Merge mysql-5.1-security -> mysql-5.5-security

mysql-test/suite/innodb/r/innodb_bug13510739.result

+CREATE TABLE bug13510739 (c INTEGER NOT NULL, PRIMARY KEY (c)) ENGINE=INNODB;
+INSERT INTO bug13510739 VALUES (1), (2), (3), (4);
+DELETE FROM bug13510739 WHERE c=2;
+HANDLER bug13510739 OPEN;
+HANDLER bug13510739 READ `primary` = (2);
+c
+HANDLER bug13510739 READ `primary` NEXT;
+c
+4
+DROP TABLE bug13510739;

mysql-test/suite/innodb/t/innodb_bug13510739.test

+#
+# Bug#13510739 63775: SERVER CRASH ON HANDLER READ NEXT AFTER DELETE RECORD.
+#
+
+-- source include/have_innodb.inc
+
+CREATE TABLE bug13510739 (c INTEGER NOT NULL, PRIMARY KEY (c)) ENGINE=INNODB;
+
+INSERT INTO bug13510739 VALUES (1), (2), (3), (4);
+
+DELETE FROM bug13510739 WHERE c=2;
+
+HANDLER bug13510739 OPEN;
+
+HANDLER bug13510739 READ `primary` = (2);
+
+# this one crashes the server if the bug is present
+HANDLER bug13510739 READ `primary` NEXT;
+
+DROP TABLE bug13510739;

storage/innobase/row/row0sel.c

@@ -4362,7 +4362,9 @@ no_gap_lock:
 		applicable to unique secondary indexes. Current behaviour is
 		to widen the scope of a lock on an already delete marked record
 		if the same record is deleted twice by the same transaction */
-		if (index == clust_index && unique_search) {
+		if (index == clust_index && unique_search
+		    && !prebuilt->used_in_HANDLER) {
+
 			err = DB_RECORD_NOT_FOUND;
 
 			goto normal_return;