Merge branch '10.1' into 10.2

client/mysql.cc

@@ -1303,8 +1303,8 @@ sig_handler mysql_end(int sig)
 {
 #ifndef _WIN32
   /*
-    Ingnoring SIGQUIT and SIGINT signals when cleanup process starts.
-    This will help in resolving the double free issues, which occures in case
+    Ignoring SIGQUIT and SIGINT signals when cleanup process starts.
+    This will help in resolving the double free issues, which occurs in case
     the signal handler function is started in between the clean up function.
   */
   signal(SIGQUIT, SIG_IGN);
@@ -4730,7 +4730,7 @@ sql_real_connect(char *host,char *database,char *user,char *password,
   /*
     CLIENT_PROGRESS_OBSOLETE is set only if we requested it in
     mysql_real_connect() and the server also supports it
-  */
+*/
   if (mysql.client_flag & CLIENT_PROGRESS_OBSOLETE)
     mysql_options(&mysql, MYSQL_PROGRESS_CALLBACK, (void*) report_progress);
 #else
@@ -4799,7 +4799,7 @@ com_status(String *buffer __attribute__((unused)),
   tee_fprintf(stdout, "\nConnection id:\t\t%lu\n",mysql_thread_id(&mysql));
   /*
     Don't remove "limit 1",
-    it is protection againts SQL_SELECT_LIMIT=0
+    it is protection against SQL_SELECT_LIMIT=0
   */
   if (!mysql_store_result_for_lazy(&result))
   {
@@ -5172,7 +5172,7 @@ static const char *construct_prompt()
   time_t  lclock = time(NULL);			// Get the date struct
   struct tm *t = localtime(&lclock);
 
-  /* parse thru the settings for the prompt */
+  /* parse through the settings for the prompt */
   for (char *c = current_prompt; *c ; c++)
   {
     if (*c != PROMPT_CHAR)

client/mysql_plugin.c

@@ -1020,7 +1020,7 @@ static int find_plugin(char *tp_path)
 
 
 /**
-  Build the boostrap file.
+  Build the bootstrap file.
   
   Create a new file and populate it with SQL commands to ENABLE or DISABLE
   the plugin via REPLACE and DELETE operations on the mysql.plugin table.
@@ -1149,7 +1149,7 @@ exit:
   
   Create a command line sequence to launch mysqld in bootstrap mode. This
   will allow mysqld to launch a minimal server instance to read and
-  execute SQL commands from a file piped in (the boostrap file). We use
+  execute SQL commands from a file piped in (the bootstrap file). We use
   the --no-defaults option to skip reading values from the config file.
 
   The bootstrap mode skips loading of plugins and many other subsystems.

client/mysqlbinlog.cc

@@ -739,7 +739,7 @@ static bool shall_skip_database(const char *log_dbname)
 /**
   Print "use <db>" statement when current db is to be changed.
 
-  We have to control emiting USE statements according to rewrite-db options.
+  We have to control emitting USE statements according to rewrite-db options.
   We have to do it here (see process_event() below) and to suppress
   producing USE statements by corresponding log event print-functions.
 */
@@ -771,7 +771,7 @@ print_use_stmt(PRINT_EVENT_INFO* pinfo, const Query_log_event *ev)
   // In case of rewrite rule print USE statement for db_to
   my_fprintf(result_file, "use %`s%s\n", db_to, pinfo->delimiter);
 
-  // Copy the *original* db to pinfo to suppress emiting
+  // Copy the *original* db to pinfo to suppress emitting
   // of USE stmts by log_event print-functions.
   memcpy(pinfo->db, db, db_len + 1);
 }

client/mysqldump.c

@@ -144,7 +144,7 @@ static char * opt_mysql_unix_port=0;
 static int   first_error=0;
 /*
   multi_source is 0 if old server or 2 if server that support multi source 
-  This is choosen this was as multi_source has 2 extra columns first in
+  This is chosen this was as multi_source has 2 extra columns first in
   SHOW ALL SLAVES STATUS.
 */
 static uint multi_source= 0;
@@ -2048,7 +2048,7 @@ static void print_xml_tag(FILE * xml_file, const char* sbeg,
       <stag_atr="sval" xsi:nil="true"/>
   NOTE
     sval MUST be a NULL terminated string.
-    sval string will be qouted before output.
+    sval string will be quoted before output.
 */
 
 static void print_xml_null_tag(FILE * xml_file, const char* sbeg,
@@ -2120,7 +2120,7 @@ static void print_xml_cdata(FILE *xml_file, const char *str, ulong len)
     Print tag with many attribute to the xml_file. Format is:
       \t\t<row_name Atr1="Val1" Atr2="Val2"... />
   NOTE
-    All atributes and values will be quoted before output.
+    All attributes and values will be quoted before output.
 */
 
 static void print_xml_row(FILE *xml_file, const char *row_name,
@@ -2591,7 +2591,7 @@ static uint dump_routines_for_db(char *db)
             print_comment(sql_file, 1,
                           "-- does %s have permissions on mysql.proc?\n\n",
                           fix_for_comment(current_user));
-            maybe_die(EX_MYSQLERR,"%s has insufficent privileges to %s!",
+            maybe_die(EX_MYSQLERR,"%s has insufficient privileges to %s!",
                       current_user, query_buff);
           }
           else if (strlen(row[2]))
@@ -4092,7 +4092,7 @@ static void dump_table(char *table, char *db, const uchar *hash_key, size_t len)
       }
     }
 
-    /* XML - close table tag and supress regular output */
+    /* XML - close table tag and suppress regular output */
     if (opt_xml)
         fputs("\t</table_data>\n", md_result_file);
     else if (extended_insert && row_break)
@@ -4498,7 +4498,7 @@ static int dump_databases(char **db_names)
 
 
 /*
-View Specific database initalization.
+View Specific database initialization.
 
 SYNOPSIS
   init_dumping_views
@@ -4515,7 +4515,7 @@ int init_dumping_views(char *qdatabase __attribute__((unused)))
 
 
 /*
-Table Specific database initalization.
+Table Specific database initialization.
 
 SYNOPSIS
   init_dumping_tables

client/mysqlimport.c

@@ -594,7 +594,7 @@ static char *field_escape(char *to,const char *from,uint length)
     else 
     {
       if (*from == '\'' && !end_backslashes)
-	*to++= *from;      /* We want a dublicate of "'" for MySQL */
+	*to++= *from;      /* We want a duplicate of "'" for MySQL */
       end_backslashes=0;
     }
   }

client/mysqlslap.c

@@ -2302,7 +2302,7 @@ slap_connect(MYSQL *mysql)
                            opt_mysql_unix_port,
                            connect_flags))
     {
-      /* Connect suceeded */
+      /* Connect succeeded */
       connect_error= 0;
       break;
     }

client/mysqltest.cc

@@ -146,7 +146,7 @@ struct property {
   my_bool *var;			/* Actual variable */
   my_bool set;			/* Has been set for ONE command */
   my_bool old;			/* If set, thus is the old value */
-  my_bool reverse;		/* Varible is true if disabled */
+  my_bool reverse;		/* Variable is true if disabled */
   const char *env_name;		/* Env. variable name */
 };
 
@@ -566,7 +566,7 @@ DYNAMIC_ARRAY regex_arr; /* stores a list of st_regex subsitutions */
 Temporary storage areas for substitutions. To reduce unnessary copying
 and memory freeing/allocation, we pre-allocate two buffers, and alternate
 their use, one for input/one for output, the roles changing on the next
-st_regex substition. At the end of substitutions  buf points to the
+st_regex substitution. At the end of substitutions  buf points to the
 one containing the final result.
 */
 char* buf;
@@ -3110,7 +3110,7 @@ void open_file(const char *name)
       strxnmov(buff, sizeof(buff), opt_overlay_dir, suffix, name, NullS);
 
       /*
-        Overlayed rty/include/thing.inc can contain the line
+        Overlaid rty/include/thing.inc can contain the line
         --source thing.inc
         which would mean to include qwe/include/thing.inc.
         But it looks like including "itself", so don't try to open the file,
@@ -4819,7 +4819,7 @@ int do_save_master_pos()
 	mysql_errno(mysql), mysql_error(mysql));
 
   if (!(res = mysql_store_result(mysql)))
-    die("mysql_store_result() retuned NULL for '%s'", query);
+    die("mysql_store_result() returned NULL for '%s'", query);
   if (!(row = mysql_fetch_row(res)))
     die("empty result in show master status");
   strnmov(master_pos.file, row[0], sizeof(master_pos.file)-1);
@@ -5337,7 +5337,7 @@ void do_get_errcodes(struct st_command *command)
         p++;
       }
 
-      /* Convert the sting to int */
+      /* Convert the string to int */
       if (!str2int(start, 10, (long) INT_MIN, (long) INT_MAX, &val))
 	die("Invalid argument to error: '%s'", command->first_argument);
 
@@ -5729,7 +5729,7 @@ int connect_n_handle_errors(struct st_command *command,
     dynstr_append_mem(ds, delimiter, delimiter_length);
     dynstr_append_mem(ds, "\n", 1);
   }
-  /* Simlified logging if enabled */
+  /* Simplified logging if enabled */
   if (!disable_connect_log && !disable_query_log)
   {
     replace_dynstr_append(ds, command->query);
@@ -8193,7 +8193,7 @@ void handle_no_error(struct st_command *command)
   SYNPOSIS
   run_query_stmt
   mysql - mysql handle
-  command - currrent command pointer
+  command - current command pointer
   query - query string to execute
   query_len - length query string to execute
   ds - output buffer where to store result form query
@@ -8433,7 +8433,7 @@ end:
 /*
   Create a util connection if one does not already exists
   and use that to run the query
-  This is done to avoid implict commit when creating/dropping objects such
+  This is done to avoid implicit commit when creating/dropping objects such
   as view, sp etc.
 */
 
@@ -8474,7 +8474,7 @@ int util_query(MYSQL* org_mysql, const char* query){
   SYNPOSIS
     run_query()
      mysql	mysql handle
-     command	currrent command pointer
+     command	current command pointer
 
   flags control the phased/stages of query execution to be performed
   if QUERY_SEND_FLAG bit is on, the query will be sent. If QUERY_REAP_FLAG
@@ -10237,7 +10237,7 @@ int multi_reg_replace(struct st_replace_regex* r,char* val)
     if (!reg_replace(&out_buf, buf_len_p, re.pattern, re.replace,
                      in_buf, re.icase))
     {
-      /* if the buffer has been reallocated, make adjustements */
+      /* if the buffer has been reallocated, make adjustments */
       if (save_out_buf != out_buf)
       {
         if (save_out_buf == r->even_buf)
@@ -10504,7 +10504,7 @@ typedef struct st_rep_set {
   uint	found_len;			/* Best match to date */
   int	found_offset;
   uint	table_offset;
-  uint	size_of_bits;			/* For convinience */
+  uint	size_of_bits;			/* For convenience */
 } REP_SET;
 
 typedef struct st_rep_sets {
@@ -10607,7 +10607,7 @@ REPLACE *init_replace(char * *from, char * *to,uint count,
     DBUG_RETURN(0);
   }
   (void) make_new_set(&sets);			/* Set starting set */
-  make_sets_invisible(&sets);			/* Hide previus sets */
+  make_sets_invisible(&sets);			/* Hide previous sets */
   used_sets=-1;
   word_states=make_new_set(&sets);		/* Start of new word */
   start_states=make_new_set(&sets);		/* This is first state */

mysql-test/r/grant.result

@@ -2727,6 +2727,19 @@ DROP USER untrusted@localhost;
 DROP DATABASE secret;
 set GLOBAL sql_mode=default;
 #
+# MDEV-22755 CREATE USER leads to indirect SIGABRT in __stack_chk_fail () from fill_schema_user_privileges + *** stack smashing detected *** (on optimized builds)
+#
+SET NAMES utf8;
+SET SQL_MODE='';
+CREATE USER 觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻@localhost;
+SELECT * FROM INFORMATION_SCHEMA.user_privileges WHERE GRANTEE LIKE "'abcdefghijklmnopqrstuvwxyz'%";
+GRANTEE	TABLE_CATALOG	PRIVILEGE_TYPE	IS_GRANTABLE
+SELECT GRANTEE FROM INFORMATION_SCHEMA.user_privileges WHERE GRANTEE LIKE '%觻%';
+GRANTEE
+'觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻'@'localhost'
+DROP USER  觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻@localhost;
+SET SQL_MODE=DEFAULT;
+#
 # Start of 10.2 tests
 #
 #

mysql-test/r/index_merge_innodb.result

@@ -807,4 +807,34 @@ sum(col1)
 33632261
 drop table t1;
 set optimizer_switch=@tmp_optimizer_switch;
+#
+# MDEV-22728: SIGFPE in Unique::get_cost_calc_buff_size from prepare_search_best_index_intersect
+# on optimized builds
+#
+SET @save_sort_buffer_size=@@sort_buffer_size;
+SET @save_innodb_file_format= @@innodb_file_format;
+SET @save_innodb_large_prefix= @@innodb_large_prefix;
+SET sort_buffer_size=2048;
+SET GLOBAL innodb_file_format = BARRACUDA;
+SET GLOBAL innodb_large_prefix = ON;
+CREATE TABLE t1 (
+a VARCHAR(1024) CHARACTER SET UTF8 PRIMARY KEY,
+b INT,
+c INT,
+INDEX (b)
+) ENGINE=InnoDB CHARSET utf8 ROW_FORMAT= DYNAMIC;
+INSERT INTO t1 SELECT seq, seq, seq from seq_1_to_100;
+EXPLAIN SELECT * FROM t1 WHERE a='1' OR b < 5;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	SIMPLE	t1	index_merge	PRIMARY,b	b,PRIMARY	5,3074	NULL	4	Using sort_union(b,PRIMARY); Using where
+SELECT * FROM t1 WHERE a='1' OR b < 5;
+a	b	c
+2	2	2
+3	3	3
+4	4	4
+1	1	1
+DROP TABLE t1;
+SET GLOBAL innodb_file_format = @save_innodb_file_format;
+SET GLOBAL innodb_large_prefix = @save_innodb_large_prefix;
+SET sort_buffer_size= @save_sort_buffer_size;
 disconnect disable_purge;

mysql-test/t/grant.test

@@ -2232,6 +2232,18 @@ set GLOBAL sql_mode=default;
 # Wait till we reached the initial number of concurrent sessions
 --source include/wait_until_count_sessions.inc
 
+--echo #
+--echo # MDEV-22755 CREATE USER leads to indirect SIGABRT in __stack_chk_fail () from fill_schema_user_privileges + *** stack smashing detected *** (on optimized builds)
+--echo #
+
+SET NAMES utf8;
+SET SQL_MODE='';
+CREATE USER 觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻@localhost;
+SELECT * FROM INFORMATION_SCHEMA.user_privileges WHERE GRANTEE LIKE "'abcdefghijklmnopqrstuvwxyz'%";
+SELECT GRANTEE FROM INFORMATION_SCHEMA.user_privileges WHERE GRANTEE LIKE '%觻%';
+DROP USER  觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻_觻觻觻觻觻觻觻觻觻觻@localhost;
+SET SQL_MODE=DEFAULT;
+
 --echo #
 --echo # Start of 10.2 tests
 --echo #

mysql-test/t/index_merge_innodb.test

@@ -199,4 +199,31 @@ SELECT sum(col1) FROM t1 FORCE INDEX (key1,key2) WHERE  (key1 between 10 and 819
 drop table t1;
 set optimizer_switch=@tmp_optimizer_switch;
 
+--echo #
+--echo # MDEV-22728: SIGFPE in Unique::get_cost_calc_buff_size from prepare_search_best_index_intersect
+--echo # on optimized builds
+--echo #
+
+SET @save_sort_buffer_size=@@sort_buffer_size;
+SET @save_innodb_file_format= @@innodb_file_format;
+SET @save_innodb_large_prefix= @@innodb_large_prefix;
+SET sort_buffer_size=2048;
+SET GLOBAL innodb_file_format = BARRACUDA;
+SET GLOBAL innodb_large_prefix = ON;
+
+CREATE TABLE t1 (
+  a VARCHAR(1024) CHARACTER SET UTF8 PRIMARY KEY,
+  b INT,
+  c INT,
+  INDEX (b)
+) ENGINE=InnoDB CHARSET utf8 ROW_FORMAT= DYNAMIC;
+INSERT INTO t1 SELECT seq, seq, seq from seq_1_to_100;
+EXPLAIN SELECT * FROM t1 WHERE a='1' OR b < 5;
+SELECT * FROM t1 WHERE a='1' OR b < 5;
+DROP TABLE t1;
+
+SET GLOBAL innodb_file_format = @save_innodb_file_format;
+SET GLOBAL innodb_large_prefix = @save_innodb_large_prefix;
+SET sort_buffer_size= @save_sort_buffer_size;
+
 disconnect disable_purge;

plugin/disks/information_schema_disks.cc

@@ -32,9 +32,9 @@ ST_FIELD_INFO disks_table_fields[]=
 {
     { "Disk",      PATH_MAX, MYSQL_TYPE_STRING, 0, 0 ,0, 0 },
     { "Path",      PATH_MAX, MYSQL_TYPE_STRING, 0, 0 ,0, 0 },
-    { "Total",           32, MYSQL_TYPE_LONG,   0, 0 ,0 ,0 }, // Total amount available
-    { "Used",            32, MYSQL_TYPE_LONG,   0, 0 ,0 ,0 }, // Amount of space used
-    { "Available",       32, MYSQL_TYPE_LONG,   0, 0 ,0 ,0 }, // Amount available to users other than root.
+    { "Total",           32, MYSQL_TYPE_LONGLONG,   0, 0 ,0 ,0 }, // Total amount available
+    { "Used",            32, MYSQL_TYPE_LONGLONG,   0, 0 ,0 ,0 }, // Amount of space used
+    { "Available",       32, MYSQL_TYPE_LONGLONG,   0, 0 ,0 ,0 }, // Amount available to users other than root.
     { 0, 0, MYSQL_TYPE_NULL, 0, 0, 0, 0 }
 };
 
@@ -51,9 +51,10 @@ int disks_table_add_row(THD* pThd,
     // f_bfree    Total number of free blocks.
     // f_bavail   Number of free blocks available to non-privileged process.
 
-    size_t total = (info.f_frsize * info.f_blocks) / 1024;
-    size_t used  = (info.f_frsize * (info.f_blocks - info.f_bfree)) / 1024;
-    size_t avail = (info.f_frsize * info.f_bavail) / 1024;
+    ulonglong total = ((ulonglong)info.f_frsize * info.f_blocks) / 1024;
+    ulonglong used  = ((ulonglong)info.f_frsize *
+                            (info.f_blocks - info.f_bfree)) / 1024;
+    ulonglong avail = ((ulonglong)info.f_frsize * info.f_bavail) / 1024;
 
     pTable->field[0]->store(zDisk, strlen(zDisk), system_charset_info);
     pTable->field[1]->store(zPath, strlen(zPath), system_charset_info);

plugin/disks/mysql-test/disks/disks.result

@@ -3,9 +3,9 @@ Table	Create Table
 DISKS	CREATE TEMPORARY TABLE `DISKS` (
   `Disk` varchar(4096) NOT NULL DEFAULT '',
   `Path` varchar(4096) NOT NULL DEFAULT '',
-  `Total` int(32) NOT NULL DEFAULT 0,
-  `Used` int(32) NOT NULL DEFAULT 0,
-  `Available` int(32) NOT NULL DEFAULT 0
+  `Total` bigint(32) NOT NULL DEFAULT 0,
+  `Used` bigint(32) NOT NULL DEFAULT 0,
+  `Available` bigint(32) NOT NULL DEFAULT 0
 ) ENGINE=MEMORY DEFAULT CHARSET=utf8
 select sum(Total) > sum(Available), sum(Total)>sum(Used) from information_schema.disks;
 sum(Total) > sum(Available)	sum(Total)>sum(Used)

sql/log.cc

@@ -2417,7 +2417,7 @@ static int find_uniq_filename(char *name, ulong next_log_number)
   char                  buff[FN_REFLEN], ext_buf[FN_REFLEN];
   struct st_my_dir     *dir_info;
   struct fileinfo *file_info;
-  ulong                 max_found, next, UNINIT_VAR(number);
+  ulong                 max_found= 0, next= 0, number= 0;
   size_t		buf_length, length;
   char			*start, *end;
   int                   error= 0;
@@ -2443,7 +2443,7 @@ static int find_uniq_filename(char *name, ulong next_log_number)
     if (strncmp(file_info->name, start, length) == 0 &&
 	test_if_number(file_info->name+length, &number,0))
     {
-      set_if_bigger(max_found,(ulong) number);
+      set_if_bigger(max_found, number);
     }
   }
   my_dirend(dir_info);

sql/sql_acl.cc

@@ -11473,7 +11473,7 @@ int wild_case_compare(CHARSET_INFO *cs, const char *str,const char *wildstr)
 
 
 #ifndef NO_EMBEDDED_ACCESS_CHECKS
-static bool update_schema_privilege(THD *thd, TABLE *table, char *buff,
+static bool update_schema_privilege(THD *thd, TABLE *table, const char *buff,
                                     const char* db, const char* t_name,
                                     const char* column, uint col_length,
                                     const char *priv, uint priv_length,
@@ -11497,6 +11497,21 @@ static bool update_schema_privilege(THD *thd, TABLE *table, char *buff,
 #endif
 
 
+#ifndef NO_EMBEDDED_ACCESS_CHECKS
+class Grantee_str
+{
+  char m_buff[USER_HOST_BUFF_SIZE + 6 /* 4 quotes, @, '\0' */];
+public:
+  Grantee_str(const char *user, const char *host)
+  {
+    DBUG_ASSERT(strlen(user) + strlen(host) + 6 < sizeof(m_buff));
+    strxmov(m_buff, "'", user, "'@'", host, "'", NullS);
+  }
+  operator const char *() const { return m_buff; }
+};
+#endif
+
+
 int fill_schema_user_privileges(THD *thd, TABLE_LIST *tables, COND *cond)
 {
 #ifndef NO_EMBEDDED_ACCESS_CHECKS
@@ -11504,7 +11519,6 @@ int fill_schema_user_privileges(THD *thd, TABLE_LIST *tables, COND *cond)
   uint counter;
   ACL_USER *acl_user;
   ulong want_access;
-  char buff[100];
   TABLE *table= tables->table;
   bool no_global_access= check_access(thd, SELECT_ACL, "mysql",
                                       NULL, NULL, 1, 1);
@@ -11531,10 +11545,10 @@ int fill_schema_user_privileges(THD *thd, TABLE_LIST *tables, COND *cond)
     if (!(want_access & GRANT_ACL))
       is_grantable= "NO";
 
-    strxmov(buff,"'",user,"'@'",host,"'",NullS);
+    Grantee_str grantee(user, host);
     if (!(want_access & ~GRANT_ACL))
     {
-      if (update_schema_privilege(thd, table, buff, 0, 0, 0, 0,
+      if (update_schema_privilege(thd, table, grantee, 0, 0, 0, 0,
                                   STRING_WITH_LEN("USAGE"), is_grantable))
       {
         error= 1;
@@ -11549,7 +11563,7 @@ int fill_schema_user_privileges(THD *thd, TABLE_LIST *tables, COND *cond)
       {
         if (test_access & j)
         {
-          if (update_schema_privilege(thd, table, buff, 0, 0, 0, 0,
+          if (update_schema_privilege(thd, table, grantee, 0, 0, 0, 0,
                                       command_array[priv_id],
                                       command_lengths[priv_id], is_grantable))
           {
@@ -11577,7 +11591,6 @@ int fill_schema_schema_privileges(THD *thd, TABLE_LIST *tables, COND *cond)
   uint counter;
   ACL_DB *acl_db;
   ulong want_access;
-  char buff[100];
   TABLE *table= tables->table;
   bool no_global_access= check_access(thd, SELECT_ACL, "mysql",
                                       NULL, NULL, 1, 1);
@@ -11608,10 +11621,10 @@ int fill_schema_schema_privileges(THD *thd, TABLE_LIST *tables, COND *cond)
       {
         is_grantable= "NO";
       }
-      strxmov(buff,"'",user,"'@'",host,"'",NullS);
+      Grantee_str grantee(user, host);
       if (!(want_access & ~GRANT_ACL))
       {
-        if (update_schema_privilege(thd, table, buff, acl_db->db, 0, 0,
+        if (update_schema_privilege(thd, table, grantee, acl_db->db, 0, 0,
                                     0, STRING_WITH_LEN("USAGE"), is_grantable))
         {
           error= 1;
@@ -11625,7 +11638,8 @@ int fill_schema_schema_privileges(THD *thd, TABLE_LIST *tables, COND *cond)
         for (cnt=0, j = SELECT_ACL; j <= DB_ACLS; cnt++,j <<= 1)
           if (test_access & j)
           {
-            if (update_schema_privilege(thd, table, buff, acl_db->db, 0, 0, 0,
+            if (update_schema_privilege(thd, table,
+                                        grantee, acl_db->db, 0, 0, 0,
                                         command_array[cnt], command_lengths[cnt],
                                         is_grantable))
             {
@@ -11651,7 +11665,6 @@ int fill_schema_table_privileges(THD *thd, TABLE_LIST *tables, COND *cond)
 #ifndef NO_EMBEDDED_ACCESS_CHECKS
   int error= 0;
   uint index;
-  char buff[100];
   TABLE *table= tables->table;
   bool no_global_access= check_access(thd, SELECT_ACL, "mysql",
                                       NULL, NULL, 1, 1);
@@ -11686,10 +11699,11 @@ int fill_schema_table_privileges(THD *thd, TABLE_LIST *tables, COND *cond)
       if (!(table_access & GRANT_ACL))
         is_grantable= "NO";
 
-      strxmov(buff, "'", user, "'@'", host, "'", NullS);
+      Grantee_str grantee(user, host);
       if (!test_access)
       {
-        if (update_schema_privilege(thd, table, buff, grant_table->db,
+        if (update_schema_privilege(thd, table,
+                                    grantee, grant_table->db,
                                     grant_table->tname, 0, 0,
                                     STRING_WITH_LEN("USAGE"), is_grantable))
         {
@@ -11705,7 +11719,8 @@ int fill_schema_table_privileges(THD *thd, TABLE_LIST *tables, COND *cond)
         {
           if (test_access & j)
           {
-            if (update_schema_privilege(thd, table, buff, grant_table->db,
+            if (update_schema_privilege(thd, table,
+                                        grantee, grant_table->db,
                                         grant_table->tname, 0, 0,
                                         command_array[cnt],
                                         command_lengths[cnt], is_grantable))
@@ -11733,7 +11748,6 @@ int fill_schema_column_privileges(THD *thd, TABLE_LIST *tables, COND *cond)
 #ifndef NO_EMBEDDED_ACCESS_CHECKS
   int error= 0;
   uint index;
-  char buff[100];
   TABLE *table= tables->table;
   bool no_global_access= check_access(thd, SELECT_ACL, "mysql",
                                       NULL, NULL, 1, 1);
@@ -11762,7 +11776,7 @@ int fill_schema_column_privileges(THD *thd, TABLE_LIST *tables, COND *cond)
         is_grantable= "NO";
 
       ulong test_access= table_access & ~GRANT_ACL;
-      strxmov(buff, "'", user, "'@'", host, "'", NullS);
+      Grantee_str grantee(user, host);
       if (!test_access)
         continue;
       else
@@ -11781,7 +11795,9 @@ int fill_schema_column_privileges(THD *thd, TABLE_LIST *tables, COND *cond)
                 my_hash_element(&grant_table->hash_columns,col_index);
               if ((grant_column->rights & j) && (table_access & j))
               {
-                if (update_schema_privilege(thd, table, buff, grant_table->db,
+                if (update_schema_privilege(thd, table,
+                                            grantee,
+                                            grant_table->db,
                                             grant_table->tname,
                                             grant_column->column,
                                             grant_column->key_length,

sql/sql_cache.cc

@@ -3396,7 +3396,7 @@ Query_cache::register_tables_from_list(THD *thd, TABLE_LIST *tables_used,
       if (!insert_table(thd, key_length, key, (*block_table),
                         tables_used->view_db.length, 0,
                         HA_CACHE_TBL_NONTRANSACT, 0, 0, TRUE))
-        DBUG_RETURN(0);
+      goto err_cleanup;
       /*
         We do not need to register view tables here because they are already
         present in the global list.
@@ -3420,7 +3420,7 @@ Query_cache::register_tables_from_list(THD *thd, TABLE_LIST *tables_used,
                         tables_used->callback_func,
                         tables_used->engine_data,
                         TRUE))
-        DBUG_RETURN(0);
+      goto err_cleanup;
 
       if (tables_used->table->file->
           register_query_cache_dependant_tables(thd, this, block_table, &n))
@@ -3428,6 +3428,11 @@ Query_cache::register_tables_from_list(THD *thd, TABLE_LIST *tables_used,
     }
   }
   DBUG_RETURN(n - counter);
+err_cleanup:
+  // Mark failed
+  (*block_table)->next= (*block_table)->prev= NULL;
+  (*block_table)->parent= NULL;
+  DBUG_RETURN(0);
 }
 
 /*
@@ -3461,7 +3466,12 @@ my_bool Query_cache::register_all_tables(THD *thd,
     for (Query_cache_block_table *tmp = block->table(0) ;
 	 tmp != block_table;
 	 tmp++)
-      unlink_table(tmp);
+    {
+      if (tmp->prev) // not marked as failed and unuseable
+        unlink_table(tmp);
+      else
+        break;
+    }
     if (block_table->parent)
       unlink_table(block_table);
   }

sql/uniques.cc

@@ -318,6 +318,9 @@ double Unique::get_use_cost(uint *buffer, size_t nkeys, uint key_size,
   max_elements_in_tree= ((size_t) max_in_memory_size /
                          ALIGN_SIZE(sizeof(TREE_ELEMENT)+key_size));
 
+  if (max_elements_in_tree == 0)
+    max_elements_in_tree= 1;
+
   n_full_trees=    nkeys / max_elements_in_tree;
   last_tree_elems= nkeys % max_elements_in_tree;
 
@@ -786,7 +789,12 @@ bool Unique::get(TABLE *table)
   /* Not enough memory; Save the result to file && free memory used by tree */
   if (flush())
     DBUG_RETURN(1);
-  size_t buff_sz= (max_in_memory_size / full_size + 1) * full_size;
+  /*
+    merge_buffer must fit at least MERGEBUFF2 + 1 keys, because
+    merge_index() can merge that many BUFFPEKs at once. The extra space for
+    one key for Sort_param::unique_buff
+  */
+  size_t buff_sz= MY_MAX(MERGEBUFF2+1, max_in_memory_size/full_size+1) * full_size;
   if (!(sort_buffer= (uchar*) my_malloc(buff_sz,
                                         MYF(MY_THREAD_SPECIFIC|MY_WME))))
     DBUG_RETURN(1);