This bug is actually two. The first one manifests itself on an EXPLAIN
SELECT query with nested subqueries that employs the filesort algorithm.
The whole SELECT under explain is marked as UNCACHEABLE_EXPLAIN to preserve
some temporary structures for explain. As a side-effect of this values of
nested subqueries weren't cached and subqueries were re-evaluated many
times. Each time buffer for filesort was allocated but wasn't freed because
freeing occurs at the end of topmost SELECT. Thus all available memory was
eaten up step by step and OOM event occur.
The second bug manifests itself on SELECT queries with conditions where
a subquery result is compared with a key field and the subquery itself also
has such condition. When a long chain of such nested subqueries is present
the stack overrun occur. This happens because at some point the range optimizer
temporary puts the PARAM structure on the stack. Its size if about 8K and
the stack is exhausted very fast.

Now the subselect_single_select_engine::exec function allows subquery result
caching when the UNCACHEABLE_EXPLAIN flag is set.
Now the SQL_SELECT::test_quick_select function calls the check_stack_overrun
function for stack checking purposes to prevent server crash.


mysql-test/t/subselect.test:
  Added a test case for the bug#31048: Many nested subqueries may cause server crash.
mysql-test/r/subselect.result:
  Added a test case for the bug#31048: Many nested subqueries may cause server crash.
sql/opt_range.cc:
  Bug#31048: Many nested subqueries may cause server crash.
  Now the SQL_SELECT::test_quick_select function calls the check_stack_overrun
  function for stack checking purposes to preven server crash.
sql/item_subselect.cc:
  Bug31048: Many nested subqueries may cause server crash.
  Now the subselect_single_select_engine::exec function allows subquery result
  caching when the UNCACHEABLE_EXPLAIN flag is set.

into  mysql.com:/home/psergey/mysql-5.0-bug31450


sql/item.cc:
  Auto merged
mysql-test/r/type_decimal.result:
  Post-merge fixes
mysql-test/t/type_decimal.test:
  Post-merge fixes

- Let Item::save_in_field() call set_field_to_null_with_conversions() 
  for decimal type, like this is done for the other item result types.


mysql-test/r/type_decimal.result:
  BUG#31450: Query causes error 1048: testcase
mysql-test/t/type_decimal.test:
  BUG#31450: Query causes error 1048: testcase

into  mysql.com:/home/gluh/MySQL/Merge/5.0-opt

into  mysql.com:/home/gluh/MySQL/Merge/5.0-opt


client/mysqldump.c:
  Auto merged
include/config-win.h:
  Auto merged
libmysql/libmysql.c:
  Auto merged
myisam/sort.c:
  Auto merged
mysql-test/r/func_sapdb.result:
  Auto merged
mysql-test/r/variables.result:
  Auto merged
mysql-test/t/variables.test:
  Auto merged
sql/field.cc:
  Auto merged
sql/ha_innodb.cc:
  Auto merged
sql/item_func.cc:
  Auto merged
sql/item_sum.cc:
  Auto merged
sql/item_timefunc.h:
  Auto merged
sql/mysql_priv.h:
  Auto merged
sql/set_var.cc:
  Auto merged
sql/sql_acl.cc:
  Auto merged
sql/sql_base.cc:
  Auto merged
sql/sql_parse.cc:
  Auto merged
sql/sql_select.cc:
  Auto merged
sql/sql_yacc.yy:
  Auto merged
tests/mysql_client_test.c:
  Auto merged
mysql-test/r/type_datetime.result:
  manual merge
mysql-test/r/type_decimal.result:
  manual merge
mysql-test/t/type_datetime.test:
  manual merge
mysql-test/t/type_decimal.test:
  manual merge
sql/item.cc:
  manual merge

into  mysql.com:/home/hf/work/30638/my50-30638

into  polly.(none):/home/kaa/src/opt/mysql-5.0-opt

into  magare.gmz:/home/kgeorge/mysql/autopush/B30825-new-5.0-opt

into  polly.(none):/home/kaa/src/opt/mysql-5.0-opt

sql/ha_heap.cc:
  type conversion fix
sql/opt_range.cc:
  type conversion fix

into  magare.gmz:/home/kgeorge/mysql/autopush/B30825-new-5.0-opt

into  mysql.com:/home/hf/work/30638/my50-30638

sql/opt_range.cc:
  type conversion fixed

into  magare.gmz:/home/kgeorge/mysql/autopush/B30825-new-5.0-opt

into  mysql.com:/home/hf/work/30638/my50-30638

myisam/mi_write.c:
  type conversion fixed
myisam/sort.c:
  type conversion fixed
sql/ha_federated.cc:
  type conversion fixed
sql/ha_heap.cc:
  type conversion fixed
sql/ha_innodb.cc:
  type conversion fixed
sql/ha_myisam.cc:
  type conversion fixed
sql/opt_range.cc:
  type conversion fixed
sql/sql_map.cc:
  type conversion fixed
sql/sql_select.cc:
  type conversion fixed
sql/sql_update.cc:
  type conversion fixed

into  mysql.com:/home/gluh/MySQL/Merge/4.1-opt

into  magare.gmz:/home/kgeorge/mysql/autopush/B30825-new-5.0-opt


sql/field.cc:
  Auto merged
sql/sql_yacc.yy:
  Auto merged

When doing indexed search the server constructs a key image for 
faster comparison to the stored keys. While doing that it must not
perform (and stop if they fail) the additional date checks that can 
be turned on by the SQL mode because there already may be values in 
the table that don't comply with the error checks.
Fixed by ignoring these SQL mode bits while making the key image.


mysql-test/r/type_date.result:
  Bug #28687: test case
mysql-test/t/type_date.test:
  Bug #28687: test case
sql/item.cc:
  Bug #28687: no invalid date warnings

an error, asserts server

In case of a fatal error during filesort in find_all_keys() the error
was returned without the necessary handler uninitialization.
Fixed by changing the code so that handler uninitialization is performed
before returning the error.


mysql-test/r/delete.result:
  Added a test case for bug #31742.
mysql-test/t/delete.test:
  Added a test case for bug #31742.
sql/filesort.cc:
  In case of a fatal error in find_all_keys() do not return before doing
  the necessary handler uninitialization steps.

into  mysql.com:/home/hf/work/30638/my50-30638

into  mysql.com:/home/hf/work/30638/my50-30638

into  mysql.com:/scratch/tnurnberg/31588/50-31588

into  polly.(none):/home/kaa/src/opt/mysql-5.0-opt

  
Since, as of MySQL 5.0.15, CHAR() arguments larger than 255 are converted into multiple result bytes, a single CHAR() argument can now take up to 4 bytes. This patch fixes Item_func_char::fix_length_and_dec() to take this into account.
  
This patch also fixes a regression introduced by the patch for bug21513. As now we do not always have the 'name' member of Item set for Item_hex_string and Item_bin_string, an own print() method has been added to Item_hex_string so that it could correctly be printed by Item_func::print_args().


mysql-test/r/func_str.result:
  Import patch bug288550.patch
mysql-test/t/func_str.test:
  Import patch bug288550.patch
sql/item.cc:
  Import patch bug288550.patch
sql/item.h:
  Import patch bug288550.patch
sql/item_strfunc.h:
  Import patch bug288550.patch

into  anubis.xiphis.org:/usr/home/antony/work/mysql-5.0-engines.merge

into  anubis.xiphis.org:/usr/home/antony/work/mysql-5.0-engines.merge


mysql-test/r/heap_btree.result:
  Auto merged
mysql-test/t/heap_btree.test:
  Auto merged

into  anubis.xiphis.org:/usr/home/antony/work/mysql-4.1-engines.merge

into  lambda.hsd1.co.comcast.net.:/home/malff/TREE/mysql-5.0-rt-merge


mysql-test/r/udf.result:
  Auto merged
mysql-test/t/udf.test:
  Auto merged
sql/item.cc:
  Auto merged
sql/item_func.cc:
  Auto merged
sql/mysql_priv.h:
  Auto merged
sql/set_var.cc:
  Auto merged
sql/udf_example.c:
  Auto merged
sql/udf_example.def:
  Auto merged

into  mysql.com:/scratch/tnurnberg/31588/50-31588

into  magare.gmz:/home/kgeorge/mysql/autopush/B31221-5.0-opt

 No warning was generated when a TIMESTAMP with a non-zero time part
 was converted to a DATE value. This caused index lookup to assume
 that this is a valid conversion and was returning rows that match 
 a comparison between a TIMESTAMP value and a DATE keypart.
 Fixed by generating a warning on such a truncation.


mysql-test/r/derived.result:
  Bug #31221: fixed an existing not-precise test case
mysql-test/r/ps_2myisam.result:
  Bug #31221: Warnings cased by existing tests
mysql-test/r/ps_3innodb.result:
  Bug #31221: Warnings cased by existing tests
mysql-test/r/ps_4heap.result:
  Bug #31221: Warnings cased by existing tests
mysql-test/r/ps_5merge.result:
  Bug #31221: Warnings cased by existing tests
mysql-test/r/ps_6bdb.result:
  Bug #31221: Warnings cased by existing tests
mysql-test/r/ps_7ndb.result:
  Bug #31221: Warnings cased by existing tests
mysql-test/r/type_date.result:
  Bug #31221: Warnings cased by existing tests
mysql-test/r/type_datetime.result:
  Bug #31221: test case
mysql-test/t/derived.test:
  Bug #31221: fixed an existing not-precise test case
mysql-test/t/type_date.test:
  Bug #31221: test case
sql/field.cc:
  Bug #31221: 
   - Upgraded fix for bug 29729
   - issue a warning only if the hh:mm:ss.msec is not zero consistently 
     for all the Field_newdate::store function
sql/item_timefunc.cc:
  Bug #31221: don't ignore the errors when storing data

The BIG_TABLES define wasn't enabled on Windows.
#define added


include/config-win.h:
  Bug #30638 why doesn't > 4294967295 rows work in myisam on windows.
  
  BIG_TABLES enabled on Windows

into  sin.intern.azundris.com:/misc/mysql/31588/41-31588

into  sin.intern.azundris.com:/misc/mysql/31588/50-31588


sql/set_var.cc:
  Auto merged
mysql-test/r/variables.result:
  SCCS merged
mysql-test/t/variables.test:
  SCCS merged

Buffer used when setting variables was not dimensioned to accomodate
trailing '\0'. An overflow by one character was therefore possible.
CS corrects limits to prevent such overflows.


mysql-test/r/variables.result:
  Try to overflow buffer used for setting system variables.
  Unpatched server should throw a valgrind warning here.
  Actual value and error message irrelevant, only length counts.
mysql-test/t/variables.test:
  Try to overflow buffer used for setting system variables.
sql/set_var.cc:
  Adjust maximum number of characters we can store in 'buff' by one
  as strmake() will write a terminating '\0'.

    
Previously, UDF *_init functions were passed constant strings with erroneous lengths. The length came from the containing variable's size, not the length of the value itself.
    
Now the *_init functions get the constant as a null terminated string with the correct length supplied too.


mysql-test/r/udf.result:
  Test case to check constants passed UDFs.
mysql-test/t/udf.test:
  Test case to check constants passed UDFs.
sql/item_func.cc:
  UDF _init functions are now passed the length of the constants, rather than the max length of the var containing the constant.
sql/udf_example.c:
  Added check_const_len functions. The check_const_len_init functions checks that lengths of constants are correctly passed.
sql/udf_example.def:
  Add new example functions to windows dll export list.

in middle of block)


libmysql/libmysql.c:
  Fix syntax error - don't define new variables in the middle of a block.
  
  Also, use size_t instead of uint to avoid unnecessary casting.

updated result files


mysql-test/suite/funcs_1/r/innodb__datadict.result:
  updated result file
mysql-test/suite/funcs_1/r/memory__datadict.result:
  updated result file
mysql-test/suite/funcs_1/r/myisam__datadict.result:
  updated result file