This may lead to buffer overflow.
The String::qs_append() function will append a string
without checking if there's enough space.
So qs_append() must be called beforehand to ensure 
there's enough space in the buffer for the subsequent 
qs_append() calls.
Fixed Item_case_expr::print() to make sure there's
enough space before appending data by adding a call to 
String::reserve() to make sure qs_append() will have 
enough space.

To correctly decide which predicates can be evaluated with a given table
the optimizer must know the exact set of tables that a predicate depends 
on. If that mask is too wide (refer to non-existing tables) the optimizer
can erroneously skip a predicate.
One such case of wrong table usage mask were the aggregate functions.
The have a all-1 mask (meaning depend on all tables, including non-existent
ones).
Fixed by making a real used_tables mask for the aggregates. The mask is
constructed in the following way :
1. OR the table dependency masks of all the arguments of the aggregate.
2. If all the arguments of the function are from the local name resolution 
  context and it is evaluated in the same name resolution
  context where it is referenced all the tables from that name resolution 
  context are OR-ed to the dependency mask. This is to denote that an
  aggregate function depends on the number of rows it processes.
3. Handle correctly the case of an aggregate function optimization (such that
  the aggregate function can be pre-calculated and made a constant).

Made sure that an aggregate function is never a constant (unless subject of a 
specific optimization and pre-calculation).  

One other flaw was revealed and fixed in the process : references were 
not calling the recalculation method for used_tables of their targets.

when the column is to be read from a derived table column which 
was specified as a concatenation of string literals.
The bug happened because the Item_string::append did not adjust the
value of Item_string::max_length. As a result of it the temporary 
table column  defined to store the concatenation of literals was 
not wide enough to hold the whole value.

away.

Additional fix for bug#22331. Now Item_field prints its value in the case of
the const field.

The flag alias_name_used was not set on for the outer references
in subqueries. It resulted in replacement of any outer reference
resolved against an alias for a full field name when the frm 
representation of a view with a subquery was generated. 
If the subquery and the outer query referenced the same table in
their from lists this replacement effectively changed the meaning
of the view and led to wrong results for selects from this view. 

Modified several functions to ensure setting the right value of
the alias_name_used flag for outer references resolved against
aliases.
 

Several problems here :
 1. The conversion to double of an hex string const item
 was not taking into account the unsigned flag.
 
 2. IN was not behaving in the same was way as comparisons
 when performed over an INT/DATE/DATETIME/TIMESTAMP column
 and a constant. The ordinary comparisons in that case 
 convert the constant to an INTEGER value and do int 
 comparisons. Fixed the IN to do the same.
 
 3. IN is not taking into account the unsigned flag when 
 calculating <expr> IN (<int_const1>, <int_const2>, ...).
 Extended the implementation of IN to store and process
 the unsigned flag for its arguments.

  Post fix for bug#23800.

  Post fix for bug#23800.
  Copy the table name of an Item_outer_ref to the conventional memory.

created for sorting.

Any outer reference in a subquery was represented by an Item_field object.
If the outer select employs a temporary table all such fields should be
replaced with fields from that temporary table in order to point to the 
actual data. This replacement wasn't done and that resulted in a wrong
subquery evaluation and a wrong result of the whole query.

Now any outer field is represented by two objects - Item_field placed in the
outer select and Item_outer_ref in the subquery. Item_field object is
processed as a normal field and the reference to it is saved in the
ref_pointer_array. Thus the Item_outer_ref is always references the correct
field. The original field is substituted for a reference in the
Item_field::fix_outer_field() function.

New function called fix_inner_refs() is added to fix fields referenced from
inner selects and to fix references (Item_ref objects) to these fields.

The new Item_outer_ref class is a descendant of the Item_direct_ref class.
It additionally stores a reference to the original field and designed to
behave more like a field.

 Several problems fixed: 
  1. There was a "catch-all" context initialization in setup_tables()
    that was causing the table that we insert into to be visible in the 
    SELECT part of an INSERT .. SELECT .. statement with no tables in
    its FROM clause. This was making sure all the under-initialized
    contexts in various parts of the code are not left uninitialized.
    Fixed by removing the "catch-all" statement and initializing the 
    context in the parser.
  2. Incomplete name resolution context when resolving the right-hand
    values in the ON DUPLICATE KEY UPDATE ... part of an INSERT ... SELECT ...
    caused columns from NATURAL JOIN/JOIN USING table references in the
    FROM clause of the select to be unavailable.
    Fixed by establishing a proper name resolution context.
  3. When setting up the special name resolution context for problem 2
    there was no check for cases where an aggregate function without a
    GROUP BY effectively takes the column from the SELECT part of an 
    INSERT ... SELECT unavailable for ON DUPLICATE KEY UPDATE.
    Fixed by checking for that condition when setting up the name 
    resolution context.

UPDATE contains wrong data if the SELECT employs a temporary table.

If the UPDATE values of the INSERT .. SELECT .. ON DUPLICATE KEY UPDATE
statement contains fields from the SELECT part and the select employs a
temporary table then those fields will contain wrong values because they
aren't corrected to get data from the temporary table.

The solution is to add these fields to the selects all_fields list,
to store pointers to those fields in the selects ref_pointer_array and
to access them via Item_ref objects.

The substitution for Item_ref objects is done in the new function called 
Item_field::update_value_transformer(). It is called through the
item->transform() mechanism at the end of the select_insert::prepare()
function.

The bug report has demonstrated the following two problems.
1. If an ORDER/GROUP BY list includes a constant expression being 
optimized away and, at the same time, containing single-row
subselects that return more that one row, no error is reported.
Strictly speaking the standard allows to ignore error in this case.
Yet, now a corresponding fatal error is reported in this case.
2. If a query requires sorting by expressions containing single-row
subselects that, however, return more than one row, then the execution
of the query may cause a server crash. 
To fix this some code has been added that blocks execution of a subselect
item in case of a fatal error in the method Item_subselect::exec.

on duplicate key".

INSERT ... SELECT ... ON DUPLICATE KEY UPDATE which was used in
stored routine or as prepared statement and which in its ON DUPLICATE
KEY clause erroneously tried to assign value to a column mentioned only
in its SELECT part was properly emitting error on the first execution
but succeeded on the second and following executions.

Code which is responsible for name resolution of fields mentioned in
UPDATE clause (e.g. see select_insert::prepare()) modifies table list
and Name_resolution_context used in this process. It uses
Name_resolution_context_state::save_state/restore_state() to revert
these modifications. Unfortunately those two methods failed to revert
properly modifications to TABLE_LIST::next_name_resolution_table
and this broke name resolution process for successive executions.

This patch fixes Name_resolution_context_state::save_state/restore_state()
in such way that it properly handles TABLE_LIST::next_name_resolution_table.

in a select list.
The objects of the Item_trigger_field class inherited the implementations
of the methods copy_or_same, get_tmp_table_item and get_tmp_table_field
from the class Item_field while they rather should have used the default
implementations defined for the base class Item.
It could cause catastrophic problems for triggers that used SELECTs
with select list containing trigger fields such as NEW.<table column>
under DISTINCT.

According to some internal communication, these two functions are place
holders for future enhancements. Because they use a variable number of
parameters, the implementation defined a reserved keyword for them in the
parser grammar.

Unfortunately, doing so creates a bug similar to Bug 21114 reported for the
function FORMAT.

In the 5.1 code base, due to improvements in the code implemented with bug
21114, having a reserved keyword for functions with a variable number of
arguments is not needed any more by the implementation.

As a result, this fix removes the place-holder implementation, and removes
the unnecessary reserved keywords. Should the functions UNIQUE_USERS and
GROUP_UNIQUE_USERS be finally implemented in a later release, the
implementation should sub class Create_native_func in sql/item_create.cc.
For example, see the class Create_func_concat.

Currently in the ONLY_FULL_GROUP_BY mode no hidden fields are allowed in the
select list. To ensure this each expression in the select list is checked
to be a constant, an aggregate function or to occur in the GROUP BY list.
The last two requirements are wrong and doesn't allow valid expressions like
"MAX(b) - MIN(b)" or "a + 1" in a query with grouping by a.

The correct check implemented by the patch will ensure that:
any field reference in the [sub]expressions of the select list 
  is under an aggregate function or
  is mentioned as member of the group list or
  is an outer reference or
  is part of the select list element that coincide with a grouping element.

The Item_field objects now can contain the position of the select list
expression which they belong to. The position is saved during the
field's Item_field::fix_fields() call.

The non_agg_fields list for non-aggregated fields is added to the SELECT_LEX
class. The SELECT_LEX::cur_pos_in_select_list now contains the position in the
select list of the expression being currently fixed.

  Corrected spelling in copyright text
Makefile.am:
  Don't update the files from BitKeeper
Many files:
  Removed "MySQL Finland AB & TCX DataKonsult AB" from copyright header
  Adjusted year(s) in copyright header 
Many files:
  Added GPL copyright text
Removed files:
  Docs/Support/colspec-fix.pl
  Docs/Support/docbook-fixup.pl
  Docs/Support/docbook-prefix.pl
  Docs/Support/docbook-split
  Docs/Support/make-docbook
  Docs/Support/make-makefile
  Docs/Support/test-make-manual
  Docs/Support/test-make-manual-de
  Docs/Support/xwf

  Changed header to GPL version 2 only

- Removed not used variables and functions
- Added #ifdef around code that is not used
- Renamed variables and functions to avoid conflicts
- Removed some not used arguments

Fixed some class/struct warnings in ndb
Added define IS_LONGDATA() to simplify code in libmysql.c

I did run gcov on the changes and added 'purecov' comments on almost all lines that was not just variable name changes

 When implicitly converting string fields to numbers the 
 string-to-number conversion error was not sent to the client.
 Added code to send the conversion error as warning.
 
 We also need to prevent generation of warnings from the places
 where val_xxx() methods are called for the sole purpose of updating
 the Item::null_value flag.
 To achieve that a special function is added (and called) : 
 update_null_value(). This function will set the no_errors flag and
 will call val_xxx(). The warning generation in Field_string::val_xxx()
 will use the flag when generating the conversion warnings. 

  
  The problem was that any VIEW columns had always implicit derivation.
  Fix: derivation is now copied from the original expression
  given in VIEW definition.
  For example:
  - a VIEW column which comes from a string constant
    in CREATE VIEW definition have now coercible derivation.
  - a VIEW column having COLLATE clause
    in CREATE VIEW definition have now explicit derivation.

Evaluate "NULL IN (SELECT ...)" in a special way: Disable pushed-down 
conditions and their "consequences": 
 = Do full table scans instead of unique_[index_subquery] lookups.
 = Change appropriate "ref_or_null" accesses to full table scans in
   subquery's joins.
Also cache value of NULL IN (SELECT ...) if the SELECT is not correlated 
wrt any upper select.

Review fixes

Review comments

 VALUES() was considered a constant. This caused replacing 
 (or pre-calculating) it using uninitialized values before the actual
 execution takes place.
 Mark it as a non-constant (still not dependent of tables) to prevent
 the pre-calculation.

equal constant under any circumstances.
In fact this substitution can be allowed if the field is
not of a type string or if the field reference serves as 
an argument of a comparison predicate.  

Changes in an item tree done by optimizer weren't properly
registered and went unnoticed, which resulted in preliminary freeing
of used memory.

A date can be represented as an int (like 20060101) and as a string (like
"2006.01.01"). When a DATE/TIME field is compared in one SELECT against both
representations the constant propagation mechanism leads to comparison
of DATE as a string and DATE as an int. In this example it compares 2006 and
20060101 integers. Obviously it fails comparison although they represents the
same date.


Now the Item_bool_func2::fix_length_and_dec() function sets the comparison
context for items being compared. I.e. if items compared as strings the
comparison context is STRING.
The constant propagation mechanism now doesn't mix items used in different
comparison contexts. The context check is done in the
Item_field::equal_fields_propagator() and in the change_cond_ref_to_const() 
functions.

Also the better fix for bug 21159 is introduced.

  Post review changes for bug#19862.

When there is no index defined filesort is used to sort the result of a
query. If there is a function in the select list and the result set should be
ordered by it's value then this function will be evaluated twice. First time to
get the value of the sort key and second time to send its value to a user.
This happens because filesort when sorts a table remembers only values of its
fields but not values of functions.
All functions are affected. But taking into account that SP and UDF functions
can be both expensive and non-deterministic a temporary table should be used 
to store their results and then sort it to avoid twice SP evaluation and to 
get a correct result.

If an expression referenced in an ORDER clause contains a SP or UDF 
function, force the use of a temporary table.

A new Item_processor function called func_type_checker_processor is added
to check whether the expression contains a function of a particular type.

Review fixes

In some functions dealing with strings and character sets, the wrong
pointers were saved for restoration in THD::rollback_item_tree_changes().
This could potentially cause random corruption or crashes.

Fixed by passing the original Item ** locations, not local stack copies.

Also remove unnecessary use of default arguments.