merge from 5.1 main

21 files changed, 277 insertions, 36 deletions

diff --git a/mysql-test/include/restart_slave_sql.inc b/mysql-test/include/restart_slave_sql.inc
new file mode 100644
index 00000000000..ee6c6d7ced6
--- /dev/null
+++ b/mysql-test/include/restart_slave_sql.inc
@@ -0,0 +1,43 @@
+# ==== Purpose ====
+#
+# Provide a earier way to restart SQL thread when you want to stop sql thread
+# and then start it immediately.
+#
+# Sources stop_slave_sql.inc to stop SQL thread on the current connection.
+# Then issues START SLAVE SQL_THREAD and then waits until
+# the SQL threads have started, or until a timeout is reached.
+#
+# Please use this instead of 'STOP|START SLAVE SQL_THREAD', to reduce the risk of
+# test case bugs.
+#
+#
+# ==== Usage ====
+#
+# [--let $slave_timeout= NUMBER]
+# [--let $rpl_debug= 1]
+# --source include/restart_slave_sql.inc
+#
+# Parameters:
+#   $slave_timeout
+#     See include/wait_for_slave_param.inc
+#
+#   $rpl_debug
+#     See include/rpl_init.inc
+
+
+--let $include_filename= restart_slave.inc
+--source include/begin_include_file.inc
+
+
+if (!$rpl_debug)
+{
+  --disable_query_log
+}
+
+source include/stop_slave_sql.inc;
+START SLAVE SQL_THREAD;
+source include/wait_for_slave_sql_to_start.inc;
+
+
+--let $include_filename= restart_slave.inc
+--source include/end_include_file.inc
\ No newline at end of file
diff --git a/mysql-test/include/rpl_connection_master.inc b/mysql-test/include/rpl_connection_master.inc
new file mode 100644
index 00000000000..e54e34071c8
--- /dev/null
+++ b/mysql-test/include/rpl_connection_master.inc
@@ -0,0 +1,2 @@
+let $rpl_connection_name= master;
+source include/rpl_connection.inc;
\ No newline at end of file
diff --git a/mysql-test/include/rpl_connection_slave.inc b/mysql-test/include/rpl_connection_slave.inc
new file mode 100644
index 00000000000..ef3876394d6
--- /dev/null
+++ b/mysql-test/include/rpl_connection_slave.inc
@@ -0,0 +1,2 @@
+let $rpl_connection_name= slave;
+source include/rpl_connection.inc;
\ No newline at end of file
diff --git a/mysql-test/include/rpl_connection_slave1.inc b/mysql-test/include/rpl_connection_slave1.inc
new file mode 100644
index 00000000000..8aee6defbdd
--- /dev/null
+++ b/mysql-test/include/rpl_connection_slave1.inc
@@ -0,0 +1,2 @@
+let $rpl_connection_name= slave1;
+source include/rpl_connection.inc;
\ No newline at end of file
diff --git a/mysql-test/r/ctype_many.result b/mysql-test/r/ctype_many.result
index 89e05bf4484..dbec746cdae 100644
--- a/mysql-test/r/ctype_many.result
+++ b/mysql-test/r/ctype_many.result
@@ -1683,3 +1683,18 @@ ARMENIAN CAPIT DA	2
 ARMENIAN CAPIT ECH	2
 ARMENIAN CAPIT ZA	2
 DROP TABLE t1;
+#
+# Start of 5.1 tests
+#
+#
+# Bug#58371 Assertion failed: !s.uses_buffer_owned_by(this) with format string function
+#
+SET NAMES latin1;
+DO CONVERT(CAST(SUBSTRING_INDEX(FORMAT(1,'1111'), FORMAT('','Zpq'),1) 
+AS BINARY(0)) USING utf8);
+Warnings:
+Warning	1292	Truncated incorrect INTEGER value: 'Zpq'
+Warning	1292	Truncated incorrect BINARY(0) value: '1.'
+#
+# End of 5.1 tests
+#
diff --git a/mysql-test/r/func_like.result b/mysql-test/r/func_like.result
index 21da211160b..76174982e8e 100644
--- a/mysql-test/r/func_like.result
+++ b/mysql-test/r/func_like.result
@@ -182,4 +182,9 @@ INSERT INTO t2 VALUES (1), (2), (3);
 SELECT 1 FROM t2 JOIN t1 ON 1 LIKE a GROUP BY a;
 1
 DROP TABLE t1, t2;
+#
+# Bug#59149 valgrind warnings with "like .. escape .." function
+#
+SELECT '' LIKE '1' ESCAPE COUNT(1);
+ERROR HY000: Incorrect arguments to ESCAPE
 End of 5.1 tests
diff --git a/mysql-test/r/xml.result b/mysql-test/r/xml.result
index 92f84381415..0a71a596505 100644
--- a/mysql-test/r/xml.result
+++ b/mysql-test/r/xml.result
@@ -1113,4 +1113,15 @@ SELECT UPDATEXML(NULL, (LPAD(0.1111E-15, '2011', 1)), 1);
 ERROR 22007: Illegal double '111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111' value found during parsing
 SELECT EXTRACTVALUE('', LPAD(0.1111E-15, '2011', 1));
 ERROR 22007: Illegal double '111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111' value found during parsing
+#
+# Bug #44332 	my_xml_scan reads behind the end of buffer
+#
+SELECT UPDATEXML(CONVERT(_latin1'<' USING utf8),'1','1');
+UPDATEXML(CONVERT(_latin1'<' USING utf8),'1','1')
+NULL
+Warnings:
+Warning	1525	Incorrect XML value: 'parse error at line 1 pos 2: END-OF-INPUT unexpected (ident or '/' wanted)'
+SELECT UPDATEXML(CONVERT(_latin1'<!--' USING utf8),'1','1');
+UPDATEXML(CONVERT(_latin1'<!--' USING utf8),'1','1')
+NULL
 End of 5.1 tests
diff --git a/mysql-test/suite/rpl/r/rpl_stop_slave.result b/mysql-test/suite/rpl/r/rpl_stop_slave.result
index 2e9522e8947..ff0061f264b 100644
--- a/mysql-test/suite/rpl/r/rpl_stop_slave.result
+++ b/mysql-test/suite/rpl/r/rpl_stop_slave.result
@@ -128,5 +128,47 @@ START SLAVE SQL_THREAD;
 include/wait_for_slave_sql_to_start.inc
 # Test end
 SET GLOBAL debug= '$debug_save';
+include/restart_slave.inc
+[connection master]
+DROP TABLE t1, t2;
+
+# Bug#58546 test rpl_packet timeout failure sporadically on PB
+# ----------------------------------------------------------------------
+# STOP SLAVE stopped IO thread first and then stopped SQL thread. It was
+# possible that IO thread stopped after replicating part of a transaction
+# which SQL thread was executing. SQL thread would be hung if the
+# transaction could not be rolled back safely.
+# It caused some sporadic failures on PB2.
+#
+# This test verifies that when 'STOP SLAVE' is issued by a user, IO
+# thread will continue to fetch the rest events of the transaction which
+# is being executed by SQL thread and is not able to be rolled back safely.
+CREATE TABLE t1 (c1 INT KEY, c2 INT) ENGINE=InnoDB;
+CREATE TABLE t2 (c1 INT) ENGINE=MyISAM;
+INSERT INTO t1 VALUES(1, 1);
+SET GLOBAL debug= 'd,dump_thread_wait_before_send_xid';
+[connection slave]
+include/restart_slave.inc
+BEGIN;
+UPDATE t1 SET c2 = 2 WHERE c1 = 1;
+[connection master]
+BEGIN;
+INSERT INTO t1 VALUES(2, 2);
+INSERT INTO t2 VALUES(1);
+UPDATE t1 SET c2 = 3 WHERE c1 = 1;
+COMMIT;
+[connection slave1]
+STOP SLAVE;
+[connection slave]
+ROLLBACK;
+[connection master]
+SET DEBUG_SYNC= 'now SIGNAL signal.continue';
+SET DEBUG_SYNC= 'RESET';
+[connection slave]
+include/wait_for_slave_to_stop.inc
+[connection slave1]
+include/start_slave.inc
+[connection master]
 DROP TABLE t1, t2;
+SET GLOBAL debug= $debug_save;
 include/rpl_end.inc
diff --git a/mysql-test/suite/rpl/t/rpl_packet.test b/mysql-test/suite/rpl/t/rpl_packet.test
index b11bd0a227e..3197b6160cd 100644
--- a/mysql-test/suite/rpl/t/rpl_packet.test
+++ b/mysql-test/suite/rpl/t/rpl_packet.test
@@ -26,8 +26,8 @@ let $old_net_buffer_length= `SELECT @@global.net_buffer_length`;
 SET @@global.max_allowed_packet=1024;
 SET @@global.net_buffer_length=1024;
 
+sync_slave_with_master;
 # Restart slave for setting to take effect
-connection slave;
 source include/stop_slave.inc;
 source include/start_slave.inc;
 
diff --git a/mysql-test/suite/rpl/t/rpl_stop_slave.test b/mysql-test/suite/rpl/t/rpl_stop_slave.test
index e7c67448dbe..e44b2f15f25 100644
--- a/mysql-test/suite/rpl/t/rpl_stop_slave.test
+++ b/mysql-test/suite/rpl/t/rpl_stop_slave.test
@@ -54,7 +54,69 @@ source extra/rpl_tests/rpl_stop_slave.test;
 
 --echo # Test end
 SET GLOBAL debug= '$debug_save';
+source include/restart_slave_sql.inc;
 
-connection master;
+--source include/rpl_connection_master.inc
 DROP TABLE t1, t2;
+
+--echo
+--echo # Bug#58546 test rpl_packet timeout failure sporadically on PB
+--echo # ----------------------------------------------------------------------
+--echo # STOP SLAVE stopped IO thread first and then stopped SQL thread. It was
+--echo # possible that IO thread stopped after replicating part of a transaction
+--echo # which SQL thread was executing. SQL thread would be hung if the
+--echo # transaction could not be rolled back safely.
+--echo # It caused some sporadic failures on PB2.
+--echo #
+--echo # This test verifies that when 'STOP SLAVE' is issued by a user, IO
+--echo # thread will continue to fetch the rest events of the transaction which
+--echo # is being executed by SQL thread and is not able to be rolled back safely.
+
+CREATE TABLE t1 (c1 INT KEY, c2 INT) ENGINE=InnoDB;
+CREATE TABLE t2 (c1 INT) ENGINE=MyISAM;
+INSERT INTO t1 VALUES(1, 1);
+
+let $debug_save= `SELECT @@GLOBAL.debug`;
+SET GLOBAL debug= 'd,dump_thread_wait_before_send_xid';
+
+sync_slave_with_master;
+
+--source include/rpl_connection_slave.inc
+source include/restart_slave_sql.inc;
+
+BEGIN;
+UPDATE t1 SET c2 = 2 WHERE c1 = 1;
+
+--source include/rpl_connection_master.inc
+BEGIN;
+INSERT INTO t1 VALUES(2, 2);
+INSERT INTO t2 VALUES(1);
+UPDATE t1 SET c2 = 3 WHERE c1 = 1;
+COMMIT;
+
+--source include/rpl_connection_slave1.inc
+let $show_statement= SHOW PROCESSLIST;
+let $field= Info;
+let $condition= = 'UPDATE t1 SET c2 = 3 WHERE c1 = 1';
+source include/wait_show_condition.inc;
+
+send STOP SLAVE;
+
+--source include/rpl_connection_slave.inc
+ROLLBACK;
+
+--source include/rpl_connection_master.inc
+SET DEBUG_SYNC= 'now SIGNAL signal.continue';
+SET DEBUG_SYNC= 'RESET';
+
+--source include/rpl_connection_slave.inc
+source include/wait_for_slave_to_stop.inc;
+
+--source include/rpl_connection_slave1.inc
+reap;
+source include/start_slave.inc;
+
+--source include/rpl_connection_master.inc
+DROP TABLE t1, t2;
+SET GLOBAL debug= $debug_save;
 --source include/rpl_end.inc
diff --git a/mysql-test/suite/sys_vars/r/innodb_max_dirty_pages_pct_func.result b/mysql-test/suite/sys_vars/r/innodb_max_dirty_pages_pct_func.result
index baf06092126..55de5adbc33 100644
--- a/mysql-test/suite/sys_vars/r/innodb_max_dirty_pages_pct_func.result
+++ b/mysql-test/suite/sys_vars/r/innodb_max_dirty_pages_pct_func.result
@@ -64,12 +64,12 @@ SET last = pct;
 END IF;
 END WHILE;
 END//
-CREATE PROCEDURE check_pct(IN num DECIMAL)
+CREATE PROCEDURE check_pct(IN success_on_wait BOOLEAN)
 BEGIN
-IF (dirty_pct() < num) THEN
+IF (success_on_wait > 0) THEN
 SELECT 'BELOW_MAX' AS PCT_VALUE;
 ELSE
-SELECT 'ABOVE_MAX' AS PCT_VALUE;
+SELECT 'ABOVE_MAX or TimeOut Of The Test' AS PCT_VALUE;
 END IF;
 END//
 CREATE TABLE t1(
@@ -83,7 +83,7 @@ CALL add_until(10);
 FLUSH TABLES;
 CALL add_records(500);
 'We expect dirty pages pct to be BELOW_MAX after some time depending on performance'
-CALL check_pct(10);
+CALL check_pct(1);
 PCT_VALUE
 BELOW_MAX
 DROP PROCEDURE add_records;
diff --git a/mysql-test/suite/sys_vars/t/innodb_max_dirty_pages_pct_func.test b/mysql-test/suite/sys_vars/t/innodb_max_dirty_pages_pct_func.test
index b577ae5fcc4..c7a9e567e69 100644
--- a/mysql-test/suite/sys_vars/t/innodb_max_dirty_pages_pct_func.test
+++ b/mysql-test/suite/sys_vars/t/innodb_max_dirty_pages_pct_func.test
@@ -117,12 +117,12 @@ BEGIN
    END WHILE;
 END//
 
-CREATE PROCEDURE check_pct(IN num DECIMAL)
+CREATE PROCEDURE check_pct(IN success_on_wait BOOLEAN)
 BEGIN
-   IF (dirty_pct() < num) THEN
+   IF (success_on_wait > 0) THEN
       SELECT 'BELOW_MAX' AS PCT_VALUE;
    ELSE
-      SELECT 'ABOVE_MAX' AS PCT_VALUE;
+      SELECT 'ABOVE_MAX or TimeOut Of The Test' AS PCT_VALUE;
    END IF;
 END//
 
@@ -155,7 +155,8 @@ let $wait_condition= SELECT (dirty_pct() <= @@global.innodb_max_dirty_pages_pct)
 --source include/wait_condition.inc
 
 --echo 'We expect dirty pages pct to be BELOW_MAX after some time depending on performance'
-CALL check_pct(10);
+# Value For $sucess will be set from include/wait_condition.inc file. It can have values 1 or 0. It will be 1 if dirty_pct() <= @@global.innodb_max_dirty_pages_pct else it will be 0.
+eval CALL check_pct($success);
 DROP PROCEDURE add_records;
 DROP PROCEDURE add_until;
 DROP PROCEDURE check_pct;
diff --git a/mysql-test/t/ctype_many.test b/mysql-test/t/ctype_many.test
index 0903c3dd7fa..84048761228 100644
--- a/mysql-test/t/ctype_many.test
+++ b/mysql-test/t/ctype_many.test
@@ -211,3 +211,19 @@ SELECT min(comment),count(*) FROM t1 GROUP BY ucs2_f;
 DROP TABLE t1;
 
 # End of 4.1 tests
+
+
+--echo #
+--echo # Start of 5.1 tests
+--echo #
+
+--echo #
+--echo # Bug#58371 Assertion failed: !s.uses_buffer_owned_by(this) with format string function
+--echo #
+
+SET NAMES latin1;
+DO CONVERT(CAST(SUBSTRING_INDEX(FORMAT(1,'1111'), FORMAT('','Zpq'),1) 
+                AS BINARY(0)) USING utf8);
+--echo #
+--echo # End of 5.1 tests
+--echo #
diff --git a/mysql-test/t/func_like.test b/mysql-test/t/func_like.test
index 1204d04d9a0..f1fe52274b2 100644
--- a/mysql-test/t/func_like.test
+++ b/mysql-test/t/func_like.test
@@ -126,5 +126,10 @@ INSERT INTO t2 VALUES (1), (2), (3);
 SELECT 1 FROM t2 JOIN t1 ON 1 LIKE a GROUP BY a;
 DROP TABLE t1, t2;
 
+--echo #
+--echo # Bug#59149 valgrind warnings with "like .. escape .." function
+--echo #
+--error ER_WRONG_ARGUMENTS
+SELECT '' LIKE '1' ESCAPE COUNT(1);
 
 --echo End of 5.1 tests
diff --git a/mysql-test/t/xml.test b/mysql-test/t/xml.test
index 416f1fef0c5..148c5701e61 100644
--- a/mysql-test/t/xml.test
+++ b/mysql-test/t/xml.test
@@ -640,5 +640,10 @@ SELECT UPDATEXML(NULL, (LPAD(0.1111E-15, '2011', 1)), 1);
 --error ER_ILLEGAL_VALUE_FOR_TYPE
 SELECT EXTRACTVALUE('', LPAD(0.1111E-15, '2011', 1));
 
+--echo #
+--echo # Bug #44332 	my_xml_scan reads behind the end of buffer
+--echo #
+SELECT UPDATEXML(CONVERT(_latin1'<' USING utf8),'1','1');
+SELECT UPDATEXML(CONVERT(_latin1'<!--' USING utf8),'1','1');
 
 --echo End of 5.1 tests
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
index 204a2dfc663..c637c9c29b8 100644
--- a/sql/item_strfunc.cc
+++ b/sql/item_strfunc.cc
@@ -2761,22 +2761,16 @@ String *Item_func_conv_charset::val_str(String *str)
   DBUG_ASSERT(fixed == 1);
   if (use_cached_value)
     return null_value ? 0 : &str_value;
-  /* 
-    Here we don't pass 'str' as a parameter to args[0]->val_str()
-    as 'str' may point to 'str_value' (e.g. see Item::save_in_field()),
-    which we use below to convert string. 
-    Use argument's 'str_value' instead.
-  */
-  String *arg= args[0]->val_str(&args[0]->str_value);
+  String *arg= args[0]->val_str(str);
   uint dummy_errors;
   if (!arg)
   {
     null_value=1;
     return 0;
   }
-  null_value= str_value.copy(arg->ptr(),arg->length(),arg->charset(),
+  null_value= tmp_value.copy(arg->ptr(), arg->length(), arg->charset(),
                              conv_charset, &dummy_errors);
-  return null_value ? 0 : check_well_formed_result(&str_value);
+  return null_value ? 0 : check_well_formed_result(&tmp_value);
 }
 
 void Item_func_conv_charset::fix_length_and_dec()
diff --git a/sql/item_strfunc.h b/sql/item_strfunc.h
index 6645a4c637a..408062ddc08 100644
--- a/sql/item_strfunc.h
+++ b/sql/item_strfunc.h
@@ -713,6 +713,7 @@ public:
 class Item_func_conv_charset :public Item_str_func
 {
   bool use_cached_value;
+  String tmp_value;
 public:
   bool safe;
   CHARSET_INFO *conv_charset; // keep it public
diff --git a/sql/item_sum.h b/sql/item_sum.h
index de988c196ec..f8819d63bf4 100644
--- a/sql/item_sum.h
+++ b/sql/item_sum.h
@@ -339,6 +339,7 @@ public:
     forced_const= TRUE; 
   }
   virtual bool const_item() const { return forced_const; }
+  virtual bool const_during_execution() const { return false; }
   virtual void print(String *str, enum_query_type query_type);
   void fix_num_length_and_dec();
 
diff --git a/sql/slave.cc b/sql/slave.cc
index 96319de5427..0e74d0ce3c0 100644
--- a/sql/slave.cc
+++ b/sql/slave.cc
@@ -408,17 +408,6 @@ int terminate_slave_threads(Master_info* mi,int thread_mask,bool skip_lock)
   int error,force_all = (thread_mask & SLAVE_FORCE_ALL);
   pthread_mutex_t *sql_lock = &mi->rli.run_lock, *io_lock = &mi->run_lock;
 
-  if (thread_mask & (SLAVE_IO|SLAVE_FORCE_ALL))
-  {
-    DBUG_PRINT("info",("Terminating IO thread"));
-    mi->abort_slave=1;
-    if ((error=terminate_slave_thread(mi->io_thd, io_lock,
-                                      &mi->stop_cond,
-                                      &mi->slave_running,
-                                      skip_lock)) &&
-        !force_all)
-      DBUG_RETURN(error);
-  }
   if (thread_mask & (SLAVE_SQL|SLAVE_FORCE_ALL))
   {
     DBUG_PRINT("info",("Terminating SQL thread"));
@@ -430,6 +419,17 @@ int terminate_slave_threads(Master_info* mi,int thread_mask,bool skip_lock)
         !force_all)
       DBUG_RETURN(error);
   }
+  if (thread_mask & (SLAVE_IO|SLAVE_FORCE_ALL))
+  {
+    DBUG_PRINT("info",("Terminating IO thread"));
+    mi->abort_slave=1;
+    if ((error=terminate_slave_thread(mi->io_thd, io_lock,
+                                      &mi->stop_cond,
+                                      &mi->slave_running,
+                                      skip_lock)) &&
+        !force_all)
+      DBUG_RETURN(error);
+  }
   DBUG_RETURN(0);
 }
 
diff --git a/sql/sql_repl.cc b/sql/sql_repl.cc
index cb5aac863c0..0ade0b759d5 100644
--- a/sql/sql_repl.cc
+++ b/sql/sql_repl.cc
@@ -21,6 +21,7 @@
 #include "log_event.h"
 #include "rpl_filter.h"
 #include <my_dir.h>
+#include "debug_sync.h"
 
 int max_binlog_dump_events = 0; // unlimited
 my_bool opt_sporadic_binlog_dump_fail = 0;
@@ -556,6 +557,20 @@ impossible position";
       }
 #endif
 
+      DBUG_EXECUTE_IF("dump_thread_wait_before_send_xid",
+                      {
+                        if ((*packet)[EVENT_TYPE_OFFSET+1] == XID_EVENT)
+                        {
+                          net_flush(net);
+                          const char act[]=
+                            "now "
+                            "wait_for signal.continue";
+                          DBUG_ASSERT(opt_debug_sync_timeout > 0);
+                          DBUG_ASSERT(!debug_sync_set_action(current_thd,
+                                                             STRING_WITH_LEN(act)));
+                        }
+                      });
+
       if ((*packet)[EVENT_TYPE_OFFSET+1] == FORMAT_DESCRIPTION_EVENT)
       {
         binlog_can_be_corrupted= test((*packet)[FLAGS_OFFSET+1] &
@@ -572,6 +587,14 @@ impossible position";
 	goto err;
       }
 
+      DBUG_EXECUTE_IF("dump_thread_wait_before_send_xid",
+                      {
+                        if ((*packet)[EVENT_TYPE_OFFSET+1] == XID_EVENT)
+                        {
+                          net_flush(net);
+                        }
+                      });
+
       DBUG_PRINT("info", ("log event code %d",
 			  (*packet)[LOG_EVENT_OFFSET+1] ));
       if ((*packet)[LOG_EVENT_OFFSET+1] == LOAD_EVENT)
diff --git a/strings/xml.c b/strings/xml.c
index f3cfaad54fa..dee9da2864c 100644
--- a/strings/xml.c
+++ b/strings/xml.c
@@ -106,6 +106,13 @@ static void my_xml_norm_text(MY_XML_ATTR *a)
 }
 
 
+static inline my_bool
+my_xml_parser_prefix_cmp(MY_XML_PARSER *p, const char *s, size_t slen)
+{
+  return (p->cur + slen > p->end) || memcmp(p->cur, s, slen);
+}
+
+
 static int my_xml_scan(MY_XML_PARSER *p,MY_XML_ATTR *a)
 {
   int lex;
@@ -123,16 +130,20 @@ static int my_xml_scan(MY_XML_PARSER *p,MY_XML_ATTR *a)
   a->beg=p->cur;
   a->end=p->cur;
   
-  if ((p->end - p->cur > 3) && !memcmp(p->cur,"<!--",4))
+  if (!my_xml_parser_prefix_cmp(p, C_STRING_WITH_LEN("<!--")))
   {
-    for (; (p->cur < p->end) && memcmp(p->cur, "-->", 3); p->cur++)
-    {}
-    if (!memcmp(p->cur, "-->", 3))
-      p->cur+=3;
+    for (; p->cur < p->end; p->cur++)
+    {
+      if (!my_xml_parser_prefix_cmp(p, C_STRING_WITH_LEN("-->")))
+      {
+        p->cur+= 3;
+        break;
+      }
+    }
     a->end=p->cur;
     lex=MY_XML_COMMENT;
   }
-  else if (!memcmp(p->cur, "<![CDATA[",9))
+  else if (!my_xml_parser_prefix_cmp(p, C_STRING_WITH_LEN("<![CDATA[")))
   {
     p->cur+= 9;
     for (; p->cur < p->end - 2 ; p->cur++)