Merge moonbone.local:/mnt/gentoo64/work/test-5.0-opt-mysql

into  moonbone.local:/mnt/gentoo64/work/test-5.1-opt-mysql

mysql-test/r/subselect.result

@@ -4074,6 +4074,32 @@ CREATE TABLE t1 (a int);
 INSERT INTO t1 VALUES (1), (2);
 EXPLAIN EXTENDED
 SELECT * FROM (SELECT count(*) FROM t1 GROUP BY a) as res;
+CREATE TABLE t1 (
+a varchar(255) default NULL,
+b timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
+INDEX idx(a,b)
+);
+CREATE TABLE t2 (
+a varchar(255) default NULL
+);
+INSERT INTO t1 VALUES ('abcdefghijk','2007-05-07 06:00:24');
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO `t1` VALUES ('asdf','2007-02-08 01:11:26');
+INSERT INTO `t2` VALUES ('abcdefghijk');
+INSERT INTO `t2` VALUES ('asdf');
+SET session sort_buffer_size=8192;
+SELECT (SELECT 1 FROM  t1 WHERE t1.a=t2.a ORDER BY t1.b LIMIT 1) AS d1 FROM t2;
+d1
+1
+1
+DROP TABLE t1,t2;
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	filtered	Extra
 1	PRIMARY	<derived2>	ALL	NULL	NULL	NULL	NULL	2	100.00	
 2	DERIVED	t1	ALL	NULL	NULL	NULL	NULL	2	100.00	Using temporary; Using filesort

mysql-test/t/subselect.test

@@ -2913,6 +2913,38 @@ SELECT * FROM (SELECT count(*) FROM t1 GROUP BY a) as res;
 
 DROP TABLE t1;
 
+#
+# Bug #28811: crash for query containing subquery with ORDER BY and LIMIT 1 
+#
+ 
+CREATE TABLE t1 (
+  a varchar(255) default NULL,
+  b timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
+  INDEX idx(a,b)
+);
+CREATE TABLE t2 (
+  a varchar(255) default NULL
+);
+
+INSERT INTO t1 VALUES ('abcdefghijk','2007-05-07 06:00:24');
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO t1 SELECT * FROM t1;
+INSERT INTO `t1` VALUES ('asdf','2007-02-08 01:11:26');
+INSERT INTO `t2` VALUES ('abcdefghijk');
+INSERT INTO `t2` VALUES ('asdf');
+
+SET session sort_buffer_size=8192;
+
+SELECT (SELECT 1 FROM  t1 WHERE t1.a=t2.a ORDER BY t1.b LIMIT 1) AS d1 FROM t2;
+
+DROP TABLE t1,t2;
+
 --echo End of 5.0 tests.
 
 #

sql/filesort.cc

@@ -35,7 +35,8 @@ if (my_b_write((file),(uchar*) (from),param->ref_length)) \
 
 	/* functions defined in this file */
 
-static char **make_char_array(register uint fields, uint length, myf my_flag);
+static char **make_char_array(char **old_pos, register uint fields,
+                              uint length, myf my_flag);
 static BUFFPEK *read_buffpek_from_file(IO_CACHE *buffer_file, uint count);
 static ha_rows find_all_keys(SORTPARAM *param,SQL_SELECT *select,
 			     uchar * *sort_keys, IO_CACHE *buffer_file,
@@ -208,9 +209,9 @@ ha_rows filesort(THD *thd, TABLE *table, SORT_FIELD *sortorder, uint s_length,
     ulong old_memavl;
     ulong keys= memavl/(param.rec_length+sizeof(char*));
     param.keys=(uint) min(records+1, keys);
-    if (table_sort.sort_keys ||
-        (table_sort.sort_keys= (uchar **) make_char_array(param.keys, param.rec_length,
-                                               MYF(0))))
+    if ((table_sort.sort_keys=
+	 (uchar **) make_char_array((char **) table_sort.sort_keys,
+                                    param.keys, param.rec_length, MYF(0))))
       break;
     old_memavl=memavl;
     if ((memavl=memavl/4*3) < min_sort_memory && old_memavl > min_sort_memory)
@@ -352,13 +353,15 @@ void filesort_free_buffers(TABLE *table, bool full)
 
 	/* Make a array of string pointers */
 
-static char **make_char_array(register uint fields, uint length, myf my_flag)
+static char **make_char_array(char **old_pos, register uint fields,
+                              uint length, myf my_flag)
 {
   register char **pos;
-  char **old_pos,*char_pos;
+  char *char_pos;
   DBUG_ENTER("make_char_array");
 
-  if ((old_pos= (char**) my_malloc((uint) fields*(length+sizeof(char*)),
+  if (old_pos ||
+      (old_pos= (char**) my_malloc((uint) fields*(length+sizeof(char*)),
 				   my_flag)))
   {
     pos=old_pos; char_pos=((char*) (pos+fields)) -length;