Merge branch '10.0' into 10.1

25 files changed, 200 insertions, 89 deletions

diff --git a/sql/item.cc b/sql/item.cc
index 82b7cacbabb..ae77e90fa85 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -1,6 +1,6 @@
 /*
    Copyright (c) 2000, 2016, Oracle and/or its affiliates.
-   Copyright (c) 2010, 2017, MariaDB
+   Copyright (c) 2010, 2017, MariaDB Corporation
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -770,6 +770,7 @@ Item_ident::Item_ident(THD *thd, Name_resolution_context *context_arg,
    cached_table(0), depended_from(0), can_be_depended(TRUE)
 {
   name = (char*) field_name_arg;
+  name_length= name ? strlen(name) : 0;
 }
 
 
@@ -783,6 +784,7 @@ Item_ident::Item_ident(THD *thd, TABLE_LIST *view_arg, const char *field_name_ar
    cached_table(NULL), depended_from(NULL), can_be_depended(TRUE)
 {
   name = (char*) field_name_arg;
+  name_length= name ? strlen(name) : 0;
 }
 
 
@@ -4454,7 +4456,7 @@ static Item** find_field_in_group_list(Item *find_item, ORDER *group_list)
     int cur_match_degree= 0;
 
     /* SELECT list element with explicit alias */
-    if ((*(cur_group->item))->name &&
+    if ((*(cur_group->item))->name && !table_name &&
         !(*(cur_group->item))->is_autogenerated_name &&
         !my_strcasecmp(system_charset_info,
                        (*(cur_group->item))->name, field_name))
diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc
index fe79e5f083d..e45e568e3da 100644
--- a/sql/item_cmpfunc.cc
+++ b/sql/item_cmpfunc.cc
@@ -5317,7 +5317,7 @@ void Regexp_processor_pcre::set_recursion_limit(THD *thd)
   DBUG_ASSERT(thd == current_thd);
   stack_used= available_stack_size(thd->thread_stack, &stack_used);
   m_pcre_extra.match_limit_recursion=
-    (my_thread_stack_size - stack_used)/my_pcre_frame_size;
+    (my_thread_stack_size - STACK_MIN_SIZE - stack_used)/my_pcre_frame_size;
 }
 
 
@@ -5581,6 +5581,12 @@ void Regexp_processor_pcre::fix_owner(Item_func *owner,
 }
 
 
+bool Item_func_regex::fix_fields(THD *thd, Item **ref)
+{
+  re.set_recursion_limit(thd);
+  return Item_bool_func::fix_fields(thd, ref);
+}
+
 void
 Item_func_regex::fix_length_and_dec()
 {
@@ -5607,6 +5613,13 @@ longlong Item_func_regex::val_int()
 }
 
 
+bool Item_func_regexp_instr::fix_fields(THD *thd, Item **ref)
+{
+  re.set_recursion_limit(thd);
+  return Item_int_func::fix_fields(thd, ref);
+}
+
+
 void
 Item_func_regexp_instr::fix_length_and_dec()
 {
diff --git a/sql/item_cmpfunc.h b/sql/item_cmpfunc.h
index 56c5a4afe54..a34e70f9918 100644
--- a/sql/item_cmpfunc.h
+++ b/sql/item_cmpfunc.h
@@ -1991,6 +1991,7 @@ public:
     DBUG_VOID_RETURN;
   }
   longlong val_int();
+  bool fix_fields(THD *thd, Item **ref);
   void fix_length_and_dec();
   const char *func_name() const { return "regexp"; }
 
@@ -2018,6 +2019,7 @@ public:
     DBUG_VOID_RETURN;
   }
   longlong val_int();
+  bool fix_fields(THD *thd, Item **ref);
   void fix_length_and_dec();
   const char *func_name() const { return "regexp_instr"; }
 };
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
index e14fc1526cd..a89c51ad87b 100644
--- a/sql/item_strfunc.cc
+++ b/sql/item_strfunc.cc
@@ -1281,6 +1281,13 @@ void Item_func_replace::fix_length_and_dec()
 
 
 /*********************************************************************/
+bool Item_func_regexp_replace::fix_fields(THD *thd, Item **ref)
+{
+  re.set_recursion_limit(thd);
+  return Item_str_func::fix_fields(thd, ref);
+}
+
+
 void Item_func_regexp_replace::fix_length_and_dec()
 {
   if (agg_arg_charsets_for_string_result_with_comparison(collation, args, 3))
@@ -1416,6 +1423,13 @@ err:
 }
 
 
+bool Item_func_regexp_substr::fix_fields(THD *thd, Item **ref)
+{
+  re.set_recursion_limit(thd);
+  return Item_str_func::fix_fields(thd, ref);
+}
+
+
 void Item_func_regexp_substr::fix_length_and_dec()
 {
   if (agg_arg_charsets_for_string_result_with_comparison(collation, args, 2))
diff --git a/sql/item_strfunc.h b/sql/item_strfunc.h
index 9818982b411..95eac328a47 100644
--- a/sql/item_strfunc.h
+++ b/sql/item_strfunc.h
@@ -305,6 +305,7 @@ public:
     DBUG_VOID_RETURN;
   }
   String *val_str(String *str);
+  bool fix_fields(THD *thd, Item **ref);
   void fix_length_and_dec();
   const char *func_name() const { return "regexp_replace"; }
 };
@@ -325,6 +326,7 @@ public:
     DBUG_VOID_RETURN;
   }
   String *val_str(String *str);
+  bool fix_fields(THD *thd, Item **ref);
   void fix_length_and_dec();
   const char *func_name() const { return "regexp_substr"; }
 };
diff --git a/sql/item_subselect.cc b/sql/item_subselect.cc
index 3ca7d3afa6c..12230014f59 100644
--- a/sql/item_subselect.cc
+++ b/sql/item_subselect.cc
@@ -330,7 +330,8 @@ bool Item_subselect::enumerate_field_refs_processor(uchar *arg)
   
   while ((upper= it++))
   {
-    if (upper->item->walk(&Item::enumerate_field_refs_processor, FALSE, arg))
+    if (upper->item &&
+        upper->item->walk(&Item::enumerate_field_refs_processor, FALSE, arg))
       return TRUE;
   }
   return FALSE;
@@ -3413,7 +3414,8 @@ bool Item_in_subselect::init_cond_guards()
 {
   DBUG_ASSERT(thd);
   uint cols_num= left_expr->cols();
-  if (!abort_on_null && left_expr->maybe_null && !pushed_cond_guards)
+  if (!abort_on_null && !pushed_cond_guards &&
+      (left_expr->maybe_null || cols_num > 1))
   {
     if (!(pushed_cond_guards= (bool*)thd->alloc(sizeof(bool) * cols_num)))
         return TRUE;
diff --git a/sql/log.cc b/sql/log.cc
index 665157a06c5..e36f974709b 100644
--- a/sql/log.cc
+++ b/sql/log.cc
@@ -9769,8 +9769,8 @@ int TC_LOG_BINLOG::recover(LOG_INFO *linfo, const char *last_log_name,
                                           sizeof(xev->xid));
           if (!x || my_hash_insert(&xids, x))
             goto err2;
-          break;
         }
+        break;
       }
       case BINLOG_CHECKPOINT_EVENT:
         if (first_round && do_xa)
diff --git a/sql/multi_range_read.cc b/sql/multi_range_read.cc
index 53d0c3204a1..50918d8dcf2 100644
--- a/sql/multi_range_read.cc
+++ b/sql/multi_range_read.cc
@@ -1224,28 +1224,18 @@ bool DsMrr_impl::setup_buffer_sharing(uint key_size_in_keybuf,
   
   ptrdiff_t bytes_for_keys= (full_buf_end - full_buf) - bytes_for_rowids;
 
-  if (bytes_for_keys < key_buff_elem_size + 1)
-  {
-    ptrdiff_t add= key_buff_elem_size + 1 - bytes_for_keys;
-    bytes_for_keys= key_buff_elem_size + 1;
-    bytes_for_rowids -= add;
-  }
-
-  if (bytes_for_rowids < (ptrdiff_t)rowid_buf_elem_size + 1)
-  {
-    ptrdiff_t add= (ptrdiff_t)(rowid_buf_elem_size + 1 - bytes_for_rowids);
-    bytes_for_rowids= (ptrdiff_t)rowid_buf_elem_size + 1;
-    bytes_for_keys -= add;
-  }
+  if (bytes_for_keys < key_buff_elem_size + 1 ||
+      bytes_for_rowids < (ptrdiff_t)rowid_buf_elem_size + 1)
+    return TRUE; /* Failed to provide minimum space for one of the buffers */
 
   rowid_buffer_end= full_buf + bytes_for_rowids;
   rowid_buffer.set_buffer_space(full_buf, rowid_buffer_end);
   key_buffer= &backward_key_buf;
   key_buffer->set_buffer_space(rowid_buffer_end, full_buf_end); 
 
-  if (!key_buffer->have_space_for(key_buff_elem_size) ||
-      !rowid_buffer.have_space_for((size_t)rowid_buf_elem_size))
-    return TRUE; /* Failed to provide minimum space for one of the buffers */
+  /* The above code guarantees that the buffers are big enough */
+  DBUG_ASSERT(key_buffer->have_space_for(key_buff_elem_size) &&
+              rowid_buffer.have_space_for((size_t)rowid_buf_elem_size));
 
   return FALSE;
 }
diff --git a/sql/mysqld.cc b/sql/mysqld.cc
index e363c6de3f1..3af8750de13 100644
--- a/sql/mysqld.cc
+++ b/sql/mysqld.cc
@@ -3587,7 +3587,6 @@ sizeof(load_default_groups)/sizeof(load_default_groups[0]);
 #endif
 
 
-#ifndef EMBEDDED_LIBRARY
 /**
   This function is used to check for stack overrun for pathological
   cases of  regular expressions and 'like' expressions.
@@ -3616,8 +3615,6 @@ check_enough_stack_size(int recurse_level)
     return 0;
   return check_enough_stack_size_slow();
 }
-#endif
-
 
 
 /*
@@ -3639,11 +3636,12 @@ static void init_pcre()
 {
   pcre_malloc= pcre_stack_malloc= my_str_malloc_mysqld;
   pcre_free= pcre_stack_free= my_str_free_mysqld;
-#ifndef EMBEDDED_LIBRARY
   pcre_stack_guard= check_enough_stack_size_slow;
   /* See http://pcre.org/original/doc/html/pcrestack.html */
-  my_pcre_frame_size= -pcre_exec(NULL, NULL, NULL, -999, -999, 0, NULL, 0) + 16;
-#endif
+  my_pcre_frame_size= -pcre_exec(NULL, NULL, NULL, -999, -999, 0, NULL, 0);
+  // pcre can underestimate its stack usage. Use a safe value, as in the manual
+  set_if_bigger(my_pcre_frame_size, 500);
+  my_pcre_frame_size += 16; // Again, safety margin, see the manual
 }
 
 
diff --git a/sql/net_serv.cc b/sql/net_serv.cc
index da3c5646e84..ed283863d31 100644
--- a/sql/net_serv.cc
+++ b/sql/net_serv.cc
@@ -1,5 +1,5 @@
 /* Copyright (c) 2000, 2016, Oracle and/or its affiliates.
-   Copyright (c) 2012, 2016, MariaDB
+   Copyright (c) 2012, 2017, MariaDB Corporation
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/sql/opt_range.cc b/sql/opt_range.cc
index e4e29378c25..1c41aa79af2 100644
--- a/sql/opt_range.cc
+++ b/sql/opt_range.cc
@@ -7306,8 +7306,10 @@ SEL_TREE *Item_bool_func::get_full_func_mm_tree(RANGE_OPT_PARAM *param,
   table_map param_comp= ~(param->prev_tables | param->read_tables |
 		          param->current_table);
 #ifdef HAVE_SPATIAL
+  Field::geometry_type sav_geom_type;
   if (field_item->field->type() == MYSQL_TYPE_GEOMETRY)
   {
+    sav_geom_type= ((Field_geom*) field_item->field)->geom_type;
     /* We have to be able to store all sorts of spatial features here */
     ((Field_geom*) field_item->field)->geom_type= Field::GEOM_GEOMETRY;
   }
@@ -7338,6 +7340,13 @@ SEL_TREE *Item_bool_func::get_full_func_mm_tree(RANGE_OPT_PARAM *param,
       }
     }
   }
+
+#ifdef HAVE_SPATIAL
+  if (field_item->field->type() == MYSQL_TYPE_GEOMETRY)
+  {
+    ((Field_geom*) field_item->field)->geom_type= sav_geom_type;
+  }
+#endif /*HAVE_SPATIAL*/
   DBUG_RETURN(ftree);
 }
 
diff --git a/sql/records.cc b/sql/records.cc
index 3901161a2cb..d98c6939e04 100644
--- a/sql/records.cc
+++ b/sql/records.cc
@@ -1,5 +1,6 @@
 /*
    Copyright (c) 2000, 2010, Oracle and/or its affiliates.
+   Copyright (c) 2009, 2017, MariaDB Corporation
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/sql/rpl_handler.cc b/sql/rpl_handler.cc
index 733af6c61c8..520fb61d8c4 100644
--- a/sql/rpl_handler.cc
+++ b/sql/rpl_handler.cc
@@ -267,7 +267,7 @@ int Binlog_storage_delegate::after_flush(THD *thd,
     thd->semisync_info= log_info;
   }
 
-  strcpy(log_info->log_file, log_file+dirname_length(log_file));
+  strmake_buf(log_info->log_file, log_file+dirname_length(log_file));
   log_info->log_pos = log_pos;
   
   FOREACH_OBSERVER(ret, after_flush, false,
diff --git a/sql/rpl_mi.cc b/sql/rpl_mi.cc
index ed756a996ca..ab54f0bfbb7 100644
--- a/sql/rpl_mi.cc
+++ b/sql/rpl_mi.cc
@@ -1,5 +1,5 @@
-/* Copyright (c) 2006, 2012, Oracle and/or its affiliates.
-   Copyright (c) 2010, 2011, Monty Program Ab
+/* Copyright (c) 2006, 2017, Oracle and/or its affiliates.
+   Copyright (c) 2010, 2017, MariaDB Corporation
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -844,7 +844,6 @@ void end_master_info(Master_info* mi)
 
   if (!mi->inited)
     DBUG_VOID_RETURN;
-  end_relay_log_info(&mi->rli);
   if (mi->fd >= 0)
   {
     end_io_cache(&mi->file);
@@ -883,6 +882,7 @@ void free_key_master_info(Master_info *mi)
   /* We use 2 here instead of 1 just to make it easier when debugging */
   mi->killed= 2;
   end_master_info(mi);
+  end_relay_log_info(&mi->rli);
   mi->unlock_slave_threads();
   delete mi;
 
diff --git a/sql/rpl_rli.cc b/sql/rpl_rli.cc
index 363f114ce9a..64a1b535307 100644
--- a/sql/rpl_rli.cc
+++ b/sql/rpl_rli.cc
@@ -1,5 +1,5 @@
-/* Copyright (c) 2006, 2013, Oracle and/or its affiliates.
-   Copyright (c) 2010, 2013, Monty Program Ab
+/* Copyright (c) 2006, 2017, Oracle and/or its affiliates.
+   Copyright (c) 2011, 2017, MariaDB Corporation
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -54,8 +54,8 @@ Relay_log_info::Relay_log_info(bool is_slave_recovery)
    sync_counter(0), is_relay_log_recovery(is_slave_recovery),
    save_temporary_tables(0), mi(0),
    inuse_relaylog_list(0), last_inuse_relaylog(0),
-   cur_log_old_open_count(0), group_relay_log_pos(0), 
-   event_relay_log_pos(0),
+   cur_log_old_open_count(0), error_on_rli_init_info(false),
+   group_relay_log_pos(0), event_relay_log_pos(0),
 #if HAVE_valgrind
    is_fake(FALSE),
 #endif
@@ -119,7 +119,7 @@ int init_relay_log_info(Relay_log_info* rli,
 			const char* info_fname)
 {
   char fname[FN_REFLEN+128];
-  int info_fd;
+  int info_fd= -1;
   const char* msg = 0;
   int error = 0;
   mysql_mutex_t *log_lock;
@@ -132,6 +132,8 @@ int init_relay_log_info(Relay_log_info* rli,
   log_lock= rli->relay_log.get_log_lock();
   fn_format(fname, info_fname, mysql_data_home, "", 4+32);
   mysql_mutex_lock(&rli->data_lock);
+  if (rli->error_on_rli_init_info)
+    goto err;
   info_fd = rli->info_fd;
   rli->cur_log_fd = -1;
   rli->slave_skip_counter=0;
@@ -255,8 +257,8 @@ a file name for --relay-log-index option", opt_relaylog_index_name);
     if ((info_fd= mysql_file_open(key_file_relay_log_info,
                                   fname, O_CREAT|O_RDWR|O_BINARY, MYF(MY_WME))) < 0)
     {
-      sql_print_error("Failed to create a new relay log info file (\
-file '%s', errno %d)", fname, my_errno);
+      sql_print_error("Failed to create a new relay log info file ("
+                      "file '%s', errno %d)", fname, my_errno);
       msg= current_thd->get_stmt_da()->message();
       goto err;
     }
@@ -431,11 +433,14 @@ Failed to open the existing relay log info file '%s' (errno %d)",
     goto err;
   }
   rli->inited= 1;
+  rli->error_on_rli_init_info= false;
   mysql_mutex_unlock(&rli->data_lock);
   DBUG_RETURN(0);
 
 err:
-  sql_print_error("%s", msg);
+  rli->error_on_rli_init_info= true;
+  if (msg)
+    sql_print_error("%s", msg);
   end_io_cache(&rli->info_file);
   if (info_fd >= 0)
     mysql_file_close(info_fd, MYF(0));
@@ -1108,6 +1113,8 @@ int purge_relay_logs(Relay_log_info* rli, THD *thd, bool just_reset,
                      const char** errmsg)
 {
   int error=0;
+  const char *ln;
+  char name_buf[FN_REFLEN];
   DBUG_ENTER("purge_relay_logs");
 
   /*
@@ -1134,12 +1141,37 @@ int purge_relay_logs(Relay_log_info* rli, THD *thd, bool just_reset,
   if (!rli->inited)
   {
     DBUG_PRINT("info", ("rli->inited == 0"));
-    DBUG_RETURN(0);
-  }
-
-  DBUG_ASSERT(rli->slave_running == 0);
-  DBUG_ASSERT(rli->mi->slave_running == 0);
+    if (rli->error_on_rli_init_info)
+    {
+      ln= rli->relay_log.generate_name(opt_relay_logname, "-relay-bin",
+                                       1, name_buf);
 
+      if (rli->relay_log.open_index_file(opt_relaylog_index_name, ln, TRUE))
+      {
+        sql_print_error("Unable to purge relay log files. Failed to open relay "
+                        "log index file:%s.", rli->relay_log.get_index_fname());
+        DBUG_RETURN(1);
+      }
+      mysql_mutex_lock(rli->relay_log.get_log_lock());
+      if (rli->relay_log.open(ln, LOG_BIN, 0, 0, SEQ_READ_APPEND,
+                             (rli->max_relay_log_size ? rli->max_relay_log_size :
+                              max_binlog_size), 1, TRUE))
+      {
+        sql_print_error("Unable to purge relay log files. Failed to open relay "
+                        "log file:%s.", rli->relay_log.get_log_fname());
+        mysql_mutex_unlock(rli->relay_log.get_log_lock());
+        DBUG_RETURN(1);
+      }
+      mysql_mutex_unlock(rli->relay_log.get_log_lock());
+    }
+    else
+      DBUG_RETURN(0);
+  }
+  else
+  {
+    DBUG_ASSERT(rli->slave_running == 0);
+    DBUG_ASSERT(rli->mi->slave_running == 0);
+  }
   mysql_mutex_lock(&rli->data_lock);
 
   /*
@@ -1186,6 +1218,12 @@ int purge_relay_logs(Relay_log_info* rli, THD *thd, bool just_reset,
     rli->group_relay_log_name[0]= rli->event_relay_log_name[0]= 0;
   }
 
+  if (!rli->inited && rli->error_on_rli_init_info)
+  {
+    mysql_mutex_lock(rli->relay_log.get_log_lock());
+    rli->relay_log.close(LOG_CLOSE_INDEX | LOG_CLOSE_STOP_EVENT);
+    mysql_mutex_unlock(rli->relay_log.get_log_lock());
+  }
 err:
   DBUG_PRINT("info",("log_space_total: %llu",rli->log_space_total));
   mysql_mutex_unlock(&rli->data_lock);
diff --git a/sql/rpl_rli.h b/sql/rpl_rli.h
index b9fc2127440..74d5b6fe416 100644
--- a/sql/rpl_rli.h
+++ b/sql/rpl_rli.h
@@ -1,4 +1,5 @@
-/* Copyright (c) 2005, 2012, Oracle and/or its affiliates.
+/* Copyright (c) 2005, 2017, Oracle and/or its affiliates.
+   Copyright (c) 2009, 2017, MariaDB Corporation
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -176,7 +177,14 @@ public:
     a different log under our feet
   */
   uint32 cur_log_old_open_count;
-  
+
+  /*
+    If on init_info() call error_on_rli_init_info is true that means
+    that previous call to init_info() terminated with an error, RESET
+    SLAVE must be executed and the problem fixed manually.
+   */
+  bool error_on_rli_init_info;
+
   /*
     Let's call a group (of events) :
       - a transaction
diff --git a/sql/slave.cc b/sql/slave.cc
index 1e093f97fa8..db1c3305b98 100644
--- a/sql/slave.cc
+++ b/sql/slave.cc
@@ -1,5 +1,5 @@
-/* Copyright (c) 2000, 2016, Oracle and/or its affiliates.
-   Copyright (c) 2009, 2017, MariaDB
+/* Copyright (c) 2000, 2017, Oracle and/or its affiliates.
+   Copyright (c) 2009, 2017, MariaDB Corporation
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -483,6 +483,7 @@ int init_slave()
   {
     delete active_mi;
     active_mi= 0;
+    sql_print_error("Failed to allocate memory for the Master Info structure");
     goto err;
   }
 
@@ -545,7 +546,6 @@ end:
   DBUG_RETURN(error);
 
 err:
-  sql_print_error("Failed to allocate memory for the Master Info structure");
   error= 1;
   goto end;
 }
@@ -6339,6 +6339,7 @@ void end_relay_log_info(Relay_log_info* rli)
   mysql_mutex_t *log_lock;
   DBUG_ENTER("end_relay_log_info");
 
+  rli->error_on_rli_init_info= false;
   if (!rli->inited)
     DBUG_VOID_RETURN;
   if (rli->info_fd >= 0)
diff --git a/sql/spatial.cc b/sql/spatial.cc
index 9c4fe168fe3..e8d2fb42383 100644
--- a/sql/spatial.cc
+++ b/sql/spatial.cc
@@ -1149,8 +1149,8 @@ int Gis_polygon::centroid_xy(double *x, double *y) const
     uint32 n_points, org_n_points;
     double prev_x, prev_y;
     double cur_area= 0;
-    double cur_cx= 0;
-    double cur_cy= 0;
+    double cur_cx= 0, cur_cy= 0;
+    double sum_cx= 0, sum_cy= 0;
 
     if (no_data(data, 4))
       return 1;
@@ -1164,17 +1164,32 @@ int Gis_polygon::centroid_xy(double *x, double *y) const
     while (--n_points)				// One point is already read
     {
       double tmp_x, tmp_y;
+      double loc_area;
       get_point(&tmp_x, &tmp_y, data);
       data+= POINT_DATA_SIZE;
-      cur_area+= (prev_x + tmp_x) * (prev_y - tmp_y);
+      loc_area= prev_x * tmp_y - tmp_x * prev_y;
+      cur_area+= loc_area;
       cur_cx+= tmp_x;
       cur_cy+= tmp_y;
+      sum_cx+= (prev_x + tmp_x) * loc_area;
+      sum_cy+= (prev_y + tmp_y) * loc_area;
+
       prev_x= tmp_x;
       prev_y= tmp_y;
     }
-    cur_area= fabs(cur_area) / 2;
-    cur_cx= cur_cx / (org_n_points - 1);
-    cur_cy= cur_cy / (org_n_points - 1);
+
+    if (fabs(cur_area) > 1e-10)
+    {
+      cur_cx= sum_cx / cur_area / 3.0;
+      cur_cy= sum_cy / cur_area / 3.0;
+    }
+    else
+    {
+      cur_cx= cur_cx / (org_n_points - 1);
+      cur_cy= cur_cy / (org_n_points - 1);
+    }
+
+    cur_area= fabs(cur_area);
 
     if (!first_loop)
     {
diff --git a/sql/sql_class.cc b/sql/sql_class.cc
index 63663cdd037..4df257b96a4 100644
--- a/sql/sql_class.cc
+++ b/sql/sql_class.cc
@@ -691,12 +691,6 @@ extern "C"
   @param buffer pointer to preferred result buffer
   @param length length of buffer
   @param max_query_len how many chars of query to copy (0 for all)
-
-  @req LOCK_thread_count
-  
-  @note LOCK_thread_count mutex is not necessary when the function is invoked on
-   the currently running thread (current_thd) or if the caller in some other
-   way guarantees that access to thd->query is serialized.
  
   @return Pointer to string
 */
@@ -710,6 +704,9 @@ char *thd_get_error_context_description(THD *thd, char *buffer,
   const Security_context *sctx= &thd->main_security_ctx;
   char header[256];
   int len;
+
+  mysql_mutex_lock(&LOCK_thread_count);
+
   /*
     The pointers thd->query and thd->proc_info might change since they are
     being modified concurrently. This is acceptable for proc_info since its
@@ -765,6 +762,7 @@ char *thd_get_error_context_description(THD *thd, char *buffer,
     }
     mysql_mutex_unlock(&thd->LOCK_thd_data);
   }
+  mysql_mutex_unlock(&LOCK_thread_count);
 
   if (str.c_ptr_safe() == buffer)
     return buffer;
diff --git a/sql/sql_derived.cc b/sql/sql_derived.cc
index d9457ba6624..d8386666de4 100644
--- a/sql/sql_derived.cc
+++ b/sql/sql_derived.cc
@@ -537,6 +537,8 @@ bool mysql_derived_merge_for_insert(THD *thd, LEX *lex, TABLE_LIST *derived)
       DBUG_ASSERT(derived->table);
     }
   }
+  else
+    derived->table= derived->merge_underlying_list->table;
   DBUG_RETURN(FALSE);
 }
 
diff --git a/sql/sql_load.cc b/sql/sql_load.cc
index 25bc29de401..1ba9de297d4 100644
--- a/sql/sql_load.cc
+++ b/sql/sql_load.cc
@@ -1,6 +1,6 @@
 /*
    Copyright (c) 2000, 2016, Oracle and/or its affiliates.
-   Copyright (c) 2010, 2016, MariaDB
+   Copyright (c) 2010, 2017, MariaDB Corporation
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index a1da14d5c53..65a2382f0d0 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -1184,18 +1184,14 @@ static my_bool deny_updates_if_read_only_option(THD *thd,
   if (lex->sql_command == SQLCOM_UPDATE_MULTI)
     DBUG_RETURN(FALSE);
 
-  const my_bool create_temp_tables= 
-    (lex->sql_command == SQLCOM_CREATE_TABLE) && lex->tmp_table();
-
-  const my_bool drop_temp_tables= 
-    (lex->sql_command == SQLCOM_DROP_TABLE) && lex->tmp_table();
-
-  const my_bool update_real_tables=
-    some_non_temp_table_to_be_updated(thd, all_tables) &&
-    !(create_temp_tables || drop_temp_tables);
-
+  /*
+    a table-to-be-created is not in the temp table list yet,
+    so CREATE TABLE needs a special treatment
+  */
+  const bool update_real_tables= lex->sql_command == SQLCOM_CREATE_TABLE ?
+        !lex->tmp_table() : some_non_temp_table_to_be_updated(thd, all_tables);
 
-  const my_bool create_or_drop_databases=
+  const bool create_or_drop_databases=
     (lex->sql_command == SQLCOM_CREATE_DB) ||
     (lex->sql_command == SQLCOM_DROP_DB);
 
@@ -1723,9 +1719,12 @@ bool dispatch_command(enum enum_server_command command, THD *thd,
 	kill_zombie_dump_threads(slave_server_id);
       thd->variables.server_id = slave_server_id;
 
-      general_log_print(thd, command, "Log: '%s'  Pos: %ld", packet+10,
-                      (long) pos);
-      mysql_binlog_send(thd, thd->strdup(packet + 10), (my_off_t) pos, flags);
+      const char *name= packet + 10;
+      size_t nlen= strlen(name);
+
+      general_log_print(thd, command, "Log: '%s'  Pos: %lu", name, pos);
+      if (nlen < FN_REFLEN)
+        mysql_binlog_send(thd, thd->strmake(name, nlen), (my_off_t)pos, flags);
       unregister_slave(thd,1,1);
       /*  fake COM_QUIT -- if we get here, the thread needs to terminate */
       error = TRUE;
diff --git a/sql/sql_repl.cc b/sql/sql_repl.cc
index 09248486bec..764047e4720 100644
--- a/sql/sql_repl.cc
+++ b/sql/sql_repl.cc
@@ -1,5 +1,5 @@
-/* Copyright (c) 2000, 2013, Oracle and/or its affiliates.
-   Copyright (c) 2008, 2014, SkySQL Ab.
+/* Copyright (c) 2000, 2017, Oracle and/or its affiliates.
+   Copyright (c) 2008, 2017, MariaDB Corporation
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -3348,6 +3348,7 @@ int reset_slave(THD *thd, Master_info* mi)
   // close master_info_file, relay_log_info_file, set mi->inited=rli->inited=0
   end_master_info(mi);
 
+  end_relay_log_info(&mi->rli);
   // and delete these two files
   create_logfile_name_with_suffix(master_info_file_tmp,
                                   sizeof(master_info_file_tmp),
diff --git a/sql/sql_union.cc b/sql/sql_union.cc
index 7ca0a9bb867..9d825f55fcb 100644
--- a/sql/sql_union.cc
+++ b/sql/sql_union.cc
@@ -1,5 +1,5 @@
-/* Copyright (c) 2000, 2014, Oracle and/or its affiliates.
-   Copyright (c) 2010, 2014, SkySQL Ab.
+/* Copyright (c) 2000, 2017, Oracle and/or its affiliates.
+   Copyright (c) 2010, 2017, Corporation
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -484,6 +484,19 @@ bool st_select_lex_unit::prepare(THD *thd_arg, select_result *sel_result,
       Item *item_tmp;
       while ((item_tmp= it++))
       {
+        /*
+          If the outer query has a GROUP BY clause, an outer reference to this
+          query block may have been wrapped in a Item_outer_ref, which has not
+          been fixed yet. An Item_type_holder must be created based on a fixed
+          Item, so use the inner Item instead.
+        */
+        DBUG_ASSERT(item_tmp->fixed ||
+                    (item_tmp->type() == Item::REF_ITEM &&
+                     ((Item_ref *)(item_tmp))->ref_type() ==
+                     Item_ref::OUTER_REF));
+        if (!item_tmp->fixed)
+          item_tmp= item_tmp->real_item();
+
 	/* Error's in 'new' will be detected after loop */
 	types.push_back(new (thd_arg->mem_root)
                         Item_type_holder(thd_arg, item_tmp));
@@ -1240,4 +1253,3 @@ void st_select_lex_unit::set_unique_exclude()
     }
   }
 }
-
diff --git a/sql/uniques.cc b/sql/uniques.cc
index 63eb6e0eb90..e88cd035549 100644
--- a/sql/uniques.cc
+++ b/sql/uniques.cc
@@ -483,7 +483,7 @@ void put_counter_into_merged_element(void *ptr, uint ofs, element_count cnt)
     <> 0  error
 */
 
-static bool merge_walk(uchar *merge_buffer, ulong merge_buffer_size,
+static bool merge_walk(uchar *merge_buffer, size_t merge_buffer_size,
                        uint key_length, BUFFPEK *begin, BUFFPEK *end,
                        tree_walk_action walk_action, void *walk_action_arg,
                        qsort_cmp2 compare, void *compare_arg,
@@ -492,7 +492,7 @@ static bool merge_walk(uchar *merge_buffer, ulong merge_buffer_size,
   BUFFPEK_COMPARE_CONTEXT compare_context = { compare, compare_arg };
   QUEUE queue;
   if (end <= begin ||
-      merge_buffer_size < (ulong) (key_length * (end - begin + 1)) ||
+      merge_buffer_size < (size_t) (key_length * (end - begin + 1)) ||
       init_queue(&queue, (uint) (end - begin), offsetof(BUFFPEK, key), 0,
                  buffpek_compare, &compare_context, 0, 0))
     return 1;
@@ -642,15 +642,19 @@ bool Unique::walk(TABLE *table, tree_walk_action action, void *walk_action_arg)
     return 1;
   if (flush_io_cache(&file) || reinit_io_cache(&file, READ_CACHE, 0L, 0, 0))
     return 1;
-  size_t buff_sz= (max_in_memory_size / full_size + 1) * full_size;
+  /*
+    merge_buffer must fit at least MERGEBUFF2 keys, because
+    merge_index() can merge that many BUFFPEKs at once.
+  */
+  size_t buff_sz= MY_MAX(MERGEBUFF2, max_in_memory_size/full_size+1) * full_size;
   if (!(merge_buffer = (uchar *)my_malloc(buff_sz, MYF(MY_THREAD_SPECIFIC|MY_WME))))
     return 1;
   if (buff_sz < full_size * (file_ptrs.elements + 1UL))
     res= merge(table, merge_buffer, buff_sz >= full_size * MERGEBUFF2) ;
-  
+
   if (!res)
-  {  
-    res= merge_walk(merge_buffer, (ulong) max_in_memory_size, full_size,
+  {
+    res= merge_walk(merge_buffer, buff_sz, full_size,
                     (BUFFPEK *) file_ptrs.buffer,
                     (BUFFPEK *) file_ptrs.buffer + file_ptrs.elements,
                     action, walk_action_arg,