merge

81 files changed, 1067 insertions, 258 deletions

diff --git a/.bzrignore b/.bzrignore
index 05597220950..2369d922ddf 100644
--- a/.bzrignore
+++ b/.bzrignore
@@ -3129,3 +3129,6 @@ libmysqld/examples/mysql_embedded
 sql/.empty
 mysys/thr_lock
 VERSION.dep
+info_macros.cmake
+Docs/INFO_BIN
+Docs/INFO_SRC
diff --git a/BUILD/SETUP.sh b/BUILD/SETUP.sh
index 2642788e360..c7f434d1bb3 100755
--- a/BUILD/SETUP.sh
+++ b/BUILD/SETUP.sh
@@ -31,6 +31,7 @@ Usage: $0 [-h|-n] [configure-options]
   -h, --help              Show this help message.
   -n, --just-print        Don't actually run any commands; just print them.
   -c, --just-configure    Stop after running configure.
+  --with-debug=full       Build with full debug(no optimizations, keep call stack).
   --warning-mode=[old|pedantic|maintainer]
                           Influences the debug flags. Old is default.
   --prefix=path           Build with prefix 'path'.
@@ -46,6 +47,8 @@ parse_options()
     case "$1" in
     --prefix=*)
       prefix=`get_key_value "$1"`;;
+    --with-debug=full)
+      full_debug="=full";;
     --warning-mode=*)
       warning_mode=`get_key_value "$1"`;;
     -c | --just-configure)
@@ -76,6 +79,7 @@ just_print=
 just_configure=
 warning_mode=
 maintainer_mode=
+full_debug=
 
 parse_options "$@"
 
@@ -154,7 +158,11 @@ base_cxxflags="-felide-constructors -fno-exceptions -fno-rtti"
 fast_cflags="-O3 -fno-omit-frame-pointer"
 
 debug_configs="--with-debug"
-debug_cflags="$debug_cflags $debug_extra_cflags"
+if [ -z "$full_debug" ]
+then
+  debug_cflags="$debug_cflags $debug_extra_cflags"
+fi
+
 
 #
 # Configuration options.
diff --git a/VERSION b/VERSION
index 3a52d76371e..796544a7013 100644
--- a/VERSION
+++ b/VERSION
@@ -1,4 +1,4 @@
 MYSQL_VERSION_MAJOR=5
 MYSQL_VERSION_MINOR=5
-MYSQL_VERSION_PATCH=13
+MYSQL_VERSION_PATCH=15
 MYSQL_VERSION_EXTRA=
diff --git a/client/mysqlbinlog.cc b/client/mysqlbinlog.cc
index e8a37ecfe5f..b374fa748b9 100644
--- a/client/mysqlbinlog.cc
+++ b/client/mysqlbinlog.cc
@@ -966,7 +966,8 @@ Exit_status process_event(PRINT_EVENT_INFO *print_event_info, Log_event *ev,
         passed --short-form, because --short-form disables printing
         row events.
       */
-      if (!print_event_info->printed_fd_event && !short_form)
+      if (!print_event_info->printed_fd_event && !short_form &&
+          opt_base64_output_mode != BASE64_OUTPUT_DECODE_ROWS)
       {
         const char* type_str= ev->get_type_str();
         if (opt_base64_output_mode == BASE64_OUTPUT_NEVER)
diff --git a/client/mysqltest.cc b/client/mysqltest.cc
index 6f19952302c..a6bd80059c1 100644
--- a/client/mysqltest.cc
+++ b/client/mysqltest.cc
@@ -10071,7 +10071,7 @@ int find_set(REP_SETS *sets,REP_SET *find)
       return i;
     }
   }
-  return i;				/* return new postion */
+  return i;				/* return new position */
 }
 
 /* find if there is a found_set with same table_offset & found_offset
@@ -10091,7 +10091,7 @@ int find_found(FOUND_SET *found_set,uint table_offset, int found_offset)
   found_set[i].table_offset=table_offset;
   found_set[i].found_offset=found_offset;
   found_sets++;
-  return -i-2;				/* return new postion */
+  return -i-2;				/* return new position */
 }
 
 /* Return 1 if regexp starts with \b or ends with \b*/
diff --git a/extra/replace.c b/extra/replace.c
index 2ce374726eb..21b9acb6f0c 100644
--- a/extra/replace.c
+++ b/extra/replace.c
@@ -1,17 +1,19 @@
-/* Copyright (C) 2000 MySQL AB
+/* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
 
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; version 2 of the License.
+   This program is free software; you can redistribute it and/or
+   modify it under the terms of the GNU General Public License
+   as published by the Free Software Foundation; version 2 of
+   the License.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
-   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA */
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+   02110-1301  USA */
 
 /*
   Replace strings in textfile
@@ -818,7 +820,7 @@ static short find_set(REP_SETS *sets,REP_SET *find)
       return (short) i;
     }
   }
-  return (short) i;			/* return new postion */
+  return (short) i;			/* return new position */
 }
 
 
@@ -841,7 +843,7 @@ static short find_found(FOUND_SET *found_set,uint table_offset,
   found_set[i].table_offset=table_offset;
   found_set[i].found_offset=found_offset;
   found_sets++;
-  return (short) (-i-2);			/* return new postion */
+  return (short) (-i-2);			/* return new position */
 }
 
 	/* Return 1 if regexp starts with \b or ends with \b*/
diff --git a/include/mysql.h b/include/mysql.h
index d3b24f0198a..1966caefdc1 100644
--- a/include/mysql.h
+++ b/include/mysql.h
@@ -573,6 +573,8 @@ typedef struct st_mysql_bind
 } MYSQL_BIND;
 
 
+struct st_mysql_stmt_extension;
+
 /* statement handler */
 typedef struct st_mysql_stmt
 {
@@ -618,7 +620,7 @@ typedef struct st_mysql_stmt
     metadata fields when doing mysql_stmt_store_result.
   */
   my_bool       update_max_length;     
-  void *extension;
+  struct st_mysql_stmt_extension *extension;
 } MYSQL_STMT;
 
 enum enum_stmt_attr_type
diff --git a/include/mysql.h.pp b/include/mysql.h.pp
index 169a8b30e2b..15ec563dfc2 100644
--- a/include/mysql.h.pp
+++ b/include/mysql.h.pp
@@ -512,6 +512,7 @@ typedef struct st_mysql_bind
   my_bool is_null_value;
   void *extension;
 } MYSQL_BIND;
+struct st_mysql_stmt_extension;
 typedef struct st_mysql_stmt
 {
   MEM_ROOT mem_root;
@@ -541,7 +542,7 @@ typedef struct st_mysql_stmt
   unsigned char bind_result_done;
   my_bool unbuffered_fetch_cancelled;
   my_bool update_max_length;
-  void *extension;
+  struct st_mysql_stmt_extension *extension;
 } MYSQL_STMT;
 enum enum_stmt_attr_type
 {
diff --git a/libmysql/libmysql.c b/libmysql/libmysql.c
index f802387cf9a..ec48720a2f5 100644
--- a/libmysql/libmysql.c
+++ b/libmysql/libmysql.c
@@ -94,6 +94,11 @@ sig_handler my_pipe_sig_handler(int sig);
 static my_bool mysql_client_init= 0;
 static my_bool org_my_init_done= 0;
 
+typedef struct st_mysql_stmt_extension
+{
+  MEM_ROOT fields_mem_root;
+} MYSQL_STMT_EXT;
+
 
 /*
   Initialize the MySQL client library
@@ -1480,11 +1485,16 @@ mysql_stmt_init(MYSQL *mysql)
   MYSQL_STMT *stmt;
   DBUG_ENTER("mysql_stmt_init");
 
-  if (!(stmt= (MYSQL_STMT *) my_malloc(sizeof(MYSQL_STMT),
+  if (!(stmt=
+          (MYSQL_STMT *) my_malloc(sizeof (MYSQL_STMT),
+                                   MYF(MY_WME | MY_ZEROFILL))) ||
+      !(stmt->extension=
+          (MYSQL_STMT_EXT *) my_malloc(sizeof (MYSQL_STMT_EXT),
                                        MYF(MY_WME | MY_ZEROFILL))))
   {
     set_mysql_error(mysql, CR_OUT_OF_MEMORY, unknown_sqlstate);
-    DBUG_RETURN(0);
+    my_free(stmt);
+    DBUG_RETURN(NULL);
   }
 
   init_alloc_root(&stmt->mem_root, 2048, 2048);
@@ -1499,6 +1509,8 @@ mysql_stmt_init(MYSQL *mysql)
   strmov(stmt->sqlstate, not_error_sqlstate);
   /* The rest of statement members was bzeroed inside malloc */
 
+  init_alloc_root(&stmt->extension->fields_mem_root, 2048, 0);
+
   DBUG_RETURN(stmt);
 }
 
@@ -1571,6 +1583,7 @@ mysql_stmt_prepare(MYSQL_STMT *stmt, const char *query, ulong length)
     stmt->bind_param_done= stmt->bind_result_done= FALSE;
     stmt->param_count= stmt->field_count= 0;
     free_root(&stmt->mem_root, MYF(MY_KEEP_PREALLOC));
+    free_root(&stmt->extension->fields_mem_root, MYF(0));
 
     int4store(buff, stmt->stmt_id);
 
@@ -1631,21 +1644,21 @@ mysql_stmt_prepare(MYSQL_STMT *stmt, const char *query, ulong length)
 static void alloc_stmt_fields(MYSQL_STMT *stmt)
 {
   MYSQL_FIELD *fields, *field, *end;
-  MEM_ROOT *alloc= &stmt->mem_root;
+  MEM_ROOT *fields_mem_root= &stmt->extension->fields_mem_root;
   MYSQL *mysql= stmt->mysql;
 
-  DBUG_ASSERT(mysql->field_count);
+  DBUG_ASSERT(stmt->field_count);
 
-  stmt->field_count= mysql->field_count;
+  free_root(fields_mem_root, MYF(0));
 
   /*
     Get the field information for non-select statements
     like SHOW and DESCRIBE commands
   */
-  if (!(stmt->fields= (MYSQL_FIELD *) alloc_root(alloc,
+  if (!(stmt->fields= (MYSQL_FIELD *) alloc_root(fields_mem_root,
 						 sizeof(MYSQL_FIELD) *
 						 stmt->field_count)) ||
-      !(stmt->bind= (MYSQL_BIND *) alloc_root(alloc,
+      !(stmt->bind= (MYSQL_BIND *) alloc_root(fields_mem_root,
 					      sizeof(MYSQL_BIND) *
 					      stmt->field_count)))
   {
@@ -1658,18 +1671,36 @@ static void alloc_stmt_fields(MYSQL_STMT *stmt)
        field && fields < end; fields++, field++)
   {
     *field= *fields; /* To copy all numeric parts. */
-    field->catalog=   strmake_root(alloc, fields->catalog,
+    field->catalog=   strmake_root(fields_mem_root,
+                                   fields->catalog,
                                    fields->catalog_length);
-    field->db=        strmake_root(alloc, fields->db, fields->db_length);
-    field->table=     strmake_root(alloc, fields->table, fields->table_length);
-    field->org_table= strmake_root(alloc, fields->org_table,
+    field->db=        strmake_root(fields_mem_root,
+                                   fields->db,
+                                   fields->db_length);
+    field->table=     strmake_root(fields_mem_root,
+                                   fields->table,
+                                   fields->table_length);
+    field->org_table= strmake_root(fields_mem_root,
+                                   fields->org_table,
                                    fields->org_table_length);
-    field->name=      strmake_root(alloc, fields->name, fields->name_length);
-    field->org_name=  strmake_root(alloc, fields->org_name,
+    field->name=      strmake_root(fields_mem_root,
+                                   fields->name,
+                                   fields->name_length);
+    field->org_name=  strmake_root(fields_mem_root,
+                                   fields->org_name,
                                    fields->org_name_length);
-    field->def=       fields->def ? strmake_root(alloc, fields->def,
-                                                 fields->def_length) : 0;
-    field->def_length= field->def ? fields->def_length : 0;
+    if (fields->def)
+    {
+      field->def= strmake_root(fields_mem_root,
+                               fields->def,
+                               fields->def_length);
+      field->def_length= fields->def_length;
+    }
+    else
+    {
+      field->def= NULL;
+      field->def_length= 0;
+    }
     field->extension= 0; /* Avoid dangling links. */
     field->max_length= 0; /* max_length is set in mysql_stmt_store_result() */
   }
@@ -2387,6 +2418,9 @@ static void reinit_result_set_metadata(MYSQL_STMT *stmt)
       prepared statements can't send result set metadata for these queries
       on prepare stage. Read it now.
     */
+
+    stmt->field_count= stmt->mysql->field_count;
+
     alloc_stmt_fields(stmt);
   }
   else
@@ -2404,7 +2438,7 @@ static void reinit_result_set_metadata(MYSQL_STMT *stmt)
       previous branch always works.
       TODO: send metadata only when it's really necessary and add a warning
       'Metadata changed' when it's sent twice.
-      */
+    */
     update_stmt_fields(stmt);
   }
 }
@@ -4605,6 +4639,7 @@ my_bool STDCALL mysql_stmt_close(MYSQL_STMT *stmt)
 
   free_root(&stmt->result.alloc, MYF(0));
   free_root(&stmt->mem_root, MYF(0));
+  free_root(&stmt->extension->fields_mem_root, MYF(0));
 
   if (mysql)
   {
@@ -4639,6 +4674,7 @@ my_bool STDCALL mysql_stmt_close(MYSQL_STMT *stmt)
     }
   }
 
+  my_free(stmt->extension);
   my_free(stmt);
 
   DBUG_RETURN(test(rc));
@@ -4805,16 +4841,13 @@ int STDCALL mysql_stmt_next_result(MYSQL_STMT *stmt)
 
   stmt->state= MYSQL_STMT_EXECUTE_DONE;
   stmt->bind_result_done= FALSE;
+  stmt->field_count= mysql->field_count;
 
   if (mysql->field_count)
   {
     alloc_stmt_fields(stmt);
     prepare_to_fetch_result(stmt);
   }
-  else
-  {
-    stmt->field_count= mysql->field_count;
-  }
 
   DBUG_RETURN(0);
 }
diff --git a/mysql-test/extra/rpl_tests/check_type.inc b/mysql-test/extra/rpl_tests/check_type.inc
index 63491d81da4..97300753d38 100644
--- a/mysql-test/extra/rpl_tests/check_type.inc
+++ b/mysql-test/extra/rpl_tests/check_type.inc
@@ -11,18 +11,28 @@
 #                      on the slave)
 #    $can_convert      True if conversion shall work, false if it
 #                      shall generate an error 
+#    $engine_type      The storage engine to be used for storing table
+#                      on both master and slave
 
+if (!$engine_type)
+{
+  # Use the default storage engine
+  let $engine_type=`SELECT @@storage_engine`;
+}
 
 connection master;
 disable_warnings;
 DROP TABLE IF EXISTS t1;
 enable_warnings;
-eval CREATE TABLE t1 (a $source_type);
+eval CREATE TABLE t1(
+  pk INT NOT NULL PRIMARY KEY,
+  a $source_type
+) ENGINE=$engine_type;
 sync_slave_with_master;
 eval ALTER TABLE t1 MODIFY a $target_type;
 
 connection master;
-eval INSERT INTO t1 VALUES($source_value);
+eval INSERT INTO t1 VALUES(1, $source_value);
 if ($can_convert) {
   sync_slave_with_master;
   eval SELECT a = $target_value into @compare FROM t1;
diff --git a/mysql-test/include/wait_show_condition.inc b/mysql-test/include/wait_show_condition.inc
index 68e05ce4644..ae1600a7e30 100644
--- a/mysql-test/include/wait_show_condition.inc
+++ b/mysql-test/include/wait_show_condition.inc
@@ -31,6 +31,21 @@
 # Created: 2009-02-18 mleich
 #
 
+if (!$condition)
+{
+  --die ERROR IN TEST: the "condition" variable must be set
+}
+
+if (!$field)
+{
+  --die ERROR IN TEST: the "field" variable must be set
+}
+
+if (!$show_statement)
+{
+  --die ERROR IN TEST: the "show_statement" variable must be set
+}
+
 let $max_run_time= 30;
 if ($wait_timeout)
 {
diff --git a/mysql-test/r/archive.result b/mysql-test/r/archive.result
index 231b7acb5b4..aacaff30898 100644
--- a/mysql-test/r/archive.result
+++ b/mysql-test/r/archive.result
@@ -12807,3 +12807,19 @@ DROP TABLE t1;
 #
 CREATE TABLE `a/../`(a INT) ENGINE=ARCHIVE;
 DROP TABLE `a/../`;
+#
+# BUG#57162 - valgrind errors, random data when returning
+#             ordered data from archive tables
+#
+SET sort_buffer_size=32804;
+CREATE TABLE t1(a INT, b CHAR(255), c CHAR(255), d CHAR(255),
+e CHAR(255), f INT) ENGINE=ARCHIVE DEFAULT CHARSET utf8;
+INSERT INTO t1 VALUES(-1,'b','c','d','e',1);
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT t1.* FROM t1,t1 t2,t1 t3,t1 t4,t1 t5,t1 t6;
+SELECT * FROM t1 ORDER BY f LIMIT 1;
+a	b	c	d	e	f
+-1	b	c	d	e	1
+DROP TABLE t1;
+SET sort_buffer_size=DEFAULT;
diff --git a/mysql-test/r/cast.result b/mysql-test/r/cast.result
index 3e1ea824db5..89cbda9847c 100644
--- a/mysql-test/r/cast.result
+++ b/mysql-test/r/cast.result
@@ -451,4 +451,21 @@ SELECT CONVERT(t2.a USING UTF8) FROM t1, t1 t2 LIMIT 1
 1
 1
 DROP TABLE t1;
+#
+# Bug #11765023: 57934: DOS POSSIBLE SINCE BINARY CASTING 
+#   DOESN'T ADHERE TO MAX_ALLOWED_PACKET
+SET @@GLOBAL.max_allowed_packet=2048;
+Warnings:
+Warning	1708	The value of 'max_allowed_packet' should be no less than the value of 'net_buffer_length'
+SELECT CONVERT('a', BINARY(2049));
+CONVERT('a', BINARY(2049))
+NULL
+Warnings:
+Warning	1301	Result of cast_as_binary() was larger than max_allowed_packet (2048) - truncated
+SELECT CONVERT('a', CHAR(2049));
+CONVERT('a', CHAR(2049))
+NULL
+Warnings:
+Warning	1301	Result of cast_as_char() was larger than max_allowed_packet (2048) - truncated
+SET @@GLOBAL.max_allowed_packet=default;
 End of 5.1 tests
diff --git a/mysql-test/r/ctype_binary.result b/mysql-test/r/ctype_binary.result
index 291dcfdf92a..a80c52ebf9d 100644
--- a/mysql-test/r/ctype_binary.result
+++ b/mysql-test/r/ctype_binary.result
@@ -2046,7 +2046,7 @@ create table t2 as select concat(a) from t1;
 show create table t2;
 Table	Create Table
 t2	CREATE TABLE `t2` (
-  `concat(a)` varbinary(2) DEFAULT NULL
+  `concat(a)` varbinary(4) DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=latin1
 drop table t1, t2;
 create table t1 (a year);
@@ -2355,7 +2355,7 @@ insert into t1 values (1);
 create view v1(a) as select concat(a) from t1;
 show columns from v1;
 Field	Type	Null	Key	Default	Extra
-a	varbinary(2)	YES		NULL	
+a	varbinary(4)	YES		NULL	
 select hex(a) from v1;
 hex(a)
 3031
diff --git a/mysql-test/r/ctype_cp1251.result b/mysql-test/r/ctype_cp1251.result
index 58f023b2b79..cff4f6b7442 100644
--- a/mysql-test/r/ctype_cp1251.result
+++ b/mysql-test/r/ctype_cp1251.result
@@ -2438,7 +2438,7 @@ create table t2 as select concat(a) from t1;
 show create table t2;
 Table	Create Table
 t2	CREATE TABLE `t2` (
-  `concat(a)` varchar(2) CHARACTER SET cp1251 DEFAULT NULL
+  `concat(a)` varchar(4) CHARACTER SET cp1251 DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=latin1
 drop table t1, t2;
 create table t1 (a year);
@@ -2747,7 +2747,7 @@ insert into t1 values (1);
 create view v1(a) as select concat(a) from t1;
 show columns from v1;
 Field	Type	Null	Key	Default	Extra
-a	varchar(2)	YES		NULL	
+a	varchar(4)	YES		NULL	
 select hex(a) from v1;
 hex(a)
 3031
diff --git a/mysql-test/r/ctype_latin1.result b/mysql-test/r/ctype_latin1.result
index 2ecb9d6aeba..12a76302397 100644
--- a/mysql-test/r/ctype_latin1.result
+++ b/mysql-test/r/ctype_latin1.result
@@ -2465,7 +2465,7 @@ create table t2 as select concat(a) from t1;
 show create table t2;
 Table	Create Table
 t2	CREATE TABLE `t2` (
-  `concat(a)` varchar(2) DEFAULT NULL
+  `concat(a)` varchar(4) DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=latin1
 drop table t1, t2;
 create table t1 (a year);
@@ -2774,7 +2774,7 @@ insert into t1 values (1);
 create view v1(a) as select concat(a) from t1;
 show columns from v1;
 Field	Type	Null	Key	Default	Extra
-a	varchar(2)	YES		NULL	
+a	varchar(4)	YES		NULL	
 select hex(a) from v1;
 hex(a)
 3031
diff --git a/mysql-test/r/ctype_ucs.result b/mysql-test/r/ctype_ucs.result
index e687822c235..dc922f8490a 100644
--- a/mysql-test/r/ctype_ucs.result
+++ b/mysql-test/r/ctype_ucs.result
@@ -3299,7 +3299,7 @@ create table t2 as select concat(a) from t1;
 show create table t2;
 Table	Create Table
 t2	CREATE TABLE `t2` (
-  `concat(a)` varchar(2) CHARACTER SET ucs2 DEFAULT NULL
+  `concat(a)` varchar(4) CHARACTER SET ucs2 DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=latin1
 drop table t1, t2;
 create table t1 (a year);
@@ -3608,7 +3608,7 @@ insert into t1 values (1);
 create view v1(a) as select concat(a) from t1;
 show columns from v1;
 Field	Type	Null	Key	Default	Extra
-a	varchar(2)	YES		NULL	
+a	varchar(4)	YES		NULL	
 select hex(a) from v1;
 hex(a)
 00300031
diff --git a/mysql-test/r/ctype_utf8.result b/mysql-test/r/ctype_utf8.result
index db981fbe298..cfbf6cee3a2 100644
--- a/mysql-test/r/ctype_utf8.result
+++ b/mysql-test/r/ctype_utf8.result
@@ -4177,7 +4177,7 @@ create table t2 as select concat(a) from t1;
 show create table t2;
 Table	Create Table
 t2	CREATE TABLE `t2` (
-  `concat(a)` varchar(2) CHARACTER SET utf8 DEFAULT NULL
+  `concat(a)` varchar(4) CHARACTER SET utf8 DEFAULT NULL
 ) ENGINE=MyISAM DEFAULT CHARSET=latin1
 drop table t1, t2;
 create table t1 (a year);
@@ -4486,7 +4486,7 @@ insert into t1 values (1);
 create view v1(a) as select concat(a) from t1;
 show columns from v1;
 Field	Type	Null	Key	Default	Extra
-a	varchar(2)	YES		NULL	
+a	varchar(4)	YES		NULL	
 select hex(a) from v1;
 hex(a)
 3031
diff --git a/mysql-test/r/distinct.result b/mysql-test/r/distinct.result
index b1cb70fa43c..74f2c19c8fe 100644
--- a/mysql-test/r/distinct.result
+++ b/mysql-test/r/distinct.result
@@ -794,3 +794,14 @@ DROP TABLE t1;
 SET @@sort_buffer_size = @old_sort_buffer_size;
 SET @@max_heap_table_size = @old_max_heap_table_size;
 End of 5.1 tests
+#
+# Bug #11744875: 4082: integer lengths cause truncation with distinct concat and innodb
+#
+CREATE TABLE t1 (a INT(1), b INT(1));
+INSERT INTO t1 VALUES (1111, 2222), (3333, 4444);
+SELECT DISTINCT CONCAT(a,b) AS c FROM t1 ORDER BY 1;
+c
+11112222
+33334444
+DROP TABLE t1;
+End of 5.5 tests
diff --git a/mysql-test/r/events_1.result b/mysql-test/r/events_1.result
index e068158e6ce..29e81975c87 100644
--- a/mysql-test/r/events_1.result
+++ b/mysql-test/r/events_1.result
@@ -1,3 +1,4 @@
+call mtr.add_suppression("Column count of mysql.event is wrong. Expected .*, found .*\. The table is probably corrupted");
 drop database if exists events_test;
 drop database if exists db_x;
 drop database if exists mysqltest_db2;
@@ -259,33 +260,36 @@ events_test	intact_check	root@localhost	SYSTEM	RECURRING	NULL	10	#	#	NULL	ENABLE
 Try to alter mysql.event: the server should fail to load
 event information after mysql.event was tampered with.
 
-First, let's add a column to the end and make sure everything
-works as before
+First, let's add a column to the end and check the error is emitted.
 
 ALTER TABLE mysql.event ADD dummy INT;
 SHOW EVENTS;
-Db	Name	Definer	Time zone	Type	Execute at	Interval value	Interval field	Starts	Ends	Status	Originator	character_set_client	collation_connection	Database Collation
-events_test	intact_check	root@localhost	SYSTEM	RECURRING	NULL	10	#	#	NULL	ENABLED	1	latin1	latin1_swedish_ci	latin1_swedish_ci
+ERROR HY000: Failed to open mysql.event
 SELECT event_name FROM INFORMATION_SCHEMA.events;
-event_name
-intact_check
+ERROR HY000: Failed to open mysql.event
 SHOW CREATE EVENT intact_check;
-Event	sql_mode	time_zone	Create Event	character_set_client	collation_connection	Database Collation
-intact_check		SYSTEM	CREATE DEFINER=`root`@`localhost` EVENT `intact_check` ON SCHEDULE EVERY 10 HOUR STARTS '#' ON COMPLETION NOT PRESERVE ENABLE DO SELECT "nothing"	latin1	latin1_swedish_ci	latin1_swedish_ci
+ERROR HY000: Failed to open mysql.event
 DROP EVENT no_such_event;
-ERROR HY000: Unknown event 'no_such_event'
+ERROR HY000: Failed to open mysql.event
 CREATE EVENT intact_check_1 ON SCHEDULE EVERY 5 HOUR DO SELECT 5;
+ERROR HY000: Failed to open mysql.event
 ALTER EVENT intact_check_1 ON SCHEDULE EVERY 8 HOUR DO SELECT 8;
+ERROR HY000: Failed to open mysql.event
 ALTER EVENT intact_check_1 RENAME TO intact_check_2;
+ERROR HY000: Failed to open mysql.event
 DROP EVENT intact_check_1;
-ERROR HY000: Unknown event 'intact_check_1'
+ERROR HY000: Failed to open mysql.event
 DROP EVENT intact_check_2;
+ERROR HY000: Failed to open mysql.event
 DROP EVENT intact_check;
+ERROR HY000: Failed to open mysql.event
 DROP DATABASE IF EXISTS mysqltest_no_such_database;
 Warnings:
 Note	1008	Can't drop database 'mysqltest_no_such_database'; database doesn't exist
 CREATE DATABASE mysqltest_db2;
 DROP DATABASE mysqltest_db2;
+Warnings:
+Error	1545	Failed to open mysql.event
 SELECT @@event_scheduler;
 @@event_scheduler
 OFF
@@ -294,6 +298,7 @@ Variable_name	Value
 event_scheduler	OFF
 SET GLOBAL event_scheduler=OFF;
 ALTER TABLE mysql.event DROP dummy;
+DROP EVENT intact_check;
 CREATE EVENT intact_check ON SCHEDULE EVERY 10 HOUR DO SELECT "nothing";
 
 Now let's add a column to the first position: the server
@@ -301,30 +306,32 @@ expects to see event schema name there
 
 ALTER TABLE mysql.event ADD dummy INT FIRST;
 SHOW EVENTS;
-ERROR HY000: Cannot load from mysql.event. The table is probably corrupted
+ERROR HY000: Failed to open mysql.event
 SELECT event_name FROM INFORMATION_SCHEMA.events;
-ERROR HY000: Cannot load from mysql.event. The table is probably corrupted
+ERROR HY000: Failed to open mysql.event
 SHOW CREATE EVENT intact_check;
-ERROR HY000: Unknown event 'intact_check'
+ERROR HY000: Failed to open mysql.event
 DROP EVENT no_such_event;
-ERROR HY000: Unknown event 'no_such_event'
+ERROR HY000: Failed to open mysql.event
 CREATE EVENT intact_check_1 ON SCHEDULE EVERY 5 HOUR DO SELECT 5;
-ERROR HY000: Failed to store event name. Error code 2 from storage engine.
+ERROR HY000: Failed to open mysql.event
 ALTER EVENT intact_check_1 ON SCHEDULE EVERY 8 HOUR DO SELECT 8;
-ERROR HY000: Unknown event 'intact_check_1'
+ERROR HY000: Failed to open mysql.event
 ALTER EVENT intact_check_1 RENAME TO intact_check_2;
-ERROR HY000: Unknown event 'intact_check_1'
+ERROR HY000: Failed to open mysql.event
 DROP EVENT intact_check_1;
-ERROR HY000: Unknown event 'intact_check_1'
+ERROR HY000: Failed to open mysql.event
 DROP EVENT intact_check_2;
-ERROR HY000: Unknown event 'intact_check_2'
+ERROR HY000: Failed to open mysql.event
 DROP EVENT intact_check;
-ERROR HY000: Unknown event 'intact_check'
+ERROR HY000: Failed to open mysql.event
 DROP DATABASE IF EXISTS mysqltest_no_such_database;
 Warnings:
 Note	1008	Can't drop database 'mysqltest_no_such_database'; database doesn't exist
 CREATE DATABASE mysqltest_db2;
 DROP DATABASE mysqltest_db2;
+Warnings:
+Error	1545	Failed to open mysql.event
 SELECT @@event_scheduler;
 @@event_scheduler
 OFF
@@ -345,29 +352,32 @@ Drop some columns and try more checks.
 
 ALTER TABLE mysql.event DROP comment, DROP starts;
 SHOW EVENTS;
-ERROR HY000: Cannot load from mysql.event. The table is probably corrupted
+ERROR HY000: Failed to open mysql.event
 SELECT event_name FROM INFORMATION_SCHEMA.EVENTS;
-ERROR HY000: Cannot load from mysql.event. The table is probably corrupted
+ERROR HY000: Failed to open mysql.event
 SHOW CREATE EVENT intact_check;
-ERROR HY000: Cannot load from mysql.event. The table is probably corrupted
+ERROR HY000: Failed to open mysql.event
 DROP EVENT no_such_event;
-ERROR HY000: Unknown event 'no_such_event'
+ERROR HY000: Failed to open mysql.event
 CREATE EVENT intact_check_1 ON SCHEDULE EVERY 5 HOUR DO SELECT 5;
-ERROR HY000: Column count of mysql.event is wrong. Expected 22, found 20. The table is probably corrupted
+ERROR HY000: Failed to open mysql.event
 ALTER EVENT intact_check_1 ON SCHEDULE EVERY 8 HOUR DO SELECT 8;
-ERROR HY000: Unknown event 'intact_check_1'
+ERROR HY000: Failed to open mysql.event
 ALTER EVENT intact_check_1 RENAME TO intact_check_2;
-ERROR HY000: Unknown event 'intact_check_1'
+ERROR HY000: Failed to open mysql.event
 DROP EVENT intact_check_1;
-ERROR HY000: Unknown event 'intact_check_1'
+ERROR HY000: Failed to open mysql.event
 DROP EVENT intact_check_2;
-ERROR HY000: Unknown event 'intact_check_2'
+ERROR HY000: Failed to open mysql.event
 DROP EVENT intact_check;
+ERROR HY000: Failed to open mysql.event
 DROP DATABASE IF EXISTS mysqltest_no_such_database;
 Warnings:
 Note	1008	Can't drop database 'mysqltest_no_such_database'; database doesn't exist
 CREATE DATABASE mysqltest_db2;
 DROP DATABASE mysqltest_db2;
+Warnings:
+Error	1545	Failed to open mysql.event
 SELECT @@event_scheduler;
 @@event_scheduler
 OFF
@@ -425,4 +435,42 @@ CREATE TABLE mysql.event like event_like;
 DROP TABLE event_like;
 SHOW EVENTS;
 Db	Name	Definer	Time zone	Type	Execute at	Interval value	Interval field	Starts	Ends	Status	Originator	character_set_client	collation_connection	Database Collation
+
+#
+# Bug#12394306: the sever may crash if mysql.event is corrupted
+#
+
+CREATE EVENT ev1 ON SCHEDULE EVERY 5 HOUR DO SELECT 5;
+ALTER EVENT ev1 ON SCHEDULE EVERY 8 HOUR DO SELECT 8;
+
+CREATE TABLE event_original LIKE mysql.event;
+INSERT INTO event_original SELECT * FROM mysql.event;
+
+ALTER TABLE mysql.event MODIFY modified CHAR(1);
+Warnings:
+Warning	1265	Data truncated for column 'modified' at row 1
+
+SHOW EVENTS;
+ERROR HY000: Failed to open mysql.event
+
+SELECT event_name, created, last_altered FROM information_schema.events;
+ERROR HY000: Failed to open mysql.event
+
+CREATE EVENT ev2 ON SCHEDULE EVERY 5 HOUR DO SELECT 5;
+ERROR HY000: Failed to open mysql.event
+
+ALTER EVENT ev1 ON SCHEDULE EVERY 9 HOUR DO SELECT 9;
+ERROR HY000: Failed to open mysql.event
+
+DROP TABLE mysql.event;
+RENAME TABLE event_original TO mysql.event;
+
+DROP EVENT ev1;
+
+SHOW EVENTS;
+Db	Name	Definer	Time zone	Type	Execute at	Interval value	Interval field	Starts	Ends	Status	Originator	character_set_client	collation_connection	Database Collation
+
+# 
+# End of tests
+#
 drop database events_test;
diff --git a/mysql-test/r/events_restart.result b/mysql-test/r/events_restart.result
index 4db61d357ce..6a751fa29f8 100644
--- a/mysql-test/r/events_restart.result
+++ b/mysql-test/r/events_restart.result
@@ -1,3 +1,4 @@
+call mtr.add_suppression("Column count of mysql.event is wrong. Expected .*, found .*\. The table is probably corrupted");
 set global event_scheduler=off;
 drop database if exists events_test;
 create database events_test;
@@ -52,6 +53,8 @@ Warnings:
 Note	1008	Can't drop database 'mysqltest_database_not_exists'; database doesn't exist
 create database mysqltest_db1;
 drop database mysqltest_db1;
+Warnings:
+Error	1545	Failed to open mysql.event
 Restore the original mysql.event table
 drop table mysql.event;
 rename table event_like to mysql.event;
diff --git a/mysql-test/r/explain.result b/mysql-test/r/explain.result
index b9ae362f6cd..b8f791b27f4 100644
--- a/mysql-test/r/explain.result
+++ b/mysql-test/r/explain.result
@@ -180,7 +180,6 @@ ERROR 42000: Mixing of GROUP columns (MIN(),MAX(),COUNT(),...) with no GROUP col
 SHOW WARNINGS;
 Level	Code	Message
 Error	1140	Mixing of GROUP columns (MIN(),MAX(),COUNT(),...) with no GROUP columns is illegal if there is no GROUP BY clause
-Note	1003	select 1 AS `1` from `test`.`t1` where <not>(<exists>(...))
 SET SESSION sql_mode=@old_sql_mode;
 DROP TABLE t1;
 End of 5.0 tests.
@@ -318,3 +317,17 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 DEALLOCATE PREPARE stmt;
 DROP TABLE t1;
 End of 5.1 tests.
+#
+# Bug#11829785 EXPLAIN EXTENDED CRASH WITH RIGHT OUTER JOIN, SUBQUERIES
+#
+CREATE TABLE t1(a INT);
+INSERT INTO t1 VALUES (0), (0);
+PREPARE s FROM 
+'EXPLAIN EXTENDED
+SELECT SUBSTRING(1, (SELECT 1 FROM t1 a1 RIGHT OUTER JOIN t1 ON 0)) AS d
+FROM t1 WHERE 0 > ANY (SELECT @a FROM t1)';
+EXECUTE s;
+ERROR 21000: Subquery returns more than 1 row
+DEALLOCATE PREPARE s;
+DROP TABLE t1;
+#
diff --git a/mysql-test/r/func_gconcat.result b/mysql-test/r/func_gconcat.result
index 01b93df6894..6c400a8ddcc 100644
--- a/mysql-test/r/func_gconcat.result
+++ b/mysql-test/r/func_gconcat.result
@@ -1056,7 +1056,6 @@ ERROR HY000: Only constant XPATH queries are supported
 SHOW WARNINGS;
 Level	Code	Message
 Error	1105	Only constant XPATH queries are supported
-Note	1003	select updatexml('1',`test`.`t1`.`a`,'1') AS `UPDATEXML('1', a, '1')` from `test`.`t1` order by (select group_concat(1 separator ',') from `test`.`t1`)
 DROP TABLE t1;
 End of 5.1 tests
 DROP TABLE IF EXISTS t1, t2;
diff --git a/mysql-test/r/gis.result b/mysql-test/r/gis.result
index 22cb6d29b2c..bfd0ddccb90 100644
--- a/mysql-test/r/gis.result
+++ b/mysql-test/r/gis.result
@@ -1043,6 +1043,10 @@ create spatial index i on t1 (a);
 ERROR 42000: A SPATIAL index may only contain a geometrical type column
 drop table t1;
 End of 5.1 tests
+CREATE TABLE t0 (a BINARY(32) NOT NULL);
+CREATE SPATIAL INDEX i on t0 (a);
+ERROR 42000: A SPATIAL index may only contain a geometrical type column
+INSERT INTO t0 VALUES (1);
 CREATE TABLE t1(
 col0 BINARY NOT NULL,
 col2 TIMESTAMP,
@@ -1071,5 +1075,5 @@ col2 LINESTRING,
 SPATIAL INDEX i1 (col1, col2)
 );
 ERROR HY000: Incorrect arguments to SPATIAL INDEX
-DROP TABLE t1;
-DROP TABLE t2;
+DROP TABLE t0, t1, t2;
+End of 5.5 tests
diff --git a/mysql-test/r/metadata.result b/mysql-test/r/metadata.result
index 480cec792c0..3418348854f 100644
--- a/mysql-test/r/metadata.result
+++ b/mysql-test/r/metadata.result
@@ -126,7 +126,7 @@ renamed
 1
 select * from v3 where renamed=1 group by renamed;
 Catalog	Database	Table	Table_alias	Column	Column_alias	Type	Length	Max length	Is_null	Flags	Decimals	Charsetnr
-def		v3	v3	renamed	renamed	8	11	0	Y	32896	0	63
+def		v3	v3	renamed	renamed	8	12	0	Y	32896	0	63
 renamed
 drop table t1;
 drop view v1,v2,v3;
diff --git a/mysql-test/r/mysqlbinlog_base64.result b/mysql-test/r/mysqlbinlog_base64.result
index c5e1e2f8ca1..72d49c16cc8 100644
--- a/mysql-test/r/mysqlbinlog_base64.result
+++ b/mysql-test/r/mysqlbinlog_base64.result
@@ -109,3 +109,13 @@ count(*)
 35840
 drop table t1;
 drop table t2;
+RESET MASTER;
+USE test;
+SET @old_binlog_format= @@binlog_format;
+SET SESSION binlog_format=ROW;
+CREATE TABLE t1(c1 INT);
+INSERT INTO t1 VALUES (1);
+FLUSH LOGS;
+DROP TABLE t1;
+SET SESSION binlog_format= @old_binlog_format;
+RESET MASTER;
diff --git a/mysql-test/r/mysqldump.result b/mysql-test/r/mysqldump.result
index c204947a763..8f6add75fd3 100644
--- a/mysql-test/r/mysqldump.result
+++ b/mysql-test/r/mysqldump.result
@@ -4626,7 +4626,7 @@ DELIMITER ;
 /*!50003 SET collation_connection  = @saved_col_connection */ ;
 ALTER DATABASE `test-database` CHARACTER SET utf8 COLLATE utf8_unicode_ci ;
 DROP DATABASE `test-database`;
-USE `test`;
+USE test;
 #
 # End of 5.1 tests
 #
diff --git a/mysql-test/r/sp.result b/mysql-test/r/sp.result
index f9b338dd414..6b4215e6b09 100644
--- a/mysql-test/r/sp.result
+++ b/mysql-test/r/sp.result
@@ -7452,6 +7452,24 @@ c1
 # Cleanup
 drop table t1;
 drop procedure p1;
+# 
+# BUG#11766234: 59299: ASSERT (TABLE_REF->TABLE || TABLE_REF->VIEW) 
+#               FAILS IN SET_FIELD_ITERATOR
+# 
+CREATE TABLE t1 (a INT);
+CREATE TABLE t2 (a INT);
+CREATE VIEW v1 AS SELECT a FROM t2;
+CREATE PROCEDURE proc() SELECT * FROM t1 NATURAL JOIN v1;
+ALTER TABLE t2 CHANGE COLUMN a b CHAR;
+
+CALL proc();
+ERROR HY000: View 'test.v1' references invalid table(s) or column(s) or function(s) or definer/invoker of view lack rights to use them
+CALL proc();
+ERROR HY000: View 'test.v1' references invalid table(s) or column(s) or function(s) or definer/invoker of view lack rights to use them
+
+DROP TABLE t1,t2;
+DROP VIEW v1;
+DROP PROCEDURE proc;
 
 # --
 # -- Bug 11765684 - 58674: SP-cache does not detect changes in
diff --git a/mysql-test/r/subselect3.result b/mysql-test/r/subselect3.result
index 2962a12d9a2..4e18a81b534 100644
--- a/mysql-test/r/subselect3.result
+++ b/mysql-test/r/subselect3.result
@@ -865,9 +865,6 @@ Level	Code	Message
 Note	1276	Field or reference 'test.t1.a' of SELECT #3 was resolved in SELECT #2
 Note	1276	Field or reference 'test.t1.c' of SELECT #3 was resolved in SELECT #2
 Error	1054	Unknown column 'c' in 'field list'
-Note	1003	select `c` AS `c` from (select (select count(`test`.`t1`.`a`) from dual group by `c`) AS `(SELECT COUNT(a) FROM 
-(SELECT COUNT(b) FROM t1) AS x GROUP BY c
-)` from `test`.`t1` group by `test`.`t1`.`b`) `y`
 DROP TABLE t1;
 End of 5.0 tests
 create table t0 (a int);
diff --git a/mysql-test/r/trigger.result b/mysql-test/r/trigger.result
index 11e0d7313b7..e759153eaaf 100644
--- a/mysql-test/r/trigger.result
+++ b/mysql-test/r/trigger.result
@@ -2208,4 +2208,22 @@ trigger_name
 # Clean-up.
 drop temporary table t1;
 drop table t1;
-End of 6.0 tests.
+
+#
+# Bug #12362125: SP INOUT HANDLING IS BROKEN FOR TEXT TYPE.
+#
+DROP TABLE IF EXISTS t1;
+CREATE TABLE t1(c TEXT);
+CREATE TRIGGER t1_bi BEFORE INSERT ON t1 FOR EACH ROW
+BEGIN
+DECLARE v TEXT;
+SET v = 'aaa';
+SET NEW.c = v;
+END|
+INSERT INTO t1 VALUES('qazwsxedc');
+SELECT c FROM t1;
+c
+aaa
+DROP TABLE t1;
+
+End of 5.5 tests.
diff --git a/mysql-test/r/type_newdecimal.result b/mysql-test/r/type_newdecimal.result
index 819e41f41c5..c9db73c5f85 100644
--- a/mysql-test/r/type_newdecimal.result
+++ b/mysql-test/r/type_newdecimal.result
@@ -1920,4 +1920,17 @@ SELECT SUM(DISTINCT a) FROM t1;
 SUM(DISTINCT a)
 0.0000
 DROP TABLE t1;
+#
+# Bug#55436: buffer overflow in debug binary of dbug_buff in
+#            Field_new_decimal::store_value
+#
+SET SQL_MODE='';
+CREATE TABLE t1(f1 DECIMAL(44,24)) ENGINE=MYISAM;
+INSERT INTO t1 SET f1 = -64878E-85;
+Warnings:
+Note	1265	Data truncated for column 'f1' at row 1
+SELECT f1 FROM t1;
+f1
+0.000000000000000000000000
+DROP TABLE IF EXISTS t1;
 End of 5.1 tests
diff --git a/mysql-test/r/type_ranges.result b/mysql-test/r/type_ranges.result
index ac3d52b9ead..d99c2363d62 100644
--- a/mysql-test/r/type_ranges.result
+++ b/mysql-test/r/type_ranges.result
@@ -271,7 +271,7 @@ drop table t2;
 create table t2 (primary key (auto)) select auto+1 as auto,1 as t1, 'a' as t2, repeat('a',256) as t3, binary repeat('b',256) as t4, repeat('a',4096) as t5, binary repeat('b',4096) as t6, '' as t7, binary '' as t8 from t1;
 show full columns from t2;
 Field	Type	Collation	Null	Key	Default	Extra	Privileges	Comment
-auto	int(6) unsigned	NULL	NO	PRI	0		#	
+auto	int(11) unsigned	NULL	NO	PRI	0		#	
 t1	int(1)	NULL	NO		0		#	
 t2	varchar(1)	latin1_swedish_ci	NO				#	
 t3	varchar(256)	latin1_swedish_ci	NO				#	
diff --git a/mysql-test/suite/binlog/r/binlog_stm_mix_innodb_myisam.result b/mysql-test/suite/binlog/r/binlog_stm_mix_innodb_myisam.result
index 20d82557122..da2e24506fd 100644
--- a/mysql-test/suite/binlog/r/binlog_stm_mix_innodb_myisam.result
+++ b/mysql-test/suite/binlog/r/binlog_stm_mix_innodb_myisam.result
@@ -698,7 +698,7 @@ master-bin.000001	#	Query	#	#	BEGIN
 master-bin.000001	#	Intvar	#	#	INSERT_ID=10
 master-bin.000001	#	Begin_load_query	#	#	;file_id=#;block_len=#
 master-bin.000001	#	Intvar	#	#	INSERT_ID=10
-master-bin.000001	#	Execute_load_query	#	#	use `test`; LOAD DATA INFILE '../../std_data/rpl_loaddata.dat' INTO TABLE `t4` FIELDS TERMINATED BY '\t' ENCLOSED BY '' ESCAPED BY '\\' LINES TERMINATED BY '\n' (`a`, @b) SET `b`=((@b) + `bug27417`(2)) ;file_id=#
+master-bin.000001	#	Execute_load_query	#	#	use `test`; LOAD DATA INFILE '../../std_data/rpl_loaddata.dat' INTO TABLE `t4` FIELDS TERMINATED BY '\t' ENCLOSED BY '' ESCAPED BY '\\' LINES TERMINATED BY '\n' (`a`, @b) SET `b`= @b + bug27417(2) ;file_id=#
 master-bin.000001	#	Query	#	#	ROLLBACK
 /* the output must denote there is the query */;
 drop trigger trg_del_t2;
@@ -950,7 +950,7 @@ master-bin.000001	#	User var	#	#	@`b`=_latin1 0x3135 COLLATE latin1_swedish_ci
 master-bin.000001	#	Begin_load_query	#	#	;file_id=#;block_len=#
 master-bin.000001	#	Intvar	#	#	INSERT_ID=10
 master-bin.000001	#	User var	#	#	@`b`=_latin1 0x3135 COLLATE latin1_swedish_ci
-master-bin.000001	#	Execute_load_query	#	#	use `test`; LOAD DATA INFILE '../../std_data/rpl_loaddata.dat' INTO TABLE `t4` FIELDS TERMINATED BY '\t' ENCLOSED BY '' ESCAPED BY '\\' LINES TERMINATED BY '\n' (`a`, @b) SET `b`=((@b) + `bug27417`(2)) ;file_id=#
+master-bin.000001	#	Execute_load_query	#	#	use `test`; LOAD DATA INFILE '../../std_data/rpl_loaddata.dat' INTO TABLE `t4` FIELDS TERMINATED BY '\t' ENCLOSED BY '' ESCAPED BY '\\' LINES TERMINATED BY '\n' (`a`, @b) SET `b`= @b + bug27417(2) ;file_id=#
 master-bin.000001	#	Query	#	#	ROLLBACK
 drop trigger trg_del_t2;
 drop table t1,t2,t3,t4,t5;
diff --git a/mysql-test/suite/binlog/t/binlog_bug23533.test b/mysql-test/suite/binlog/t/binlog_bug23533.test
index c05abe788c6..ca610e399e4 100644
--- a/mysql-test/suite/binlog/t/binlog_bug23533.test
+++ b/mysql-test/suite/binlog/t/binlog_bug23533.test
@@ -35,7 +35,7 @@ connect(default,localhost,root,,test);
 
 # Copied data from t1 into t2 large than max_binlog_cache_size
 START TRANSACTION;
---error 1197
+--error ER_TRANS_CACHE_FULL
 CREATE TABLE t2 SELECT * FROM t1;
 COMMIT;
 SHOW TABLES LIKE 't%';
diff --git a/mysql-test/suite/rpl/r/rpl_loaddatalocal.result b/mysql-test/suite/rpl/r/rpl_loaddatalocal.result
index 2fd9dc6294e..902bc1cda00 100644
--- a/mysql-test/suite/rpl/r/rpl_loaddatalocal.result
+++ b/mysql-test/suite/rpl/r/rpl_loaddatalocal.result
@@ -93,4 +93,31 @@ Slave	44
 DROP TABLE t1;
 SET SESSION sql_mode=@old_mode;
 [slave]
+
+Bug #60580/#11902767:
+"statement improperly replicated crashes slave sql thread"
+
+[master]
+CREATE TABLE t1(f1 INT, f2 INT);
+CREATE TABLE t2(f1 INT, f2 TIMESTAMP);
+INSERT INTO t2 VALUES(1, '2011-03-22 21:01:28');
+INSERT INTO t2 VALUES(2, '2011-03-21 21:01:28');
+INSERT INTO t2 VALUES(3, '2011-03-20 21:01:28');
+CREATE TABLE t3 AS SELECT * FROM t2;
+CREATE VIEW v1 AS SELECT * FROM t2
+WHERE f1 IN (SELECT f1 FROM t3 WHERE (t3.f2 IS NULL));
+SELECT 1 INTO OUTFILE 'MYSQLD_DATADIR/bug60580.csv' FROM DUAL;
+LOAD DATA LOCAL INFILE 'MYSQLD_DATADIR/bug60580.csv' INTO TABLE t1 (@f1) SET f2 = (SELECT f1 FROM v1 WHERE f1=@f1);
+SELECT * FROM t1;
+f1	f2
+NULL	NULL
+[slave]
+SELECT * FROM t1;
+f1	f2
+NULL	NULL
+[master]
+DROP VIEW v1;
+DROP TABLE t1, t2, t3;
+[slave]
 include/rpl_end.inc
+# End of 5.1 tests
diff --git a/mysql-test/suite/rpl/r/rpl_server_id2.result b/mysql-test/suite/rpl/r/rpl_server_id2.result
index ce1f54dbf85..69c0e1f7d9b 100644
--- a/mysql-test/suite/rpl/r/rpl_server_id2.result
+++ b/mysql-test/suite/rpl/r/rpl_server_id2.result
@@ -22,7 +22,7 @@ change master to master_port=MASTER_PORT;
 start slave until master_log_file='master-bin.000001', master_log_pos=UNTIL_POS;
 include/wait_for_slave_io_to_start.inc
 include/wait_for_slave_sql_to_stop.inc
-*** checking until postion execution: must be only t1 in the list ***
+*** checking until position execution: must be only t1 in the list ***
 show tables;
 Tables_in_test
 t1
diff --git a/mysql-test/suite/rpl/r/rpl_show_slave_hosts.result b/mysql-test/suite/rpl/r/rpl_show_slave_hosts.result
index 107cd8f63cc..2ada5670e04 100644
--- a/mysql-test/suite/rpl/r/rpl_show_slave_hosts.result
+++ b/mysql-test/suite/rpl/r/rpl_show_slave_hosts.result
@@ -8,8 +8,7 @@ SHOW SLAVE HOSTS;
 Server_id	Host	Port	Master_id
 3	slave2	DEFAULT_PORT	1
 2		SLAVE_PORT	1
-STOP SLAVE IO_THREAD;
-include/wait_for_slave_io_to_stop.inc
+include/stop_slave_io.inc
 SHOW SLAVE HOSTS;
 Server_id	Host	Port	Master_id
 2		SLAVE_PORT	1
diff --git a/mysql-test/suite/rpl/r/rpl_typeconv.result b/mysql-test/suite/rpl/r/rpl_typeconv.result
index 0d2f3cb26f7..f9d5b50b4e2 100644
--- a/mysql-test/suite/rpl/r/rpl_typeconv.result
+++ b/mysql-test/suite/rpl/r/rpl_typeconv.result
@@ -534,7 +534,7 @@ BIT(6)         	BIT(5)         	ALL_LOSSY,ALL_NON_LOSSY  	<Correct value>
 BIT(5)         	BIT(12)        	ALL_LOSSY,ALL_NON_LOSSY  	<Correct value>
 BIT(12)        	BIT(5)         	ALL_LOSSY,ALL_NON_LOSSY  	<Correct value>
 DROP TABLE type_conversions;
-call mtr.add_suppression("Slave SQL.*Column 0 of table .test.t1. cannot be converted from type.* Error_code: 1677");
+call mtr.add_suppression("Slave SQL.*Column 1 of table .test.t1. cannot be converted from type.* Error_code: 1677");
 DROP TABLE t1;
 set global slave_type_conversions = @saved_slave_type_conversions;
 include/rpl_end.inc
diff --git a/mysql-test/suite/rpl/t/rpl_loaddatalocal.test b/mysql-test/suite/rpl/t/rpl_loaddatalocal.test
index a54d216cb7c..4ebe572741f 100644
--- a/mysql-test/suite/rpl/t/rpl_loaddatalocal.test
+++ b/mysql-test/suite/rpl/t/rpl_loaddatalocal.test
@@ -186,4 +186,55 @@ SET SESSION sql_mode=@old_mode;
 sync_slave_with_master;
 
 connection master;
+
+--echo
+--echo Bug #60580/#11902767:
+--echo "statement improperly replicated crashes slave sql thread"
+--echo
+
+--echo [master]
+connection master;
+let $MYSQLD_DATADIR= `select @@datadir`;
+
+CREATE TABLE t1(f1 INT, f2 INT);
+CREATE TABLE t2(f1 INT, f2 TIMESTAMP);
+
+INSERT INTO t2 VALUES(1, '2011-03-22 21:01:28');
+INSERT INTO t2 VALUES(2, '2011-03-21 21:01:28');
+INSERT INTO t2 VALUES(3, '2011-03-20 21:01:28');
+
+CREATE TABLE t3 AS SELECT * FROM t2;
+
+CREATE VIEW v1 AS SELECT * FROM t2
+  WHERE f1 IN (SELECT f1 FROM t3 WHERE (t3.f2 IS NULL));
+
+--replace_result $MYSQLD_DATADIR MYSQLD_DATADIR
+eval SELECT 1 INTO OUTFILE '$MYSQLD_DATADIR/bug60580.csv' FROM DUAL;
+
+--replace_result $MYSQLD_DATADIR MYSQLD_DATADIR
+eval LOAD DATA LOCAL INFILE '$MYSQLD_DATADIR/bug60580.csv' INTO TABLE t1 (@f1) SET f2 = (SELECT f1 FROM v1 WHERE f1=@f1);
+
+SELECT * FROM t1;
+
+sleep 1;
+
+--echo [slave]
+sync_slave_with_master;
+
+SELECT * FROM t1;
+
+--remove_file $MYSQLD_DATADIR/bug60580.csv
+
+--echo [master]
+connection master;
+
+DROP VIEW v1;
+DROP TABLE t1, t2, t3;
+
+--echo [slave]
+sync_slave_with_master;
+
+connection master;
 --source include/rpl_end.inc
+
+--echo # End of 5.1 tests
diff --git a/mysql-test/suite/rpl/t/rpl_row_until.test b/mysql-test/suite/rpl/t/rpl_row_until.test
index 0a70fb441c1..b861bb8c8ec 100644
--- a/mysql-test/suite/rpl/t/rpl_row_until.test
+++ b/mysql-test/suite/rpl/t/rpl_row_until.test
@@ -8,32 +8,32 @@
 connection master;
 CREATE TABLE t1(n INT NOT NULL AUTO_INCREMENT PRIMARY KEY);
 INSERT INTO t1 VALUES (1),(2),(3),(4);
-# Save master log postion for query DROP TABLE t1
+# Save master log position for query DROP TABLE t1
 let $master_pos_drop_t1= query_get_value(SHOW MASTER STATUS, Position, 1);
 DROP TABLE t1;
-# Save master log postion for query DROP TABLE t1
+# Save master log position for query DROP TABLE t1
 save_master_pos;
 let $master_pos_drop_t1= query_get_value(SHOW BINLOG EVENTS, Pos, 7);
 let $master_log_file= query_get_value(SHOW BINLOG EVENTS, Log_name, 7);
 
-# Save master log postion for query CREATE TABLE t2
+# Save master log position for query CREATE TABLE t2
 let $master_pos_create_t2= query_get_value(SHOW MASTER STATUS, Position, 1);
 CREATE TABLE t2(n INT NOT NULL AUTO_INCREMENT PRIMARY KEY);
 #show binlog events;
 
 INSERT INTO t2 VALUES (1),(2);
-# Save master log postion for query INSERT INTO t2 VALUES (1),(2);
+# Save master log position for query INSERT INTO t2 VALUES (1),(2);
 let $master_pos_insert1_t2= query_get_value(SHOW MASTER STATUS, Position, 1);
 sync_slave_with_master;
 #show binlog events;
 
-# Save relay log postion for query INSERT INTO t2 VALUES (1),(2);
+# Save relay log position for query INSERT INTO t2 VALUES (1),(2);
 let $relay_pos_insert1_t2= query_get_value(SHOW SLAVE STATUS, Relay_Log_Pos, 1);
 
 connection master;
 INSERT INTO t2 VALUES (3),(4);
 DROP TABLE t2;
-# Save master log postion for query DROP TABLE t2;
+# Save master log position for query DROP TABLE t2;
 let $master_pos_drop_t2= query_get_value(SHOW MASTER STATUS, Position, 1);
 sync_slave_with_master;
 #show binlog events;
diff --git a/mysql-test/suite/rpl/t/rpl_server_id2.test b/mysql-test/suite/rpl/t/rpl_server_id2.test
index aa2ad5c3a8a..21e197866cf 100644
--- a/mysql-test/suite/rpl/t/rpl_server_id2.test
+++ b/mysql-test/suite/rpl/t/rpl_server_id2.test
@@ -50,7 +50,7 @@ eval start slave until master_log_file='master-bin.000001', master_log_pos=$unti
 --source include/wait_for_slave_io_to_start.inc
 --source include/wait_for_slave_sql_to_stop.inc
 
---echo *** checking until postion execution: must be only t1 in the list ***
+--echo *** checking until position execution: must be only t1 in the list ***
 show tables;
 
 # cleanup
diff --git a/mysql-test/suite/rpl/t/rpl_show_slave_hosts.test b/mysql-test/suite/rpl/t/rpl_show_slave_hosts.test
index eb2e883847f..105f1873659 100644
--- a/mysql-test/suite/rpl/t/rpl_show_slave_hosts.test
+++ b/mysql-test/suite/rpl/t/rpl_show_slave_hosts.test
@@ -23,14 +23,13 @@ connection master;
 let $show_statement= SHOW SLAVE HOSTS;
 let $field= Server_id;
 # 3 is server_id of slave2.
-let $connection= ='3';
+let $condition= ='3';
 source include/wait_show_condition.inc;
 --replace_result $SLAVE_MYPORT SLAVE_PORT $DEFAULT_MASTER_PORT DEFAULT_PORT
 SHOW SLAVE HOSTS;
 
 connection slave2;
-STOP SLAVE IO_THREAD;
-source include/wait_for_slave_io_to_stop.inc;
+--source include/stop_slave_io.inc
 
 connection master;
 let $show_statement= SHOW SLAVE HOSTS;
diff --git a/mysql-test/suite/rpl/t/rpl_typeconv.test b/mysql-test/suite/rpl/t/rpl_typeconv.test
index efe3dc15353..efcbe97049f 100644
--- a/mysql-test/suite/rpl/t/rpl_typeconv.test
+++ b/mysql-test/suite/rpl/t/rpl_typeconv.test
@@ -61,7 +61,7 @@ SELECT RPAD(Source, 15, ' ') AS Source_Type,
 enable_query_log;
 DROP TABLE type_conversions;
 
-call mtr.add_suppression("Slave SQL.*Column 0 of table .test.t1. cannot be converted from type.* Error_code: 1677");
+call mtr.add_suppression("Slave SQL.*Column 1 of table .test.t1. cannot be converted from type.* Error_code: 1677");
 
 connection master;
 DROP TABLE t1;
diff --git a/mysql-test/t/archive.test b/mysql-test/t/archive.test
index ce5047124a2..4686b3ca1dc 100644
--- a/mysql-test/t/archive.test
+++ b/mysql-test/t/archive.test
@@ -1730,3 +1730,18 @@ DROP TABLE t1;
 CREATE TABLE `a/../`(a INT) ENGINE=ARCHIVE;
 remove_file $MYSQLD_DATADIR/test/a@002f@002e@002e@002f.frm;
 DROP TABLE `a/../`;
+
+--echo #
+--echo # BUG#57162 - valgrind errors, random data when returning
+--echo #             ordered data from archive tables
+--echo #
+SET sort_buffer_size=32804;
+CREATE TABLE t1(a INT, b CHAR(255), c CHAR(255), d CHAR(255),
+  e CHAR(255), f INT) ENGINE=ARCHIVE DEFAULT CHARSET utf8;
+INSERT INTO t1 VALUES(-1,'b','c','d','e',1);
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT t1.* FROM t1,t1 t2,t1 t3,t1 t4,t1 t5,t1 t6;
+SELECT * FROM t1 ORDER BY f LIMIT 1;
+DROP TABLE t1;
+SET sort_buffer_size=DEFAULT;
diff --git a/mysql-test/t/cast.test b/mysql-test/t/cast.test
index f5426f8d631..a922cc9aaf7 100644
--- a/mysql-test/t/cast.test
+++ b/mysql-test/t/cast.test
@@ -280,5 +280,19 @@ SELECT 1 FROM
 ) AS s LIMIT 1;
 DROP TABLE t1;
 
+--echo #
+--echo # Bug #11765023: 57934: DOS POSSIBLE SINCE BINARY CASTING 
+--echo #   DOESN'T ADHERE TO MAX_ALLOWED_PACKET
+
+SET @@GLOBAL.max_allowed_packet=2048;
+# reconnect to make the new max packet size take effect
+--connect (newconn, localhost, root,,)
+
+SELECT CONVERT('a', BINARY(2049));  
+SELECT CONVERT('a', CHAR(2049));  
+
+connection default;
+disconnect newconn;
+SET @@GLOBAL.max_allowed_packet=default;
 
 --echo End of 5.1 tests
diff --git a/mysql-test/t/distinct.test b/mysql-test/t/distinct.test
index bf4c23562cf..84073d15109 100644
--- a/mysql-test/t/distinct.test
+++ b/mysql-test/t/distinct.test
@@ -614,3 +614,16 @@ SET @@sort_buffer_size = @old_sort_buffer_size;
 SET @@max_heap_table_size = @old_max_heap_table_size;
 
 --echo End of 5.1 tests
+
+
+--echo #
+--echo # Bug #11744875: 4082: integer lengths cause truncation with distinct concat and innodb
+--echo #
+
+CREATE TABLE t1 (a INT(1), b INT(1));
+INSERT INTO t1 VALUES (1111, 2222), (3333, 4444);
+SELECT DISTINCT CONCAT(a,b) AS c FROM t1 ORDER BY 1;
+DROP TABLE t1;
+
+
+--echo End of 5.5 tests
diff --git a/mysql-test/t/events_1.test b/mysql-test/t/events_1.test
index ccdeb70d291..7f31e3fc881 100644
--- a/mysql-test/t/events_1.test
+++ b/mysql-test/t/events_1.test
@@ -4,6 +4,8 @@
 # Can't test with embedded server that doesn't support grants
 -- source include/not_embedded.inc
 
+call mtr.add_suppression("Column count of mysql.event is wrong. Expected .*, found .*\. The table is probably corrupted");
+
 --disable_warnings
 drop database if exists events_test;
 drop database if exists db_x;
@@ -270,23 +272,28 @@ SHOW EVENTS;
 --echo Try to alter mysql.event: the server should fail to load
 --echo event information after mysql.event was tampered with.
 --echo 
---echo First, let's add a column to the end and make sure everything
---echo works as before
+--echo First, let's add a column to the end and check the error is emitted.
 --echo 
 ALTER TABLE mysql.event ADD dummy INT;
---replace_column 8 # 9 #
+--error ER_EVENT_OPEN_TABLE_FAILED
 SHOW EVENTS;
+--error ER_EVENT_OPEN_TABLE_FAILED
 SELECT event_name FROM INFORMATION_SCHEMA.events;
---replace_regex /STARTS '[^']+'/STARTS '#'/
+--error ER_EVENT_OPEN_TABLE_FAILED
 SHOW CREATE EVENT intact_check;
---error ER_EVENT_DOES_NOT_EXIST
+--error ER_EVENT_OPEN_TABLE_FAILED
 DROP EVENT no_such_event;
+--error ER_EVENT_OPEN_TABLE_FAILED
 CREATE EVENT intact_check_1 ON SCHEDULE EVERY 5 HOUR DO SELECT 5;
+--error ER_EVENT_OPEN_TABLE_FAILED
 ALTER EVENT intact_check_1 ON SCHEDULE EVERY 8 HOUR DO SELECT 8;
+--error ER_EVENT_OPEN_TABLE_FAILED
 ALTER EVENT intact_check_1 RENAME TO intact_check_2;
---error ER_EVENT_DOES_NOT_EXIST
+--error ER_EVENT_OPEN_TABLE_FAILED
 DROP EVENT intact_check_1;
+--error ER_EVENT_OPEN_TABLE_FAILED
 DROP EVENT intact_check_2;
+--error ER_EVENT_OPEN_TABLE_FAILED
 DROP EVENT intact_check;
 DROP DATABASE IF EXISTS mysqltest_no_such_database;
 CREATE DATABASE mysqltest_db2;
@@ -296,6 +303,7 @@ SHOW VARIABLES LIKE 'event_scheduler';
 SET GLOBAL event_scheduler=OFF;
 # Clean up
 ALTER TABLE mysql.event DROP dummy;
+DROP EVENT intact_check;
 CREATE EVENT intact_check ON SCHEDULE EVERY 10 HOUR DO SELECT "nothing";
 --echo 
 --echo Now let's add a column to the first position: the server
@@ -303,24 +311,26 @@ CREATE EVENT intact_check ON SCHEDULE EVERY 10 HOUR DO SELECT "nothing";
 --echo 
 ALTER TABLE mysql.event ADD dummy INT FIRST;
 --error ER_CANNOT_LOAD_FROM_TABLE
+--error ER_EVENT_OPEN_TABLE_FAILED
 SHOW EVENTS;
 --error ER_CANNOT_LOAD_FROM_TABLE
+--error ER_EVENT_OPEN_TABLE_FAILED
 SELECT event_name FROM INFORMATION_SCHEMA.events;
---error ER_EVENT_DOES_NOT_EXIST
+--error ER_EVENT_OPEN_TABLE_FAILED
 SHOW CREATE EVENT intact_check;
---error ER_EVENT_DOES_NOT_EXIST
+--error ER_EVENT_OPEN_TABLE_FAILED
 DROP EVENT no_such_event;
---error ER_EVENT_STORE_FAILED
+--error ER_EVENT_OPEN_TABLE_FAILED
 CREATE EVENT intact_check_1 ON SCHEDULE EVERY 5 HOUR DO SELECT 5;
---error ER_EVENT_DOES_NOT_EXIST
+--error ER_EVENT_OPEN_TABLE_FAILED
 ALTER EVENT intact_check_1 ON SCHEDULE EVERY 8 HOUR DO SELECT 8;
---error ER_EVENT_DOES_NOT_EXIST
+--error ER_EVENT_OPEN_TABLE_FAILED
 ALTER EVENT intact_check_1 RENAME TO intact_check_2;
---error ER_EVENT_DOES_NOT_EXIST
+--error ER_EVENT_OPEN_TABLE_FAILED
 DROP EVENT intact_check_1;
---error ER_EVENT_DOES_NOT_EXIST
+--error ER_EVENT_OPEN_TABLE_FAILED
 DROP EVENT intact_check_2;
---error ER_EVENT_DOES_NOT_EXIST
+--error ER_EVENT_OPEN_TABLE_FAILED
 DROP EVENT intact_check;
 # Should work OK
 DROP DATABASE IF EXISTS mysqltest_no_such_database;
@@ -341,25 +351,25 @@ INSERT INTO event_like SELECT * FROM mysql.event;
 --echo
 --echo 
 ALTER TABLE mysql.event DROP comment, DROP starts;
---error ER_CANNOT_LOAD_FROM_TABLE
+--error ER_EVENT_OPEN_TABLE_FAILED
 SHOW EVENTS;
---error ER_CANNOT_LOAD_FROM_TABLE
+--error ER_EVENT_OPEN_TABLE_FAILED
 SELECT event_name FROM INFORMATION_SCHEMA.EVENTS;
---error ER_CANNOT_LOAD_FROM_TABLE
+--error ER_EVENT_OPEN_TABLE_FAILED
 SHOW CREATE EVENT intact_check;
---error ER_EVENT_DOES_NOT_EXIST
+--error ER_EVENT_OPEN_TABLE_FAILED
 DROP EVENT no_such_event;
---error ER_COL_COUNT_DOESNT_MATCH_CORRUPTED
+--error ER_EVENT_OPEN_TABLE_FAILED
 CREATE EVENT intact_check_1 ON SCHEDULE EVERY 5 HOUR DO SELECT 5;
---error ER_EVENT_DOES_NOT_EXIST
+--error ER_EVENT_OPEN_TABLE_FAILED
 ALTER EVENT intact_check_1 ON SCHEDULE EVERY 8 HOUR DO SELECT 8;
---error ER_EVENT_DOES_NOT_EXIST
+--error ER_EVENT_OPEN_TABLE_FAILED
 ALTER EVENT intact_check_1 RENAME TO intact_check_2;
---error ER_EVENT_DOES_NOT_EXIST
+--error ER_EVENT_OPEN_TABLE_FAILED
 DROP EVENT intact_check_1;
---error ER_EVENT_DOES_NOT_EXIST
+--error ER_EVENT_OPEN_TABLE_FAILED
 DROP EVENT intact_check_2;
-# Should succeed
+--error ER_EVENT_OPEN_TABLE_FAILED
 DROP EVENT intact_check;
 DROP DATABASE IF EXISTS mysqltest_no_such_database;
 CREATE DATABASE mysqltest_db2;
@@ -407,9 +417,54 @@ CREATE TABLE mysql.event like event_like;
 DROP TABLE event_like;
 --replace_column 8 # 9 #
 SHOW EVENTS;
-# 
-# End of tests
-#
+
+--echo
+--echo #
+--echo # Bug#12394306: the sever may crash if mysql.event is corrupted
+--echo #
+
+--echo
+CREATE EVENT ev1 ON SCHEDULE EVERY 5 HOUR DO SELECT 5;
+ALTER EVENT ev1 ON SCHEDULE EVERY 8 HOUR DO SELECT 8;
+
+--echo
+CREATE TABLE event_original LIKE mysql.event;
+INSERT INTO event_original SELECT * FROM mysql.event;
+
+--echo
+ALTER TABLE mysql.event MODIFY modified CHAR(1);
+
+--echo
+--error ER_EVENT_OPEN_TABLE_FAILED
+SHOW EVENTS;
+
+--echo
+--error ER_EVENT_OPEN_TABLE_FAILED
+SELECT event_name, created, last_altered FROM information_schema.events;
+
+--echo
+--error ER_EVENT_OPEN_TABLE_FAILED
+CREATE EVENT ev2 ON SCHEDULE EVERY 5 HOUR DO SELECT 5;
+
+--echo
+--error ER_EVENT_OPEN_TABLE_FAILED
+ALTER EVENT ev1 ON SCHEDULE EVERY 9 HOUR DO SELECT 9;
+
+--echo
+DROP TABLE mysql.event;
+RENAME TABLE event_original TO mysql.event;
+
+--echo
+DROP EVENT ev1;
+
+--echo
+SHOW EVENTS;
+
+
+--echo
+--echo # 
+--echo # End of tests
+--echo #
 
 let $wait_condition=
   select count(*) = 0 from information_schema.processlist
diff --git a/mysql-test/t/events_restart.test b/mysql-test/t/events_restart.test
index e155fe2ea16..facf2912087 100644
--- a/mysql-test/t/events_restart.test
+++ b/mysql-test/t/events_restart.test
@@ -1,6 +1,8 @@
 # Can't test with embedded server that doesn't support grants
 -- source include/not_embedded.inc
 
+call mtr.add_suppression("Column count of mysql.event is wrong. Expected .*, found .*\. The table is probably corrupted");
+
 #
 # Test that when the server is restarted, it checks mysql.event table,
 # and disables the scheduler if it's not up to date.
diff --git a/mysql-test/t/explain.test b/mysql-test/t/explain.test
index 931948b1b65..8376fdf1ad1 100644
--- a/mysql-test/t/explain.test
+++ b/mysql-test/t/explain.test
@@ -1,5 +1,5 @@
 #
-# Test of different EXPLAIN's
+# Test of different EXPLAINs
 
 --disable_warnings
 drop table if exists t1;
@@ -275,3 +275,24 @@ DEALLOCATE PREPARE stmt;
 DROP TABLE t1;
 
 --echo End of 5.1 tests.
+
+--echo #
+--echo # Bug#11829785 EXPLAIN EXTENDED CRASH WITH RIGHT OUTER JOIN, SUBQUERIES
+--echo #
+
+CREATE TABLE t1(a INT);
+
+INSERT INTO t1 VALUES (0), (0);
+
+PREPARE s FROM 
+'EXPLAIN EXTENDED
+SELECT SUBSTRING(1, (SELECT 1 FROM t1 a1 RIGHT OUTER JOIN t1 ON 0)) AS d
+FROM t1 WHERE 0 > ANY (SELECT @a FROM t1)';
+
+--error ER_SUBQUERY_NO_1_ROW
+EXECUTE s;
+
+DEALLOCATE PREPARE s;
+DROP TABLE t1;
+
+--echo #
diff --git a/mysql-test/t/gis.test b/mysql-test/t/gis.test
index e68e70c685a..2a800140d1f 100644
--- a/mysql-test/t/gis.test
+++ b/mysql-test/t/gis.test
@@ -773,7 +773,14 @@ drop table t1;
 #
 # Bug #50574 5.5.x allows spatial indexes on non-spatial 
 #           columns, causing crashes!
+# Bug#11767480 SPATIAL INDEXES ON NON-SPATIAL COLUMNS 
+#              CAUSE CRASHES.
 #
+CREATE TABLE t0 (a BINARY(32) NOT NULL);
+--error ER_SPATIAL_MUST_HAVE_GEOM_COL
+CREATE SPATIAL INDEX i on t0 (a);
+INSERT INTO t0 VALUES (1);
+
 --error ER_SPATIAL_MUST_HAVE_GEOM_COL
 CREATE TABLE t1(
   col0 BINARY NOT NULL,
@@ -811,6 +818,7 @@ CREATE TABLE t3 (
 );
 
 # cleanup
-DROP TABLE t1;
-DROP TABLE t2;
+DROP TABLE t0, t1, t2;
+
 
+--echo End of 5.5 tests
diff --git a/mysql-test/t/mysqlbinlog_base64.test b/mysql-test/t/mysqlbinlog_base64.test
index fb21e28fdcb..3d3444cea1c 100644
--- a/mysql-test/t/mysqlbinlog_base64.test
+++ b/mysql-test/t/mysqlbinlog_base64.test
@@ -71,3 +71,32 @@ select count(*) from t2;
 --remove_file $MYSQLTEST_VARDIR/tmp/mysqlbinlog_base64.sql
 drop table t1;
 drop table t2;
+
+#
+# BUG#12354268
+#
+# This test verifies that using --start-position with DECODE-ROWS
+# does not make mysqlbinlog to output an error stating that it
+# does not contain any FD event.
+#
+
+RESET MASTER;
+USE test;
+SET @old_binlog_format= @@binlog_format;
+SET SESSION binlog_format=ROW;
+CREATE TABLE t1(c1 INT);
+--let $master_binlog= query_get_value(SHOW MASTER STATUS, File, 1)
+--let $master_pos= query_get_value(SHOW MASTER STATUS, Position, 1)
+--let $MYSQLD_DATADIR= `SELECT @@datadir`
+
+INSERT INTO t1 VALUES (1);
+
+FLUSH LOGS;
+
+--disable_result_log 
+--exec $MYSQL_BINLOG --base64-output=DECODE-ROWS --start-position=$master_pos -v $MYSQLD_DATADIR/$master_binlog
+--enable_result_log 
+
+DROP TABLE t1;
+SET SESSION binlog_format= @old_binlog_format;
+RESET MASTER;
diff --git a/mysql-test/t/mysqldump.test b/mysql-test/t/mysqldump.test
index 09648faca94..e224bf6afe3 100644
--- a/mysql-test/t/mysqldump.test
+++ b/mysql-test/t/mysqldump.test
@@ -2199,7 +2199,7 @@ ALTER DATABASE `test-database` CHARACTER SET utf8 COLLATE utf8_unicode_ci ;
 
 DROP DATABASE `test-database`;
 # Switching back to test database.
-USE `test`;
+USE test;
 
 --echo #
 --echo # End of 5.1 tests
diff --git a/mysql-test/t/sp.test b/mysql-test/t/sp.test
index 1ed11c50ba8..b052b181d70 100644
--- a/mysql-test/t/sp.test
+++ b/mysql-test/t/sp.test
@@ -8713,6 +8713,30 @@ call p1(3, 2);
 drop table t1;
 drop procedure p1;
 
+
+--echo # 
+--echo # BUG#11766234: 59299: ASSERT (TABLE_REF->TABLE || TABLE_REF->VIEW) 
+--echo #               FAILS IN SET_FIELD_ITERATOR
+--echo # 
+
+CREATE TABLE t1 (a INT);
+CREATE TABLE t2 (a INT);
+CREATE VIEW v1 AS SELECT a FROM t2;
+CREATE PROCEDURE proc() SELECT * FROM t1 NATURAL JOIN v1;
+ALTER TABLE t2 CHANGE COLUMN a b CHAR;
+
+--echo
+--error ER_VIEW_INVALID
+CALL proc();
+--error ER_VIEW_INVALID
+CALL proc();
+
+--echo
+DROP TABLE t1,t2;
+DROP VIEW v1;
+DROP PROCEDURE proc;
+
+
 --echo
 --echo # --
 --echo # -- Bug 11765684 - 58674: SP-cache does not detect changes in
diff --git a/mysql-test/t/trigger.test b/mysql-test/t/trigger.test
index e5039c3ea23..80dbcceb448 100644
--- a/mysql-test/t/trigger.test
+++ b/mysql-test/t/trigger.test
@@ -2583,4 +2583,32 @@ select trigger_name from information_schema.triggers
 drop temporary table t1;
 drop table t1;
 
---echo End of 6.0 tests.
+
+--echo
+--echo #
+--echo # Bug #12362125: SP INOUT HANDLING IS BROKEN FOR TEXT TYPE.
+--echo #
+
+--disable_warnings
+DROP TABLE IF EXISTS t1;
+--enable_warnings
+
+CREATE TABLE t1(c TEXT);
+
+delimiter |;
+CREATE TRIGGER t1_bi BEFORE INSERT ON t1 FOR EACH ROW
+BEGIN
+  DECLARE v TEXT;
+  SET v = 'aaa';
+  SET NEW.c = v;
+END|
+delimiter ;|
+
+INSERT INTO t1 VALUES('qazwsxedc');
+
+SELECT c FROM t1;
+
+DROP TABLE t1;
+
+--echo
+--echo End of 5.5 tests.
diff --git a/mysql-test/t/type_newdecimal.test b/mysql-test/t/type_newdecimal.test
index bd70e64b1ad..f1eeabbd924 100644
--- a/mysql-test/t/type_newdecimal.test
+++ b/mysql-test/t/type_newdecimal.test
@@ -1519,4 +1519,19 @@ SELECT AVG(DISTINCT a) FROM t1;
 SELECT SUM(DISTINCT a) FROM t1;
 DROP TABLE t1;
 
+--echo #
+--echo # Bug#55436: buffer overflow in debug binary of dbug_buff in
+--echo #            Field_new_decimal::store_value
+--echo #
+
+# this threw memory warnings on Windows. Also make sure future changes
+# don't change these results, as per usual.
+SET SQL_MODE='';
+CREATE TABLE t1(f1 DECIMAL(44,24)) ENGINE=MYISAM;
+INSERT INTO t1 SET f1 = -64878E-85;
+SELECT f1 FROM t1;
+DROP TABLE IF EXISTS t1;
+
+
+
 --echo End of 5.1 tests
diff --git a/plugin/semisync/semisync_slave_plugin.cc b/plugin/semisync/semisync_slave_plugin.cc
index 5aa32cdfd5f..cfb04bdd276 100644
--- a/plugin/semisync/semisync_slave_plugin.cc
+++ b/plugin/semisync/semisync_slave_plugin.cc
@@ -53,7 +53,6 @@ int repl_semi_slave_request_dump(Binlog_relay_IO_param *param,
   if (mysql_real_query(mysql, query, strlen(query)) ||
       !(res= mysql_store_result(mysql)))
   {
-    mysql_free_result(mysql_store_result(mysql));
     sql_print_error("Execution failed on master: %s", query);
     return 1;
   }
@@ -65,8 +64,10 @@ int repl_semi_slave_request_dump(Binlog_relay_IO_param *param,
     sql_print_warning("Master server does not support semi-sync, "
                       "fallback to asynchronous replication");
     rpl_semi_sync_slave_status= 0;
+    mysql_free_result(res);
     return 0;
   }
+  mysql_free_result(res);
 
   /*
     Tell master dump thread that we want to do semi-sync
@@ -76,7 +77,6 @@ int repl_semi_slave_request_dump(Binlog_relay_IO_param *param,
   if (mysql_real_query(mysql, query, strlen(query)))
   {
     sql_print_error("Set 'rpl_semi_sync_slave=1' on master failed");
-    mysql_free_result(mysql_store_result(mysql));
     return 1;
   }
   mysql_free_result(mysql_store_result(mysql));
diff --git a/scripts/make_win_bin_dist b/scripts/make_win_bin_dist
index 004ea9f4c3f..3c384265bec 100755
--- a/scripts/make_win_bin_dist
+++ b/scripts/make_win_bin_dist
@@ -181,6 +181,7 @@ cp Docs/INSTALL-BINARY    $DESTDIR/Docs/
 cp Docs/manual.chm        $DESTDIR/Docs/ || /bin/true
 cp ChangeLog              $DESTDIR/Docs/ || /bin/true
 cp support-files/my-*.ini $DESTDIR/
+cp README                 $DESTDIR/
 
 if [ -f COPYING ] ; then
   cp COPYING $DESTDIR/
diff --git a/sql/event_db_repository.cc b/sql/event_db_repository.cc
index 3a25324db52..75d1c8ef8e8 100644
--- a/sql/event_db_repository.cc
+++ b/sql/event_db_repository.cc
@@ -534,6 +534,13 @@ Event_db_repository::fill_schema_events(THD *thd, TABLE_LIST *i_s_table,
   if (open_system_tables_for_read(thd, &event_table, &open_tables_backup))
     DBUG_RETURN(TRUE);
 
+  if (table_intact.check(event_table.table, &event_table_def))
+  {
+    close_system_tables(thd, &open_tables_backup);
+    my_error(ER_EVENT_OPEN_TABLE_FAILED, MYF(0));
+    DBUG_RETURN(TRUE);
+  }
+
   /*
     1. SELECT I_S => use table scan. I_S.EVENTS does not guarantee order
                      thus we won't order it. OTOH, SHOW EVENTS will be
@@ -591,6 +598,14 @@ Event_db_repository::open_event_table(THD *thd, enum thr_lock_type lock_type,
 
   *table= tables.table;
   tables.table->use_all_columns();
+
+  if (table_intact.check(*table, &event_table_def))
+  {
+    close_thread_tables(thd);
+    my_error(ER_EVENT_OPEN_TABLE_FAILED, MYF(0));
+    DBUG_RETURN(TRUE);
+  }
+
   DBUG_RETURN(FALSE);
 }
 
@@ -1035,6 +1050,13 @@ Event_db_repository::load_named_event(THD *thd, LEX_STRING dbname,
   */
   if (!(ret= open_system_tables_for_read(thd, &event_table, &open_tables_backup)))
   {
+    if (table_intact.check(event_table.table, &event_table_def))
+    {
+      close_system_tables(thd, &open_tables_backup);
+      my_error(ER_EVENT_OPEN_TABLE_FAILED, MYF(0));
+      DBUG_RETURN(TRUE);
+    }
+
     if ((ret= find_named_event(dbname, name, event_table.table)))
       my_error(ER_EVENT_DOES_NOT_EXIST, MYF(0), name.str);
     else if ((ret= etn->load_from_row(thd, event_table.table)))
diff --git a/sql/field.cc b/sql/field.cc
index 7ffc399718c..d273f26306d 100644
--- a/sql/field.cc
+++ b/sql/field.cc
@@ -2608,7 +2608,7 @@ bool Field_new_decimal::store_value(const my_decimal *decimal_value)
   DBUG_ENTER("Field_new_decimal::store_value");
 #ifndef DBUG_OFF
   {
-    char dbug_buff[DECIMAL_MAX_STR_LENGTH+1];
+    char dbug_buff[DECIMAL_MAX_STR_LENGTH+2];
     DBUG_PRINT("enter", ("value: %s", dbug_decimal_as_string(dbug_buff, decimal_value)));
   }
 #endif
@@ -2623,7 +2623,7 @@ bool Field_new_decimal::store_value(const my_decimal *decimal_value)
   }
 #ifndef DBUG_OFF
   {
-    char dbug_buff[DECIMAL_MAX_STR_LENGTH+1];
+    char dbug_buff[DECIMAL_MAX_STR_LENGTH+2];
     DBUG_PRINT("info", ("saving with precision %d  scale: %d  value %s",
                         (int)precision, (int)dec,
                         dbug_decimal_as_string(dbug_buff, decimal_value)));
@@ -2692,7 +2692,7 @@ int Field_new_decimal::store(const char *from, uint length,
   }
 
 #ifndef DBUG_OFF
-  char dbug_buff[DECIMAL_MAX_STR_LENGTH+1];
+  char dbug_buff[DECIMAL_MAX_STR_LENGTH+2];
   DBUG_PRINT("enter", ("value: %s",
                        dbug_decimal_as_string(dbug_buff, &decimal_value)));
 #endif
diff --git a/sql/handler.h b/sql/handler.h
index 1250388f459..fbc52170297 100644
--- a/sql/handler.h
+++ b/sql/handler.h
@@ -3,18 +3,20 @@
 
 /* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
 
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; version 2 of the License.
+   This program is free software; you can redistribute it and/or
+   modify it under the terms of the GNU General Public License
+   as published by the Free Software Foundation; version 2 of
+   the License.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
-   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA */
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+   02110-1301  USA */
 
 /* Definitions for parameters to do with handler-routines */
 
@@ -60,7 +62,7 @@
   a table with rnd_next()
   - We will see all rows (including deleted ones)
   - Row positions are 'table->s->db_record_offset' apart
-  If this flag is not set, filesort will do a postion() call for each matched
+  If this flag is not set, filesort will do a position() call for each matched
   row to be able to find the row later.
 */
 #define HA_REC_NOT_IN_SEQ      (1 << 3)
diff --git a/sql/item.cc b/sql/item.cc
index af3917c09c1..2c0da80b43b 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -581,7 +581,7 @@ void Item::rename(char *new_name)
 
 Item* Item::transform(Item_transformer transformer, uchar *arg)
 {
-  DBUG_ASSERT(!current_thd->is_stmt_prepare());
+  DBUG_ASSERT(!current_thd->stmt_arena->is_stmt_prepare());
 
   return (this->*transformer)(arg);
 }
@@ -1781,14 +1781,17 @@ bool agg_item_set_converter(DTCollation &coll, const char *fname,
   }
 
   THD *thd= current_thd;
-  Query_arena *arena, backup;
   bool res= FALSE;
   uint i;
+
   /*
     In case we're in statement prepare, create conversion item
     in its memory: it will be reused on each execute.
   */
-  arena= thd->activate_stmt_arena_if_needed(&backup);
+  Query_arena backup;
+  Query_arena *arena= thd->stmt_arena->is_stmt_prepare() ?
+                      thd->activate_stmt_arena_if_needed(&backup) :
+                      NULL;
 
   for (i= 0, arg= args; i < nargs; i++, arg+= item_sep)
   {
@@ -1845,7 +1848,7 @@ bool agg_item_set_converter(DTCollation &coll, const char *fname,
       been created in prepare. In this case register the change for
       rollback.
     */
-    if (thd->is_stmt_prepare())
+    if (thd->stmt_arena->is_stmt_prepare())
       *arg= conv;
     else
       thd->change_item_tree(arg, conv);
@@ -2008,6 +2011,61 @@ Item_field::Item_field(THD *thd, Item_field *item)
   collation.set(DERIVATION_IMPLICIT);
 }
 
+
+/**
+  Calculate the max column length not taking into account the
+  limitations over integer types.
+
+  When storing data into fields the server currently just ignores the
+  limits specified on integer types, e.g. 1234 can safely be stored in
+  an int(2) and will not cause an error.
+  Thus when creating temporary tables and doing transformations
+  we must adjust the maximum field length to reflect this fact.
+  We take the un-restricted maximum length and adjust it similarly to
+  how the declared length is adjusted wrt unsignedness etc.
+  TODO: this all needs to go when we disable storing 1234 in int(2).
+
+  @param field_par   Original field the use to calculate the lengths
+  @param max_length  Item's calculated explicit max length
+  @return            The adjusted max length
+*/
+
+inline static uint32
+adjust_max_effective_column_length(Field *field_par, uint32 max_length)
+{
+  uint32 new_max_length= field_par->max_display_length();
+  uint32 sign_length= (field_par->flags & UNSIGNED_FLAG) ? 0 : 1;
+
+  switch (field_par->type())
+  {
+  case MYSQL_TYPE_INT24:
+    /*
+      Compensate for MAX_MEDIUMINT_WIDTH being 1 too long (8)
+      compared to the actual number of digits that can fit into
+      the column.
+    */
+    new_max_length+= 1;
+    /* fall through */
+  case MYSQL_TYPE_LONG:
+  case MYSQL_TYPE_TINY:
+  case MYSQL_TYPE_SHORT:
+
+    /* Take out the sign and add a conditional sign */
+    new_max_length= new_max_length - 1 + sign_length;
+    break;
+
+  /* BINGINT is always 20 no matter the sign */
+  case MYSQL_TYPE_LONGLONG:
+  /* make gcc happy */
+  default:
+    break;
+  }
+
+  /* Adjust only if the actual precision based one is bigger than specified */
+  return new_max_length > max_length ? new_max_length : max_length;
+}
+
+
 void Item_field::set_field(Field *field_par)
 {
   field=result_field=field_par;			// for easy coding with fields
@@ -2021,6 +2079,9 @@ void Item_field::set_field(Field *field_par)
   collation.set(field_par->charset(), field_par->derivation(),
                 field_par->repertoire());
   fix_char_length(field_par->char_length());
+
+  max_length= adjust_max_effective_column_length(field_par, max_length);
+
   fixed= 1;
   if (field->table->s->tmp_table == SYSTEM_TMP_TABLE)
     any_privileges= 0;
@@ -6965,7 +7026,7 @@ int Item_default_value::save_in_field(Field *field_arg, bool no_conversions)
 
 Item *Item_default_value::transform(Item_transformer transformer, uchar *args)
 {
-  DBUG_ASSERT(!current_thd->is_stmt_prepare());
+  DBUG_ASSERT(!current_thd->stmt_arena->is_stmt_prepare());
 
   /*
     If the value of arg is NULL, then this object represents a constant,
@@ -7131,8 +7192,26 @@ bool Item_trigger_field::set_value(THD *thd, sp_rcontext * /*ctx*/, Item **it)
 {
   Item *item= sp_prepare_func_item(thd, it);
 
-  return (!item || (!fixed && fix_fields(thd, 0)) ||
-          (item->save_in_field(field, 0) < 0));
+  if (!item)
+    return true;
+
+  if (!fixed)
+  {
+    if (fix_fields(thd, NULL))
+      return true;
+  }
+
+  // NOTE: field->table->copy_blobs should be false here, but let's
+  // remember the value at runtime to avoid subtle bugs.
+  bool copy_blobs_saved= field->table->copy_blobs;
+
+  field->table->copy_blobs= true;
+
+  int err_code= item->save_in_field(field, 0);
+
+  field->table->copy_blobs= copy_blobs_saved;
+
+  return err_code < 0;
 }
 
 
diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc
index cf5da5313d9..e0057d1550b 100644
--- a/sql/item_cmpfunc.cc
+++ b/sql/item_cmpfunc.cc
@@ -4345,7 +4345,7 @@ bool Item_cond::walk(Item_processor processor, bool walk_subquery, uchar *arg)
 
 Item *Item_cond::transform(Item_transformer transformer, uchar *arg)
 {
-  DBUG_ASSERT(!current_thd->is_stmt_prepare());
+  DBUG_ASSERT(!current_thd->stmt_arena->is_stmt_prepare());
 
   List_iterator<Item> li(list);
   Item *item;
@@ -5718,7 +5718,7 @@ bool Item_equal::walk(Item_processor processor, bool walk_subquery, uchar *arg)
 
 Item *Item_equal::transform(Item_transformer transformer, uchar *arg)
 {
-  DBUG_ASSERT(!current_thd->is_stmt_prepare());
+  DBUG_ASSERT(!current_thd->stmt_arena->is_stmt_prepare());
 
   List_iterator<Item_field> it(fields);
   Item *item;
diff --git a/sql/item_func.cc b/sql/item_func.cc
index 9035d644962..a7e9ed43cb4 100644
--- a/sql/item_func.cc
+++ b/sql/item_func.cc
@@ -295,7 +295,7 @@ void Item_func::traverse_cond(Cond_traverser traverser,
 
 Item *Item_func::transform(Item_transformer transformer, uchar *argument)
 {
-  DBUG_ASSERT(!current_thd->is_stmt_prepare());
+  DBUG_ASSERT(!current_thd->stmt_arena->is_stmt_prepare());
 
   if (arg_count)
   {
diff --git a/sql/item_row.cc b/sql/item_row.cc
index 94515640625..0f5d6f27823 100644
--- a/sql/item_row.cc
+++ b/sql/item_row.cc
@@ -170,7 +170,7 @@ bool Item_row::walk(Item_processor processor, bool walk_subquery, uchar *arg)
 
 Item *Item_row::transform(Item_transformer transformer, uchar *arg)
 {
-  DBUG_ASSERT(!current_thd->is_stmt_prepare());
+  DBUG_ASSERT(!current_thd->stmt_arena->is_stmt_prepare());
 
   for (uint i= 0; i < arg_count; i++)
   {
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
index e5c47c110f4..e1a4fcc8def 100644
--- a/sql/item_strfunc.cc
+++ b/sql/item_strfunc.cc
@@ -2536,7 +2536,7 @@ String *Item_func_make_set::val_str(String *str)
 
 Item *Item_func_make_set::transform(Item_transformer transformer, uchar *arg)
 {
-  DBUG_ASSERT(!current_thd->is_stmt_prepare());
+  DBUG_ASSERT(!current_thd->stmt_arena->is_stmt_prepare());
 
   Item *new_item= item->transform(transformer, arg);
   if (!new_item)
diff --git a/sql/item_timefunc.cc b/sql/item_timefunc.cc
index 68e75a262dc..0952a5448e4 100644
--- a/sql/item_timefunc.cc
+++ b/sql/item_timefunc.cc
@@ -2524,6 +2524,19 @@ String *Item_char_typecast::val_str(String *str)
   String *res;
   uint32 length;
 
+  if (cast_length >= 0 &&
+      ((unsigned) cast_length) > current_thd->variables.max_allowed_packet)
+  {
+    push_warning_printf(current_thd, MYSQL_ERROR::WARN_LEVEL_WARN,
+			ER_WARN_ALLOWED_PACKET_OVERFLOWED,
+			ER(ER_WARN_ALLOWED_PACKET_OVERFLOWED),
+			cast_cs == &my_charset_bin ?
+                        "cast_as_binary" : func_name(),
+                        current_thd->variables.max_allowed_packet);
+    null_value= 1;
+    return 0;
+  }
+
   if (!charset_conversion)
   {
     if (!(res= args[0]->val_str(str)))
diff --git a/sql/my_decimal.cc b/sql/my_decimal.cc
index a5b60739b26..3b5fa81eab9 100644
--- a/sql/my_decimal.cc
+++ b/sql/my_decimal.cc
@@ -99,10 +99,11 @@ int my_decimal2string(uint mask, const my_decimal *d,
     UNSIGNED. Hence the buffer for a ZEROFILLed value is the length
     the user requested, plus one for a possible decimal point, plus
     one if the user only wanted decimal places, but we force a leading
-    zero on them. Because the type is implicitly UNSIGNED, we do not
-    need to reserve a character for the sign. For all other cases,
-    fixed_prec will be 0, and my_decimal_string_length() will be called
-    instead to calculate the required size of the buffer.
+    zero on them, plus one for the '\0' terminator. Because the type
+    is implicitly UNSIGNED, we do not need to reserve a character for
+    the sign. For all other cases, fixed_prec will be 0, and
+    my_decimal_string_length() will be called instead to calculate the
+    required size of the buffer.
   */
   int length= (fixed_prec
                ? (fixed_prec + ((fixed_prec == fixed_dec) ? 1 : 0) + 1)
@@ -332,7 +333,7 @@ print_decimal_buff(const my_decimal *dec, const uchar* ptr, int length)
 
 const char *dbug_decimal_as_string(char *buff, const my_decimal *val)
 {
-  int length= DECIMAL_MAX_STR_LENGTH;
+  int length= DECIMAL_MAX_STR_LENGTH + 1;     /* minimum size for buff */
   if (!val)
     return "NULL";
   (void)decimal2string((decimal_t*) val, buff, &length, 0,0,0);
diff --git a/sql/my_decimal.h b/sql/my_decimal.h
index f3fd39f5721..6ac9d25b87d 100644
--- a/sql/my_decimal.h
+++ b/sql/my_decimal.h
@@ -62,7 +62,7 @@ typedef struct st_mysql_time MYSQL_TIME;
 
 /**
   maximum length of string representation (number of maximum decimal
-  digits + 1 position for sign + 1 position for decimal point)
+  digits + 1 position for sign + 1 position for decimal point, no terminator)
 */
 #define DECIMAL_MAX_STR_LENGTH (DECIMAL_MAX_POSSIBLE_PRECISION + 2)
 
@@ -243,6 +243,7 @@ inline uint32 my_decimal_precision_to_length(uint precision, uint8 scale,
 inline
 int my_decimal_string_length(const my_decimal *d)
 {
+  /* length of string representation including terminating '\0' */
   return decimal_string_size(d);
 }
 
diff --git a/sql/rpl_handler.h b/sql/rpl_handler.h
index bf207e53e2d..9a181250efc 100644
--- a/sql/rpl_handler.h
+++ b/sql/rpl_handler.h
@@ -73,7 +73,10 @@ public:
     while (info && info->observer != observer)
       info= iter++;
     if (info)
+    {
       iter.remove();
+      delete info;
+    }
     else
       ret= TRUE;
     unlock();
diff --git a/sql/slave.cc b/sql/slave.cc
index c676c89b369..223ea21851a 100644
--- a/sql/slave.cc
+++ b/sql/slave.cc
@@ -113,7 +113,7 @@ static const char *reconnect_messages[SLAVE_RECON_ACT_MAX][SLAVE_RECON_MSG_MAX]=
 registration on master",
     "Reconnecting after a failed registration on master",
     "failed registering on master, reconnecting to try again, \
-log '%s' at postion %s",
+log '%s' at position %s",
     "COM_REGISTER_SLAVE",
     "Slave I/O thread killed during or after reconnect"
   },
@@ -121,7 +121,7 @@ log '%s' at postion %s",
     "Waiting to reconnect after a failed binlog dump request",
     "Slave I/O thread killed while retrying master dump",
     "Reconnecting after a failed binlog dump request",
-    "failed dump request, reconnecting to try again, log '%s' at postion %s",
+    "failed dump request, reconnecting to try again, log '%s' at position %s",
     "COM_BINLOG_DUMP",
     "Slave I/O thread killed during or after reconnect"
   },
@@ -130,7 +130,7 @@ log '%s' at postion %s",
     "Slave I/O thread killed while waiting to reconnect after a failed read",
     "Reconnecting after a failed master event read",
     "Slave I/O thread: Failed reading log event, reconnecting to retry, \
-log '%s' at postion %s",
+log '%s' at position %s",
     "",
     "Slave I/O thread killed during or after a reconnect done to recover from \
 failed read"
diff --git a/sql/sql_acl.cc b/sql/sql_acl.cc
index a269d5a1eef..18758130767 100644
--- a/sql/sql_acl.cc
+++ b/sql/sql_acl.cc
@@ -8399,6 +8399,94 @@ static bool parse_com_change_user_packet(MPVIO_EXT *mpvio, uint packet_length)
   DBUG_RETURN (0);
 }
 
+#ifndef EMBEDDED_LIBRARY
+/**
+  Get a null character terminated string from a user-supplied buffer.
+
+  @param buffer[in, out]    Pointer to the buffer to be scanned.
+  @param max_bytes_available[in, out]  Limit the bytes to scan.
+  @param string_length[out] The number of characters scanned not including
+                            the null character.
+
+  @remark The string_length does not include the terminating null character.
+          However, after the call, the buffer is increased by string_length+1
+          bytes, beyond the null character if there still available bytes to
+          scan.
+
+  @return pointer to beginning of the string scanned.
+    @retval NULL The buffer content is malformed
+*/
+
+static
+char *get_null_terminated_string(char **buffer,
+                                 size_t *max_bytes_available,
+                                 size_t *string_length)
+{
+  char *str= (char *)memchr(*buffer, '\0', *max_bytes_available);
+
+  if (str == NULL)
+    return NULL;
+
+  *string_length= (size_t)(str - *buffer);
+  *max_bytes_available-= *string_length + 1;
+  str= *buffer;
+  *buffer += *string_length + 1;  
+
+  return str;
+}
+
+/**
+  Get a length encoded string from a user-supplied buffer.
+
+  @param buffer[in, out] The buffer to scan; updates position after scan.
+  @param max_bytes_available[in, out] Limit the number of bytes to scan
+  @param string_length[out] Number of characters scanned
+  
+  @remark In case the length is zero, then the total size of the string is
+    considered to be 1 byte; the size byte.
+
+  @return pointer to first byte after the header in buffer.
+    @retval NULL The buffer content is malformed
+*/
+
+static
+char *get_length_encoded_string(char **buffer,
+                                size_t *max_bytes_available,
+                                size_t *string_length)
+{
+  if (*max_bytes_available == 0)
+    return NULL;
+
+  /* Do double cast to prevent overflow from signed / unsigned conversion */
+  size_t str_len= (size_t)(unsigned char)**buffer;
+
+  /*
+    If the length encoded string has the length 0
+    the total size of the string is only one byte long (the size byte)
+  */
+  if (str_len == 0)
+  {
+    ++*buffer;
+    *string_length= 0;
+    /*
+      Return a pointer to the 0 character so the return value will be
+      an empty string.
+    */
+    return *buffer-1;
+  }
+
+  if (str_len >= *max_bytes_available)
+    return NULL;
+
+  char *str= *buffer+1;
+  *string_length= str_len;
+  *max_bytes_available-= *string_length + 1;
+  *buffer+= *string_length + 1;
+  return str;
+}
+#endif
+
+
 /* the packet format is described in send_client_reply_packet() */
 static ulong parse_client_handshake_packet(MPVIO_EXT *mpvio,
                                            uchar **buff, ulong pkt_len)
@@ -8463,50 +8551,76 @@ static ulong parse_client_handshake_packet(MPVIO_EXT *mpvio,
   }
 #endif
 
-  if (end >= (char*) net->read_pos + pkt_len + 2)
+  if (end > (char *)net->read_pos + pkt_len)
     return packet_error;
 
   if ((mpvio->client_capabilities & CLIENT_TRANSACTIONS) &&
       opt_using_transactions)
     net->return_status= mpvio->server_status;
+ 
+  /*
+    In order to safely scan a head for '\0' string terminators
+    we must keep track of how many bytes remain in the allocated
+    buffer or we might read past the end of the buffer.
+  */
+  size_t bytes_remaining_in_packet= pkt_len - (end - (char *)net->read_pos);
 
-  char *user= end;
-  char *passwd= strend(user) + 1;
-  uint user_len= passwd - user - 1, db_len;
-  char *db= passwd;
-  char db_buff[NAME_LEN + 1];           // buffer to store db in utf8
-  char user_buff[USERNAME_LENGTH + 1];	// buffer to store user in utf8
-  uint dummy_errors;
+  size_t user_len;
+  char *user= get_null_terminated_string(&end, &bytes_remaining_in_packet,
+                                         &user_len);
+  if (user == NULL)
+    return packet_error;
 
   /*
-    Old clients send null-terminated string as password; new clients send
+    Old clients send a null-terminated string as password; new clients send
     the size (1 byte) + string (not null-terminated). Hence in case of empty
     password both send '\0'.
-
-    This strlen() can't be easily deleted without changing protocol.
-
-    Cast *passwd to an unsigned char, so that it doesn't extend the sign for
-    *passwd > 127 and become 2**32-127+ after casting to uint.
   */
-  uint passwd_len= mpvio->client_capabilities & CLIENT_SECURE_CONNECTION ?
-                   (uchar) (*passwd++) : strlen(passwd);
-  
-  if (mpvio->client_capabilities & CLIENT_CONNECT_WITH_DB)
+  size_t passwd_len= 0;
+  char *passwd= NULL;
+
+  if (mpvio->client_capabilities & CLIENT_SECURE_CONNECTION)
   {
-    db= db + passwd_len + 1;
-    /* strlen() can't be easily deleted without changing protocol */
-    db_len= strlen(db);
+    /*
+      4.1+ password. First byte is password length.
+    */
+    passwd= get_length_encoded_string(&end, &bytes_remaining_in_packet,
+                                      &passwd_len);
   }
   else
   {
-    db= 0;
-    db_len= 0;
+    /*
+      Old passwords are zero terminated strings.
+    */
+    passwd= get_null_terminated_string(&end, &bytes_remaining_in_packet,
+                                       &passwd_len);
   }
 
-  if (passwd + passwd_len + db_len > (char *) net->read_pos + pkt_len)
+  if (passwd == NULL)
     return packet_error;
 
-  char *client_plugin= passwd + passwd_len + (db ? db_len + 1 : 0);
+  size_t db_len= 0;
+  char *db= NULL;
+
+  if (mpvio->client_capabilities & CLIENT_CONNECT_WITH_DB)
+  {
+    db= get_null_terminated_string(&end, &bytes_remaining_in_packet,
+                                   &db_len);
+    if (db == NULL)
+      return packet_error;
+  }
+
+  size_t client_plugin_len= 0;
+  char *client_plugin= get_null_terminated_string(&end,
+                                                  &bytes_remaining_in_packet,
+                                                  &client_plugin_len);
+  if (client_plugin == NULL)
+    client_plugin= &empty_c_string[0];
+ 
+  char db_buff[NAME_LEN + 1];           // buffer to store db in utf8
+  char user_buff[USERNAME_LENGTH + 1];	// buffer to store user in utf8
+  uint dummy_errors;
+  
 
   /* Since 4.1 all database names are stored in utf8 */
   if (db)
@@ -8552,18 +8666,18 @@ static ulong parse_client_handshake_packet(MPVIO_EXT *mpvio,
   if (find_mpvio_user(mpvio))
     return packet_error;
 
-  if (mpvio->client_capabilities & CLIENT_PLUGIN_AUTH)
-  {
-    if ((client_plugin + strlen(client_plugin)) > 
-          (char *) net->read_pos + pkt_len)
-      return packet_error;
-  }
-  else
+  if (!(mpvio->client_capabilities & CLIENT_PLUGIN_AUTH))
   {
+    /*
+      An old client is connecting
+    */
     if (mpvio->client_capabilities & CLIENT_SECURE_CONNECTION)
       client_plugin= native_password_plugin_name.str;
     else
     {
+      /*
+        A really old client is connecting
+      */
       client_plugin= old_password_plugin_name.str;
       /*
         For a passwordless accounts we use native_password_plugin.
diff --git a/sql/sql_base.cc b/sql/sql_base.cc
index 628e3b49719..f9d85b1e024 100644
--- a/sql/sql_base.cc
+++ b/sql/sql_base.cc
@@ -7602,9 +7602,10 @@ static bool setup_natural_join_row_types(THD *thd,
                                          List<TABLE_LIST> *from_clause,
                                          Name_resolution_context *context)
 {
+  DBUG_ENTER("setup_natural_join_row_types");
   thd->where= "from clause";
   if (from_clause->elements == 0)
-    return FALSE; /* We come here in the case of UNIONs. */
+    DBUG_RETURN(false); /* We come here in the case of UNIONs. */
 
   List_iterator_fast<TABLE_LIST> table_ref_it(*from_clause);
   TABLE_LIST *table_ref; /* Current table reference. */
@@ -7612,10 +7613,6 @@ static bool setup_natural_join_row_types(THD *thd,
   TABLE_LIST *left_neighbor;
   /* Table reference to the right of the current. */
   TABLE_LIST *right_neighbor= NULL;
-  bool save_first_natural_join_processing=
-    context->select_lex->first_natural_join_processing;
-
-  context->select_lex->first_natural_join_processing= FALSE;
 
   /* Note that tables in the list are in reversed order */
   for (left_neighbor= table_ref_it++; left_neighbor ; )
@@ -7627,12 +7624,11 @@ static bool setup_natural_join_row_types(THD *thd,
       1) for stored procedures,
       2) for multitable update after lock failure and table reopening.
     */
-    if (save_first_natural_join_processing)
+    if (context->select_lex->first_natural_join_processing)
     {
-      context->select_lex->first_natural_join_processing= FALSE;
       if (store_top_level_join_columns(thd, table_ref,
                                        left_neighbor, right_neighbor))
-        return TRUE;
+        DBUG_RETURN(true);
       if (left_neighbor)
       {
         TABLE_LIST *first_leaf_on_the_right;
@@ -7652,8 +7648,9 @@ static bool setup_natural_join_row_types(THD *thd,
   DBUG_ASSERT(right_neighbor);
   context->first_name_resolution_table=
     right_neighbor->first_leaf_for_name_resolution();
+  context->select_lex->first_natural_join_processing= false;
 
-  return FALSE;
+  DBUG_RETURN (false);
 }
 
 
diff --git a/sql/sql_class.h b/sql/sql_class.h
index 060f2ef77f5..71b1a7d4c1c 100644
--- a/sql/sql_class.h
+++ b/sql/sql_class.h
@@ -655,15 +655,10 @@ public:
   virtual ~Query_arena() {};
 
   inline bool is_stmt_prepare() const { return state == STMT_INITIALIZED; }
-  inline bool is_first_sp_execute() const
-  { return state == STMT_INITIALIZED_FOR_SP; }
   inline bool is_stmt_prepare_or_first_sp_execute() const
   { return (int)state < (int)STMT_PREPARED; }
   inline bool is_stmt_prepare_or_first_stmt_execute() const
   { return (int)state <= (int)STMT_PREPARED; }
-  inline bool is_first_stmt_execute() const { return state == STMT_PREPARED; }
-  inline bool is_stmt_execute() const
-  { return state == STMT_PREPARED || state == STMT_EXECUTED; }
   inline bool is_conventional() const
   { return state == STMT_CONVENTIONAL_EXECUTION; }
 
@@ -1434,6 +1429,19 @@ extern "C" void my_message_sql(uint error, const char *str, myf MyFlags);
 class THD :public Statement,
            public Open_tables_state
 {
+private:
+  inline bool is_stmt_prepare() const
+  { DBUG_ASSERT(0); return Statement::is_stmt_prepare(); }
+
+  inline bool is_stmt_prepare_or_first_sp_execute() const
+  { DBUG_ASSERT(0); return Statement::is_stmt_prepare_or_first_sp_execute(); }
+
+  inline bool is_stmt_prepare_or_first_stmt_execute() const
+  { DBUG_ASSERT(0); return Statement::is_stmt_prepare_or_first_stmt_execute(); }
+
+  inline bool is_conventional() const
+  { DBUG_ASSERT(0); return Statement::is_conventional(); }
+
 public:
   MDL_context mdl_context;
 
diff --git a/sql/sql_load.cc b/sql/sql_load.cc
index ae708178097..35c26f9bb89 100644
--- a/sql/sql_load.cc
+++ b/sql/sql_load.cc
@@ -1,4 +1,4 @@
-/* Copyright (c) 2000, 2010 Oracle and/or its affiliates. All rights reserved.
+/* Copyright (c) 2000, 2011 Oracle and/or its affiliates. All rights reserved.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -743,8 +743,7 @@ static bool write_execute_load_query_log_event(THD *thd, sql_exchange* ex,
       pfields.append("`");
       pfields.append(item->name);
       pfields.append("`");
-      pfields.append("=");
-      val->print(&pfields, QT_ORDINARY);
+      pfields.append(val->name);
     }
   }
 
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index d9d99de2911..24f7fdb8e61 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -4434,7 +4434,11 @@ static bool execute_sqlcom_select(THD *thd, TABLE_LIST *all_tables)
         return 1;                               /* purecov: inspected */
       thd->send_explain_fields(result);
       res= mysql_explain_union(thd, &thd->lex->unit, result);
-      if (lex->describe & DESCRIBE_EXTENDED)
+      /*
+        The code which prints the extended description is not robust
+        against malformed queries, so skip it if we have an error.
+      */
+      if (!res && (lex->describe & DESCRIBE_EXTENDED))
       {
         char buff[1024];
         String str(buff,(uint32) sizeof(buff), system_charset_info);
diff --git a/sql/sql_partition.cc b/sql/sql_partition.cc
index 5c2c0bb95d6..776ce01cc54 100644
--- a/sql/sql_partition.cc
+++ b/sql/sql_partition.cc
@@ -3979,7 +3979,7 @@ void get_partition_set(const TABLE *table, uchar *buf, const uint index,
   part_spec->start_part= 0;
   part_spec->end_part= num_parts - 1;
   if ((index < MAX_KEY) && 
-       key_spec->flag == (uint)HA_READ_KEY_EXACT &&
+       key_spec && key_spec->flag == (uint)HA_READ_KEY_EXACT &&
        part_info->some_fields_in_PF.is_set(index))
   {
     key_info= table->key_info+index;
diff --git a/sql/sql_yacc.yy b/sql/sql_yacc.yy
index 13a1b8029f2..5ab1a648d09 100644
--- a/sql/sql_yacc.yy
+++ b/sql/sql_yacc.yy
@@ -1,4 +1,4 @@
-/* Copyright (c) 2000, 2010 Oracle and/or its affiliates. All rights reserved.
+/* Copyright (c) 2000, 2011 Oracle and/or its affiliates. All rights reserved.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -11574,7 +11574,23 @@ field_or_var:
 
 opt_load_data_set_spec:
           /* empty */ {}
-        | SET insert_update_list {}
+        | SET load_data_set_list {}
+        ;
+
+load_data_set_list:
+          load_data_set_list ',' load_data_set_elem
+        | load_data_set_elem
+        ;
+
+load_data_set_elem:
+          simple_ident_nospvar equal remember_name expr_or_default remember_end
+          {
+            LEX *lex= Lex;
+            if (lex->update_list.push_back($1) || 
+                lex->value_list.push_back($4))
+                MYSQL_YYABORT;
+            $4->set_name($3, (uint) ($5 - $3), YYTHD->charset());
+          }
         ;
 
 /* Common definitions */
diff --git a/storage/archive/ha_archive.cc b/storage/archive/ha_archive.cc
index fe167318743..df556a0721c 100644
--- a/storage/archive/ha_archive.cc
+++ b/storage/archive/ha_archive.cc
@@ -1,17 +1,19 @@
-/* Copyright (C) 2003 MySQL AB, 2008-2009 Sun Microsystems, Inc
+/* Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved.
 
-  This program is free software; you can redistribute it and/or modify
-  it under the terms of the GNU General Public License as published by
-  the Free Software Foundation; version 2 of the License.
+   This program is free software; you can redistribute it and/or
+   modify it under the terms of the GNU General Public License
+   as published by the Free Software Foundation; version 2 of
+   the License.
 
-  This program is distributed in the hope that it will be useful,
-  but WITHOUT ANY WARRANTY; without even the implied warranty of
-  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-  GNU General Public License for more details.
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+   GNU General Public License for more details.
 
-  You should have received a copy of the GNU General Public License
-  along with this program; if not, write to the Free Software
-  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA */
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+   02110-1301  USA */
 
 #ifdef USE_PRAGMA_IMPLEMENTATION
 #pragma implementation        // gcc: Class implementation
@@ -923,7 +925,7 @@ int ha_archive::write_row(uchar *buf)
        */
       azflush(&(share->archive_write), Z_SYNC_FLUSH);
       /*
-        Set the position of the local read thread to the beginning postion.
+        Set the position of the local read thread to the beginning position.
       */
       if (read_data_header(&archive))
       {
@@ -1179,7 +1181,7 @@ int ha_archive::unpack_row(azio_stream *file_to_read, uchar *record)
   ptr+= table->s->null_bytes;
   for (Field **field=table->field ; *field ; field++)
   {
-    if (!((*field)->is_null()))
+    if (!((*field)->is_null_in_record(record)))
     {
       ptr= (*field)->unpack(record + (*field)->offset(table->record[0]), ptr);
     }
diff --git a/storage/ndb/src/kernel/blocks/lgman.cpp b/storage/ndb/src/kernel/blocks/lgman.cpp
index 53cb1e113e1..7dc71e7399a 100644
--- a/storage/ndb/src/kernel/blocks/lgman.cpp
+++ b/storage/ndb/src/kernel/blocks/lgman.cpp
@@ -1,17 +1,19 @@
-/* Copyright (C) 2003 MySQL AB
+/* Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved.
 
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; version 2 of the License.
+   This program is free software; you can redistribute it and/or
+   modify it under the terms of the GNU General Public License
+   as published by the Free Software Foundation; version 2 of
+   the License.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
-   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA */
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+   02110-1301  USA */
 
 #include "lgman.hpp"
 #include "diskpage.hpp"
@@ -2501,7 +2503,7 @@ Lgman::init_run_undo_log(Signal* signal)
     sendSignal(reference(), GSN_CONTINUEB, signal, 2, JBB);
     
     /**
-     * Insert in correct postion in list of logfile_group's
+     * Insert in correct position in list of logfile_group's
      */
     Ptr<Logfile_group> pos;
     for(tmp.first(pos); !pos.isNull(); tmp.next(pos))
diff --git a/strings/decimal.c b/strings/decimal.c
index 4766c3b2d00..74272b0a903 100644
--- a/strings/decimal.c
+++ b/strings/decimal.c
@@ -312,8 +312,8 @@ int decimal_actual_fraction(decimal_t *from)
       from            - value to convert
       to              - points to buffer where string representation
                         should be stored
-      *to_len         - in:  size of to buffer
-                        out: length of the actually written string
+      *to_len         - in:  size of to buffer (incl. terminating '\0')
+                        out: length of the actually written string (excl. '\0')
       fixed_precision - 0 if representation can be variable length and
                         fixed_decimals will not be checked in this case.
                         Put number as with fixed point position with this
@@ -330,6 +330,7 @@ int decimal2string(const decimal_t *from, char *to, int *to_len,
                    int fixed_precision, int fixed_decimals,
                    char filler)
 {
+  /* {intg_len, frac_len} output widths; {intg, frac} places in input */
   int len, intg, frac= from->frac, i, intg_len, frac_len, fill;
   /* number digits before decimal point */
   int fixed_intg= (fixed_precision ?
diff --git a/vio/viosocket.c b/vio/viosocket.c
index 9ad7134312c..daa5e6602c8 100644
--- a/vio/viosocket.c
+++ b/vio/viosocket.c
@@ -1,17 +1,19 @@
 /* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
 
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; version 2 of the License.
+   This program is free software; you can redistribute it and/or
+   modify it under the terms of the GNU General Public License
+   as published by the Free Software Foundation; version 2 of
+   the License.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
-   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA */
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+   02110-1301  USA */
 
 /*
   Note that we can't have assertion on file descriptors;  The reason for
@@ -865,7 +867,7 @@ size_t vio_read_shared_memory(Vio * vio, uchar* buf, size_t size)
 {
   size_t length;
   size_t remain_local;
-  char *current_postion;
+  char *current_position;
   HANDLE events[2];
 
   DBUG_ENTER("vio_read_shared_memory");
@@ -873,7 +875,7 @@ size_t vio_read_shared_memory(Vio * vio, uchar* buf, size_t size)
                        size));
 
   remain_local = size;
-  current_postion=buf;
+  current_position=buf;
 
   events[0]= vio->event_server_wrote;
   events[1]= vio->event_conn_closed;
@@ -907,11 +909,11 @@ size_t vio_read_shared_memory(Vio * vio, uchar* buf, size_t size)
     if (length > remain_local)
        length = remain_local;
 
-    memcpy(current_postion,vio->shared_memory_pos,length);
+    memcpy(current_position,vio->shared_memory_pos,length);
 
     vio->shared_memory_remain-=length;
     vio->shared_memory_pos+=length;
-    current_postion+=length;
+    current_position+=length;
     remain_local-=length;
 
     if (!vio->shared_memory_remain)
@@ -931,7 +933,7 @@ size_t vio_write_shared_memory(Vio * vio, const uchar* buf, size_t size)
 {
   size_t length, remain, sz;
   HANDLE pos;
-  const uchar *current_postion;
+  const uchar *current_position;
   HANDLE events[2];
 
   DBUG_ENTER("vio_write_shared_memory");
@@ -939,7 +941,7 @@ size_t vio_write_shared_memory(Vio * vio, const uchar* buf, size_t size)
                        size));
 
   remain = size;
-  current_postion = buf;
+  current_position = buf;
 
   events[0]= vio->event_server_read;
   events[1]= vio->event_conn_closed;
@@ -957,9 +959,9 @@ size_t vio_write_shared_memory(Vio * vio, const uchar* buf, size_t size)
 
     int4store(vio->handle_map,sz);
     pos = vio->handle_map + 4;
-    memcpy(pos,current_postion,sz);
+    memcpy(pos,current_position,sz);
     remain-=sz;
-    current_postion+=sz;
+    current_position+=sz;
     if (!SetEvent(vio->event_client_wrote))
       DBUG_RETURN((size_t) -1);
   }