A stored procedure involving substrings could crash the server on certain
platforms because of invalid memory reads.
          
During storing the new blob-field value, the cached value's address range
overlapped that of the new field value. This caused problems when the 
cached value storage was reallocated to provide access for a new 
characater set representation. The patch checks the address ranges, and if
they overlap, the new field value is copied to a new storage before it is
converted to the new character set.


mysql-test/r/sp.result:
  Added result set
mysql-test/t/sp.test:
  Added test case
sql/field.cc:
  The source and destination address ranges of a character conversion must not overlap or the 'from' address will be invalidated as the temporary value-
  object is re-allocated to fit the new character set.
sql/field.h:
  Added comments

Problem: <=> operator may return wrong results 
comparing NULL and a DATE/DATETIME/TIME value.

Fix: properly check NULLs.


mysql-test/r/type_datetime.result:
  Fix for bug#37526: asymertic operator <=> in trigger
    - test result.
mysql-test/t/type_datetime.test:
  Fix for bug#37526: asymertic operator <=> in trigger
    - test case.
sql/item_cmpfunc.cc:
  Fix for bug#37526: asymertic operator <=> in trigger
    - if is_nulls_eq is TRUE Arg_comparator::compare_datetime() 
  should return 1 only if both arguments are NULL.

Problem: SELECT ... REGEXP BINARY NULL may lead to server crash/hang.

Fix: properly handle NULL regular expressions.


mysql-test/r/func_regexp.result:
  Fix for bug #39021: SELECT REGEXP BINARY NULL never returns
    - test result.
mysql-test/t/func_regexp.test:
  Fix for bug #39021: SELECT REGEXP BINARY NULL never returns
    - test case.
sql/item_cmpfunc.cc:
  Fix for bug #39021: SELECT REGEXP BINARY NULL never returns
    - checking regular expressions' null_value
  we tested it without a val_xxx() call before, which is wrong.
  Now Item_func_regex::regcomp() returns -1 in the case
  and allows to handle NULL expessions properly.
sql/item_cmpfunc.h:
  Fix for bug #39021: SELECT REGEXP BINARY NULL never returns
    - checking regular expressions' null_value
  we tested it without a val_xxx() call before, which is wrong.
  Now Item_func_regex::regcomp() returns -1 in the case
  and allows to handle NULL expessions properly.

in open_table()

Problem: repeating "CREATE... ( AUTOINCREMENT) ... SELECT" may lead to
an assertion failure.

Fix: reset table->auto_increment_field_not_null after each record 
writing.


mysql-test/r/create.result:
  Fix for bug#38821: Assert table->auto_increment_field_not_null failed 
  in open_table()
    - test result.
mysql-test/t/create.test:
  Fix for bug#38821: Assert table->auto_increment_field_not_null failed 
  in open_table()
    - test case.
sql/sql_insert.cc:
  Fix for bug#38821: Assert table->auto_increment_field_not_null failed 
  in open_table()
    - reset table->auto_increment_field_not_null after writing a record
  for "{CREATE, INSERT}..SELECT".

  INSERT .. SELECT .. ON DUPLICATE KEY UPDATE col=DEFAULT

In order to get correct values from update fields that
belongs to the SELECT part in the INSERT .. SELECT .. ON
DUPLICATE KEY UPDATE statement, the server adds referenced
fields to the select list. Part of the code that does this
transformation is shared between implementations of
the DEFAULT(col) function and the DEFAULT keyword (in
the col=DEFAULT expression), and an implementation of
the DEFAULT keyword is incomplete.


mysql-test/r/default.result:
  Added test case for bug #39002.
mysql-test/t/default.test:
  Added test case for bug #39002.
sql/item.cc:
  The Item_default_value::transform() function has been
  modified to take into account the fact that the DEFAULT
  keyword has no arguments unlike the DEFAULT(col) function
  that always has an argument.

Bug#33031 app linked to libmysql.lib crash if run as service in vista under 
localsystem
  

There are some problems using DllMain hook functions on Windows that 
automatically do global and per-thread initialization for libmysqld.dll

1)per-thread initialization(DLL_THREAD_ATTACH)
MySQL internally counts number of active threads that and causes a delay in in 
my_end() if not all threads are exited. But,there are threads that can be 
started either by Windows internally (often in TCP/IP scenarios) or by user 
himself - those threads are not necessarily using libmysql.dll functionality, 
but nonetheless the contribute to the count of open threads.

2)process-initialization (DLL_PROCESS_ATTACH)
my_init() calls WSAStartup that itself loads DLLs and can lead to a deadlock in 
Windows loader.

Fix is to remove dll initialization code from libmysql.dll in general case. I
still leave an environment variable LIBMYSQL_DLLINIT, which if set to any value 
will cause the old behavior (DLL init hooks will be called). This env.variable 
exists only to prevent breakage of existing Windows-only applications that 
don't do mysql_thread_init() and work ok today. Use of LIBMYSQL_DLLINIT is 
discouraged and it will be removed in 6.0

            returns unexpected result

If:
  1. a table has a not nullable BIT column c1 with a length
     shorter than 8 bits and some additional not nullable
     columns c2 etc, and
  2. the WHERE clause is like: (c1 = constant) AND c2 ...,
the SELECT query returns unexpected result set.


The server stores BIT columns in a tricky way to save disk
space: if column's bit length is not divisible by 8, the
server places reminder bits among the null bits at the start
of a record. The rest bytes are stored in the record itself,
and Field::ptr points to these rest bytes.

However if a bit length of the whole column is less than 8,
there are no remaining bytes, and there is nothing to store in
the record at its regular place. In this case Field::ptr points
to bytes actually occupied by the next column in a record.
If both columns (BIT and the next column) are NOT NULL,
the Field::eq function incorrectly deduces that this is the
same column, so query transformation/equal item elimination
code (see build_equal_items_for_cond) may mix these columns
and damage conditions containing references to them.


mysql-test/r/type_bit.result:
  Added test case for bug #37799.
mysql-test/t/type_bit.test:
  Added test case for bug #37799.
sql/field.h:
  1. The Field::eq function has been modified to take types of
  comparing columns into account to distinguish between BIT and
  not BIT columns referencing the same bytes in a record.
  
  2. Unnecessary type comparison has been removed from the
  Field_bit::eq function (moved to Field::eq).

used causes server crash.
      
When the loose index scan access method is used values of aggregated functions
are precomputed by it. Aggregation of such functions shouldn't be performed
in this case and functions should be treated as normal ones.
The create_tmp_table function wasn't taking this into account and this led to
a crash if a query has MIN/MAX aggregate functions and employs temporary table
and loose index scan.
Now the JOIN::exec and the create_tmp_table functions treat MIN/MAX aggregate
functions as normal ones when the loose index scan is used.


mysql-test/r/group_min_max.result:
  Added a test case for the bug#38195.
mysql-test/t/group_min_max.test:
  Added a test case for the bug#38195.
sql/sql_select.cc:
  Bug#38195: Incorrect handling of aggregate functions when loose index scan is
  used causes server crash.
  The JOIN::exec and the create_tmp_table functions treat MIN/MAX aggregate
  functions as normal ones when the loose index scan is used.

Typo fixed.
No test case as we actually don't use rtree_get_first() 
and rtree_get_next() at present.

Problem: data consistency check (maximum record length) for a correct
MyISAM table with CHECKSUM=1 and ROW_FORMAT=DYNAMIC option 
may fail due to wrong inner MyISAM parameter. In result we may 
have the table marked as 'corrupted'. 

Fix: properly set MyISAM maximum record length parameter.


myisam/mi_create.c:
  Fix for bug #37310: 'on update CURRENT_TIMESTAMP' option crashes the table
  
  Use HA_OPTION_PACK_RECORD instead of HA_PACK_RECORD (typo?) 
  calculating packed record length.

- Use the compiler's default copy constructor for QUICK_RANGE_SELECT. 
  bcopy(this, copy, ...) call caused some odd action on gcc-4.1.2 on x86_64

sql/opt_range.cc:
  BUG#36639: subselect.test crashes on 64 bit pentium4 when compiled for valgrind
  - Set QUICK_SELECT_DESC not to use MRR implementation (code moved to here
    from opt_range.h)
sql/opt_range.h:
  BUG#36639: subselect.test crashes on 64 bit pentium4 when compiled for valgrind
  - Use the compiler's default copy constructor for QUICK_RANGE_SELECT. 
    bcopy(this, copy, ...) call caused some odd action on gcc-4.1.2 on x86_64

Dumping information about locks in use by sending a SIGHUP signal
to the server or by invoking the "mysqladmin debug" command may
lead to a server crash in debug builds or to undefined behavior in
production builds.

The problem was that a mutex that protects a lock object (THR_LOCK)
might have been destroyed before the lock object was actually removed
from the list of locks in use, causing a race condition with other
threads iterating over the list. The solution is to destroy the mutex
only after removing lock object from the list.

mysys/thr_lock.c:
  Destroy the mutex that protects the lock object only after removing
  the lock object from the list of locks in use.

plugin_dir option backported from 5.1

mysql-test/r/udf.result:
  result fix
sql/mysql_priv.h:
  opt_plugin_dir and opt_plugin_dir_ptr declared.
sql/mysqld.cc:
  'plugin_dir' option added
sql/set_var.cc:
  'plugin_dir' option added.
sql/sql_udf.cc:
  opt_plugin_dir added to the udf->dl path. Warn if it's not specified.
sql/unireg.h:
  PLUGINDIR defined.

  Bug#26687 rpl_ddl test fails if run with --innodb option
  Details:
  - The current test + the expected results do only fit
    if the slave uses MyISAM for mysqltest1.t1.
    Therefore skip the test if we do not meet these
    conditions.
  - The solution for 5.1 will look quite different
    because "ps_ddl" is already much improved in
    MySQL 5.1.

            
            test_if_data_home_dir fixed to look into real path.
            Checks added to mi_open for symlinks into data home directory.

per-file messages:
        include/my_sys.h
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          my_is_symlink interface added
        include/myisam.h
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          myisam_test_invalid_symlink interface added
        myisam/mi_check.c
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          mi_open_datafile calls modified
        myisam/mi_open.c
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          code added to mi_open to check for symlinks into data home directory.
          mi_open_datafile now accepts 'original' file path to check if it's
          an allowed symlink.
        myisam/mi_static.c
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          myisam_test_invlaid_symlink defined
        myisam/myisamchk.c
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          mi_open_datafile call modified
        myisam/myisamdef.h
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          mi_open_datafile interface modified - 'real_path' parameter added
        mysql-test/r/symlink.test
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          error codes corrected as some patch now rejected pointing inside datahome
        mysql-test/r/symlink.result
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          error messages corrected in the result
        mysys/my_symlink.c
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          my_is_symlink() implementsd
          my_realpath() now returns the 'realpath' even if a file isn't a symlink
        sql/mysql_priv.h
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          test_if_data_home_dir interface
        sql/mysqld.cc
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          myisam_test_invalid_symlik set with the 'test_if_data_home_dir'
        sql/sql_parse.cc
          Bug#32167 another privilege bypass with DATA/INDEX DIRECTORY.
          
          error messages corrected
          test_if_data_home_dir code fixed

- Cherry pick 6.0 changes for Visual Studio 2008 support
- Add scripts  win\build-vs9.bat and win\build-vs9_x64.bat

Also, remove CMake generated visual studio project files.

extra/yassl/taocrypt/taocrypt.vcproj:
  remove file that is generated each time by cmake
extra/yassl/yassl.vcproj:
  remove file that is generated each time by cmake
server-tools/instance-manager/mysqlmanager.vcproj:
  remove file that is generated each time by cmake
win/build-vs9.bat:
  Add script for Visual Studio 2008 support
win/build-vs9_x64.bat:
  Add script for Visual Studio 2008 support
zlib/zutil.h:
  support Visual Studio 2008

Send_field.org_col_name has broken value on secondary execution.
It happens when result field is created from the field which belongs to view
due to forgotten assignment of some Send_field attributes. 
The fix:
set Send_field.org_col_name,org_table_name with correct value during Send_field intialization.

mysql-test/r/metadata.result:
  result fix
  The result file was changed because now forgotten attributes are properly set.
mysql-test/r/sp.result:
  test result
mysql-test/t/sp.test:
  test case
sql/item.cc:
  Send_field.org_col_name has broken value on secondary execution.
  It happens when result field is created from the field which belongs to view
  due to forgotten assignment of some Send_field attributes. 
  The fix:
  set Send_field.org_col_name,org_table_name with correct value during Send_field intialization.
tests/mysql_client_test.c:
  test case fix
  The test was changed because now forgotten attributes are properly set.

is used causes server crash.
  Revert the fix : unstable test case revealed by pushbuild

more clever gcc version checking.

Tilde expansion could fail when it was to expand to an empty string (such as
when HOME is set to an empty string), especially on systems where size_t is
unsigned.

Length value is the length of the field,
Max_length is the length of the field value.
So Max_length can not be more than Length.
The fix: fixed calculation of the Item_empty_string item length

(Patch applied and queued on demand of Trudy/Davi.)

sql/item.h:
  fixed calculation of the item length
sql/sql_show.cc:
  removed unnecessary code

When the fractional part in a multiplication of DECIMALs
overflowed, we truncated the first operand rather than the
longest. Now truncating least significant places instead
for more precise multiplications.

(Queuing at demand of Trudy/Davi.)

mysql-test/r/type_newdecimal.result:
  show that if we need to truncate the scale of an operand, we pick the
  right one (that is, we discard the least significant decimal places)
mysql-test/t/type_newdecimal.test:
  show that if we need to truncate the scale of an operand, we pick the
  right one (that is, we discard the least significant decimal places)
strings/decimal.c:
  when needing to disregard fractional parts, pick the least
  significant ones

with blobs containing nulls

Problem: FEDERATED SE improperly stores NULL fields in the record buffer.

Fix: store them properly.


mysql-test/r/federated.result:
  Fix for bug #34779: crash in checksum table on federated tables 
  with blobs containing nulls
    - test result.
mysql-test/t/federated.test:
  Fix for bug #34779: crash in checksum table on federated tables 
  with blobs containing nulls
    - test case.
sql/ha_federated.cc:
  Fix for bug #34779: crash in checksum table on federated tables 
  with blobs containing nulls
    - storing a NULL field in the record buffer
      we must initialize its data as other code
      may rely on it.

used causes server crash.

When the loose index scan access method is used values of aggregated functions
are precomputed by it. Aggregation of such functions shouldn't be performed
in this case and functions should be treated as normal ones.
The create_tmp_table function wasn't taking this into account and this led to
a crash if a query has MIN/MAX aggregate functions and employs temporary table
and loose index scan.
Now the JOIN::exec and the create_tmp_table functions treat MIN/MAX aggregate
functions as normal ones when the loose index scan is used.


mysql-test/r/group_min_max.result:
  Added a test case for the bug#38195.
mysql-test/t/group_min_max.test:
  Added a test case for the bug#38195.
sql/sql_select.cc:
  Bug#38195: Incorrect handling of aggregate functions when loose index scan is
  used causes server crash.
  Now the JOIN::exec and the create_tmp_table functions treat MIN/MAX aggregate
  functions as normal ones when the loose index scan is used.