Merge 5.2->5.3

9 files changed, 223 insertions, 67 deletions

diff --git a/mysql-test/r/range.result b/mysql-test/r/range.result
index 3d6426148d0..49e2086c703 100644
--- a/mysql-test/r/range.result
+++ b/mysql-test/r/range.result
@@ -712,14 +712,14 @@ INSERT INTO t1 VALUES
 'd8c4177d09f8b11f5.52725522');
 EXPLAIN
 SELECT s.oxid FROM t1 v, t1 s 
-WHERE s.oxrootid = 'd8c4177d09f8b11f5.52725521' AND
+WHERE 
 v.oxrootid ='d8c4177d09f8b11f5.52725521' AND
 s.oxleft > v.oxleft AND s.oxleft < v.oxright;
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	v	ref	OXLEFT,OXRIGHT,OXROOTID	OXROOTID	34	const	5	Using index condition
 1	SIMPLE	s	ALL	OXLEFT	NULL	NULL	NULL	12	Range checked for each record (index map: 0x4)
 SELECT s.oxid FROM t1 v, t1 s 
-WHERE s.oxrootid = 'd8c4177d09f8b11f5.52725521' AND
+WHERE
 v.oxrootid ='d8c4177d09f8b11f5.52725521' AND
 s.oxleft > v.oxleft AND s.oxleft < v.oxright;
 oxid
@@ -728,6 +728,11 @@ d8c4177d206a333d2.74422679
 d8c4177d225791924.30714720
 d8c4177d2380fc201.39666693
 d8c4177d24ccef970.14957924
+d8c4177d151affab2.81582771
+d8c4177d206a333d2.74422678
+d8c4177d225791924.30714721
+d8c4177d2380fc201.39666694
+d8c4177d24ccef970.14957925
 DROP TABLE t1;
 create table t1 (
 c1  char(10), c2  char(10), c3  char(10), c4  char(10),
@@ -1885,6 +1890,46 @@ AAA	AAA	AAA
 AAAA	AAAA	AAAA
 AAAAA	AAAAA	AAAAA
 DROP TABLE t1;
+#
+# mdev-4894:  Poor performance with unnecessary 
+# (bug#70021) 'Range checked for each record'
+#
+create table t1( key1 int not null, INDEX i1(key1) );
+insert into t1 values (1),(2),(3),(4),(5),(6),(7),(8);
+insert into t1 select key1+8 from t1;
+insert into t1 select key1+16 from t1;
+insert into t1 select key1+32 from t1;
+insert into t1 select key1+64 from t1;
+insert into t1 select key1+128 from t1;
+insert into t1 select key1+256 from t1;
+insert into t1 select key1+512 from t1;
+alter table t1 add key2 int not null, add index i2(key2);
+update t1 set key2=key1;
+analyze table t1;
+Table	Op	Msg_type	Msg_text
+test.t1	analyze	status	OK
+create table t2 (a int);
+insert into t2 values (1),(2),(3),(4),(5),(6),(7),(8);
+insert into t2 select a+16 from t2;
+insert into t2 select a+32 from t2;
+insert into t2 select a+64 from t2;
+explain
+select count(*) from t2 left join t1 on (t1.key1 < 3 or t1.key1 > 1020) and t1.key2 < 1000;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	SIMPLE	t2	ALL	NULL	NULL	NULL	NULL	64	
+1	SIMPLE	t1	range	i1,i2	i1	4	NULL	78	Using where; Using join buffer (flat, BNL join)
+select count(*) from t2 left join t1 on (t1.key1 < 3 or t1.key1 > 1020) and t1.key2 < 1000;
+count(*)
+128
+explain
+select count(*) from t2 left join t1 on (t1.key1 < 3 or t1.key1 > 1020) and t1.key2 < t2.a;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	SIMPLE	t2	ALL	NULL	NULL	NULL	NULL	64	
+1	SIMPLE	t1	range	i1,i2	i1	4	NULL	78	Using where; Using join buffer (flat, BNL join)
+select count(*) from t2 left join t1 on (t1.key1 < 3 or t1.key1 > 1020) and t1.key2 < t2.a;
+count(*)
+126
+drop table t1,t2;
 End of 5.1 tests
 #
 # LP Bug #533117: Wrong use_count in SEL_ARG trees
diff --git a/mysql-test/r/range_mrr_icp.result b/mysql-test/r/range_mrr_icp.result
index 74397909ea8..f80ef838557 100644
--- a/mysql-test/r/range_mrr_icp.result
+++ b/mysql-test/r/range_mrr_icp.result
@@ -714,14 +714,14 @@ INSERT INTO t1 VALUES
 'd8c4177d09f8b11f5.52725522');
 EXPLAIN
 SELECT s.oxid FROM t1 v, t1 s 
-WHERE s.oxrootid = 'd8c4177d09f8b11f5.52725521' AND
+WHERE 
 v.oxrootid ='d8c4177d09f8b11f5.52725521' AND
 s.oxleft > v.oxleft AND s.oxleft < v.oxright;
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	v	ref	OXLEFT,OXRIGHT,OXROOTID	OXROOTID	34	const	5	Using index condition
 1	SIMPLE	s	ALL	OXLEFT	NULL	NULL	NULL	12	Range checked for each record (index map: 0x4)
 SELECT s.oxid FROM t1 v, t1 s 
-WHERE s.oxrootid = 'd8c4177d09f8b11f5.52725521' AND
+WHERE
 v.oxrootid ='d8c4177d09f8b11f5.52725521' AND
 s.oxleft > v.oxleft AND s.oxleft < v.oxright;
 oxid
@@ -730,6 +730,11 @@ d8c4177d206a333d2.74422679
 d8c4177d225791924.30714720
 d8c4177d2380fc201.39666693
 d8c4177d24ccef970.14957924
+d8c4177d151affab2.81582771
+d8c4177d206a333d2.74422678
+d8c4177d225791924.30714721
+d8c4177d2380fc201.39666694
+d8c4177d24ccef970.14957925
 DROP TABLE t1;
 create table t1 (
 c1  char(10), c2  char(10), c3  char(10), c4  char(10),
@@ -1887,6 +1892,46 @@ AAA	AAA	AAA
 AAAA	AAAA	AAAA
 AAAAA	AAAAA	AAAAA
 DROP TABLE t1;
+#
+# mdev-4894:  Poor performance with unnecessary 
+# (bug#70021) 'Range checked for each record'
+#
+create table t1( key1 int not null, INDEX i1(key1) );
+insert into t1 values (1),(2),(3),(4),(5),(6),(7),(8);
+insert into t1 select key1+8 from t1;
+insert into t1 select key1+16 from t1;
+insert into t1 select key1+32 from t1;
+insert into t1 select key1+64 from t1;
+insert into t1 select key1+128 from t1;
+insert into t1 select key1+256 from t1;
+insert into t1 select key1+512 from t1;
+alter table t1 add key2 int not null, add index i2(key2);
+update t1 set key2=key1;
+analyze table t1;
+Table	Op	Msg_type	Msg_text
+test.t1	analyze	status	OK
+create table t2 (a int);
+insert into t2 values (1),(2),(3),(4),(5),(6),(7),(8);
+insert into t2 select a+16 from t2;
+insert into t2 select a+32 from t2;
+insert into t2 select a+64 from t2;
+explain
+select count(*) from t2 left join t1 on (t1.key1 < 3 or t1.key1 > 1020) and t1.key2 < 1000;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	SIMPLE	t2	ALL	NULL	NULL	NULL	NULL	64	
+1	SIMPLE	t1	range	i1,i2	i1	4	NULL	78	Using where; Rowid-ordered scan; Using join buffer (flat, BNL join)
+select count(*) from t2 left join t1 on (t1.key1 < 3 or t1.key1 > 1020) and t1.key2 < 1000;
+count(*)
+128
+explain
+select count(*) from t2 left join t1 on (t1.key1 < 3 or t1.key1 > 1020) and t1.key2 < t2.a;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	SIMPLE	t2	ALL	NULL	NULL	NULL	NULL	64	
+1	SIMPLE	t1	range	i1,i2	i1	4	NULL	78	Using where; Rowid-ordered scan; Using join buffer (flat, BNL join)
+select count(*) from t2 left join t1 on (t1.key1 < 3 or t1.key1 > 1020) and t1.key2 < t2.a;
+count(*)
+126
+drop table t1,t2;
 End of 5.1 tests
 #
 # LP Bug #533117: Wrong use_count in SEL_ARG trees
diff --git a/mysql-test/suite/vcol/r/vcol_misc.result b/mysql-test/suite/vcol/r/vcol_misc.result
index 4929eabb2e9..4514928e592 100644
--- a/mysql-test/suite/vcol/r/vcol_misc.result
+++ b/mysql-test/suite/vcol/r/vcol_misc.result
@@ -197,6 +197,13 @@ SELECT COUNT(*) FROM t1;
 COUNT(*)
 2
 DROP TABLE t1;
+#
+# MDEV-4823 Server crashes in Item_func_not::fix_fields on
+# creating a table with a virtual column using NOT
+#
+CREATE TABLE t1 ( f1 INT, v4 INT AS ( NOT f1 ) VIRTUAL );
+drop table t1;
+# end of 5.2 tests
 create table t1 (a int, b int);
 insert into t1 values (3, 30), (4, 20), (1, 20);
 create table t2 (c int, d int, v int as (d+1), index idx(c));
@@ -309,3 +316,4 @@ ERROR HY000: The value specified for computed column 'd' in table 't1' ignored
 INSERT INTO `test`.`t1`(`a`,`b`,`c`,`d`) VALUES ( '1','a',NULL,'a');
 ERROR HY000: The value specified for computed column 'd' in table 't1' ignored
 drop table t1;
+# end of 5.3 tests
diff --git a/mysql-test/suite/vcol/t/vcol_misc.test b/mysql-test/suite/vcol/t/vcol_misc.test
index 3c51ee4b685..9c8443218fa 100644
--- a/mysql-test/suite/vcol/t/vcol_misc.test
+++ b/mysql-test/suite/vcol/t/vcol_misc.test
@@ -197,6 +197,15 @@ SELECT COUNT(*) FROM t1;
 
 DROP TABLE t1;
 
+--echo #
+--echo # MDEV-4823 Server crashes in Item_func_not::fix_fields on
+--echo # creating a table with a virtual column using NOT
+--echo #
+CREATE TABLE t1 ( f1 INT, v4 INT AS ( NOT f1 ) VIRTUAL );
+drop table t1;
+
+--echo # end of 5.2 tests
+
 #
 #  SELECT that uses a virtual column and executed with BKA
 #
@@ -265,3 +274,5 @@ UPDATE `test`.`t1` SET `d`='b' WHERE `a`='1' AND `b`='a' AND `c`='1' AND  `d`='a
 --error ER_WARNING_NON_DEFAULT_VALUE_FOR_VIRTUAL_COLUMN
 INSERT INTO `test`.`t1`(`a`,`b`,`c`,`d`) VALUES ( '1','a',NULL,'a');
 drop table t1;
+
+--echo # end of 5.3 tests
diff --git a/mysql-test/t/range.test b/mysql-test/t/range.test
index 6ac883ffcc1..0be487a8460 100644
--- a/mysql-test/t/range.test
+++ b/mysql-test/t/range.test
@@ -569,12 +569,12 @@ INSERT INTO t1 VALUES
 
 EXPLAIN
 SELECT s.oxid FROM t1 v, t1 s 
-  WHERE s.oxrootid = 'd8c4177d09f8b11f5.52725521' AND
+  WHERE 
         v.oxrootid ='d8c4177d09f8b11f5.52725521' AND
         s.oxleft > v.oxleft AND s.oxleft < v.oxright;
 
 SELECT s.oxid FROM t1 v, t1 s 
-  WHERE s.oxrootid = 'd8c4177d09f8b11f5.52725521' AND
+  WHERE
         v.oxrootid ='d8c4177d09f8b11f5.52725521' AND
         s.oxleft > v.oxleft AND s.oxleft < v.oxright;
 
@@ -1480,6 +1480,40 @@ SELECT * FROM t1 IGNORE INDEX(PRIMARY) WHERE F1 BETWEEN 'A    ' AND
 
 DROP TABLE t1;
 
+--echo #
+--echo # mdev-4894:  Poor performance with unnecessary 
+--echo # (bug#70021) 'Range checked for each record'
+--echo #
+
+create table t1( key1 int not null, INDEX i1(key1) );
+insert into t1 values (1),(2),(3),(4),(5),(6),(7),(8);
+insert into t1 select key1+8 from t1; 
+insert into t1 select key1+16 from t1; 
+insert into t1 select key1+32 from t1; 
+insert into t1 select key1+64 from t1; 
+insert into t1 select key1+128 from t1; 
+insert into t1 select key1+256 from t1; 
+insert into t1 select key1+512 from t1; 
+
+alter table t1 add key2 int not null, add index i2(key2);
+update t1 set key2=key1;
+analyze table t1;
+
+create table t2 (a int);
+insert into t2 values (1),(2),(3),(4),(5),(6),(7),(8);
+insert into t2 select a+16 from t2;
+insert into t2 select a+32 from t2;
+insert into t2 select a+64 from t2;
+
+explain
+select count(*) from t2 left join t1 on (t1.key1 < 3 or t1.key1 > 1020) and t1.key2 < 1000;
+select count(*) from t2 left join t1 on (t1.key1 < 3 or t1.key1 > 1020) and t1.key2 < 1000;
+explain
+select count(*) from t2 left join t1 on (t1.key1 < 3 or t1.key1 > 1020) and t1.key2 < t2.a;
+select count(*) from t2 left join t1 on (t1.key1 < 3 or t1.key1 > 1020) and t1.key2 < t2.a;
+
+drop table t1,t2;
+
 --echo End of 5.1 tests
 
 --echo #
diff --git a/sql/spatial.cc b/sql/spatial.cc
index 65ba01bf44e..8f74d4fa4a7 100644
--- a/sql/spatial.cc
+++ b/sql/spatial.cc
@@ -443,19 +443,18 @@ const char *Geometry::append_points(String *txt, uint32 n_points,
 const char *Geometry::get_mbr_for_points(MBR *mbr, const char *data,
 					 uint offset) const
 {
-  uint32 n_points;
+  uint32 points;
   /* read number of points */
   if (no_data(data, 4))
     return 0;
-  n_points= uint4korr(data);
+  points= uint4korr(data);
   data+= 4;
 
-  if (n_points > max_n_points ||
-      no_data(data, (POINT_DATA_SIZE + offset) * n_points))
+  if (not_enough_points(data, points, offset))
     return 0;
 
   /* Calculate MBR for points */
-  while (n_points--)
+  while (points--)
   {
     data+= offset;
     mbr->add_xy(data, data + SIZEOF_STORED_DOUBLE);
@@ -559,12 +558,16 @@ const Geometry::Class_info *Gis_point::get_class_info() const
 
 uint32 Gis_line_string::get_data_size() const 
 {
-  uint32 n_points, size;
-  if (no_data(m_data, 4) ||
-      (n_points= uint4korr(m_data)) > max_n_points ||
-      no_data(m_data, (size= 4 + n_points * POINT_DATA_SIZE)))
+  uint32 n_points;
+  if (no_data(m_data, 4))
     return GET_SIZE_ERROR;
-  return size;
+
+  n_points= uint4korr(m_data);
+
+  if (not_enough_points(m_data + 4, n_points))
+    return GET_SIZE_ERROR;
+
+  return 4 + n_points * POINT_DATA_SIZE;
 }
 
 
@@ -603,9 +606,8 @@ uint Gis_line_string::init_from_wkb(const char *wkb, uint len,
   const char *wkb_end;
   Gis_point p;
 
-  if (len < 4 ||
-      (n_points= wkb_get_uint(wkb, bo)) < 1 ||
-      n_points > max_n_points)
+  if (len < 4 || (n_points= wkb_get_uint(wkb, bo)) < 1 ||
+      ((len - 4) / POINT_DATA_SIZE) < n_points)
     return 0;
   proper_length= 4 + n_points * POINT_DATA_SIZE;
 
@@ -635,7 +637,7 @@ bool Gis_line_string::get_data_as_wkt(String *txt, const char **end) const
   data += 4;
 
   if (n_points < 1 ||
-      no_data(data, POINT_DATA_SIZE * n_points) ||
+      not_enough_points(data, n_points) ||
       txt->reserve(((MAX_DIGITS_IN_DOUBLE + 1)*2 + 1) * n_points))
     return 1;
 
@@ -672,8 +674,7 @@ int Gis_line_string::geom_length(double *len, const char **end) const
     return 1;
   n_points= uint4korr(data);
   data+= 4;
-  if (n_points < 1 || n_points > max_n_points ||
-      no_data(data, POINT_DATA_SIZE * n_points))
+  if (n_points < 1 || not_enough_points(data, n_points))
     return 1;
 
   get_point(&prev_x, &prev_y, data);
@@ -721,8 +722,7 @@ int Gis_line_string::is_closed(int *closed) const
     return 0;
   }
   data+= 4;
-  if (n_points == 0 || n_points > max_n_points ||
-      no_data(data, POINT_DATA_SIZE * n_points))
+  if (n_points == 0 || not_enough_points(data, n_points))
     return 1;
 
   /* Get first point */
@@ -757,8 +757,7 @@ int Gis_line_string::end_point(String *result) const
   if (no_data(m_data, 4))
     return 1;
   n_points= uint4korr(m_data);
-  if (n_points == 0 || n_points > max_n_points ||
-      no_data(m_data, POINT_DATA_SIZE * n_points))
+  if (n_points == 0 || not_enough_points(m_data+4, n_points))
     return 1;
   return create_point(result, m_data + 4 + (n_points - 1) * POINT_DATA_SIZE);
 }
@@ -771,9 +770,7 @@ int Gis_line_string::point_n(uint32 num, String *result) const
     return 1;
   num--;
   n_points= uint4korr(m_data);
-  if (num >= n_points ||
-      num > max_n_points || // means (num > n_points || num < 1)
-      no_data(m_data, num * POINT_DATA_SIZE))
+  if (num >= n_points || not_enough_points(m_data+4, n_points))
     return 1;
 
   return create_point(result, m_data + 4 + num*POINT_DATA_SIZE);
@@ -837,7 +834,7 @@ uint32 Gis_polygon::get_data_size() const
   while (n_linear_rings--)
   {
     if (no_data(data, 4) ||
-        (n_points= uint4korr(data)) > max_n_points)
+        not_enough_points(data+4, n_points= uint4korr(data)))
       return GET_SIZE_ERROR;
     data+= 4 + n_points*POINT_DATA_SIZE;
   }
@@ -981,8 +978,7 @@ bool Gis_polygon::get_data_as_wkt(String *txt, const char **end) const
       return 1;
     n_points= uint4korr(data);
     data+= 4;
-    if (n_points > max_n_points ||
-        no_data(data, POINT_DATA_SIZE * n_points) ||
+    if (not_enough_points(data, n_points) ||
 	txt->reserve(2 + ((MAX_DIGITS_IN_DOUBLE + 1) * 2 + 1) * n_points))
       return 1;
     txt->qs_append('(');
@@ -1036,8 +1032,8 @@ int Gis_polygon::area(double *ar, const char **end_of_data) const
     if (no_data(data, 4))
       return 1;
     n_points= uint4korr(data);
-    if (n_points == 0 || n_points > max_n_points ||
-        no_data(data, POINT_DATA_SIZE * n_points))
+    if (n_points == 0 ||
+        not_enough_points(data, n_points))
       return 1;
     get_point(&prev_x, &prev_y, data+4);
     data+= (4+POINT_DATA_SIZE);
@@ -1073,8 +1069,7 @@ int Gis_polygon::exterior_ring(String *result) const
   n_points= uint4korr(data);
   data+= 4;
   length= n_points * POINT_DATA_SIZE;
-  if (n_points > max_n_points ||
-      no_data(data, length) || result->reserve(1+4+4+ length))
+  if (not_enough_points(data, n_points) || result->reserve(1+4+4+ length))
     return 1;
 
   result->q_append((char) wkb_ndr);
@@ -1120,7 +1115,7 @@ int Gis_polygon::interior_ring_n(uint32 num, String *result) const
   n_points= uint4korr(data);
   points_size= n_points * POINT_DATA_SIZE;
   data+= 4;
-  if (no_data(data, points_size) || result->reserve(1 + 4 + 4 + points_size))
+  if (not_enough_points(data, n_points) || result->reserve(1+4+4+ points_size))
     return 1;
 
   result->q_append((char) wkb_ndr);
@@ -1157,8 +1152,7 @@ int Gis_polygon::centroid_xy(double *x, double *y) const
       return 1;
     org_n_points= n_points= uint4korr(data);
     data+= 4;
-    if (n_points == 0 || n_points > max_n_points ||
-        no_data(data, POINT_DATA_SIZE * n_points))
+    if (n_points == 0 || not_enough_points(data, n_points))
       return 1;
     get_point(&prev_x, &prev_y, data);
     data+= POINT_DATA_SIZE;
@@ -1286,13 +1280,12 @@ const Geometry::Class_info *Gis_polygon::get_class_info() const
 uint32 Gis_multi_point::get_data_size() const 
 {
   uint32 n_points;
-  uint32 size;
 
   if (no_data(m_data, 4) ||
-      (n_points= uint4korr(m_data)) > max_n_points ||
-      no_data(m_data, (size= 4 + n_points*(POINT_DATA_SIZE + WKB_HEADER_SIZE))))
+      not_enough_points(m_data+4, (n_points= uint4korr(m_data)),
+        WKB_HEADER_SIZE))
      return GET_SIZE_ERROR;
-  return size;
+  return  4 + n_points * (POINT_DATA_SIZE + WKB_HEADER_SIZE);
 }
 
 
@@ -1387,7 +1380,7 @@ bool Gis_multi_point::get_data_as_wkt(String *txt, const char **end) const
 
   n_points= uint4korr(m_data);
   if (n_points > max_n_points ||
-      no_data(m_data+4, n_points * (POINT_DATA_SIZE + WKB_HEADER_SIZE)) ||
+      not_enough_points(m_data+4, n_points, WKB_HEADER_SIZE) ||
       txt->reserve(((MAX_DIGITS_IN_DOUBLE + 1) * 2 + 1) * n_points))
     return 1;
   *end= append_points(txt, n_points, m_data+4, WKB_HEADER_SIZE);
@@ -1479,7 +1472,8 @@ uint32 Gis_multi_line_string::get_data_size() const
   while (n_line_strings--)
   {
     if (no_data(data, WKB_HEADER_SIZE + 4) ||
-        (n_points= uint4korr(data + WKB_HEADER_SIZE)) > max_n_points)
+        not_enough_points(data + WKB_HEADER_SIZE+4,
+                          (n_points= uint4korr(data + WKB_HEADER_SIZE))))
       return GET_SIZE_ERROR;
     data+= (WKB_HEADER_SIZE + 4 + n_points*POINT_DATA_SIZE);
   }
@@ -1608,8 +1602,7 @@ bool Gis_multi_line_string::get_data_as_wkt(String *txt,
       return 1;
     n_points= uint4korr(data + WKB_HEADER_SIZE);
     data+= WKB_HEADER_SIZE + 4;
-    if (n_points > max_n_points ||
-        no_data(data, n_points * POINT_DATA_SIZE) ||
+    if (not_enough_points(data, n_points) ||
 	txt->reserve(2 + ((MAX_DIGITS_IN_DOUBLE + 1) * 2 + 1) * n_points))
       return 1;
     txt->qs_append('(');
@@ -1670,7 +1663,7 @@ int Gis_multi_line_string::geometry_n(uint32 num, String *result) const
       return 1;
     n_points= uint4korr(data + WKB_HEADER_SIZE);
     length= WKB_HEADER_SIZE + 4+ POINT_DATA_SIZE * n_points;
-    if (n_points > max_n_points || no_data(data, length))
+    if (not_enough_points(data+WKB_HEADER_SIZE+4, n_points))
       return 1;
     if (!--num)
       break;
@@ -1801,7 +1794,7 @@ uint32 Gis_multi_polygon::get_data_size() const
     while (n_linear_rings--)
     {
       if (no_data(data, 4) ||
-          (n_points= uint4korr(data)) > max_n_points)
+          not_enough_points(data+4, (n_points= uint4korr(data))))
 	return GET_SIZE_ERROR;
       data+= 4 + n_points * POINT_DATA_SIZE;
     }
@@ -1935,8 +1928,7 @@ bool Gis_multi_polygon::get_data_as_wkt(String *txt, const char **end) const
         return 1;
       uint32 n_points= uint4korr(data);
       data+= 4;
-      if (n_points > max_n_points ||
-          no_data(data, POINT_DATA_SIZE * n_points) ||
+      if (not_enough_points(data, n_points) ||
 	  txt->reserve(2 + ((MAX_DIGITS_IN_DOUBLE + 1) * 2 + 1) * n_points,
 		       512))
 	return 1;
@@ -2019,7 +2011,7 @@ int Gis_multi_polygon::geometry_n(uint32 num, String *result) const
       if (no_data(data, 4))
 	return 1;
       n_points= uint4korr(data);
-      if (n_points > max_n_points)
+      if (not_enough_points(data + 4, n_points))
         return 1;
       data+= 4 + POINT_DATA_SIZE * n_points;
     }
diff --git a/sql/spatial.h b/sql/spatial.h
index aa7e8fd0c8d..b9b9bddf5f9 100644
--- a/sql/spatial.h
+++ b/sql/spatial.h
@@ -212,11 +212,6 @@ struct Geometry_buffer;
 class Geometry
 {
 public:
-  // Maximum number of points in feature that can fit into String
-  static const uint32 max_n_points=
-    (uint32) (INT_MAX32 - WKB_HEADER_SIZE - 4 /* n_points */) /
-    POINT_DATA_SIZE;
-public:
   Geometry() {}                               /* Remove gcc warning */
   virtual ~Geometry() {}                        /* Remove gcc warning */
   static void *operator new(size_t size, void *buffer)
@@ -337,6 +332,25 @@ protected:
   {
     return (cur_data + data_amount > m_data_end);
   }
+
+  /**
+     Check if there're enough points remaining as requested
+
+     Need to perform the calculation in logical units, since multiplication
+     can overflow the size data type.
+
+     @arg data              pointer to the begining of the points array
+     @arg expected_points   number of points expected
+     @arg extra_point_space extra space for each point element in the array
+     @return               true if there are not enough points
+  */
+  inline bool not_enough_points(const char *data, uint32 expected_points,
+                                uint32 extra_point_space = 0) const
+  {
+    return (m_data_end < data ||
+            (expected_points > ((m_data_end - data) /
+                                (POINT_DATA_SIZE + extra_point_space))));
+  }
   const char *m_data;
   const char *m_data_end;
 };
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 40021baa954..5e594b99327 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -8664,19 +8664,18 @@ make_join_select(JOIN *join,SQL_SELECT *select,COND *cond)
 	  else
 	  {
 	    sel->needed_reg=tab->needed_reg;
-	    sel->quick_keys.clear_all();
 	  }
+	  sel->quick_keys= tab->table->quick_keys;
 	  if (!sel->quick_keys.is_subset(tab->checked_keys) ||
               !sel->needed_reg.is_subset(tab->checked_keys))
 	  {
-	    tab->keys=sel->quick_keys;
-            tab->keys.merge(sel->needed_reg);
 	    tab->use_quick= (!sel->needed_reg.is_clear_all() &&
-			     (select->quick_keys.is_clear_all() ||
-			      (select->quick &&
-			       (select->quick->records >= 100L)))) ?
+			     (sel->quick_keys.is_clear_all() ||
+			      (sel->quick &&
+			       (sel->quick->records >= 100L)))) ?
 	      2 : 1;
 	    sel->read_tables= used_tables & ~current_map;
+            sel->quick_keys.clear_all();
 	  }
 	  if (i != join->const_tables && tab->use_quick != 2 &&
               !tab->first_inner)
diff --git a/sql/table.cc b/sql/table.cc
index 7c5f9ac82cb..9e1c53f7b22 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -1801,7 +1801,7 @@ bool fix_vcol_expr(THD *thd,
   bool result= TRUE;
   TABLE_LIST tables;
   TABLE_LIST *save_table_list, *save_first_table, *save_last_table;
-  int error;
+  int error= 0;
   Name_resolution_context *context;
   const char *save_where;
   char* db_name;
@@ -1849,9 +1849,17 @@ bool fix_vcol_expr(THD *thd,
   save_use_only_table_context= thd->lex->use_only_table_context;
   thd->lex->use_only_table_context= TRUE;
   /* Fix fields referenced to by the virtual column function */
-  thd->lex->context_analysis_only|= CONTEXT_ANALYSIS_ONLY_VCOL_EXPR;
-  error= func_expr->fix_fields(thd, (Item**)0);
-  thd->lex->context_analysis_only&= ~CONTEXT_ANALYSIS_ONLY_VCOL_EXPR;
+  if (!func_expr->fixed)
+  {
+    thd->lex->context_analysis_only|= CONTEXT_ANALYSIS_ONLY_VCOL_EXPR;
+    error= func_expr->fix_fields(thd, &vcol_info->expr_item);
+    thd->lex->context_analysis_only&= ~CONTEXT_ANALYSIS_ONLY_VCOL_EXPR;
+  }
+
+  /* fix_fields could change the expression */
+  func_expr= vcol_info->expr_item;
+  /* Number of columns will be checked later */
+
   /* Restore the original context*/
   thd->lex->use_only_table_context= save_use_only_table_context;
   context->table_list= save_table_list;