From c0adb05b30e75196a424e1fc11854c9451127120 Mon Sep 17 00:00:00 2001
From: Daniel Black <daniel@mariadb.org>
Date: Mon, 15 May 2023 09:07:43 +1000
Subject: [PATCH 01/15] MDEV-31268: Fedora mariadb-connector-c-config conflicts
 with MariaDB's MariaDB-common

The previous fix in MDEV-24629 had a version end of life date.

Thanks @pgnd on Zulip for noticing.
---
 cmake/cpack_rpm.cmake | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmake/cpack_rpm.cmake b/cmake/cpack_rpm.cmake
index 41177f8a908..7b1f0b0ff87 100644
--- a/cmake/cpack_rpm.cmake
+++ b/cmake/cpack_rpm.cmake
@@ -289,7 +289,7 @@ ELSEIF(RPM MATCHES "sles")
 ENDIF()
 
 # MDEV-24629, we need it outside of ELSIFs
-IF(RPM MATCHES "fedora3[234]")
+IF(RPM MATCHES "fedora")
   ALTERNATIVE_NAME("common" "mariadb-connector-c-config" ${MARIADB_CONNECTOR_C_VERSION}-1)
 ENDIF()
 

From a5ce335ac919cc0735b6eb703262c7cffb2af578 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20M=C3=A4kel=C3=A4?= <marko.makela@mariadb.com>
Date: Mon, 22 May 2023 17:10:25 +0300
Subject: [PATCH 02/15] MDEV-29593 fixup: Avoid a leak if rseg.undo_cached is
 corrupted

trx_purge_truncate_rseg_history(): Avoid a leak similar to the one
that was fixed in MDEV-31324, in case a supposedly cached undo log
page is not found in the rseg.undo_cached list.
---
 storage/innobase/trx/trx0purge.cc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/storage/innobase/trx/trx0purge.cc b/storage/innobase/trx/trx0purge.cc
index 6541ede447e..e8d81ff49cd 100644
--- a/storage/innobase/trx/trx0purge.cc
+++ b/storage/innobase/trx/trx0purge.cc
@@ -486,9 +486,9 @@ loop:
         if (undo->hdr_page_no == hdr_addr.page)
           goto found_cached;
       ut_ad("inconsistent undo logs" == 0);
-      break;
-    found_cached:
-      UT_LIST_REMOVE(rseg.undo_cached, undo);
+      if (false)
+      found_cached:
+        UT_LIST_REMOVE(rseg.undo_cached, undo);
       static_assert(FIL_NULL == 0xffffffff, "");
       if (UNIV_UNLIKELY(mach_read_from_4(TRX_RSEG + TRX_RSEG_FORMAT +
                                          rseg_hdr->page.frame)))

From 16258677b37011b543fd68a41eae4abd45f64f68 Mon Sep 17 00:00:00 2001
From: Monty <monty@mariadb.org>
Date: Fri, 31 Mar 2023 19:35:04 +0300
Subject: [PATCH 03/15] MDEV-6768 Wrong result with aggregate with join with no
 result set

When a query does implicit grouping and join operation produces an empty
result set, a NULL-complemented row combination is generated.
However, constant table fields still show non-NULL values.

What happens in the is that end_send_group() is called with a
const row but without any rows matching the WHERE clause.
This last part is shown by 'join->first_record' not being set.

This causes item->no_rows_in_result() to be called for all items to reset
all sum functions to their initial state. However fields are not set
to NULL.

The used fix is to produce NULL-complemented records for constant tables
as well. Also, reset the constant table's records back in case we're
in a subquery which may get re-executed.
An alternative fix would have item->no_rows_in_result() also work
with Item_field objects.

There is some other issues with the code:
- join->no_rows_in_result_called is used but never set.
- Tables that are used with group functions are not properly marked as
  maybe_null, which is required if the table rows should be regarded as
  null-complemented (not existing).
- The code that tries to detect if mixed_implicit_grouping should be set
  didn't take into account all usage of fields and sum functions.
- Item_func::restore_to_before_no_rows_in_result() called the wrong
  function.
- join->clear() does not use a table_map argument to clear_tables(),
  which caused it to ignore constant tables.
- unclear_tables() does not correctly restore status to what is
  was before clear_tables().

Main bug fix was to always use a table_map argument to clear_tables() and
always use join->clear() and clear_tables() together with unclear_tables().

Other fixes:
- Fixed Item_func::restore_to_before_no_rows_in_result()
- Set 'join->no_rows_in_result_called' when no_rows_in_result_set()
  is called.
- Removed not used argument from setup_end_select_func().
- More code comments
- Ensure that end_send_group() modifies the same fields as are in the
  result set.
- Changed return_zero_rows() to use pointers instead of references,
  similar to the rest of the code.

Reviewer: Sergei Petrunia <sergey@mariadb.com>
---
 mysql-test/main/group_min_max.result  | 110 +++++++++++
 mysql-test/main/group_min_max.test    | 110 +++++++++++
 mysql-test/main/type_timestamp.result |   2 +
 mysql-test/main/type_timestamp.test   |   1 +
 sql/item_func.h                       |   2 +-
 sql/sql_select.cc                     | 264 ++++++++++++++++----------
 sql/sql_select.h                      |   5 +-
 sql/table.h                           |  10 +-
 8 files changed, 397 insertions(+), 107 deletions(-)

diff --git a/mysql-test/main/group_min_max.result b/mysql-test/main/group_min_max.result
index a87a79fbc56..712466c8afb 100644
--- a/mysql-test/main/group_min_max.result
+++ b/mysql-test/main/group_min_max.result
@@ -4095,5 +4095,115 @@ MIN(pk)	a
 5	10
 DROP TABLE t1;
 #
+# MDEV-6768 Wrong result with agregate with join with no resultset
+#
+create table t1
+(
+PARENT_ID int(10) unsigned NOT NULL AUTO_INCREMENT,
+PARENT_FIELD VARCHAR(10),
+PRIMARY KEY (PARENT_ID)
+) engine=innodb;
+create table t2
+(
+CHILD_ID INT NOT NULL AUTO_INCREMENT,
+PARENT_ID INT NOT NULL,
+CHILD_FIELD varchar(10),
+PRIMARY KEY (CHILD_ID)
+)engine=innodb;
+INSERT INTO t1 (PARENT_FIELD)
+SELECT 'AAAA';
+INSERT INTO t2 (PARENT_ID, CHILD_FIELD)
+SELECT 1, 'BBBB';
+explain select
+t1.PARENT_ID,
+min(CHILD_FIELD)
+from t1 straight_join t2
+where t1.PARENT_ID = 1
+and t1.PARENT_ID = t2.PARENT_ID
+and t2.CHILD_FIELD = "ZZZZ";
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	SIMPLE	t1	const	PRIMARY	PRIMARY	4	const	1	Using index
+1	SIMPLE	t2	ALL	NULL	NULL	NULL	NULL	1	Using where
+select
+t1.PARENT_ID,
+min(CHILD_FIELD)
+from t1 straight_join t2
+where t1.PARENT_ID = 1
+and t1.PARENT_ID = t2.PARENT_ID
+and t2.CHILD_FIELD = "ZZZZ";
+PARENT_ID	min(CHILD_FIELD)
+NULL	NULL
+select
+1,
+min(CHILD_FIELD)
+from t1 straight_join t2
+where t1.PARENT_ID = 1
+and t1.PARENT_ID = t2.PARENT_ID
+and t2.CHILD_FIELD = "ZZZZ";
+1	min(CHILD_FIELD)
+1	NULL
+select
+IFNULL(t1.PARENT_ID,1),
+min(CHILD_FIELD)
+from t1 straight_join t2
+where t1.PARENT_ID = 1
+and t1.PARENT_ID = t2.PARENT_ID
+and t2.CHILD_FIELD = "ZZZZ";
+IFNULL(t1.PARENT_ID,1)	min(CHILD_FIELD)
+1	NULL
+# Check that things works with MyISAM (which has different explain)
+alter table t1 engine=myisam;
+alter table t2 engine=myisam;
+explain select
+t1.PARENT_ID,
+min(CHILD_FIELD)
+from t1 straight_join t2
+where t1.PARENT_ID = 1
+and t1.PARENT_ID = t2.PARENT_ID
+and t2.CHILD_FIELD = "ZZZZ";
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	SIMPLE	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Impossible WHERE noticed after reading const tables
+select
+t1.PARENT_ID,
+min(CHILD_FIELD)
+from t1 straight_join t2
+where t1.PARENT_ID = 1
+and t1.PARENT_ID = t2.PARENT_ID
+and t2.CHILD_FIELD = "ZZZZ";
+PARENT_ID	min(CHILD_FIELD)
+NULL	NULL
+drop table t1,t2;
+# Check that things works if sub queries are re-executed
+create table t1 (a int primary key, b int);
+create table t2 (a int primary key, b int);
+create table t3 (a int primary key, b int);
+insert into t1 values (1,1),(2,2),(3,3);
+insert into t2 values (1,1),(2,2),(3,3);
+insert into t3 values (1,1),(3,3);
+explain
+select *,
+(select
+CONCAT('t2:',       IFNULL(t2.a,      't2a-null'), ';',
+'min_t3_b:', IFNULL(min(t3.b), 't3b-null'))
+from t2,t3
+where t2.a=1 and t1.b = t3.a) as s1
+from t1;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	t1	ALL	NULL	NULL	NULL	NULL	3	
+2	DEPENDENT SUBQUERY	t2	const	PRIMARY	PRIMARY	4	const	1	Using index
+2	DEPENDENT SUBQUERY	t3	eq_ref	PRIMARY	PRIMARY	4	test.t1.b	1	
+select *,
+(select
+CONCAT('t2:',       IFNULL(t2.a,      't2a-null'), ';',
+'min_t3_b:', IFNULL(min(t3.b), 't3b-null'))
+from t2,t3
+where t2.a=1 and t1.b = t3.a) as s1
+from t1;
+a	b	s1
+1	1	t2:1;min_t3_b:1
+2	2	t2:t2a-null;min_t3_b:t3b-null
+3	3	t2:1;min_t3_b:3
+drop table t1,t2,t3;
+#
 # End of 10.5 tests
 #
diff --git a/mysql-test/main/group_min_max.test b/mysql-test/main/group_min_max.test
index 5f7981b8b30..1fc2be6231a 100644
--- a/mysql-test/main/group_min_max.test
+++ b/mysql-test/main/group_min_max.test
@@ -1748,6 +1748,116 @@ SELECT MIN(pk), a FROM t1 WHERE pk <> 1 GROUP BY a;
 
 DROP TABLE t1;
 
+--echo #
+--echo # MDEV-6768 Wrong result with agregate with join with no resultset
+--echo #
+
+create table t1
+(
+	PARENT_ID int(10) unsigned NOT NULL AUTO_INCREMENT,
+	PARENT_FIELD VARCHAR(10),
+	PRIMARY KEY (PARENT_ID)
+) engine=innodb;
+
+create table t2
+(
+	CHILD_ID INT NOT NULL AUTO_INCREMENT,
+	PARENT_ID INT NOT NULL,
+	CHILD_FIELD varchar(10),
+	PRIMARY KEY (CHILD_ID)
+)engine=innodb;
+
+INSERT INTO t1 (PARENT_FIELD)
+SELECT 'AAAA';
+
+INSERT INTO t2 (PARENT_ID, CHILD_FIELD)
+SELECT 1, 'BBBB';
+
+explain select
+ t1.PARENT_ID,
+ min(CHILD_FIELD)
+ from t1 straight_join t2
+ where t1.PARENT_ID = 1
+ and t1.PARENT_ID = t2.PARENT_ID
+ and t2.CHILD_FIELD = "ZZZZ";
+
+select
+ t1.PARENT_ID,
+ min(CHILD_FIELD)
+ from t1 straight_join t2
+ where t1.PARENT_ID = 1
+ and t1.PARENT_ID = t2.PARENT_ID
+ and t2.CHILD_FIELD = "ZZZZ";
+
+select
+ 1,
+ min(CHILD_FIELD)
+ from t1 straight_join t2
+ where t1.PARENT_ID = 1
+ and t1.PARENT_ID = t2.PARENT_ID
+ and t2.CHILD_FIELD = "ZZZZ";
+
+select
+ IFNULL(t1.PARENT_ID,1),
+ min(CHILD_FIELD)
+ from t1 straight_join t2
+ where t1.PARENT_ID = 1
+ and t1.PARENT_ID = t2.PARENT_ID
+ and t2.CHILD_FIELD = "ZZZZ";
+
+
+--echo # Check that things works with MyISAM (which has different explain)
+
+alter table t1 engine=myisam;
+alter table t2 engine=myisam;
+
+explain select
+ t1.PARENT_ID,
+ min(CHILD_FIELD)
+ from t1 straight_join t2
+ where t1.PARENT_ID = 1
+ and t1.PARENT_ID = t2.PARENT_ID
+ and t2.CHILD_FIELD = "ZZZZ";
+
+select
+ t1.PARENT_ID,
+ min(CHILD_FIELD)
+ from t1 straight_join t2
+ where t1.PARENT_ID = 1
+ and t1.PARENT_ID = t2.PARENT_ID
+ and t2.CHILD_FIELD = "ZZZZ";
+
+drop table t1,t2;
+
+--echo # Check that things works if sub queries are re-executed
+
+create table t1 (a int primary key, b int);
+create table t2 (a int primary key, b int);
+create table t3 (a int primary key, b int);
+
+insert into t1 values (1,1),(2,2),(3,3);
+insert into t2 values (1,1),(2,2),(3,3);
+insert into t3 values (1,1),(3,3);
+
+explain
+select *,
+   (select
+        CONCAT('t2:',       IFNULL(t2.a,      't2a-null'), ';',
+               'min_t3_b:', IFNULL(min(t3.b), 't3b-null'))
+    from t2,t3
+    where t2.a=1 and t1.b = t3.a) as s1
+from t1;
+
+select *,
+   (select
+        CONCAT('t2:',       IFNULL(t2.a,      't2a-null'), ';',
+               'min_t3_b:', IFNULL(min(t3.b), 't3b-null'))
+    from t2,t3
+    where t2.a=1 and t1.b = t3.a) as s1
+from t1;
+
+drop table t1,t2,t3;
+
 --echo #
 --echo # End of 10.5 tests
 --echo #
diff --git a/mysql-test/main/type_timestamp.result b/mysql-test/main/type_timestamp.result
index f23c66e10a5..c78619fe585 100644
--- a/mysql-test/main/type_timestamp.result
+++ b/mysql-test/main/type_timestamp.result
@@ -1230,6 +1230,8 @@ SELECT * FROM t1 HAVING MIN(t1.c1) >= ALL(SELECT 'a' UNION SELECT 'r');
 c1
 Warnings:
 Warning	1292	Truncated incorrect datetime value: 'r'
+SELECT * FROM t1 HAVING MIN(t1.c1) > 0;
+c1
 DROP TABLE t1;
 CREATE TABLE t1 (c1 timestamp);
 INSERT INTO t1 VALUES ('2010-01-01 00:00:00');
diff --git a/mysql-test/main/type_timestamp.test b/mysql-test/main/type_timestamp.test
index a0f1f2c3d78..84b7e1cf49c 100644
--- a/mysql-test/main/type_timestamp.test
+++ b/mysql-test/main/type_timestamp.test
@@ -810,6 +810,7 @@ DROP TABLE t1;
 CREATE TABLE t1 (c1 timestamp);
 SELECT MIN(t1.c1) AS k1 FROM t1 HAVING (k1 >= ALL(SELECT 'a' UNION SELECT 'r'));
 SELECT * FROM t1 HAVING MIN(t1.c1) >= ALL(SELECT 'a' UNION SELECT 'r');
+SELECT * FROM t1 HAVING MIN(t1.c1) > 0;
 DROP TABLE t1;
 
 CREATE TABLE t1 (c1 timestamp);
diff --git a/sql/item_func.h b/sql/item_func.h
index 0af90fab24b..1a10b6e1d29 100644
--- a/sql/item_func.h
+++ b/sql/item_func.h
@@ -380,7 +380,7 @@ public:
   {
     for (uint i= 0; i < arg_count; i++)
     {
-      args[i]->no_rows_in_result();
+      args[i]->restore_to_before_no_rows_in_result();
     }
   }
   void convert_const_compared_to_int_field(THD *thd);
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index b6fee1c6f85..2f1cc62fe39 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -141,10 +141,10 @@ static void update_depend_map_for_order(JOIN *join, ORDER *order);
 static ORDER *remove_const(JOIN *join,ORDER *first_order,COND *cond,
 			   bool change_list, bool *simple_order);
 static int return_zero_rows(JOIN *join, select_result *res, 
-                            List<TABLE_LIST> &tables,
-                            List<Item> &fields, bool send_row,
+                            List<TABLE_LIST> *tables,
+                            List<Item> *fields, bool send_row,
                             ulonglong select_options, const char *info,
-                            Item *having, List<Item> &all_fields);
+                            Item *having, List<Item> *all_fields);
 static COND *build_equal_items(JOIN *join, COND *cond,
                                COND_EQUAL *inherited,
                                List<TABLE_LIST> *join_list,
@@ -1165,11 +1165,40 @@ int SELECT_LEX::vers_setup_conds(THD *thd, TABLE_LIST *tables)
   DBUG_RETURN(0);
 }
 
+
 /*****************************************************************************
   Check fields, find best join, do the select and output fields.
   mysql_select assumes that all tables are already opened
 *****************************************************************************/
 
+/*
+  Check if we have a field reference. If yes, we have to use
+  mixed_implicit_grouping.
+*/
+
+static bool check_list_for_field(List<Item> *items)
+{
+  List_iterator_fast <Item> select_it(*items);
+  Item *select_el;
+
+  while ((select_el= select_it++))
+  {
+    if (select_el->with_field)
+      return true;
+  }
+  return false;
+}
+
+static bool check_list_for_field(ORDER *order)
+{
+  for (; order; order= order->next)
+  {
+    if (order->item[0]->with_field)
+      return true;
+  }
+  return false;
+}
+
 
 /**
   Prepare of whole select (including sub queries in future).
@@ -1248,53 +1277,45 @@ JOIN::prepare(TABLE_LIST *tables_init, COND *conds_init, uint og_num,
     DBUG_RETURN(-1);
 
   /*
-    TRUE if the SELECT list mixes elements with and without grouping,
-    and there is no GROUP BY clause. Mixing non-aggregated fields with
-    aggregate functions in the SELECT list is a MySQL extenstion that
-    is allowed only if the ONLY_FULL_GROUP_BY sql mode is not set.
+    mixed_implicit_grouping will be set to TRUE if the SELECT list
+    mixes elements with and without grouping, and there is no GROUP BY
+    clause.
+    Mixing non-aggregated fields with aggregate functions in the
+    SELECT list or HAVING is a MySQL extension that is allowed only if
+    the ONLY_FULL_GROUP_BY sql mode is not set.
   */
   mixed_implicit_grouping= false;
   if ((~thd->variables.sql_mode & MODE_ONLY_FULL_GROUP_BY) &&
       select_lex->with_sum_func && !group_list)
   {
-    List_iterator_fast <Item> select_it(fields_list);
-    Item *select_el; /* Element of the SELECT clause, can be an expression. */
-    bool found_field_elem= false;
-    bool found_sum_func_elem= false;
-
-    while ((select_el= select_it++))
+    if (check_list_for_field(&fields_list)  ||
+        check_list_for_field(order))
     {
-      if (select_el->with_sum_func())
-        found_sum_func_elem= true;
-      if (select_el->with_field)
-        found_field_elem= true;
-      if (found_sum_func_elem && found_field_elem)
+      TABLE_LIST *tbl;
+      List_iterator_fast<TABLE_LIST> li(select_lex->leaf_tables);
+
+      mixed_implicit_grouping= true;            // mark for future
+
+      while ((tbl= li++))
       {
-        mixed_implicit_grouping= true;
-        break;
+        /*
+          If the query uses implicit grouping where the select list
+          contains both aggregate functions and non-aggregate fields,
+          any non-aggregated field may produce a NULL value. Set all
+          fields of each table as nullable before semantic analysis to
+          take into account this change of nullability.
+
+          Note: this loop doesn't touch tables inside merged
+          semi-joins, because subquery-to-semijoin conversion has not
+          been done yet. This is intended.
+        */
+        if (tbl->table)
+          tbl->table->maybe_null= 1;
       }
     }
   }
-
   table_count= select_lex->leaf_tables.elements;
 
-  TABLE_LIST *tbl;
-  List_iterator_fast<TABLE_LIST> li(select_lex->leaf_tables);
-  while ((tbl= li++))
-  {
-    /*
-      If the query uses implicit grouping where the select list contains both
-      aggregate functions and non-aggregate fields, any non-aggregated field
-      may produce a NULL value. Set all fields of each table as nullable before
-      semantic analysis to take into account this change of nullability.
-
-      Note: this loop doesn't touch tables inside merged semi-joins, because
-      subquery-to-semijoin conversion has not been done yet. This is intended.
-    */
-    if (mixed_implicit_grouping && tbl->table)
-      tbl->table->maybe_null= 1;
-  }
- 
   uint real_og_num= og_num;
   if (skip_order_by && 
       select_lex != select_lex->master_unit()->global_parameters())
@@ -3838,7 +3859,7 @@ bool JOIN::make_aggr_tables_info()
   set_items_ref_array(items0);
   if (join_tab)
     join_tab[exec_join_tab_cnt() + aggr_tables - 1].next_select=
-      setup_end_select_func(this, NULL);
+      setup_end_select_func(this);
   group= has_group_by;
 
   DBUG_RETURN(false);
@@ -4216,13 +4237,7 @@ JOIN::reinit()
     }
   }
 
-  /* Reset of sum functions */
-  if (sum_funcs)
-  {
-    Item_sum *func, **func_ptr= sum_funcs;
-    while ((func= *(func_ptr++)))
-      func->clear();
-  }
+  clear_sum_funcs();
 
   if (no_rows_in_result_called)
   {
@@ -4507,12 +4522,12 @@ void JOIN::exec_inner()
     }
     else
     {
-      (void) return_zero_rows(this, result, select_lex->leaf_tables,
-                              *columns_list,
+      (void) return_zero_rows(this, result, &select_lex->leaf_tables,
+                              columns_list,
 			      send_row_on_empty_set(),
 			      select_options,
 			      zero_result_cause,
-			      having ? having : tmp_having, all_fields);
+			      having ? having : tmp_having, &all_fields);
       DBUG_VOID_RETURN;
     }
   }
@@ -14768,10 +14783,36 @@ ORDER *simple_remove_const(ORDER *order, COND *where)
 }
 
 
+/*
+  Set all fields in the table to have a null value
+
+  @param tables            Table list
+*/
+
+static void make_tables_null_complemented(List<TABLE_LIST> *tables)
+{
+  List_iterator<TABLE_LIST> ti(*tables);
+  TABLE_LIST *table;
+  while ((table= ti++))
+  {
+    /*
+      Don't touch semi-join materialization tables, as the a join_free()
+      call may have freed them (and HAVING clause can't have references to
+      them anyway).
+    */
+    if (!table->is_jtbm())
+    {
+      TABLE *tbl= table->table;
+      mark_as_null_row(tbl);		// Set fields to NULL
+    }
+  }
+}
+
+
 static int
-return_zero_rows(JOIN *join, select_result *result, List<TABLE_LIST> &tables,
-		 List<Item> &fields, bool send_row, ulonglong select_options,
-		 const char *info, Item *having, List<Item> &all_fields)
+return_zero_rows(JOIN *join, select_result *result, List<TABLE_LIST> *tables,
+		 List<Item> *fields, bool send_row, ulonglong select_options,
+		 const char *info, Item *having, List<Item> *all_fields)
 {
   DBUG_ENTER("return_zero_rows");
 
@@ -14787,24 +14828,15 @@ return_zero_rows(JOIN *join, select_result *result, List<TABLE_LIST> &tables,
       Set all tables to have NULL row. This is needed as we will be evaluating
       HAVING condition.
     */
-    List_iterator<TABLE_LIST> ti(tables);
-    TABLE_LIST *table;
-    while ((table= ti++))
-    {
-      /*
-        Don't touch semi-join materialization tables, as the above join_free()
-        call has freed them (and HAVING clause can't have references to them 
-        anyway).
-      */
-      if (!table->is_jtbm())
-        mark_as_null_row(table->table);		// All fields are NULL
-    }
-    List_iterator_fast<Item> it(all_fields);
+    make_tables_null_complemented(tables);
+
+    List_iterator_fast<Item> it(*all_fields);
     Item *item;
     /*
       Inform all items (especially aggregating) to calculate HAVING correctly,
       also we will need it for sending results.
     */
+    join->no_rows_in_result_called= 1;
     while ((item= it++))
       item->no_rows_in_result();
     if (having && having->val_int() == 0)
@@ -14818,12 +14850,12 @@ return_zero_rows(JOIN *join, select_result *result, List<TABLE_LIST> &tables,
     join->thd->limit_found_rows= 0;
   }
 
-  if (!(result->send_result_set_metadata(fields,
+  if (!(result->send_result_set_metadata(*fields,
                               Protocol::SEND_NUM_ROWS | Protocol::SEND_EOF)))
   {
     bool send_error= FALSE;
     if (send_row)
-      send_error= result->send_data_with_check(fields, join->unit, 0) > 0;
+      send_error= result->send_data_with_check(*fields, join->unit, 0) > 0;
     if (likely(!send_error))
       result->send_eof();				// Should be safe
   }
@@ -14839,49 +14871,42 @@ return_zero_rows(JOIN *join, select_result *result, List<TABLE_LIST> &tables,
 }
 
 /**
-  used only in JOIN::clear (always) and in do_select()
-  (if there where no matching rows)
+  Reset table rows to contain a null-complement row (all fields are null)
+
+  Used only in JOIN::clear() and in do_select() if there where no matching rows.
 
   @param join            JOIN
-  @param cleared_tables  If not null, clear also const tables and mark all
-                         cleared tables in the map. cleared_tables is only
-                         set when called from do_select() when there is a
-                         group function and there where no matching rows.
+  @param cleared_tables  Used to mark all cleared tables in the map. Needed for
+                         unclear_tables() to know which tables to restore to
+                         their original state.
 */
 
 static void clear_tables(JOIN *join, table_map *cleared_tables)
 {
-  /* 
-    must clear only the non-const tables as const tables are not re-calculated.
-  */
+  DBUG_ASSERT(cleared_tables);
   for (uint i= 0 ; i < join->table_count ; i++)
   {
     TABLE *table= join->table[i];
 
     if (table->null_row)
       continue;                                 // Nothing more to do
-    if (!(table->map & join->const_table_map) || cleared_tables)
+    (*cleared_tables)|= (((table_map) 1) << i);
+    if (table->s->null_bytes)
     {
-      if (cleared_tables)
-      {
-        (*cleared_tables)|= (((table_map) 1) << i);
-        if (table->s->null_bytes)
-        {
-          /*
-            Remember null bits for the record so that we can restore the
-            original const record in unclear_tables()
-          */
-          memcpy(table->record[1], table->null_flags, table->s->null_bytes);
-        }
-      }
-      mark_as_null_row(table);                  // All fields are NULL
+      /*
+        Remember null bits for the record so that we can restore the
+        original const record in unclear_tables()
+      */
+      memcpy(table->record[1], table->null_flags, table->s->null_bytes);
     }
+    mark_as_null_row(table);                  // All fields are NULL
   }
 }
 
 
 /**
    Reverse null marking for tables and restore null bits.
+   This return the tables to the state of before clear_tables().
 
    We have to do this because the tables may be re-used in a sub query
    and the subquery will assume that the const tables contains the original
@@ -20519,9 +20544,9 @@ void set_postjoin_aggr_write_func(JOIN_TAB *tab)
     end_select function to use. This function can't fail.
 */
 
-Next_select_func setup_end_select_func(JOIN *join, JOIN_TAB *tab)
+Next_select_func setup_end_select_func(JOIN *join)
 {
-  TMP_TABLE_PARAM *tmp_tbl= tab ? tab->tmp_table_param : &join->tmp_table_param;
+  TMP_TABLE_PARAM *tmp_tbl= &join->tmp_table_param;
 
   /* 
      Choose method for presenting result to user. Use end_send_group
@@ -20591,7 +20616,7 @@ do_select(JOIN *join, Procedure *procedure)
   join->duplicate_rows= join->send_records=0;
   if (join->only_const_tables() && !join->need_tmp)
   {
-    Next_select_func end_select= setup_end_select_func(join, NULL);
+    Next_select_func end_select= setup_end_select_func(join);
 
     /*
       HAVING will be checked after processing aggregate functions,
@@ -21077,6 +21102,7 @@ sub_select(JOIN *join,JOIN_TAB *join_tab,bool end_of_records)
     }
   }
 
+  /* Restore state if mark_as_null_row() have been called */
   if (join_tab->last_inner)
   {
     JOIN_TAB *last_inner_tab= join_tab->last_inner;
@@ -22461,11 +22487,18 @@ end_send_group(JOIN *join, JOIN_TAB *join_tab __attribute__((unused)),
 {
   int idx= -1;
   enum_nested_loop_state ok_code= NESTED_LOOP_OK;
+  /*
+    join_tab can be 0 in the case all tables are const tables and we did not
+    need a temporary table to store the result.
+    In this case we use the original given fields, which is stored in
+    join->fields.
+  */
   List<Item> *fields= join_tab ? (join_tab-1)->fields : join->fields;
   DBUG_ENTER("end_send_group");
 
   if (!join->items3.is_null() && !join->set_group_rpa)
   {
+    /* Move ref_pointer_array to points to items3 */
     join->set_group_rpa= true;
     join->set_items_ref_array(join->items3);
   }
@@ -22473,10 +22506,12 @@ end_send_group(JOIN *join, JOIN_TAB *join_tab __attribute__((unused)),
   if (!join->first_record || end_of_records ||
       (idx=test_if_group_changed(join->group_fields)) >= 0)
   {
+
     if (!join->group_sent &&
         (join->first_record ||
          (end_of_records && !join->group && !join->group_optimized_away)))
     {
+      table_map cleared_tables= (table_map) 0;
       if (join->procedure)
 	join->procedure->end_group();
       if (idx < (int) join->send_group_parts)
@@ -22499,11 +22534,13 @@ end_send_group(JOIN *join, JOIN_TAB *join_tab __attribute__((unused)),
 	{
 	  if (!join->first_record)
 	  {
-            List_iterator_fast<Item> it(*join->fields);
-            Item *item;
             /* No matching rows for group function */
-            join->clear();
 
+            List_iterator_fast<Item> it(*fields);
+            Item *item;
+            join->no_rows_in_result_called= 1;
+
+            join->clear(&cleared_tables);
             while ((item= it++))
               item->no_rows_in_result();
 	  }
@@ -22531,7 +22568,14 @@ end_send_group(JOIN *join, JOIN_TAB *join_tab __attribute__((unused)),
 	    if (join->rollup_send_data((uint) (idx+1)))
 	      error= 1;
 	  }
-	}
+          if (join->no_rows_in_result_called)
+          {
+            /* Restore null tables to original state */
+            join->no_rows_in_result_called= 0;
+            if (cleared_tables)
+              unclear_tables(join, &cleared_tables);
+          }
+        }
 	if (unlikely(error > 0))
           DBUG_RETURN(NESTED_LOOP_ERROR);        /* purecov: inspected */
 	if (end_of_records)
@@ -22835,6 +22879,7 @@ end_write_group(JOIN *join, JOIN_TAB *join_tab __attribute__((unused)),
   {
     if (join->first_record || (end_of_records && !join->group))
     {
+      table_map cleared_tables= (table_map) 0;
       if (join->procedure)
 	join->procedure->end_group();
       int send_group_parts= join->send_group_parts;
@@ -22843,7 +22888,7 @@ end_write_group(JOIN *join, JOIN_TAB *join_tab __attribute__((unused)),
         if (!join->first_record)
         {
           /* No matching rows for group function */
-          join->clear();
+          join->clear(&cleared_tables);
         }
         copy_sum_funcs(join->sum_funcs,
                        join->sum_funcs_end[send_group_parts]);
@@ -22866,6 +22911,8 @@ end_write_group(JOIN *join, JOIN_TAB *join_tab __attribute__((unused)),
 	    DBUG_RETURN(NESTED_LOOP_ERROR);
           }
 	}
+        if (cleared_tables)
+          unclear_tables(join, &cleared_tables);
 	if (end_of_records)
 	  goto end;
       }
@@ -26965,11 +27012,8 @@ int JOIN::rollup_write_data(uint idx, TMP_TABLE_PARAM *tmp_table_param_arg, TABL
   (end_send_group/end_write_group)
 */
 
-void JOIN::clear()
+void inline JOIN::clear_sum_funcs()
 {
-  clear_tables(this, 0);
-  copy_fields(&tmp_table_param);
-
   if (sum_funcs)
   {
     Item_sum *func, **func_ptr= sum_funcs;
@@ -26979,6 +27023,22 @@ void JOIN::clear()
 }
 
 
+/*
+  Prepare for returning 'empty row' when there is no matching row.
+
+  - Mark all tables with mark_as_null_row()
+  - Make a copy of of all simple SELECT items
+  - Reset all sum functions to NULL or 0.
+*/
+
+void JOIN::clear(table_map *cleared_tables)
+{
+  clear_tables(this, cleared_tables);
+  copy_fields(&tmp_table_param);
+  clear_sum_funcs();
+}
+
+
 /**
   Print an EXPLAIN line with all NULLs and given message in the 'Extra' column
 
diff --git a/sql/sql_select.h b/sql/sql_select.h
index 4eafffd385f..be50925034c 100644
--- a/sql/sql_select.h
+++ b/sql/sql_select.h
@@ -227,7 +227,7 @@ enum sj_strategy_enum
 
 typedef enum_nested_loop_state
 (*Next_select_func)(JOIN *, struct st_join_table *, bool);
-Next_select_func setup_end_select_func(JOIN *join, JOIN_TAB *tab);
+Next_select_func setup_end_select_func(JOIN *join);
 int rr_sequential(READ_RECORD *info);
 int rr_sequential_and_unpack(READ_RECORD *info);
 Item *remove_pushed_top_conjuncts(THD *thd, Item *cond);
@@ -1767,7 +1767,8 @@ public:
   void join_free();
   /** Cleanup this JOIN, possibly for reuse */
   void cleanup(bool full);
-  void clear();
+  void clear(table_map *cleared_tables);
+  void inline clear_sum_funcs();
   bool send_row_on_empty_set()
   {
     return (do_send_rows && implicit_grouping && !group_optimized_away &&
diff --git a/sql/table.h b/sql/table.h
index d8756deb43c..f28e1268fad 100644
--- a/sql/table.h
+++ b/sql/table.h
@@ -3306,10 +3306,16 @@ inline void mark_as_null_row(TABLE *table)
     bfill(table->null_flags,table->s->null_bytes,255);
 }
 
+/*
+  Restore table to state before mark_as_null_row() call.
+  This assumes that the caller has restored table->null_flags,
+  as is done in unclear_tables().
+*/
+
 inline void unmark_as_null_row(TABLE *table)
 {
-  table->null_row=0;
-  table->status= STATUS_NO_RECORD;
+  table->null_row= 0;
+  table->status&= ~STATUS_NULL_ROW;
 }
 
 bool is_simple_order(ORDER *order);

From b0c285bb06f85650055fb28f03c8dec3338414dd Mon Sep 17 00:00:00 2001
From: Monty <monty@mariadb.org>
Date: Mon, 22 May 2023 11:27:00 +0300
Subject: [PATCH 04/15] Remove warning of not freed memory if mysqld aborts

Fixes warning when doing:
./sql/mariadbd --socket=/tmp/xxxx/ddd
---
 sql/mysqld.cc | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sql/mysqld.cc b/sql/mysqld.cc
index 3163ff36c9a..843f9b5cbae 100644
--- a/sql/mysqld.cc
+++ b/sql/mysqld.cc
@@ -1714,6 +1714,11 @@ static void close_connections(void)
       (void) unlink(mysqld_unix_port);
     }
   }
+  /*
+    The following is needed to the threads stuck in
+    setup_connection_thread_globals()
+    to continue.
+  */
   listen_sockets.free_memory();
   mysql_mutex_unlock(&LOCK_start_thread);
 
@@ -1999,6 +2004,7 @@ static void clean_up(bool print_message)
   end_ssl();
 #ifndef EMBEDDED_LIBRARY
   vio_end();
+  listen_sockets.free_memory();
 #endif /*!EMBEDDED_LIBRARY*/
 #if defined(ENABLED_DEBUG_SYNC)
   /* End the debug sync facility. See debug_sync.cc. */

From 6a0314063d892370ea56d36bd87050f76ea54e30 Mon Sep 17 00:00:00 2001
From: Monty <monty@mariadb.org>
Date: Tue, 18 Apr 2023 11:21:06 +0300
Subject: [PATCH 05/15] Make install.db read only in mtr

This ensures that no mtr test can change install.db after it's initial
creation as changing it while as another thread is coping it will lead to
failures in at least InnoDB and Aria recovery.

Fixed spider/bugfix.mdev_30370 that was wrongly used install.db
---
 mysql-test/lib/My/File/Path.pm                | 31 ++++++++++++++++++-
 mysql-test/lib/My/SafeProcess/Base.pm         |  2 +-
 mysql-test/mysql-test-run.pl                  |  7 +++--
 .../spider/bugfix/t/mdev_30370.test           |  5 ++-
 4 files changed, 40 insertions(+), 5 deletions(-)

diff --git a/mysql-test/lib/My/File/Path.pm b/mysql-test/lib/My/File/Path.pm
index d60027c909e..fd3cf6dd61c 100644
--- a/mysql-test/lib/My/File/Path.pm
+++ b/mysql-test/lib/My/File/Path.pm
@@ -34,7 +34,7 @@ use strict;
 
 use Exporter;
 use base "Exporter";
-our @EXPORT= qw /rmtree mkpath copytree/;
+our @EXPORT= qw /rmtree mkpath copytree make_readonly/;
 
 use File::Find;
 use File::Copy;
@@ -184,6 +184,10 @@ sub copytree {
     # Only copy plain files
     next unless -f "$from_dir/$_";
     copy("$from_dir/$_", "$to_dir/$_");
+    if (!$use_umask)
+    {
+      chmod(0666, "$to_dir/$_");
+    }
   }
   closedir(DIR);
 
@@ -193,4 +197,29 @@ sub copytree {
   }
 }
 
+
+sub make_readonly {
+  my ($dir) = @_;
+
+  die "Usage: make_readonly(<dir>])"
+    unless @_ == 1;
+
+  opendir(DIR, "$dir")
+    or croak("Can't find $dir$!");
+  for(readdir(DIR)) {
+
+    next if "$_" eq "." or "$_" eq "..";
+
+    if ( -d "$dir/$_" )
+    {
+      make_readonly("$dir/$_");
+      next;
+    }
+
+    # Only copy plain files
+    next unless -f "$dir/$_";
+    chmod 0444, "$dir/$_";
+  }
+  closedir(DIR);
+}
 1;
diff --git a/mysql-test/lib/My/SafeProcess/Base.pm b/mysql-test/lib/My/SafeProcess/Base.pm
index 818e6e34e11..1cd01cb0ca9 100644
--- a/mysql-test/lib/My/SafeProcess/Base.pm
+++ b/mysql-test/lib/My/SafeProcess/Base.pm
@@ -40,7 +40,7 @@ our @EXPORT= qw(create_process);
 #   Retry a couple of times if fork returns EAGAIN
 #
 sub _safe_fork {
-  my $retries= 5;
+  my $retries= 100;
   my $pid;
 
  FORK:
diff --git a/mysql-test/mysql-test-run.pl b/mysql-test/mysql-test-run.pl
index da5e33428a9..0513bc209ad 100755
--- a/mysql-test/mysql-test-run.pl
+++ b/mysql-test/mysql-test-run.pl
@@ -401,8 +401,11 @@ sub main {
   my $tests= collect_test_cases($opt_reorder, $opt_suites, \@opt_cases, \@opt_skip_test_list);
   mark_time_used('collect');
 
-  mysql_install_db(default_mysqld(), "$opt_vardir/install.db") unless using_extern();
-
+  if (!using_extern())
+  {
+    mysql_install_db(default_mysqld(), "$opt_vardir/install.db");
+    make_readonly("$opt_vardir/install.db");
+  }
   if ($opt_dry_run)
   {
     for (@$tests) {
diff --git a/storage/spider/mysql-test/spider/bugfix/t/mdev_30370.test b/storage/spider/mysql-test/spider/bugfix/t/mdev_30370.test
index 788ea2323f7..99e56ab062a 100644
--- a/storage/spider/mysql-test/spider/bugfix/t/mdev_30370.test
+++ b/storage/spider/mysql-test/spider/bugfix/t/mdev_30370.test
@@ -2,4 +2,7 @@
 --echo # MDEV-30370 mariadbd hangs when running with --wsrep-recover and --plugin-load-add=ha_spider.so
 --echo #
 
---exec $MYSQLD_BOOTSTRAP_CMD --wsrep-recover --plugin-load-add=ha_spider.so
+let $MYSQLD_DATADIR=$MYSQLTEST_VARDIR/mdev_30370;
+--mkdir $MYSQLD_DATADIR
+--exec $MYSQLD_BOOTSTRAP_CMD --wsrep-recover --plugin-load-add=ha_spider.so --datadir=$MYSQLD_DATADIR
+--rmdir $MYSQLD_DATADIR

From c7e04af8bc4b3c8a390e362bc9b24716b6edb16a Mon Sep 17 00:00:00 2001
From: Monty <monty@mariadb.org>
Date: Tue, 18 Apr 2023 14:56:07 +0300
Subject: [PATCH 06/15] Update main.selectivity test and results

---
 mysql-test/main/selectivity.result        | 35 +++++++++++++++++------
 mysql-test/main/selectivity.test          | 12 ++++----
 mysql-test/main/selectivity_innodb.result | 35 +++++++++++++++++------
 3 files changed, 59 insertions(+), 23 deletions(-)

diff --git a/mysql-test/main/selectivity.result b/mysql-test/main/selectivity.result
index 5a7ec7799a0..2bde5027d0e 100644
--- a/mysql-test/main/selectivity.result
+++ b/mysql-test/main/selectivity.result
@@ -1824,7 +1824,6 @@ test.t1	analyze	status	Table is already up to date
 test.t2	analyze	status	Engine-independent statistics collected
 test.t2	analyze	status	Table is already up to date
 set optimizer_switch='exists_to_in=off';
-set optimizer_use_condition_selectivity=2;
 SELECT * FROM t1
 WHERE
 EXISTS (SELECT * FROM t1 A INNER JOIN t2 ON t2.a = A.id
@@ -1849,18 +1848,39 @@ id	a
 17	17
 18	18
 19	19
-explain SELECT * FROM t1
+set statement optimizer_use_condition_selectivity=2 for explain SELECT * FROM t1
 WHERE
 EXISTS (SELECT * FROM t1 A INNER JOIN t2 ON t2.a = A.id
 WHERE A.a=t1.a AND t2.b < 20);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	PRIMARY	t1	ALL	NULL	NULL	NULL	NULL	100	Using where
-2	DEPENDENT SUBQUERY	A	ref	PRIMARY,a	a	5	test.t1.a	1	
-2	DEPENDENT SUBQUERY	t2	ref|filter	a,b	a|b	5|5	test.A.id	1 (10%)	Using where; Using rowid filter
-EXPLAIN  SELECT * FROM t1 A, t1 B WHERE A.a = B.a and A.id = 65;
+3	DEPENDENT SUBQUERY	A	ref	PRIMARY,a	a	5	test.t1.a	1	
+3	DEPENDENT SUBQUERY	t2	ref|filter	a,b	a|b	5|5	test.A.id	1 (10%)	Using where; Using rowid filter
+set statement optimizer_use_condition_selectivity=4 for explain SELECT * FROM t1
+WHERE
+EXISTS (SELECT * FROM t1 A INNER JOIN t2 ON t2.a = A.id
+WHERE A.a=t1.a AND t2.b < 20);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
-1	SIMPLE	A	const	PRIMARY,a	PRIMARY	4	const	1	
-1	SIMPLE	B	ref	a	a	5	const	1	
+1	PRIMARY	t1	ALL	NULL	NULL	NULL	NULL	100	Using where
+3	DEPENDENT SUBQUERY	A	ref	PRIMARY,a	a	5	test.t1.a	1	
+3	DEPENDENT SUBQUERY	t2	ref|filter	a,b	a|b	5|5	test.A.id	1 (10%)	Using where; Using rowid filter
+set @query="EXPLAIN  SELECT * FROM t1 A, t1 B WHERE A.a = B.a and A.id = 65";
+set statement optimizer_use_condition_selectivity=2 for explain SELECT * FROM t1
+WHERE
+EXISTS (SELECT * FROM t1 A INNER JOIN t2 ON t2.a = A.id
+WHERE A.a=t1.a AND t2.b < 20);
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	t1	ALL	NULL	NULL	NULL	NULL	100	Using where
+3	DEPENDENT SUBQUERY	A	ref	PRIMARY,a	a	5	test.t1.a	1	
+3	DEPENDENT SUBQUERY	t2	ref|filter	a,b	a|b	5|5	test.A.id	1 (10%)	Using where; Using rowid filter
+set statement optimizer_use_condition_selectivity=4 for explain SELECT * FROM t1
+WHERE
+EXISTS (SELECT * FROM t1 A INNER JOIN t2 ON t2.a = A.id
+WHERE A.a=t1.a AND t2.b < 20);
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	t1	ALL	NULL	NULL	NULL	NULL	100	Using where
+3	DEPENDENT SUBQUERY	A	ref	PRIMARY,a	a	5	test.t1.a	1	
+3	DEPENDENT SUBQUERY	t2	ref|filter	a,b	a|b	5|5	test.A.id	1 (10%)	Using where; Using rowid filter
 explain SELECT * FROM t1
 WHERE
 EXISTS (SELECT * FROM t1 A INNER JOIN t2 ON t2.a = A.id
@@ -1870,7 +1890,6 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 2	DEPENDENT SUBQUERY	A	ref	PRIMARY,a	a	5	test.t1.a	1	
 2	DEPENDENT SUBQUERY	t2	ref|filter	a,b	a|b	5|5	test.A.id	1 (10%)	Using where; Using rowid filter
 set optimizer_switch= @save_optimizer_switch;
-set optimizer_use_condition_selectivity= @save_optimizer_use_condition_selectivity;
 drop table t1,t2;
 #
 # MDEV-21495: Conditional jump or move depends on uninitialised value in sel_arg_range_seq_next
diff --git a/mysql-test/main/selectivity.test b/mysql-test/main/selectivity.test
index df3850d74b7..9f21bea442a 100644
--- a/mysql-test/main/selectivity.test
+++ b/mysql-test/main/selectivity.test
@@ -1236,13 +1236,10 @@ set optimizer_use_condition_selectivity= @@optimizer_use_condition_selectivity;
 
 drop table t1,t2,t3;
 
-
 --echo #
 --echo # MDEV-20519: Query plan regression with optimizer_use_condition_selectivity=4
 --echo #
 
-
-
 create table t1 (id int, a int, PRIMARY KEY(id), key(a));
 insert into t1 select seq,seq from seq_1_to_100;
 
@@ -1252,7 +1249,6 @@ insert into t2 select seq,seq,seq from seq_1_to_100;
 analyze table t1,t2 persistent for all;
 
 set optimizer_switch='exists_to_in=off';
-set optimizer_use_condition_selectivity=2;
 
 let $query= SELECT * FROM t1
             WHERE
@@ -1260,14 +1256,16 @@ let $query= SELECT * FROM t1
                       WHERE A.a=t1.a AND t2.b < 20);
 
 eval $query;
-eval explain $query;
+eval set statement optimizer_use_condition_selectivity=2 for explain $query;
+eval set statement optimizer_use_condition_selectivity=4 for explain $query;
 
-EXPLAIN  SELECT * FROM t1 A, t1 B WHERE A.a = B.a and A.id = 65;
+set @query="EXPLAIN  SELECT * FROM t1 A, t1 B WHERE A.a = B.a and A.id = 65";
+eval set statement optimizer_use_condition_selectivity=2 for explain $query;
+eval set statement optimizer_use_condition_selectivity=4 for explain $query;
 
 eval explain $query;
 
 set optimizer_switch= @save_optimizer_switch;
-set optimizer_use_condition_selectivity= @save_optimizer_use_condition_selectivity;
 drop table t1,t2;
 
 --echo #
diff --git a/mysql-test/main/selectivity_innodb.result b/mysql-test/main/selectivity_innodb.result
index f9c623cd4b3..ed7da42e37f 100644
--- a/mysql-test/main/selectivity_innodb.result
+++ b/mysql-test/main/selectivity_innodb.result
@@ -1834,7 +1834,6 @@ test.t1	analyze	status	OK
 test.t2	analyze	status	Engine-independent statistics collected
 test.t2	analyze	status	OK
 set optimizer_switch='exists_to_in=off';
-set optimizer_use_condition_selectivity=2;
 SELECT * FROM t1
 WHERE
 EXISTS (SELECT * FROM t1 A INNER JOIN t2 ON t2.a = A.id
@@ -1859,18 +1858,39 @@ id	a
 17	17
 18	18
 19	19
-explain SELECT * FROM t1
+set statement optimizer_use_condition_selectivity=2 for explain SELECT * FROM t1
 WHERE
 EXISTS (SELECT * FROM t1 A INNER JOIN t2 ON t2.a = A.id
 WHERE A.a=t1.a AND t2.b < 20);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	PRIMARY	t1	index	NULL	a	5	NULL	100	Using where; Using index
-2	DEPENDENT SUBQUERY	A	ref	PRIMARY,a	a	5	test.t1.a	1	Using index
-2	DEPENDENT SUBQUERY	t2	ref|filter	a,b	a|b	5|5	test.A.id	1 (19%)	Using where; Using rowid filter
-EXPLAIN  SELECT * FROM t1 A, t1 B WHERE A.a = B.a and A.id = 65;
+3	DEPENDENT SUBQUERY	A	ref	PRIMARY,a	a	5	test.t1.a	1	Using index
+3	DEPENDENT SUBQUERY	t2	ref|filter	a,b	a|b	5|5	test.A.id	1 (19%)	Using where; Using rowid filter
+set statement optimizer_use_condition_selectivity=4 for explain SELECT * FROM t1
+WHERE
+EXISTS (SELECT * FROM t1 A INNER JOIN t2 ON t2.a = A.id
+WHERE A.a=t1.a AND t2.b < 20);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
-1	SIMPLE	A	const	PRIMARY,a	PRIMARY	4	const	1	
-1	SIMPLE	B	ref	a	a	5	const	1	Using index
+1	PRIMARY	t1	index	NULL	a	5	NULL	100	Using where; Using index
+3	DEPENDENT SUBQUERY	A	ref	PRIMARY,a	a	5	test.t1.a	1	Using index
+3	DEPENDENT SUBQUERY	t2	ref|filter	a,b	a|b	5|5	test.A.id	1 (19%)	Using where; Using rowid filter
+set @query="EXPLAIN  SELECT * FROM t1 A, t1 B WHERE A.a = B.a and A.id = 65";
+set statement optimizer_use_condition_selectivity=2 for explain SELECT * FROM t1
+WHERE
+EXISTS (SELECT * FROM t1 A INNER JOIN t2 ON t2.a = A.id
+WHERE A.a=t1.a AND t2.b < 20);
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	t1	index	NULL	a	5	NULL	100	Using where; Using index
+3	DEPENDENT SUBQUERY	A	ref	PRIMARY,a	a	5	test.t1.a	1	Using index
+3	DEPENDENT SUBQUERY	t2	ref|filter	a,b	a|b	5|5	test.A.id	1 (19%)	Using where; Using rowid filter
+set statement optimizer_use_condition_selectivity=4 for explain SELECT * FROM t1
+WHERE
+EXISTS (SELECT * FROM t1 A INNER JOIN t2 ON t2.a = A.id
+WHERE A.a=t1.a AND t2.b < 20);
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	t1	index	NULL	a	5	NULL	100	Using where; Using index
+3	DEPENDENT SUBQUERY	A	ref	PRIMARY,a	a	5	test.t1.a	1	Using index
+3	DEPENDENT SUBQUERY	t2	ref|filter	a,b	a|b	5|5	test.A.id	1 (19%)	Using where; Using rowid filter
 explain SELECT * FROM t1
 WHERE
 EXISTS (SELECT * FROM t1 A INNER JOIN t2 ON t2.a = A.id
@@ -1880,7 +1900,6 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 2	DEPENDENT SUBQUERY	A	ref	PRIMARY,a	a	5	test.t1.a	1	Using index
 2	DEPENDENT SUBQUERY	t2	ref|filter	a,b	a|b	5|5	test.A.id	1 (19%)	Using where; Using rowid filter
 set optimizer_switch= @save_optimizer_switch;
-set optimizer_use_condition_selectivity= @save_optimizer_use_condition_selectivity;
 drop table t1,t2;
 #
 # MDEV-21495: Conditional jump or move depends on uninitialised value in sel_arg_range_seq_next

From cd37e494220fa556592d8f56666a72876ee63505 Mon Sep 17 00:00:00 2001
From: Monty <monty@mariadb.org>
Date: Thu, 20 Apr 2023 14:12:48 +0300
Subject: [PATCH 07/15] MDEV-31083 ASAN use-after-poison in
 myrg_attach_children

The reason for ASAN report was that the MERGE and MYISAM file
had different key definitions, which is not allowed.

Fixed by ensuring that the MERGE code is not copying more key stats
than what is in the MyISAM file.

Other things:
- Give an error if different MyISAM files has different number of
  key parts.
---
 include/myisammrg.h           |  1 +
 mysql-test/main/merge.result  | 12 ++++++++++++
 mysql-test/main/merge.test    | 12 ++++++++++++
 storage/myisam/mi_open.c      |  1 +
 storage/myisam/myisamdef.h    |  2 +-
 storage/myisammrg/myrg_open.c | 16 ++++++++++------
 6 files changed, 37 insertions(+), 7 deletions(-)

diff --git a/include/myisammrg.h b/include/myisammrg.h
index 1d7efbe74d6..b3bca218a44 100644
--- a/include/myisammrg.h
+++ b/include/myisammrg.h
@@ -71,6 +71,7 @@ typedef struct st_myrg_info
   ulong  cache_size;
   uint	 merge_insert_method;
   uint	 tables,options,reclength,keys;
+  uint   key_parts;
   my_bool cache_in_use;
   /* If MERGE children attached to parent. See top comment in ha_myisammrg.cc */
   my_bool children_attached;
diff --git a/mysql-test/main/merge.result b/mysql-test/main/merge.result
index 3761ca2c150..6722dd38b9c 100644
--- a/mysql-test/main/merge.result
+++ b/mysql-test/main/merge.result
@@ -3919,3 +3919,15 @@ ERROR HY000: Unable to open underlying table which is differently defined or of
 DROP TRIGGER trg1;
 DROP TABLE t1;
 DROP TABLE m1;
+#
+# MDEV-31083 ASAN use-after-poison in myrg_attach_children
+#
+CREATE TABLE t1 (f TEXT, FULLTEXT (f)) ENGINE=MyISAM;
+INSERT INTO t1 VALUES ('foo'),('bar');
+CREATE TABLE mrg (f TEXT) ENGINE=MERGE, UNION(t1);
+SELECT * FROM mrg;
+f
+foo
+bar
+DROP TABLE mrg, t1;
+End of 10.5 tests
diff --git a/mysql-test/main/merge.test b/mysql-test/main/merge.test
index 888b41b24bd..ba2ce29ade2 100644
--- a/mysql-test/main/merge.test
+++ b/mysql-test/main/merge.test
@@ -2919,3 +2919,15 @@ set global default_storage_engine=@save_default_storage_engine;
 # Check that all connections opened by test cases in this file are really
 # gone so execution of other tests won't be affected by their presence.
 --source include/wait_until_count_sessions.inc
+
+--echo #
+--echo # MDEV-31083 ASAN use-after-poison in myrg_attach_children
+--echo #
+
+CREATE TABLE t1 (f TEXT, FULLTEXT (f)) ENGINE=MyISAM;
+INSERT INTO t1 VALUES ('foo'),('bar');
+CREATE TABLE mrg (f TEXT) ENGINE=MERGE, UNION(t1);
+SELECT * FROM mrg;
+DROP TABLE mrg, t1;
+
+--echo End of 10.5 tests
diff --git a/storage/myisam/mi_open.c b/storage/myisam/mi_open.c
index 3db424ea997..f47ae48ad0d 100644
--- a/storage/myisam/mi_open.c
+++ b/storage/myisam/mi_open.c
@@ -518,6 +518,7 @@ MI_INFO *mi_open(const char *name, int mode, uint open_flags)
     share->kfile=kfile;
     share->this_process=(ulong) getpid();
     share->last_process= share->state.process;
+    share->base.base_key_parts= base_key_parts;
     share->base.key_parts=key_parts;
     share->base.all_key_parts=key_parts+unique_key_parts;
     if (!(share->last_version=share->state.version))
diff --git a/storage/myisam/myisamdef.h b/storage/myisam/myisamdef.h
index c90d989c975..f84ad6fa184 100644
--- a/storage/myisam/myisamdef.h
+++ b/storage/myisam/myisamdef.h
@@ -132,7 +132,7 @@ typedef struct st_mi_base_info
   uint extra_alloc_bytes;
   uint extra_alloc_procent;
   /* The following are from the header */
-  uint key_parts, all_key_parts;
+  uint key_parts, all_key_parts, base_key_parts;
 } MI_BASE_INFO;
 
 
diff --git a/storage/myisammrg/myrg_open.c b/storage/myisammrg/myrg_open.c
index d9ea4b754f2..4a983684394 100644
--- a/storage/myisammrg/myrg_open.c
+++ b/storage/myisammrg/myrg_open.c
@@ -432,17 +432,20 @@ int myrg_attach_children(MYRG_INFO *m_info, int handle_locking,
       first_child= FALSE;
       m_info->reclength= myisam->s->base.reclength;
       min_keys=  myisam->s->base.keys;
-      key_parts= myisam->s->base.key_parts;
+      key_parts= myisam->s->base.base_key_parts;
       if (*need_compat_check && m_info->rec_per_key_part)
       {
         my_free(m_info->rec_per_key_part);
         m_info->rec_per_key_part= NULL;
       }
-      if (!m_info->rec_per_key_part)
+      if (!m_info->rec_per_key_part || m_info->key_parts != key_parts)
       {
-        if(!(m_info->rec_per_key_part= (ulong*)
-             my_malloc(rg_key_memory_MYRG_INFO,
-                       key_parts * sizeof(long), MYF(MY_WME))))
+        m_info->key_parts= key_parts;
+        /* The +1 is because by my_realloc() don't allow zero length */
+        if (!(m_info->rec_per_key_part= (ulong*)
+              my_realloc(rg_key_memory_MYRG_INFO, m_info->rec_per_key_part,
+                         key_parts * sizeof(long) +1,
+                         MYF(MY_WME | MY_ALLOW_ZERO_PTR | MY_FREE_ON_ERROR))))
           goto err; /* purecov: inspected */
         errpos= 1;
       }
@@ -457,7 +460,8 @@ int myrg_attach_children(MYRG_INFO *m_info, int handle_locking,
     myisam->open_flag|= HA_OPEN_MERGE_TABLE;
 
     /* Check table definition match. */
-    if (m_info->reclength != myisam->s->base.reclength)
+    if (m_info->reclength != myisam->s->base.reclength ||
+        key_parts != myisam->s->base.base_key_parts)
     {
       DBUG_PRINT("error", ("definition mismatch table: '%s'  repair: %d",
                            myisam->filename,

From 92d2ceac73aa175a01f520fd4b7a31ed338c1ef5 Mon Sep 17 00:00:00 2001
From: Monty <monty@mariadb.org>
Date: Mon, 22 May 2023 18:58:45 +0300
Subject: [PATCH 08/15] MDEV-28285 Unexpected result when combining DISTINCT,
 subselect and LIMIT

The problem was that when  JOIN_TAB::remove_duplicates() noticed there
can only be one possible row in the output, it adjusted limits but
didn't take into account any possible offset.

Fixed by not adjusting limit offset when setting one-row-limit.
---
 mysql-test/main/distinct.result | 25 +++++++++++++++++++++++++
 mysql-test/main/distinct.test   | 21 +++++++++++++++++++++
 sql/sql_limit.h                 |  9 +++++++++
 sql/sql_select.cc               |  2 +-
 4 files changed, 56 insertions(+), 1 deletion(-)

diff --git a/mysql-test/main/distinct.result b/mysql-test/main/distinct.result
index fa9f0259a0f..ac693421ba2 100644
--- a/mysql-test/main/distinct.result
+++ b/mysql-test/main/distinct.result
@@ -1157,3 +1157,28 @@ explain select * from t1 limit 0 offset 10;
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	NULL	NULL	NULL	NULL	NULL	NULL	NULL	Zero limit
 drop table t1, t2;
+#
+# MDEV-28285 Unexpected result when combining DISTINCT, subselect
+# and LIMIT
+#
+create table t1 (a int primary key);
+create table t2 (a int primary key, b int not null);
+insert into t1 select seq from seq_1_to_10;
+insert into t2 select seq,seq from seq_1_to_10;
+select distinct a from t1 where t1.a=1 and t1.a in (select a from t2 where t2.b in (1,2));
+a
+1
+explain select distinct a from t1 where t1.a=1 and t1.a in (select a+0 from t2 where t2.b in (1,2)) limit 10,10;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	PRIMARY	t1	const	PRIMARY	PRIMARY	4	const	1	Using index; Using temporary
+1	PRIMARY	<subquery2>	eq_ref	distinct_key	distinct_key	8	func	1	
+2	MATERIALIZED	t2	ALL	NULL	NULL	NULL	NULL	10	Using where
+select distinct a from t1 where t1.a=1 and t1.a in (select a+0 from t2 where t2.b in (1,2)) limit 10,10;
+a
+select distinct a from t1 where t1.a=1 and t1.a in (select a+0 from t2 where t2.b in (1,2)) limit 0,1;
+a
+1
+drop table t1,t2;
+#
+# end of 10.5 tests
+#
diff --git a/mysql-test/main/distinct.test b/mysql-test/main/distinct.test
index 893e2dcc9a7..9aa3b2921aa 100644
--- a/mysql-test/main/distinct.test
+++ b/mysql-test/main/distinct.test
@@ -892,3 +892,24 @@ explain select * from t1 limit 0;
 explain select * from t1 limit 0 offset 10;
 
 drop table t1, t2;
+
+--echo #
+--echo # MDEV-28285 Unexpected result when combining DISTINCT, subselect
+--echo # and LIMIT
+--echo #
+
+create table t1 (a int primary key);
+create table t2 (a int primary key, b int not null);
+
+insert into t1 select seq from seq_1_to_10;
+insert into t2 select seq,seq from seq_1_to_10;
+
+select distinct a from t1 where t1.a=1 and t1.a in (select a from t2 where t2.b in (1,2));
+explain select distinct a from t1 where t1.a=1 and t1.a in (select a+0 from t2 where t2.b in (1,2)) limit 10,10;
+select distinct a from t1 where t1.a=1 and t1.a in (select a+0 from t2 where t2.b in (1,2)) limit 10,10;
+select distinct a from t1 where t1.a=1 and t1.a in (select a+0 from t2 where t2.b in (1,2)) limit 0,1;
+drop table t1,t2;
+
+--echo #
+--echo # end of 10.5 tests
+--echo #
diff --git a/sql/sql_limit.h b/sql/sql_limit.h
index 19c1ce57e99..a85e8118175 100644
--- a/sql/sql_limit.h
+++ b/sql/sql_limit.h
@@ -52,6 +52,15 @@ class Select_limit_counters
      select_limit_cnt= 1;
    }
 
+   /* Send the first row, still honoring offset_limit_cnt */
+   void send_first_row()
+   {
+     /* Guard against overflow */
+     if ((select_limit_cnt= offset_limit_cnt +1 ) == 0)
+       select_limit_cnt= offset_limit_cnt;
+     // with_ties= false;   Remove // on merge to 10.6
+   }
+
    bool is_unlimited()
    { return select_limit_cnt == HA_POS_ERROR; }
    bool is_unrestricted()
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 2f1cc62fe39..5af2a9e6896 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -24640,7 +24640,7 @@ JOIN_TAB::remove_duplicates()
       !(join->select_options & OPTION_FOUND_ROWS))
   {
     // only const items with no OPTION_FOUND_ROWS
-    join->unit->lim.set_single_row();		// Only send first row
+    join->unit->lim.send_first_row();		// Only send first row
     my_free(sortorder);
     DBUG_RETURN(false);
   }

From a7adfd4c52307876d68ad3386cefd3757ee66e92 Mon Sep 17 00:00:00 2001
From: Monty <monty@mariadb.org>
Date: Tue, 23 May 2023 10:02:33 +0300
Subject: [PATCH 09/15] Optimized version of safe_strcpy()

Note: We should replace most case of safe_strcpy() with strmake() to avoid
the not needed zerofill.
---
 include/m_string.h | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/include/m_string.h b/include/m_string.h
index 1db86d1b197..722de2855ca 100644
--- a/include/m_string.h
+++ b/include/m_string.h
@@ -249,14 +249,15 @@ static inline void lex_string_set3(LEX_CSTRING *lex_str, const char *c_str,
 */
 static inline int safe_strcpy(char *dst, size_t dst_size, const char *src)
 {
-  memset(dst, '\0', dst_size);
-  strncpy(dst, src, dst_size - 1);
-  /*
-     If the first condition is true, we are guaranteed to have src length
-     >= (dst_size - 1), hence safe to access src[dst_size - 1].
-  */
-  if (dst[dst_size - 2] != '\0' && src[dst_size - 1] != '\0')
-    return 1; /* Truncation of src. */
+  DBUG_ASSERT(dst_size > 0);
+  /* Note, strncpy will zerofill end of dst if src shorter than dst_size */
+  strncpy(dst, src, dst_size);
+  if (dst[dst_size-1])
+  {
+    /* Ensure string is zero terminated */
+    dst[dst_size-1]= 0;
+    return 1;
+  }
   return 0;
 }
 

From 9c35f9c9c160c729a235336101d1cfe384a15d41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20M=C3=A4kel=C3=A4?= <marko.makela@mariadb.com>
Date: Tue, 23 May 2023 12:20:27 +0300
Subject: [PATCH 10/15] MDEV-31234 fixup: Allow innodb_undo_log_truncate=ON
 after upgrade

trx_purge_truncate_history(): Relax a condition that would prevent
undo log truncation if the undo log tablespaces were "contaminated"
by the bug that commit e0084b9d315f10e3ceb578b65e144d751b208bf1 fixed.
That is, trx_purge_truncate_rseg_history() would have invoked
flst_remove() on TRX_RSEG_HISTORY but not reduced TRX_RSEG_HISTORY_SIZE.

To avoid any regression with normal operation, we implement this
fixup during slow shutdown only. The condition on the history list
being empty is necessary: without it, in the test
innodb.undo_truncate_recover there may be much fewer than the
expected 90,000 calls to row_purge() before the truncation.
That is, we would truncate the undo tablespace before actually having
processed all undo log records in it.

To truncate such "contaminated" or "bloated" undo log tablespaces
(when using innodb_undo_tablespaces=2 or more)
you can execute the following SQL:

BEGIN;INSERT mysql.innodb_table_stats VALUES('','',DEFAULT,0,0,0);ROLLBACK;
SET GLOBAL innodb_undo_log_truncate=ON, innodb_fast_shutdown=0;
SHUTDOWN;

The first line creates a dummy InnoDB transaction, to ensure that there
will be some history to be purged during shutdown and that the undo
tablespaces will be truncated.
---
 storage/innobase/trx/trx0purge.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/storage/innobase/trx/trx0purge.cc b/storage/innobase/trx/trx0purge.cc
index 97979a3fefe..37c73486c8a 100644
--- a/storage/innobase/trx/trx0purge.cc
+++ b/storage/innobase/trx/trx0purge.cc
@@ -619,7 +619,8 @@ static void trx_purge_truncate_history()
 
       ut_ad(rseg->curr_size > cached);
 
-      if (rseg->curr_size > cached + 1)
+      if (rseg->curr_size > cached + 1 &&
+          (srv_fast_shutdown || srv_undo_sources || trx_sys.rseg_history_len))
         goto not_free;
 
       mutex_exit(&rseg->mutex);

From c5cf94b2dcebc55b23d28a9b14c3c5b10b16f541 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20M=C3=A4kel=C3=A4?= <marko.makela@mariadb.com>
Date: Wed, 24 May 2023 08:25:26 +0300
Subject: [PATCH 11/15] MDEV-31234 fixup: Free some UNDO pages earlier

trx_purge_truncate_rseg_history(): Add a parameter to specify if
the entire rollback segment is safe to be freed. If not, we may
still be able to invoke trx_undo_truncate_start() and free some pages.
---
 storage/innobase/trx/trx0purge.cc | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/storage/innobase/trx/trx0purge.cc b/storage/innobase/trx/trx0purge.cc
index 97979a3fefe..c5ec42ecfce 100644
--- a/storage/innobase/trx/trx0purge.cc
+++ b/storage/innobase/trx/trx0purge.cc
@@ -399,12 +399,14 @@ void trx_purge_free_segment(mtr_t &mtr, trx_rseg_t* rseg, fil_addr_t hdr_addr)
 
 /** Remove unnecessary history data from a rollback segment.
 @param[in,out]	rseg		rollback segment
-@param[in]	limit		truncate anything before this */
+@param[in]	limit		truncate anything before this
+@param[in]	all		whether everything can be truncated */
 static
 void
 trx_purge_truncate_rseg_history(
 	trx_rseg_t&			rseg,
-	const purge_sys_t::iterator&	limit)
+	const purge_sys_t::iterator&	limit,
+	bool				all)
 {
 	fil_addr_t	hdr_addr;
 	fil_addr_t	prev_hdr_addr;
@@ -443,6 +445,10 @@ func_exit:
 		goto func_exit;
 	}
 
+	if (!all) {
+		goto func_exit;
+	}
+
 	prev_hdr_addr = flst_get_prev_addr(block->frame + hdr_addr.boffset
 					   + TRX_UNDO_HISTORY_NODE);
 	prev_hdr_addr.boffset = static_cast<uint16_t>(prev_hdr_addr.boffset
@@ -539,8 +545,9 @@ static void trx_purge_truncate_history()
       ut_ad(rseg->id == i);
       ut_ad(rseg->is_persistent());
       mutex_enter(&rseg->mutex);
-      if (!rseg->trx_ref_count && rseg->needs_purge <= head.trx_no)
-        trx_purge_truncate_rseg_history(*rseg, head);
+      trx_purge_truncate_rseg_history(*rseg, head,
+                                      !rseg->trx_ref_count &&
+                                      rseg->needs_purge <= head.trx_no);
       mutex_exit(&rseg->mutex);
     }
   }

From 7737f15f8740ab994d704200a58bf62aa2f3c875 Mon Sep 17 00:00:00 2001
From: Thirunarayanan Balathandayuthapani <thiru@mariadb.com>
Date: Wed, 24 May 2023 14:34:57 +0530
Subject: [PATCH 12/15] MDEV-31333 fsp_free_page() fails to move the extent
 from 		FSP_FREE_FRAG to FSP_FREE list

- This issue was caused by commit 0b47c126e31cddda1e94588799599e138400bcf8.
In fsp_free_page(), InnoDB should set XDES_FREE_BIT of the page before
moving the extent from FSP_FREE_FRAG to FSP_FREE list.
---
 storage/innobase/fsp/fsp0fsp.cc | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/storage/innobase/fsp/fsp0fsp.cc b/storage/innobase/fsp/fsp0fsp.cc
index 514083d35cc..8618c7e2e0e 100644
--- a/storage/innobase/fsp/fsp0fsp.cc
+++ b/storage/innobase/fsp/fsp0fsp.cc
@@ -1286,23 +1286,20 @@ static dberr_t fsp_free_page(fil_space_t *space, page_no_t offset, mtr_t *mtr)
 			      + header->page.frame, frag_n_used - 1);
 	}
 
+	mtr->free(*space, static_cast<uint32_t>(offset));
+	xdes_set_free<true>(*xdes, descr, offset % FSP_EXTENT_SIZE, mtr);
+	ut_ad(err == DB_SUCCESS);
+
 	if (!xdes_get_n_used(descr)) {
 		/* The extent has become free: move it to another list */
 		err = flst_remove(header, FSP_HEADER_OFFSET + FSP_FREE_FRAG,
 				  xdes, xoffset, mtr);
-		if (UNIV_UNLIKELY(err != DB_SUCCESS)) {
-			return err;
-		}
-		err = fsp_free_extent(space, offset, mtr);
-		if (UNIV_UNLIKELY(err != DB_SUCCESS)) {
-			return err;
+		if (err == DB_SUCCESS) {
+			err = fsp_free_extent(space, offset, mtr);
 		}
 	}
 
-	mtr->free(*space, static_cast<uint32_t>(offset));
-	xdes_set_free<true>(*xdes, descr, offset % FSP_EXTENT_SIZE, mtr);
-
-	return DB_SUCCESS;
+	return err;
 }
 
 /** @return Number of segment inodes which fit on a single page */

From d77d9e1f6fb4333567a4701837806b1b8f5f5740 Mon Sep 17 00:00:00 2001
From: Monty <monty@mariadb.org>
Date: Wed, 24 May 2023 13:35:22 +0300
Subject: [PATCH 13/15] MENT-1703 Repeatable crash during backup after
 processing very large ibdata1

The crash happened in filename_to_spacename() when using it on a
filename that is not in the format of "./database/table.ibd".
According to Marko, it is possible the function is called with
the path to an undo file, which would cause a crash.

This patch fixes this by,  instead of crashing with unexpected filenames,
returning them 'as such', except for changing all '\' to '/'.
---
 extra/mariabackup/xtrabackup.cc | 61 ++++++++++++++++++++++-----------
 1 file changed, 41 insertions(+), 20 deletions(-)

diff --git a/extra/mariabackup/xtrabackup.cc b/extra/mariabackup/xtrabackup.cc
index cccf5abb01b..52174388b87 100644
--- a/extra/mariabackup/xtrabackup.cc
+++ b/extra/mariabackup/xtrabackup.cc
@@ -851,28 +851,49 @@ void mdl_lock_all()
 
 
 // Convert non-null terminated filename to space name
+// Note that in 10.6 the filename may be an undo file name
 static std::string filename_to_spacename(const void *filename, size_t len)
 {
-	// null- terminate filename
-	char *f = (char *)malloc(len + 1);
-	ut_a(f);
-	memcpy(f, filename, len);
-	f[len] = 0;
-	for (size_t i = 0; i < len; i++)
-		if (f[i] == '\\')
-			f[i] = '/';
-	char *p = strrchr(f, '.');
-	ut_a(p);
-	*p = 0;
-	char *table = strrchr(f, '/');
-	ut_a(table);
-	*table = 0;
-	char *db = strrchr(f, '/');
-	ut_a(db);
-	*table = '/';
-	std::string s(db+1);
-	free(f);
-	return s;
+  char f[FN_REFLEN];
+  char *p= 0, *table, *db;
+  DBUG_ASSERT(len = FN_REFLEN);
+
+  strmake(f, (const char*) filename, len);
+
+#ifdef _WIN32
+  for (size_t i = 0; i < len; i++)
+  {
+    if (f[i] == '\\')
+      f[i] = '/';
+  }
+#endif
+
+  /* Remove extension, if exists */
+  if (!(p= strrchr(f, '.')))
+    goto err;
+  *p= 0;
+
+  /* Find table name */
+  if (!(table= strrchr(f, '/')))
+    goto err;
+  *table = 0;
+
+  /* Find database name */
+  db= strrchr(f, '/');
+  *table = '/';
+  if (!db)
+    goto err;
+  {
+    std::string s(db+1);
+    return s;
+  }
+
+err:
+  /* Not a database/table. Return original (converted) name */
+  if (p)
+    *p= '.';                                    // Restore removed extension
+  std::string s(f);
+  return s;
 }
 
 /** Report an operation to create, delete, or rename a file during backup.

From 9b3084b7be6ac63193da72a40f1ed65af0a5f340 Mon Sep 17 00:00:00 2001
From: Monty <monty@mariadb.org>
Date: Wed, 24 May 2023 17:32:19 +0300
Subject: [PATCH 14/15] Fixed typo in xtrabackup.c

---
 extra/mariabackup/xtrabackup.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extra/mariabackup/xtrabackup.cc b/extra/mariabackup/xtrabackup.cc
index 52174388b87..83e3806eea1 100644
--- a/extra/mariabackup/xtrabackup.cc
+++ b/extra/mariabackup/xtrabackup.cc
@@ -856,7 +856,7 @@ static std::string filename_to_spacename(const void *filename, size_t len)
 {
   char f[FN_REFLEN];
   char *p= 0, *table, *db;
-  DBUG_ASSERT(len = FN_REFLEN);
+  DBUG_ASSERT(len < FN_REFLEN);
 
   strmake(f, (const char*) filename, len);
 

From 9edb1a5ce3d56ffc4ce7be1e698d55fecac0fe09 Mon Sep 17 00:00:00 2001
From: Alexander Barkov <bar@mariadb.com>
Date: Wed, 24 May 2023 13:17:47 +0400
Subject: [PATCH 15/15] MDEV-30483 After upgrade to 10.6 from Mysql 5.7 seeing
 "InnoDB: Column last_update in table mysql.innodb_table_stats is BINARY(4)
 NOT NULL but should be INT UNSIGNED NOT NULL"

Problem:

Field_timestampf implementations differ in MySQL and MariaDB:
- MariaDB sets the UNSIGNED_FLAG in Field::flags
- MySQL does not

The reference table structures
(defined in table_stats_schema and index_stats_schema)
expected the last_update column to have the DATA_UNSIGNED flag,
because MariaDB's Field_timestampf has the UNSIGNED_FLAG.
It worked fine on pure MariaDB installations.

However, if a MariaDB server starts over a MySQL-5.7 data directory during
a migration, the last_update column does not have DATA_UNSIGNED flag,
because MySQL's Field_timestampf does not have the UNSIGNED_FLAG.

This made InnoDB (after the migration from MySQL) complain into the server
error log about the unexpected data type.

The actual fix is done in storage/innobase/dict/dict0stats.cc:
It removes DATA_UNSIGNED from the prtype_mask member of the reference columns,
so now it does not require the underlying columns to have this flag.

The rest of the fix is needed for MTR tests.
The new data type plugin TYPE_MYSQL_TIMESTAMP implements a slightly modified
version of Field_timestampf, which removes the unsigned flag, so
it works like MySQL's Field_timestampf.

The MTR test ALTERs the data type of the columns
table_stats_schema.last_update and index_stats_schema.last_update
from TIMESTAMP to TYPE_MYSQL_TIMESTAMP, then makes InnoDB
verify the structure of the two statistics tables by creating
and populating an InnoDB table t1.

Without the fix made storage/innobase/dict/dict0stats.cc,
MTR complains about unexpected warnings in the server error log:

[ERROR] InnoDB: Column last_update in table mysql.innodb_table_stats is ...
[ERROR] InnoDB: Column last_update in table mysql.innodb_index_stats is ...

With the fix made storage/innobase/dict/dict0stats.cc these warnings
go away.
---
 plugin/type_mysql_timestamp/CMakeLists.txt    |  17 ++
 .../mysql-test/type_mysql_timestamp/suite.opt |   1 +
 .../mysql-test/type_mysql_timestamp/suite.pm  |  10 ++
 .../type_mysql_timestamp.result               |  45 +++++
 .../type_mysql_timestamp.test                 |  31 ++++
 .../type_mysql_timestamp_stat_tables.result   |  73 ++++++++
 .../type_mysql_timestamp_stat_tables.test     |  24 +++
 plugin/type_mysql_timestamp/plugin.cc         | 161 ++++++++++++++++++
 sql/field.h                                   |   2 +-
 sql/sql_type.h                                |   5 +-
 storage/innobase/dict/dict0stats.cc           |  18 +-
 11 files changed, 382 insertions(+), 5 deletions(-)
 create mode 100644 plugin/type_mysql_timestamp/CMakeLists.txt
 create mode 100644 plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/suite.opt
 create mode 100644 plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/suite.pm
 create mode 100644 plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/type_mysql_timestamp.result
 create mode 100644 plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/type_mysql_timestamp.test
 create mode 100644 plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/type_mysql_timestamp_stat_tables.result
 create mode 100644 plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/type_mysql_timestamp_stat_tables.test
 create mode 100644 plugin/type_mysql_timestamp/plugin.cc

diff --git a/plugin/type_mysql_timestamp/CMakeLists.txt b/plugin/type_mysql_timestamp/CMakeLists.txt
new file mode 100644
index 00000000000..ca7bf1e7704
--- /dev/null
+++ b/plugin/type_mysql_timestamp/CMakeLists.txt
@@ -0,0 +1,17 @@
+# Copyright (c) 2019, MariaDB corporation
+# 
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+# 
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1335  USA
+
+MYSQL_ADD_PLUGIN(type_mysql_timestamp plugin.cc RECOMPILE_FOR_EMBEDDED
+                 MODULE_ONLY COMPONENT Test)
diff --git a/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/suite.opt b/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/suite.opt
new file mode 100644
index 00000000000..e9e2a99b589
--- /dev/null
+++ b/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/suite.opt
@@ -0,0 +1 @@
+--plugin-load-add=$TYPE_MYSQL_TIMESTAMP_SO
diff --git a/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/suite.pm b/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/suite.pm
new file mode 100644
index 00000000000..cbb8f1b097f
--- /dev/null
+++ b/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/suite.pm
@@ -0,0 +1,10 @@
+package My::Suite::Type_test;
+
+@ISA = qw(My::Suite);
+
+return "No TYPE_TEST plugin" unless $ENV{TYPE_MYSQL_TIMESTAMP_SO};
+
+sub is_default { 1 }
+
+bless { };
+
diff --git a/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/type_mysql_timestamp.result b/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/type_mysql_timestamp.result
new file mode 100644
index 00000000000..009b3a7c47c
--- /dev/null
+++ b/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/type_mysql_timestamp.result
@@ -0,0 +1,45 @@
+#
+# MDEV-30483 After upgrade to 10.6 from Mysql 5.7 seeing "InnoDB: Column last_update in table mysql.innodb_table_stats is BINARY(4) NOT NULL but should be INT UNSIGNED NOT NULL"
+#
+SELECT
+PLUGIN_NAME,
+PLUGIN_VERSION,
+PLUGIN_STATUS,
+PLUGIN_TYPE,
+PLUGIN_AUTHOR,
+PLUGIN_DESCRIPTION,
+PLUGIN_LICENSE,
+PLUGIN_MATURITY,
+PLUGIN_AUTH_VERSION
+FROM INFORMATION_SCHEMA.PLUGINS
+WHERE PLUGIN_TYPE='DATA TYPE'
+    AND PLUGIN_NAME LIKE 'type_mysql_timestamp';
+PLUGIN_NAME	type_mysql_timestamp
+PLUGIN_VERSION	1.0
+PLUGIN_STATUS	ACTIVE
+PLUGIN_TYPE	DATA TYPE
+PLUGIN_AUTHOR	MariaDB Corporation
+PLUGIN_DESCRIPTION	Data type TYPE_MYSQL_TIMESTAMP
+PLUGIN_LICENSE	GPL
+PLUGIN_MATURITY	Experimental
+PLUGIN_AUTH_VERSION	1.0
+CREATE TABLE t1 (a TYPE_MYSQL_TIMESTAMP);
+SHOW CREATE TABLE t1;
+Table	Create Table
+t1	CREATE TABLE `t1` (
+  `a` type_mysql_timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
+) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci
+DROP TABLE t1;
+CREATE TABLE t1 (a TIMESTAMP);
+SHOW CREATE TABLE t1;
+Table	Create Table
+t1	CREATE TABLE `t1` (
+  `a` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
+) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci
+ALTER TABLE t1 MODIFY a TYPE_MYSQL_TIMESTAMP;
+SHOW CREATE TABLE t1;
+Table	Create Table
+t1	CREATE TABLE `t1` (
+  `a` type_mysql_timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
+) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci
+DROP TABLE t1;
diff --git a/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/type_mysql_timestamp.test b/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/type_mysql_timestamp.test
new file mode 100644
index 00000000000..a7aaa5a3e4c
--- /dev/null
+++ b/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/type_mysql_timestamp.test
@@ -0,0 +1,31 @@
+--source include/have_innodb.inc
+
+--echo #
+--echo # MDEV-30483 After upgrade to 10.6 from Mysql 5.7 seeing "InnoDB: Column last_update in table mysql.innodb_table_stats is BINARY(4) NOT NULL but should be INT UNSIGNED NOT NULL"
+--echo #
+
+--vertical_results
+SELECT
+  PLUGIN_NAME,
+  PLUGIN_VERSION,
+  PLUGIN_STATUS,
+  PLUGIN_TYPE,
+  PLUGIN_AUTHOR,
+  PLUGIN_DESCRIPTION,
+  PLUGIN_LICENSE,
+  PLUGIN_MATURITY,
+  PLUGIN_AUTH_VERSION
+FROM INFORMATION_SCHEMA.PLUGINS
+  WHERE PLUGIN_TYPE='DATA TYPE'
+    AND PLUGIN_NAME LIKE 'type_mysql_timestamp';
+--horizontal_results
+
+CREATE TABLE t1 (a TYPE_MYSQL_TIMESTAMP);
+SHOW CREATE TABLE t1;
+DROP TABLE t1;
+
+CREATE TABLE t1 (a TIMESTAMP);
+SHOW CREATE TABLE t1;
+ALTER TABLE t1 MODIFY a TYPE_MYSQL_TIMESTAMP;
+SHOW CREATE TABLE t1;
+DROP TABLE t1;
diff --git a/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/type_mysql_timestamp_stat_tables.result b/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/type_mysql_timestamp_stat_tables.result
new file mode 100644
index 00000000000..e48f29c9a26
--- /dev/null
+++ b/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/type_mysql_timestamp_stat_tables.result
@@ -0,0 +1,73 @@
+#
+# MDEV-30483 After upgrade to 10.6 from Mysql 5.7 seeing "InnoDB: Column last_update in table mysql.innodb_table_stats is BINARY(4) NOT NULL but should be INT UNSIGNED NOT NULL"
+#
+SET @@global.innodb_stats_persistent=0;
+SHOW CREATE TABLE mysql.innodb_table_stats;
+Table	Create Table
+innodb_table_stats	CREATE TABLE `innodb_table_stats` (
+  `database_name` varchar(64) NOT NULL,
+  `table_name` varchar(199) NOT NULL,
+  `last_update` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
+  `n_rows` bigint(20) unsigned NOT NULL,
+  `clustered_index_size` bigint(20) unsigned NOT NULL,
+  `sum_of_other_index_sizes` bigint(20) unsigned NOT NULL,
+  PRIMARY KEY (`database_name`,`table_name`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3 COLLATE=utf8mb3_bin STATS_PERSISTENT=0
+ALTER TABLE mysql.innodb_table_stats MODIFY last_update TYPE_MYSQL_TIMESTAMP;
+SHOW CREATE TABLE mysql.innodb_table_stats;
+Table	Create Table
+innodb_table_stats	CREATE TABLE `innodb_table_stats` (
+  `database_name` varchar(64) NOT NULL,
+  `table_name` varchar(199) NOT NULL,
+  `last_update` type_mysql_timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
+  `n_rows` bigint(20) unsigned NOT NULL,
+  `clustered_index_size` bigint(20) unsigned NOT NULL,
+  `sum_of_other_index_sizes` bigint(20) unsigned NOT NULL,
+  PRIMARY KEY (`database_name`,`table_name`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3 COLLATE=utf8mb3_bin STATS_PERSISTENT=0
+ALTER TABLE mysql.innodb_index_stats MODIFY last_update TYPE_MYSQL_TIMESTAMP;
+SHOW CREATE TABLE mysql.innodb_index_stats;
+Table	Create Table
+innodb_index_stats	CREATE TABLE `innodb_index_stats` (
+  `database_name` varchar(64) NOT NULL,
+  `table_name` varchar(199) NOT NULL,
+  `index_name` varchar(64) NOT NULL,
+  `last_update` type_mysql_timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
+  `stat_name` varchar(64) NOT NULL,
+  `stat_value` bigint(20) unsigned NOT NULL,
+  `sample_size` bigint(20) unsigned DEFAULT NULL,
+  `stat_description` varchar(1024) NOT NULL,
+  PRIMARY KEY (`database_name`,`table_name`,`index_name`,`stat_name`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3 COLLATE=utf8mb3_bin STATS_PERSISTENT=0
+SET @@global.innodb_stats_persistent=1;
+CREATE TABLE t1 (a INT, KEY(a)) ENGINE=InnoDB;
+INSERT INTO t1 VALUES (10);
+DROP TABLE t1;
+SET @@global.innodb_stats_persistent=0;
+ALTER TABLE mysql.innodb_table_stats MODIFY last_update TIMESTAMP;
+SHOW CREATE TABLE mysql.innodb_table_stats;
+Table	Create Table
+innodb_table_stats	CREATE TABLE `innodb_table_stats` (
+  `database_name` varchar(64) NOT NULL,
+  `table_name` varchar(199) NOT NULL,
+  `last_update` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
+  `n_rows` bigint(20) unsigned NOT NULL,
+  `clustered_index_size` bigint(20) unsigned NOT NULL,
+  `sum_of_other_index_sizes` bigint(20) unsigned NOT NULL,
+  PRIMARY KEY (`database_name`,`table_name`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3 COLLATE=utf8mb3_bin STATS_PERSISTENT=0
+ALTER TABLE mysql.innodb_index_stats MODIFY last_update TIMESTAMP;
+SHOW CREATE TABLE mysql.innodb_index_stats;
+Table	Create Table
+innodb_index_stats	CREATE TABLE `innodb_index_stats` (
+  `database_name` varchar(64) NOT NULL,
+  `table_name` varchar(199) NOT NULL,
+  `index_name` varchar(64) NOT NULL,
+  `last_update` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
+  `stat_name` varchar(64) NOT NULL,
+  `stat_value` bigint(20) unsigned NOT NULL,
+  `sample_size` bigint(20) unsigned DEFAULT NULL,
+  `stat_description` varchar(1024) NOT NULL,
+  PRIMARY KEY (`database_name`,`table_name`,`index_name`,`stat_name`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb3 COLLATE=utf8mb3_bin STATS_PERSISTENT=0
+SET @@global.innodb_stats_persistent=1;
diff --git a/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/type_mysql_timestamp_stat_tables.test b/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/type_mysql_timestamp_stat_tables.test
new file mode 100644
index 00000000000..d22c94c6f82
--- /dev/null
+++ b/plugin/type_mysql_timestamp/mysql-test/type_mysql_timestamp/type_mysql_timestamp_stat_tables.test
@@ -0,0 +1,24 @@
+--source include/have_innodb.inc
+
+--echo #
+--echo # MDEV-30483 After upgrade to 10.6 from Mysql 5.7 seeing "InnoDB: Column last_update in table mysql.innodb_table_stats is BINARY(4) NOT NULL but should be INT UNSIGNED NOT NULL"
+--echo #
+
+SET @@global.innodb_stats_persistent=0;
+SHOW CREATE TABLE mysql.innodb_table_stats;
+ALTER TABLE mysql.innodb_table_stats MODIFY last_update TYPE_MYSQL_TIMESTAMP;
+SHOW CREATE TABLE mysql.innodb_table_stats;
+ALTER TABLE mysql.innodb_index_stats MODIFY last_update TYPE_MYSQL_TIMESTAMP;
+SHOW CREATE TABLE mysql.innodb_index_stats;
+SET @@global.innodb_stats_persistent=1;
+
+CREATE TABLE t1 (a INT, KEY(a)) ENGINE=InnoDB;
+INSERT INTO t1 VALUES (10);
+DROP TABLE t1;
+
+SET @@global.innodb_stats_persistent=0;
+ALTER TABLE mysql.innodb_table_stats MODIFY last_update TIMESTAMP;
+SHOW CREATE TABLE mysql.innodb_table_stats;
+ALTER TABLE mysql.innodb_index_stats MODIFY last_update TIMESTAMP;
+SHOW CREATE TABLE mysql.innodb_index_stats;
+SET @@global.innodb_stats_persistent=1;
diff --git a/plugin/type_mysql_timestamp/plugin.cc b/plugin/type_mysql_timestamp/plugin.cc
new file mode 100644
index 00000000000..f361ab6c0eb
--- /dev/null
+++ b/plugin/type_mysql_timestamp/plugin.cc
@@ -0,0 +1,161 @@
+/*
+   Copyright (c) 2023, MariaDB Corporation
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 of the License.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA */
+
+#include <my_global.h>
+#include <sql_class.h>
+#include <mysql/plugin_data_type.h>
+#include "sql_type.h"
+
+
+class Type_collection_local: public Type_collection
+{
+protected:
+  const Type_handler *aggregate_common(const Type_handler *h1,
+                                       const Type_handler *h2) const
+  {
+    if (h1 == h2)
+      return h1;
+    return NULL;
+  }
+public:
+  const Type_handler *handler_by_name(const LEX_CSTRING &name) const override
+  {
+    return NULL;
+  }
+
+  const Type_handler *aggregate_for_result(const Type_handler *h1,
+                                           const Type_handler *h2)
+                                           const override
+  {
+    return aggregate_common(h1, h2);
+  }
+
+  const Type_handler *aggregate_for_comparison(const Type_handler *h1,
+                                               const Type_handler *h2)
+                                               const override
+  {
+    return aggregate_common(h1, h2);
+  }
+
+  const Type_handler *aggregate_for_min_max(const Type_handler *h1,
+                                            const Type_handler *h2)
+                                            const override
+  {
+    return aggregate_common(h1, h2);
+  }
+
+  const Type_handler *aggregate_for_num_op(const Type_handler *h1,
+                                           const Type_handler *h2)
+                                           const override
+  {
+    return aggregate_common(h1, h2);
+  }
+};
+
+
+static Type_collection_local type_collection_local;
+
+
+/*
+  A more MySQL compatible Field:
+  it does not set the UNSIGNED_FLAG.
+  This is how MySQL's Field_timestampf works.
+*/
+class Field_mysql_timestampf :public Field_timestampf
+{
+public:
+  Field_mysql_timestampf(const LEX_CSTRING &name,
+                         const Record_addr &addr,
+                         enum utype unireg_check_arg,
+                         TABLE_SHARE *share, decimal_digits_t dec_arg)
+   :Field_timestampf(addr.ptr(), addr.null_ptr(), addr.null_bit(),
+                     unireg_check_arg, &name, share, dec_arg)
+  {
+    flags&= ~UNSIGNED_FLAG; // MySQL compatibility
+  }
+  void sql_type(String &str) const override
+  {
+    sql_type_opt_dec_comment(str,
+                             Field_mysql_timestampf::type_handler()->name(),
+                             dec, type_version_mysql56());
+  }
+  const Type_handler *type_handler() const override;
+};
+
+
+class Type_handler_mysql_timestamp2: public Type_handler_timestamp2
+{
+public:
+  const Type_collection *type_collection() const override
+  {
+    return &type_collection_local;
+  }
+  Field *make_table_field_from_def(TABLE_SHARE *share, MEM_ROOT *root,
+                                   const LEX_CSTRING *name,
+                                   const Record_addr &rec, const Bit_addr &bit,
+                                   const Column_definition_attributes *attr,
+                                   uint32 flags) const override
+  {
+    return new (root)
+      Field_mysql_timestampf(*name, rec, attr->unireg_check, share,
+                             attr->temporal_dec(MAX_DATETIME_WIDTH));
+  }
+  void Column_definition_implicit_upgrade(Column_definition *c) const override
+  {
+    /*
+      Suppress the automatic upgrade depending on opt_mysql56_temporal_format,
+      derived from Type_handler_timestamp_common.
+    */
+  }
+};
+
+
+static Type_handler_mysql_timestamp2 type_handler_mysql_timestamp2;
+
+
+const Type_handler *Field_mysql_timestampf::type_handler() const
+{
+  return &type_handler_mysql_timestamp2;
+}
+
+
+static struct st_mariadb_data_type plugin_descriptor_type_mysql_timestamp=
+{
+  MariaDB_DATA_TYPE_INTERFACE_VERSION,
+  &type_handler_mysql_timestamp2
+};
+
+
+
+/*************************************************************************/
+
+maria_declare_plugin(type_mysql_timestamp)
+{
+  MariaDB_DATA_TYPE_PLUGIN,     // the plugin type (see include/mysql/plugin.h)
+  &plugin_descriptor_type_mysql_timestamp, // pointer to type-specific plugin descriptor
+  "type_mysql_timestamp",       // plugin name
+  "MariaDB Corporation",        // plugin author
+  "Data type TYPE_MYSQL_TIMESTAMP", // the plugin description
+  PLUGIN_LICENSE_GPL,           // the plugin license (see include/mysql/plugin.h)
+  0,                            // Pointer to plugin initialization function
+  0,                            // Pointer to plugin deinitialization function
+  0x0100,                       // Numeric version 0xAABB means AA.BB version
+  NULL,                         // Status variables
+  NULL,                         // System variables
+  "1.0",                        // String version representation
+  MariaDB_PLUGIN_MATURITY_EXPERIMENTAL // Maturity(see include/mysql/plugin.h)*/
+}
+maria_declare_plugin_end;
diff --git a/sql/field.h b/sql/field.h
index b146ded321d..fd7336afd2c 100644
--- a/sql/field.h
+++ b/sql/field.h
@@ -3336,7 +3336,7 @@ public:
 /**
   TIMESTAMP(0..6) - MySQL56 version
 */
-class Field_timestampf final :public Field_timestamp_with_dec {
+class Field_timestampf :public Field_timestamp_with_dec {
   void store_TIMEVAL(const timeval &tv) override;
 public:
   Field_timestampf(uchar *ptr_arg,
diff --git a/sql/sql_type.h b/sql/sql_type.h
index b082449639b..479f924a727 100644
--- a/sql/sql_type.h
+++ b/sql/sql_type.h
@@ -7593,8 +7593,9 @@ extern Named_type_handler<Type_handler_time>        type_handler_time;
 extern Named_type_handler<Type_handler_time2>       type_handler_time2;
 extern Named_type_handler<Type_handler_datetime>    type_handler_datetime;
 extern Named_type_handler<Type_handler_datetime2>   type_handler_datetime2;
-extern Named_type_handler<Type_handler_timestamp>   type_handler_timestamp;
-extern Named_type_handler<Type_handler_timestamp2>  type_handler_timestamp2;
+
+extern MYSQL_PLUGIN_IMPORT Named_type_handler<Type_handler_timestamp>   type_handler_timestamp;
+extern MYSQL_PLUGIN_IMPORT Named_type_handler<Type_handler_timestamp2>  type_handler_timestamp2;
 
 extern Type_handler_interval_DDhhmmssff type_handler_interval_DDhhmmssff;
 
diff --git a/storage/innobase/dict/dict0stats.cc b/storage/innobase/dict/dict0stats.cc
index 7bdccd899b8..b5291ccbd87 100644
--- a/storage/innobase/dict/dict0stats.cc
+++ b/storage/innobase/dict/dict0stats.cc
@@ -204,7 +204,17 @@ static const dict_table_schema_t table_stats_schema =
   {
     {"database_name", DATA_VARMYSQL, DATA_NOT_NULL, 192},
     {"table_name", DATA_VARMYSQL, DATA_NOT_NULL, 597},
-    {"last_update", DATA_INT, DATA_NOT_NULL | DATA_UNSIGNED, 4},
+    /*
+      Don't check the DATA_UNSIGNED flag in last_update.
+      It presents if the server is running in a pure MariaDB installation,
+      because MariaDB's Field_timestampf::flags has UNSIGNED_FLAG.
+      But DATA_UNSIGNED misses when the server starts on a MySQL-5.7 directory
+      (during a migration), because MySQL's Field_timestampf::flags does not
+      have UNSIGNED_FLAG.
+      This is fine not to check DATA_UNSIGNED, because Field_timestampf
+      in both MariaDB and MySQL support only non-negative time_t values.
+    */
+    {"last_update", DATA_INT, DATA_NOT_NULL, 4},
     {"n_rows", DATA_INT, DATA_NOT_NULL | DATA_UNSIGNED, 8},
     {"clustered_index_size", DATA_INT, DATA_NOT_NULL | DATA_UNSIGNED, 8},
     {"sum_of_other_index_sizes", DATA_INT, DATA_NOT_NULL | DATA_UNSIGNED, 8},
@@ -218,7 +228,11 @@ static const dict_table_schema_t index_stats_schema =
     {"database_name", DATA_VARMYSQL, DATA_NOT_NULL, 192},
     {"table_name", DATA_VARMYSQL, DATA_NOT_NULL, 597},
     {"index_name", DATA_VARMYSQL, DATA_NOT_NULL, 192},
-    {"last_update", DATA_INT, DATA_NOT_NULL | DATA_UNSIGNED, 4},
+    /*
+      Don't check the DATA_UNSIGNED flag in last_update.
+      See comments about last_update in table_stats_schema above.
+    */
+    {"last_update", DATA_INT, DATA_NOT_NULL, 4},
     {"stat_name", DATA_VARMYSQL, DATA_NOT_NULL, 64*3},
     {"stat_value", DATA_INT, DATA_NOT_NULL | DATA_UNSIGNED, 8},
     {"sample_size", DATA_INT, DATA_UNSIGNED, 8},