Merge branch '5.5' into 10.0bb-10.0-merge-sanja

11 files changed, 99 insertions, 16 deletions

diff --git a/mysql-test/mysql-test-run.pl b/mysql-test/mysql-test-run.pl
index f6d8cda592d..63801357dd5 100755
--- a/mysql-test/mysql-test-run.pl
+++ b/mysql-test/mysql-test-run.pl
@@ -1463,7 +1463,7 @@ sub command_line_setup {
 
     foreach my $fs (@tmpfs_locations)
     {
-      if ( -d $fs && ! -l $fs )
+      if ( -d $fs && ! -l $fs  && -w $fs )
       {
 	my $template= "var_${opt_build_thread}_XXXX";
 	$opt_mem= tempdir( $template, DIR => $fs, CLEANUP => 0);
diff --git a/mysql-test/r/join.result b/mysql-test/r/join.result
index d065403371d..35713443ee7 100644
--- a/mysql-test/r/join.result
+++ b/mysql-test/r/join.result
@@ -1516,11 +1516,13 @@ ERROR 42S22: Unknown column 'f' in 'from clause'
 DROP TABLE t;
 CREATE TABLE t (f INT);
 CALL p;
-ERROR 42S22: Unknown column 'f' in 'from clause'
+f
 DROP TABLE t;
 CREATE TABLE t (i INT);
 CALL p;
-ERROR 42S22: Unknown column 'f' in 'from clause'
+ERROR 42S22: Unknown column 't1.f' in 'field list'
+CALL p;
+ERROR 42S22: Unknown column 't1.f' in 'field list'
 DROP PROCEDURE p;
 DROP TABLE t;
 CREATE TABLE t1 (a INT, b INT);
diff --git a/mysql-test/r/sp.result b/mysql-test/r/sp.result
index 2cb1b701e2d..058ef69c548 100644
--- a/mysql-test/r/sp.result
+++ b/mysql-test/r/sp.result
@@ -7898,6 +7898,23 @@ SET S.CLOSE_YN = ''
 where 1=1;
 drop function if exists f1;
 drop table t1,t2;
+#
+# MDEV-16957: Server crashes in Field_iterator_natural_join::next
+# upon 2nd execution of SP
+#
+CREATE TABLE t1 (a INT, b VARCHAR(32));
+CREATE PROCEDURE sp() SELECT * FROM t1 AS t1x JOIN t1 AS t1y USING (c);
+CALL sp;
+ERROR 42S22: Unknown column 'c' in 'from clause'
+CALL sp;
+ERROR 42S22: Unknown column 'c' in 'from clause'
+CALL sp;
+ERROR 42S22: Unknown column 'c' in 'from clause'
+alter table t1 add column c int;
+CALL sp;
+c	a	b	a	b
+DROP PROCEDURE sp;
+DROP TABLE t1;
 # End of 5.5 test
 #
 #  MDEV-7040: Crash in field_conv, memcpy_field_possible, part#2
diff --git a/mysql-test/suite/maria/maria.result b/mysql-test/suite/maria/maria.result
index 2618327c716..9c8565d0f03 100644
--- a/mysql-test/suite/maria/maria.result
+++ b/mysql-test/suite/maria/maria.result
@@ -2732,6 +2732,10 @@ id	name
 -1	dog
 2	cat
 DROP TABLE t1;
+CREATE TABLE t1 (pk int, i2 int) ENGINE=Aria;
+INSERT INTO t1 VALUES (1,2), (2,3),(3,4);
+DELETE FROM tt.*, t1.* USING t1 AS tt LEFT JOIN t1 ON (tt.i2 = t1.pk);
+DROP TABLE t1;
 #
 # End of 5.5 tests
 #
diff --git a/mysql-test/suite/maria/maria.test b/mysql-test/suite/maria/maria.test
index 6c080e484ce..9616933e363 100644
--- a/mysql-test/suite/maria/maria.test
+++ b/mysql-test/suite/maria/maria.test
@@ -2002,6 +2002,16 @@ INSERT INTO t1 (name) VALUES ('cat');
 SELECT * FROM t1;
 DROP TABLE t1;
 
+#
+# MDEV-16682
+# Assertion `(buff[7] & 7) == HEAD_PAGE' failed.
+#
+
+CREATE TABLE t1 (pk int, i2 int) ENGINE=Aria;
+INSERT INTO t1 VALUES (1,2), (2,3),(3,4);
+DELETE FROM tt.*, t1.* USING t1 AS tt LEFT JOIN t1 ON (tt.i2 = t1.pk);
+DROP TABLE t1;
+
 --echo #
 --echo # End of 5.5 tests
 --echo #
diff --git a/mysql-test/t/join.test b/mysql-test/t/join.test
index 8a088de91cc..3d2a02e2346 100644
--- a/mysql-test/t/join.test
+++ b/mysql-test/t/join.test
@@ -1185,12 +1185,13 @@ CREATE TABLE t (f INT);
 #
 # The following shouldn't fail as the table is now matching the using
 #
---error ER_BAD_FIELD_ERROR
 CALL p;
 DROP TABLE t;
 CREATE TABLE t (i INT);
 --error ER_BAD_FIELD_ERROR
 CALL p;
+--error ER_BAD_FIELD_ERROR
+CALL p;
 DROP PROCEDURE p;
 DROP TABLE t;
 
diff --git a/mysql-test/t/sp.test b/mysql-test/t/sp.test
index c5d37d1017d..1b765f0eb2d 100644
--- a/mysql-test/t/sp.test
+++ b/mysql-test/t/sp.test
@@ -9353,6 +9353,27 @@ where 1=1;
 drop function if exists f1;
 drop table t1,t2;
 
+--echo #
+--echo # MDEV-16957: Server crashes in Field_iterator_natural_join::next
+--echo # upon 2nd execution of SP
+--echo #
+
+CREATE TABLE t1 (a INT, b VARCHAR(32));
+CREATE PROCEDURE sp() SELECT * FROM t1 AS t1x JOIN t1 AS t1y USING (c);
+--error ER_BAD_FIELD_ERROR
+CALL sp;
+--error ER_BAD_FIELD_ERROR
+CALL sp;
+--error ER_BAD_FIELD_ERROR
+CALL sp;
+alter table t1 add column c int;
+CALL sp;
+
+# Cleanup
+DROP PROCEDURE sp;
+DROP TABLE t1;
+
+
 --echo # End of 5.5 test
 
 --echo #
diff --git a/sql/item.cc b/sql/item.cc
index fca8a887f46..7f1ec42b029 100644
--- a/sql/item.cc
+++ b/sql/item.cc
@@ -8707,13 +8707,11 @@ void Item_trigger_field::cleanup()
 
 Item_result item_cmp_type(Item_result a,Item_result b)
 {
-  if (a == STRING_RESULT && b == STRING_RESULT)
-    return STRING_RESULT;
-  if (a == INT_RESULT && b == INT_RESULT)
-    return INT_RESULT;
-  else if (a == ROW_RESULT || b == ROW_RESULT)
+  if (a == b)
+    return a;
+  if (a == ROW_RESULT || b == ROW_RESULT)
     return ROW_RESULT;
-  else if (a == TIME_RESULT || b == TIME_RESULT)
+  if (a == TIME_RESULT || b == TIME_RESULT)
     return TIME_RESULT;
   if ((a == INT_RESULT || a == DECIMAL_RESULT) &&
       (b == INT_RESULT || b == DECIMAL_RESULT))
diff --git a/sql/sql_base.cc b/sql/sql_base.cc
index 1ed57a051d8..96a58b9e1b2 100644
--- a/sql/sql_base.cc
+++ b/sql/sql_base.cc
@@ -7465,10 +7465,22 @@ store_natural_using_join_columns(THD *thd, TABLE_LIST *natural_using_join,
 
   result= FALSE;
 
-err:
   if (arena)
     thd->restore_active_arena(arena, &backup);
   DBUG_RETURN(result);
+
+err:
+  /*
+     Actually we failed to build join columns list, so we have to
+     clear it to avoid problems with half-build join on next run.
+     The list was created in mark_common_columns().
+   */
+  table_ref_1->remove_join_columns();
+  table_ref_2->remove_join_columns();
+
+  if (arena)
+    thd->restore_active_arena(arena, &backup);
+  DBUG_RETURN(TRUE);
 }
 
 
diff --git a/sql/table.h b/sql/table.h
index 73c40992751..05596b605a5 100644
--- a/sql/table.h
+++ b/sql/table.h
@@ -2283,6 +2283,16 @@ struct TABLE_LIST
   } 
   void set_lock_type(THD* thd, enum thr_lock_type lock);
 
+  void remove_join_columns()
+  {
+    if (join_columns)
+    {
+      join_columns->empty();
+      join_columns= NULL;
+      is_join_columns_complete= FALSE;
+    }
+  }
+
 private:
   bool prep_check_option(THD *thd, uint8 check_opt_type);
   bool prep_where(THD *thd, Item **conds, bool no_where_clause);
diff --git a/storage/maria/ma_blockrec.c b/storage/maria/ma_blockrec.c
index ac46ac95101..367c8da26c0 100644
--- a/storage/maria/ma_blockrec.c
+++ b/storage/maria/ma_blockrec.c
@@ -53,10 +53,10 @@
   Page header:
 
   LSN            7 bytes   Log position for last page change
-  PAGE_TYPE      1 uchar   1 for head / 2 for tail / 3 for blob
+  PAGE_TYPE      1 uchar   0 unalloced / 1 for head / 2 for tail / 3 for blob
   DIR_COUNT      1 uchar   Number of row/tail entries on page
   FREE_DIR_LINK  1 uchar   Pointer to first free director entry or 255 if no
-  empty space    2 bytes  Empty space on page
+  empty space    2 bytes   Bytes of empty space on page
 
   The most significant bit in PAGE_TYPE is set to 1 if the data on the page
   can be compacted to get more space. (PAGE_CAN_BE_COMPACTED)
@@ -5123,11 +5123,19 @@ int _ma_read_block_record(MARIA_HA *info, uchar *record,
                              info->buff, share->page_type,
                              PAGECACHE_LOCK_LEFT_UNLOCKED, 0)))
     DBUG_RETURN(my_errno);
-  DBUG_ASSERT((buff[PAGE_TYPE_OFFSET] & PAGE_TYPE_MASK) == HEAD_PAGE);
-  if (!(data= get_record_position(buff, block_size, offset, &end_of_data)))
+
+ /*
+   Unallocated page access can happen if this is an access to a page where
+   all rows where deleted as part of this statement.
+ */
+ DBUG_ASSERT((buff[PAGE_TYPE_OFFSET] & PAGE_TYPE_MASK) == HEAD_PAGE ||
+             (buff[PAGE_TYPE_OFFSET] & PAGE_TYPE_MASK) == UNALLOCATED_PAGE);
+
+ if (((buff[PAGE_TYPE_OFFSET] & PAGE_TYPE_MASK) == UNALLOCATED_PAGE) ||
+     !(data= get_record_position(buff, block_size, offset, &end_of_data)))
   {
     DBUG_ASSERT(!maria_assert_if_crashed_table);
-    DBUG_PRINT("error", ("Wrong directory entry in data block"));
+    DBUG_PRINT("warning", ("Wrong directory entry in data block"));
     my_errno= HA_ERR_RECORD_DELETED;           /* File crashed */
     DBUG_RETURN(HA_ERR_RECORD_DELETED);
   }