connections
The problem is that tables can enter open table cache for a thread without 
being properly cleaned up. This can happen if make_join_statistics() fails 
to read a const table because of e.g. a deadlock. It does set a member of 
TABLE structure to a value it allocates, but doesn't clean-up this setting 
on error nor does it set the rest of the members in JOIN to allow for 
automatic cleanup.
As a result when such an error occurs and the next statement depends re-uses 
the table from the open tables cache it will get it with this 
TABLE::reginfo.join_tab pointing to a memory area that's freed.
Fixed by making sure make_join_statistics() cleans up TABLE::reginfo.join_tab 
on error.

mysql-test/r/innodb_mysql.result:
  Bug #42419: test case
mysql-test/t/innodb_mysql-master.opt:
  Bug #42419: increase the timeout so it covers te conservative 
  sleep 3 in the test
mysql-test/t/innodb_mysql.test:
  Bug #42419: test case
sql/sql_select.cc:
  Bug #42419: clean up the members of TABLE on failure in 
          make_join_statisitcs()

      
Additional fix:
 1. Revert the unification of DROP FUNCTION
and DROP PROCEDURE, because DROP FUNCTION can be used to
drop UDFs (that have a non-qualified name and don't require
database name to be present and valid).
 2. Fixed the case sensitivity problem by adding a call to 
check_db_name() (similar to the sp_name production).

      
MATCH() function accepts column list as an argument. It was possible to override
this requirement with aliased non-column select expression. Which results in
server crash.

With this fix aliased non-column select expressions are not accepted by MATCH()
function, returning an error.

mysql-test/r/fulltext.result:
  A test case for BUG#36737.
mysql-test/t/fulltext.test:
  A test case for BUG#36737.
sql/item_func.cc:
  Only accept fields as arguments to MATCH().

based on NetBSD CVS as of 2009/02/06 20:09:00.

The parser was not using the correct fully-qualified-name
production for DROP FUNCTION.
Fixed by copying the production from DROP PROCEDURE.
Tested in the windows specific suite to make sure it's 
tested on a case-insensitive file system.

mysql-test/r/windows.result:
  Bug #33813: test case
mysql-test/t/windows.test:
  Bug #33813: test case
sql/sql_yacc.yy:
  Bug #33813: use the correct production for the name in
  DROP PROCEDURE

Bug#42003 tests missing the disconnect of connections <> default
second slice
Content:
1. wait_until_count_sessions.inc
   - One PB run of a test using this routine failed because
     5 seconds timeout were exceeded. Although I have some doubts
     if the assigned timeout was really too small, I increase the
     value to 10. We waste the additional 5 seconds only if the
     tests fails anyway.
   - Print the content of the PROCESSLIST if the poll routine fails
2. minor improvements of formatting
3. query_cache_notembedded:
   Activate the wait_until_count_sessions.inc routine which was
   unfortunately forgotten in the changeset before.

no conflicts

This involves just the tag, no file changes - they were all present before.

In 37553 we declared longlong results for
class Item_str_timefunc as per comments/docs,
but didn't add a method for that. And the
default just wasn't good enough for some
cases.

Changeset adds dedicated val_int() to class.

mysql-test/r/func_sapdb.result:
  More tests for casts of TIME() / TIMEDIFF() with negative results.
mysql-test/t/func_sapdb.test:
  More tests for casts of TIME() / TIMEDIFF() with negative results.
sql/item_timefunc.h:
  Since we claim to provide longlong results, we should have
  a suitable function to provide them (the default won't do).
  This one matches the val_real() variant.

   - If missing: add "disconnect <session>"
   - If physical disconnect of non "default" sessions is not finished
     at test end: add routine which waits till this happened
+ additional improvements
  - remove superfluous files created by the test
  - replace error numbers by error names
  - remove trailing spaces, replace tabs by spaces
  - unify writing of bugs within comments
  - correct comments
  - minor changes of formatting
Fixed tests:
  backup
  check
  compress
  grant
  information_schema
  multi_update
  overflow
  packet
  query_cache_not_embedded
  sp-threads
  subselect
  synchronization
  timezone_grant

            ORDER BY could cause a server crash

Dependent subqueries like

  SELECT COUNT(*) FROM t1, t2 WHERE t2.b
   IN (SELECT DISTINCT t2.b FROM t2 WHERE t2.b = t1.a)

caused a memory leak proportional to the
number of outer rows.


The make_simple_join() function has been modified to
JOIN class method to store join_tab_reexec and
table_reexec values in the parent join only
(make_simple_join of tmp_join may access these values
via 'this' pointer of the parent JOIN).

NOTE: this patch doesn't include standard test case (this is
"out of memory" bug). See bug #42037 page for test cases.


sql/sql_select.cc:
  Bug #42037: Queries containing a subquery with DISTINCT and
              ORDER BY could cause a server crash
  
  The make_simple_join() function has been modified to
  JOIN class method to store join_tab_reexec and
  table_reexec values in the parent join only.
sql/sql_select.h:
  Bug #42037: Queries containing a subquery with DISTINCT and
              ORDER BY could cause a server crash
  
  1. The make_simple_join() function has been modified to
     JOIN class method.
  
  2. Type of JOIN::table_reexec field has been changed from
     TABLE** to TABLE *table_reexec[1]: this field always was
     NULL or a pointer to one-element array of pointers, so
     a pointer to a pointer has been replaced with one pointer
     and unnecessary memory allocation has been eliminated.

Problem: some queries using NAME_CONST(.. COLLATE ...)
lead to server crash due to failed type cast.

Fix: return the underlying item's type in case of
NAME_CONST(.. COLLATE ...) to avoid wrong casting.


mysql-test/r/func_misc.result:
  Fix for bug#42014: Crash, name_const with coll
    - test result.
mysql-test/t/func_misc.test:
  Fix for bug#42014: Crash, name_const with coll
    - test case.
sql/item.cc:
  Fix for bug#42014: Crash, name_const with coll
    - in case of NAME_CONST('name', 'value' COLLATE collation)
  Item_name_const::type() returns type of 'value' argument 
  to awoid wrong type casting of the Item_name_const items.

Accessing well defined MERGE table may return an error
stating that the merge table is incorrectly defined. This
happens if MERGE child tables were accessed before and we
failed to open another incorrectly defined MERGE table in
this connection.

myrg_open() internally used my_errno as a variable for determining
failure, and thus could be tricked into a wrong decision by other
uses of my_errno.

With this fix we use function local boolean flag instead of my_errno
to determine failure.

myisammrg/myrg_open.c:
  There are two requirement for accessing/setting my_errno variable,
  which were not followed by myrg_open():
  - it must be checked immediately after a function returned an error. There
    must be no calls to other functions that may change it's value between.
  - my_errno value must be set right before a function is going to return an
    error. There must be no calls to other functions that may change it's
    value between (that's why we have these tricks with save_errno at the
    bottom of myrg_open()).
  
  myrg_open() internally used my_errno as a variable for determining
  failure, and thus could be tricked into a wrong decision by other
  uses of my_errno.
mysql-test/r/merge.result:
  A test case for BUG#32047.
mysql-test/t/merge.test:
  A test case for BUG#32047.

simpler to just use the source .tar.gz to do a build.  So the script has been renamed
to nwbuild, and simplified.

                    functions
      
String::realloc() did not check whether the existing string data fits in the newly
allocated buffer for cases when reallocating a String object with external buffer
(i.e.alloced == FALSE).  This could lead to memory overruns in some cases.


mysql-test/r/func_str.result:
  Added a test case for bug #41868.
mysql-test/t/func_str.test:
  Added a test case for bug #41868.
sql/sql_class.cc:
  After each call to Item::send() in select_send::send_data() reset buffer to its
  original state to reduce unnecessary malloc() calls. See comments for bug #41868
  for detailed analysis.
sql/sql_string.cc:
  Fixed String::realloc() to check whether the existing string data fits in the newly allocated buffer for cases when reallocating a String object with external buffer.

The original symptoms of this bug have been fixed as a consequence of other bug fixes.
Taking this time to correct some formatting, such as replacing error numbers with names.
Beginning this with 5.0

   - If missing: add "disconnect <session>"
   - If physical disconnect of non "default" sessions is not finished
     at test end: add routine which waits till this happened
+ additional improvements like
  - remove superfluous files created by the test
  - replace error numbers by error names
  - remove trailing spaces, replace tabs by spaces
  - unify writing of bugs within comments
  - correct comments
  - minor changes of formatting
Modifications according to the code review are included.
Fixed tests:
grant2
grant3
lock_tables_lost_commit
mysqldump
openssl_1
outfile

When storing a NULL to a TIMESTAMP NOT NULL DEFAULT ...,
NULL returned from some functions threw a 'cannot be NULL error.'

NULL-returns now correctly result in the timestamp-field being
assigned its default value.

mysql-test/r/type_timestamp.result:
  Show that for TIMESTAMP NOT NULL DEFAULT, NULL function returns
  set default now.
mysql-test/t/type_timestamp.test:
  Show that for TIMESTAMP NOT NULL DEFAULT, NULL function returns
  set default now.
sql/item.cc:
  When storing a returned NULL (from a time- or date-related
  function), make sure to apply NULL-means-DEFAULT magic where
  applicable.