Fixed bugs found by valgrind

- Some of the bug fixes are backports from 10.5!
- The fix in innobase/fil/fil0fil.cc is just a backport to get less
  error messages in mysqld.1.err when running with valgrind.
- Renamed HAVE_valgrind_or_MSAN to HAVE_valgrind

10 files changed, 50 insertions, 27 deletions

diff --git a/sql/field.cc b/sql/field.cc
index 1e2a711c956..8accfb35b0b 100644
--- a/sql/field.cc
+++ b/sql/field.cc
@@ -7686,7 +7686,7 @@ my_decimal *Field_varstring::val_decimal(my_decimal *decimal_value)
 }
 
 
-#ifdef HAVE_valgrind_or_MSAN
+#ifdef HAVE_valgrind
 void Field_varstring::mark_unused_memory_as_defined()
 {
   uint used_length= get_length();
diff --git a/sql/field.h b/sql/field.h
index 34d6684571b..83cdb903b20 100644
--- a/sql/field.h
+++ b/sql/field.h
@@ -826,7 +826,7 @@ public:
     return store(ls.str, (uint) ls.length, cs);
   }
 
-#ifdef HAVE_valgrind_or_MSAN
+#ifdef HAVE_valgrind
   /**
     Mark unused memory in the field as defined. Mainly used to ensure
     that if we write full field to disk (for example in
@@ -3466,7 +3466,7 @@ public:
   bool memcpy_field_possible(const Field *from) const;
   int  store(const char *to,size_t length,CHARSET_INFO *charset);
   using Field_str::store;
-#ifdef HAVE_valgrind_or_MSAN
+#ifdef HAVE_valgrind
   void mark_unused_memory_as_defined();
 #endif
   double val_real(void);
@@ -4395,7 +4395,8 @@ public:
    :Type_handler_hybrid_field_type(&type_handler_null),
     compression_method_ptr(0),
     comment(null_clex_str),
-    on_update(NULL), length(0), invisible(VISIBLE), decimals(0),
+    on_update(NULL), length(0), invisible(VISIBLE), char_length(0),
+    decimals(0),
     flags(0), pack_length(0), key_length(0), unireg_check(Field::NONE),
     interval(0), charset(&my_charset_bin),
     srid(0), geom_type(Field::GEOM_GEOMETRY),
diff --git a/sql/ha_partition.cc b/sql/ha_partition.cc
index 8165474ccea..e19f21de006 100644
--- a/sql/ha_partition.cc
+++ b/sql/ha_partition.cc
@@ -2548,7 +2548,7 @@ register_query_cache_dependant_tables(THD *thd,
         sub_elem= subpart_it++;
         part= i * num_subparts + j;
         /* we store the end \0 as part of the key */
-        end= strmov(engine_pos, sub_elem->partition_name);
+        end= strmov(engine_pos, sub_elem->partition_name) + 1;
         length= (uint)(end - engine_key);
         /* Copy the suffix also to query cache key */
         memcpy(query_cache_key_end, engine_key_end, (end - engine_key_end));
diff --git a/sql/item_cmpfunc.cc b/sql/item_cmpfunc.cc
index ee371b8f896..a0a3631b15b 100644
--- a/sql/item_cmpfunc.cc
+++ b/sql/item_cmpfunc.cc
@@ -1176,6 +1176,8 @@ longlong Item_func_truth::val_int()
 
 bool Item_in_optimizer::is_top_level_item()
 {
+  if (invisible_mode())
+    return FALSE;
   return ((Item_in_subselect *)args[1])->is_top_level_item();
 }
 
diff --git a/sql/item_subselect.cc b/sql/item_subselect.cc
index ce2427bce91..c0a98aab183 100644
--- a/sql/item_subselect.cc
+++ b/sql/item_subselect.cc
@@ -717,7 +717,7 @@ bool Item_subselect::exec()
 
     push_warning_printf(thd, Sql_condition::WARN_LEVEL_NOTE,
        ER_UNKNOWN_ERROR, "DBUG: Item_subselect::exec %.*s",
-       print.length(),print.c_ptr());
+       print.length(),print.ptr());
   );
   /*
     Do not execute subselect in case of a fatal error
diff --git a/sql/opt_range.cc b/sql/opt_range.cc
index a936184de0d..0edc1665ac9 100644
--- a/sql/opt_range.cc
+++ b/sql/opt_range.cc
@@ -2457,6 +2457,7 @@ int SQL_SELECT::test_quick_select(THD *thd, key_map keys_to_use,
     param.imerge_cost_buff_size= 0;
     param.using_real_indexes= TRUE;
     param.remove_jump_scans= TRUE;
+    param.is_ror_scan= 0;
     param.remove_false_where_parts= remove_false_parts_of_where;
     param.force_default_mrr= ordered_output;
     param.possible_keys.clear_all();
diff --git a/sql/session_tracker.cc b/sql/session_tracker.cc
index 65d600b9b5a..7133e45ab11 100644
--- a/sql/session_tracker.cc
+++ b/sql/session_tracker.cc
@@ -380,9 +380,10 @@ bool Session_sysvars_tracker::enable(THD *thd)
 bool Session_sysvars_tracker::update(THD *thd, set_var *var)
 {
   vars_list tool_list;
+  size_t length= 1;
   void *copy= var->save_result.string_value.str ?
               my_memdup(var->save_result.string_value.str,
-                        var->save_result.string_value.length + 1,
+                        length= var->save_result.string_value.length + 1,
                         MYF(MY_WME | MY_THREAD_SPECIFIC)) :
               my_strdup("", MYF(MY_WME | MY_THREAD_SPECIFIC));
 
@@ -402,7 +403,7 @@ bool Session_sysvars_tracker::update(THD *thd, set_var *var)
   m_parsed= true;
   orig_list.copy(&tool_list, thd);
   orig_list.construct_var_list(thd->variables.session_track_system_variables,
-                               var->save_result.string_value.length + 1);
+                               length);
   return false;
 }
 
diff --git a/sql/sql_select.cc b/sql/sql_select.cc
index 1738cf5d18f..88a1cdedeac 100644
--- a/sql/sql_select.cc
+++ b/sql/sql_select.cc
@@ -6176,9 +6176,11 @@ add_ft_keys(DYNAMIC_ARRAY *keyuse_array,
   keyuse.keypart= FT_KEYPART;
   keyuse.used_tables=cond_func->key_item()->used_tables();
   keyuse.optimize= 0;
+  keyuse.ref_table_rows= 0;
   keyuse.keypart_map= 0;
   keyuse.sj_pred_no= UINT_MAX;
   keyuse.validity_ref= 0;
+  keyuse.null_rejecting= FALSE;
   return insert_dynamic(keyuse_array,(uchar*) &keyuse);
 }
 
@@ -17966,25 +17968,31 @@ create_tmp_table(THD *thd, TMP_TABLE_PARAM *param, List<Item> &fields,
          inherit the default value that is defined for the field referred
          by the Item_field object from which 'field' has been created.
       */
-      const Field *orig_field= default_field[i];
+      Field *orig_field= default_field[i];
       /* Get the value from default_values */
       if (orig_field->is_null_in_record(orig_field->table->s->default_values))
         field->set_null();
       else
       {
+        /*
+          Copy default value. We have to use field_conv() for copy, instead of
+          memcpy(), because bit_fields may be stored differently
+        */
+        my_ptrdiff_t ptr_diff= (orig_field->table->s->default_values -
+                                orig_field->table->record[0]);
         field->set_notnull();
-        memcpy(field->ptr,
-               orig_field->ptr_in_record(orig_field->table->s->default_values),
-               field->pack_length_in_rec());
+        orig_field->move_field_offset(ptr_diff);
+        field_conv(field, orig_field);
+        orig_field->move_field_offset(-ptr_diff);
       }
-    } 
+    }
 
     if (from_field[i])
     {						/* Not a table Item */
       copy->set(field,from_field[i],save_sum_fields);
       copy++;
     }
-    length=field->pack_length();
+    length=field->pack_length_in_rec();
     pos+= length;
 
     /* Make entry for create table */
@@ -18006,6 +18014,9 @@ create_tmp_table(THD *thd, TMP_TABLE_PARAM *param, List<Item> &fields,
     // fix table name in field entry
     field->set_table_name(&table->alias);
   }
+  /* Handle group_null_items */
+  bzero(pos, table->s->reclength - (pos - table->record[0]));
+  MEM_CHECK_DEFINED(table->record[0], table->s->reclength);
 
   param->copy_field_end=copy;
   param->recinfo= recinfo;              	// Pointer to after last field
@@ -18275,8 +18286,9 @@ create_tmp_table(THD *thd, TMP_TABLE_PARAM *param, List<Item> &fields,
       goto err;
   }
 
-  // Make empty record so random data is not written to disk
-  empty_record(table);
+  /* record[0] and share->default_values should now have been set up */
+  MEM_CHECK_DEFINED(table->record[0], table->s->reclength);
+  MEM_CHECK_DEFINED(share->default_values, table->s->reclength);
 
   thd->mem_root= mem_root_save;
 
@@ -18571,7 +18583,11 @@ bool create_internal_tmp_table(TABLE *table, KEY *keyinfo,
       (*recinfo)->type=   FIELD_CHECK;
       (*recinfo)->length= MARIA_UNIQUE_HASH_LENGTH;
       (*recinfo)++;
-      share->reclength+=      MARIA_UNIQUE_HASH_LENGTH;
+
+      /* Avoid warnings from valgrind */
+      bzero(table->record[0]+ share->reclength, MARIA_UNIQUE_HASH_LENGTH);
+      bzero(share->default_values+ share->reclength, MARIA_UNIQUE_HASH_LENGTH);
+      share->reclength+= MARIA_UNIQUE_HASH_LENGTH;
     }
     else
     {
@@ -18765,7 +18781,10 @@ bool create_internal_tmp_table(TABLE *table, KEY *keyinfo,
       (*recinfo)->type= FIELD_CHECK;
       (*recinfo)->length=MI_UNIQUE_HASH_LENGTH;
       (*recinfo)++;
-      share->reclength+=MI_UNIQUE_HASH_LENGTH;
+      /* Avoid warnings from valgrind */
+      bzero(table->record[0]+ share->reclength, MI_UNIQUE_HASH_LENGTH);
+      bzero(share->default_values+ share->reclength, MI_UNIQUE_HASH_LENGTH);
+      share->reclength+= MI_UNIQUE_HASH_LENGTH;
     }
     else
     {
@@ -19357,11 +19376,11 @@ bool instantiate_tmp_table(TABLE *table, KEY *keyinfo,
       If it is not heap (in-memory) table then convert index to unique
       constrain.
     */
+    MEM_CHECK_DEFINED(table->record[0], table->s->reclength);
     if (create_internal_tmp_table(table, keyinfo, start_recinfo, recinfo,
                                   options))
       return TRUE;
-    // Make empty record so random data is not written to disk
-    empty_record(table);
+    MEM_CHECK_DEFINED(table->record[0], table->s->reclength);
   }
   if (open_tmp_table(table))
     return TRUE;
@@ -27698,7 +27717,6 @@ AGGR_OP::prepare_tmp_table()
                               join->select_options))
       return true;
     (void) table->file->extra(HA_EXTRA_WRITE_CACHE);
-    empty_record(table);
   }
   /* If it wasn't already, start index scan for grouping using table index. */
   if (!table->file->inited && table->group &&
diff --git a/sql/table.cc b/sql/table.cc
index c0cfc5ca3db..ec2d86e232e 100644
--- a/sql/table.cc
+++ b/sql/table.cc
@@ -1644,8 +1644,7 @@ int TABLE_SHARE::init_from_binary_frm_image(THD *thd, bool write,
   share->rec_buff_length= rec_buff_length;
   if (!(record= (uchar *) alloc_root(&share->mem_root, rec_buff_length)))
     goto err;                          /* purecov: inspected */
-  MEM_NOACCESS(record, rec_buff_length);
-  MEM_UNDEFINED(record, share->reclength);
+  MEM_NOACCESS(record + share->reclength, rec_buff_length - share->reclength);
   share->default_values= record;
   memcpy(record, frm_image + record_offset, share->reclength);
 
@@ -3273,7 +3272,6 @@ enum open_frm_error open_table_from_share(THD *thd, TABLE_SHARE *share,
     if (!(record= (uchar*) alloc_root(&outparam->mem_root,
                                       share->rec_buff_length * records)))
       goto err;                                   /* purecov: inspected */
-    MEM_NOACCESS(record, share->rec_buff_length * records);
   }
 
   for (i= 0; i < 3;)
@@ -3282,8 +3280,10 @@ enum open_frm_error open_table_from_share(THD *thd, TABLE_SHARE *share,
     if (++i < records)
       record+= share->rec_buff_length;
   }
+  /* Mark bytes between records as not accessable to catch overrun bugs */
   for (i= 0; i < records; i++)
-    MEM_UNDEFINED(outparam->record[i], share->reclength);
+    MEM_NOACCESS(outparam->record[i] + share->reclength,
+                 share->rec_buff_length - share->reclength);
 
   if (!(field_ptr = (Field **) alloc_root(&outparam->mem_root,
                                           (uint) ((share->fields+1)*
diff --git a/sql/unireg.cc b/sql/unireg.cc
index b7eb1cd3457..cccb09a9fb9 100644
--- a/sql/unireg.cc
+++ b/sql/unireg.cc
@@ -436,8 +436,8 @@ LEX_CUSTRING build_frm_image(THD *thd, const LEX_CSTRING *table,
     pos+= create_info->comment.length;
   }
 
-  memcpy(frm_ptr + filepos, forminfo, 288);
-  pos= frm_ptr + filepos + 288;
+  memcpy(frm_ptr + filepos, forminfo, FRM_FORMINFO_SIZE);
+  pos= frm_ptr + filepos + FRM_FORMINFO_SIZE;
   if (pack_fields(&pos, create_fields, create_info, data_offset))
     goto err;