Merge bk-internal:/home/bk/mysql-5.1-opt

into  magare.gmz:/home/kgeorge/mysql/work/merge-5.1-opt

mysql-test/r/insert_update.result

@@ -393,3 +393,17 @@ id	c1	cnt
 1	0	3
 2	2	1
 DROP TABLE t1;
+create table t1(f1 int primary key,
+f2 timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP);
+insert into t1(f1) values(1);
+select @stamp1:=f2 from t1;
+@stamp1:=f2
+#
+insert into t1(f1) values(1) on duplicate key update f1=1;
+select @stamp2:=f2 from t1;
+@stamp2:=f2
+#
+select if( @stamp1 = @stamp2, "correct", "wrong");
+if( @stamp1 = @stamp2, "correct", "wrong")
+correct
+drop table t1;

mysql-test/r/trigger.result

@@ -1454,19 +1454,22 @@ CREATE TABLE t2 (id INTEGER);
 INSERT INTO t2 VALUES (1),(2);
 CREATE TRIGGER t1_test AFTER INSERT ON t1 FOR EACH ROW 
 INSERT INTO t2 VALUES (new.id);
-SELECT GET_LOCK('B26162',20);
-GET_LOCK('B26162',20)
+SELECT GET_LOCK('B26162',120);
+GET_LOCK('B26162',120)
 1
-SELECT 'rl_acquirer', GET_LOCK('B26162',5), id FROM t2 WHERE id = 1;
+SELECT 'rl_acquirer', GET_LOCK('B26162',120), id FROM t2 WHERE id = 1;
 SET SESSION LOW_PRIORITY_UPDATES=1;
 SET GLOBAL LOW_PRIORITY_UPDATES=1;
 INSERT INTO t1 VALUES (5);
 SELECT 'rl_contender', id FROM t2 WHERE id > 1;
 SELECT RELEASE_LOCK('B26162');
 RELEASE_LOCK('B26162')
-0
-rl_acquirer	GET_LOCK('B26162',5)	id
-rl_acquirer	0	1
+1
+rl_acquirer	GET_LOCK('B26162',120)	id
+rl_acquirer	1	1
+SELECT RELEASE_LOCK('B26162');
+RELEASE_LOCK('B26162')
+1
 rl_contender	id
 rl_contender	2
 DROP TRIGGER t1_test;

mysql-test/t/insert_update.test

@@ -290,3 +290,19 @@ INSERT IGNORE INTO t1 (id,c1) SELECT * FROM t2
 SELECT * FROM t1;
 
 DROP TABLE t1;
+
+#
+# Bug#28904: INSERT .. ON DUPLICATE was silently updating rows when it
+#            shouldn't.
+#
+create table t1(f1 int primary key,
+ f2 timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP);
+insert into t1(f1) values(1);
+--replace_column 1 #
+select @stamp1:=f2 from t1;
+--sleep 2
+insert into t1(f1) values(1) on duplicate key update f1=1;
+--replace_column 1 #
+select @stamp2:=f2 from t1;
+select if( @stamp1 = @stamp2, "correct", "wrong");
+drop table t1;

mysql-test/t/trigger.test

@@ -1763,6 +1763,9 @@ select * from t1;
 select * from t3;
 drop table t1, t2, t3;
 
+disconnect addconroot1;
+disconnect addconroot2;
+disconnect addconwithoutdb;
 #
 # Bug #26162: Trigger DML ignores low_priority_updates setting
 #
@@ -1776,19 +1779,23 @@ INSERT INTO t2 VALUES (1),(2);
 CREATE TRIGGER t1_test AFTER INSERT ON t1 FOR EACH ROW 
   INSERT INTO t2 VALUES (new.id);
 
+CONNECT (rl_holder,    localhost, root,,);
 CONNECT (rl_acquirer,  localhost, root,,);
 CONNECT (wl_acquirer,  localhost, root,,);
 CONNECT (rl_contender, localhost, root,,);
 
-SELECT GET_LOCK('B26162',20);
+CONNECTION rl_holder;
+SELECT GET_LOCK('B26162',120);
 
 CONNECTION rl_acquirer;
 --send
-SELECT 'rl_acquirer', GET_LOCK('B26162',5), id FROM t2 WHERE id = 1;
+SELECT 'rl_acquirer', GET_LOCK('B26162',120), id FROM t2 WHERE id = 1;
 
 CONNECTION wl_acquirer;
 SET SESSION LOW_PRIORITY_UPDATES=1;
 SET GLOBAL LOW_PRIORITY_UPDATES=1;
+#need to wait for rl_acquirer to lock on the B26162 lock 
+sleep 2;
 --send
 INSERT INTO t1 VALUES (5);
 
@@ -1798,13 +1805,16 @@ CONNECTION rl_contender;
 --send
 SELECT 'rl_contender', id FROM t2 WHERE id > 1;
 
-CONNECTION default;
+CONNECTION rl_holder;
+#need to wait for wl_acquirer and rl_contender to lock on t2 
+sleep 2;
 SELECT RELEASE_LOCK('B26162');
 
-CONNECTION wl_acquirer;
---reap
 CONNECTION rl_acquirer;
 --reap
+SELECT RELEASE_LOCK('B26162');
+CONNECTION wl_acquirer;
+--reap
 CONNECTION rl_contender;
 --reap
 
@@ -1812,6 +1822,7 @@ CONNECTION default;
 DISCONNECT rl_acquirer;
 DISCONNECT wl_acquirer;
 DISCONNECT rl_contender;
+DISCONNECT rl_holder;
 
 DROP TRIGGER t1_test;
 DROP TABLE t1,t2;

sql/item_func.cc

@@ -3439,6 +3439,7 @@ longlong Item_func_get_lock::val_int()
   THD *thd=current_thd;
   User_level_lock *ull;
   int error;
+  DBUG_ENTER("Item_func_get_lock::val_int");
 
   /*
     In slave thread no need to get locks, everything is serialized. Anyway
@@ -3448,7 +3449,7 @@ longlong Item_func_get_lock::val_int()
     it's not guaranteed to be same as on master.
   */
   if (thd->slave_thread)
-    return 1;
+    DBUG_RETURN(1);
 
   pthread_mutex_lock(&LOCK_user_locks);
 
@@ -3456,8 +3457,10 @@ longlong Item_func_get_lock::val_int()
   {
     pthread_mutex_unlock(&LOCK_user_locks);
     null_value=1;
-    return 0;
+    DBUG_RETURN(0);
   }
+  DBUG_PRINT("info", ("lock %.*s, thd=%ld", res->length(), res->ptr(),
+                      (long) thd->real_id));
   null_value=0;
 
   if (thd->ull)
@@ -3477,14 +3480,16 @@ longlong Item_func_get_lock::val_int()
       delete ull;
       pthread_mutex_unlock(&LOCK_user_locks);
       null_value=1;				// Probably out of memory
-      return 0;
+      DBUG_RETURN(0);
     }
     ull->set_thread(thd);
     thd->ull=ull;
     pthread_mutex_unlock(&LOCK_user_locks);
-    return 1;					// Got new lock
+    DBUG_PRINT("info", ("made new lock"));
+    DBUG_RETURN(1);				// Got new lock
   }
   ull->count++;
+  DBUG_PRINT("info", ("ull->count=%d", ull->count));
 
   /*
     Structure is now initialized.  Try to get the lock.
@@ -3498,9 +3503,13 @@ longlong Item_func_get_lock::val_int()
   error= 0;
   while (ull->locked && !thd->killed)
   {
+    DBUG_PRINT("info", ("waiting on lock"));
     error= pthread_cond_timedwait(&ull->cond,&LOCK_user_locks,&abstime);
     if (error == ETIMEDOUT || error == ETIME)
+    {
+      DBUG_PRINT("info", ("lock wait timeout"));
       break;
+    }
     error= 0;
   }
 
@@ -3524,6 +3533,7 @@ longlong Item_func_get_lock::val_int()
     ull->thread_id= thd->thread_id;
     thd->ull=ull;
     error=0;
+    DBUG_PRINT("info", ("got the lock"));
   }
   pthread_mutex_unlock(&LOCK_user_locks);
 
@@ -3533,7 +3543,7 @@ longlong Item_func_get_lock::val_int()
   thd->mysys_var->current_cond=  0;
   pthread_mutex_unlock(&thd->mysys_var->mutex);
 
-  return !error ? 1 : 0;
+  DBUG_RETURN(!error ? 1 : 0);
 }
 
 
@@ -3551,11 +3561,14 @@ longlong Item_func_release_lock::val_int()
   String *res=args[0]->val_str(&value);
   User_level_lock *ull;
   longlong result;
+  THD *thd=current_thd;
+  DBUG_ENTER("Item_func_release_lock::val_int");
   if (!res || !res->length())
   {
     null_value=1;
-    return 0;
+    DBUG_RETURN(0);
   }
+  DBUG_PRINT("info", ("lock %.*s", res->length(), res->ptr()));
   null_value=0;
 
   result=0;
@@ -3568,15 +3581,20 @@ longlong Item_func_release_lock::val_int()
   }
   else
   {
+    DBUG_PRINT("info", ("ull->locked=%d ull->thread=%lu thd=%lu", 
+                        (int) ull->locked,
+                        (long)ull->thread_id,
+                        (long)thd->thread_id));
     if (ull->locked && current_thd->thread_id == ull->thread_id)
     {
+      DBUG_PRINT("info", ("release lock"));
       result=1;					// Release is ok
       item_user_lock_release(ull);
-      current_thd->ull=0;
+      thd->ull=0;
     }
   }
   pthread_mutex_unlock(&LOCK_user_locks);
-  return result;
+  DBUG_RETURN(result);
 }
 
 

sql/item_strfunc.cc

@@ -3364,7 +3364,7 @@ String *Item_func_uuid::val_str(String *str)
       *--s=_dig_vec_lower[mac[i] >> 4];
     }
     randominit(&uuid_rand, tmp + (ulong) server_start_time,
-	       tmp + thd->status_var.bytes_sent);
+	       tmp + (ulong) thd->status_var.bytes_sent);
     set_clock_seq_str();
   }
 

sql/mysqld.cc

@@ -6675,8 +6675,8 @@ SHOW_VAR status_vars[]= {
   {"Aborted_connects",         (char*) &aborted_connects,       SHOW_LONG},
   {"Binlog_cache_disk_use",    (char*) &binlog_cache_disk_use,  SHOW_LONG},
   {"Binlog_cache_use",         (char*) &binlog_cache_use,       SHOW_LONG},
-  {"Bytes_received",           (char*) offsetof(STATUS_VAR, bytes_received), SHOW_LONG_STATUS},
-  {"Bytes_sent",               (char*) offsetof(STATUS_VAR, bytes_sent), SHOW_LONG_STATUS},
+  {"Bytes_received",           (char*) offsetof(STATUS_VAR, bytes_received), SHOW_LONGLONG_STATUS},
+  {"Bytes_sent",               (char*) offsetof(STATUS_VAR, bytes_sent), SHOW_LONGLONG_STATUS},
   {"Com_admin_commands",       (char*) offsetof(STATUS_VAR, com_other), SHOW_LONG_STATUS},
   {"Com_alter_db",	       (char*) offsetof(STATUS_VAR, com_stat[(uint) SQLCOM_ALTER_DB]), SHOW_LONG_STATUS},
   {"Com_alter_event",	       (char*) offsetof(STATUS_VAR, com_stat[(uint) SQLCOM_ALTER_EVENT]), SHOW_LONG_STATUS},

sql/sql_class.h

@@ -344,8 +344,8 @@ struct system_variables
 
 typedef struct system_status_var
 {
-  ulong bytes_received;
-  ulong bytes_sent;
+  ulonglong bytes_received;
+  ulonglong bytes_sent;
   ulong com_other;
   ulong com_stat[(uint) SQLCOM_END];
   ulong created_tmp_disk_tables;

sql/sql_insert.cc

@@ -1419,6 +1419,9 @@ int write_record(THD *thd, TABLE *table,COPY_INFO *info)
           goto before_trg_err;
 
         table->file->restore_auto_increment(prev_insert_id);
+        if ((table->file->ha_table_flags() & HA_PARTIAL_COLUMN_READ) ||
+            compare_record(table))
+        {
           if ((error=table->file->ha_update_row(table->record[1],
                                                 table->record[0])))
           {
@@ -1429,10 +1432,7 @@ int write_record(THD *thd, TABLE *table,COPY_INFO *info)
             }
             goto err;
           }
-        info->touched++;
-        if ((table->file->ha_table_flags() & HA_PARTIAL_COLUMN_READ) ||
-             compare_record(table))
-        {
+
           info->updated++;
           /*
             If ON DUP KEY UPDATE updates a row instead of inserting one, it's
@@ -1451,6 +1451,11 @@ int write_record(THD *thd, TABLE *table,COPY_INFO *info)
           info->copied++;
         }
 
+        if (table->next_number_field)
+          table->file->adjust_next_insert_id_after_explicit_value(
+            table->next_number_field->val_int());
+        info->touched++;
+
         goto ok_or_after_trg_err;
       }
       else /* DUP_REPLACE */

sql/sql_plugin.h

@@ -33,7 +33,8 @@ class sys_var;
 */
 #define SHOW_FUNC    SHOW_FUNC, SHOW_KEY_CACHE_LONG, SHOW_KEY_CACHE_LONGLONG, \
                      SHOW_LONG_STATUS, SHOW_DOUBLE_STATUS, SHOW_HAVE,   \
-                     SHOW_MY_BOOL, SHOW_HA_ROWS, SHOW_SYS, SHOW_LONG_NOFLUSH
+                     SHOW_MY_BOOL, SHOW_HA_ROWS, SHOW_SYS, SHOW_LONG_NOFLUSH, \
+                     SHOW_LONGLONG_STATUS
 #include <mysql/plugin.h>
 #undef SHOW_FUNC
 typedef enum enum_mysql_show_type SHOW_TYPE;

sql/sql_prepare.cc

@@ -572,6 +572,8 @@ void set_param_date(Item_param *param, uchar **pos, ulong len)
 static void set_param_str(Item_param *param, uchar **pos, ulong len)
 {
   ulong length= get_param_length(pos, len);
+  if (length > len)
+    length= len;
   param->set_str((const char *)*pos, length);
   *pos+= length;
 }
@@ -742,6 +744,8 @@ static bool insert_params_with_log(Prepared_statement *stmt, uchar *null_array,
         if (read_pos >= data_end)
           DBUG_RETURN(1);
         param->set_param_func(param, &read_pos, data_end - read_pos);
+        if (param->state == Item_param::NO_VALUE)
+          DBUG_RETURN(1);
       }
     }
     res= param->query_val_str(&str);
@@ -778,6 +782,8 @@ static bool insert_params(Prepared_statement *stmt, uchar *null_array,
         if (read_pos >= data_end)
           DBUG_RETURN(1);
         param->set_param_func(param, &read_pos, data_end - read_pos);
+        if (param->state == Item_param::NO_VALUE)
+          DBUG_RETURN(1);
       }
     }
     if (param->convert_str_value(stmt->thd))
@@ -860,6 +866,8 @@ static bool emb_insert_params(Prepared_statement *stmt, String *expanded_query)
                               client_param->length ?
                               *client_param->length :
                               client_param->buffer_length);
+        if (param->state == Item_param::NO_VALUE)
+          DBUG_RETURN(1);
       }
     }
     if (param->convert_str_value(thd))
@@ -902,6 +910,8 @@ static bool emb_insert_params_with_log(Prepared_statement *stmt,
                               client_param->length ?
                               *client_param->length :
                               client_param->buffer_length);
+        if (param->state == Item_param::NO_VALUE)
+          DBUG_RETURN(1);
       }
     }
     res= param->query_val_str(&str);

sql/sql_show.cc

@@ -2055,6 +2055,8 @@ static bool show_status_array(THD *thd, const char *wild,
         case SHOW_LONG_NOFLUSH: // the difference lies in refresh_status()
           end= int10_to_str(*(long*) value, buff, 10);
           break;
+        case SHOW_LONGLONG_STATUS:
+          value= ((char *) status_var + (ulonglong) value);
         case SHOW_LONGLONG:
           end= longlong10_to_str(*(longlong*) value, buff, 10);
           break;

tests/mysql_client_test.c

@@ -16224,6 +16224,85 @@ static void test_bug28505()
 }
 
 
+/*
+  Bug#28934: server crash when receiving malformed com_execute packets
+*/
+
+static void test_bug28934()
+{
+  MYSQL *l_mysql;
+  my_bool error= 0;
+  MYSQL_BIND bind[5];
+  MYSQL_STMT *stmt;
+  int cnt;
+
+  if (!(l_mysql= mysql_init(NULL)))
+  {
+    myerror("mysql_init() failed");
+    DIE_UNLESS(1);
+  }
+  if (!(mysql_real_connect(l_mysql, opt_host, opt_user,
+                           opt_password, current_db, opt_port,
+                           opt_unix_socket, CLIENT_FOUND_ROWS)))
+  {
+    myerror("connection failed");
+    error= 1;
+    goto end;
+  }
+  l_mysql->reconnect= 1;
+  if (mysql_query(l_mysql, "drop table if exists t1"))
+  {
+    myerror(NULL);
+    error= 1;
+    goto end;
+  }
+  if (mysql_query(l_mysql, "create table t1(id int)"))
+  {
+    myerror(NULL);
+    error= 1;
+    goto end;
+  }
+  if (mysql_query(l_mysql, "insert into t1 values(1),(2),(3),(4),(5)"))
+  {
+    myerror(NULL);
+    error= 1;
+    goto end;
+  }
+  if (!(stmt= mysql_simple_prepare(l_mysql,
+                                   "select * from t1 where id in(?,?,?,?,?)")))
+  {
+    myerror(NULL);
+    error= 1;
+    goto end;
+  }
+
+  memset (&bind, 0, sizeof (bind));
+  for (cnt= 0; cnt < 5; cnt++)
+  {
+    bind[cnt].buffer_type= MYSQL_TYPE_LONG;
+    bind[cnt].buffer= (char*)&cnt;
+    bind[cnt].buffer_length= 0;
+  }
+  if(mysql_stmt_bind_param(stmt, bind))
+  {
+    myerror(NULL);
+    error= 1;
+    goto end;
+  }
+  stmt->param_count=2;
+  error= mysql_stmt_execute(stmt);
+  DIE_UNLESS (error != 0);
+  myerror(NULL);
+  error= 0;
+  if (mysql_query(l_mysql, "drop table t1"))
+  {
+    myerror(NULL);
+    error= 1;
+  }
+end:
+  mysql_close(l_mysql);
+  DIE_UNLESS(error == 0);
+}
 /*
   Read and parse arguments and MySQL options from my.cnf
 */
@@ -16512,6 +16591,7 @@ static struct my_tests_st my_tests[]= {
 #ifdef fix_bug_in_pb_first 
   { "test_bug28075", test_bug28075 },
 #endif
+  { "test_bug28934", test_bug28934 },
   { "test_bug27876", test_bug27876 },
   { 0, 0 }
 };