  ENUM_VALUE_LIST	OFF,ON
  READ_ONLY	YES
  COMMAND_LINE_ARGUMENT	NONE
@@ -1231,7 +1206,7 @@
  VARIABLE_NAME	INNODB_USE_SYS_MALLOC
  SESSION_VALUE	NULL
  GLOBAL_VALUE	ON
-@@ -2387,12 +2877,12 @@
+@@ -2401,12 +2905,12 @@
  COMMAND_LINE_ARGUMENT	OPTIONAL
  VARIABLE_NAME	INNODB_VERSION
  SESSION_VALUE	NULL
@@ -1246,7 +1221,7 @@
  NUMERIC_MIN_VALUE	NULL
  NUMERIC_MAX_VALUE	NULL
  NUMERIC_BLOCK_SIZE	NULL
-@@ -2405,7 +2895,7 @@
+@@ -2419,7 +2923,7 @@
  GLOBAL_VALUE_ORIGIN	CONFIG
  DEFAULT_VALUE	4
  VARIABLE_SCOPE	GLOBAL
diff --git a/mysql-test/suite/sys_vars/r/sysvars_innodb,xtradb.rdiff-disabled b/mysql-test/suite/sys_vars/r/sysvars_innodb,xtradb.rdiff-disabled
index 313be8f99f6..55d53713b8a 100644
--- a/mysql-test/suite/sys_vars/r/sysvars_innodb,xtradb.rdiff-disabled
+++ b/mysql-test/suite/sys_vars/r/sysvars_innodb,xtradb.rdiff-disabled
@@ -177,7 +177,7 @@
  VARIABLE_NAME	INNODB_DATA_FILE_PATH
  SESSION_VALUE	NULL
  GLOBAL_VALUE	ibdata1:12M:autoextend
-@@ -775,6 +915,20 @@
+@@ -789,6 +929,20 @@
  ENUM_VALUE_LIST	NULL
  READ_ONLY	YES
  COMMAND_LINE_ARGUMENT	OPTIONAL
@@ -198,7 +198,7 @@
  VARIABLE_NAME	INNODB_ENCRYPTION_ROTATE_KEY_AGE
  SESSION_VALUE	NULL
  GLOBAL_VALUE	1
-@@ -845,6 +999,20 @@
+@@ -859,6 +1013,20 @@
  ENUM_VALUE_LIST	OFF,ON,FORCE
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	OPTIONAL
@@ -219,7 +219,7 @@
  VARIABLE_NAME	INNODB_FAST_SHUTDOWN
  SESSION_VALUE	NULL
  GLOBAL_VALUE	1
-@@ -972,11 +1140,11 @@
+@@ -986,11 +1154,11 @@
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	OPTIONAL
  VARIABLE_NAME	INNODB_FLUSH_LOG_AT_TRX_COMMIT
@@ -233,7 +233,7 @@
  VARIABLE_TYPE	BIGINT UNSIGNED
  VARIABLE_COMMENT	Controls the durability/speed trade-off for commits. Set to 0 (write and flush redo log to disk only once per second), 1 (flush to disk at each commit), 2 (write to log at commit but flush to disk only once per second) or 3 (flush to disk at prepare and at commit, slower and usually redundant). 1 and 3 guarantees that after a crash, committed transactions will not be lost and will be consistent with the binlog and other transactional engines. 2 can get inconsistent and lose transactions if there is a power failure or kernel crash but not if mysqld crashes. 0 has no guarantees in case of crash. 0 and 2 can be faster than 1 or 3.
  NUMERIC_MIN_VALUE	0
-@@ -1055,6 +1223,20 @@
+@@ -1069,6 +1237,20 @@
  ENUM_VALUE_LIST	NULL
  READ_ONLY	YES
  COMMAND_LINE_ARGUMENT	REQUIRED
@@ -254,7 +254,7 @@
  VARIABLE_NAME	INNODB_FT_AUX_TABLE
  SESSION_VALUE	NULL
  GLOBAL_VALUE	
-@@ -1293,6 +1475,20 @@
+@@ -1307,6 +1489,20 @@
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	REQUIRED
@@ -275,7 +275,7 @@
  VARIABLE_NAME	INNODB_LARGE_PREFIX
  SESSION_VALUE	NULL
  GLOBAL_VALUE	OFF
-@@ -1321,6 +1517,20 @@
+@@ -1335,6 +1531,20 @@
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	REQUIRED
@@ -296,7 +296,7 @@
  VARIABLE_NAME	INNODB_LOCKS_UNSAFE_FOR_BINLOG
  SESSION_VALUE	NULL
  GLOBAL_VALUE	OFF
-@@ -1363,6 +1573,62 @@
+@@ -1377,6 +1587,62 @@
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	REQUIRED
@@ -359,7 +359,7 @@
  VARIABLE_NAME	INNODB_LOG_BUFFER_SIZE
  SESSION_VALUE	NULL
  GLOBAL_VALUE	1048576
-@@ -1391,6 +1657,20 @@
+@@ -1405,6 +1671,20 @@
  ENUM_VALUE_LIST	OFF,ON
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	OPTIONAL
@@ -380,7 +380,7 @@
  VARIABLE_NAME	INNODB_LOG_COMPRESSED_PAGES
  SESSION_VALUE	NULL
  GLOBAL_VALUE	ON
-@@ -1461,6 +1741,34 @@
+@@ -1475,6 +1755,34 @@
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	REQUIRED
@@ -415,7 +415,16 @@
  VARIABLE_NAME	INNODB_MAX_DIRTY_PAGES_PCT
  SESSION_VALUE	NULL
  GLOBAL_VALUE	75.000000
-@@ -1727,6 +2035,76 @@
+@@ -1659,7 +1967,7 @@
+ COMMAND_LINE_ARGUMENT	REQUIRED
+ VARIABLE_NAME	INNODB_OPEN_FILES
+ SESSION_VALUE	NULL
+-GLOBAL_VALUE	2000
++GLOBAL_VALUE	300
+ GLOBAL_VALUE_ORIGIN	COMPILE-TIME
+ DEFAULT_VALUE	0
+ VARIABLE_SCOPE	GLOBAL
+@@ -1741,6 +2049,76 @@
  ENUM_VALUE_LIST	OFF,ON
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	OPTIONAL
@@ -492,7 +501,7 @@
  VARIABLE_NAME	INNODB_PURGE_BATCH_SIZE
  SESSION_VALUE	NULL
  GLOBAL_VALUE	300
-@@ -1895,6 +2273,48 @@
+@@ -1909,6 +2287,48 @@
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	OPTIONAL
@@ -541,7 +550,7 @@
  VARIABLE_NAME	INNODB_SCRUB_LOG
  SESSION_VALUE	NULL
  GLOBAL_VALUE	OFF
-@@ -1923,6 +2343,34 @@
+@@ -1937,6 +2357,34 @@
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	OPTIONAL
@@ -576,7 +585,7 @@
  VARIABLE_NAME	INNODB_SIMULATE_COMP_FAILURES
  SESSION_VALUE	NULL
  GLOBAL_VALUE	0
-@@ -2000,7 +2448,7 @@
+@@ -2014,7 +2462,7 @@
  DEFAULT_VALUE	nulls_equal
  VARIABLE_SCOPE	GLOBAL
  VARIABLE_TYPE	ENUM
@@ -585,7 +594,7 @@
  NUMERIC_MIN_VALUE	NULL
  NUMERIC_MAX_VALUE	NULL
  NUMERIC_BLOCK_SIZE	NULL
-@@ -2245,6 +2693,34 @@
+@@ -2259,6 +2707,34 @@
  ENUM_VALUE_LIST	NULL
  READ_ONLY	NO
  COMMAND_LINE_ARGUMENT	OPTIONAL
@@ -620,7 +629,7 @@
  VARIABLE_NAME	INNODB_TRX_PURGE_VIEW_UPDATE_ONLY_DEBUG
  SESSION_VALUE	NULL
  GLOBAL_VALUE	OFF
-@@ -2322,7 +2798,7 @@
+@@ -2336,7 +2812,7 @@
  DEFAULT_VALUE	OFF
  VARIABLE_SCOPE	GLOBAL
  VARIABLE_TYPE	BOOLEAN
@@ -629,7 +638,7 @@
  NUMERIC_MIN_VALUE	NULL
  NUMERIC_MAX_VALUE	NULL
  NUMERIC_BLOCK_SIZE	NULL
-@@ -2343,6 +2819,20 @@
+@@ -2357,6 +2833,20 @@
  ENUM_VALUE_LIST	OFF,ON
  READ_ONLY	YES
  COMMAND_LINE_ARGUMENT	NONE
@@ -650,7 +659,7 @@
  VARIABLE_NAME	INNODB_USE_MTFLUSH
  SESSION_VALUE	NULL
  GLOBAL_VALUE	OFF
-@@ -2357,6 +2847,20 @@
+@@ -2371,6 +2861,20 @@
  ENUM_VALUE_LIST	OFF,ON
  READ_ONLY	YES
  COMMAND_LINE_ARGUMENT	NONE
@@ -671,7 +680,7 @@
  VARIABLE_NAME	INNODB_USE_SYS_MALLOC
  SESSION_VALUE	NULL
  GLOBAL_VALUE	ON
-@@ -2387,12 +2891,12 @@
+@@ -2401,12 +2905,12 @@
  COMMAND_LINE_ARGUMENT	OPTIONAL
  VARIABLE_NAME	INNODB_VERSION
  SESSION_VALUE	NULL
diff --git a/mysql-test/t/ctype_ucs.test b/mysql-test/t/ctype_ucs.test
index d7a4fd48ccd..17a07cd4bf9 100644
--- a/mysql-test/t/ctype_ucs.test
+++ b/mysql-test/t/ctype_ucs.test
@@ -852,6 +852,28 @@ set sql_mode=default;
 
 
 --echo #
+--echo # MDEV-15624 Changing the default character set to utf8mb4 changes query evaluation in a very surprising way
+--echo #
+
+SET NAMES utf8;
+CREATE TABLE t1 (id INT);
+INSERT INTO t1 VALUES (1),(2),(3);
+
+SELECT COUNT(DISTINCT c) FROM (SELECT id, REPLACE(uuid_short(), '0', CAST('o' AS CHAR CHARACTER SET ucs2)) AS c FROM t1) AS d1;
+--replace_column 1 xxxxxxxxxxxxxxxxx
+SELECT DISTINCT REPLACE(uuid_short(), '0', CAST('o' AS CHAR CHARACTER SET ucs2)) AS c FROM t1;
+
+SELECT COUNT(DISTINCT c) FROM (SELECT id, INSERT(uuid_short(), 1, 1, CAST('0' AS CHAR CHARACTER SET ucs2)) AS c FROM t1) AS d1;
+--replace_column 1 xxxxxxxxxxxxxxxxx
+SELECT DISTINCT INSERT(uuid_short(), 1, 1, CAST('0' AS CHAR CHARACTER SET ucs2)) AS c FROM t1;
+
+SELECT COUNT(DISTINCT c) FROM (SELECT id, CONCAT(uuid_short(), CAST('0' AS CHAR CHARACTER SET ucs2)) AS c FROM t1) AS d1;
+--replace_column 1 xxxxxxxxxxxxxxxxx
+SELECT DISTINCT CONCAT(uuid_short(), CAST('0' AS CHAR CHARACTER SET ucs2)) AS c FROM t1;
+DROP TABLE t1;
+
+
+--echo #
 --echo # End of 5.5 tests
 --echo #
 
diff --git a/mysql-test/t/ctype_utf8mb4.test b/mysql-test/t/ctype_utf8mb4.test
index 7aa644fe8a9..545347fcd26 100644
--- a/mysql-test/t/ctype_utf8mb4.test
+++ b/mysql-test/t/ctype_utf8mb4.test
@@ -1851,6 +1851,25 @@ SELECT LENGTH(data) AS len FROM (SELECT REPEAT('☃', 65535) AS data ) AS sub;
 SELECT LENGTH(data) AS len FROM (SELECT REPEAT('☃', 65536) AS data ) AS sub;
 
 --echo #
+--echo # MDEV-15624 Changing the default character set to utf8mb4 changes query evaluation in a very surprising way
+--echo #
+
+SET NAMES utf8mb4;
+CREATE TABLE t1 (id INT);
+INSERT INTO t1 VALUES (1),(2),(3);
+
+SELECT COUNT(DISTINCT c) FROM (SELECT id, REPLACE(UUID(), "-", "") AS c FROM t1) AS d1;
+--replace_column 1 xxxxxxxxxxxxx-xxxx-xxxx-xxxxxxxxxxxx
+SELECT DISTINCT INSERT(uuid(), 9, 1, "X") AS c FROM t1;
+
+SELECT COUNT(DISTINCT c) FROM (SELECT id, INSERT(UUID(), 9, 1, "X") AS c FROM t1) AS d1;
+--replace_column 1 xxxxxxxxxxxxx-xxxx-xxxx-xxxxxxxxxxxx
+SELECT DISTINCT INSERT(UUID(), 9, 1, "X") AS c FROM t1;
+
+DROP TABLE t1;
+
+
+--echo #
 --echo # End of 5.5 tests
 --echo #
 
diff --git a/mysql-test/t/read_only_innodb.test b/mysql-test/t/read_only_innodb.test
index 9ba3ccaca07..a9310a1a78e 100644
--- a/mysql-test/t/read_only_innodb.test
+++ b/mysql-test/t/read_only_innodb.test
@@ -241,6 +241,15 @@ SELECT * FROM temp1, temp2;
 DROP TABLE temp1, temp2;
 
 --echo
+--echo # MDEV-14185 CREATE TEMPORARY TABLE AS SELECT causes error 1290 with read_only and InnoDB.
+--echo
+
+CREATE TEMPORARY TABLE temp1 ENGINE=INNODB AS SELECT a FROM t1;
+SELECT * FROM temp1;
+DROP TABLE temp1;
+
+
+--echo
 --echo # Disconnect and cleanup
 --echo
 disconnect con1;
diff --git a/mysql-test/t/sp-destruct.test b/mysql-test/t/sp-destruct.test
index 31da235d906..25eb0182168 100644
--- a/mysql-test/t/sp-destruct.test
+++ b/mysql-test/t/sp-destruct.test
@@ -285,3 +285,13 @@ create database mysqltest1;
 create procedure mysqltest1.foo() select "foo";
 update mysql.proc set name='' where db='mysqltest1';
 drop database mysqltest1;
+
+#
+# BUG#26881798: SERVER EXITS WHEN PRIMARY KEY IN MYSQL.PROC IS DROPPED
+#
+create procedure p1() set @foo = 10;
+alter table mysql.proc drop primary key;
+--error ER_CANNOT_LOAD_FROM_TABLE_V2
+drop procedure p1;
+alter table mysql.proc add primary key (db,name,type);
+drop procedure p1;
diff --git a/mysql-test/t/subselect4.test b/mysql-test/t/subselect4.test
index 77ea117b15f..d5a40419185 100644
--- a/mysql-test/t/subselect4.test
+++ b/mysql-test/t/subselect4.test
@@ -2044,6 +2044,29 @@ SET optimizer_switch= @@global.optimizer_switch;
 set @@tmp_table_size= @@global.tmp_table_size;
 
 --echo #
+--echo # MDEV-14515: Wrong results for tableless query with subquery in WHERE
+--echo #             and implicit aggregation
+--echo #
+
+create table t1 (i1 int, i2 int);
+insert into t1 values (1314, 1084),(1330, 1084),(1401, 1084),(580, 1084);
+
+create table t2 (cd int);
+insert into t2 values
+  (1330), (1330), (1330), (1330), (1330), (1330), (1330), (1330),
+  (1330), (1330), (1330), (1330), (1330), (1330), (1330), (1330);
+
+select max(10) from dual
+  where exists (select 1 from t2 join t1 on t1.i1 = t2.cd  and t1.i2 = 345);
+
+insert into t2 select * from t2;
+
+select max(10) from dual
+  where exists (select 1 from t2 join t1 on t1.i1 = t2.cd  and t1.i2 = 345);
+
+DROP TABLE t1,t2;
+
+--echo #
 --echo # MDEV-10232 Scalar result of subquery changes after adding an outer select stmt
 --echo #
 
diff --git a/mysys/lf_hash.c b/mysys/lf_hash.c
index 430f1007f30..64e5c5e3e93 100644
--- a/mysys/lf_hash.c
+++ b/mysys/lf_hash.c
@@ -1,5 +1,5 @@
-/* Copyright (c) 2006, 2010, Oracle and/or its affiliates.
-   Copyright (c) 2009, 2016, MariaDB
+/* Copyright (c) 2006, 2018, Oracle and/or its affiliates.
+   Copyright (c) 2009, 2018, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -102,8 +102,8 @@ retry:
   do { /* PTR() isn't necessary below, head is a dummy node */
     cursor->curr= (LF_SLIST *)(*cursor->prev);
     lf_pin(pins, 1, cursor->curr);
-  } while (*cursor->prev != (intptr)cursor->curr && LF_BACKOFF);
-
+  } while (my_atomic_loadptr((void**)cursor->prev) != cursor->curr &&
+                              LF_BACKOFF);
   for (;;)
   {
     if (unlikely(!cursor->curr))
diff --git a/mysys/my_default.c b/mysys/my_default.c
index 9efbf054131..78fbe57e01d 100644
--- a/mysys/my_default.c
+++ b/mysys/my_default.c
@@ -1099,10 +1099,12 @@ void print_defaults(const char *conf_file, const char **groups)
     }
   }
   puts("\nThe following options may be given as the first argument:\n\
---print-defaults        Print the program argument list and exit.\n\
---no-defaults           Don't read default options from any option file.\n\
---defaults-file=#       Only read default options from the given file #.\n\
---defaults-extra-file=# Read this file after the global files are read.");
+--print-defaults          Print the program argument list and exit.\n\
+--no-defaults             Don't read default options from any option file.\n\
+The following specify which files/extra groups are read (specified before remaining options):\n\
+--defaults-file=#         Only read default options from the given file #.\n\
+--defaults-extra-file=#   Read this file after the global files are read.\n\
+--defaults-group-suffix=# Additionally read default groups with # appended as a suffix.");
 }
 
 
diff --git a/sql-common/client.c b/sql-common/client.c
index 727211e35d9..a4f22691d75 100644
--- a/sql-common/client.c
+++ b/sql-common/client.c
@@ -1578,7 +1578,7 @@ read_one_row(MYSQL *mysql,uint fields,MYSQL_ROW row, ulong *lengths)
     }
     else
     {
-      if (len > (ulong) (end_pos - pos))
+      if (pos + len > end_pos)
       {
         set_mysql_error(mysql, CR_UNKNOWN_ERROR, unknown_sqlstate);
         return -1;
diff --git a/sql/handler.cc b/sql/handler.cc
index 8093c17135b..cd2ad06bb70 100644
--- a/sql/handler.cc
+++ b/sql/handler.cc
@@ -4284,18 +4284,6 @@ handler::check_if_supported_inplace_alter(TABLE *altered_table,
   DBUG_RETURN(HA_ALTER_INPLACE_NOT_SUPPORTED);
 }
 
-
-/*
-   Default implementation to support in-place alter table
-   and old online add/drop index API
-*/
-
-void handler::notify_table_changed()
-{
-  ha_create_partitioning_metadata(table->s->path.str, NULL, CHF_INDEX_FLAG);
-}
-
-
 void Alter_inplace_info::report_unsupported_error(const char *not_supported,
                                                   const char *try_instead)
 {
@@ -4394,7 +4382,6 @@ handler::ha_create_partitioning_metadata(const char *name,
   */
   DBUG_ASSERT(m_lock_type == F_UNLCK ||
               (!old_name && strcmp(name, table_share->path.str)));
-  mark_trx_read_write();
 
   return create_partitioning_metadata(name, old_name, action_flag);
 }
diff --git a/sql/handler.h b/sql/handler.h
index b280f6d597d..a29026990de 100644
--- a/sql/handler.h
+++ b/sql/handler.h
@@ -3901,7 +3901,7 @@ protected:
 
     @note No errors are allowed during notify_table_changed().
  */
- virtual void notify_table_changed();
+ virtual void notify_table_changed() { }
 
 public:
  /* End of On-line/in-place ALTER TABLE interface. */
diff --git a/sql/item_func.h b/sql/item_func.h
index 0fb365f8107..689bfb84034 100644
--- a/sql/item_func.h
+++ b/sql/item_func.h
@@ -2460,6 +2460,7 @@ public:
   Item_func_uuid_short(THD *thd): Item_int_func(thd) {}
   const char *func_name() const { return "uuid_short"; }
   longlong val_int();
+  bool const_item() const { return false; }
   void fix_length_and_dec()
   { max_length= 21; unsigned_flag=1; }
   table_map used_tables() const { return RAND_TABLE_BIT; }
diff --git a/sql/item_strfunc.h b/sql/item_strfunc.h
index 4372855ccf5..c9956ab364e 100644
--- a/sql/item_strfunc.h
+++ b/sql/item_strfunc.h
@@ -1384,6 +1384,7 @@ public:
                   DERIVATION_COERCIBLE, MY_REPERTOIRE_ASCII);
     fix_char_length(MY_UUID_STRING_LENGTH);
   }
+  bool const_item() const { return false; }
   table_map used_tables() const { return RAND_TABLE_BIT; }
   const char *func_name() const{ return "uuid"; }
   String *val_str(String *);
diff --git a/sql/log_event.cc b/sql/log_event.cc
index 55e5e49f5bd..7de9df9ebe6 100644
--- a/sql/log_event.cc
+++ b/sql/log_event.cc
@@ -1,6 +1,6 @@
 /*
-   Copyright (c) 2000, 2016, Oracle and/or its affiliates.
-   Copyright (c) 2009, 2016, MariaDB
+   Copyright (c) 2000, 2018, Oracle and/or its affiliates.
+   Copyright (c) 2009, 2018, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -4525,6 +4525,24 @@ Query_log_event::Query_log_event(const char* buf, uint event_len,
   db= (char *)start;
   query= (char *)(start + db_len + 1);
   q_len= data_len - db_len -1;
+
+  if (data_len && (data_len < db_len ||
+                   data_len < q_len ||
+                   data_len != (db_len + q_len + 1)))
+  {
+    q_len= 0;
+    query= NULL;
+    DBUG_VOID_RETURN;
+  }
+
+  uint32 max_length= uint32(event_len - ((const char*)(end + db_len + 1) -
+                                         (buf - common_header_len)));
+  if (q_len != max_length)
+  {
+    q_len= 0;
+    query= NULL;
+    DBUG_VOID_RETURN;
+  }
   /**
     Append the db length at the end of the buffer. This will be used by
     Query_cache::send_result_to_client() in case the query cache is On.
@@ -5043,6 +5061,19 @@ int Query_log_event::do_apply_event(rpl_group_info *rgi,
     you.
   */
   thd->catalog= catalog_len ? (char *) catalog : (char *)"";
+
+  size_t valid_len= Well_formed_prefix(system_charset_info,
+                                       db, db_len, NAME_LEN).length();
+
+  if (valid_len != db_len)
+  {
+    rli->report(ERROR_LEVEL, ER_SLAVE_FATAL_ERROR,
+                ER_THD(thd, ER_SLAVE_FATAL_ERROR),
+                "Invalid database name in Query event.");
+    thd->is_slave_error= true;
+    goto end;
+  }
+
   new_db.length= db_len;
   new_db.str= (char *) rpl_filter->get_rewrite_db(db, &new_db.length);
   thd->set_db(new_db.str, new_db.length);       /* allocates a copy of 'db' */
@@ -5184,7 +5215,23 @@ int Query_log_event::do_apply_event(rpl_group_info *rgi,
       }
       else
         thd->variables.collation_database= thd->db_charset;
-      
+
+      {
+        const CHARSET_INFO *cs= thd->charset();
+        /*
+          We cannot ask for parsing a statement using a character set
+          without state_maps (parser internal data).
+        */
+        if (!cs->state_map)
+        {
+          rli->report(ERROR_LEVEL, ER_SLAVE_FATAL_ERROR,
+                      ER_THD(thd, ER_SLAVE_FATAL_ERROR),
+                      "character_set cannot be parsed");
+          thd->is_slave_error= true;
+          goto end;
+        }
+      }
+
       /*
         Record any GTID in the same transaction, so slave state is
         transactionally consistent.
@@ -5727,7 +5774,13 @@ int Start_log_event_v3::do_apply_event(rpl_group_info *rgi)
     */
     break;
   default:
-    /* this case is impossible */
+    /*
+      This case is not expected. It can be either an event corruption or an
+      unsupported binary log version.
+    */
+    rli->report(ERROR_LEVEL, ER_SLAVE_FATAL_ERROR,
+                ER_THD(thd, ER_SLAVE_FATAL_ERROR),
+                "Binlog version not supported");
     DBUG_RETURN(1);
   }
   DBUG_RETURN(error);
@@ -6643,6 +6696,9 @@ int Load_log_event::copy_log_event(const char *buf, ulong event_len,
 
   fields = (char*)field_lens + num_fields;
   table_name  = fields + field_block_len;
+  if (strlen(table_name) > NAME_LEN)
+    goto err;
+
   db = table_name + table_name_len + 1;
   DBUG_EXECUTE_IF ("simulate_invalid_address",
                    db_len = data_len;);
@@ -8623,6 +8679,13 @@ User_var_log_event(const char* buf, uint event_len,
   buf+= description_event->common_header_len +
     description_event->post_header_len[USER_VAR_EVENT-1];
   name_len= uint4korr(buf);
+  /* Avoid reading out of buffer */
+  if ((buf - buf_start) + UV_NAME_LEN_SIZE + name_len > event_len)
+  {
+    error= true;
+    goto err;
+  }
+
   name= (char *) buf + UV_NAME_LEN_SIZE;
 
   /*
@@ -8679,7 +8742,12 @@ User_var_log_event(const char* buf, uint event_len,
       Old events will not have this extra byte, thence,
       we keep the flags set to UNDEF_F.
     */
-    size_t bytes_read= ((val + val_len) - buf_start);
+    size_t bytes_read= (val + val_len) - buf_start;
+    if (bytes_read > size_t(event_len))
+    {
+      error= true;
+      goto err;
+    }
     if ((data_written - bytes_read) > 0)
     {
       flags= (uint) *(buf + UV_VAL_IS_NULL + UV_VAL_TYPE_SIZE +
@@ -8894,7 +8962,12 @@ int User_var_log_event::do_apply_event(rpl_group_info *rgi)
   }
 
   if (!(charset= get_charset(charset_number, MYF(MY_WME))))
+  {
+    rgi->rli->report(ERROR_LEVEL, ER_SLAVE_FATAL_ERROR,
+                ER_THD(thd, ER_SLAVE_FATAL_ERROR),
+                "Invalid character set for User var event");
     DBUG_RETURN(1);
+  }
   LEX_STRING user_var_name;
   user_var_name.str= name;
   user_var_name.length= name_len;
@@ -8909,12 +8982,26 @@ int User_var_log_event::do_apply_event(rpl_group_info *rgi)
   {
     switch (type) {
     case REAL_RESULT:
+      if (val_len != 8)
+      {
+        rgi->rli->report(ERROR_LEVEL, ER_SLAVE_FATAL_ERROR,
+                    ER_THD(thd, ER_SLAVE_FATAL_ERROR),
+                    "Invalid variable length at User var event");
+        return 1;
+      }
       float8get(real_val, val);
       it= new (thd->mem_root) Item_float(thd, real_val, 0);
       val= (char*) &real_val;		// Pointer to value in native format
       val_len= 8;
       break;
     case INT_RESULT:
+      if (val_len != 8)
+      {
+        rgi->rli->report(ERROR_LEVEL, ER_SLAVE_FATAL_ERROR,
+                    ER_THD(thd, ER_SLAVE_FATAL_ERROR),
+                    "Invalid variable length at User var event");
+        return 1;
+      }
       int_val= (longlong) uint8korr(val);
       it= new (thd->mem_root) Item_int(thd, int_val);
       val= (char*) &int_val;		// Pointer to value in native format
@@ -8922,6 +9009,13 @@ int User_var_log_event::do_apply_event(rpl_group_info *rgi)
       break;
     case DECIMAL_RESULT:
     {
+      if (val_len < 3)
+      {
+        rgi->rli->report(ERROR_LEVEL, ER_SLAVE_FATAL_ERROR,
+                    ER_THD(thd, ER_SLAVE_FATAL_ERROR),
+                    "Invalid variable length at User var event");
+        return 1;
+      }
       Item_decimal *dec= new (thd->mem_root) Item_decimal(thd, (uchar*) val+2, val[0], val[1]);
       it= dec;
       val= (char *)dec->val_decimal(NULL);
@@ -10294,6 +10388,14 @@ Rows_log_event::Rows_log_event(const char *buf, uint event_len,
   DBUG_PRINT("debug", ("Reading from %p", ptr_after_width));
   m_width = net_field_length(&ptr_after_width);
   DBUG_PRINT("debug", ("m_width=%lu", m_width));
+
+  /* Avoid reading out of buffer */
+  if (ptr_after_width + (m_width + 7) / 8 > (uchar*)buf + event_len)
+  {
+    m_cols.bitmap= NULL;
+    DBUG_VOID_RETURN;
+  }
+
   /* if my_bitmap_init fails, catched in is_valid() */
   if (likely(!my_bitmap_init(&m_cols,
                           m_width <= sizeof(m_bitbuf)*8 ? m_bitbuf : NULL,
@@ -10342,7 +10444,12 @@ Rows_log_event::Rows_log_event(const char *buf, uint event_len,
 
   const uchar* const ptr_rows_data= (const uchar*) ptr_after_width;
 
-  size_t const data_size= event_len - (ptr_rows_data - (const uchar *) buf);
+  size_t const read_size= ptr_rows_data - (const unsigned char *) buf;
+  if (read_size > event_len)
+  {
+    DBUG_VOID_RETURN;
+  }
+  size_t const data_size= event_len - read_size;
   DBUG_PRINT("info",("m_table_id: %lu  m_flags: %d  m_width: %lu  data_size: %lu",
                      m_table_id, m_flags, m_width, (ulong) data_size));
 
diff --git a/sql/log_event_old.cc b/sql/log_event_old.cc
index 68ffa32fafe..ce9bca920fe 100644
--- a/sql/log_event_old.cc
+++ b/sql/log_event_old.cc
@@ -1,4 +1,5 @@
-/* Copyright (c) 2007, 2016, Oracle and/or its affiliates.
+/* Copyright (c) 2007, 2018, Oracle and/or its affiliates.
+   Copyright (c) 2009, 2018, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -1233,6 +1234,13 @@ Old_rows_log_event::Old_rows_log_event(const char *buf, uint event_len,
   DBUG_PRINT("debug", ("Reading from %p", ptr_after_width));
   m_width = net_field_length(&ptr_after_width);
   DBUG_PRINT("debug", ("m_width=%lu", m_width));
+  /* Avoid reading out of buffer */
+  if (ptr_after_width + m_width > (uchar *)buf + event_len)
+  {
+    m_cols.bitmap= NULL;
+    DBUG_VOID_RETURN;
+  }
+
   /* if my_bitmap_init fails, catched in is_valid() */
   if (likely(!my_bitmap_init(&m_cols,
                           m_width <= sizeof(m_bitbuf)*8 ? m_bitbuf : NULL,
diff --git a/sql/opt_subselect.cc b/sql/opt_subselect.cc
index 9e456bd3969..b28adae0a44 100644
--- a/sql/opt_subselect.cc
+++ b/sql/opt_subselect.cc
@@ -5969,5 +5969,6 @@ bool JOIN::choose_tableless_subquery_plan()
       tmp_having= having;
     }
   }
+  exec_const_cond= conds;
   return FALSE;
 }
diff --git a/sql/sp.cc b/sql/sp.cc
index 89797ff400a..207ece47356 100644
--- a/sql/sp.cc
+++ b/sql/sp.cc
@@ -1,6 +1,6 @@
 /*
-   Copyright (c) 2002, 2016, Oracle and/or its affiliates.
-   Copyright (c) 2009, 2017, MariaDB
+   Copyright (c) 2002, 2018, Oracle and/or its affiliates.
+   Copyright (c) 2009, 2018, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -347,7 +347,7 @@ private:
   bool m_print_once;
 
 public:
-  Proc_table_intact() : m_print_once(TRUE) {}
+  Proc_table_intact() : m_print_once(TRUE) { has_keys= TRUE; }
 
 protected:
   void report_error(uint code, const char *fmt, ...);
diff --git a/sql/sql_acl.cc b/sql/sql_acl.cc
index e5c3340aa09..b3059248ac0 100644
--- a/sql/sql_acl.cc
+++ b/sql/sql_acl.cc
@@ -1,5 +1,5 @@
 /* Copyright (c) 2000, 2016, Oracle and/or its affiliates.
-   Copyright (c) 2009, 2016, MariaDB
+   Copyright (c) 2009, 2018, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/sql/sql_admin.cc b/sql/sql_admin.cc
index 6474213cb9f..48d16da9d0a 100644
--- a/sql/sql_admin.cc
+++ b/sql/sql_admin.cc
@@ -1,5 +1,5 @@
 /* Copyright (c) 2010, 2015, Oracle and/or its affiliates.
-   Copyright (c) 2011, 2016, MariaDB
+   Copyright (c) 2011, 2018, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -238,7 +238,7 @@ static int prepare_for_repair(THD *thd, TABLE_LIST *table_list,
 
   if (thd->locked_tables_list.locked_tables())
   {
-    if (thd->locked_tables_list.reopen_tables(thd))
+    if (thd->locked_tables_list.reopen_tables(thd, false))
       goto end;
     /* Restore the table in the table list with the new opened table */
     table_list->table= pos_in_locked_tables->table;
diff --git a/sql/sql_base.cc b/sql/sql_base.cc
index aa4a77554f8..cc34b103a15 100644
--- a/sql/sql_base.cc
+++ b/sql/sql_base.cc
@@ -481,7 +481,7 @@ err_with_reopen:
       old locks. This should always succeed (unless some external process
       has removed the tables)
     */
-    if (thd->locked_tables_list.reopen_tables(thd))
+    if (thd->locked_tables_list.reopen_tables(thd, false))
       result= true;
     /*
       Since downgrade_lock() won't do anything with shared
@@ -808,7 +808,10 @@ void close_thread_tables(THD *thd)
       we will exit this function a few lines below.
     */
     if (! thd->lex->requires_prelocking())
+    {
+      thd->locked_tables_list.reopen_tables(thd, true);
       DBUG_VOID_RETURN;
+    }
 
     /*
       We are in the top-level statement of a prelocked statement,
@@ -2241,7 +2244,8 @@ void Locked_tables_list::unlink_from_list(THD *thd,
     If mode is not LTM_LOCK_TABLES, we needn't do anything. Moreover,
     outside this mode pos_in_locked_tables value is not trustworthy.
   */
-  if (thd->locked_tables_mode != LTM_LOCK_TABLES)
+  if (thd->locked_tables_mode != LTM_LOCK_TABLES &&
+      thd->locked_tables_mode != LTM_PRELOCKED_UNDER_LOCK_TABLES)
     return;
 
   /*
@@ -2345,7 +2349,7 @@ unlink_all_closed_tables(THD *thd, MYSQL_LOCK *lock, size_t reopen_count)
 */
 
 bool
-Locked_tables_list::reopen_tables(THD *thd)
+Locked_tables_list::reopen_tables(THD *thd, bool need_reopen)
 {
   Open_table_context ot_ctx(thd, MYSQL_OPEN_REOPEN);
   size_t reopen_count= 0;
@@ -2356,8 +2360,20 @@ Locked_tables_list::reopen_tables(THD *thd)
   for (TABLE_LIST *table_list= m_locked_tables;
        table_list; table_list= table_list->next_global)
   {
-    if (table_list->table)                      /* The table was not closed */
-      continue;
+    if (need_reopen)
+    {
+      if (!table_list->table || !table_list->table->needs_reopen())
+        continue;
+      /* no need to remove the table from the TDC here, thus (TABLE*)1 */
+      close_all_tables_for_name(thd, table_list->table->s,
+                                HA_EXTRA_NOT_USED, (TABLE*)1);
+      DBUG_ASSERT(table_list->table == NULL);
+    }
+    else
+    {
+      if (table_list->table)                      /* The table was not closed */
+          continue;
+    }
 
     /* Links into thd->open_tables upon success */
     if (open_table(thd, table_list, &ot_ctx))
diff --git a/sql/sql_base.h b/sql/sql_base.h
index 9fb94e92d09..d6063f1b771 100644
--- a/sql/sql_base.h
+++ b/sql/sql_base.h
@@ -1,4 +1,6 @@
 /* Copyright (c) 2010, 2013, Oracle and/or its affiliates. All rights reserved.
+   Copyright (c) 2011, 2018, MariaDB
+
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/sql/sql_class.h b/sql/sql_class.h
index 89cdb5af251..cd31e0356e8 100644
--- a/sql/sql_class.h
+++ b/sql/sql_class.h
@@ -1854,7 +1854,7 @@ public:
   void unlink_all_closed_tables(THD *thd,
                                 MYSQL_LOCK *lock,
                                 size_t reopen_count);
-  bool reopen_tables(THD *thd);
+  bool reopen_tables(THD *thd, bool need_reopen);
   bool restore_lock(THD *thd, TABLE_LIST *dst_table_list, TABLE *table,
                     MYSQL_LOCK *lock);
   void add_back_last_deleted_lock(TABLE_LIST *dst_table_list);
diff --git a/sql/sql_partition.cc b/sql/sql_partition.cc
index 1376115e77c..536c436475f 100644
--- a/sql/sql_partition.cc
+++ b/sql/sql_partition.cc
@@ -1,5 +1,5 @@
 /* Copyright (c) 2005, 2017, Oracle and/or its affiliates.
-   Copyright (c) 2009, 2017, SkySQL Ab.
+   Copyright (c) 2009, 2018, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -6283,7 +6283,7 @@ static void alter_partition_lock_handling(ALTER_PARTITION_PARAM_TYPE *lpt)
       thd->set_stmt_da(&tmp_stmt_da);
     }
 
-    if (thd->locked_tables_list.reopen_tables(thd))
+    if (thd->locked_tables_list.reopen_tables(thd, false))
       sql_print_warning("We failed to reacquire LOCKs in ALTER TABLE");
 
     if (stmt_da)
@@ -6489,7 +6489,7 @@ err_exclusive_lock:
       thd->set_stmt_da(&tmp_stmt_da);
     }
 
-    if (thd->locked_tables_list.reopen_tables(thd))
+    if (thd->locked_tables_list.reopen_tables(thd, false))
       sql_print_warning("We failed to reacquire LOCKs in ALTER TABLE");
 
     if (stmt_da)
diff --git a/sql/sql_partition_admin.cc b/sql/sql_partition_admin.cc
index 1f9ee32ba73..cb5b3c8a044 100644
--- a/sql/sql_partition_admin.cc
+++ b/sql/sql_partition_admin.cc
@@ -629,7 +629,7 @@ bool Sql_cmd_alter_table_exchange_partition::
     better to keep master/slave in consistent state. Alternative would be to
     try to revert the exchange operation and issue error.
   */
-  (void) thd->locked_tables_list.reopen_tables(thd);
+  (void) thd->locked_tables_list.reopen_tables(thd, false);
 
   if ((error= write_bin_log(thd, TRUE, thd->query(), thd->query_length())))
   {
diff --git a/sql/sql_plugin.cc b/sql/sql_plugin.cc
index adf6fa4f936..4c258acd487 100644
--- a/sql/sql_plugin.cc
+++ b/sql/sql_plugin.cc
@@ -1,6 +1,6 @@
 /*
-   Copyright (c) 2005, 2013, Oracle and/or its affiliates.
-   Copyright (c) 2010, 2017, MariaDB Corporation.
+   Copyright (c) 2005, 2018, Oracle and/or its affiliates.
+   Copyright (c) 2010, 2018, MariaDB Corporation
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -2283,6 +2283,16 @@ bool mysql_uninstall_plugin(THD *thd, const LEX_STRING *name,
   if (! (table= open_ltable(thd, &tables, TL_WRITE, MYSQL_LOCK_IGNORE_TIMEOUT)))
     DBUG_RETURN(TRUE);
 
+  if (!table->key_info)
+  {
+    my_printf_error(ER_UNKNOWN_ERROR,
+                    "The table %s.%s has no primary key. "
+                    "Please check the table definition and "
+                    "create the primary key accordingly.", MYF(0),
+                    table->s->db.str, table->s->table_name.str);
+    DBUG_RETURN(TRUE);
+  }
+
   /*
     Pre-acquire audit plugins for events that may potentially occur
     during [UN]INSTALL PLUGIN.
diff --git a/sql/sql_priv.h b/sql/sql_priv.h
index 6c9df6a9606..f34148d4fe6 100644
--- a/sql/sql_priv.h
+++ b/sql/sql_priv.h
@@ -1,5 +1,5 @@
-/* Copyright (c) 2000, 2014, Oracle and/or its affiliates.
-   Copyright (c) 2010, 2014, Monty Program Ab.
+/* Copyright (c) 2000, 2018, Oracle and/or its affiliates.
+   Copyright (c) 2010, 2018, Monty Program Ab.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/sql/sql_statistics.cc b/sql/sql_statistics.cc
index 5badcad3492..e40e817ec8a 100644
--- a/sql/sql_statistics.cc
+++ b/sql/sql_statistics.cc
@@ -2619,7 +2619,7 @@ int collect_statistics_for_index(THD *thd, TABLE *table, uint index)
   DBUG_ENTER("collect_statistics_for_index");
 
   /* No statistics for FULLTEXT indexes. */
-  if (key_info->flags & HA_FULLTEXT)
+  if (key_info->flags & (HA_FULLTEXT|HA_SPATIAL))
     DBUG_RETURN(rc);
 
   Index_prefix_calc index_prefix_calc(thd, table, key_info);
diff --git a/sql/sql_table.cc b/sql/sql_table.cc
index 78e91d64689..9e7973b745c 100644
--- a/sql/sql_table.cc
+++ b/sql/sql_table.cc
@@ -1,6 +1,6 @@
 /*
    Copyright (c) 2000, 2016, Oracle and/or its affiliates.
-   Copyright (c) 2010, 2017, MariaDB Corporation.
+   Copyright (c) 2010, 2018, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -5090,7 +5090,7 @@ bool mysql_create_table(THD *thd, TABLE_LIST *create_table,
       This should always work as we have a meta lock on the table.
      */
     thd->locked_tables_list.add_back_last_deleted_lock(pos_in_locked_tables);
-    if (thd->locked_tables_list.reopen_tables(thd))
+    if (thd->locked_tables_list.reopen_tables(thd, false))
     {
       thd->locked_tables_list.unlink_all_closed_tables(thd, NULL, 0);
       result= 1;
@@ -5480,7 +5480,7 @@ bool mysql_create_like_table(THD* thd, TABLE_LIST* table,
       This should always work as we have a meta lock on the table.
      */
     thd->locked_tables_list.add_back_last_deleted_lock(pos_in_locked_tables);
-    if (thd->locked_tables_list.reopen_tables(thd))
+    if (thd->locked_tables_list.reopen_tables(thd, false))
     {
       thd->locked_tables_list.unlink_all_closed_tables(thd, NULL, 0);
       res= 1;                                   // We got an error
@@ -7455,7 +7455,7 @@ static bool mysql_inplace_alter_table(THD *thd,
                               HA_EXTRA_PREPARE_FOR_RENAME :
                               HA_EXTRA_NOT_USED,
                               NULL);
-    if (thd->locked_tables_list.reopen_tables(thd))
+    if (thd->locked_tables_list.reopen_tables(thd, false))
       thd->locked_tables_list.unlink_all_closed_tables(thd, NULL, 0);
     /* QQ; do something about metadata locks ? */
   }
@@ -9642,7 +9642,7 @@ bool mysql_alter_table(THD *thd,char *new_db, char *new_name,
 
 end_inplace:
 
-  if (thd->locked_tables_list.reopen_tables(thd))
+  if (thd->locked_tables_list.reopen_tables(thd, false))
     goto err_with_mdl_after_alter;
 
   THD_STAGE_INFO(thd, stage_end);
diff --git a/sql/sql_trigger.cc b/sql/sql_trigger.cc
index 303c5d75e18..0fefe7d2c52 100644
--- a/sql/sql_trigger.cc
+++ b/sql/sql_trigger.cc
@@ -1,5 +1,6 @@
 /*
    Copyright (c) 2004, 2012, Oracle and/or its affiliates.
+   Copyright (c) 2010, 2018, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -587,7 +588,7 @@ bool mysql_create_or_drop_trigger(THD *thd, TABLE_LIST *tables, bool create)
     Ignore the return value for now. It's better to
     keep master/slave in consistent state.
   */
-  if (thd->locked_tables_list.reopen_tables(thd))
+  if (thd->locked_tables_list.reopen_tables(thd, false))
     thd->clear_error();
 
   /*
diff --git a/sql/sql_truncate.cc b/sql/sql_truncate.cc
index c08c75f771a..8a70e6f6bdb 100644
--- a/sql/sql_truncate.cc
+++ b/sql/sql_truncate.cc
@@ -1,5 +1,5 @@
 /* Copyright (c) 2010, 2015, Oracle and/or its affiliates.
-   Copyright (c) 2013, 2015, MariaDB
+   Copyright (c) 2012, 2018, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -426,7 +426,7 @@ bool Sql_cmd_truncate_table::truncate_table(THD *thd, TABLE_LIST *table_ref)
       */
       error= dd_recreate_table(thd, table_ref->db, table_ref->table_name);
 
-      if (thd->locked_tables_mode && thd->locked_tables_list.reopen_tables(thd))
+      if (thd->locked_tables_mode && thd->locked_tables_list.reopen_tables(thd, false))
           thd->locked_tables_list.unlink_all_closed_tables(thd, NULL, 0);
 
       /* No need to binlog a failed truncate-by-recreate. */
@@ -500,4 +500,3 @@ bool Sql_cmd_truncate_table::execute(THD *thd)
 
   DBUG_RETURN(res);
 }
-
diff --git a/sql/table.cc b/sql/table.cc
index b36feadeac2..18bc4bf17bc 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -1,5 +1,5 @@
-/* Copyright (c) 2000, 2015, Oracle and/or its affiliates.
-   Copyright (c) 2008, 2016, MariaDB
+/* Copyright (c) 2000, 2017, Oracle and/or its affiliates.
+   Copyright (c) 2008, 2018, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -4088,7 +4088,7 @@ Table_check_intact::check(TABLE *table, const TABLE_FIELD_DEF *table_def)
 
   /* Whether the table definition has already been validated. */
   if (table->s->table_field_def_cache == table_def)
-    DBUG_RETURN(FALSE);
+    goto end;
 
   if (table->s->fields != table_def->count)
   {
@@ -4121,6 +4121,8 @@ Table_check_intact::check(TABLE *table, const TABLE_FIELD_DEF *table_def)
       is backward compatible.
     */
   }
+  else
+  {
   StringBuffer<1024> sql_type(system_charset_info);
   sql_type.extra_allocation(256); // Allocate min 256 characters at once
   for (i=0 ; i < table_def->count; i++, field_def++)
@@ -4206,6 +4208,7 @@ Table_check_intact::check(TABLE *table, const TABLE_FIELD_DEF *table_def)
       error= TRUE;
     }
   }
+  }
 
   if (table_def->primary_key_parts)
   {
@@ -4250,6 +4253,16 @@ Table_check_intact::check(TABLE *table, const TABLE_FIELD_DEF *table_def)
   if (! error)
     table->s->table_field_def_cache= table_def;
 
+end:
+
+  if (has_keys && !error && !table->key_info)
+  {
+    report_error(0, "Incorrect definition of table %s.%s: "
+                 "indexes are missing",
+                 table->s->db.str, table->alias.c_ptr());
+    error= TRUE;
+  }
+
   DBUG_RETURN(error);
 }
 
diff --git a/sql/table.h b/sql/table.h
index 7af45b9f169..61ac6c06e38 100644
--- a/sql/table.h
+++ b/sql/table.h
@@ -1,8 +1,7 @@
 #ifndef TABLE_INCLUDED
 #define TABLE_INCLUDED
-/* Copyright (c) 2000, 2013, Oracle and/or its affiliates.
-   Copyright (c) 2009, 2014, SkySQL Ab.
-   Copyright (c) 2016, 2017, MariaDB Corporation.
+/* Copyright (c) 2000, 2017, Oracle and/or its affiliates.
+   Copyright (c) 2009, 2018, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -473,10 +472,11 @@ typedef struct st_table_field_def
 class Table_check_intact
 {
 protected:
+  bool has_keys;
   virtual void report_error(uint code, const char *fmt, ...)= 0;
 
 public:
-  Table_check_intact() {}
+  Table_check_intact(bool keys= false) : has_keys(keys) {}
   virtual ~Table_check_intact() {}
 
   /** Checks whether a table is intact. */
@@ -491,6 +491,8 @@ class Table_check_intact_log_error : public Table_check_intact
 {
 protected:
   void report_error(uint, const char *fmt, ...);
+public:
+  Table_check_intact_log_error() : Table_check_intact(true) {}
 };
 
 
diff --git a/storage/innobase/dict/dict0load.cc b/storage/innobase/dict/dict0load.cc
index 3606b902510..67f863ee907 100644
--- a/storage/innobase/dict/dict0load.cc
+++ b/storage/innobase/dict/dict0load.cc
@@ -2674,11 +2674,13 @@ dict_load_table_low(table_name_t& name, const rec_t* rec, dict_table_t** table)
 	ulint		n_v_col;
 
 	if (const char* error_text = dict_sys_tables_rec_check(rec)) {
+		*table = NULL;
 		return(error_text);
 	}
 
 	if (!dict_sys_tables_rec_read(rec, name, &table_id, &space_id,
 				      &t_num, &flags, &flags2)) {
+		*table = NULL;
 		return(dict_load_table_flags);
 	}
 
diff --git a/storage/innobase/handler/ha_innodb.cc b/storage/innobase/handler/ha_innodb.cc
index 3f707e5e631..9eb924b6595 100644
--- a/storage/innobase/handler/ha_innodb.cc
+++ b/storage/innobase/handler/ha_innodb.cc
@@ -1,10 +1,10 @@
 /*****************************************************************************
 
-Copyright (c) 2000, 2017, Oracle and/or its affiliates. All Rights Reserved.
-Copyright (c) 2013, 2018, MariaDB Corporation.
+Copyright (c) 2000, 2018, Oracle and/or its affiliates. All Rights Reserved.
 Copyright (c) 2008, 2009 Google Inc.
 Copyright (c) 2009, Percona Inc.
 Copyright (c) 2012, Facebook Inc.
+Copyright (c) 2013, 2018, MariaDB Corporation.
 
 Portions of this file contain modifications contributed and copyrighted by
 Google, Inc. Those modifications are gratefully acknowledged and are described
@@ -15641,6 +15641,7 @@ ha_innobase::start_stmt(
 		case SQLCOM_INSERT:
 		case SQLCOM_UPDATE:
 		case SQLCOM_DELETE:
+		case SQLCOM_REPLACE:
 			init_table_handle_for_HANDLER();
 			m_prebuilt->select_lock_type = LOCK_X;
 			m_prebuilt->stored_select_lock_type = LOCK_X;
diff --git a/storage/innobase/handler/handler0alter.cc b/storage/innobase/handler/handler0alter.cc
index 02a8428cdc9..d064ebccfe2 100644
--- a/storage/innobase/handler/handler0alter.cc
+++ b/storage/innobase/handler/handler0alter.cc
@@ -2593,14 +2593,9 @@ innobase_create_key_defs(
 		ulint	primary_key_number;
 
 		if (new_primary) {
-			if (n_add == 0) {
-				DBUG_ASSERT(got_default_clust);
-				DBUG_ASSERT(altered_table->s->primary_key
-					    == 0);
-				primary_key_number = 0;
-			} else {
-				primary_key_number = *add;
-			}
+			DBUG_ASSERT(n_add || got_default_clust);
+			DBUG_ASSERT(n_add || !altered_table->s->primary_key);
+			primary_key_number = altered_table->s->primary_key;
 		} else if (got_default_clust) {
 			/* Create the GEN_CLUST_INDEX */
 			index_def_t*	index = indexdef++;
diff --git a/storage/innobase/include/data0type.ic b/storage/innobase/include/data0type.ic
index c0b32953cff..59f8c75fd65 100644
--- a/storage/innobase/include/data0type.ic
+++ b/storage/innobase/include/data0type.ic
@@ -479,6 +479,7 @@ dtype_get_fixed_size_low(
 			return(0);
 		}
 #endif /* UNIV_DEBUG */
+		/* fall through */
 	case DATA_CHAR:
 	case DATA_FIXBINARY:
 	case DATA_INT:
@@ -552,6 +553,7 @@ dtype_get_min_size_low(
 			return(0);
 		}
 #endif /* UNIV_DEBUG */
+		/* fall through */
 	case DATA_CHAR:
 	case DATA_FIXBINARY:
 	case DATA_INT:
diff --git a/storage/innobase/page/page0page.cc b/storage/innobase/page/page0page.cc
index c33623e9398..1b010448135 100644
--- a/storage/innobase/page/page0page.cc
+++ b/storage/innobase/page/page0page.cc
@@ -87,17 +87,13 @@ page_dir_find_owner_slot(
 /*=====================*/
 	const rec_t*	rec)	/*!< in: the physical record */
 {
-	const page_t*			page;
-	register uint16			rec_offs_bytes;
-	register const page_dir_slot_t*	slot;
-	register const page_dir_slot_t*	first_slot;
-	register const rec_t*		r = rec;
-
 	ut_ad(page_rec_check(rec));
 
-	page = page_align(rec);
-	first_slot = page_dir_get_nth_slot(page, 0);
-	slot = page_dir_get_nth_slot(page, page_dir_get_n_slots(page) - 1);
+	const page_t* page = page_align(rec);
+	const page_dir_slot_t* first_slot = page_dir_get_nth_slot(page, 0);
+	const page_dir_slot_t* slot = page_dir_get_nth_slot(
+		page, page_dir_get_n_slots(page) - 1);
+	const rec_t*		r = rec;
 
 	if (page_is_comp(page)) {
 		while (rec_get_n_owned_new(r) == 0) {
@@ -113,7 +109,7 @@ page_dir_find_owner_slot(
 		}
 	}
 
-	rec_offs_bytes = mach_encode_2(r - page);
+	uint16 rec_offs_bytes = mach_encode_2(r - page);
 
 	while (UNIV_LIKELY(*(uint16*) slot != rec_offs_bytes)) {
 
diff --git a/storage/oqgraph/graphcore-config.h b/storage/oqgraph/graphcore-config.h
index 2afb7dfbcd6..3ef9da152ad 100644
--- a/storage/oqgraph/graphcore-config.h
+++ b/storage/oqgraph/graphcore-config.h
@@ -27,6 +27,8 @@
 #define BOOST_ALL_NO_LIB 1
 #define BOOST_NO_RTTI 1
 #define BOOST_NO_TYPEID 1
+#define BOOST_NO_HASH 1
+#define BOOST_NO_SLIST 1
 
 #ifdef DBUG_OFF
 #define NDEBUG 1
diff --git a/storage/oqgraph/oqgraph_shim.h b/storage/oqgraph/oqgraph_shim.h
index df578c9e4d0..aab6e797306 100644
--- a/storage/oqgraph/oqgraph_shim.h
+++ b/storage/oqgraph/oqgraph_shim.h
@@ -27,9 +27,6 @@
 #include "oqgraph_judy.h"
 #include "oqgraph_thunk.h"
 
-#define BOOST_NO_HASH 1
-#define BOOST_NO_SLIST 1
-
 #include <boost/graph/directed_graph.hpp>
 #include <boost/graph/adjacency_iterator.hpp>
 
diff --git a/storage/xtradb/dict/dict0load.cc b/storage/xtradb/dict/dict0load.cc
index 4c3dd47761f..1ff444b05c0 100644
--- a/storage/xtradb/dict/dict0load.cc
+++ b/storage/xtradb/dict/dict0load.cc
@@ -1,7 +1,7 @@
 /*****************************************************************************
 
 Copyright (c) 1996, 2016, Oracle and/or its affiliates. All Rights Reserved.
-Copyright (c) 2016, 2017, MariaDB Corporation.
+Copyright (c) 2016, 2018, MariaDB Corporation.
 
 This program is free software; you can redistribute it and/or modify it under
 the terms of the GNU General Public License as published by the Free Software
@@ -2088,10 +2088,12 @@ dict_load_table_low(
 	ulint		flags2;
 
 	if (rec_get_deleted_flag(rec, 0)) {
+		*table = NULL;
 		return("delete-marked record in SYS_TABLES");
 	}
 
 	if (rec_get_n_fields_old(rec) != DICT_NUM_FIELDS__SYS_TABLES) {
+		*table = NULL;
 		return("wrong number of columns in SYS_TABLES record");
 	}
 
@@ -2099,6 +2101,7 @@ dict_load_table_low(
 		rec, DICT_FLD__SYS_TABLES__NAME, &len);
 	if (len == 0 || len == UNIV_SQL_NULL) {
 err_len:
+		*table = NULL;
 		return("incorrect column length in SYS_TABLES");
 	}
 	rec_get_nth_field_offs_old(
@@ -2178,6 +2181,7 @@ err_len:
 			"InnoDB: in InnoDB data dictionary"
 			" has unknown type %lx.\n",
 			(ulong) flags);
+		*table = NULL;
 		return("incorrect flags in SYS_TABLES");
 	}
 
diff --git a/storage/xtradb/handler/handler0alter.cc b/storage/xtradb/handler/handler0alter.cc
index d5faaabc9d2..90cc91dfb59 100644
--- a/storage/xtradb/handler/handler0alter.cc
+++ b/storage/xtradb/handler/handler0alter.cc
@@ -1622,6 +1622,7 @@ innobase_create_index_def(
 
 	if (key_clustered) {
 		DBUG_ASSERT(!(key->flags & HA_FULLTEXT));
+		DBUG_ASSERT(key->flags & HA_NOSAME);
 		index->ind_type |= DICT_CLUSTERED;
 	} else if (key->flags & HA_FULLTEXT) {
 		DBUG_ASSERT(!(key->flags & HA_KEYFLAG_MASK
@@ -1937,14 +1938,9 @@ innobase_create_key_defs(
 		ulint	primary_key_number;
 
 		if (new_primary) {
-			if (n_add == 0) {
-				DBUG_ASSERT(got_default_clust);
-				DBUG_ASSERT(altered_table->s->primary_key
-					    == 0);
-				primary_key_number = 0;
-			} else {
-				primary_key_number = *add;
-			}
+			DBUG_ASSERT(n_add || got_default_clust);
+			DBUG_ASSERT(n_add || !altered_table->s->primary_key);
+			primary_key_number = altered_table->s->primary_key;
 		} else if (got_default_clust) {
 			/* Create the GEN_CLUST_INDEX */
 			index_def_t*	index = indexdef++;
diff --git a/storage/xtradb/include/data0type.ic b/storage/xtradb/include/data0type.ic
index 96b001e197e..a7e2eb0682c 100644
--- a/storage/xtradb/include/data0type.ic
+++ b/storage/xtradb/include/data0type.ic
@@ -525,6 +525,7 @@ dtype_get_fixed_size_low(
 			return(0);
 		}
 #endif /* UNIV_DEBUG */
+		/* fall through */
 	case DATA_CHAR:
 	case DATA_FIXBINARY:
 	case DATA_INT:
@@ -602,6 +603,7 @@ dtype_get_min_size_low(
 			return(0);
 		}
 #endif /* UNIV_DEBUG */
+		/* fall through */
 	case DATA_CHAR:
 	case DATA_FIXBINARY:
 	case DATA_INT:
diff --git a/storage/xtradb/page/page0page.cc b/storage/xtradb/page/page0page.cc
index fc93eebd445..e21880c2d4b 100644
--- a/storage/xtradb/page/page0page.cc
+++ b/storage/xtradb/page/page0page.cc
@@ -2,6 +2,7 @@
 
 Copyright (c) 1994, 2016, Oracle and/or its affiliates. All Rights Reserved.
 Copyright (c) 2012, Facebook Inc.
+Copyright (c) 2018, MariaDB Corporation.
 
 This program is free software; you can redistribute it and/or modify it under
 the terms of the GNU General Public License as published by the Free Software
@@ -98,17 +99,13 @@ page_dir_find_owner_slot(
 /*=====================*/
 	const rec_t*	rec)	/*!< in: the physical record */
 {
-	const page_t*			page;
-	register uint16			rec_offs_bytes;
-	register const page_dir_slot_t*	slot;
-	register const page_dir_slot_t*	first_slot;
-	register const rec_t*		r = rec;
-
 	ut_ad(page_rec_check(rec));
 
-	page = page_align(rec);
-	first_slot = page_dir_get_nth_slot(page, 0);
-	slot = page_dir_get_nth_slot(page, page_dir_get_n_slots(page) - 1);
+	const page_t* page = page_align(rec);
+	const page_dir_slot_t* first_slot = page_dir_get_nth_slot(page, 0);
+	const page_dir_slot_t* slot = page_dir_get_nth_slot(
+		page, page_dir_get_n_slots(page) - 1);
+	const rec_t*		r = rec;
 
 	if (page_is_comp(page)) {
 		while (rec_get_n_owned_new(r) == 0) {
@@ -124,7 +121,7 @@ page_dir_find_owner_slot(
 		}
 	}
 
-	rec_offs_bytes = mach_encode_2(r - page);
+	uint16 rec_offs_bytes = mach_encode_2(r - page);
 
 	while (UNIV_LIKELY(*(uint16*) slot != rec_offs_bytes)) {