Fixed wrong memory references found by purify

(No really critical errors found, but a few possible wrong results)

8 files changed, 114 insertions, 50 deletions

diff --git a/sql/field.h b/sql/field.h
index fd0f2f9c2f1..b5d88504939 100644
--- a/sql/field.h
+++ b/sql/field.h
@@ -277,6 +277,7 @@ public:
   virtual bool get_date(TIME *ltime,uint fuzzydate);
   virtual bool get_time(TIME *ltime);
   virtual CHARSET_INFO *charset(void) const { return &my_charset_bin; }
+  virtual CHARSET_INFO *sort_charset(void) const { return charset(); }
   virtual bool has_charset(void) const { return FALSE; }
   virtual void set_charset(CHARSET_INFO *charset) { }
   bool set_warning(const unsigned int level, const unsigned int code, 
@@ -1152,6 +1153,8 @@ public:
   bool optimize_range(uint idx, uint part) { return 0; }
   bool eq_def(Field *field);
   bool has_charset(void) const { return TRUE; }
+  /* enum and set are sorted as integers */
+  CHARSET_INFO *sort_charset(void) const { return &my_charset_bin; }
   field_cast_enum field_cast_type() { return FIELD_CAST_ENUM; }
 };
 
diff --git a/sql/filesort.cc b/sql/filesort.cc
index 24088210f1a..76ce9ac4ce2 100644
--- a/sql/filesort.cc
+++ b/sql/filesort.cc
@@ -1127,7 +1127,7 @@ sortlength(SORT_FIELD *sortorder, uint s_length, bool *multi_byte_charset)
       else
       {
 	sortorder->length=sortorder->field->pack_length();
-	if (use_strnxfrm((cs=sortorder->field->charset())))
+	if (use_strnxfrm((cs=sortorder->field->sort_charset())))
 	{
 	  sortorder->need_strxnfrm= 1;
 	  *multi_byte_charset= 1;
diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc
index aff11ac7b25..690da1be18c 100644
--- a/sql/item_cmpfunc.cc
+++ b/sql/item_cmpfunc.cc
@@ -265,7 +265,7 @@ int Arg_comparator::set_compare_func(Item_bool_func2 *item, Item_result type)
       comparators= 0;
       return 1;
     }
-    if (!(comparators= (Arg_comparator *) sql_alloc(sizeof(Arg_comparator)*n)))
+    if (!(comparators= new Arg_comparator[n]))
       return 1;
     for (uint i=0; i < n; i++)
     {
@@ -1528,6 +1528,12 @@ in_row::in_row(uint elements, Item * item)
   size= sizeof(cmp_item_row);
   compare= (qsort2_cmp) cmp_row;
   tmp.store_value(item);
+  /*
+    We need to reset these as otherwise we will call sort() with
+    uninitialized (even if not used) elements
+  */
+  used_count= elements;
+  collation= 0;
 }
 
 in_row::~in_row()
diff --git a/sql/mysqld.cc b/sql/mysqld.cc
index 1591b205d46..f1b1d8a7d86 100644
--- a/sql/mysqld.cc
+++ b/sql/mysqld.cc
@@ -530,6 +530,7 @@ extern "C" pthread_handler_decl(handle_slave,arg);
 static ulong find_bit_type(const char *x, TYPELIB *bit_lib);
 static void clean_up(bool print_message);
 static void clean_up_mutexes(void);
+static void wait_for_signal_thread_to_end(void);
 static int test_if_case_insensitive(const char *dir_name);
 static void create_pid_file();
 
@@ -918,6 +919,7 @@ extern "C" void unireg_abort(int exit_code)
     sql_print_error("Aborting\n");
   clean_up(exit_code || !opt_bootstrap); /* purecov: inspected */
   DBUG_PRINT("quit",("done with cleanup in unireg_abort"));
+  wait_for_signal_thread_to_end();
   clean_up_mutexes();
   my_end(opt_endinfo ? MY_CHECK_ERROR | MY_GIVE_INFO : 0);
   exit(exit_code); /* purecov: inspected */
@@ -1023,6 +1025,29 @@ void clean_up(bool print_message)
 } /* clean_up */
 
 
+/*
+  This is mainly needed when running with purify, but it's still nice to
+  know that all child threads have died when mysqld exits
+*/
+
+static void wait_for_signal_thread_to_end()
+{
+#ifndef __NETWARE__
+  uint i;
+  /*
+    Wait up to 10 seconds for signal thread to die. We use this mainly to
+    avoid getting warnings that my_thread_end has not been called
+  */
+  for (i= 0 ; i < 100 && signal_thread_in_use; i++)
+  {
+    if (pthread_kill(signal_thread, MYSQL_KILL_SIGNAL))
+      break;
+    my_sleep(100);				// Give it time to die
+  }
+#endif
+}
+
+
 static void clean_up_mutexes()
 {
   (void) pthread_mutex_destroy(&LOCK_mysql_create_db);
@@ -2117,6 +2142,7 @@ extern "C" void *signal_hand(void *arg __attribute__((unused)))
       while ((error=my_sigwait(&set,&sig)) == EINTR) ;
     if (cleanup_done)
     {
+      DBUG_PRINT("quit",("signal_handler: calling my_thread_end()"));
       my_thread_end();
       signal_thread_in_use= 0;
       pthread_exit(0);				// Safety
@@ -3111,21 +3137,7 @@ we force server id to 2, but this MySQL server will not act as a slave.");
       CloseHandle(hEventShutdown);
   }
 #endif
-#ifndef __NETWARE__
-  {
-    uint i;
-    /*
-      Wait up to 10 seconds for signal thread to die. We use this mainly to
-      avoid getting warnings that my_thread_end has not been called
-    */
-    for (i= 0 ; i < 100 && signal_thread_in_use; i++)
-    {
-      if (pthread_kill(signal_thread, MYSQL_KILL_SIGNAL))
-	break;
-      my_sleep(100);				// Give it time to die
-    }
-  }
-#endif
+  wait_for_signal_thread_to_end();
   clean_up_mutexes();
   my_end(opt_endinfo ? MY_CHECK_ERROR | MY_GIVE_INFO : 0);
  
diff --git a/sql/sql_insert.cc b/sql/sql_insert.cc
index 844e5e7dac2..1f190a450de 100644
--- a/sql/sql_insert.cc
+++ b/sql/sql_insert.cc
@@ -688,7 +688,8 @@ public:
     thd.current_tablenr=0;
     thd.version=refresh_version;
     thd.command=COM_DELAYED_INSERT;
-    thd.lex->current_select= 0; /* for my_message_sql */
+    thd.lex->current_select= 0; 		// for my_message_sql
+    thd.lex->sql_command= SQLCOM_INSERT;        // For innodb::store_lock()
 
     bzero((char*) &thd.net, sizeof(thd.net));		// Safety
     bzero((char*) &table_list, sizeof(table_list));	// Safety
diff --git a/sql/sql_lex.h b/sql/sql_lex.h
index 3e2f6a3f2b5..f48ff42bbf8 100644
--- a/sql/sql_lex.h
+++ b/sql/sql_lex.h
@@ -125,27 +125,46 @@ enum tablespace_op_type
 /* 
   The state of the lex parsing for selects 
    
+   master and slaves are pointers to select_lex.
+   master is pointer to upper level node.
+   slave is pointer to lower level node
+   select_lex is a SELECT without union
+   unit is container of either
+     - One SELECT
+     - UNION of selects
+   select_lex and unit are both inherited form select_lex_node
+   neighbors are two select_lex or units on the same level
+
    All select describing structures linked with following pointers:
-   - list of neighbors (next/prev) (prev of first element point to slave 
+   - list of neighbors (next/prev) (prev of first element point to slave
      pointer of upper structure)
-     - one level units for unit (union) structure
-     - member of one union(unit) for ordinary select_lex
-   - pointer to master
-     - outer select_lex for unit (union)
-     - unit structure for ordinary select_lex
-   - pointer to slave
-     - first list element of select_lex belonged to this unit for unit
-     - first unit in list of units that belong to this select_lex (as
-       subselects or derived tables) for ordinary select_lex
-   - list of all select_lex (for group operation like correcting list of opened
-     tables)
-   - if unit contain several selects (union) then it have special 
-     select_lex called fake_select_lex. It used for storing global parameters
-     and executing union. subqueries of global ORDER BY clause will be
-     attached to this fake_select_lex, which will allow them correctly
-     resolve fields of 'upper' union and other more outer selects. 
-
-   for example for following query:
+     - For select this is a list of UNION's (or one element list)
+     - For units this is a list of sub queries for the upper level select
+
+   - pointer to master (master), which is
+     If this is a unit
+       - pointer to outer select_lex
+     If this is a select_lex
+       - pointer to outer unit structure for select
+
+   - pointer to slave (slave), which is either:
+     If this is a unit:
+       - first SELECT that belong to this unit
+     If this is a select_lex
+       - first unit that belong to this SELECT (subquries or derived tables)
+
+   - list of all select_lex (link_next/link_prev)
+     This is to be used for things like derived tables creation, where we
+     go through this list and create the derived tables.
+
+   If unit contain several selects (UNION now, INTERSECT etc later)
+   then it have special select_lex called fake_select_lex. It used for
+   storing global parameters (like ORDER BY, LIMIT) and executing union.
+   Subqueries used in global ORDER BY clause will be attached to this
+   fake_select_lex, which will allow them correctly resolve fields of
+   'upper' UNION and outer selects.
+
+   For example for following query:
 
    select *
      from table1
@@ -163,6 +182,11 @@ enum tablespace_op_type
 
    we will have following structure:
 
+   select1: (select * from table1 ...)
+   select2: (select * from table2 ...)
+   select3: (select * from table3)
+   select1.1.1: (select * from table1_1_1)
+   ...
 
      main unit
      fake0
@@ -185,7 +209,12 @@ enum tablespace_op_type
 
 
    relation in main unit will be following:
-                          
+   (bigger picture for:
+      main unit
+      fake0
+      select1 select2 select3
+   in the above picture)
+
          main unit
          |^^^^|fake_select_lex
          |||||+--------------------------------------------+
@@ -382,7 +411,7 @@ private:
 typedef class st_select_lex_unit SELECT_LEX_UNIT;
 
 /*
-  SELECT_LEX - store information of parsed SELECT_LEX statment
+  SELECT_LEX - store information of parsed SELECT statment
 */
 class st_select_lex: public st_select_lex_node
 {
diff --git a/sql/sql_repl.cc b/sql/sql_repl.cc
index fd165ad1fa5..d02bb5ff0a3 100644
--- a/sql/sql_repl.cc
+++ b/sql/sql_repl.cc
@@ -246,7 +246,7 @@ bool log_in_use(const char* log_name)
     if ((linfo = tmp->current_linfo))
     {
       pthread_mutex_lock(&linfo->lock);
-      result = !memcmp(log_name, linfo->log_file_name, log_name_len);
+      result = !bcmp(log_name, linfo->log_file_name, log_name_len);
       pthread_mutex_unlock(&linfo->lock);
       if (result)
 	break;
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 05314097ca3..a210fbbbe02 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -7622,8 +7622,8 @@ static int remove_dup_with_hash_index(THD *thd, TABLE *table,
 {
   byte *key_buffer, *key_pos, *record=table->record[0];
   int error;
-  handler *file=table->file;
-  ulong extra_length=ALIGN_SIZE(key_length)-key_length;
+  handler *file= table->file;
+  ulong extra_length= ALIGN_SIZE(key_length)-key_length;
   uint *field_lengths,*field_length;
   HASH hash;
   DBUG_ENTER("remove_dup_with_hash_index");
@@ -7637,22 +7637,34 @@ static int remove_dup_with_hash_index(THD *thd, TABLE *table,
 		       NullS))
     DBUG_RETURN(1);
 
+  {
+    Field **ptr;
+    ulong total_length= 0;
+    for (ptr= first_field, field_length=field_lengths ; *ptr ; ptr++)
+    {
+      uint length= (*ptr)->pack_length();
+      (*field_length++)= length;
+      total_length+= length;
+    }
+    DBUG_PRINT("info",("field_count: %u  key_length: %lu  total_length: %lu",
+                       field_count, key_length, total_length));
+    DBUG_ASSERT(total_length <= key_length);
+    key_length= total_length;
+    extra_length= ALIGN_SIZE(key_length)-key_length;
+  }
+
   if (hash_init(&hash, &my_charset_bin, (uint) file->records, 0, 
-		key_length,(hash_get_key) 0, 0, 0))
+		key_length, (hash_get_key) 0, 0, 0))
   {
     my_free((char*) key_buffer,MYF(0));
     DBUG_RETURN(1);
   }
-  {
-    Field **ptr;
-    for (ptr= first_field, field_length=field_lengths ; *ptr ; ptr++)
-      (*field_length++)= (*ptr)->pack_length();
-  }
 
   file->ha_rnd_init(1);
   key_pos=key_buffer;
   for (;;)
   {
+    byte *org_key_pos;
     if (thd->killed)
     {
       my_error(ER_SERVER_SHUTDOWN,MYF(0));
@@ -7675,6 +7687,7 @@ static int remove_dup_with_hash_index(THD *thd, TABLE *table,
     }
 
     /* copy fields to key buffer */
+    org_key_pos= key_pos;
     field_length=field_lengths;
     for (Field **ptr= first_field ; *ptr ; ptr++)
     {
@@ -7682,14 +7695,14 @@ static int remove_dup_with_hash_index(THD *thd, TABLE *table,
       key_pos+= *field_length++;
     }
     /* Check if it exists before */
-    if (hash_search(&hash,key_pos-key_length,key_length))
+    if (hash_search(&hash, org_key_pos, key_length))
     {
       /* Duplicated found ; Remove the row */
       if ((error=file->delete_row(record)))
 	goto err;
     }
     else
-      (void) my_hash_insert(&hash, key_pos-key_length);
+      (void) my_hash_insert(&hash, org_key_pos);
     key_pos+=extra_length;
   }
   my_free((char*) key_buffer,MYF(0));