diff --git a/client/mysql.cc b/client/mysql.cc
index 05d5d1355ad05e60f19a9f44464f029457702795..358b13e652b4da7d990438b8b229a590b1449821 100644
--- a/client/mysql.cc
+++ b/client/mysql.cc
@@ -1971,7 +1971,7 @@ print_field_types(MYSQL_RES *result)
   MYSQL_FIELD	*field;  
   while ((field = mysql_fetch_field(result)))
   {
-    tee_fprintf(PAGER,"Catalog:    '%s'\nDatabase:   '%s'\nTable:      '%s'\nName:       '%s'\nType:       %d\nLength:     %d\nMax length: %d\nIs_null:    %d\nFlags:      %d\nDecimals:   %d\n\n",
+    tee_fprintf(PAGER,"Catalog:    '%s'\nDatabase:   '%s'\nTable:      '%s'\nName:       '%s'\nType:       %d\nLength:     %ld\nMax length: %ld\nIs_null:    %d\nFlags:      %u\nDecimals:   %u\n\n",
 		field->catalog, field->db, field->table, field->name,
 		(int) field->type,
 		field->length, field->max_length,
@@ -2017,7 +2017,8 @@ print_table_data(MYSQL_RES *result)
     (void) tee_fputs("|", PAGER);
     for (uint off=0; (field = mysql_fetch_field(result)) ; off++)
     {
-      tee_fprintf(PAGER, " %-*s|",min(field->max_length,MAX_COLUMN_LENGTH),
+      tee_fprintf(PAGER, " %-*s|",(int) min(field->max_length,
+                                            MAX_COLUMN_LENGTH),
 		  field->name);
       num_flag[off]= IS_NUM(field->type);
     }
diff --git a/client/mysqltest.c b/client/mysqltest.c
index 7be65941f2da5af1f8d71c4314fda107a9eef3b1..6226189cbbbd6c26f02e840e8d5d2b0cccb3714e 100644
--- a/client/mysqltest.c
+++ b/client/mysqltest.c
@@ -359,8 +359,7 @@ DYNAMIC_STRING ds_res;
 static void die(const char *fmt, ...);
 static void init_var_hash();
 static VAR* var_from_env(const char *, const char *);
-static byte* get_var_key(const byte* rec, uint* len,
-			 my_bool __attribute__((unused)) t);
+static byte* get_var_key(const byte* rec, uint* len, my_bool t);
 static VAR* var_init(VAR* v, const char *name, int name_len, const char *val,
 		     int val_len);
 
@@ -1785,6 +1784,10 @@ int read_line(char* buf, int size)
       continue;
     }
 
+    /* Line counting is independent of state */
+    if (c == '\n')
+      (*lineno)++;
+
     switch(state) {
     case R_NORMAL:
       /*  Only accept '{' in the beginning of a line */
@@ -1800,14 +1803,12 @@ int read_line(char* buf, int size)
       else if (c == '\n')
       {
 	state = R_LINE_START;
-	(*lineno)++;
       }
       break;
     case R_COMMENT:
       if (c == '\n')
       {
 	*p= 0;
-	(*lineno)++;
 	DBUG_RETURN(0);
       }
       break;
@@ -1819,7 +1820,7 @@ int read_line(char* buf, int size)
       else if (my_isspace(charset_info, c))
       {
 	if (c == '\n')
-	  start_lineno= ++*lineno;		/* Query hasn't started yet */
+	  start_lineno= *lineno;		/* Query hasn't started yet */
 	no_save= 1;
       }
       else if (c == '}')
diff --git a/heap/hp_hash.c b/heap/hp_hash.c
index 71eecc8bdf2efbac17aecad149bc3cf682e76425..b54e76d79fe5b749e41b7dd3cdd9d3c4fa4608e9 100644
--- a/heap/hp_hash.c
+++ b/heap/hp_hash.c
@@ -585,7 +585,7 @@ uint hp_rb_make_key(HP_KEYDEF *keydef, byte *key,
                               char_length / seg->charset->mbmaxlen);
       set_if_smaller(char_length, seg->length); /* QQ: ok to remove? */
       if (char_length < seg->length)
-        seg->charset->cset->fill(seg->charset, key + char_length, 
+        seg->charset->cset->fill(seg->charset, (char*) key + char_length, 
                                  seg->length - char_length, ' ');
     }
     memcpy(key, rec + seg->start, (size_t) char_length);
@@ -634,7 +634,7 @@ uint hp_rb_pack_key(HP_KEYDEF *keydef, uchar *key, const uchar *old,
                               char_length / seg->charset->mbmaxlen);
       set_if_smaller(char_length, seg->length); /* QQ: ok to remove? */
       if (char_length < seg->length)
-        seg->charset->cset->fill(seg->charset, key + char_length, 
+        seg->charset->cset->fill(seg->charset, (char*) key + char_length, 
                                  seg->length - char_length, ' ');
     }
     memcpy(key, old, (size_t) char_length);
diff --git a/innobase/dict/dict0load.c b/innobase/dict/dict0load.c
index 1866921c589ca268dfa97135ba83f7a8fcfda0c9..d430eadc97b3c68107edee761b15635f938cf88b 100644
--- a/innobase/dict/dict0load.c
+++ b/innobase/dict/dict0load.c
@@ -92,7 +92,7 @@ loop:
 
 		/* We found one */
 
-		char*	table_name = mem_strdupl(field, len);
+                char*	table_name = mem_strdupl((char*) field, len);
 		
 		btr_pcur_close(&pcur);
 		mtr_commit(&mtr);
@@ -154,7 +154,7 @@ loop:
 
 		/* We found one */
 
-		char*	table_name = mem_strdupl(field, len);
+                char*	table_name = mem_strdupl((char*) field, len);
 
 		btr_pcur_store_position(&pcur, &mtr);
 
@@ -246,7 +246,7 @@ loop:
 
 		/* We found one */
 
-		char*	name = mem_strdupl(field, len);
+                char*	name = mem_strdupl((char*) field, len);
 
 		field = rec_get_nth_field(rec, 9, &len);
 		ut_a(len == 4);
@@ -347,7 +347,7 @@ dict_load_columns(
 			dict_table_get_first_index(sys_columns), 4))->name));
 
 		field = rec_get_nth_field(rec, 4, &len);
-		name = mem_heap_strdupl(heap, field, len);
+		name = mem_heap_strdupl(heap, (char*) field, len);
 
 		field = rec_get_nth_field(rec, 5, &len);
 		mtype = mach_read_from_4(field);
@@ -494,7 +494,7 @@ dict_load_fields(
 		field = rec_get_nth_field(rec, 4, &len);
 
 		dict_mem_index_add_field(index,
-			mem_heap_strdupl(heap, field, len), 0, prefix_len);
+                                         mem_heap_strdupl(heap, (char*) field, len), 0, prefix_len);
 
 		btr_pcur_move_to_next_user_rec(&pcur, &mtr);
 	} 
@@ -597,7 +597,7 @@ dict_load_indexes(
 			dict_table_get_first_index(sys_indexes), 4))->name));
 		
 		field = rec_get_nth_field(rec, 4, &name_len);
-		name_buf = mem_heap_strdupl(heap, field, name_len);
+		name_buf = mem_heap_strdupl(heap, (char*) field, name_len);
 
 		field = rec_get_nth_field(rec, 5, &len);
 		n_fields = mach_read_from_4(field);
@@ -805,7 +805,7 @@ dict_load_table(
 		table->mix_id = mach_read_from_8(field);
 
 		field = rec_get_nth_field(rec, 8, &len);
-		table->cluster_name = mem_heap_strdupl(heap, field, len);
+		table->cluster_name = mem_heap_strdupl(heap, (char*) field, len);
 #endif
 	}
 
@@ -938,7 +938,7 @@ dict_load_table_on_id(
 	/* Now we get the table name from the record */
 	field = rec_get_nth_field(rec, 1, &len);
 	/* Load the table definition to memory */
-	table = dict_load_table(mem_heap_strdupl(heap, field, len));
+	table = dict_load_table(mem_heap_strdupl(heap, (char*) field, len));
 	
 	btr_pcur_close(&pcur);
 	mtr_commit(&mtr);
@@ -1030,11 +1030,11 @@ dict_load_foreign_cols(
 
 		field = rec_get_nth_field(rec, 4, &len);
 		foreign->foreign_col_names[i] =
-			mem_heap_strdupl(foreign->heap, field, len);
+                        mem_heap_strdupl(foreign->heap, (char*) field, len);
 
 		field = rec_get_nth_field(rec, 5, &len);
 		foreign->referenced_col_names[i] =
-			mem_heap_strdupl(foreign->heap, field, len);
+                  mem_heap_strdupl(foreign->heap, (char*) field, len);
 
 		btr_pcur_move_to_next_user_rec(&pcur, &mtr);
 	} 
@@ -1138,11 +1138,11 @@ dict_load_foreign(
 
 	field = rec_get_nth_field(rec, 3, &len);
 	foreign->foreign_table_name =
-		mem_heap_strdupl(foreign->heap, field, len);
+                mem_heap_strdupl(foreign->heap, (char*) field, len);
 	
 	field = rec_get_nth_field(rec, 4, &len);
 	foreign->referenced_table_name =
-		mem_heap_strdupl(foreign->heap, field, len);
+                mem_heap_strdupl(foreign->heap, (char*) field, len);
 
 	btr_pcur_close(&pcur);
 	mtr_commit(&mtr);
@@ -1256,7 +1256,7 @@ loop:
 
 	/* Now we get a foreign key constraint id */
 	field = rec_get_nth_field(rec, 1, &len);
-	id = mem_heap_strdupl(heap, field, len);
+	id = mem_heap_strdupl(heap, (char*) field, len);
 	
 	btr_pcur_store_position(&pcur, &mtr);
 
diff --git a/innobase/include/mem0mem.h b/innobase/include/mem0mem.h
index 056d3dc508fa33036401a510cb92d4c9e0a52ee7..87afdb8f91c2fe6289c7f52f583d78d1911f8c44 100644
--- a/innobase/include/mem0mem.h
+++ b/innobase/include/mem0mem.h
@@ -136,10 +136,8 @@ void
 mem_heap_free_func(
 /*===============*/
 	mem_heap_t*   	heap,  		/* in, own: heap to be freed */
-	const char*	file_name __attribute__((unused)),
-					/* in: file name where freed */
-	ulint    	line  __attribute__((unused)));
-					/* in: line where freed */
+	const char*	file_name, 	/* in: file name where freed */
+	ulint    	line);		/* in: line where freed */
 /*******************************************************************
 Allocates n bytes of memory from a memory heap. */
 UNIV_INLINE
diff --git a/libmysql/client_settings.h b/libmysql/client_settings.h
index 552307733ead4e266fa8c1957fad1fd422fc0783..f53f054a28d62a2e9a91080f144d27b87e790f88 100644
--- a/libmysql/client_settings.h
+++ b/libmysql/client_settings.h
@@ -21,7 +21,7 @@ extern my_string	mysql_unix_port;
                              CLIENT_TRANSACTIONS | \
 			     CLIENT_PROTOCOL_41 | CLIENT_SECURE_CONNECTION)
 
-sig_handler pipe_sig_handler(int sig __attribute__((unused)));
+sig_handler pipe_sig_handler(int sig);
 void read_user_name(char *name);
 my_bool handle_local_infile(MYSQL *mysql, const char *net_filename);
 
diff --git a/myisam/ft_nlq_search.c b/myisam/ft_nlq_search.c
index c9caf4f39afb715890cdde581e043e8c7698cd5d..83de6acdab93a607351300ca8fbbdfbbb746d1a4 100644
--- a/myisam/ft_nlq_search.c
+++ b/myisam/ft_nlq_search.c
@@ -99,6 +99,7 @@ static int walk_and_match(FT_WORD *word, uint32 count, ALL_IN_ONE *aio)
 
   info->update|= HA_STATE_AKTIV;              /* for _mi_test_if_changed() */
 
+  /* The following should be safe, even if we compare doubles */
   while (!r && gweight)
   {
 
@@ -127,6 +128,7 @@ static int walk_and_match(FT_WORD *word, uint32 count, ALL_IN_ONE *aio)
 #else
 #error
 #endif
+  /* The following should be safe, even if we compare doubles */
     if (tmp_weight==0)
       DBUG_RETURN(doc_cnt); /* stopword, doc_cnt should be 0 */
 
diff --git a/myisam/rt_index.c b/myisam/rt_index.c
index 4fffd84862430f227dde684b4abfa3fd41601579..cfb2ca877f428522a1f1b3bbc84ba319b0501dfc 100644
--- a/myisam/rt_index.c
+++ b/myisam/rt_index.c
@@ -494,9 +494,11 @@ static uchar *rtree_pick_key(MI_INFO *info, MI_KEYDEF *keyinfo, uchar *key,
 
   for (; k < last; k = rt_PAGE_NEXT_KEY(k, key_length, nod_flag))
   {
+    /* The following is safe as -1.0 is an exact number */
     if ((increase = rtree_area_increase(keyinfo->seg, k, key, key_length, 
-                                        &area)) == -1)
+                                        &area)) == -1.0)
       return NULL;
+    /* The following should be safe, even if we compare doubles */
     if (increase < best_incr)
     {
       best_key = k;
@@ -505,6 +507,7 @@ static uchar *rtree_pick_key(MI_INFO *info, MI_KEYDEF *keyinfo, uchar *key,
     }
     else
     {
+      /* The following should be safe, even if we compare doubles */
       if ((increase == best_incr) && (area < best_area))
       {
         best_key = k;
@@ -1021,6 +1024,7 @@ ha_rows rtree_estimate(MI_INFO *info, uint keynr, uchar *key,
     {
       double k_area = rtree_rect_volume(keyinfo->seg, k, key_length);
 
+      /* The following should be safe, even if we compare doubles */
       if (k_area == 0)
       {
         if (flag & (MBR_CONTAIN | MBR_INTERSECT))
diff --git a/myisam/rt_mbr.c b/myisam/rt_mbr.c
index c7fde674729a98f85823be16b973e6f75e30b647..c43daec2f7cf1787adcb59b6986e74fc9d78b865 100644
--- a/myisam/rt_mbr.c
+++ b/myisam/rt_mbr.c
@@ -129,6 +129,7 @@ int rtree_key_cmp(HA_KEYSEG *keyseg, uchar *b, uchar *a, uint key_length,
       break;
 #endif
     case HA_KEYTYPE_FLOAT:
+      /* The following should be safe, even if we compare doubles */
       RT_CMP_GET(float, mi_float4get, 4, nextflag);
       break;
     case HA_KEYTYPE_DOUBLE:
diff --git a/mysql-test/r/ps.result b/mysql-test/r/ps.result
index 0950a066e64fdb0f4eac75602188dc333f176db8..a416ba5c4824ebdbf8f718335f7d2fc1c831d69a 100644
--- a/mysql-test/r/ps.result
+++ b/mysql-test/r/ps.result
@@ -410,3 +410,17 @@ a	a
 1.1	1.2
 2.1	2.2
 deallocate prepare stmt;
+create table t1 (a int);
+insert into t1 values (1),(2),(3);
+create table t2 select * from t1;
+PREPARE my_stmt FROM 'create table t2 select * from t1';
+drop table t2;
+execute my_stmt;
+drop table t2;
+execute my_stmt;
+execute my_stmt;
+ERROR 42S01: Table 't2' already exists
+drop table t2;
+execute my_stmt;
+drop table t1,t2;
+deallocate prepare my_stmt;
diff --git a/mysql-test/t/ps.test b/mysql-test/t/ps.test
index 04ab8aa62a8e78e039f4a8f1dd41481ac643e8d1..9546a698e588fb722bb65b67825bf15cb11f63ac 100644
--- a/mysql-test/t/ps.test
+++ b/mysql-test/t/ps.test
@@ -415,3 +415,21 @@ execute stmt;
 execute stmt;
 execute stmt;
 deallocate prepare stmt;
+
+#
+# Test CREATE TABLE ... SELECT (Bug #6094)
+#
+create table t1 (a int); 
+insert into t1 values (1),(2),(3);
+create table t2 select * from t1;
+PREPARE my_stmt FROM 'create table t2 select * from t1';
+drop table t2;
+execute my_stmt;
+drop table t2;
+execute my_stmt;
+--error 1050
+execute my_stmt;
+drop table t2;
+execute my_stmt;
+drop table t1,t2;
+deallocate prepare my_stmt;
diff --git a/mysys/hash.c b/mysys/hash.c
index cf0f1d2dde66e09d456a939f819bdb9ddb5ea5f0..d068299d44e7e18b212f21fa6442f20d68640572 100644
--- a/mysys/hash.c
+++ b/mysys/hash.c
@@ -174,6 +174,7 @@ static uint hash_rec_mask(HASH *hash,HASH_LINK *pos,uint buffmax,
 
 
 /* for compilers which can not handle inline */
+static
 #if !defined(__SUNPRO_C) && !defined(__USLC__) && !defined(__sgi)
 inline
 #endif
diff --git a/mysys/my_handler.c b/mysys/my_handler.c
index 360a7666e9419fe8c28b32bd14a46196e9b99194..00f25924e69a98db4dd55fa529d065d656f7d849 100644
--- a/mysys/my_handler.c
+++ b/mysys/my_handler.c
@@ -309,6 +309,11 @@ int ha_key_cmp(register HA_KEYSEG *keyseg, register uchar *a,
     case HA_KEYTYPE_FLOAT:
       mi_float4get(f_1,a);
       mi_float4get(f_2,b);
+      /*
+        The following may give a compiler warning about floating point
+        comparison not being safe, but this is ok in this context as
+        we are bascily doing sorting
+      */
       if (piks && (flag = CMP_NUM(f_1,f_2)))
         return ((keyseg->flag & HA_REVERSE_SORT) ? -flag : flag);
       a=  end;
@@ -317,6 +322,11 @@ int ha_key_cmp(register HA_KEYSEG *keyseg, register uchar *a,
     case HA_KEYTYPE_DOUBLE:
       mi_float8get(d_1,a);
       mi_float8get(d_2,b);
+      /*
+        The following may give a compiler warning about floating point
+        comparison not being safe, but this is ok in this context as
+        we are bascily doing sorting
+      */
       if (piks && (flag = CMP_NUM(d_1,d_2)))
         return ((keyseg->flag & HA_REVERSE_SORT) ? -flag : flag);
       a=  end;
diff --git a/mysys/my_thr_init.c b/mysys/my_thr_init.c
index 0ce59bee34698fee92813d4ab5a7eb7d73e223df..36b37f68b46f423dd5262438059ac12e583eac89 100644
--- a/mysys/my_thr_init.c
+++ b/mysys/my_thr_init.c
@@ -64,6 +64,11 @@ my_bool my_thread_global_init(void)
   }
 #ifdef PTHREAD_ADAPTIVE_MUTEX_INITIALIZER_NP
   pthread_mutexattr_init(&my_fast_mutexattr);
+  /*
+    Note that the following statement may give a compiler warning under
+    some configurations, but there isn't anything we can do about this as
+    this is a bug in the header files for the thread implementation
+  */
   pthread_mutexattr_setkind_np(&my_fast_mutexattr,PTHREAD_MUTEX_ADAPTIVE_NP);
 #endif
 #ifdef PTHREAD_ERRORCHECK_MUTEX_INITIALIZER_NP
diff --git a/ndb/include/mgmapi/mgmapi.h b/ndb/include/mgmapi/mgmapi.h
index 41fd211063e6089e24f82e2ed01926c832b86033..f1bf002a87cda234713bdc610d3ddd98bebb06dd 100644
--- a/ndb/include/mgmapi/mgmapi.h
+++ b/ndb/include/mgmapi/mgmapi.h
@@ -271,7 +271,7 @@ extern "C" {
    *   Log categories
    */
   enum ndb_mgm_event_category {
-    NDB_MGM_ILLEGAL_EVENT_CATEGORY = -1,     /*< Invalid
+    NDB_MGM_ILLEGAL_EVENT_CATEGORY = -1,
     /**
      * Events during all kinds of startups
      */
diff --git a/regex/main.c b/regex/main.c
index f43a112a661e30ce8104d1a5808e697e7c924e17..29abca6d9a26d05347f8818f5186d967ece393a6 100644
--- a/regex/main.c
+++ b/regex/main.c
@@ -78,7 +78,7 @@ char *argv[];
 	if (err) {
 		len = regerror(err, &re, erbuf, sizeof(erbuf));
 		fprintf(stderr, "error %s, %d/%d `%s'\n",
-			eprint(err), len, sizeof(erbuf), erbuf);
+			eprint(err), len, (int) sizeof(erbuf), erbuf);
 		exit(status);
 	}
 	regprint(&re, stdout);
@@ -96,7 +96,7 @@ char *argv[];
 	if (err) {
 		len = regerror(err, &re, erbuf, sizeof(erbuf));
 		fprintf(stderr, "error %s, %d/%d `%s'\n",
-			eprint(err), len, sizeof(erbuf), erbuf);
+			eprint(err), (int) len, (int) sizeof(erbuf), erbuf);
 		exit(status);
 	}
 	if (!(copts&REG_NOSUB)) {
@@ -232,7 +232,7 @@ int opts;			/* may not match f1 */
 		len = regerror(err, &re, erbuf, sizeof(erbuf));
 		fprintf(stderr, "%d: %s error %s, %d/%d `%s'\n",
 					line, type, eprint(err), len,
-					sizeof(erbuf), erbuf);
+					(int) sizeof(erbuf), erbuf);
 		status = 1;
 	} else if (err == 0 && opt('C', f1)) {
 		/* unexpected success */
@@ -263,7 +263,7 @@ int opts;			/* may not match f1 */
 		len = regerror(err, &re, erbuf, sizeof(erbuf));
 		fprintf(stderr, "%d: %s exec error %s, %d/%d `%s'\n",
 					line, type, eprint(err), len,
-					sizeof(erbuf), erbuf);
+					(int) sizeof(erbuf), erbuf);
 		status = 1;
 	} else if (err != 0) {
 		/* nothing more to check */
diff --git a/sql/item.h b/sql/item.h
index b3142ec4b0646a3268aaab8770221ec3e2306782..0bf127944040eb6e1643ce32c48f7322252480c1 100644
--- a/sql/item.h
+++ b/sql/item.h
@@ -97,7 +97,8 @@ public:
   static void *operator new(size_t size) {return (void*) sql_alloc((uint) size); }
   static void *operator new(size_t size, MEM_ROOT *mem_root)
   { return (void*) alloc_root(mem_root, (uint) size); }
-  static void operator delete(void *ptr,size_t size) {} /*lint -e715 */
+  static void operator delete(void *ptr,size_t size) {}
+  static void operator delete(void *ptr,size_t size, MEM_ROOT *mem_root) {}
 
   enum Type {FIELD_ITEM, FUNC_ITEM, SUM_FUNC_ITEM, STRING_ITEM,
 	     INT_ITEM, REAL_ITEM, NULL_ITEM, VARBIN_ITEM,
diff --git a/sql/item_func.h b/sql/item_func.h
index e61459cfbd86503de57c4c53bfe8e0ad3ec4161f..6e43d66a32d040c48bc34a4b8c40dc1438575b36 100644
--- a/sql/item_func.h
+++ b/sql/item_func.h
@@ -348,6 +348,7 @@ class Item_dec_func :public Item_real_func
 #ifndef HAVE_FINITE
     return value;
 #else
+    /* The following should be safe, even if we compare doubles */
     if (finite(value) && value != POSTFIX_ERROR)
       return value;
     null_value=1;
@@ -1032,6 +1033,7 @@ public:
   table_map not_null_tables() const { return 0; }
   bool fix_fields(THD *thd, struct st_table_list *tlist, Item **ref);
   bool eq(const Item *, bool binary_cmp) const;
+  /* The following should be safe, even if we compare doubles */
   longlong val_int() { DBUG_ASSERT(fixed == 1); return val()!=0.0; }
   double val();
   void print(String *str);
diff --git a/sql/spatial.h b/sql/spatial.h
index 45db1ca8d00db3f4d0d818512e2362a858aaaebc..b96434831a1e017353d9576695b8e7b29eb7c4bf 100644
--- a/sql/spatial.h
+++ b/sql/spatial.h
@@ -97,12 +97,14 @@ struct MBR
 
   int equals(const MBR *mbr)
   {
+    /* The following should be safe, even if we compare doubles */
     return ((mbr->xmin == xmin) && (mbr->ymin == ymin) &&
 	    (mbr->xmax == xmax) && (mbr->ymax == ymax));
   }
 
   int disjoint(const MBR *mbr)
   {
+    /* The following should be safe, even if we compare doubles */
     return ((mbr->xmin > xmax) || (mbr->ymin > ymax) ||
 	    (mbr->xmax < xmin) || (mbr->ymax < ymin));
   }
@@ -114,6 +116,7 @@ struct MBR
 
   int touches(const MBR *mbr)
   {
+    /* The following should be safe, even if we compare doubles */
     return ((((mbr->xmin == xmax) || (mbr->xmax == xmin)) && 
 	     ((mbr->ymin >= ymin) && (mbr->ymin <= ymax) || 
 	      (mbr->ymax >= ymin) && (mbr->ymax <= ymax))) ||
@@ -124,18 +127,21 @@ struct MBR
 
   int within(const MBR *mbr)
   {
+    /* The following should be safe, even if we compare doubles */
     return ((mbr->xmin <= xmin) && (mbr->ymin <= ymin) &&
 	    (mbr->xmax >= xmax) && (mbr->ymax >= ymax));
   }
 
   int contains(const MBR *mbr)
   {
+    /* The following should be safe, even if we compare doubles */
     return ((mbr->xmin >= xmin) && (mbr->ymin >= ymin) &&
 	    (mbr->xmax <= xmax) && (mbr->ymax <= ymax));
   }
 
   bool inner_point(double x, double y) const
   {
+    /* The following should be safe, even if we compare doubles */
     return (xmin<x) && (xmax>x) && (ymin<y) && (ymax>x);
   }
 
@@ -164,6 +170,9 @@ public:
     return buffer;
   }
 
+  static void operator delete(void *ptr, void *buffer)
+  {}
+
   enum wkbType
   {
     wkb_point= 1,
diff --git a/sql/sql_lex.h b/sql/sql_lex.h
index 38cdde019ffa099e9d3e2d241250ed8f7253703b..040a52ae30ee53664a08c86103ff807c8353275e 100644
--- a/sql/sql_lex.h
+++ b/sql/sql_lex.h
@@ -241,6 +241,7 @@ public:
   static void *operator new(size_t size, MEM_ROOT *mem_root)
   { return (void*) alloc_root(mem_root, (uint) size); }
   static void operator delete(void *ptr,size_t size) {}
+  static void operator delete(void *ptr,size_t size, MEM_ROOT *mem_root) {}
   st_select_lex_node(): linkage(UNSPECIFIED_TYPE) {}
   virtual ~st_select_lex_node() {}
   inline st_select_lex_node* get_master() { return master; }
diff --git a/sql/sql_list.h b/sql/sql_list.h
index c3b9c7f87eab650cdc247889f129aa7a358192ef..38c5af2a4f766fe9d98e4de2ac171fadfeb5659d 100644
--- a/sql/sql_list.h
+++ b/sql/sql_list.h
@@ -41,6 +41,8 @@ public:
   static void *operator new(size_t size, MEM_ROOT *mem_root)
   { return (void*) alloc_root(mem_root, (uint) size); }
   static void operator delete(void *ptr, size_t size) { TRASH(ptr, size); }
+  static void operator delete(void *ptr, size_t size, MEM_ROOT *mem_root)
+  { TRASH(ptr, size); }
   static void operator delete[](void *ptr, size_t size) { TRASH(ptr, size); }
 #ifdef HAVE_purify
   bool dummy;
diff --git a/sql/sql_parse.cc b/sql/sql_parse.cc
index 8279e32c8deb8eddc2dbff5f222d6c1e20fe7615..bb25fd57d0e5667b6a4a5de76889de27475626d9 100644
--- a/sql/sql_parse.cc
+++ b/sql/sql_parse.cc
@@ -1862,8 +1862,8 @@ mysql_execute_command(THD *thd)
 {
   int	res= 0;
   LEX	*lex= thd->lex;
-  TABLE_LIST *tables= (TABLE_LIST*) lex->select_lex.table_list.first;
   SELECT_LEX *select_lex= &lex->select_lex;
+  TABLE_LIST *tables= (TABLE_LIST*) select_lex->table_list.first;
   SELECT_LEX_UNIT *unit= &lex->unit;
   DBUG_ENTER("mysql_execute_command");
 
@@ -2333,30 +2333,6 @@ mysql_execute_command(THD *thd)
     {
       select_result *result;
 
-      if (!(lex->create_info.options & HA_LEX_CREATE_TMP_TABLE) &&
-	  find_real_table_in_list(tables, create_table->db,
-				  create_table->real_name))
-      {
-	net_printf(thd,ER_UPDATE_TABLE_USED, create_table->real_name);
-	goto create_error;
-      }
-      if (lex->create_info.used_fields & HA_CREATE_USED_UNION)
-      {
-        TABLE_LIST *tab;
-        for (tab= tables; tab; tab= tab->next)
-        {
-          if (find_real_table_in_list((TABLE_LIST*) lex->create_info.
-                                      merge_list.first,
-                                      tables->db, tab->real_name))
-          {
-            net_printf(thd, ER_UPDATE_TABLE_USED, tab->real_name);
-            goto create_error;
-          }
-        }  
-      }    
-
-      if (tables && check_table_access(thd, SELECT_ACL, tables,0))
-	goto create_error;			// Error message is given
       select_lex->options|= SELECT_NO_UNLOCK;
       unit->offset_limit_cnt= select_lex->offset_limit;
       unit->select_limit_cnt= select_lex->select_limit+
@@ -5282,7 +5258,7 @@ int multi_delete_precheck(THD *thd, TABLE_LIST *tables, uint *table_count)
   INSERT ... SELECT query pre-check
 
   SYNOPSIS
-    multi_delete_precheck()
+    insert_delete_precheck()
     thd		Thread handler
     tables	Global table list
 
@@ -5404,26 +5380,69 @@ int insert_precheck(THD *thd, TABLE_LIST *tables)
   RETURN VALUE
     0   OK
     1   Error (message is sent to user)
-    -1  Error (message is not sent to user)
 */
 
 int create_table_precheck(THD *thd, TABLE_LIST *tables,
 			  TABLE_LIST *create_table)
 {
   LEX *lex= thd->lex;
+  SELECT_LEX *select_lex= &lex->select_lex;
+  ulong want_priv;
+  int error= 1;                                 // Error message is given
   DBUG_ENTER("create_table_precheck");
-  ulong want_priv= ((lex->create_info.options & HA_LEX_CREATE_TMP_TABLE) ?
-		    CREATE_TMP_ACL : CREATE_ACL);
+
+  want_priv= ((lex->create_info.options & HA_LEX_CREATE_TMP_TABLE) ?
+              CREATE_TMP_ACL : CREATE_ACL);
   lex->create_info.alias= create_table->alias;
   if (check_access(thd, want_priv, create_table->db,
 		   &create_table->grant.privilege, 0, 0) ||
       check_merge_table_access(thd, create_table->db,
 			       (TABLE_LIST *)
 			       lex->create_info.merge_list.first))
-    DBUG_RETURN(1);
-  DBUG_RETURN((grant_option && want_priv != CREATE_TMP_ACL &&
-	       check_grant(thd, want_priv, create_table, 0, UINT_MAX, 0)) ?
-	      1 : 0);
+    goto err;
+  if (grant_option && want_priv != CREATE_TMP_ACL &&
+      check_grant(thd, want_priv, create_table, 0, UINT_MAX, 0))
+    goto err;
+
+  if (select_lex->item_list.elements)
+  {
+    /* Check permissions for used tables in CREATE TABLE ... SELECT */
+
+    /*
+      For temporary tables or PREPARED STATEMETNS we don't have to check
+      if the created table exists
+    */
+    if (!(lex->create_info.options & HA_LEX_CREATE_TMP_TABLE) &&
+        ! thd->current_arena->is_stmt_prepare() &&
+        find_real_table_in_list(tables, create_table->db,
+                                create_table->real_name))
+    {
+      net_printf(thd,ER_UPDATE_TABLE_USED, create_table->real_name);
+
+      goto err;
+    }
+    if (lex->create_info.used_fields & HA_CREATE_USED_UNION)
+    {
+      TABLE_LIST *tab;
+      for (tab= tables; tab; tab= tab->next)
+      {
+        if (find_real_table_in_list((TABLE_LIST*) lex->create_info.
+                                    merge_list.first,
+                                    tables->db, tab->real_name))
+        {
+          net_printf(thd, ER_UPDATE_TABLE_USED, tab->real_name);
+          goto err;
+        }
+      }  
+    }    
+
+    if (tables && check_table_access(thd, SELECT_ACL, tables,0))
+      goto err;
+  }
+  error= 0;
+
+err:
+  DBUG_RETURN(error);
 }
 
 
diff --git a/sql/sql_prepare.cc b/sql/sql_prepare.cc
index 12f526c55663303a7c6880e2bddb36911dc913f7..0e9394989258105811d9f7e14d18578f05a09808 100644
--- a/sql/sql_prepare.cc
+++ b/sql/sql_prepare.cc
@@ -1391,7 +1391,6 @@ static int send_prepare_results(Prepared_statement *stmt, bool text_protocol)
       lex->unit.create_total_list(thd, lex, &tables))
     DBUG_RETURN(1);
 
-  
   switch (sql_command) {
   case SQLCOM_REPLACE:
   case SQLCOM_INSERT:
diff --git a/sql/sql_string.h b/sql/sql_string.h
index d8c4c3a87a152c71096dee482ea4545450b46d9a..2d36899115995926adebd864dc2abcdea1ef00c1 100644
--- a/sql/sql_string.h
+++ b/sql/sql_string.h
@@ -71,7 +71,9 @@ public:
   }
   static void *operator new(size_t size, MEM_ROOT *mem_root)
   { return (void*) alloc_root(mem_root, (uint) size); }
-  static void operator delete(void *ptr_arg,size_t size) /*lint -e715 */
+  static void operator delete(void *ptr_arg,size_t size)
+    {}
+  static void operator delete(void *ptr_arg,size_t size, MEM_ROOT *mem_root)
     {}
   ~String() { free(); }
 
diff --git a/strings/ctype-mb.c b/strings/ctype-mb.c
index e7527b418f5dc8e2ba6abe11c463f0787cef52ea..7d81766c4cb4c51932dbcb403cb2bad4bb19aabd 100644
--- a/strings/ctype-mb.c
+++ b/strings/ctype-mb.c
@@ -502,7 +502,8 @@ my_bool my_like_range_mb(CHARSET_INFO *cs,
         representation of the max_sort_char character,
         and copy it into max_str in a loop. 
       */
-      buflen= cs->cset->wc_mb(cs, cs->max_sort_char, buf, buf + sizeof(buf));
+      buflen= cs->cset->wc_mb(cs, cs->max_sort_char, (uchar*) buf,
+                              (uchar*) buf + sizeof(buf));
       DBUG_ASSERT(buflen > 0);
       do
       {