squash! 4cb69791aaa59e786859405c3c3826a6a15c4a09bb-11.0

- Ensure that TEMP_TABLE_PARAM.func_count includes all items that may
  need a copy function.
- Fixed that Aria allocates enough space for key copies.
- Fixed that Aria does not check empty_bits if not allocated.

The first issue could cause crashes, the other issues should not
affect anything.

10 files changed, 61 insertions, 42 deletions

diff --git a/sql/opt_subselect.cc b/sql/opt_subselect.cc
index 4edd4ccecad..8e6a4dbf1f8 100644
--- a/sql/opt_subselect.cc
+++ b/sql/opt_subselect.cc
@@ -4306,6 +4306,7 @@ bool setup_sj_materialization_part1(JOIN_TAB *sjm_tab)
   }
 
   sjm->sjm_table_param.field_count= subq_select->item_list.elements;
+  sjm->sjm_table_param.func_count= sjm->sjm_table_param.field_count;
   sjm->sjm_table_param.force_not_null_cols= TRUE;
 
   if (!(sjm->table= create_tmp_table(thd, &sjm->sjm_table_param, 
@@ -5925,14 +5926,14 @@ TABLE *create_dummy_tmp_table(THD *thd)
   DBUG_ENTER("create_dummy_tmp_table");
   TABLE *table;
   TMP_TABLE_PARAM sjm_table_param;
-  sjm_table_param.init();
-  sjm_table_param.field_count= 1;
   List<Item> sjm_table_cols;
   const LEX_CSTRING dummy_name= { STRING_WITH_LEN("dummy") };
   Item *column_item= new (thd->mem_root) Item_int(thd, 1);
   if (!column_item)
     DBUG_RETURN(NULL);
 
+  sjm_table_param.init();
+  sjm_table_param.field_count= sjm_table_param.func_count= 1;
   sjm_table_cols.push_back(column_item, thd->mem_root);
   if (!(table= create_tmp_table(thd, &sjm_table_param, 
                                 sjm_table_cols, (ORDER*) 0, 
diff --git a/sql/select_handler.cc b/sql/select_handler.cc
index 795ed8eb641..b0b8e58623d 100644
--- a/sql/select_handler.cc
+++ b/sql/select_handler.cc
@@ -51,18 +51,19 @@ select_handler::~select_handler()
 
 TABLE *select_handler::create_tmp_table(THD *thd, SELECT_LEX *select)
 {
-  DBUG_ENTER("select_handler::create_tmp_table");
   List<Item> types;
   TMP_TABLE_PARAM tmp_table_param;
+  TABLE *table;
+  DBUG_ENTER("select_handler::create_tmp_table");
+
   if (select->master_unit()->join_union_item_types(thd, types, 1))
     DBUG_RETURN(NULL);
   tmp_table_param.init();
-  tmp_table_param.field_count= types.elements;
-
-  TABLE *table= ::create_tmp_table(thd, &tmp_table_param, types,
-                                   (ORDER *) 0, false, 0,
-                                   TMP_TABLE_ALL_COLUMNS, 1,
-                                   &empty_clex_str, true, false);
+  tmp_table_param.field_count= tmp_table_param.func_count= types.elements;
+  table= ::create_tmp_table(thd, &tmp_table_param, types,
+                            (ORDER *) 0, false, 0,
+                            TMP_TABLE_ALL_COLUMNS, 1,
+                            &empty_clex_str, true, false);
   DBUG_RETURN(table);
 }
 
diff --git a/sql/sql_class.cc b/sql/sql_class.cc
index 17ce7b3c048..beebaf12765 100644
--- a/sql/sql_class.cc
+++ b/sql/sql_class.cc
@@ -4287,6 +4287,7 @@ create_result_table(THD *thd_arg, List<Item> *column_types,
 {
   DBUG_ASSERT(table == 0);
   tmp_table_param.field_count= column_types->elements;
+  tmp_table_param.func_count= tmp_table_param.field_count;
   tmp_table_param.bit_fields_as_long= bit_fields_as_long;
 
   if (! (table= create_tmp_table(thd_arg, &tmp_table_param, *column_types,
diff --git a/sql/sql_expression_cache.cc b/sql/sql_expression_cache.cc
index bc44ecd79fa..69d85f3343d 100644
--- a/sql/sql_expression_cache.cc
+++ b/sql/sql_expression_cache.cc
@@ -114,7 +114,7 @@ void Expression_cache_tmptable::init()
 
   cache_table_param.init();
   /* dependent items and result */
-  cache_table_param.field_count= items.elements;
+  cache_table_param.field_count= cache_table_param.func_count= items.elements;
   /* postpone table creation to index description */
   cache_table_param.skip_create_table= 1;
 
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 0b7e4eae7f2..f421a31a96b 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -3590,7 +3590,9 @@ bool JOIN::make_aggr_tables_info()
 
       if (gbh)
       {
-        if (!(pushdown_query= new (thd->mem_root) Pushdown_query(select_lex, gbh)))
+        TABLE *table;
+        if (!(pushdown_query= new (thd->mem_root) Pushdown_query(select_lex,
+                                                                 gbh)))
           DBUG_RETURN(1);
         /*
           We must store rows in the tmp table if we need to do an ORDER BY
@@ -3610,12 +3612,13 @@ bool JOIN::make_aggr_tables_info()
 
         if (!(curr_tab->tmp_table_param= new TMP_TABLE_PARAM(tmp_table_param)))
           DBUG_RETURN(1);
-        TABLE* table= create_tmp_table(thd, curr_tab->tmp_table_param,
-                                       all_fields,
-                                       NULL, distinct,
-                                       TRUE, select_options, HA_ROWS_MAX,
-                                       &empty_clex_str, !need_tmp,
-                                       keep_row_order);
+        curr_tab->tmp_table_param->func_count= all_fields.elements;
+        table= create_tmp_table(thd, curr_tab->tmp_table_param,
+                                all_fields,
+                                NULL, distinct,
+                                TRUE, select_options, HA_ROWS_MAX,
+                                &empty_clex_str, !need_tmp,
+                                keep_row_order);
         if (!table)
           DBUG_RETURN(1);
 
@@ -28458,6 +28461,11 @@ bool JOIN::rollup_init()
   Item **ref_array;
 
   tmp_table_param.quick_group= 0;	// Can't create groups in tmp table
+  /*
+    Each group can potentially be replaced with Item_func_rollup_const() which
+    needs a copy_func placeholder.
+  */
+  tmp_table_param.func_count+= send_group_parts;
   rollup.state= ROLLUP::STATE_INITED;
 
   /*
@@ -28482,7 +28490,6 @@ bool JOIN::rollup_init()
 
   ref_array= (Item**) (rollup.ref_pointer_arrays+send_group_parts);
 
-
   /*
     Prepare space for field list for the different levels
     These will be filled up in rollup_make_fields()
@@ -28646,7 +28653,6 @@ bool JOIN::rollup_make_fields(List<Item> &fields_arg, List<Item> &sel_fields,
     /* Point to first hidden field */
     uint ref_array_ix= fields_arg.elements-1;
 
-
     /* Remember where the sum functions ends for the previous level */
     sum_funcs_end[pos+1]= *func;
 
diff --git a/sql/sql_show.cc b/sql/sql_show.cc
index 7b2f8922fa0..00972c98dcb 100644
--- a/sql/sql_show.cc
+++ b/sql/sql_show.cc
@@ -8405,25 +8405,29 @@ TABLE *create_schema_table(THD *thd, TABLE_LIST *table_list)
   ST_FIELD_INFO *fields= schema_table->fields_info;
   bool need_all_fieds= table_list->schema_table_reformed || // SHOW command
                        thd->lex->only_view_structure(); // need table structure
+  SELECT_LEX *select_lex;
+  bool keep_row_order;
+  TMP_TABLE_PARAM *tmp_table_param;
+  my_bitmap_map *bitmaps;
   DBUG_ENTER("create_schema_table");
 
   for (; !fields->end_marker(); fields++)
     field_count++;
 
-  TMP_TABLE_PARAM *tmp_table_param = new (thd->mem_root) TMP_TABLE_PARAM;
+  tmp_table_param = new (thd->mem_root) TMP_TABLE_PARAM;
   tmp_table_param->init();
   tmp_table_param->table_charset= system_charset_info;
-  tmp_table_param->field_count= field_count;
+  tmp_table_param->field_count= tmp_table_param->func_count= field_count;
   tmp_table_param->schema_table= 1;
-  SELECT_LEX *select_lex= table_list->select_lex;
-  bool keep_row_order= is_show_command(thd);
+  select_lex= table_list->select_lex;
+  keep_row_order= is_show_command(thd);
   if (!(table= create_tmp_table_for_schema(thd, tmp_table_param, *schema_table,
-                 (select_lex->options | thd->variables.option_bits | TMP_TABLE_ALL_COLUMNS),
+                 (select_lex->options | thd->variables.option_bits |
+                  TMP_TABLE_ALL_COLUMNS),
                   table_list->alias, !need_all_fieds, keep_row_order)))
     DBUG_RETURN(0);
-  my_bitmap_map* bitmaps=
-    (my_bitmap_map*) thd->alloc(bitmap_buffer_size(field_count));
-  my_bitmap_init(&table->def_read_set, (my_bitmap_map*) bitmaps, field_count);
+  bitmaps= (my_bitmap_map*) thd->alloc(bitmap_buffer_size(field_count));
+  my_bitmap_init(&table->def_read_set, bitmaps, field_count);
   table->read_set= &table->def_read_set;
   bitmap_clear_all(table->read_set);
   table_list->schema_table_param= tmp_table_param;
diff --git a/sql/sql_union.cc b/sql/sql_union.cc
index 5d3db73d4e2..7e27a8ff980 100644
--- a/sql/sql_union.cc
+++ b/sql/sql_union.cc
@@ -383,7 +383,8 @@ select_union_recursive::create_result_table(THD *thd_arg,
     return true;
   
   incr_table_param.init();
-  incr_table_param.field_count= column_types->elements;
+  incr_table_param.field_count= incr_table_param.func_count=
+    column_types->elements;
   incr_table_param.bit_fields_as_long= bit_fields_as_long;
   if (! (incr_table= create_tmp_table(thd_arg, &incr_table_param, *column_types,
                                       (ORDER*) 0, false, 1,
diff --git a/sql/temporary_tables.cc b/sql/temporary_tables.cc
index b43a38e7fa2..c69059f8712 100644
--- a/sql/temporary_tables.cc
+++ b/sql/temporary_tables.cc
@@ -921,9 +921,8 @@ bool THD::has_temporary_tables()
 uint THD::create_tmp_table_def_key(char *key, const char *db,
                                     const char *table_name)
 {
-  DBUG_ENTER("THD::create_tmp_table_def_key");
-
   uint key_length;
+  DBUG_ENTER("THD::create_tmp_table_def_key");
 
   key_length= tdc_create_key(key, db, table_name);
   int4store(key + key_length, variables.server_id);
@@ -1172,11 +1171,10 @@ TABLE *THD::open_temporary_table(TMP_TABLE_SHARE *share,
 */
 bool THD::find_and_use_tmp_table(const TABLE_LIST *tl, TABLE **out_table)
 {
-  DBUG_ENTER("THD::find_and_use_tmp_table");
-
   char key[MAX_DBKEY_LENGTH];
   uint key_length;
   bool result;
+  DBUG_ENTER("THD::find_and_use_tmp_table");
 
   key_length= create_tmp_table_def_key(key, tl->get_db_name(),
                                         tl->get_table_name());
diff --git a/storage/maria/ma_blockrec.c b/storage/maria/ma_blockrec.c
index baa777edcf0..98ef5c21e55 100644
--- a/storage/maria/ma_blockrec.c
+++ b/storage/maria/ma_blockrec.c
@@ -2780,7 +2780,8 @@ static my_bool write_block_record(MARIA_HA *info,
     const uchar *field_pos;
     ulong length;
     if ((record[column->null_pos] & column->null_bit) ||
-        (row->empty_bits[column->empty_pos] & column->empty_bit))
+        (column->empty_bit &&
+         (row->empty_bits[column->empty_pos] & column->empty_bit)))
       continue;
 
     field_pos= record + column->offset;
@@ -4887,7 +4888,8 @@ int _ma_read_block_record2(MARIA_HA *info, uchar *record,
     uchar *field_pos= record + column->offset;
     /* First check if field is present in record */
     if ((record[column->null_pos] & column->null_bit) ||
-        (cur_row->empty_bits[column->empty_pos] & column->empty_bit))
+        (column->empty_bit &&
+         (cur_row->empty_bits[column->empty_pos] & column->empty_bit)))
     {
       bfill(record + column->offset, column->fill_length,
             type == FIELD_SKIP_ENDSPACE ? ' ' : 0);
@@ -4970,8 +4972,9 @@ int _ma_read_block_record2(MARIA_HA *info, uchar *record,
         {
           uint size_length;
           if ((record[blob_field->null_pos] & blob_field->null_bit) ||
-              (cur_row->empty_bits[blob_field->empty_pos] &
-               blob_field->empty_bit))
+              (blob_field->empty_bit &
+               (cur_row->empty_bits[blob_field->empty_pos] &
+                blob_field->empty_bit)))
             continue;
           size_length= blob_field->length - portable_sizeof_char_ptr;
           blob_lengths+= _ma_calc_blob_length(size_length, length_data);
@@ -5825,7 +5828,8 @@ static size_t fill_insert_undo_parts(MARIA_HA *info, const uchar *record,
     const uchar *column_pos;
     size_t column_length;
     if ((record[column->null_pos] & column->null_bit) ||
-        cur_row->empty_bits[column->empty_pos] & column->empty_bit)
+        (column->empty_bit &&
+         cur_row->empty_bits[column->empty_pos] & column->empty_bit))
       continue;
 
     column_pos=    record+ column->offset;
@@ -6006,7 +6010,8 @@ static size_t fill_update_undo_parts(MARIA_HA *info, const uchar *oldrec,
       */
       continue;
     }
-    if (old_row->empty_bits[column->empty_pos] & column->empty_bit)
+    if (column->empty_bit &&
+        (old_row->empty_bits[column->empty_pos] & column->empty_bit))
     {
       if (new_row->empty_bits[column->empty_pos] & column->empty_bit)
         continue;                               /* Both are empty; skip */
@@ -6022,8 +6027,9 @@ static size_t fill_update_undo_parts(MARIA_HA *info, const uchar *oldrec,
       log the original value
     */
     new_column_is_empty= ((newrec[column->null_pos] & column->null_bit) ||
-                          (new_row->empty_bits[column->empty_pos] &
-                           column->empty_bit));
+                          (column->empty_bit &&
+                           (new_row->empty_bits[column->empty_pos] &
+                            column->empty_bit)));
 
     old_column_pos=      oldrec + column->offset;
     new_column_pos=      newrec + column->offset;
@@ -7196,7 +7202,8 @@ my_bool _ma_apply_undo_row_delete(MARIA_HA *info, LSN undo_lsn,
        column++, null_field_lengths++)
   {
     if ((record[column->null_pos] & column->null_bit) ||
-        row.empty_bits[column->empty_pos] & column->empty_bit)
+        (column->empty_bit &&
+         row.empty_bits[column->empty_pos] & column->empty_bit))
     {
       if (column->type != FIELD_BLOB)
         *null_field_lengths= 0;
diff --git a/storage/maria/ma_open.c b/storage/maria/ma_open.c
index 2d9174b4380..7702355b7d1 100644
--- a/storage/maria/ma_open.c
+++ b/storage/maria/ma_open.c
@@ -117,7 +117,7 @@ static MARIA_HA *maria_clone_internal(MARIA_SHARE *share,
 		       &info.blobs,sizeof(MARIA_BLOB)*share->base.blobs,
 		       &info.buff,(share->base.max_key_block_length*2+
 				   share->base.max_key_length),
-		       &info.lastkey_buff,share->base.max_key_length*2+1,
+		       &info.lastkey_buff,share->base.max_key_length*3,
 		       &info.first_mbr_key, share->base.max_key_length,
 		       &info.maria_rtree_recursion_state,
                        share->have_rtree ? 1024 : 0,