Merge branch '5.5' into 10.0

mysql-test/mysql-test-run.pl

@@ -1463,7 +1463,7 @@ sub command_line_setup {
 
     foreach my $fs (@tmpfs_locations)
     {
-      if ( -d $fs && ! -l $fs )
+      if ( -d $fs && ! -l $fs  && -w $fs )
       {
 	my $template= "var_${opt_build_thread}_XXXX";
 	$opt_mem= tempdir( $template, DIR => $fs, CLEANUP => 0);

mysql-test/r/join.result

@@ -1516,11 +1516,13 @@ ERROR 42S22: Unknown column 'f' in 'from clause'
 DROP TABLE t;
 CREATE TABLE t (f INT);
 CALL p;
-ERROR 42S22: Unknown column 'f' in 'from clause'
+f
 DROP TABLE t;
 CREATE TABLE t (i INT);
 CALL p;
-ERROR 42S22: Unknown column 'f' in 'from clause'
+ERROR 42S22: Unknown column 't1.f' in 'field list'
+CALL p;
+ERROR 42S22: Unknown column 't1.f' in 'field list'
 DROP PROCEDURE p;
 DROP TABLE t;
 CREATE TABLE t1 (a INT, b INT);

mysql-test/r/sp.result

@@ -7898,6 +7898,23 @@ SET S.CLOSE_YN = ''
 where 1=1;
 drop function if exists f1;
 drop table t1,t2;
+#
+# MDEV-16957: Server crashes in Field_iterator_natural_join::next
+# upon 2nd execution of SP
+#
+CREATE TABLE t1 (a INT, b VARCHAR(32));
+CREATE PROCEDURE sp() SELECT * FROM t1 AS t1x JOIN t1 AS t1y USING (c);
+CALL sp;
+ERROR 42S22: Unknown column 'c' in 'from clause'
+CALL sp;
+ERROR 42S22: Unknown column 'c' in 'from clause'
+CALL sp;
+ERROR 42S22: Unknown column 'c' in 'from clause'
+alter table t1 add column c int;
+CALL sp;
+c	a	b	a	b
+DROP PROCEDURE sp;
+DROP TABLE t1;
 # End of 5.5 test
 #
 #  MDEV-7040: Crash in field_conv, memcpy_field_possible, part#2

mysql-test/suite/maria/maria.result

@@ -2732,6 +2732,10 @@ id	name
 -1	dog
 2	cat
 DROP TABLE t1;
+CREATE TABLE t1 (pk int, i2 int) ENGINE=Aria;
+INSERT INTO t1 VALUES (1,2), (2,3),(3,4);
+DELETE FROM tt.*, t1.* USING t1 AS tt LEFT JOIN t1 ON (tt.i2 = t1.pk);
+DROP TABLE t1;
 #
 # End of 5.5 tests
 #

mysql-test/suite/maria/maria.test

@@ -2002,6 +2002,16 @@ INSERT INTO t1 (name) VALUES ('cat');
 SELECT * FROM t1;
 DROP TABLE t1;
 
+#
+# MDEV-16682
+# Assertion `(buff[7] & 7) == HEAD_PAGE' failed.
+#
+
+CREATE TABLE t1 (pk int, i2 int) ENGINE=Aria;
+INSERT INTO t1 VALUES (1,2), (2,3),(3,4);
+DELETE FROM tt.*, t1.* USING t1 AS tt LEFT JOIN t1 ON (tt.i2 = t1.pk);
+DROP TABLE t1;
+
 --echo #
 --echo # End of 5.5 tests
 --echo #

mysql-test/t/join.test

@@ -1185,12 +1185,13 @@ CREATE TABLE t (f INT);
 #
 # The following shouldn't fail as the table is now matching the using
 #
---error ER_BAD_FIELD_ERROR
 CALL p;
 DROP TABLE t;
 CREATE TABLE t (i INT);
 --error ER_BAD_FIELD_ERROR
 CALL p;
+--error ER_BAD_FIELD_ERROR
+CALL p;
 DROP PROCEDURE p;
 DROP TABLE t;
 

mysql-test/t/sp.test

@@ -9353,6 +9353,27 @@ where 1=1;
 drop function if exists f1;
 drop table t1,t2;
 
+--echo #
+--echo # MDEV-16957: Server crashes in Field_iterator_natural_join::next
+--echo # upon 2nd execution of SP
+--echo #
+
+CREATE TABLE t1 (a INT, b VARCHAR(32));
+CREATE PROCEDURE sp() SELECT * FROM t1 AS t1x JOIN t1 AS t1y USING (c);
+--error ER_BAD_FIELD_ERROR
+CALL sp;
+--error ER_BAD_FIELD_ERROR
+CALL sp;
+--error ER_BAD_FIELD_ERROR
+CALL sp;
+alter table t1 add column c int;
+CALL sp;
+
+# Cleanup
+DROP PROCEDURE sp;
+DROP TABLE t1;
+
+
 --echo # End of 5.5 test
 
 --echo #

sql/item.cc

@@ -8707,13 +8707,11 @@ void Item_trigger_field::cleanup()
 
 Item_result item_cmp_type(Item_result a,Item_result b)
 {
-  if (a == STRING_RESULT && b == STRING_RESULT)
+  if (a == b)
-    return STRING_RESULT;
+    return a;
-  if (a == INT_RESULT && b == INT_RESULT)
+  if (a == ROW_RESULT || b == ROW_RESULT)
-    return INT_RESULT;
-  else if (a == ROW_RESULT || b == ROW_RESULT)
     return ROW_RESULT;
-  else if (a == TIME_RESULT || b == TIME_RESULT)
+  if (a == TIME_RESULT || b == TIME_RESULT)
     return TIME_RESULT;
   if ((a == INT_RESULT || a == DECIMAL_RESULT) &&
       (b == INT_RESULT || b == DECIMAL_RESULT))

sql/sql_base.cc

@@ -7465,10 +7465,22 @@ store_natural_using_join_columns(THD *thd, TABLE_LIST *natural_using_join,
 
   result= FALSE;
 
-err:
   if (arena)
     thd->restore_active_arena(arena, &backup);
   DBUG_RETURN(result);
+
+err:
+  /*
+     Actually we failed to build join columns list, so we have to
+     clear it to avoid problems with half-build join on next run.
+     The list was created in mark_common_columns().
+   */
+  table_ref_1->remove_join_columns();
+  table_ref_2->remove_join_columns();
+
+  if (arena)
+    thd->restore_active_arena(arena, &backup);
+  DBUG_RETURN(TRUE);
 }
 
 

sql/table.h

@@ -2283,6 +2283,16 @@ struct TABLE_LIST
   } 
   void set_lock_type(THD* thd, enum thr_lock_type lock);
 
+  void remove_join_columns()
+  {
+    if (join_columns)
+    {
+      join_columns->empty();
+      join_columns= NULL;
+      is_join_columns_complete= FALSE;
+    }
+  }
+
 private:
   bool prep_check_option(THD *thd, uint8 check_opt_type);
   bool prep_where(THD *thd, Item **conds, bool no_where_clause);

storage/maria/ma_blockrec.c

@@ -53,10 +53,10 @@
   Page header:
 
   LSN            7 bytes   Log position for last page change
-  PAGE_TYPE      1 uchar   1 for head / 2 for tail / 3 for blob
+  PAGE_TYPE      1 uchar   0 unalloced / 1 for head / 2 for tail / 3 for blob
   DIR_COUNT      1 uchar   Number of row/tail entries on page
   FREE_DIR_LINK  1 uchar   Pointer to first free director entry or 255 if no
-  empty space    2 bytes  Empty space on page
+  empty space    2 bytes   Bytes of empty space on page
 
   The most significant bit in PAGE_TYPE is set to 1 if the data on the page
   can be compacted to get more space. (PAGE_CAN_BE_COMPACTED)
@@ -5123,11 +5123,19 @@ int _ma_read_block_record(MARIA_HA *info, uchar *record,
                              info->buff, share->page_type,
                              PAGECACHE_LOCK_LEFT_UNLOCKED, 0)))
     DBUG_RETURN(my_errno);
-  DBUG_ASSERT((buff[PAGE_TYPE_OFFSET] & PAGE_TYPE_MASK) == HEAD_PAGE);
+
-  if (!(data= get_record_position(buff, block_size, offset, &end_of_data)))
+ /*
+   Unallocated page access can happen if this is an access to a page where
+   all rows where deleted as part of this statement.
+ */
+ DBUG_ASSERT((buff[PAGE_TYPE_OFFSET] & PAGE_TYPE_MASK) == HEAD_PAGE ||
+             (buff[PAGE_TYPE_OFFSET] & PAGE_TYPE_MASK) == UNALLOCATED_PAGE);
+
+ if (((buff[PAGE_TYPE_OFFSET] & PAGE_TYPE_MASK) == UNALLOCATED_PAGE) ||
+     !(data= get_record_position(buff, block_size, offset, &end_of_data)))
   {
     DBUG_ASSERT(!maria_assert_if_crashed_table);
-    DBUG_PRINT("error", ("Wrong directory entry in data block"));
+    DBUG_PRINT("warning", ("Wrong directory entry in data block"));
     my_errno= HA_ERR_RECORD_DELETED;           /* File crashed */
     DBUG_RETURN(HA_ERR_RECORD_DELETED);
   }