Merge lp:~stewart/percona-server/5.1.67 into lp:percona-server/5.1

[Stewart Smith]

Merge MySQL 5.1.67.

This will seemingly have to wait for MySQL 5.5.30 to be properly merged in as there are (again) changesets in 5.1 that aren't in 5.5.

This was mostly auto merge, apart from binlog quoting (which I reverted in the MySQL branch before merging) and minor bit in sql/log_event.cc

http://jenkins.percona.com/view/PS%205.1/job/percona-server-5.1-param/489/

[Laurynas Biveinis (laurynas-biveinis)]

review: Approve

[Laurynas Biveinis (laurynas-biveinis)]

Setting to WiP until https://code.launchpad.net/~stewart/percona-server/5.5.30/+merge/148984 is merged.

=== modified file 'Percona-Server/client/mysql.cc'
--- Percona-Server/client/mysql.cc	2013-01-10 04:35:31 +0000
+++ Percona-Server/client/mysql.cc	2013-01-10 04:35:33 +0000
@@ -250,6 +250,8 @@
 static char *get_arg(char *line, my_bool get_next_arg);
 static void init_username();
 static void add_int_to_prompt(int toadd);
+static int normalize_dbname(const char *line, char *buff, uint buff_size);
+static int get_quote_count(const char *line);
 
 /* A structure which contains information on the commands this program
    can understand. */
@@ -4172,8 +4174,23 @@
   int select_db;
 
   bzero(buff, sizeof(buff));
-  strmake(buff, line, sizeof(buff) - 1);
-  tmp= get_arg(buff, 0);
+
+  /*
+    In case number of quotes exceed 2, we try to get
+    the normalized db name.
+  */
+  if (get_quote_count(line) > 2)
+  {
+    if (normalize_dbname(line, buff, sizeof(buff)))
+      return put_error(&mysql);
+    tmp= buff;
+  }
+  else
+  {
+    strmake(buff, line, sizeof(buff) - 1);
+    tmp= get_arg(buff, 0);
+  }
+
   if (!tmp || !*tmp)
   {
     put_info("USE must be followed by a database name", INFO_ERROR);
@@ -4239,6 +4256,62 @@
   return 0;
 }
 
+/**
+  Normalize database name.
+
+  @param line [IN]          The command.
+  @param buff [OUT]         Normalized db name.
+  @param buff_size [IN]     Buffer size.
+
+  @return Operation status
+      @retval 0    Success
+      @retval 1    Failure
+
+  @note Sometimes server normilizes the database names
+        & APIs like mysql_select_db() expect normalized
+        database names. Since it is difficult to perform
+        the name conversion/normalization on the client
+        side, this function tries to get the normalized
+        dbname (indirectly) from the server.
+*/
+
+static int
+normalize_dbname(const char *line, char *buff, uint buff_size)
+{
+  MYSQL_RES *res= NULL;
+
+  /* Send the "USE db" commmand to the server. */
+  if (mysql_query(&mysql, line))
+    return 1;
+
+  /*
+    Now, get the normalized database name and store it
+    into the buff.
+  */
+  if (!mysql_query(&mysql, "SELECT DATABASE()") &&
+      (res= mysql_use_result(&mysql)))
+  {
+    MYSQL_ROW row= mysql_fetch_row(res);
+    if (row && row[0])
+    {
+      size_t len= strlen(row[0]);
+      /* Make sure there is enough room to store the dbname. */
+      if ((len > buff_size) || ! memcpy(buff, row[0], len))
+      {
+        mysql_free_result(res);
+        return 1;
+      }
+    }
+    mysql_free_result(res);
+  }
+
+  /* Restore the original database. */
+  if (current_db && mysql_select_db(&mysql, current_db))
+    return 1;
+
+  return 0;
+}
+
 static int
 com_warnings(String *buffer __attribute__((unused)),
    char *line __attribute__((unused)))
@@ -4318,6 +4391,20 @@
   return valid_arg ? start : NullS;
 }
 
+/*
+  Number of quotes present in the command's argument.
+*/
+static int
+get_quote_count(const char *line)
+{
+  int quote_count;
+  const char *ptr= line;
+
+  for(quote_count= 0; ptr ++ && *ptr; ptr= strpbrk(ptr, "\"\'`"))
+    quote_count ++;
+
+  return quote_count;
+}
 
 static int
 sql_real_connect(char *host,char *database,char *user,char *password,
 
=== modified file 'Percona-Server/configure.in'
--- Percona-Server/configure.in	2013-01-10 04:35:31 +0000
+++ Percona-Server/configure.in	2013-01-10 04:35:33 +0000
@@ -12,7 +12,7 @@
 dnl When changing the major version number please also check the switch
 dnl statement in mysqlbinlog::check_master_version().  You may also need
 dnl to update version.c in ndb.
-AC_INIT([MySQL Server], [5.1.66], [], [mysql])
+AC_INIT([MySQL Server], [5.1.67], [], [mysql])
 
 AC_CONFIG_SRCDIR([sql/mysqld.cc])
 AC_CANONICAL_SYSTEM
 
=== modified file 'Percona-Server/libmysql/libmysql.c'
--- Percona-Server/libmysql/libmysql.c	2012-08-20 00:29:22 +0000
+++ Percona-Server/libmysql/libmysql.c	2013-01-10 04:35:33 +0000
@@ -4653,7 +4653,7 @@
   if ((int) stmt->state < (int) MYSQL_STMT_FETCH_DONE)
   {
     set_stmt_error(stmt, CR_NO_DATA, unknown_sqlstate, NULL);
-    return 1;
+    DBUG_RETURN(1);
   }
   if (column >= stmt->field_count)
   {
 
=== renamed file 'Percona-Server/mysql-test/include/mysqlbinlog_row_engine.inc' => 'Percona-Server/mysql-test/extra/binlog_tests/mysqlbinlog_row_engine.inc'
=== modified file 'Percona-Server/mysql-test/r/ctype_ucs.result'
--- Percona-Server/mysql-test/r/ctype_ucs.result	2011-03-03 15:39:26 +0000
+++ Percona-Server/mysql-test/r/ctype_ucs.result	2013-01-10 04:35:33 +0000
@@ -191,6 +191,32 @@
   `r` varchar(10) CHARACTER SET ucs2 NOT NULL DEFAULT ''
 ) ENGINE=MyISAM DEFAULT CHARSET=latin1
 DROP TABLE t1;
+#
+# Bug #51876 : crash/memory underrun when loading data with ucs2 
+#   and reverse() function
+#
+# Problem # 1 (original report): wrong parsing of ucs2 data
+SELECT '00' UNION SELECT '10' INTO OUTFILE 'tmpp.txt';
+CREATE TABLE t1(a INT);
+LOAD DATA INFILE 'tmpp.txt' INTO TABLE t1 CHARACTER SET ucs2
+(@b) SET a=REVERSE(@b);
+# should return 2 zeroes (as the value is truncated)
+SELECT * FROM t1;
+a
+0
+1
+DROP TABLE t1;
+# Problem # 2 : if you write and read ucs2 data to a file they're lost
+SELECT '00' UNION SELECT '10' INTO OUTFILE 'tmpp2.txt' CHARACTER SET ucs2;
+CREATE TABLE t1(a INT);
+LOAD DATA INFILE 'tmpp2.txt' INTO TABLE t1 CHARACTER SET ucs2
+(@b) SET a=REVERSE(@b);
+# should return 0 and 1 (10 reversed)
+SELECT * FROM t1;
+a
+0
+1
+DROP TABLE t1;
 create table t2(f1 Char(30));
 insert into t2 values ("103000"), ("22720000"), ("3401200"), ("78000");
 select lpad(f1, 12, "-o-/") from t2;
 
=== modified file 'Percona-Server/mysql-test/r/loaddata.result'
--- Percona-Server/mysql-test/r/loaddata.result	2011-05-10 13:57:40 +0000
+++ Percona-Server/mysql-test/r/loaddata.result	2013-01-10 04:35:33 +0000
@@ -504,35 +504,6 @@
 LOAD DATA LOCAL INFILE 'tb.txt' INTO TABLE t1;
 DROP TABLE t1;
 #
-# Bug #51876 : crash/memory underrun when loading data with ucs2 
-#   and reverse() function
-#
-# Problem # 1 (original report): wrong parsing of ucs2 data
-SELECT '00' UNION SELECT '10' INTO OUTFILE 'tmpp.txt';
-CREATE TABLE t1(a INT);
-LOAD DATA INFILE 'tmpp.txt' INTO TABLE t1 CHARACTER SET ucs2
-(@b) SET a=REVERSE(@b);
-Warnings:
-Warning	1366	Incorrect integer value: '00' for column 'a' at row 1
-Warning	1366	Incorrect integer value: '10' for column 'a' at row 2
-# should return 2 zeroes (as the value is truncated)
-SELECT * FROM t1;
-a
-0
-0
-DROP TABLE t1;
-# Problem # 2 : if you write and read ucs2 data to a file they're lost
-SELECT '00' UNION SELECT '10' INTO OUTFILE 'tmpp2.txt' CHARACTER SET ucs2;
-CREATE TABLE t1(a INT);
-LOAD DATA INFILE 'tmpp2.txt' INTO TABLE t1 CHARACTER SET ucs2
-(@b) SET a=REVERSE(@b);
-# should return 0 and 1 (10 reversed)
-SELECT * FROM t1;
-a
-0
-1
-DROP TABLE t1;
-#
 # Bug#11765139  58069: LOAD DATA INFILE: VALGRIND REPORTS INVALID MEMORY READS AND WRITES WITH U
 #
 CREATE TABLE t1(f1 INT);
 
=== modified file 'Percona-Server/mysql-test/r/sp_notembedded.result'
--- Percona-Server/mysql-test/r/sp_notembedded.result	2012-03-28 06:35:31 +0000
+++ Percona-Server/mysql-test/r/sp_notembedded.result	2013-01-10 04:35:33 +0000
@@ -248,7 +248,6 @@
 DROP PROCEDURE p1;
 DELETE FROM mysql.user WHERE User='mysqltest_1';
 FLUSH PRIVILEGES;
-set @@global.concurrent_insert= @old_concurrent_insert;
 #
 # Bug#44521 Prepared Statement: CALL p() - crashes: `! thd->main_da.is_sent' failed et.al.
 #
@@ -302,3 +301,4 @@
 # ------------------------------------------------------------------
 # -- End of 5.1 tests
 # ------------------------------------------------------------------
+set @@global.concurrent_insert= @old_concurrent_insert;
 
=== renamed file 'Percona-Server/mysql-test/r/mysqlbinlog-cp932.result' => 'Percona-Server/mysql-test/suite/binlog/r/binlog_mysqlbinlog-cp932.result'
=== renamed file 'Percona-Server/mysql-test/r/mysqlbinlog2.result' => 'Percona-Server/mysql-test/suite/binlog/r/binlog_mysqlbinlog2.result'
=== renamed file 'Percona-Server/mysql-test/r/mysqlbinlog_base64.result' => 'Percona-Server/mysql-test/suite/binlog/r/binlog_mysqlbinlog_base64.result'
=== renamed file 'Percona-Server/mysql-test/r/mysqlbinlog_row.result' => 'Percona-Server/mysql-test/suite/binlog/r/binlog_mysqlbinlog_row.result'
=== renamed file 'Percona-Server/mysql-test/r/mysqlbinlog_row_innodb.result' => 'Percona-Server/mysql-test/suite/binlog/r/binlog_mysqlbinlog_row_innodb.result'
=== renamed file 'Percona-Server/mysql-test/r/mysqlbinlog_row_myisam.result' => 'Percona-Server/mysql-test/suite/binlog/r/binlog_mysqlbinlog_row_myisam.result'
=== renamed file 'Percona-Server/mysql-test/r/mysqlbinlog_row_trans.result' => 'Percona-Server/mysql-test/suite/binlog/r/binlog_mysqlbinlog_row_trans.result'
=== renamed file 'Percona-Server/mysql-test/t/mysqlbinlog-cp932-master.opt' => 'Percona-Server/mysql-test/suite/binlog/t/binlog_mysqlbinlog-cp932-master.opt'
=== renamed file 'Percona-Server/mysql-test/t/mysqlbinlog-cp932.test' => 'Percona-Server/mysql-test/suite/binlog/t/binlog_mysqlbinlog-cp932.test'
=== renamed file 'Percona-Server/mysql-test/t/mysqlbinlog2.test' => 'Percona-Server/mysql-test/suite/binlog/t/binlog_mysqlbinlog2.test'
=== renamed file 'Percona-Server/mysql-test/t/mysqlbinlog_base64.test' => 'Percona-Server/mysql-test/suite/binlog/t/binlog_mysqlbinlog_base64.test'
=== renamed file 'Percona-Server/mysql-test/t/mysqlbinlog_row.test' => 'Percona-Server/mysql-test/suite/binlog/t/binlog_mysqlbinlog_row.test'
=== renamed file 'Percona-Server/mysql-test/t/mysqlbinlog_row_innodb.test' => 'Percona-Server/mysql-test/suite/binlog/t/binlog_mysqlbinlog_row_innodb.test'
--- Percona-Server/mysql-test/t/mysqlbinlog_row_innodb.test	2008-08-20 14:06:31 +0000
+++ Percona-Server/mysql-test/suite/binlog/t/binlog_mysqlbinlog_row_innodb.test	2013-01-10 04:35:33 +0000
@@ -20,5 +20,5 @@
 --source include/have_binlog_format_row.inc
 --source include/have_ucs2.inc 
 
---source include/mysqlbinlog_row_engine.inc
+--source extra/binlog_tests/mysqlbinlog_row_engine.inc
 
 
=== renamed file 'Percona-Server/mysql-test/t/mysqlbinlog_row_myisam.test' => 'Percona-Server/mysql-test/suite/binlog/t/binlog_mysqlbinlog_row_myisam.test'
--- Percona-Server/mysql-test/t/mysqlbinlog_row_myisam.test	2008-08-20 14:06:31 +0000
+++ Percona-Server/mysql-test/suite/binlog/t/binlog_mysqlbinlog_row_myisam.test	2013-01-10 04:35:33 +0000
@@ -20,4 +20,4 @@
 --source include/have_binlog_format_row.inc
 --source include/have_ucs2.inc 
 
---source include/mysqlbinlog_row_engine.inc
+--source extra/binlog_tests/mysqlbinlog_row_engine.inc
 
=== renamed file 'Percona-Server/mysql-test/t/mysqlbinlog_row_trans.test' => 'Percona-Server/mysql-test/suite/binlog/t/binlog_mysqlbinlog_row_trans.test'
=== added file 'Percona-Server/mysql-test/suite/innodb/r/innodb_bug14704286.result'
--- Percona-Server/mysql-test/suite/innodb/r/innodb_bug14704286.result	1970-01-01 00:00:00 +0000
+++ Percona-Server/mysql-test/suite/innodb/r/innodb_bug14704286.result	2013-01-10 04:35:33 +0000
@@ -0,0 +1,53 @@
+use test;
+drop table if exists t1;
+create table t1 (id int primary key, value int, value2 int,
+value3 int, index(value,value2)) engine=innodb;
+insert into t1 values
+(10,10,10,10),(11,11,11,11),(12,12,12,12),(13,13,13,13),(14,14,14,14),
+(15,15,15,15),(16,16,16,16),(17,17,17,17),(18,18,18,18),(19,19,19,19),
+(20,20,20,20);
+use test;
+start transaction with consistent snapshot;
+use test;
+CREATE PROCEDURE update_t1()
+BEGIN
+DECLARE i INT DEFAULT 1;
+while (i <= 5000) DO
+update test.t1 set value2=value2+1, value3=value3+1 where id=12;
+SET i = i + 1;
+END WHILE;
+END|
+set autocommit=0;
+CALL update_t1();
+select * from t1;
+id	value	value2	value3
[phone]
[phone]
[phone]
[phone]
[phone]
[phone]
[phone]
[phone]
[phone]
[phone]
[phone]
+set autocommit=1;
+select * from t1;
+id	value	value2	value3
[phone]
[phone]
[phone]
[phone]
[phone]
[phone]
[phone]
[phone]
[phone]
[phone]
[phone]
+select * from t1 force index(value) where value=12;
+kill query @id;
+ERROR 70100: Query execution was interrupted
+drop procedure if exists update_t1;
+drop table if exists t1;
 
=== added file 'Percona-Server/mysql-test/suite/innodb/t/innodb_bug14704286.test'
--- Percona-Server/mysql-test/suite/innodb/t/innodb_bug14704286.test	1970-01-01 00:00:00 +0000
+++ Percona-Server/mysql-test/suite/innodb/t/innodb_bug14704286.test	2013-01-10 04:35:33 +0000
@@ -0,0 +1,95 @@
+--source include/have_innodb.inc
+
+#
+# create test-bed to run test
+#
+use test;
+--disable_warnings
+drop table if exists t1;
+--enable_warnings
+create table t1 (id int primary key, value int, value2 int,
+value3 int, index(value,value2)) engine=innodb;
+
+insert into t1 values
+(10,10,10,10),(11,11,11,11),(12,12,12,12),(13,13,13,13),(14,14,14,14),
+(15,15,15,15),(16,16,16,16),(17,17,17,17),(18,18,18,18),(19,19,19,19),
+(20,20,20,20);
+let $ID= `SELECT @id := CONNECTION_ID()`;
+
+#
+# we need multiple connections as we need to keep one connection
+# active with trx requesting consistent read.
+#
+connect (conn1, localhost, root,,);
+connect (conn2, localhost, root,,);
+connect (conn3, localhost, root,,);
+
+#
+# start trx with consistent read
+#
+connection conn1;
+use test;
+
+start transaction with consistent snapshot;
+
+#
+# update table such that secondary index is updated.
+#
+connection conn2;
+use test;
+delimiter |;
+CREATE PROCEDURE update_t1()
+BEGIN
+	DECLARE i INT DEFAULT 1;
+	while (i <= 5000) DO
+		update test.t1 set value2=value2+1, value3=value3+1 where id=12;
+		SET i = i + 1;
+	END WHILE;
+END|
+
+delimiter ;|
+set autocommit=0;
+CALL update_t1();
+select * from t1;
+set autocommit=1;
+select * from t1;
+
+#
+# Now try to fire select query from connection-1 enforcing
+# use of secondary index.
+#
+connection conn1;
+let $ID= `SELECT @id := CONNECTION_ID()`;
+#--error ER_QUERY_INTERRUPTED
+--send
+select * from t1 force index(value) where value=12;
+
+#
+# select is going to take good time so let's kill query.
+#
+connection conn3;
+let $wait_condition=
+	select * from information_schema.processlist where state = 'Sending data' and
+	info = 'select * from t1 force index(value) where value=12';
+--source include/wait_condition.inc
+let $ignore= `SELECT @id := $ID`;
+kill query @id;
+
+#
+# reap the value of connection-1
+#
+connection conn1;
+--error ER_QUERY_INTERRUPTED
+reap;
+
+#
+# clean test-bed.
+#
+connection default;
+disconnect conn1;
+disconnect conn2;
+disconnect conn3;
+drop procedure if exists update_t1;
+drop table if exists t1;
+
+
 
=== modified file 'Percona-Server/mysql-test/t/ctype_ucs.test'
--- Percona-Server/mysql-test/t/ctype_ucs.test	2011-03-03 15:39:26 +0000
+++ Percona-Server/mysql-test/t/ctype_ucs.test	2013-01-10 04:35:33 +0000
@@ -68,6 +68,38 @@
 SHOW CREATE TABLE t1;
 DROP TABLE t1;
 
+--echo #
+--echo # Bug #51876 : crash/memory underrun when loading data with ucs2 
+--echo #   and reverse() function
+--echo #
+
+--echo # Problem # 1 (original report): wrong parsing of ucs2 data
+SELECT '00' UNION SELECT '10' INTO OUTFILE 'tmpp.txt';
+CREATE TABLE t1(a INT);
+LOAD DATA INFILE 'tmpp.txt' INTO TABLE t1 CHARACTER SET ucs2
+(@b) SET a=REVERSE(@b);
+--echo # should return 2 zeroes (as the value is truncated)
+SELECT * FROM t1;
+
+DROP TABLE t1;
+let $MYSQLD_DATADIR= `select @@datadir`;
+remove_file $MYSQLD_DATADIR/test/tmpp.txt;
+
+
+--echo # Problem # 2 : if you write and read ucs2 data to a file they're lost
+SELECT '00' UNION SELECT '10' INTO OUTFILE 'tmpp2.txt' CHARACTER SET ucs2;
+CREATE TABLE t1(a INT);
+LOAD DATA INFILE 'tmpp2.txt' INTO TABLE t1 CHARACTER SET ucs2
+(@b) SET a=REVERSE(@b);
+--echo # should return 0 and 1 (10 reversed)
+SELECT * FROM t1;
+
+DROP TABLE t1;
+let $MYSQLD_DATADIR= `select @@datadir`;
+remove_file $MYSQLD_DATADIR/test/tmpp2.txt;
+
+
+
 #
 # BUG3946
 #
 
=== modified file 'Percona-Server/mysql-test/t/loaddata.test'
--- Percona-Server/mysql-test/t/loaddata.test	2011-11-24 02:00:56 +0000
+++ Percona-Server/mysql-test/t/loaddata.test	2013-01-10 04:35:33 +0000
@@ -580,36 +580,40 @@
 connection default;
 disconnect con1;
 
-
---echo #
---echo # Bug #51876 : crash/memory underrun when loading data with ucs2 
---echo #   and reverse() function
---echo #
-
---echo # Problem # 1 (original report): wrong parsing of ucs2 data
-SELECT '00' UNION SELECT '10' INTO OUTFILE 'tmpp.txt';
-CREATE TABLE t1(a INT);
-LOAD DATA INFILE 'tmpp.txt' INTO TABLE t1 CHARACTER SET ucs2
-(@b) SET a=REVERSE(@b);
---echo # should return 2 zeroes (as the value is truncated)
-SELECT * FROM t1;
-
-DROP TABLE t1;
-let $MYSQLD_DATADIR= `select @@datadir`;
-remove_file $MYSQLD_DATADIR/test/tmpp.txt;
-
-
---echo # Problem # 2 : if you write and read ucs2 data to a file they're lost
-SELECT '00' UNION SELECT '10' INTO OUTFILE 'tmpp2.txt' CHARACTER SET ucs2;
-CREATE TABLE t1(a INT);
-LOAD DATA INFILE 'tmpp2.txt' INTO TABLE t1 CHARACTER SET ucs2
-(@b) SET a=REVERSE(@b);
---echo # should return 0 and 1 (10 reversed)
-SELECT * FROM t1;
-
-DROP TABLE t1;
-let $MYSQLD_DATADIR= `select @@datadir`;
-remove_file $MYSQLD_DATADIR/test/tmpp2.txt;
+#############################################################################
+#           The below protion is moved to ctype_ucs.test                    #
+#############################################################################
+#--echo #
+#--echo # Bug #51876 : crash/memory underrun when loading data with ucs2 
+#--echo #   and reverse() function
+#--echo #
+
+#--echo # Problem # 1 (original report): wrong parsing of ucs2 data
+#SELECT '00' UNION SELECT '10' INTO OUTFILE 'tmpp.txt';
+#CREATE TABLE t1(a INT);
+#LOAD DATA INFILE 'tmpp.txt' INTO TABLE t1 CHARACTER SET ucs2
+#(@b) SET a=REVERSE(@b);
+#--echo # should return 2 zeroes (as the value is truncated)
+#SELECT * FROM t1;
+
+#DROP TABLE t1;
+#let $MYSQLD_DATADIR= `select @@datadir`;
+#remove_file $MYSQLD_DATADIR/test/tmpp.txt;
+
+
+#--echo # Problem # 2 : if you write and read ucs2 data to a file they're lost
+#SELECT '00' UNION SELECT '10' INTO OUTFILE 'tmpp2.txt' CHARACTER SET ucs2;
+#CREATE TABLE t1(a INT);
+#LOAD DATA INFILE 'tmpp2.txt' INTO TABLE t1 CHARACTER SET ucs2
+#(@b) SET a=REVERSE(@b);
+#--echo # should return 0 and 1 (10 reversed)
+#SELECT * FROM t1;
+
+#DROP TABLE t1;
+#let $MYSQLD_DATADIR= `select @@datadir`;
+#remove_file $MYSQLD_DATADIR/test/tmpp2.txt;
+######################################################################################
+
 
 --echo #
 --echo # Bug#11765139  58069: LOAD DATA INFILE: VALGRIND REPORTS INVALID MEMORY READS AND WRITES WITH U
 
=== modified file 'Percona-Server/mysql-test/t/sp_notembedded.test'
--- Percona-Server/mysql-test/t/sp_notembedded.test	2012-03-28 06:35:31 +0000
+++ Percona-Server/mysql-test/t/sp_notembedded.test	2013-01-10 04:35:33 +0000
@@ -371,16 +371,6 @@
 FLUSH PRIVILEGES;
 
 
-#
-# Restore global concurrent_insert value. Keep in the end of the test file.
-#
-
-set @@global.concurrent_insert= @old_concurrent_insert;
-
-# Wait till all disconnects are completed
---source include/wait_until_count_sessions.inc
-
-
 --echo #
 --echo # Bug#44521 Prepared Statement: CALL p() - crashes: `! thd->main_da.is_sent' failed et.al.
 --echo #
@@ -476,3 +466,13 @@
 --echo # ------------------------------------------------------------------
 --echo # -- End of 5.1 tests
 --echo # ------------------------------------------------------------------
+
+
+#
+# Restore global concurrent_insert value. Keep in the end of the test file.
+#
+
+set @@global.concurrent_insert= @old_concurrent_insert;
+
+# Wait till all disconnects are completed
+--source include/wait_until_count_sessions.inc
 
=== modified file 'Percona-Server/scripts/mysql_install_db.pl.in'
--- Percona-Server/scripts/mysql_install_db.pl.in	2012-02-15 16:21:38 +0000
+++ Percona-Server/scripts/mysql_install_db.pl.in	2013-01-10 04:35:33 +0000
@@ -423,10 +423,11 @@
                                             "--bootstrap",
                                             "--basedir=$opt->{basedir}",
                                             "--datadir=$opt->{ldata}",
-                                            "--skip-innodb",
-                                            "--skip-bdb",
-                                            "--skip-ndbcluster",
+                                            "--log-warnings=0",
+                                            "--loose-skip-innodb",
+                                            "--loose-skip-ndbcluster",
                                             "--max_allowed_packet=8M",
+                                            "--default-storage-engine=MyISAM",
                                             "--net_buffer_length=16K",
                                             @args,
                                           );
@@ -439,6 +440,8 @@
 
 open(SQL, $create_system_tables)
   or error($opt,"can't open $create_system_tables for reading: $!");
+open(SQL2, $fill_system_tables)
+  or error($opt,"can't open $fill_system_tables for reading: $!");
 # FIXME  > /dev/null ?
 if ( open(PIPE, "| $mysqld_install_cmd_line") )
 {
@@ -452,8 +455,20 @@
 
     print PIPE $_;
   }
+  while ( <SQL2> )
+  {
+    # TODO: make it similar to the above condition when we're sure 
+    #   @@hostname returns a fqdn
+    # When doing a "cross bootstrap" install, no reference to the current
+    # host should be added to the system tables.  So we filter out any
+    # lines which contain the current host name.
+    next if /\@current_hostname/;
+
+    print PIPE $_;
+  }
   close PIPE;
   close SQL;
+  close SQL2;
 
   report_verbose($opt,"OK");
 
 
=== modified file 'Percona-Server/scripts/mysqld_multi.sh'
--- Percona-Server/scripts/mysqld_multi.sh	2011-06-30 15:37:13 +0000
+++ Percona-Server/scripts/mysqld_multi.sh	2013-01-10 04:35:33 +0000
@@ -47,6 +47,28 @@
 $my_progname = $0;
 $my_progname =~ s/.*[\/]//;
 
+
+if (defined($ENV{UMASK})) {
+  my $UMASK = $ENV{UMASK};
+  my $m;
+  my $fmode = "0640";
+
+  if(($UMASK =~ m/[^0246]/) || ($UMASK =~ m/^[^0]/) || (length($UMASK) != 4)) {
+    printf("UMASK must be a 3-digit mode with an additional leading 0 to indicate octal.\n");
+    printf("The first digit will be corrected to 6, the others may be 0, 2, 4, or 6.\n"); }
+  else {
+    $fmode= substr $UMASK, 2, 2;
+    $fmode= "06${fmode}"; }
+
+  if($fmode != $UMASK) {
+    printf("UMASK corrected from $UMASK to $fmode ...\n"); }
+
+  $fmode= oct($fmode);
+
+  umask($fmode);
+}
+
+
 main();
 
 ####
 
=== modified file 'Percona-Server/scripts/mysqld_safe.sh'
--- Percona-Server/scripts/mysqld_safe.sh	2010-04-09 11:47:18 +0000
+++ Percona-Server/scripts/mysqld_safe.sh	2013-01-10 04:35:33 +0000
@@ -27,7 +27,28 @@
 
 trap '' 1 2 3 15			# we shouldn't let anyone kill us
 
-umask 007
+# MySQL-specific environment variable. First off, it's not really a umask,
+# it's the desired mode. Second, it follows umask(2), not umask(3) in that
+# octal needs to be explicit. Our shell might be a proper sh without printf,
+# multiple-base arithmetic, and binary arithmetic, so this will get ugly.
+# We reject decimal values to keep things at least half-sane.
+umask 007                               # fallback
+UMASK="${UMASK-0640}"
+fmode=`echo "$UMASK" | sed -e 's/[^0246]//g'`
+octalp=`echo "$fmode"|cut -c1`
+fmlen=`echo "$fmode"|wc -c|sed -e 's/ //g'`
+if [ "x$octalp" != "x0" -o "x$UMASK" != "x$fmode" -o "x$fmlen" != "x5" ]
+then
+  fmode=0640
+  echo "UMASK must be a 3-digit mode with an additional leading 0 to indicate octal." >&2
+  echo "The first digit will be corrected to 6, the others may be 0, 2, 4, or 6." >&2
+fi
+fmode=`echo "$fmode"|cut -c3-4`
+fmode="6$fmode"
+if [ "x$UMASK" != "x0$fmode" ]
+then
+  echo "UMASK corrected from $UMASK to 0$fmode ..."
+fi
 
 defaults=
 case "$1" in
@@ -371,6 +392,12 @@
   # Log to err_log file
   log_notice "Logging to '$err_log'."
   logging=file
+
+  if [ ! -e "$err_log" ]; then                  # if error log already exists,
+    touch "$err_log"                            # we just append. otherwise,
+    chmod "$fmode" "$err_log"                   # fix the permissions here!
+  fi
+
 else
   if [ -n "$syslog_tag" ]
   then
@@ -572,6 +599,12 @@
 
   eval_log_error "$cmd"
 
+  if [ $want_syslog -eq 0 -a ! -e "$err_log" ]; then
+    touch "$err_log"                    # hypothetical: log was renamed but not
+    chown $user "$err_log"              # flushed yet. we'd recreate it with
+    chmod "$fmode" "$err_log"           # wrong owner next time we log, so set
+  fi                                    # it up correctly while we can!
+
   if test ! -f "$pid_file"		# This is removed if normal shutdown
   then
     break
 
=== modified file 'Percona-Server/sql/hostname.cc'
--- Percona-Server/sql/hostname.cc	2012-06-19 07:26:40 +0000
+++ Percona-Server/sql/hostname.cc	2013-01-10 04:35:33 +0000
@@ -214,6 +214,15 @@
   }
   my_gethostbyname_r_free();
 #else
+
+  DBUG_EXECUTE_IF("addr_fake_ipv4",
+                  {
+                    const char* fake_host= "santa.claus.ipv4.example.com";
+                    name=my_strdup(fake_host, MYF(0));
+                    add_hostname(in,name);
+                    DBUG_RETURN(name);
+                  };);
+
   VOID(pthread_mutex_lock(&LOCK_hostname));
   if (!(hp=gethostbyaddr((char*) in,sizeof(*in), AF_INET)))
   {
 
=== modified file 'Percona-Server/sql/item_cmpfunc.cc'
--- Percona-Server/sql/item_cmpfunc.cc	2011-07-03 15:47:37 +0000
+++ Percona-Server/sql/item_cmpfunc.cc	2013-01-10 04:35:33 +0000
@@ -1,4 +1,4 @@
-/* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
+/* Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -3045,6 +3045,15 @@
           return;
       }
     }
+    /*
+      Set cmp_context of all WHEN arguments. This prevents
+      Item_field::equal_fields_propagator() from transforming a
+      zerofill argument into a string constant. Such a change would
+      require rebuilding cmp_items.
+    */
+    for (i= 0; i < ncases; i+= 2)
+      args[i]->cmp_context= item_cmp_type(left_result_type,
+                                          args[i]->result_type());
   }
 
   if (else_expr_num == -1 || args[else_expr_num]->maybe_null)
@@ -4032,6 +4041,16 @@
       }
     }
   }
+  /*
+    Set cmp_context of all arguments. This prevents
+    Item_field::equal_fields_propagator() from transforming a zerofill integer
+    argument into a string constant. Such a change would require rebuilding
+    cmp_itmes.
+   */
+  for (arg= args + 1, arg_end= args + arg_count; arg != arg_end ; arg++)
+  {
+    arg[0]->cmp_context= item_cmp_type(left_result_type, arg[0]->result_type());
+  }
   max_length= 1;
 }
 
 
=== modified file 'Percona-Server/sql/item_func.cc'
--- Percona-Server/sql/item_func.cc	2012-10-05 07:20:04 +0000
+++ Percona-Server/sql/item_func.cc	2013-01-10 04:35:33 +0000
@@ -3596,7 +3596,8 @@
     thd->first_successful_insert_id_in_prev_stmt= value;
     return value;
   }
-  return thd->read_first_successful_insert_id_in_prev_stmt();
+  return
+    static_cast<longlong>(thd->read_first_successful_insert_id_in_prev_stmt());
 }
 
 
 
=== modified file 'Percona-Server/sql/item_func.h'
--- Percona-Server/sql/item_func.h	2012-10-05 07:20:04 +0000
+++ Percona-Server/sql/item_func.h	2013-01-10 04:35:33 +0000
@@ -1043,6 +1043,7 @@
   const char *func_name() const { return "last_insert_id"; }
   void fix_length_and_dec()
   {
+    unsigned_flag= TRUE;
     if (arg_count)
       max_length= args[0]->max_length;
   }
 
=== modified file 'Percona-Server/sql/log.cc'
--- Percona-Server/sql/log.cc	2013-01-03 00:03:10 +0000
+++ Percona-Server/sql/log.cc	2013-01-10 04:35:33 +0000
@@ -4448,10 +4448,16 @@
     /*
       Write pending event to log file or transaction cache
     */
+    DBUG_EXECUTE_IF("simulate_disk_full_at_flush_pending",
+                    {DBUG_SET("+d,simulate_file_write_error");});
     if (pending->write(file))
     {
       pthread_mutex_unlock(&LOCK_log);
       set_write_error(thd);
+      delete pending;
+      trx_data->set_pending(NULL);
+      DBUG_EXECUTE_IF("simulate_disk_full_at_flush_pending",
+                    {DBUG_SET("-d,simulate_file_write_error");});
       DBUG_RETURN(1);
     }
 
 
=== modified file 'Percona-Server/sql/log_event.cc'
--- Percona-Server/sql/log_event.cc	2012-12-30 12:35:56 +0000
+++ Percona-Server/sql/log_event.cc	2013-01-10 04:35:33 +0000
@@ -54,6 +54,22 @@
 */
 #define FMT_G_BUFSIZE(PREC) (3 + (PREC) + 5 + 1)
 
+/*
+  Explicit instantiation to unsigned int of template available_buffer
+  function.
+*/
+template unsigned int available_buffer<unsigned int>(const char*,
+                                                     const char*,
+                                                     unsigned int);
+
+/*
+  Explicit instantiation to unsigned int of template valid_buffer_range
+  function.
+*/
+template bool valid_buffer_range<unsigned int>(unsigned int,
+                                               const char*,
+                                               const char*,
+                                               unsigned int);
 
 #if !defined(MYSQL_CLIENT) && defined(HAVE_REPLICATION)
 static int rows_event_stmt_cleanup(Relay_log_info const *rli, THD* thd);
@@ -1286,7 +1302,7 @@
       ev = new Rand_log_event(buf, description_event);
       break;
     case USER_VAR_EVENT:
-      ev = new User_var_log_event(buf, description_event);
+      ev = new User_var_log_event(buf, event_len, description_event);
       break;
     case FORMAT_DESCRIPTION_EVENT:
       ev = new Format_description_log_event(buf, event_len, description_event);
@@ -5755,18 +5771,34 @@
 
 
 User_var_log_event::
-User_var_log_event(const char* buf,
+User_var_log_event(const char* buf, uint event_len,
                    const Format_description_log_event* description_event)
   :Log_event(buf, description_event)
 #ifndef MYSQL_CLIENT
   , deferred(false)
 #endif
 {
+  bool error= false;
+  const char* buf_start= buf;
   /* The Post-Header is empty. The Variable Data part begins immediately. */
   buf+= description_event->common_header_len +
     description_event->post_header_len[USER_VAR_EVENT-1];
   name_len= uint4korr(buf);
   name= (char *) buf + UV_NAME_LEN_SIZE;
+
+  /*
+    We don't know yet is_null value, so we must assume that name_len
+    may have the bigger value possible, is_null= True and there is no
+    payload for val.
+  */
+  if (0 == name_len ||
+      !valid_buffer_range<uint>(name_len, buf_start, name,
+                                event_len - UV_VAL_IS_NULL))
+  {
+    error= true;
+    goto err;
+  }
+
   buf+= UV_NAME_LEN_SIZE + name_len;
   is_null= (bool) *buf;
   if (is_null)
@@ -5778,13 +5810,31 @@
   }
   else
   {
+    if (!valid_buffer_range<uint>(UV_VAL_IS_NULL + UV_VAL_TYPE_SIZE
+                                  + UV_CHARSET_NUMBER_SIZE + UV_VAL_LEN_SIZE,
+                                  buf_start, buf, event_len))
+    {
+      error= true;
+      goto err;
+    }
+
     type= (Item_result) buf[UV_VAL_IS_NULL];
     charset_number= uint4korr(buf + UV_VAL_IS_NULL + UV_VAL_TYPE_SIZE);
     val_len= uint4korr(buf + UV_VAL_IS_NULL + UV_VAL_TYPE_SIZE + 
 		       UV_CHARSET_NUMBER_SIZE);
     val= (char *) (buf + UV_VAL_IS_NULL + UV_VAL_TYPE_SIZE +
 		   UV_CHARSET_NUMBER_SIZE + UV_VAL_LEN_SIZE);
+
+    if (!valid_buffer_range<uint>(val_len, buf_start, val, event_len))
+    {
+      error= true;
+      goto err;
+    }
   }
+
+err:
+  if (error)
+    name= 0;
 }
 
 
@@ -5931,8 +5981,9 @@
       char *hex_str;
       CHARSET_INFO *cs;
 
-      if (!(hex_str= (char *)my_alloca(2*val_len+1+2))) // 2 hex digits / byte
-        break; // no error, as we are 'void'
+      hex_str= (char *)my_malloc(2*val_len+1+2,MYF(MY_WME)); // 2 hex digits / byte
+      if (!hex_str)
+        return;
       str_to_hex(hex_str, val, val_len);
       /*
         For proper behaviour when mysqlbinlog|mysql, we need to explicitely
 
=== modified file 'Percona-Server/sql/log_event.h'
--- Percona-Server/sql/log_event.h	2013-01-10 04:35:31 +0000
+++ Percona-Server/sql/log_event.h	2013-01-10 04:35:33 +0000
@@ -2517,7 +2517,7 @@
   void print(FILE* file, PRINT_EVENT_INFO* print_event_info);
 #endif
 
-  User_var_log_event(const char* buf,
+  User_var_log_event(const char* buf, uint event_len,
                      const Format_description_log_event *description_event);
   ~User_var_log_event() {}
   Log_event_type get_type_code() { return USER_VAR_EVENT;}
@@ -2529,9 +2529,9 @@
      and which case the applier adjusts execution path.
   */
   bool is_deferred() { return deferred; }
-  void set_deferred() { deferred= val; }
+  void set_deferred() { deferred= true; }
 #endif
-  bool is_valid() const { return 1; }
+  bool is_valid() const { return name != 0; }
 
 private:
 #if !defined(MYSQL_CLIENT) && defined(HAVE_REPLICATION)
 
=== modified file 'Percona-Server/sql/mysql_priv.h'
--- Percona-Server/sql/mysql_priv.h	2012-10-05 07:20:04 +0000
+++ Percona-Server/sql/mysql_priv.h	2013-01-10 04:35:33 +0000
@@ -505,6 +505,41 @@
 */
 #define MAX_TIME_ZONE_NAME_LENGTH       (NAME_LEN + 1)
 
+/*
+  Check how many bytes are available on buffer.
+
+  @param buf_start    Pointer to buffer start.
+  @param buf_current  Pointer to the current position on buffer.
+  @param buf_len      Buffer length.
+
+  @return             Number of bytes available on event buffer.
+*/
+template <class T> T available_buffer(const char* buf_start,
+                                      const char* buf_current,
+                                      T buf_len)
+{
+  return buf_len - (buf_current - buf_start);
+}
+
+/*
+  Check if jump value is within buffer limits.
+
+  @param jump         Number of positions we want to advance.
+  @param buf_start    Pointer to buffer start
+  @param buf_current  Pointer to the current position on buffer.
+  @param buf_len      Buffer length.
+
+  @return      True   If jump value is within buffer limits.
+               False  Otherwise.
+*/
+template <class T> bool valid_buffer_range(T jump,
+                                           const char* buf_start,
+                                           const char* buf_current,
+                                           T buf_len)
+{
+  return (jump <= available_buffer(buf_start, buf_current, buf_len));
+}
+
 /* The rest of the file is included in the server only */
 #ifndef MYSQL_CLIENT
 
 
=== modified file 'Percona-Server/sql/mysqld.cc'
--- Percona-Server/sql/mysqld.cc	2013-01-10 04:35:31 +0000
+++ Percona-Server/sql/mysqld.cc	2013-01-10 04:35:33 +0000
@@ -4981,7 +4981,7 @@
   if (cached_thread_count > wake_thread)
   {
     /* Get thread from cache */
-    thread_cache.append(thd);
+    thread_cache.push_back(thd);
     wake_thread++;
     pthread_cond_signal(&COND_thread_cache);
   }
 
=== modified file 'Percona-Server/sql/sp_head.cc'
--- Percona-Server/sql/sp_head.cc	2012-10-15 15:08:07 +0000
+++ Percona-Server/sql/sp_head.cc	2013-01-10 04:35:33 +0000
@@ -3860,8 +3860,6 @@
     Multi-set key:
       db_name\0table_name\0alias\0 - for normal tables
       db_name\0table_name\0        - for temporary tables
-    Note that in both cases we don't take last '\0' into account when
-    we count length of key.
   */
   LEX_STRING qname;
   uint db_length, table_name_length;
@@ -3918,19 +3916,26 @@
   for (; table ; table= table->next_global)
     if (!table->derived && !table->schema_table)
     {
-      char tname[(NAME_LEN + 1) * 3];           // db\0table\0alias\0
-      uint tlen, alen;
+      /*
+        Structure of key for the multi-set is "db\0table\0alias\0".
+        Since "alias" part can have arbitrary length we use String
+        object to construct the key. By default String will use
+        buffer allocated on stack with NAME_LEN bytes reserved for
+        alias, since in most cases it is going to be smaller than
+        NAME_LEN bytes.
+      */
+      char tname_buff[(NAME_LEN + 1) * 3];
+      String tname(tname_buff, sizeof(tname_buff), &my_charset_bin);
+      uint temp_table_key_length;
 
-      tlen= table->db_length;
-      memcpy(tname, table->db, tlen);
-      tname[tlen++]= '\0';
-      memcpy(tname+tlen, table->table_name, table->table_name_length);
-      tlen+= table->table_name_length;
-      tname[tlen++]= '\0';
-      alen= strlen(table->alias);
-      memcpy(tname+tlen, table->alias, alen);
-      tlen+= alen;
-      tname[tlen]= '\0';
+      tname.length(0);
+      tname.append(table->db, table->db_length);
+      tname.append('\0');
+      tname.append(table->table_name, table->table_name_length);
+      tname.append('\0');
+      temp_table_key_length= tname.length();
+      tname.append(table->alias);
+      tname.append('\0');
 
       /*
         Upgrade the lock type because this table list will be used
@@ -3945,9 +3950,10 @@
         (and therefore should not be prelocked). Otherwise we will erroneously
         treat table with same name but with different alias as non-temporary.
       */
-      if ((tab= (SP_TABLE *)hash_search(&m_sptabs, (uchar *)tname, tlen)) ||
-          ((tab= (SP_TABLE *)hash_search(&m_sptabs, (uchar *)tname,
-                                        tlen - alen - 1)) &&
+      if ((tab= (SP_TABLE *)hash_search(&m_sptabs, (uchar *)tname.ptr(),
+                                        tname.length())) ||
+          ((tab= (SP_TABLE *)hash_search(&m_sptabs, (uchar *)tname.ptr(),
+                                         temp_table_key_length)) &&
            tab->temp))
       {
         if (tab->lock_type < table->lock_type)
@@ -3966,11 +3972,11 @@
 	    lex_for_tmp_check->create_info.options & HA_LEX_CREATE_TMP_TABLE)
         {
 	  tab->temp= TRUE;
-          tab->qname.length= tlen - alen - 1;
+          tab->qname.length= temp_table_key_length;
         }
         else
-          tab->qname.length= tlen;
-        tab->qname.str= (char*) thd->memdup(tname, tab->qname.length + 1);
+          tab->qname.length= tname.length();
+        tab->qname.str= (char*) thd->memdup(tname.ptr(), tab->qname.length);
         if (!tab->qname.str)
           return FALSE;
         tab->table_name_length= table->table_name_length;
@@ -4039,7 +4045,7 @@
     if (!(tab_buff= (char *)thd->calloc(ALIGN_SIZE(sizeof(TABLE_LIST)) *
                                         stab->lock_count)) ||
         !(key_buff= (char*)thd->memdup(stab->qname.str,
-                                       stab->qname.length + 1)))
+                                       stab->qname.length)))
       DBUG_RETURN(FALSE);
 
     for (uint j= 0; j < stab->lock_count; j++)
 
=== modified file 'Percona-Server/sql/sql_acl.cc'
--- Percona-Server/sql/sql_acl.cc	2012-11-28 22:39:45 +0000
+++ Percona-Server/sql/sql_acl.cc	2013-01-10 04:35:33 +0000
@@ -195,7 +195,17 @@
 static my_bool acl_load(THD *thd, TABLE_LIST *tables);
 static my_bool grant_load(THD *thd, TABLE_LIST *tables);
 static inline void get_grantor(THD *thd, char* grantor);
-
+/*
+ Enumeration of various ACL's and Hashes used in handle_grant_struct()
+*/
+enum enum_acl_lists
+{
+  USER_ACL= 0,
+  DB_ACL,
+  COLUMN_PRIVILEGES_HASH,
+  PROC_PRIVILEGES_HASH,
+  FUNC_PRIVILEGES_HASH
+};
 /*
   Convert scrambled password to binary form, according to scramble type, 
   Binary form is stored in user.salt.
@@ -1346,10 +1356,19 @@
 {
   ulong host_access= ~(ulong)0, db_access= 0;
   uint i;
-  size_t key_length;
+  size_t key_length, copy_length;
   char key[ACL_KEY_LENGTH],*tmp_db,*end;
   acl_entry *entry;
   DBUG_ENTER("acl_get");
+  
+  copy_length= (size_t) (strlen(ip ? ip : "") +
+                 strlen(user ? user : "") +
+                 strlen(db ? db : ""));
+  /*
+    Make sure that strmov() operations do not result in buffer overflow.
+  */
+  if (copy_length >= ACL_KEY_LENGTH)
+    DBUG_RETURN(0);
 
   tmp_db= strmov(strmov(key, ip ? ip : "") + 1, user) + 1;
   end= strnmov(tmp_db, db, key + sizeof(key) - tmp_db);
@@ -4336,6 +4355,16 @@
   char helping [NAME_LEN+USERNAME_LENGTH+2], *end;
   uint len;
   bool error= TRUE;
+  size_t copy_length;
+
+  copy_length= (size_t) (strlen(sctx->priv_user ? sctx->priv_user : "") +
+                 strlen(db ? db : ""));
+
+  /*
+    Make sure that strmov() operations do not result in buffer overflow.
+  */
+  if (copy_length >= (NAME_LEN+USERNAME_LENGTH+2))
+    return 1;
 
   end= strmov(helping, sctx->priv_user) + 1;
   end= strnmov(end, db, helping + sizeof(helping) - end);
@@ -5402,19 +5431,19 @@
     Delete from grant structure if drop is true.
     Update in grant structure if drop is false and user_to is not NULL.
     Search in grant structure if drop is false and user_to is NULL.
-    Structures are numbered as follows:
-    0 acl_users
-    1 acl_dbs
-    2 column_priv_hash
-    3 proc_priv_hash
-    4 func_priv_hash
+    Structures are enumerated as follows:
+    0 ACL_USER
+    1 ACL_DB
+    2 COLUMN_PRIVILEGES_HASH
+    3 PROC_PRIVILEGES_HASH
+    4 FUNC_PRIVILEGES_HASH
 
   @retval > 0  At least one element matched.
   @retval 0    OK, but no element matched.
-  @retval -1   Wrong arguments to function.
+  @retval -1   Wrong arguments to function or Out of Memory
 */
 
-static int handle_grant_struct(uint struct_no, bool drop,
+static int handle_grant_struct(enum enum_acl_lists struct_no, bool drop,
                                LEX_USER *user_from, LEX_USER *user_to)
 {
   int result= 0;
@@ -5425,6 +5454,11 @@
   ACL_USER *acl_user= NULL;
   ACL_DB *acl_db= NULL;
   GRANT_NAME *grant_name= NULL;
+  /*
+    Dynamic array acl_grant_name used to store pointers to all
+    GRANT_NAME objects
+  */
+  Dynamic_array<GRANT_NAME *> acl_grant_name;
   HASH *grant_name_hash= NULL;
   DBUG_ENTER("handle_grant_struct");
   DBUG_PRINT("info",("scan struct: %u  search: '%s'@'%s'",
@@ -5437,21 +5471,21 @@
 
   /* Get the number of elements in the in-memory structure. */
   switch (struct_no) {
-  case 0:
+  case USER_ACL:
     elements= acl_users.elements;
     break;
-  case 1:
+  case DB_ACL:
     elements= acl_dbs.elements;
     break;
-  case 2:
+  case COLUMN_PRIVILEGES_HASH:
     elements= column_priv_hash.records;
     grant_name_hash= &column_priv_hash;
     break;
-  case 3:
+  case PROC_PRIVILEGES_HASH:
     elements= proc_priv_hash.records;
     grant_name_hash= &proc_priv_hash;
     break;
-  case 4:
+  case FUNC_PRIVILEGES_HASH:
     elements= func_priv_hash.records;
     grant_name_hash= &func_priv_hash;
     break;
@@ -5470,21 +5504,21 @@
       Get a pointer to the element.
     */
     switch (struct_no) {
-    case 0:
+    case USER_ACL:
       acl_user= dynamic_element(&acl_users, idx, ACL_USER*);
       user= acl_user->user;
       host= acl_user->host.hostname;
     break;
 
-    case 1:
+    case DB_ACL:
       acl_db= dynamic_element(&acl_dbs, idx, ACL_DB*);
       user= acl_db->user;
       host= acl_db->host.hostname;
       break;
 
-    case 2:
-    case 3:
-    case 4:
+    case COLUMN_PRIVILEGES_HASH:
+    case PROC_PRIVILEGES_HASH:
+    case FUNC_PRIVILEGES_HASH:
       grant_name= (GRANT_NAME*) hash_element(grant_name_hash, idx);
       user= grant_name->user;
       host= grant_name->host.hostname;
@@ -5510,86 +5544,60 @@
     if ( drop )
     {
       switch ( struct_no ) {
-      case 0:
+      case USER_ACL:
         delete_dynamic_element(&acl_users, idx);
-        break;
-
-      case 1:
-        delete_dynamic_element(&acl_dbs, idx);
-        break;
-
-      case 2:
-      case 3:
-      case 4:
-        hash_delete(grant_name_hash, (uchar*) grant_name);
-	break;
-      }
-      elements--;
-      /*
+        elements--;
+        /*
         - If we are iterating through an array then we just have moved all
           elements after the current element one position closer to its head.
           This means that we have to take another look at the element at
           current position as it is a new element from the array's tail.
-        - If we are iterating through a hash the current element was replaced
-          with one of elements from the tail. So we also have to take a look
-          at the new element in current position.
-          Note that in our HASH implementation hash_delete() won't move any
-          elements with position after current one to position before the
-          current (i.e. from the tail to the head), so it is safe to continue
-          iteration without re-starting.
-      */
-      idx--;
+        - This is valid for USER_ACL, DB_ACL.
+        */
+        idx--;
+        break;
+
+      case DB_ACL:
+        delete_dynamic_element(&acl_dbs, idx);
+        elements--;
+        idx--;
+        break;
+
+      case COLUMN_PRIVILEGES_HASH:
+      case PROC_PRIVILEGES_HASH:
+      case FUNC_PRIVILEGES_HASH:
+        /*
+          Deleting while traversing a hash table is not valid procedure and
+          hence we save pointers to GRANT_NAME objects for later processing.
+        */
+        if (acl_grant_name.append(grant_name))
+          DBUG_RETURN(-1);
+	break;
+      }
     }
     else if ( user_to )
     {
       switch ( struct_no ) {
-      case 0:
+      case USER_ACL:
         acl_user->user= strdup_root(&mem, user_to->user.str);
         acl_user->host.hostname= strdup_root(&mem, user_to->host.str);
         break;
 
-      case 1:
+      case DB_ACL:
         acl_db->user= strdup_root(&mem, user_to->user.str);
         acl_db->host.hostname= strdup_root(&mem, user_to->host.str);
         break;
 
-      case 2:
-      case 3:
-      case 4:
-        {
-          /*
-            Save old hash key and its length to be able properly update
-            element position in hash.
-          */
-          char *old_key= grant_name->hash_key;
-          size_t old_key_length= grant_name->key_length;
-
-          /*
-            Update the grant structure with the new user name and host name.
-          */
-          grant_name->set_user_details(user_to->host.str, grant_name->db,
-                                       user_to->user.str, grant_name->tname,
-                                       TRUE);
-
-          /*
-            Since username is part of the hash key, when the user name
-            is renamed, the hash key is changed. Update the hash to
-            ensure that the position matches the new hash key value
-          */
-          hash_update(grant_name_hash, (uchar*) grant_name, (uchar*) old_key,
-                      old_key_length);
-          /*
-            hash_update() operation could have moved element from the tail
-            of the hash to the current position. So we need to take a look
-            at the element in current position once again.
-            Thanks to the fact that hash_update() for our HASH implementation
-            won't move any elements from the tail of the hash to the positions
-            before the current one (a.k.a. head) it is safe to continue
-            iteration without restarting.
-          */
-          idx--;
-          break;
-        }
+      case COLUMN_PRIVILEGES_HASH:
+      case PROC_PRIVILEGES_HASH:
+      case FUNC_PRIVILEGES_HASH:
+        /*
+          Updating while traversing a hash table is not valid procedure and
+          hence we save pointers to GRANT_NAME objects for later processing.
+        */
+        if (acl_grant_name.append(grant_name))
+          DBUG_RETURN(-1);
+        break;
       }
     }
     else
@@ -5598,6 +5606,48 @@
       break;
     }
   }
+
+  if (drop || user_to)
+  {
+    /*
+      Traversing the elements stored in acl_grant_name dynamic array
+      to either delete or update them.
+    */
+    for (int i= 0; i < acl_grant_name.elements(); ++i)
+    {
+      grant_name= acl_grant_name.at(i);
+
+      if (drop)
+      {
+        my_hash_delete(grant_name_hash, (uchar *) grant_name);
+      }
+      else
+      {
+        /*
+          Save old hash key and its length to be able properly update
+          element position in hash.
+        */
+        char *old_key= grant_name->hash_key;
+        size_t old_key_length= grant_name->key_length;
+
+        /*
+          Update the grant structure with the new user name and host name.
+        */
+        grant_name->set_user_details(user_to->host.str, grant_name->db,
+                                     user_to->user.str, grant_name->tname,
+                                     TRUE);
+
+        /*
+          Since username is part of the hash key, when the user name
+          is renamed, the hash key is changed. Update the hash to
+          ensure that the position matches the new hash key value
+        */
+        my_hash_update(grant_name_hash, (uchar*) grant_name, (uchar*) old_key,
+                       old_key_length);
+      }
+    }
+  }
+
 #ifdef EXTRA_DEBUG
   DBUG_PRINT("loop",("scan struct: %u  result %d", struct_no, result));
 #endif
@@ -5635,6 +5685,7 @@
 {
   int result= 0;
   int found;
+  int ret;
   DBUG_ENTER("handle_grant_data");
 
   /* Handle user table. */
@@ -5646,14 +5697,19 @@
   else
   {
     /* Handle user array. */
-    if ((handle_grant_struct(0, drop, user_from, user_to) && ! result) ||
-        found)
+    if (((ret= handle_grant_struct(USER_ACL, drop, user_from, user_to) > 0) &&
+         ! result) || found)
     {
       result= 1; /* At least one record/element found. */
       /* If search is requested, we do not need to search further. */
       if (! drop && ! user_to)
         goto end;
     }
+    else if (ret < 0)
+    {
+      result= -1;
+      goto end;
+    }
   }
 
   /* Handle db table. */
@@ -5665,14 +5721,19 @@
   else
   {
     /* Handle db array. */
-    if (((handle_grant_struct(1, drop, user_from, user_to) && ! result) ||
-         found) && ! result)
+    if ((((ret= handle_grant_struct(DB_ACL, drop, user_from, user_to) > 0) &&
+          ! result) || found) && ! result)
     {
       result= 1; /* At least one record/element found. */
       /* If search is requested, we do not need to search further. */
       if (! drop && ! user_to)
         goto end;
     }
+    else if (ret < 0)
+    {
+      result= -1;
+      goto end;
+    }
   }
 
   /* Handle stored routines table. */
@@ -5684,23 +5745,35 @@
   else
   {
     /* Handle procs array. */
-    if (((handle_grant_struct(3, drop, user_from, user_to) && ! result) ||
-         found) && ! result)
+    if ((((ret= handle_grant_struct(PROC_PRIVILEGES_HASH, drop, user_from,
+                                    user_to) > 0) && ! result) || found) &&
+        ! result)
     {
       result= 1; /* At least one record/element found. */
       /* If search is requested, we do not need to search further. */
       if (! drop && ! user_to)
         goto end;
     }
+    else if (ret < 0)
+    {
+      result= -1;
+      goto end;
+    }
     /* Handle funcs array. */
-    if (((handle_grant_struct(4, drop, user_from, user_to) && ! result) ||
-         found) && ! result)
+    if ((((ret= handle_grant_struct(FUNC_PRIVILEGES_HASH, drop, user_from,
+                                    user_to) > 0) && ! result) || found) &&
+        ! result)
     {
       result= 1; /* At least one record/element found. */
       /* If search is requested, we do not need to search further. */
       if (! drop && ! user_to)
         goto end;
     }
+    else if (ret < 0)
+    {
+      result= -1;
+      goto end;
+    }
   }
 
   /* Handle tables table. */
@@ -5728,9 +5801,12 @@
     else
     {
       /* Handle columns hash. */
-      if (((handle_grant_struct(2, drop, user_from, user_to) && ! result) ||
-           found) && ! result)
+      if ((((ret= handle_grant_struct(COLUMN_PRIVILEGES_HASH, drop, user_from,
+                                      user_to) > 0) && ! result) || found) &&
+          ! result)
         result= 1; /* At least one record/element found. */
+      else if (ret < 0)
+        result= -1;
     }
   }
  end:
 
=== modified file 'Percona-Server/sql/sql_connect.cc'
--- Percona-Server/sql/sql_connect.cc	2012-08-20 03:14:02 +0000
+++ Percona-Server/sql/sql_connect.cc	2013-01-10 04:35:33 +0000
@@ -914,6 +914,7 @@
 
   USER_RESOURCES ur;
   int res= acl_getroot(thd, &ur, passwd, passwd_len);
+  DBUG_EXECUTE_IF("password_format_mismatch",{res= -1;};);
 #ifndef EMBEDDED_LIBRARY
   if (res == -1)
   {
@@ -924,6 +925,12 @@
       in old format.
     */
     NET *net= &thd->net;
+    DBUG_EXECUTE_IF("password_format_mismatch",
+                    {
+                      inc_host_errors(&thd->remote.sin_addr);
+                      my_error(ER_HANDSHAKE_ERROR, MYF(0));
+                      DBUG_RETURN(1);
+                    };);
     if (opt_secure_auth_local)
     {
       my_error(ER_SERVER_IS_IN_SECURE_AUTH_MODE, MYF(0),
@@ -1395,6 +1402,8 @@
   size_t passwd_len;
   char *user;
   size_t user_len;
+  uint charset_code= 0;
+  size_t bytes_remaining_in_packet= 0;
 
   DBUG_PRINT("info",
              ("New connection received on %s", vio_description(net->vio)));
@@ -1411,6 +1420,19 @@
       my_error(ER_BAD_HOST_ERROR, MYF(0));
       return 1;
     }
+    /* BEGIN : DEBUG */
+    DBUG_EXECUTE_IF("addr_fake_ipv4",
+                    {
+                      struct sockaddr *sa= (sockaddr *) &net->vio->remote;
+                      sa->sa_family= AF_INET;
+                      struct in_addr *ip4= &((struct sockaddr_in *)sa)->sin_addr;
+                      /* See RFC 5737, 192.0.2.0/23 is reserved */
+                      const char* fake= "192.0.2.4";
+                      ip4->s_addr= inet_addr(fake);
+                      strcpy(ip, fake);
+                    };);
+    /* END   : DEBUG */
+
     if (!(thd->main_security_ctx.ip= my_strdup(ip,MYF(MY_WME))))
       return 1; /* The error is set by my_strdup(). */
     thd->main_security_ctx.host_or_ip= thd->main_security_ctx.ip;
@@ -1506,32 +1528,31 @@
                           (uchar*) buff, (size_t) (end-buff)) ||
 	(pkt_len= my_net_read(net)) == packet_error)
     {
-      inc_host_errors(&thd->remote.sin_addr);
-      my_error(ER_HANDSHAKE_ERROR, MYF(0));
-      return 1;
+      goto error;
     }
   }
 #ifdef _CUSTOMCONFIG_
 #include "_cust_sql_parse.h"
 #endif
-  if (connect_errors)
-    reset_host_errors(&thd->remote.sin_addr);
   if (thd->packet.alloc(thd->variables.net_buffer_length))
     return 1; /* The error is set by alloc(). */
 
-  uint charset_code= 0;
   end= (char *)net->read_pos;
   /*
     In order to safely scan a head for '\0' string terminators
     we must keep track of how many bytes remain in the allocated
     buffer or we might read past the end of the buffer.
   */
-  size_t bytes_remaining_in_packet= pkt_len;
+  bytes_remaining_in_packet= pkt_len;
   
   /*
     Peek ahead on the client capability packet and determine which version of
     the protocol should be used.
   */
+  DBUG_EXECUTE_IF("host_error_packet_length",
+                  {
+                    bytes_remaining_in_packet= 0;
+                  };);
   if (bytes_remaining_in_packet < 2)
     goto error;
   
@@ -1590,6 +1611,10 @@
 
 skip_to_ssl:
 
+  DBUG_EXECUTE_IF("host_error_charset",
+                  {
+                    goto error;
+                  };);
   DBUG_PRINT("info", ("client_character_set: %u", charset_code));
   if (thd_init_client_charset(thd, charset_code))
     goto error;
@@ -1658,6 +1683,10 @@
       bytes_remaining_in_packet -= AUTH_PACKET_HEADER_SIZE_PROTO_40;
     }
   
+    DBUG_EXECUTE_IF("host_error_SSL_layering",
+                    {
+                      packet_has_required_size= 0;
+                    };);
     if (!packet_has_required_size)
       goto error;
   }
@@ -1683,6 +1712,11 @@
     get_string= get_40_protocol_string;
 
   user= get_string(&end, &bytes_remaining_in_packet, &user_len);
+  DBUG_EXECUTE_IF("host_error_user",
+                  {
+                    user= NULL;
+                  };);
+
   if (user == NULL)
     goto error;
 
@@ -1710,6 +1744,11 @@
     passwd= get_string(&end, &bytes_remaining_in_packet, &passwd_len);
   }
 
+  DBUG_EXECUTE_IF("host_error_password",
+                  {
+                    passwd= NULL;
+                  };);
+
   if (passwd == NULL)
     goto error;
 
@@ -1770,7 +1809,20 @@
 
   if (!(thd->main_security_ctx.user= my_strdup(user, MYF(MY_WME))))
     return 1; /* The error is set by my_strdup(). */
-  return check_user(thd, COM_CONNECT, passwd, passwd_len, db, TRUE);
+
+  if (!check_user(thd, COM_CONNECT, passwd, passwd_len, db, TRUE))
+  {
+    /*
+      Call to reset_host_errors() should be made only when all sanity checks
+      are done and connection is going to be a successful.
+    */
+    reset_host_errors(&thd->remote.sin_addr);
+    return 0;
+  }
+  else
+  {
+    return 1;
+  }
   
 error:
   inc_host_errors(&thd->remote.sin_addr);
 
=== modified file 'Percona-Server/sql/sql_lex.cc'
--- Percona-Server/sql/sql_lex.cc	2012-08-20 03:14:02 +0000
+++ Percona-Server/sql/sql_lex.cc	2013-01-10 04:35:33 +0000
@@ -1621,6 +1621,7 @@
   ref_pointer_array= 0;
   select_n_where_fields= 0;
   select_n_having_items= 0;
+  n_child_sum_items= 0;
   subquery_in_having= explicit_limit= 0;
   is_item_list_lookup= 0;
   first_execution= 1;
 
=== modified file 'Percona-Server/sql/sql_list.h'
--- Percona-Server/sql/sql_list.h	2011-06-30 15:37:13 +0000
+++ Percona-Server/sql/sql_list.h	2013-01-10 04:35:33 +0000
@@ -1,7 +1,6 @@
 #ifndef INCLUDES_MYSQL_SQL_LIST_H
 #define INCLUDES_MYSQL_SQL_LIST_H
-/*
-   Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
+/* Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -165,6 +164,14 @@
 public:
   uint elements;
 
+  bool operator==(const base_list &rhs) const
+  {
+    return
+      elements == rhs.elements &&
+      first == rhs.first &&
+      last == rhs.last;
+  }
+
   inline void empty() { elements=0; first= &end_of_list; last=&first;}
   inline base_list() { empty(); }
   /**
 
=== modified file 'Percona-Server/sql/sql_profile.cc'
--- Percona-Server/sql/sql_profile.cc	2012-08-20 03:14:02 +0000
+++ Percona-Server/sql/sql_profile.cc	2013-01-10 04:35:33 +0000
@@ -39,6 +39,7 @@
 #define TIME_I_S_DECIMAL_SIZE (TIME_FLOAT_DIGITS*100)+(TIME_FLOAT_DIGITS-3)
 
 #define MAX_QUERY_LENGTH 300
+#define MAX_QUERY_HISTORY 101
 
 /* Reserved for systems that can't record the function name in source. */
 const char * const _unknown_func_ = "<unknown>";
@@ -247,9 +248,12 @@
 QUERY_PROFILE::QUERY_PROFILE(PROFILING *profiling_arg, const char *status_arg)
   :profiling(profiling_arg), profiling_query_id(0), query_source(NULL)
 {
-  profile_start= new PROF_MEASUREMENT(this, status_arg);
-  entries.push_back(profile_start);
-  profile_end= profile_start;
+  m_seq_counter= 1;
+  PROF_MEASUREMENT *prof= new PROF_MEASUREMENT(this, status_arg);
+  prof->m_seq= m_seq_counter++;
+  m_start_time_usecs= prof->time_usecs;
+  m_end_time_usecs= m_start_time_usecs;
+  entries.push_back(prof);
 }
 
 QUERY_PROFILE::~QUERY_PROFILE()
@@ -289,9 +293,14 @@
   else
     prof= new PROF_MEASUREMENT(this, status_arg);
 
-  profile_end= prof;
+  prof->m_seq= m_seq_counter++;
+  m_end_time_usecs= prof->time_usecs;
   entries.push_back(prof);
 
+  /* Maintain the query history size. */
+  while (entries.elements > MAX_QUERY_HISTORY)
+    delete entries.pop();
+
   DBUG_VOID_RETURN;
 }
 
@@ -452,8 +461,7 @@
 
     String elapsed;
 
-    PROF_MEASUREMENT *ps= prof->profile_start;
-    PROF_MEASUREMENT *pe= prof->profile_end;
+    double query_time_usecs= prof->m_end_time_usecs - prof->m_start_time_usecs;
 
     if (++idx <= unit->offset_limit_cnt)
       continue;
@@ -462,7 +470,7 @@
 
     protocol->prepare_for_resend();
     protocol->store((uint32)(prof->profiling_query_id));
-    protocol->store((double)(pe->time_usecs - ps->time_usecs)/(1000.0*1000),
+    protocol->store((double)(query_time_usecs/(1000.0*1000)),
                     (uint32) TIME_FLOAT_DIGITS-1, &elapsed);
     if (prof->query_source != NULL)
       protocol->store(prof->query_source, strlen(prof->query_source),
@@ -634,17 +642,18 @@
       us also include a numbering of each state per query.  The query_id and
       the "seq" together are unique.
     */
-    ulonglong seq;
+    ulong seq;
 
     void *entry_iterator;
     PROF_MEASUREMENT *entry, *previous= NULL;
     /* ...and for each query, go through all its state-change steps. */
-    for (seq= 0, entry_iterator= query->entries.new_iterator();
+    for (entry_iterator= query->entries.new_iterator();
          entry_iterator != NULL;
          entry_iterator= query->entries.iterator_next(entry_iterator),
-         seq++, previous=entry, row_number++)
+         previous=entry, row_number++)
     {
       entry= query->entries.iterator_value(entry_iterator);
+      seq= entry->m_seq;
 
       /* Skip the first.  We count spans of fence, not fence-posts. */
       if (previous == NULL) continue;
 
=== modified file 'Percona-Server/sql/sql_profile.h'
--- Percona-Server/sql/sql_profile.h	2011-11-24 01:59:44 +0000
+++ Percona-Server/sql/sql_profile.h	2013-01-10 04:35:33 +0000
@@ -186,6 +186,7 @@
   char *file;
   unsigned int line;
 
+  ulong m_seq;
   double time_usecs;
   double cpu_time_usecs;
   PROF_MEASUREMENT();
@@ -212,8 +213,9 @@
   query_id_t profiling_query_id;        /* Session-specific id. */
   char *query_source;
 
-  PROF_MEASUREMENT *profile_start;
-  PROF_MEASUREMENT *profile_end;
+  double m_start_time_usecs;
+  double m_end_time_usecs;
+  ulong m_seq_counter;
   Queue<PROF_MEASUREMENT> entries;
 
 
 
=== modified file 'Percona-Server/sql/sql_select.cc'
--- Percona-Server/sql/sql_select.cc	2013-01-10 04:35:31 +0000
+++ Percona-Server/sql/sql_select.cc	2013-01-10 04:35:33 +0000
@@ -1,4 +1,4 @@
-/* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
+/* Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -1699,6 +1699,8 @@
 */
 void JOIN::restore_tmp()
 {
+  DBUG_PRINT("info", ("restore_tmp this %p tmp_join %p", this, tmp_join));
+  DBUG_ASSERT(tmp_join != this);
   memcpy(tmp_join, this, (size_t) sizeof(JOIN));
 }
 
@@ -7116,21 +7118,19 @@
       }
     }
   }
-  /*
-    We are not using tables anymore
-    Unlock all tables. We may be in an INSERT .... SELECT statement.
-  */
   if (full)
   {
-    if (tmp_join)
-      tmp_table_param.copy_field= 0;
+    /* 
+      Ensure that the following delete_elements() would not be called
+      twice for the same list.
+    */
+    if (tmp_join && tmp_join != this &&
+        tmp_join->group_fields == this->group_fields)
+      tmp_join->group_fields.empty();
+
+    // Run Cached_item DTORs!
     group_fields.delete_elements();
-    /* 
-      Ensure that the above delete_elements() would not be called
-      twice for the same list.
-    */
-    if (tmp_join && tmp_join != this)
-      tmp_join->group_fields= group_fields;
+
     /*
       We can't call delete_elements() on copy_funcs as this will cause
       problems in free_elements() as some of the elements are then deleted.
 
=== modified file 'Percona-Server/storage/innobase/btr/btr0cur.c'
--- Percona-Server/storage/innobase/btr/btr0cur.c	2012-08-20 00:29:22 +0000
+++ Percona-Server/storage/innobase/btr/btr0cur.c	2013-01-10 04:35:33 +0000
@@ -2377,21 +2377,22 @@
 }
 
 /***************************************************************
-Sets a secondary index record delete mark to FALSE. This function is only
+Sets a secondary index record delete mark. This function is only
 used by the insert buffer insert merge mechanism. */
 
 void
-btr_cur_del_unmark_for_ibuf(
-/*========================*/
+btr_cur_set_deleted_flag_for_ibuf(
+/*==============================*/
 	rec_t*		rec,	/* in: record to delete unmark */
+	ibool		val,	/* in: value to set */
 	mtr_t*		mtr)	/* in: mtr */
 {
 	/* We do not need to reserve btr_search_latch, as the page has just
 	been read to the buffer pool and there cannot be a hash index to it. */
 
-	rec_set_deleted_flag(rec, page_is_comp(buf_frame_align(rec)), FALSE);
+	rec_set_deleted_flag(rec, page_is_comp(buf_frame_align(rec)), val);
 
-	btr_cur_del_mark_set_sec_rec_log(rec, FALSE, mtr);
+	btr_cur_del_mark_set_sec_rec_log(rec, val, mtr);
 }
 
 /*==================== B-TREE RECORD REMOVE =========================*/
 
=== modified file 'Percona-Server/storage/innobase/dict/dict0dict.c'
--- Percona-Server/storage/innobase/dict/dict0dict.c	2012-03-01 05:35:51 +0000
+++ Percona-Server/storage/innobase/dict/dict0dict.c	2013-01-10 04:35:33 +0000
@@ -1629,7 +1629,6 @@
 {
 	dict_index_t*	new_index;
 	dict_field_t*	field;
-	ulint		fixed_size;
 	ulint		trx_id_pos;
 	ulint		i;
 	ibool*		indexed;
@@ -1706,7 +1705,7 @@
 
 		for (i = 0; i < trx_id_pos; i++) {
 
-			fixed_size = dict_col_get_fixed_size(
+			ulint	fixed_size = dict_col_get_fixed_size(
 				dict_index_get_nth_col(new_index, i));
 
 			if (fixed_size == 0) {
@@ -1722,7 +1721,20 @@
 				break;
 			}
 
-			new_index->trx_id_offset += (unsigned int) fixed_size;
+			/* Add fixed_size to new_index->trx_id_offset.
+			Because the latter is a bit-field, an overflow
+			can theoretically occur. Check for it. */
+			fixed_size += new_index->trx_id_offset;
+
+			new_index->trx_id_offset = fixed_size;
+
+			if (new_index->trx_id_offset != fixed_size) {
+				/* Overflow. Pretend that this is a
+				variable-length PRIMARY KEY. */
+				ut_ad(0);
+				new_index->trx_id_offset = 0;
+				break;
+			}
 		}
 
 	}
 
=== modified file 'Percona-Server/storage/innobase/handler/ha_innodb.cc'
--- Percona-Server/storage/innobase/handler/ha_innodb.cc	2013-01-10 04:35:31 +0000
+++ Percona-Server/storage/innobase/handler/ha_innodb.cc	2013-01-10 04:35:33 +0000
@@ -9274,8 +9274,8 @@
 #if defined UNIV_DEBUG || defined UNIV_IBUF_DEBUG
 static MYSQL_SYSVAR_UINT(change_buffering_debug, ibuf_debug,
   PLUGIN_VAR_RQCMDARG,
-  "Debug flags for InnoDB change buffering (0=none)",
-  NULL, NULL, 0, 0, 1, 0);
+  "Debug flags for InnoDB change buffering (0=none, 2=crash at merge)",
+  NULL, NULL, 0, 0, 2, 0);
 #endif /* UNIV_DEBUG || UNIV_IBUF_DEBUG */
 
 #ifdef UNIV_DEBUG
 
=== modified file 'Percona-Server/storage/innobase/ibuf/ibuf0ibuf.c'
--- Percona-Server/storage/innobase/ibuf/ibuf0ibuf.c	2012-01-16 12:22:03 +0000
+++ Percona-Server/storage/innobase/ibuf/ibuf0ibuf.c	2013-01-10 04:35:33 +0000
@@ -2978,7 +2978,7 @@
 			/* The records only differ in the delete-mark.
 			Clear the delete-mark, like we did before
 			Bug #56680 was fixed. */
-			btr_cur_del_unmark_for_ibuf(rec, mtr);
+			btr_cur_set_deleted_flag_for_ibuf(rec, FALSE, mtr);
 updated_in_place:
 			mem_heap_free(heap);
 			return;
@@ -3058,6 +3058,22 @@
 
 	ut_ad(ibuf_inside());
 
+#if defined UNIV_DEBUG || defined UNIV_IBUF_DEBUG
+	if (ibuf_debug == 2) {
+		/* Inject a fault (crash). We do this before trying
+		optimistic delete, because a pessimistic delete in the
+		change buffer would require a larger test case. */
+
+		/* Flag the buffered record as processed, to avoid
+		an assertion failure after crash recovery. */
+		btr_cur_set_deleted_flag_for_ibuf(
+			btr_pcur_get_rec(pcur), TRUE, mtr);
+		mtr_commit(mtr);
+		log_make_checkpoint_at(ut_dulint_max, TRUE);
+		DBUG_SUICIDE();
+	}
+#endif /* UNIV_DEBUG || UNIV_IBUF_DEBUG */
+
 	success = btr_cur_optimistic_delete(btr_pcur_get_btr_cur(pcur), mtr);
 
 	if (success) {
@@ -3072,7 +3088,13 @@
 		return(FALSE);
 	}
 
-	/* We have to resort to a pessimistic delete from ibuf */
+	/* We have to resort to a pessimistic delete from ibuf.
+	Delete-mark the record so that it will not be applied again,
+	in case the server crashes before the pessimistic delete is
+	made persistent. */
+	btr_cur_set_deleted_flag_for_ibuf(
+		btr_pcur_get_rec(pcur), TRUE, mtr);
+
 	btr_pcur_store_position(pcur, mtr);
 
 	btr_pcur_commit_specify_mtr(pcur, mtr);
@@ -3343,7 +3365,7 @@
 			fputs("InnoDB: Discarding record\n ", stderr);
 			rec_print_old(stderr, ibuf_rec);
 			fputs("\n from the insert buffer!\n\n", stderr);
-		} else if (page) {
+		} else if (page && !rec_get_deleted_flag(ibuf_rec, 0)) {
 			/* Now we have at pcur a record which should be
 			inserted to the index page; NOTE that the call below
 			copies pointers to fields in ibuf_rec, and we must
 
=== modified file 'Percona-Server/storage/innobase/include/btr0cur.h'
--- Percona-Server/storage/innobase/include/btr0cur.h	2011-10-26 09:23:57 +0000
+++ Percona-Server/storage/innobase/include/btr0cur.h	2013-01-10 04:35:33 +0000
@@ -277,13 +277,14 @@
 	que_thr_t*	thr,	/* in: query thread */
 	mtr_t*		mtr);	/* in: mtr */
 /***************************************************************
-Sets a secondary index record delete mark to FALSE. This function is
-only used by the insert buffer insert merge mechanism. */
+Sets a secondary index record delete mark. This function is only
+used by the insert buffer insert merge mechanism. */
 
 void
-btr_cur_del_unmark_for_ibuf(
-/*========================*/
+btr_cur_set_deleted_flag_for_ibuf(
+/*==============================*/
 	rec_t*		rec,	/* in: record to delete unmark */
+	ibool		val,	/* in: value to set */
 	mtr_t*		mtr);	/* in: mtr */
 /*****************************************************************
 Tries to compress a page of the tree on the leaf level. It is assumed
 
=== modified file 'Percona-Server/storage/innobase/include/dict0mem.h'
--- Percona-Server/storage/innobase/include/dict0mem.h	2011-01-14 17:02:28 +0000
+++ Percona-Server/storage/innobase/include/dict0mem.h	2013-01-10 04:35:33 +0000
@@ -196,10 +196,15 @@
 	unsigned	space:32;
 				/* space where the index tree is placed */
 	unsigned	page:32;/* index tree root page number */
-	unsigned	trx_id_offset:10;/* position of the the trx id column
+#define MAX_KEY_LENGTH_BITS 12
+	unsigned	trx_id_offset:MAX_KEY_LENGTH_BITS;
+				/* position of the trx id column
 				in a clustered index record, if the fields
 				before it are known to be of a fixed size,
 				0 otherwise */
+#if (1<<MAX_KEY_LENGTH_BITS) < MAX_KEY_LENGTH
+# error (1<<MAX_KEY_LENGTH_BITS) < MAX_KEY_LENGTH
+#endif
 	unsigned	n_user_defined_cols:10;
 				/* number of columns the user defined to
 				be in the index: in the internal
 
=== modified file 'Percona-Server/storage/innobase/include/row0undo.h'
--- Percona-Server/storage/innobase/include/row0undo.h	2006-08-28 17:42:45 +0000
+++ Percona-Server/storage/innobase/include/row0undo.h	2013-01-10 04:35:33 +0000
@@ -78,8 +78,6 @@
 	dulint		undo_no;/* undo number of the record */
 	ulint		rec_type;/* undo log record type: TRX_UNDO_INSERT_REC,
 				... */
-	dulint		new_roll_ptr; /* roll ptr to restore to clustered index
-				record */
 	dulint		new_trx_id; /* trx id to restore to clustered index
 				record */
 	btr_pcur_t	pcur;	/* persistent cursor used in searching the
@@ -101,11 +99,8 @@
 /* Execution states for an undo node */
 #define	UNDO_NODE_FETCH_NEXT	1	/* we should fetch the next undo log
 					record */
-#define	UNDO_NODE_PREV_VERS	2	/* the roll ptr to previous version of
-					a row is stored in node, and undo
-					should be done based on it */
-#define UNDO_NODE_INSERT	3
-#define UNDO_NODE_MODIFY	4
+#define UNDO_NODE_INSERT	2
+#define UNDO_NODE_MODIFY	3
 
 
 #ifndef UNIV_NONINL
 
=== modified file 'Percona-Server/storage/innobase/os/os0file.c'
--- Percona-Server/storage/innobase/os/os0file.c	2010-10-28 04:18:59 +0000
+++ Percona-Server/storage/innobase/os/os0file.c	2013-01-10 04:35:33 +0000
@@ -1215,6 +1215,14 @@
 	DWORD		create_flag;
 	DWORD		attributes;
 	ibool		retry;
+
+	DBUG_EXECUTE_IF(
+		"ib_create_table_fail_disk_full",
+		*success = FALSE;
+		SetLastError(ERROR_DISK_FULL);
+		return((os_file_t) -1);
+	);
+
 try_again:
 	ut_a(name);
 
@@ -1318,6 +1326,13 @@
 	ibool		retry;
 	const char*	mode_str	= NULL;
 
+	DBUG_EXECUTE_IF(
+		"ib_create_table_fail_disk_full",
+		*success = FALSE;
+		errno = ENOSPC;
+		return((os_file_t) -1);
+	);
+
 try_again:
 	ut_a(name);
 
 
=== modified file 'Percona-Server/storage/innobase/row/row0sel.c'
--- Percona-Server/storage/innobase/row/row0sel.c	2011-12-22 10:55:44 +0000
+++ Percona-Server/storage/innobase/row/row0sel.c	2013-01-10 04:35:33 +0000
@@ -3758,9 +3758,13 @@
 	}
 
 rec_loop:
+	if (trx_is_interrupted(trx)) {
+		err = DB_INTERRUPTED;
+		goto normal_return;
+	}
+
 	/*-------------------------------------------------------------*/
 	/* PHASE 4: Look for matching records in a loop */
-
 	rec = btr_pcur_get_rec(pcur);
 	ut_ad(!!page_rec_is_comp(rec) == comp);
 #ifdef UNIV_SEARCH_DEBUG
@@ -4656,14 +4660,18 @@
 	/* TODO: We have to cast away the const of rec for now.  This needs
 	to be fixed later.*/
 	offsets = rec_get_offsets(
-		(rec_t*) rec, index, offsets, ULINT_UNDEFINED, &heap);
+		(rec_t*) rec, index, offsets, col_no + 1, &heap);
+
+	if (rec_offs_nth_sql_null(offsets, col_no)) {
+		/* There is no non-NULL value in the auto-increment column. */
+		value = 0;
+		goto func_exit;
+	}
 
 	/* TODO: We have to cast away the const of rec for now.  This needs
 	to be fixed later.*/
 	data = rec_get_nth_field((rec_t*)rec, offsets, col_no, &len);
 
-	ut_a(len != UNIV_SQL_NULL);
-
 	switch (mtype) {
 	case DATA_INT:
 		ut_a(len <= sizeof value);
@@ -4684,15 +4692,16 @@
 		ut_error;
 	}
 
-	if (UNIV_LIKELY_NULL(heap)) {
-		mem_heap_free(heap);
-	}
-
 	/* We assume that the autoinc counter can't be negative. */
 	if (!unsigned_type && (ib_longlong) value < 0) {
 		value = 0;
 	}
 
+func_exit:
+	if (UNIV_LIKELY_NULL(heap)) {
+		mem_heap_free(heap);
+	}
+
 	return(value);
 }
 
 
=== modified file 'Percona-Server/storage/innobase/row/row0umod.c'
--- Percona-Server/storage/innobase/row/row0umod.c	2011-10-26 09:23:57 +0000
+++ Percona-Server/storage/innobase/row/row0umod.c	2013-01-10 04:35:33 +0000
@@ -42,37 +42,6 @@
 version has become obsolete at the time the undo is started. */
 
 /***************************************************************
-Checks if also the previous version of the clustered index record was
-modified or inserted by the same transaction, and its undo number is such
-that it should be undone in the same rollback. */
-UNIV_INLINE
-ibool
-row_undo_mod_undo_also_prev_vers(
-/*=============================*/
-				/* out: TRUE if also previous modify or
-				insert of this row should be undone */
-	undo_node_t*	node,	/* in: row undo node */
-	dulint*		undo_no)/* out: the undo number */
-{
-	trx_undo_rec_t*	undo_rec;
-	trx_t*		trx;
-
-	trx = node->trx;
-
-	if (0 != ut_dulint_cmp(node->new_trx_id, trx->id)) {
-
-		*undo_no = ut_dulint_zero;
-		return(FALSE);
-	}
-
-	undo_rec = trx_undo_get_undo_rec_low(node->new_roll_ptr, node->heap);
-
-	*undo_no = trx_undo_rec_get_undo_no(undo_rec);
-
-	return(ut_dulint_cmp(trx->roll_limit, *undo_no) <= 0);
-}
-
-/***************************************************************
 Undoes a modify in a clustered index record. */
 static
 ulint
@@ -202,17 +171,9 @@
 	btr_pcur_t*	pcur;
 	mtr_t		mtr;
 	ulint		err;
-	ibool		success;
-	ibool		more_vers;
-	dulint		new_undo_no;
 
 	ut_ad(node && thr);
 
-	/* Check if also the previous version of the clustered index record
-	should be undone in this same rollback operation */
-
-	more_vers = row_undo_mod_undo_also_prev_vers(node, &new_undo_no);
-
 	pcur = &(node->pcur);
 
 	mtr_start(&mtr);
@@ -260,20 +221,6 @@
 
 	trx_undo_rec_release(node->trx, node->undo_no);
 
-	if (more_vers && err == DB_SUCCESS) {
-
-		/* Reserve the undo log record to the prior version after
-		committing &mtr: this is necessary to comply with the latching
-		order, as &mtr may contain the fsp latch which is lower in
-		the latch hierarchy than trx->undo_mutex. */
-
-		success = trx_undo_rec_reserve(node->trx, new_undo_no);
-
-		if (success) {
-			node->state = UNDO_NODE_PREV_VERS;
-		}
-	}
-
 	return(err);
 }
 
@@ -702,7 +649,6 @@
 	trx_undo_update_rec_get_update(ptr, clust_index, type, trx_id,
 				       roll_ptr, info_bits, trx,
 				       node->heap, &(node->update));
-	node->new_roll_ptr = roll_ptr;
 	node->new_trx_id = trx_id;
 	node->cmpl_info = cmpl_info;
 }
 
=== modified file 'Percona-Server/storage/innobase/row/row0undo.c'
--- Percona-Server/storage/innobase/row/row0undo.c	2010-06-25 08:18:41 +0000
+++ Percona-Server/storage/innobase/row/row0undo.c	2013-01-10 04:35:33 +0000
@@ -242,25 +242,6 @@
 		} else {
 			node->state = UNDO_NODE_MODIFY;
 		}
-
-	} else if (node->state == UNDO_NODE_PREV_VERS) {
-
-		/* Undo should be done to the same clustered index record
-		again in this same rollback, restoring the previous version */
-
-		roll_ptr = node->new_roll_ptr;
-
-		node->undo_rec = trx_undo_get_undo_rec_low(roll_ptr,
-							   node->heap);
-		node->roll_ptr = roll_ptr;
-		node->undo_no = trx_undo_rec_get_undo_no(node->undo_rec);
-
-		if (trx_undo_roll_ptr_is_insert(roll_ptr)) {
-
-			node->state = UNDO_NODE_INSERT;
-		} else {
-			node->state = UNDO_NODE_MODIFY;
-		}
 	}
 
 	/* Prevent DROP TABLE etc. while we are rolling back this row.
 
=== modified file 'Percona-Server/storage/innodb_plugin/ChangeLog'
--- Percona-Server/storage/innodb_plugin/ChangeLog	2013-01-10 04:35:31 +0000
+++ Percona-Server/storage/innodb_plugin/ChangeLog	2013-01-10 04:35:33 +0000
@@ -1,3 +1,40 @@
[phone]	The InnoDB Team
+
+	* row/row0sel.c:
+	Fix Bug#14758405: ALTER TABLE: ADDING SERIAL NULL DATATYPE: ASSERTION:
+	LEN <= SIZEOF(ULONGLONG)
+
[phone]	The InnoDB Team
+
+	* dict/dict0dict.c, handler/handler0alter.cc, include/dict0dict.h:
+	Fix Bug#14729221 IN-PLACE ALTER TABLE REPORTS '' INSTEAD OF REAL
+	DUPLICATE VALUE FOR PREFIX KEYS
+
[phone]	The InnoDB Team
+
+	* row/row0mysql.c:
+	Fix Bug#14708715 CREATE TABLE MEMORY LEAK ON DB_OUT_OF_FILE_SPACE
+
[phone]	The InnoDB Team
+
+	* include/row0undo.h, row/row0umod.c, row/row0undo.c:
+	Fix Bug#13249921 ASSERT !BPAGE->FILE_PAGE_WAS_FREED, USUALLY
+	IN TRANSACTION ROLLBACK. This patch will ensure that the
+	undo logs will be applied in proper reverse order.
+
[phone]	The InnoDB Team
+
+	* btr/btr0cur.c, handler/ha_innodb.cc, ibuf/ibuf0ibuf.c,
+	include/btr0cur.h:
+	Fix Bug#14636528 INNODB CHANGE BUFFERING IS NOT ENTIRELY CRASH-SAFE
+
[phone]	The InnoDB Team
+
+	* btr/btr0btr.c, btr/btr0cur.c, buf/buf0lru.c,
+	include/page0zip.h, log/log0recv.c, page/page0cur.c,
+	page/page0page.c, page/page0zip.c:
+	Fix Bug#12701488 ASSERT PAGE_ZIP_VALIDATE, UNIV_ZIP_DEBUG
+
 2012-08-29	The InnoDB Team
 
 	* btr/btr0btr.c, page/page0cur.c, page/page0page.c:
 
=== modified file 'Percona-Server/storage/innodb_plugin/btr/btr0btr.c'
--- Percona-Server/storage/innodb_plugin/btr/btr0btr.c	2013-01-10 04:35:31 +0000
+++ Percona-Server/storage/innodb_plugin/btr/btr0btr.c	2013-01-10 04:35:33 +0000
@@ -1620,7 +1620,7 @@
 	ut_ad(mtr_memo_contains(mtr, block, MTR_MEMO_PAGE_X_FIX));
 	ut_ad(!!page_is_comp(page) == dict_table_is_comp(index->table));
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(!page_zip || page_zip_validate(page_zip, page));
+	ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 	data_size1 = page_get_data_size(page);
 	max_ins_size1 = page_get_max_insert_size_after_reorganize(page, 1);
@@ -1738,7 +1738,7 @@
 
 func_exit:
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(!page_zip || page_zip_validate(page_zip, page));
+	ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 #ifndef UNIV_HOTBACKUP
 	buf_block_free(temp_block);
@@ -1813,7 +1813,7 @@
 	ut_ad(mtr_memo_contains(mtr, block, MTR_MEMO_PAGE_X_FIX));
 	ut_ad(page_zip == buf_block_get_page_zip(block));
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(!page_zip || page_zip_validate(page_zip, page));
+	ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 
 	btr_search_drop_page_hash_index(block);
@@ -1870,10 +1870,10 @@
 	root_block = btr_cur_get_block(cursor);
 	root_page_zip = buf_block_get_page_zip(root_block);
 	ut_ad(page_get_n_recs(root) > 0);
+	index = btr_cur_get_index(cursor);
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(!root_page_zip || page_zip_validate(root_page_zip, root));
+	ut_a(!root_page_zip || page_zip_validate(root_page_zip, root, index));
 #endif /* UNIV_ZIP_DEBUG */
-	index = btr_cur_get_index(cursor);
 #ifdef UNIV_BTR_DEBUG
 	if (!dict_index_is_ibuf(index)) {
 		ulint	space = dict_index_get_space(index);
@@ -2803,8 +2803,8 @@
 
 #ifdef UNIV_ZIP_DEBUG
 	if (UNIV_LIKELY_NULL(page_zip)) {
-		ut_a(page_zip_validate(page_zip, page));
-		ut_a(page_zip_validate(new_page_zip, new_page));
+		ut_a(page_zip_validate(page_zip, page, cursor->index));
+		ut_a(page_zip_validate(new_page_zip, new_page, cursor->index));
 	}
 #endif /* UNIV_ZIP_DEBUG */
 
@@ -2838,7 +2838,8 @@
 			= buf_block_get_page_zip(insert_block);
 
 		ut_a(!insert_page_zip
-		     || page_zip_validate(insert_page_zip, insert_page));
+		     || page_zip_validate(insert_page_zip, insert_page,
+					  cursor->index));
 	}
 #endif /* UNIV_ZIP_DEBUG */
 
@@ -3203,7 +3204,7 @@
 
 		btr_page_set_level(page, page_zip, page_level, mtr);
 #ifdef UNIV_ZIP_DEBUG
-		ut_a(!page_zip || page_zip_validate(page_zip, page));
+		ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 	}
 
@@ -3379,8 +3380,8 @@
 		const page_zip_des_t*	page_zip
 			= buf_block_get_page_zip(block);
 		ut_a(page_zip);
-		ut_a(page_zip_validate(merge_page_zip, merge_page));
-		ut_a(page_zip_validate(page_zip, page));
+		ut_a(page_zip_validate(merge_page_zip, merge_page, index));
+		ut_a(page_zip_validate(page_zip, page, index));
 	}
 #endif /* UNIV_ZIP_DEBUG */
 
@@ -3513,7 +3514,8 @@
 
 	ut_ad(page_validate(merge_page, index));
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(!merge_page_zip || page_zip_validate(merge_page_zip, merge_page));
+	ut_a(!merge_page_zip || page_zip_validate(merge_page_zip, merge_page,
+						  index));
 #endif /* UNIV_ZIP_DEBUG */
 
 	/* Free the file page */
@@ -3696,7 +3698,7 @@
 		page_zip_des_t*	merge_page_zip
 			= buf_block_get_page_zip(merge_block);
 		ut_a(!merge_page_zip
-		     || page_zip_validate(merge_page_zip, merge_page));
+		     || page_zip_validate(merge_page_zip, merge_page, index));
 	}
 #endif /* UNIV_ZIP_DEBUG */
 
@@ -4173,7 +4175,7 @@
 		ut_a(space == page_get_space_id(page));
 #ifdef UNIV_ZIP_DEBUG
 		page_zip = buf_block_get_page_zip(block);
-		ut_a(!page_zip || page_zip_validate(page_zip, page));
+		ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 		ut_a(!page_is_leaf(page));
 
@@ -4201,7 +4203,7 @@
 
 #ifdef UNIV_ZIP_DEBUG
 	page_zip = buf_block_get_page_zip(block);
-	ut_a(!page_zip || page_zip_validate(page_zip, page));
+	ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 
 	/* Check ordering etc. of records */
 
=== modified file 'Percona-Server/storage/innodb_plugin/btr/btr0cur.c'
--- Percona-Server/storage/innodb_plugin/btr/btr0cur.c	2013-01-10 04:35:31 +0000
+++ Percona-Server/storage/innodb_plugin/btr/btr0cur.c	2013-01-10 04:35:33 +0000
@@ -651,7 +651,8 @@
 #ifdef UNIV_ZIP_DEBUG
 			const page_zip_des_t*	page_zip
 				= buf_block_get_page_zip(block);
-			ut_a(!page_zip || page_zip_validate(page_zip, page));
+			ut_a(!page_zip
+			     || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 
 			buf_block_dbg_add_level(
@@ -2084,7 +2085,7 @@
 
 	page_zip = buf_block_get_page_zip(block);
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(!page_zip || page_zip_validate(page_zip, page));
+	ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 
 	if (page_zip
@@ -2299,7 +2300,7 @@
 				MTR_MEMO_X_LOCK));
 	ut_ad((thr && thr_get_trx(thr)->fake_changes) || mtr_memo_contains(mtr, block, MTR_MEMO_PAGE_X_FIX));
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(!page_zip || page_zip_validate(page_zip, page));
+	ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 	/* The insert buffer tree should never be updated in place. */
 	ut_ad(!dict_index_is_ibuf(index));
@@ -2454,7 +2455,7 @@
 	btr_search_update_hash_on_delete(cursor);
 
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(!page_zip || page_zip_validate(page_zip, page));
+	ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 	page_cursor = btr_cur_get_page_cur(cursor);
 
@@ -2561,7 +2562,7 @@
 		buf_block_t*	rec_block = btr_cur_get_block(cursor);
 
 #ifdef UNIV_ZIP_DEBUG
-		ut_a(!page_zip || page_zip_validate(page_zip, page));
+		ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 		page = buf_block_get_frame(rec_block);
 #endif /* UNIV_ZIP_DEBUG */
 		page_zip = buf_block_get_page_zip(rec_block);
@@ -2587,7 +2588,7 @@
 
 return_after_reservations:
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(!page_zip || page_zip_validate(page_zip, page));
+	ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 
 	if (n_extents > 0) {
@@ -2946,19 +2947,20 @@
 	return(DB_SUCCESS);
 }
 
-/***********************************************************//**
-Clear a secondary index record's delete mark.  This function is only
+/***************************************************************
+Sets a secondary index record delete mark. This function is only
 used by the insert buffer insert merge mechanism. */
 UNIV_INTERN
 void
-btr_cur_del_unmark_for_ibuf(
-/*========================*/
+btr_cur_set_deleted_flag_for_ibuf(
+/*==============================*/
 	rec_t*		rec,		/*!< in/out: record to delete unmark */
 	page_zip_des_t*	page_zip,	/*!< in/out: compressed page
 					corresponding to rec, or NULL
 					when the tablespace is
 					uncompressed */
-	mtr_t*		mtr)		/*!< in: mtr */
+	ibool		val,		/*!< in: value to set */
+	mtr_t*		mtr)		/*!< in/out: mini-transaction */
 {
 	/* We do not need to reserve btr_search_latch, as the page
 	has just been read to the buffer pool and there cannot be
@@ -2966,9 +2968,9 @@
 	updated in place and the adaptive hash index does not depend
 	on it. */
 
-	btr_rec_set_deleted_flag(rec, page_zip, FALSE);
+	btr_rec_set_deleted_flag(rec, page_zip, val);
 
-	btr_cur_del_mark_set_sec_rec_log(rec, FALSE, mtr);
+	btr_cur_del_mark_set_sec_rec_log(rec, val, mtr);
 }
 
 /*==================== B-TREE RECORD REMOVE =========================*/
@@ -3063,12 +3065,14 @@
 				page, 1);
 		}
 #ifdef UNIV_ZIP_DEBUG
-		ut_a(!page_zip || page_zip_validate(page_zip, page));
+		ut_a(!page_zip
+		     || page_zip_validate(page_zip, page, cursor->index));
 #endif /* UNIV_ZIP_DEBUG */
 		page_cur_delete_rec(btr_cur_get_page_cur(cursor),
 				    cursor->index, offsets, mtr);
 #ifdef UNIV_ZIP_DEBUG
-		ut_a(!page_zip || page_zip_validate(page_zip, page));
+		ut_a(!page_zip
+		     || page_zip_validate(page_zip, page, cursor->index));
 #endif /* UNIV_ZIP_DEBUG */
 
 		if (dict_index_is_clust(cursor->index)
@@ -3165,7 +3169,7 @@
 	rec = btr_cur_get_rec(cursor);
 	page_zip = buf_block_get_page_zip(block);
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(!page_zip || page_zip_validate(page_zip, page));
+	ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 
 	offsets = rec_get_offsets(rec, index, NULL, ULINT_UNDEFINED, &heap);
@@ -3175,7 +3179,7 @@
 						      rec, offsets, page_zip,
 						      rb_ctx, mtr);
 #ifdef UNIV_ZIP_DEBUG
-		ut_a(!page_zip || page_zip_validate(page_zip, page));
+		ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 	}
 
@@ -3236,7 +3240,7 @@
 
 	page_cur_delete_rec(btr_cur_get_page_cur(cursor), index, offsets, mtr);
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(!page_zip || page_zip_validate(page_zip, page));
+	ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 
 	ut_ad(btr_check_node_ptr(index, block, mtr));
 
=== modified file 'Percona-Server/storage/innodb_plugin/buf/buf0buf.c'
--- Percona-Server/storage/innodb_plugin/buf/buf0buf.c	2013-01-10 04:35:31 +0000
+++ Percona-Server/storage/innodb_plugin/buf/buf0buf.c	2013-01-10 04:35:33 +0000
@@ -278,7 +278,7 @@
 
 #ifndef UNIV_HOTBACKUP
 /** Value in microseconds */
-static const int WAIT_FOR_READ	= 5000;
+static const int WAIT_FOR_READ	= 100;
 /** Number of attemtps made to read in a page in the buffer pool */
 static const ulint BUF_PAGE_READ_MAX_RETRIES = 100;
 
@@ -2202,8 +2202,9 @@
 				mutex_exit(&block->mutex);
 
 				if (io_fix == BUF_IO_READ) {
-
-					os_thread_sleep(WAIT_FOR_READ);
+					/* wait by temporaly s-latch */
+					rw_lock_s_lock(&(block->lock));
+					rw_lock_s_unlock(&(block->lock));
 				} else {
 					break;
 				}
 
=== modified file 'Percona-Server/storage/innodb_plugin/buf/buf0lru.c'
--- Percona-Server/storage/innodb_plugin/buf/buf0lru.c	2012-11-23 11:15:06 +0000
+++ Percona-Server/storage/innodb_plugin/buf/buf0lru.c	2013-01-10 04:35:33 +0000
@@ -1839,7 +1839,9 @@
 				break;
 			case FIL_PAGE_INDEX:
 #ifdef UNIV_ZIP_DEBUG
-				ut_a(page_zip_validate(&bpage->zip, page));
+				ut_a(page_zip_validate(
+					     &bpage->zip, page,
+					     ((buf_block_t*) bpage)->index));
 #endif /* UNIV_ZIP_DEBUG */
 				break;
 			default:
 
=== modified file 'Percona-Server/storage/innodb_plugin/dict/dict0dict.c'
--- Percona-Server/storage/innodb_plugin/dict/dict0dict.c	2012-08-20 03:14:02 +0000
+++ Percona-Server/storage/innodb_plugin/dict/dict0dict.c	2013-01-10 04:35:33 +0000
@@ -1,6 +1,6 @@
 /*****************************************************************************
 
-Copyright (c) 1996, 2011, Oracle and/or its affiliates. All Rights Reserved.
+Copyright (c) 1996, 2012, Oracle and/or its affiliates. All Rights Reserved.
 
 This program is free software; you can redistribute it and/or modify it under
 the terms of the GNU General Public License as published by the Free Software
@@ -498,38 +498,55 @@
 ULINT_UNDEFINED if not contained */
 UNIV_INTERN
 ulint
+dict_index_get_nth_col_or_prefix_pos(
+/*=================================*/
+	const dict_index_t*	index,		/*!< in: index */
+	ulint			n,		/*!< in: column number */
+	ibool			inc_prefix)	/*!< in: TRUE=consider
+						column prefixes too */
+{
+	const dict_field_t*	field;
+	const dict_col_t*	col;
+	ulint			pos;
+	ulint			n_fields;
+
+	ut_ad(index);
+	ut_ad(index->magic_n == DICT_INDEX_MAGIC_N);
+
+	col = dict_table_get_nth_col(index->table, n);
+
+	if (dict_index_is_clust(index)) {
+
+		return(dict_col_get_clust_pos(col, index));
+	}
+
+	n_fields = dict_index_get_n_fields(index);
+
+	for (pos = 0; pos < n_fields; pos++) {
+		field = dict_index_get_nth_field(index, pos);
+
+		if (col == field->col
+		    && (inc_prefix || field->prefix_len == 0)) {
+
+			return(pos);
+		}
+	}
+
+	return(ULINT_UNDEFINED);
+}
+
+/********************************************************************//**
+Looks for column n in an index.
+@return position in internal representation of the index;
+ULINT_UNDEFINED if not contained */
+UNIV_INTERN
+ulint
 dict_index_get_nth_col_pos(
 /*=======================*/
 	const dict_index_t*	index,	/*!< in: index */
 	ulint			n)	/*!< in: column number */
 {
-	const dict_field_t*	field;
-	const dict_col_t*	col;
-	ulint			pos;
-	ulint			n_fields;
-
-	ut_ad(index);
-	ut_ad(index->magic_n == DICT_INDEX_MAGIC_N);
-
-	col = dict_table_get_nth_col(index->table, n);
-
-	if (dict_index_is_clust(index)) {
-
-		return(dict_col_get_clust_pos(col, index));
-	}
-
-	n_fields = dict_index_get_n_fields(index);
-
-	for (pos = 0; pos < n_fields; pos++) {
-		field = dict_index_get_nth_field(index, pos);
-
-		if (col == field->col && field->prefix_len == 0) {
-
-			return(pos);
-		}
-	}
-
-	return(ULINT_UNDEFINED);
+	return(dict_index_get_nth_col_or_prefix_pos(index, n, FALSE));
 }
 
 #ifndef UNIV_HOTBACKUP
@@ -2062,7 +2079,6 @@
 {
 	dict_index_t*	new_index;
 	dict_field_t*	field;
-	ulint		fixed_size;
 	ulint		trx_id_pos;
 	ulint		i;
 	ibool*		indexed;
@@ -2139,7 +2155,7 @@
 
 		for (i = 0; i < trx_id_pos; i++) {
 
-			fixed_size = dict_col_get_fixed_size(
+			ulint	fixed_size = dict_col_get_fixed_size(
 				dict_index_get_nth_col(new_index, i),
 				dict_table_is_comp(table));
 
@@ -2156,7 +2172,20 @@
 				break;
 			}
 
-			new_index->trx_id_offset += (unsigned int) fixed_size;
+			/* Add fixed_size to new_index->trx_id_offset.
+			Because the latter is a bit-field, an overflow
+			can theoretically occur. Check for it. */
+			fixed_size += new_index->trx_id_offset;
+
+			new_index->trx_id_offset = fixed_size;
+
+			if (new_index->trx_id_offset != fixed_size) {
+				/* Overflow. Pretend that this is a
+				variable-length PRIMARY KEY. */
+				ut_ad(0);
+				new_index->trx_id_offset = 0;
+				break;
+			}
 		}
 
 	}
 
=== modified file 'Percona-Server/storage/innodb_plugin/handler/ha_innodb.cc'
--- Percona-Server/storage/innodb_plugin/handler/ha_innodb.cc	2013-01-10 04:35:31 +0000
+++ Percona-Server/storage/innodb_plugin/handler/ha_innodb.cc	2013-01-10 04:35:33 +0000
@@ -12123,8 +12123,8 @@
 #if defined UNIV_DEBUG || defined UNIV_IBUF_DEBUG
 static MYSQL_SYSVAR_UINT(change_buffering_debug, ibuf_debug,
   PLUGIN_VAR_RQCMDARG,
-  "Debug flags for InnoDB change buffering (0=none)",
-  NULL, NULL, 0, 0, 1, 0);
+  "Debug flags for InnoDB change buffering (0=none, 2=crash at merge)",
+  NULL, NULL, 0, 0, 2, 0);
 #endif /* UNIV_DEBUG || UNIV_IBUF_DEBUG */
 
 static MYSQL_SYSVAR_BOOL(random_read_ahead, srv_random_read_ahead,
 
=== modified file 'Percona-Server/storage/innodb_plugin/handler/handler0alter.cc'
--- Percona-Server/storage/innodb_plugin/handler/handler0alter.cc	2012-08-20 03:14:02 +0000
+++ Percona-Server/storage/innodb_plugin/handler/handler0alter.cc	2013-01-10 04:35:33 +0000
@@ -108,13 +108,17 @@
 		/* These column types should never be shipped to MySQL. */
 		ut_ad(0);
 
-	case DATA_CHAR:
 	case DATA_FIXBINARY:
 	case DATA_FLOAT:
 	case DATA_DOUBLE:
 	case DATA_DECIMAL:
 		/* Above are the valid column types for MySQL data. */
 		ut_ad(flen == len);
+		/* fall through */
+	case DATA_CHAR:
+		/* We may have flen > len when there is a shorter
+		prefix on a CHAR column. */
+		ut_ad(flen >= len);
 #else /* UNIV_DEBUG */
 	default:
 #endif /* UNIV_DEBUG */
@@ -147,7 +151,7 @@
 
 		field->reset();
 
-		ipos = dict_index_get_nth_col_pos(index, i);
+		ipos = dict_index_get_nth_col_or_prefix_pos(index, i, TRUE);
 
 		if (UNIV_UNLIKELY(ipos == ULINT_UNDEFINED)) {
 null_field:
 
=== modified file 'Percona-Server/storage/innodb_plugin/ibuf/ibuf0ibuf.c'
--- Percona-Server/storage/innodb_plugin/ibuf/ibuf0ibuf.c	2013-01-10 04:35:31 +0000
+++ Percona-Server/storage/innodb_plugin/ibuf/ibuf0ibuf.c	2013-01-10 04:35:33 +0000
@@ -3049,7 +3049,8 @@
 			/* The records only differ in the delete-mark.
 			Clear the delete-mark, like we did before
 			Bug #56680 was fixed. */
-			btr_cur_del_unmark_for_ibuf(rec, page_zip, mtr);
+			btr_cur_set_deleted_flag_for_ibuf(
+				rec, page_zip, FALSE, mtr);
 updated_in_place:
 			mem_heap_free(heap);
 			return;
@@ -3134,6 +3135,22 @@
 	ut_ad(ibuf_rec_get_page_no(btr_pcur_get_rec(pcur)) == page_no);
 	ut_ad(ibuf_rec_get_space(btr_pcur_get_rec(pcur)) == space);
 
+#if defined UNIV_DEBUG || defined UNIV_IBUF_DEBUG
+	if (ibuf_debug == 2) {
+		/* Inject a fault (crash). We do this before trying
+		optimistic delete, because a pessimistic delete in the
+		change buffer would require a larger test case. */
+
+		/* Flag the buffered record as processed, to avoid
+		an assertion failure after crash recovery. */
+		btr_cur_set_deleted_flag_for_ibuf(
+			btr_pcur_get_rec(pcur), NULL, TRUE, mtr);
+		mtr_commit(mtr);
+		log_make_checkpoint_at(IB_ULONGLONG_MAX, TRUE);
+		DBUG_SUICIDE();
+	}
+#endif /* UNIV_DEBUG || UNIV_IBUF_DEBUG */
+
 	success = btr_cur_optimistic_delete(btr_pcur_get_btr_cur(pcur), mtr);
 
 	if (success) {
@@ -3152,7 +3169,13 @@
 	ut_ad(ibuf_rec_get_page_no(btr_pcur_get_rec(pcur)) == page_no);
 	ut_ad(ibuf_rec_get_space(btr_pcur_get_rec(pcur)) == space);
 
-	/* We have to resort to a pessimistic delete from ibuf */
+	/* We have to resort to a pessimistic delete from ibuf.
+	Delete-mark the record so that it will not be applied again,
+	in case the server crashes before the pessimistic delete is
+	made persistent. */
+	btr_cur_set_deleted_flag_for_ibuf(
+		btr_pcur_get_rec(pcur), NULL, TRUE, mtr);
+
 	btr_pcur_store_position(pcur, mtr);
 
 	btr_pcur_commit_specify_mtr(pcur, mtr);
@@ -3461,7 +3484,7 @@
 			fputs("InnoDB: Discarding record\n ", stderr);
 			rec_print_old(stderr, rec);
 			fputs("\nInnoDB: from the insert buffer!\n\n", stderr);
-		} else if (block) {
+		} else if (block && !rec_get_deleted_flag(rec, 0)) {
 			/* Now we have at pcur a record which should be
 			inserted to the index page; NOTE that the call below
 			copies pointers to fields in rec, and we must
 
=== modified file 'Percona-Server/storage/innodb_plugin/include/btr0cur.h'
--- Percona-Server/storage/innodb_plugin/include/btr0cur.h	2012-10-16 11:18:45 +0000
+++ Percona-Server/storage/innodb_plugin/include/btr0cur.h	2013-01-10 04:35:33 +0000
@@ -358,19 +358,20 @@
 	ibool		val,	/*!< in: value to set */
 	que_thr_t*	thr,	/*!< in: query thread */
 	mtr_t*		mtr);	/*!< in: mtr */
-/***********************************************************//**
-Clear a secondary index record's delete mark.  This function is only
+/***************************************************************
+Sets a secondary index record delete mark. This function is only
 used by the insert buffer insert merge mechanism. */
 UNIV_INTERN
 void
-btr_cur_del_unmark_for_ibuf(
-/*========================*/
+btr_cur_set_deleted_flag_for_ibuf(
+/*==============================*/
 	rec_t*		rec,		/*!< in/out: record to delete unmark */
 	page_zip_des_t*	page_zip,	/*!< in/out: compressed page
 					corresponding to rec, or NULL
 					when the tablespace is
 					uncompressed */
-	mtr_t*		mtr);		/*!< in: mtr */
+	ibool		val,		/*!< in: value to set */
+	mtr_t*		mtr);		/*!< in/out: mini-transaction */
 /*************************************************************//**
 Tries to compress a page of the tree if it seems useful. It is assumed
 that mtr holds an x-latch on the tree and on the cursor page. To avoid
 
=== modified file 'Percona-Server/storage/innodb_plugin/include/dict0dict.h'
--- Percona-Server/storage/innodb_plugin/include/dict0dict.h	2012-05-09 04:14:12 +0000
+++ Percona-Server/storage/innodb_plugin/include/dict0dict.h	2013-01-10 04:35:33 +0000
@@ -839,6 +839,18 @@
 	const dict_index_t*	index,	/*!< in: index */
 	ulint			n);	/*!< in: column number */
 /********************************************************************//**
+Looks for column n in an index.
+@return position in internal representation of the index;
+ULINT_UNDEFINED if not contained */
+UNIV_INTERN
+ulint
+dict_index_get_nth_col_or_prefix_pos(
+/*=================================*/
+	const dict_index_t*	index,		/*!< in: index */
+	ulint			n,		/*!< in: column number */
+	ibool			inc_prefix);	/*!< in: TRUE=consider
+						column prefixes too */
+/********************************************************************//**
 Returns TRUE if the index contains a column or a prefix of that column.
 @return	TRUE if contains the column or its prefix */
 UNIV_INTERN
 
=== modified file 'Percona-Server/storage/innodb_plugin/include/dict0mem.h'
--- Percona-Server/storage/innodb_plugin/include/dict0mem.h	2012-05-09 04:14:12 +0000
+++ Percona-Server/storage/innodb_plugin/include/dict0mem.h	2013-01-10 04:35:33 +0000
@@ -286,10 +286,15 @@
 #endif /* !UNIV_HOTBACKUP */
 	unsigned	type:4;	/*!< index type (DICT_CLUSTERED, DICT_UNIQUE,
 				DICT_UNIVERSAL, DICT_IBUF) */
-	unsigned	trx_id_offset:10;/*!< position of the trx id column
+#define MAX_KEY_LENGTH_BITS 12
+	unsigned	trx_id_offset:MAX_KEY_LENGTH_BITS;
+				/*!< position of the trx id column
 				in a clustered index record, if the fields
 				before it are known to be of a fixed size,
 				0 otherwise */
+#if (1<<MAX_KEY_LENGTH_BITS) < MAX_KEY_LENGTH
+# error (1<<MAX_KEY_LENGTH_BITS) < MAX_KEY_LENGTH
+#endif
 	unsigned	n_user_defined_cols:10;
 				/*!< number of columns the user defined to
 				be in the index: in the internal
 
=== modified file 'Percona-Server/storage/innodb_plugin/include/page0zip.h'
--- Percona-Server/storage/innodb_plugin/include/page0zip.h	2011-11-24 02:00:38 +0000
+++ Percona-Server/storage/innodb_plugin/include/page0zip.h	2013-01-10 04:35:33 +0000
@@ -156,9 +156,10 @@
 /*==================*/
 	const page_zip_des_t*	page_zip,/*!< in: compressed page */
 	const page_t*		page,	/*!< in: uncompressed page */
+	const dict_index_t*	index,	/*!< in: index of the page, if known */
 	ibool			sloppy)	/*!< in: FALSE=strict,
 					TRUE=ignore the MIN_REC_FLAG */
-	__attribute__((nonnull));
+	__attribute__((nonnull(1,2)));
 /**********************************************************************//**
 Check that the compressed and decompressed pages match. */
 UNIV_INTERN
@@ -166,8 +167,9 @@
 page_zip_validate(
 /*==============*/
 	const page_zip_des_t*	page_zip,/*!< in: compressed page */
-	const page_t*		page)	/*!< in: uncompressed page */
-	__attribute__((nonnull));
+	const page_t*		page,	/*!< in: uncompressed page */
+	const dict_index_t*	index)	/*!< in: index of the page, if known */
+	__attribute__((nonnull(1,2)));
 #endif /* UNIV_ZIP_DEBUG */
 
 /**********************************************************************//**
 
=== modified file 'Percona-Server/storage/innodb_plugin/include/row0undo.h'
--- Percona-Server/storage/innodb_plugin/include/row0undo.h	2009-05-26 12:28:49 +0000
+++ Percona-Server/storage/innodb_plugin/include/row0undo.h	2013-01-10 04:35:33 +0000
@@ -87,10 +87,6 @@
 enum undo_exec {
 	UNDO_NODE_FETCH_NEXT = 1,	/*!< we should fetch the next
 					undo log record */
-	UNDO_NODE_PREV_VERS,		/*!< the roll ptr to previous
-					version of a row is stored in
-					node, and undo should be done
-					based on it */
 	UNDO_NODE_INSERT,		/*!< undo a fresh insert of a
 					row to a table */
 	UNDO_NODE_MODIFY		/*!< undo a modify operation
@@ -108,9 +104,6 @@
 	undo_no_t	undo_no;/*!< undo number of the record */
 	ulint		rec_type;/*!< undo log record type: TRX_UNDO_INSERT_REC,
 				... */
-	roll_ptr_t	new_roll_ptr;
-				/*!< roll ptr to restore to clustered index
-				record */
 	trx_id_t	new_trx_id; /*!< trx id to restore to clustered index
 				record */
 	btr_pcur_t	pcur;	/*!< persistent cursor used in searching the
 
=== modified file 'Percona-Server/storage/innodb_plugin/log/log0recv.c'
--- Percona-Server/storage/innodb_plugin/log/log0recv.c	2012-06-14 09:16:03 +0000
+++ Percona-Server/storage/innodb_plugin/log/log0recv.c	2013-01-10 04:35:33 +0000
@@ -1687,9 +1687,8 @@
 	if (fil_page_get_type(page) == FIL_PAGE_INDEX) {
 		page_zip_des_t*	page_zip = buf_block_get_page_zip(block);
 
-		if (page_zip) {
-			ut_a(page_zip_validate_low(page_zip, page, FALSE));
-		}
+		ut_a(!page_zip
+		     || page_zip_validate_low(page_zip, page, NULL, FALSE));
 	}
 #endif /* UNIV_ZIP_DEBUG */
 
 
=== modified file 'Percona-Server/storage/innodb_plugin/os/os0file.c'
--- Percona-Server/storage/innodb_plugin/os/os0file.c	2013-01-04 07:28:01 +0000
+++ Percona-Server/storage/innodb_plugin/os/os0file.c	2013-01-10 04:35:33 +0000
@@ -1296,6 +1296,14 @@
 	DWORD		create_flag;
 	DWORD		attributes;
 	ibool		retry;
+
+	DBUG_EXECUTE_IF(
+		"ib_create_table_fail_disk_full",
+		*success = FALSE;
+		SetLastError(ERROR_DISK_FULL);
+		return((os_file_t) -1);
+	);
+
 try_again:
 	ut_a(name);
 
@@ -1411,6 +1419,13 @@
 	ibool		retry;
 	const char*	mode_str	= NULL;
 
+	DBUG_EXECUTE_IF(
+		"ib_create_table_fail_disk_full",
+		*success = FALSE;
+		errno = ENOSPC;
+		return((os_file_t) -1);
+	);
+
 try_again:
 	ut_a(name);
 
 
=== modified file 'Percona-Server/storage/innodb_plugin/page/page0cur.c'
--- Percona-Server/storage/innodb_plugin/page/page0cur.c	2013-01-10 04:35:31 +0000
+++ Percona-Server/storage/innodb_plugin/page/page0cur.c	2013-01-10 04:35:33 +0000
@@ -310,7 +310,7 @@
 #endif /* UNIV_DEBUG */
 	page = buf_block_get_frame(block);
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(!page_zip || page_zip_validate(page_zip, page));
+	ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 
 	page_check_dir(page);
@@ -1248,7 +1248,7 @@
 
 	ut_ad(!page_rec_is_supremum(*current_rec));
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(page_zip_validate(page_zip, page));
+	ut_a(page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 
 	/* 1. Get the size of the physical record in the page */
@@ -1973,7 +1973,7 @@
 	}
 
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(!page_zip || page_zip_validate(page_zip, page));
+	ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 }
 
 
=== modified file 'Percona-Server/storage/innodb_plugin/page/page0page.c'
--- Percona-Server/storage/innodb_plugin/page/page0page.c	2013-01-10 04:35:31 +0000
+++ Percona-Server/storage/innodb_plugin/page/page0page.c	2013-01-10 04:35:33 +0000
@@ -625,7 +625,7 @@
 		Furthermore, btr_compress() may set FIL_PAGE_PREV to
 		FIL_NULL on new_page while leaving it intact on
 		new_page_zip.  So, we cannot validate new_page_zip. */
-		ut_a(page_zip_validate_low(page_zip, page, TRUE));
+		ut_a(page_zip_validate_low(page_zip, page, index, TRUE));
 	}
 #endif /* UNIV_ZIP_DEBUG */
 	ut_ad(buf_block_get_frame(block) == page);
@@ -945,7 +945,7 @@
 	ut_ad(size == ULINT_UNDEFINED || size < UNIV_PAGE_SIZE);
 	ut_ad(!page_zip || page_rec_is_comp(rec));
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(!page_zip || page_zip_validate(page_zip, page));
+	ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 
 	if (page_rec_is_infimum(rec)) {
@@ -987,7 +987,7 @@
 						  ULINT_UNDEFINED, &heap);
 			rec = rec_get_next_ptr(rec, TRUE);
 #ifdef UNIV_ZIP_DEBUG
-			ut_a(page_zip_validate(page_zip, page));
+			ut_a(page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 			page_cur_delete_rec(&cur, index, offsets, mtr);
 		} while (page_offset(rec) != PAGE_NEW_SUPREMUM);
@@ -1127,7 +1127,8 @@
 		between btr_attach_half_pages() and insert_page = ...
 		when btr_page_get_split_rec_to_left() holds
 		(direction == FSP_DOWN). */
-		ut_a(!page_zip || page_zip_validate_low(page_zip, page, TRUE));
+		ut_a(!page_zip
+		     || page_zip_validate_low(page_zip, page, index, TRUE));
 	}
 #endif /* UNIV_ZIP_DEBUG */
 
@@ -1198,9 +1199,10 @@
 			= buf_block_get_page_zip(block);
 		ut_a(!new_page_zip == !page_zip);
 		ut_a(!new_page_zip
-		     || page_zip_validate(new_page_zip, new_page));
+		     || page_zip_validate(new_page_zip, new_page, index));
 		ut_a(!page_zip
-		     || page_zip_validate(page_zip, page_align(split_rec)));
+		     || page_zip_validate(page_zip, page_align(split_rec),
+					  index));
 	}
 #endif /* UNIV_ZIP_DEBUG */
 
 
=== modified file 'Percona-Server/storage/innodb_plugin/page/page0zip.c'
--- Percona-Server/storage/innodb_plugin/page/page0zip.c	2011-11-24 02:00:43 +0000
+++ Percona-Server/storage/innodb_plugin/page/page0zip.c	2013-01-10 04:35:33 +0000
@@ -1437,7 +1437,7 @@
 	       page_zip_get_size(page_zip) - PAGE_DATA);
 	mem_heap_free(heap);
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(page_zip_validate(page_zip, page));
+	ut_a(page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 
 	if (mtr) {
@@ -3123,6 +3123,7 @@
 /*==================*/
 	const page_zip_des_t*	page_zip,/*!< in: compressed page */
 	const page_t*		page,	/*!< in: uncompressed page */
+	const dict_index_t*	index,	/*!< in: index of the page, if known */
 	ibool			sloppy)	/*!< in: FALSE=strict,
 					TRUE=ignore the MIN_REC_FLAG */
 {
@@ -3210,39 +3211,102 @@
 		committed.  Let us tolerate that difference when we
 		are performing a sloppy validation. */
 
-		if (sloppy) {
-			byte	info_bits_diff;
-			ulint	offset
-				= rec_get_next_offs(page + PAGE_NEW_INFIMUM,
-						    TRUE);
-			ut_a(offset >= PAGE_NEW_SUPREMUM);
-			offset -= 5 /* REC_NEW_INFO_BITS */;
-
-			info_bits_diff = page[offset] ^ temp_page[offset];
-
-			if (info_bits_diff == REC_INFO_MIN_REC_FLAG) {
-				temp_page[offset] = page[offset];
-
-				if (!memcmp(page + PAGE_HEADER,
-					    temp_page + PAGE_HEADER,
-					    UNIV_PAGE_SIZE - PAGE_HEADER
-					    - FIL_PAGE_DATA_END)) {
-
-					/* Only the minimum record flag
-					differed.  Let us ignore it. */
-					page_zip_fail(("page_zip_validate: "
-						       "min_rec_flag "
-						       "(ignored, "
-						       "%lu,%lu,0x%02lx)\n",
-						       page_get_space_id(page),
-						       page_get_page_no(page),
-						       (ulong) page[offset]));
-					goto func_exit;
+		ulint*		offsets;
+		mem_heap_t*	heap;
+		const rec_t*	rec;
+		const rec_t*	trec;
+		byte		info_bits_diff;
+		ulint		offset
+			= rec_get_next_offs(page + PAGE_NEW_INFIMUM, TRUE);
+		ut_a(offset >= PAGE_NEW_SUPREMUM);
+		offset -= 5/*REC_NEW_INFO_BITS*/;
+
+		info_bits_diff = page[offset] ^ temp_page[offset];
+
+		if (info_bits_diff == REC_INFO_MIN_REC_FLAG) {
+			temp_page[offset] = page[offset];
+
+			if (!memcmp(page + PAGE_HEADER,
+				    temp_page + PAGE_HEADER,
+				    UNIV_PAGE_SIZE - PAGE_HEADER
+				    - FIL_PAGE_DATA_END)) {
+
+				/* Only the minimum record flag
+				differed.  Let us ignore it. */
+				page_zip_fail(("page_zip_validate: "
+					       "min_rec_flag "
+					       "(%s"
+					       "%lu,%lu,0x%02lx)\n",
+					       sloppy ? "ignored, " : "",
+					       page_get_space_id(page),
+					       page_get_page_no(page),
+					       (ulong) page[offset]));
+				valid = sloppy;
+				goto func_exit;
+			}
+		}
+
+		/* Compare the pointers in the PAGE_FREE list. */
+		rec = page_header_get_ptr(page, PAGE_FREE);
+		trec = page_header_get_ptr(temp_page, PAGE_FREE);
+
+		while (rec || trec) {
+			if (page_offset(rec) != page_offset(trec)) {
+				page_zip_fail(("page_zip_validate: "
+					       "PAGE_FREE list: %u!=%u\n",
+					       (unsigned) page_offset(rec),
+					       (unsigned) page_offset(trec)));
+				valid = FALSE;
+				goto func_exit;
+			}
+
+			rec = page_rec_get_next_low(rec, TRUE);
+			trec = page_rec_get_next_low(trec, TRUE);
+		}
+
+		/* Compare the records. */
+		heap = NULL;
+		offsets = NULL;
+		rec = page_rec_get_next_low(
+			page + PAGE_NEW_INFIMUM, TRUE);
+		trec = page_rec_get_next_low(
+			temp_page + PAGE_NEW_INFIMUM, TRUE);
+
+		do {
+			if (page_offset(rec) != page_offset(trec)) {
+				page_zip_fail(("page_zip_validate: "
+					       "record list: 0x%02x!=0x%02x\n",
+					       (unsigned) page_offset(rec),
+					       (unsigned) page_offset(trec)));
+				valid = FALSE;
+				break;
+			}
+
+			if (index) {
+				/* Compare the data. */
+				offsets = rec_get_offsets(
+					rec, index, offsets,
+					ULINT_UNDEFINED, &heap);
+
+				if (memcmp(rec - rec_offs_extra_size(offsets),
+					   trec - rec_offs_extra_size(offsets),
+					   rec_offs_size(offsets))) {
+					page_zip_fail(
+						("page_zip_validate: "
+						 "record content: 0x%02x",
+						 (unsigned) page_offset(rec)));
+					valid = FALSE;
+					break;
 				}
 			}
+
+			rec = page_rec_get_next_low(rec, TRUE);
+			trec = page_rec_get_next_low(trec, TRUE);
+		} while (rec || trec);
+
+		if (heap) {
+			mem_heap_free(heap);
 		}
-		page_zip_fail(("page_zip_validate: content\n"));
-		valid = FALSE;
 	}
 
 func_exit:
@@ -3264,9 +3328,10 @@
 page_zip_validate(
 /*==============*/
 	const page_zip_des_t*	page_zip,/*!< in: compressed page */
-	const page_t*		page)	/*!< in: uncompressed page */
+	const page_t*		page,	/*!< in: uncompressed page */
+	const dict_index_t*	index)	/*!< in: index of the page, if known */
 {
-	return(page_zip_validate_low(page_zip, page,
+	return(page_zip_validate_low(page_zip, page, index,
 				     recv_recovery_is_on()));
 }
 #endif /* UNIV_ZIP_DEBUG */
@@ -3597,7 +3662,7 @@
 	page_zip->m_nonempty = TRUE;
 
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(page_zip_validate(page_zip, page_align(rec)));
+	ut_a(page_zip_validate(page_zip, page_align(rec), index));
 #endif /* UNIV_ZIP_DEBUG */
 }
 
@@ -3644,7 +3709,7 @@
 		}
 
 #ifdef UNIV_ZIP_DEBUG
-		ut_a(page_zip_validate(page_zip, page));
+		ut_a(page_zip_validate(page_zip, page, NULL));
 #endif /* UNIV_ZIP_DEBUG */
 
 		memcpy(page + offset,
@@ -3653,7 +3718,7 @@
 		       ptr + 4, BTR_EXTERN_FIELD_REF_SIZE);
 
 #ifdef UNIV_ZIP_DEBUG
-		ut_a(page_zip_validate(page_zip, page));
+		ut_a(page_zip_validate(page_zip, page, NULL));
 #endif /* UNIV_ZIP_DEBUG */
 	}
 
@@ -3720,7 +3785,7 @@
 	memcpy(externs, field, BTR_EXTERN_FIELD_REF_SIZE);
 
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(page_zip_validate(page_zip, page));
+	ut_a(page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 
 	if (mtr) {
@@ -3791,7 +3856,7 @@
 		}
 
 #ifdef UNIV_ZIP_DEBUG
-		ut_a(page_zip_validate(page_zip, page));
+		ut_a(page_zip_validate(page_zip, page, NULL));
 #endif /* UNIV_ZIP_DEBUG */
 
 		field = page + offset;
@@ -3812,7 +3877,7 @@
 		memcpy(storage, ptr + 4, REC_NODE_PTR_SIZE);
 
 #ifdef UNIV_ZIP_DEBUG
-		ut_a(page_zip_validate(page_zip, page));
+		ut_a(page_zip_validate(page_zip, page, NULL));
 #endif /* UNIV_ZIP_DEBUG */
 	}
 
@@ -4039,7 +4104,7 @@
 	}
 
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(page_zip_validate(page_zip, page));
+	ut_a(page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 }
 
@@ -4063,7 +4128,7 @@
 		*slot &= ~(PAGE_ZIP_DIR_SLOT_DEL >> 8);
 	}
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(page_zip_validate(page_zip, page_align(rec)));
+	ut_a(page_zip_validate(page_zip, page_align(rec), NULL));
 #endif /* UNIV_ZIP_DEBUG */
 }
 
@@ -4364,14 +4429,14 @@
 			goto corrupt;
 		}
 #ifdef UNIV_ZIP_DEBUG
-		ut_a(page_zip_validate(page_zip, page));
+		ut_a(page_zip_validate(page_zip, page, NULL));
 #endif /* UNIV_ZIP_DEBUG */
 
 		memcpy(page + offset, ptr, len);
 		memcpy(page_zip->data + offset, ptr, len);
 
 #ifdef UNIV_ZIP_DEBUG
-		ut_a(page_zip_validate(page_zip, page));
+		ut_a(page_zip_validate(page_zip, page, NULL));
 #endif /* UNIV_ZIP_DEBUG */
 	}
 
@@ -4446,7 +4511,7 @@
 	ut_ad(mtr_memo_contains(mtr, block, MTR_MEMO_PAGE_X_FIX));
 	ut_ad(page_is_comp(page));
 	ut_ad(!dict_index_is_ibuf(index));
-	/* Note that page_zip_validate(page_zip, page) may fail here. */
+	/* Note that page_zip_validate(page_zip, page, index) may fail here. */
 	UNIV_MEM_ASSERT_RW(page, UNIV_PAGE_SIZE);
 	UNIV_MEM_ASSERT_RW(page_zip->data, page_zip_get_size(page_zip));
 
@@ -4533,7 +4598,7 @@
 	FIL_PAGE_PREV or PAGE_LEVEL, causing a temporary min_rec_flag
 	mismatch.  A strict page_zip_validate() will be executed later
 	during the B-tree operations. */
-	ut_a(page_zip_validate_low(src_zip, src, TRUE));
+	ut_a(page_zip_validate_low(src_zip, src, index, TRUE));
 #endif /* UNIV_ZIP_DEBUG */
 	ut_a(page_zip_get_size(page_zip) == page_zip_get_size(src_zip));
 	if (UNIV_UNLIKELY(src_zip->n_blobs)) {
@@ -4594,7 +4659,7 @@
 	}
 
 #ifdef UNIV_ZIP_DEBUG
-	ut_a(page_zip_validate(page_zip, page));
+	ut_a(page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
 	btr_blob_dbg_add(page, index, "page_zip_copy_recs");
 
 
=== modified file 'Percona-Server/storage/innodb_plugin/row/row0mysql.c'
--- Percona-Server/storage/innodb_plugin/row/row0mysql.c	2012-10-17 11:00:21 +0000
+++ Percona-Server/storage/innodb_plugin/row/row0mysql.c	2013-01-10 04:35:33 +0000
@@ -1792,7 +1792,8 @@
 one of "innodb_monitor", "innodb_lock_monitor", "innodb_tablespace_monitor",
 "innodb_table_monitor", then this will also start the printing of monitor
 output by the master thread. If the table name ends in "innodb_mem_validate",
-InnoDB will try to invoke mem_validate().
+InnoDB will try to invoke mem_validate(). On failure the transaction will
+be rolled back and the 'table' object will be freed.
 @return	error code or DB_SUCCESS */
 UNIV_INTERN
 int
@@ -1931,6 +1932,8 @@
 
 			row_drop_table_for_mysql(table->name, trx, FALSE);
 			trx_commit_for_mysql(trx);
+		} else {
+			dict_mem_table_free(table);
 		}
 		break;
 
 
=== modified file 'Percona-Server/storage/innodb_plugin/row/row0sel.c'
--- Percona-Server/storage/innodb_plugin/row/row0sel.c	2012-04-02 02:09:15 +0000
+++ Percona-Server/storage/innodb_plugin/row/row0sel.c	2013-01-10 04:35:33 +0000
@@ -3926,6 +3926,11 @@
 	}
 
 rec_loop:
+	if (trx_is_interrupted(trx)) {
+		err = DB_INTERRUPTED;
+		goto normal_return;
+	}
+
 	/*-------------------------------------------------------------*/
 	/* PHASE 4: Look for matching records in a loop */
 
@@ -4860,12 +4865,16 @@
 
 	rec_offs_init(offsets_);
 
-	offsets = rec_get_offsets(rec, index, offsets, ULINT_UNDEFINED, &heap);
+	offsets = rec_get_offsets(rec, index, offsets, col_no + 1, &heap);
+
+	if (rec_offs_nth_sql_null(offsets, col_no)) {
+		/* There is no non-NULL value in the auto-increment column. */
+		value = 0;
+		goto func_exit;
+	}
 
 	data = rec_get_nth_field(rec, offsets, col_no, &len);
 
-	ut_a(len != UNIV_SQL_NULL);
-
 	switch (mtype) {
 	case DATA_INT:
 		ut_a(len <= sizeof value);
@@ -4886,14 +4895,15 @@
 		ut_error;
 	}
 
-	if (UNIV_LIKELY_NULL(heap)) {
-		mem_heap_free(heap);
-	}
-
 	if (!unsigned_type && (ib_int64_t) value < 0) {
 		value = 0;
 	}
 
+func_exit:
+	if (UNIV_LIKELY_NULL(heap)) {
+		mem_heap_free(heap);
+	}
+
 	return(value);
 }
 
 
=== modified file 'Percona-Server/storage/innodb_plugin/row/row0umod.c'
--- Percona-Server/storage/innodb_plugin/row/row0umod.c	2011-02-02 12:12:49 +0000
+++ Percona-Server/storage/innodb_plugin/row/row0umod.c	2013-01-10 04:35:33 +0000
@@ -69,36 +69,6 @@
 introduced where a call to log_free_check() is bypassed. */
 
 /***********************************************************//**
-Checks if also the previous version of the clustered index record was
-modified or inserted by the same transaction, and its undo number is such
-that it should be undone in the same rollback.
-@return	TRUE if also previous modify or insert of this row should be undone */
-static
-ibool
-row_undo_mod_undo_also_prev_vers(
-/*=============================*/
-	undo_node_t*	node,	/*!< in: row undo node */
-	undo_no_t*	undo_no)/*!< out: the undo number */
-{
-	trx_undo_rec_t*	undo_rec;
-	trx_t*		trx;
-
-	trx = node->trx;
-
-	if (0 != ut_dulint_cmp(node->new_trx_id, trx->id)) {
-
-		*undo_no = ut_dulint_zero;
-		return(FALSE);
-	}
-
-	undo_rec = trx_undo_get_undo_rec_low(node->new_roll_ptr, node->heap);
-
-	*undo_no = trx_undo_rec_get_undo_no(undo_rec);
-
-	return(ut_dulint_cmp(trx->roll_limit, *undo_no) <= 0);
-}
-
-/***********************************************************//**
 Undoes a modify in a clustered index record.
 @return	DB_SUCCESS, DB_FAIL, or error code: we may run out of file space */
 static
@@ -226,19 +196,11 @@
 	btr_pcur_t*	pcur;
 	mtr_t		mtr;
 	ulint		err;
-	ibool		success;
-	ibool		more_vers;
-	undo_no_t	new_undo_no;
 
 	ut_ad(node && thr);
 
 	log_free_check();
 
-	/* Check if also the previous version of the clustered index record
-	should be undone in this same rollback operation */
-
-	more_vers = row_undo_mod_undo_also_prev_vers(node, &new_undo_no);
-
 	pcur = &(node->pcur);
 
 	mtr_start(&mtr);
@@ -286,20 +248,6 @@
 
 	trx_undo_rec_release(node->trx, node->undo_no);
 
-	if (more_vers && err == DB_SUCCESS) {
-
-		/* Reserve the undo log record to the prior version after
-		committing &mtr: this is necessary to comply with the latching
-		order, as &mtr may contain the fsp latch which is lower in
-		the latch hierarchy than trx->undo_mutex. */
-
-		success = trx_undo_rec_reserve(node->trx, new_undo_no);
-
-		if (success) {
-			node->state = UNDO_NODE_PREV_VERS;
-		}
-	}
-
 	return(err);
 }
 
@@ -799,7 +747,6 @@
 	trx_undo_update_rec_get_update(ptr, clust_index, type, trx_id,
 				       roll_ptr, info_bits, trx,
 				       node->heap, &(node->update));
-	node->new_roll_ptr = roll_ptr;
 	node->new_trx_id = trx_id;
 	node->cmpl_info = cmpl_info;
 }
 
=== modified file 'Percona-Server/storage/innodb_plugin/row/row0undo.c'
--- Percona-Server/storage/innodb_plugin/row/row0undo.c	2010-06-29 13:00:58 +0000
+++ Percona-Server/storage/innodb_plugin/row/row0undo.c	2013-01-10 04:35:33 +0000
@@ -283,25 +283,6 @@
 		} else {
 			node->state = UNDO_NODE_MODIFY;
 		}
-
-	} else if (node->state == UNDO_NODE_PREV_VERS) {
-
-		/* Undo should be done to the same clustered index record
-		again in this same rollback, restoring the previous version */
-
-		roll_ptr = node->new_roll_ptr;
-
-		node->undo_rec = trx_undo_get_undo_rec_low(roll_ptr,
-							   node->heap);
-		node->roll_ptr = roll_ptr;
-		node->undo_no = trx_undo_rec_get_undo_no(node->undo_rec);
-
-		if (trx_undo_roll_ptr_is_insert(roll_ptr)) {
-
-			node->state = UNDO_NODE_INSERT;
-		} else {
-			node->state = UNDO_NODE_MODIFY;
-		}
 	}
 
 	/* Prevent DROP TABLE etc. while we are rolling back this row.
 
=== modified file 'Percona-Server/storage/myisam/myisamchk.c'
--- Percona-Server/storage/myisam/myisamchk.c	2011-06-30 15:37:13 +0000
+++ Percona-Server/storage/myisam/myisamchk.c	2013-01-10 04:35:33 +0000
@@ -310,7 +310,14 @@
     &check_param.write_buffer_length, 0, GET_ULONG, REQUIRED_ARG,
     (long) READ_BUFFER_INIT, (long) MALLOC_OVERHEAD,
     INT_MAX32, (long) MALLOC_OVERHEAD, (long) 1L, 0},
-  { "sort_buffer_size", OPT_SORT_BUFFER_SIZE, "",
+  { "sort_buffer_size", OPT_SORT_BUFFER_SIZE, 
+    "Deprecated. myisam_sort_buffer_size alias is being used",
+    &check_param.sort_buffer_length,
+    &check_param.sort_buffer_length, 0, GET_ULONG, REQUIRED_ARG,
+    (long) SORT_BUFFER_INIT, (long) (MIN_SORT_BUFFER + MALLOC_OVERHEAD),
+    ULONG_MAX, (long) MALLOC_OVERHEAD, (long) 1L, 0},
+  { "myisam_sort_buffer_size", OPT_SORT_BUFFER_SIZE, 
+    "Alias of sort_buffer_size parameter",
     &check_param.sort_buffer_length,
     &check_param.sort_buffer_length, 0, GET_ULONG, REQUIRED_ARG,
     (long) SORT_BUFFER_INIT, (long) (MIN_SORT_BUFFER + MALLOC_OVERHEAD),
 
=== modified file 'Percona-Server/tests/mysql_client_test.c'
--- Percona-Server/tests/mysql_client_test.c	2012-08-20 00:29:22 +0000
+++ Percona-Server/tests/mysql_client_test.c	2013-01-10 04:35:33 +0000
@@ -15278,6 +15278,7 @@
 
   rc= mysql_query(mysql, "set names default");
   myquery(rc);
+  DBUG_VOID_RETURN;
 }