diff --git a/VERSION b/VERSION
index 4522ed40cbddc..7fa0a03e5b67e 100644
--- a/VERSION
+++ b/VERSION
@@ -1,4 +1,4 @@
 MYSQL_VERSION_MAJOR=10
 MYSQL_VERSION_MINOR=6
-MYSQL_VERSION_PATCH=25
+MYSQL_VERSION_PATCH=26
 SERVER_MATURITY=stable
diff --git a/mysql-test/main/gis-precise.result b/mysql-test/main/gis-precise.result
index 242fa2eb5ef76..a454fbf00ba13 100644
--- a/mysql-test/main/gis-precise.result
+++ b/mysql-test/main/gis-precise.result
@@ -389,7 +389,7 @@ result
 MULTIPOINT(7 5,7 5.142857142857142,5.899999999999998 5.300000000000001,5.799999999999997 5.600000000000001,3 7)
 SELECT ST_CROSSES( GEOMETRYFROMTEXT(' POLYGON( (3 5, 2 4, 2 5, 3 5) ) ') , POLYGONFROMTEXT(' POLYGON((2 4,3 4,3 5,2 5,2 4)) ')) as result;
 result
-0
+NULL
 SELECT ST_WITHIN( POLYGONFROMTEXT(' POLYGON( (0 5, 3 5, 3 4, 2 0 , 1 0, 2 4 , 0 4, 0 5) ) ') , POLYGONFROMTEXT(' POLYGON( (0 5, 3 5, 3 4, 1 4 , 1 3 , 3 3 , 3 0 , 0 0 , 0 5), ( 1 1 , 2 1 , 2 2 , 1 2 , 1 1 ) ) ') ) as result;
 result
 0
@@ -868,3 +868,15 @@ ST_INTERSECTION(
 ST_MULTIPOLYGONFROMTEXT(' MULTIPOLYGON(((3.8571428571428568 2.857142857142857,5.571428571428571 4.571428571428571,9 4,3.8571428571428568 2.857142857142857)),((4.5 4.75,3 5,4.6 7.4,6 6,4.5 4.75))) '),                   ST_MULTIPOLYGONFROMTEXT(' MULTIPOLYGON(((3 4,3 5,2 5,2 7,5 4,3 4),(5 4,7.4 7,8 7,8 4,5 4))) ') )) as V;
 V
 3
+#
+# MDEV-36058 ST_CROSSES returns 0 instead of NULL.
+#
+SELECT ST_CROSSES( ST_GEOMFROMTEXT('point(1 1)'), st_geomfromtext('point(1 1)') ) a;
+a
+NULL
+SELECT ST_CROSSES( ST_GEOMFROMTEXT('POLYGON ((59 18,67 18,67 13,59 13,59 18)) '), st_geomfromtext('polygon((2 2,2 4, 4 2,2 2))') ) a;
+a
+NULL
+SELECT ST_CROSSES( ST_GEOMFROMTEXT('POLYGON ((59 18,67 18,67 13,59 13,59 18)) '), st_geomfromtext('point(1 1)') ) a;
+a
+NULL
diff --git a/mysql-test/main/gis-precise.test b/mysql-test/main/gis-precise.test
index 4f84589c9995b..abf9ccb939439 100644
--- a/mysql-test/main/gis-precise.test
+++ b/mysql-test/main/gis-precise.test
@@ -477,7 +477,6 @@ set @sarajevo = ST_GeomFromText('POINT(18.413076 43.856258)');
 SELECT TRUNCATE(ST_Distance_Sphere(@zenica, @sarajevo), 10);
 SELECT TRUNCATE(ST_Distance_Sphere(@sarajevo, @zenica), 10);
 
-
 --echo #
 --echo # MDEV-31499 Assertion `(0)' failed in Gis_geometry_collection::init_from_opresult.
 --echo #
@@ -486,3 +485,12 @@ SELECT ST_NUMGEOMETRIES(
        ST_INTERSECTION(
                 ST_MULTIPOLYGONFROMTEXT(' MULTIPOLYGON(((3.8571428571428568 2.857142857142857,5.571428571428571 4.571428571428571,9 4,3.8571428571428568 2.857142857142857)),((4.5 4.75,3 5,4.6 7.4,6 6,4.5 4.75))) '),                   ST_MULTIPOLYGONFROMTEXT(' MULTIPOLYGON(((3 4,3 5,2 5,2 7,5 4,3 4),(5 4,7.4 7,8 7,8 4,5 4))) ') )) as V;
 
+--echo #
+--echo # MDEV-36058 ST_CROSSES returns 0 instead of NULL.
+--echo #
+
+
+SELECT ST_CROSSES( ST_GEOMFROMTEXT('point(1 1)'), st_geomfromtext('point(1 1)') ) a;
+SELECT ST_CROSSES( ST_GEOMFROMTEXT('POLYGON ((59 18,67 18,67 13,59 13,59 18)) '), st_geomfromtext('polygon((2 2,2 4, 4 2,2 2))') ) a;
+SELECT ST_CROSSES( ST_GEOMFROMTEXT('POLYGON ((59 18,67 18,67 13,59 13,59 18)) '), st_geomfromtext('point(1 1)') ) a;
+
diff --git a/mysql-test/main/gis.result b/mysql-test/main/gis.result
index 9e92de66d090c..8b4bdb1dc0585 100644
--- a/mysql-test/main/gis.result
+++ b/mysql-test/main/gis.result
@@ -1825,7 +1825,7 @@ exp
 #
 SELECT ST_GEOMETRYTYPE(ST_PointOnSurface(ST_PolyFromText('POLYGON((-70.916 42.1002,-70.9468 42.0946,-70.9754 42.0875,-70.9749 42.0879,-70.9759 42.0897,-70.916 42.1002))'))) as exp;
 exp
-NULL
+POINT
 #
 # MDEV-7529 GIS: ST_Relate returns unexpected results for POINT relations
 #
@@ -5507,3 +5507,10 @@ ST_SRID(g1)	ST_SRID(ST_GeomFromWKB(g1, 4326))	ST_SRID(ST_GeomFromWKB(g1))	ST_AsT
 SELECT ST_DISTANCE_SPHERE(st_geomfromtext('linestring( 2 2, 2 8) '), ST_GeomFromText('POINT(18.413076 43.856258)')) ;
 ERROR HY000: Calling geometry function st_distance_sphere with unsupported types of arguments.
 # End of 10.5 tests
+#
+# MDEV-35766 ST_PointOnSurface returns NULL with Polygon in some case.
+#
+SELECT ST_ASTEXT(ST_POINTONSURFACE(ST_GeomFromText('POLYGON((-1 0, 1 2, 1 0, -1 0))'))) as T;
+T
+POINT(0.5 1)
+# End of 10.6 tests
diff --git a/mysql-test/main/gis.test b/mysql-test/main/gis.test
index 860fc8a4d4a31..6de6180db91b4 100644
--- a/mysql-test/main/gis.test
+++ b/mysql-test/main/gis.test
@@ -3515,3 +3515,10 @@ FROM (
 SELECT ST_DISTANCE_SPHERE(st_geomfromtext('linestring( 2 2, 2 8) '), ST_GeomFromText('POINT(18.413076 43.856258)')) ;
 
 --echo # End of 10.5 tests
+
+--echo #
+--echo # MDEV-35766 ST_PointOnSurface returns NULL with Polygon in some case.
+--echo #
+SELECT ST_ASTEXT(ST_POINTONSURFACE(ST_GeomFromText('POLYGON((-1 0, 1 2, 1 0, -1 0))'))) as T;
+
+--echo # End of 10.6 tests
diff --git a/mysql-test/main/mysqltest_string_functions.result b/mysql-test/main/mysqltest_string_functions.result
index e6f848cef6f9a..eb3d56e655408 100644
--- a/mysql-test/main/mysqltest_string_functions.result
+++ b/mysql-test/main/mysqltest_string_functions.result
@@ -2,6 +2,32 @@
 # Test for MDEV-36108: Variable substitutions in mysqltest
 # ----------------------------------------------------------------------------
 # ----------------------------------------------------------------------------
+# Test absolute value function
+# ----------------------------------------------------------------------------
+# Basic abs() function tests
+abs(10) -> 10;
+abs(-10) -> 10;
+abs(0) -> 0;
+abs(123456789) -> 123456789;
+abs(-987654321) -> 987654321;
+abs(NULL) -> ;
+abs(5 - 10) -> 5;
+abs(10 - 5) -> 5;
+abs(-(-25)) -> 25;
+abs(-2147483648) -> 2147483648;
+abs(2147483647) -> 2147483647;
+abs(1 == 1) -> 1;
+abs(1 == 0) -> 0;
+abs(-((5 * -3) + (2 - 8))) -> 21;
+abs(((10 - 25) * (3 + 2))) -> 75;
+abs(((2 - 6) * (-4 + 1))) -> 12;
+abs((((-5 * 6) + 10) - (8 * -2))) -> 4;
+abs(((((3 - 9) * 2) + 4) - 1)) -> 9;
+abs(((-100 + 50) * (2 - 5))) -> 150;
+abs(((-3 * (2 + 4)) + (18 / 3))) -> 12;
+abs(((((10 - 5) * -3) + 4) * -2)) -> 22;
+abs((((-2 * -2) - (5 * 3)) + 20)) -> 9;
+# ----------------------------------------------------------------------------
 # Test conversion functions (conv, bin, oct, hex)
 # ----------------------------------------------------------------------------
 # Basic conv() function tests
diff --git a/mysql-test/main/mysqltest_string_functions.test b/mysql-test/main/mysqltest_string_functions.test
index 9115e46923d56..10e0d546e157c 100644
--- a/mysql-test/main/mysqltest_string_functions.test
+++ b/mysql-test/main/mysqltest_string_functions.test
@@ -4,6 +4,79 @@
 
 --source include/not_embedded.inc
 
+--echo # ----------------------------------------------------------------------------
+--echo # Test absolute value function
+--echo # ----------------------------------------------------------------------------
+
+--echo # Basic abs() function tests
+
+let $a1 = $(abs(10));
+-- echo abs(10) -> $a1;
+
+let $a2 = $(abs(-10));
+-- echo abs(-10) -> $a2;
+
+let $a3 = $(abs(0));
+-- echo abs(0) -> $a3;
+
+let $a4 = $(abs(123456789));
+-- echo abs(123456789) -> $a4;
+
+let $a5 = $(abs(-987654321));
+-- echo abs(-987654321) -> $a5;
+
+let $a6 = $(abs(NULL));
+-- echo abs(NULL) -> $a6;
+
+let $a7 = $(abs(5 - 10));
+-- echo abs(5 - 10) -> $a7;
+
+let $a8 = $(abs(10 - 5));
+-- echo abs(10 - 5) -> $a8;
+
+let $a9 = $(abs(-(-25)));
+-- echo abs(-(-25)) -> $a9;
+
+let $a10 = $(abs(-2147483648));
+-- echo abs(-2147483648) -> $a10;
+
+let $a11 = $(abs(2147483647));
+-- echo abs(2147483647) -> $a11;
+
+let $a12 = $(abs(1 == 1));
+-- echo abs(1 == 1) -> $a12;
+
+let $a13 = $(abs(1 == 0));
+-- echo abs(1 == 0) -> $a13;
+
+let $a14 = $(abs(-((5 * -3) + (2 - 8))));
+-- echo abs(-((5 * -3) + (2 - 8))) -> $a14;
+
+let $a15 = $(abs(((10 - 25) * (3 + 2))));
+-- echo abs(((10 - 25) * (3 + 2))) -> $a15;
+
+let $a16 = $(abs(((2 - 6) * (-4 + 1))));
+-- echo abs(((2 - 6) * (-4 + 1))) -> $a16;
+
+let $a17 = $(abs((((-5 * 6) + 10) - (8 * -2))));
+-- echo abs((((-5 * 6) + 10) - (8 * -2))) -> $a17;
+
+let $a18 = $(abs(((((3 - 9) * 2) + 4) - 1)));
+-- echo abs(((((3 - 9) * 2) + 4) - 1)) -> $a18;
+
+let $a19 = $(abs(((-100 + 50) * (2 - 5))));
+-- echo abs(((-100 + 50) * (2 - 5))) -> $a19;
+
+let $a20 = $(abs(((-3 * (2 + 4)) + (18 / 3))));
+-- echo abs(((-3 * (2 + 4)) + (18 / 3))) -> $a20;
+
+let $a21 = $(abs(((((10 - 5) * -3) + 4) * -2)));
+-- echo abs(((((10 - 5) * -3) + 4) * -2)) -> $a21;
+
+let $a22 = $(abs((((-2 * -2) - (5 * 3)) + 20)));
+-- echo abs((((-2 * -2) - (5 * 3)) + 20)) -> $a22;
+
+
 --echo # ----------------------------------------------------------------------------
 --echo # Test conversion functions (conv, bin, oct, hex)
 --echo # ----------------------------------------------------------------------------
diff --git a/mysql-test/suite/encryption/t/innodb-first-page-read.opt b/mysql-test/suite/encryption/t/innodb-first-page-read.opt
deleted file mode 100644
index 38d69691ed6aa..0000000000000
--- a/mysql-test/suite/encryption/t/innodb-first-page-read.opt
+++ /dev/null
@@ -1,5 +0,0 @@
---innodb-encrypt-tables=ON
---innodb-encrypt-log=ON
---innodb-encryption-rotate-key-age=15
---innodb-encryption-threads=4
---innodb-tablespaces-encryption
diff --git a/mysql-test/suite/innodb/r/alter_crash.result b/mysql-test/suite/innodb/r/alter_crash.result
index 77acd237218b0..6659b91522f03 100644
--- a/mysql-test/suite/innodb/r/alter_crash.result
+++ b/mysql-test/suite/innodb/r/alter_crash.result
@@ -243,3 +243,19 @@ a	b
 1	1
 2	1
 DROP TABLE t1;
+#
+#  MDEV-37886 PAGE_COMPRESSED ALTER TABLE operations
+#    inconsistent with innodb_file_per_table setting
+#
+SET GLOBAL innodb_file_per_table=0;
+CREATE TABLE t1(a INT PRIMARY KEY) ENGINE=InnoDB;
+SET DEBUG_SYNC='before_lock_tables_takes_lock SIGNAL stuck WAIT_FOR go';
+ALTER TABLE t1 PAGE_COMPRESSED=1, ALGORITHM=INSTANT;
+connect con1,localhost,root;
+SET DEBUG_SYNC='now WAIT_FOR stuck';
+SET GLOBAL innodb_file_per_table=1;
+SET DEBUG_SYNC='now SIGNAL go';
+disconnect con1;
+connection default;
+ERROR HY000: Table storage engine 'InnoDB' does not support the create option 'PAGE_COMPRESSED'
+DROP TABLE t1;
diff --git a/mysql-test/suite/innodb/r/xa_recovery.result b/mysql-test/suite/innodb/r/xa_recovery.result
index 0caa501c1e1d1..133f9780c5797 100644
--- a/mysql-test/suite/innodb/r/xa_recovery.result
+++ b/mysql-test/suite/innodb/r/xa_recovery.result
@@ -16,6 +16,7 @@ connection default;
 disconnect con1;
 disconnect con2;
 connect  con1,localhost,root;
+SET STATEMENT innodb_lock_wait_timeout=1 FOR # work around MDEV-38741
 SELECT * FROM t1 LOCK IN SHARE MODE;
 connection default;
 SET innodb_lock_wait_timeout=1;
diff --git a/mysql-test/suite/innodb/t/alter_crash.test b/mysql-test/suite/innodb/t/alter_crash.test
index 1829529450ddc..320befe0dba2b 100644
--- a/mysql-test/suite/innodb/t/alter_crash.test
+++ b/mysql-test/suite/innodb/t/alter_crash.test
@@ -241,3 +241,22 @@ CHECK TABLE t1;
 SHOW CREATE TABLE t1;
 SELECT * FROM t1;
 DROP TABLE t1;
+
+--echo #
+--echo #  MDEV-37886 PAGE_COMPRESSED ALTER TABLE operations
+--echo #    inconsistent with innodb_file_per_table setting
+--echo #
+SET GLOBAL innodb_file_per_table=0;
+CREATE TABLE t1(a INT PRIMARY KEY) ENGINE=InnoDB;
+SET DEBUG_SYNC='before_lock_tables_takes_lock SIGNAL stuck WAIT_FOR go';
+send ALTER TABLE t1 PAGE_COMPRESSED=1, ALGORITHM=INSTANT;
+
+--connect con1,localhost,root
+SET DEBUG_SYNC='now WAIT_FOR stuck';
+SET GLOBAL innodb_file_per_table=1;
+SET DEBUG_SYNC='now SIGNAL go';
+--disconnect con1
+--connection default
+--error ER_ILLEGAL_HA_CREATE_OPTION
+--reap
+DROP TABLE t1;
diff --git a/mysql-test/suite/innodb/t/xa_recovery.test b/mysql-test/suite/innodb/t/xa_recovery.test
index e3479f6fe783d..d649812071946 100644
--- a/mysql-test/suite/innodb/t/xa_recovery.test
+++ b/mysql-test/suite/innodb/t/xa_recovery.test
@@ -31,13 +31,15 @@ connection default;
 disconnect con1;
 disconnect con2;
 connect (con1,localhost,root);
---send SELECT * FROM t1 LOCK IN SHARE MODE
+send
+SET STATEMENT innodb_lock_wait_timeout=1 FOR # work around MDEV-38741
+SELECT * FROM t1 LOCK IN SHARE MODE;
 
 connection default;
 let $wait_condition=
   select count(*) = 1 from information_schema.processlist
   where state = 'Sending data' and
-        info = 'SELECT * FROM t1 LOCK IN SHARE MODE';
+        info LIKE 'SET STATEMENT innodb_lock_wait_timeout%';
 --source include/wait_condition.inc
 
 SET innodb_lock_wait_timeout=1;
diff --git a/mysql-test/suite/innodb_gis/r/alter_spatial_index.result b/mysql-test/suite/innodb_gis/r/alter_spatial_index.result
index 08632b6751426..b8ec214e8aeea 100644
--- a/mysql-test/suite/innodb_gis/r/alter_spatial_index.result
+++ b/mysql-test/suite/innodb_gis/r/alter_spatial_index.result
@@ -140,14 +140,10 @@ tab	1	idx6	1	c4	A	#	10	NULL		BTREE			NO
 SET @g1 = ST_GeomFromText('POLYGON((20 20,30 30,40 40,50 50,40 50,30 40,30 30,20 20))');
 SELECT c1,ST_Astext(c2),ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1);
 c1	ST_Astext(c2)	ST_Astext(c4)
-2	POINT(20 20)	POLYGON((40 50,40 70,50 100,70 100,80 80,70 50,40 50))
-1	POINT(10 10)	POLYGON((30 30,40 40,50 50,30 50,30 40,30 30))
 UPDATE tab SET C2 = ST_GeomFromText('POINT(1000 1000)')
 WHERE ST_Crosses(tab.c4, @g1);
 SELECT c1,ST_Astext(c2),ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1);
 c1	ST_Astext(c2)	ST_Astext(c4)
-2	POINT(1000 1000)	POLYGON((40 50,40 70,50 100,70 100,80 80,70 50,40 50))
-1	POINT(1000 1000)	POLYGON((30 30,40 40,50 50,30 50,30 40,30 30))
 DELETE FROM tab WHERE ST_Crosses(tab.c4, @g1);
 ALTER TABLE tab CHANGE COLUMN c2 c22 POINT NOT NULL;
 affected rows: 0
@@ -232,18 +228,20 @@ DELETE FROM tab WHERE MBREquals(tab.c4, @g1);
 SELECT c1,ST_Astext(c2),ST_Astext(c4) FROM tab WHERE MBREquals(tab.c4, @g1);
 c1	ST_Astext(c2)	ST_Astext(c4)
 ALTER TABLE tab  DROP PRIMARY KEY;
-affected rows: 4
-info: Records: 4  Duplicates: 0  Warnings: 0
+affected rows: 6
+info: Records: 6  Duplicates: 0  Warnings: 0
 ALTER TABLE tab ADD PRIMARY KEY(c2) ;
 affected rows: 0
 info: Records: 0  Duplicates: 0  Warnings: 0
 SET @g1 = ST_GeomFromText( 'POLYGON((0 0,0 30,30 40,40 50,50 30,0 0))');
 SELECT c1,ST_Astext(c2),ST_Astext(c4) FROM tab WHERE ST_Touches(tab.c4, @g1);
 c1	ST_Astext(c2)	ST_Astext(c4)
+2	POINT(20 20)	POLYGON((40 50,40 70,50 100,70 100,80 80,70 50,40 50))
 UPDATE tab SET C2 = ST_GeomFromText('POINT(3000 3000)') 
 WHERE ST_Touches(tab.c4, @g1);
 SELECT c1,ST_Astext(c2),ST_Astext(c4) FROM tab WHERE ST_Touches(tab.c4, @g1);
 c1	ST_Astext(c2)	ST_Astext(c4)
+2	POINT(3000 3000)	POLYGON((40 50,40 70,50 100,70 100,80 80,70 50,40 50))
 DELETE FROM tab WHERE ST_Touches(tab.c4, @g1);
 SELECT c1,ST_Astext(c2),ST_Astext(c4) FROM tab WHERE ST_Touches(tab.c4, @g1);
 c1	ST_Astext(c2)	ST_Astext(c4)
@@ -267,6 +265,7 @@ Table	Op	Msg_type	Msg_text
 test.tab	check	status	OK
 SELECT c1,ST_Astext(c2),ST_Astext(c4) FROM tab ORDER BY c1;
 c1	ST_Astext(c2)	ST_Astext(c4)
+1	POINT(10 10)	POLYGON((30 30,40 40,50 50,30 50,30 40,30 30))
 6	POINT(3 3)	POLYGON((2010 2010,2020 2020,2030 2030,2040 2030,2020 2010,2010 2010))
 7	POINT(60 70)	POLYGON((3010 3010,3020 3020,3030 3030,3040 3030,3020 3010,3010 3010))
 8	POINT(0 0)	POLYGON((3010 3010,3020 3020,3030 3030,3040 3030,3020 3010,3010 3010))
@@ -290,8 +289,8 @@ SELECT c1,ST_Astext(c2),ST_Astext(c4) FROM tab WHERE MBROverlaps(tab.c4, @g1) OR
 c1	ST_Astext(c2)	ST_Astext(c4)
 INSERT INTO tab SELECT * FROM tab1;
 ALTER TABLE tab DROP PRIMARY KEY;
-affected rows: 1
-info: Records: 1  Duplicates: 0  Warnings: 0
+affected rows: 2
+info: Records: 2  Duplicates: 0  Warnings: 0
 SET STATEMENT sql_mode = 'NO_ENGINE_SUBSTITUTION' FOR
 CREATE TEMPORARY TABLE temp_tab AS SELECT * FROM tab where c1 = c2;
 ERROR HY000: Illegal parameter data types int and point for operation '='
diff --git a/mysql-test/suite/innodb_gis/r/create_spatial_index.result b/mysql-test/suite/innodb_gis/r/create_spatial_index.result
index d91947136850b..1ae97a603bc0a 100644
--- a/mysql-test/suite/innodb_gis/r/create_spatial_index.result
+++ b/mysql-test/suite/innodb_gis/r/create_spatial_index.result
@@ -105,7 +105,6 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	tab	range	idx3	idx3	34	NULL	1	Using where; Using filesort
 SELECT c1,ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
-4	POLYGON((300 300,400 400,500 500,300 500,300 400,300 300))
 EXPLAIN UPDATE tab SET C2 = ST_GeomFromText('POINT(0 0)') 
 WHERE ST_Crosses(tab.c4, @g1);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
@@ -119,7 +118,6 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	tab	range	idx3	idx3	34	NULL	1	Using where; Using filesort
 SELECT c1,ST_Astext(c4) FROM tab WHERE  ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
-1	POLYGON((30 30,40 40,50 50,30 50,30 40,30 30))
 EXPLAIN UPDATE tab SET C2 = ST_GeomFromText('POINT(0 0)') 
 WHERE ST_Crosses(tab.c4, @g1);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
@@ -411,7 +409,6 @@ test.tab	check	status	OK
 SET @g1 = ST_GeomFromText('POLYGON((100 200,1010 1010,1020 1020,500 300,300 200,100 300,100 200))');
 SELECT c1,ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
-5	POLYGON((1010 1010,1020 1020,1030 1030,1040 1030,1020 1010,1010 1010))
 DELETE FROM tab WHERE ST_Crosses(tab.c4, @g1);
 SELECT c1,ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
@@ -534,7 +531,6 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	tab	range	idx3	idx3	34	NULL	1	Using where; Using filesort
 SELECT c1,ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
-4	POLYGON((300 300,400 400,500 500,300 500,300 400,300 300))
 EXPLAIN UPDATE tab SET C2 = ST_GeomFromText('POINT(0 0)') 
 WHERE ST_Crosses(tab.c4, @g1);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
@@ -548,7 +544,6 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	tab	range	idx3	idx3	34	NULL	1	Using where; Using filesort
 SELECT c1,ST_Astext(c4) FROM tab WHERE  ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
-1	POLYGON((30 30,40 40,50 50,30 50,30 40,30 30))
 EXPLAIN UPDATE tab SET C2 = ST_GeomFromText('POINT(0 0)') 
 WHERE ST_Crosses(tab.c4, @g1);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
@@ -830,7 +825,6 @@ test.tab	check	status	OK
 SET @g1 = ST_GeomFromText('POLYGON((100 200,200 300,400 500,500 300,300 200,100 300,100 200))');
 SELECT c1,ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
-4	POLYGON((300 300,400 400,500 500,300 500,300 400,300 300))
 DELETE FROM tab WHERE ST_Crosses(tab.c4, @g1);
 SELECT c1,ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
@@ -952,7 +946,6 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	tab	range	idx3	idx3	34	NULL	1	Using where; Using filesort
 SELECT c1,ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
-4	POLYGON((300 300,400 400,500 500,300 500,300 400,300 300))
 EXPLAIN UPDATE tab SET C2 = ST_GeomFromText('POINT(0 0)') 
 WHERE ST_Crosses(tab.c4, @g1);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
@@ -966,7 +959,6 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	tab	range	idx3	idx3	34	NULL	1	Using where; Using filesort
 SELECT c1,ST_Astext(c4) FROM tab WHERE  ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
-1	POLYGON((30 30,40 40,50 50,30 50,30 40,30 30))
 EXPLAIN UPDATE tab SET C2 = ST_GeomFromText('POINT(0 0)') 
 WHERE ST_Crosses(tab.c4, @g1);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
diff --git a/sql/gcalc_slicescan.cc b/sql/gcalc_slicescan.cc
index 662783ea4ea26..b0d41e9dc0596 100644
--- a/sql/gcalc_slicescan.cc
+++ b/sql/gcalc_slicescan.cc
@@ -902,14 +902,18 @@ static Gcalc_heap::Info *new_eq_point(
 }
 
 
-void Gcalc_heap::Info::calc_xy(double *x, double *y) const
+void Gcalc_heap::Info::calc_intersection_xy(double *x, double *y) const
 {
+  GCALC_DBUG_ASSERT(type == nt_intersection);
   double b0_x= node.intersection.p2->node.shape.x - node.intersection.p1->node.shape.x;
   double b0_y= node.intersection.p2->node.shape.y - node.intersection.p1->node.shape.y;
   double b1_x= node.intersection.p4->node.shape.x - node.intersection.p3->node.shape.x;
   double b1_y= node.intersection.p4->node.shape.y - node.intersection.p3->node.shape.y;
   double b0xb1= b0_x * b1_y - b0_y * b1_x;
-  double t= (node.intersection.p3->node.shape.x - node.intersection.p1->node.shape.x) * b1_y - (node.intersection.p3->node.shape.y - node.intersection.p1->node.shape.y) * b1_x;
+  double t=(node.intersection.p3->node.shape.x -
+               node.intersection.p1->node.shape.x) * b1_y -
+            (node.intersection.p3->node.shape.y -
+               node.intersection.p1->node.shape.y) * b1_x;
 
   t/= b0xb1;
 
@@ -918,6 +922,19 @@ void Gcalc_heap::Info::calc_xy(double *x, double *y) const
 }
 
 
+void Gcalc_heap::Info::get_xy(double *x, double *y) const
+{
+  if (type == nt_intersection)
+    calc_intersection_xy(x, y);
+  else
+  {
+    GCALC_DBUG_ASSERT(type == nt_shape_node);
+    *x= node.shape.x;
+    *y= node.shape.y;
+  }
+}
+
+
 #ifdef GCALC_CHECK_WITH_FLOAT
 void Gcalc_heap::Info::calc_xy_ld(long double *x, long double *y) const
 {
@@ -1925,7 +1942,8 @@ double Gcalc_scan_iterator::get_y() const
     Gcalc_coord2 t_a, t_b;
     Gcalc_coord3 a_tb, b_ta, y_exp;
     calc_t(t_a, t_b, dxa, dya,
-           state.pi->node.intersection.p1, state.pi->node.intersection.p2, state.pi->node.intersection.p3, state.pi->node.intersection.p4);
+           state.pi->node.intersection.p1, state.pi->node.intersection.p2,
+           state.pi->node.intersection.p3, state.pi->node.intersection.p4);
 
 
     gcalc_mul_coord(a_tb, GCALC_COORD_BASE3,
@@ -1971,14 +1989,12 @@ double Gcalc_scan_iterator::get_event_x() const
 double Gcalc_scan_iterator::get_h() const
 {
   double cur_y= get_y();
-  double next_y;
-  if (state.pi->type == Gcalc_heap::nt_intersection)
-  {
-    double x;
-    state.pi->calc_xy(&x, &next_y);
-  }
-  else
-    next_y= state.pi->next ? state.pi->get_next()->node.shape.y : 0.0;
+  double x, next_y;
+
+  GCALC_DBUG_ASSERT(m_cur_pi);
+
+  m_cur_pi->get_xy(&x, &next_y);
+
   return next_y - cur_y;
 }
 
diff --git a/sql/gcalc_slicescan.h b/sql/gcalc_slicescan.h
index 37e887e87e5a3..48f5cf345ded0 100644
--- a/sql/gcalc_slicescan.h
+++ b/sql/gcalc_slicescan.h
@@ -216,7 +216,8 @@ class Gcalc_heap : public Gcalc_dyn_list
     bool is_single_node() const
       { return is_bottom() && is_top(); }
 
-    void calc_xy(double *x, double *y) const;
+    void calc_intersection_xy(double *x, double *y) const;
+    void get_xy(double *x, double *y) const;
     int equal_pi(const Info *pi) const;
 #ifdef GCALC_CHECK_WITH_FLOAT
     void calc_xy_ld(long double *x, long double *y) const;
diff --git a/sql/gcalc_tools.cc b/sql/gcalc_tools.cc
index 62c42f087a038..3d6a574b28a74 100644
--- a/sql/gcalc_tools.cc
+++ b/sql/gcalc_tools.cc
@@ -1285,7 +1285,7 @@ inline int Gcalc_operation_reducer::get_single_result(res_point *res,
   if (res->intersection_point)
   {
     double x, y;
-    res->pi->calc_xy(&x, &y);
+    res->pi->calc_intersection_xy(&x, &y);
     if (storage->single_point(x,y))
       GCALC_DBUG_RETURN(1);
   }
@@ -1312,7 +1312,7 @@ int Gcalc_operation_reducer::get_result_thread(res_point *cur,
     {
       if (cur->intersection_point)
       {
-        cur->pi->calc_xy(&x, &y);
+        cur->pi->calc_intersection_xy(&x, &y);
       }
       else
       {
diff --git a/sql/handler.cc b/sql/handler.cc
index 67ccb31e4f9f7..a2508d75fb945 100644
--- a/sql/handler.cc
+++ b/sql/handler.cc
@@ -5519,11 +5519,14 @@ Alter_inplace_info::Alter_inplace_info(HA_CREATE_INFO *create_info_arg,
     : create_info(create_info_arg),
     alter_info(alter_info_arg),
     key_info_buffer(key_info_arg),
-    key_count(key_count_arg),
-    rename_keys(current_thd->mem_root),
     modified_part_info(modified_part_info_arg),
+    rename_keys(current_thd->mem_root),
+    key_count(key_count_arg),
+    online(false),
+    file_per_table(false),
     ignore(ignore_arg),
-    error_if_not_empty(error_non_empty)
+    error_if_not_empty(error_non_empty),
+    mdl_exclusive_after_prepare(false)
   {}
 
 void Alter_inplace_info::report_unsupported_error(const char *not_supported,
diff --git a/sql/handler.h b/sql/handler.h
index c6071bce85ae2..7dcb8bbe68070 100644
--- a/sql/handler.h
+++ b/sql/handler.h
@@ -2547,21 +2547,12 @@ class Alter_inplace_info
   */
   KEY  *key_info_buffer;
 
-  /** Size of key_info_buffer array. */
-  uint key_count;
-
-  /** Size of index_drop_buffer array. */
-  uint index_drop_count= 0;
-
   /**
      Array of pointers to KEYs to be dropped belonging to the TABLE instance
      for the old version of the table.
   */
   KEY  **index_drop_buffer= nullptr;
 
-  /** Size of index_add_buffer array. */
-  uint index_add_count= 0;
-
   /**
      Array of indexes into key_info_buffer for KEYs to be added,
      sorted in increasing order.
@@ -2570,32 +2561,6 @@ class Alter_inplace_info
 
   KEY_PAIR  *index_altered_ignorability_buffer= nullptr;
 
-  /** Size of index_altered_ignorability_buffer array. */
-  uint index_altered_ignorability_count= 0;
-
-  /**
-     Old and new index names. Used for index rename.
-  */
-  struct Rename_key_pair
-  {
-    Rename_key_pair(const KEY *old_key, const KEY *new_key)
-        : old_key(old_key), new_key(new_key)
-    {
-    }
-    const KEY *old_key;
-    const KEY *new_key;
-  };
-  /**
-     Vector of key pairs from DROP/ADD index which can be renamed.
-  */
-  typedef Mem_root_array<Rename_key_pair, true> Rename_keys_vector;
-
-  /**
-     A list of indexes which should be renamed.
-     Index definitions stays the same.
-  */
-  Rename_keys_vector rename_keys;
-
   /**
      Context information to allow handlers to keep context between in-place
      alter API calls.
@@ -2622,9 +2587,6 @@ class Alter_inplace_info
   */
   alter_table_operations handler_flags= 0;
 
-  /* Alter operations involving parititons are strored here */
-  ulong partition_flags;
-
   /**
      Partition_info taking into account the partition changes to be performed.
      Contains all partitions which are present in the old version of the table
@@ -2633,12 +2595,6 @@ class Alter_inplace_info
   */
   partition_info * const modified_part_info;
 
-  /** true for ALTER IGNORE TABLE ... */
-  const bool ignore;
-
-  /** true for online operation (LOCK=NONE) */
-  bool online= false;
-
   /**
     When ha_commit_inplace_alter_table() is called the the engine can
     set this to a function to be called after the ddl log
@@ -2650,9 +2606,6 @@ class Alter_inplace_info
   /* This will be used as the argument to the above function when called */
   void *inplace_alter_table_committed_argument= nullptr;
 
-  /** which ALGORITHM and LOCK are supported by the storage engine */
-  enum_alter_inplace_result inplace_supported;
-
   /**
      Can be set by handler to describe why a given operation cannot be done
      in-place (HA_ALTER_INPLACE_NOT_SUPPORTED) or why it cannot be done
@@ -2667,11 +2620,57 @@ class Alter_inplace_info
   */
   const char *unsupported_reason= nullptr;
 
-  /** true when InnoDB should abort the alter when table is not empty */
-  const bool error_if_not_empty;
+  /* Alter operations involving parititons are strored here */
+  ulong partition_flags;
+
+  /**
+     Old and new index names. Used for index rename.
+  */
+  struct Rename_key_pair
+  {
+    Rename_key_pair(const KEY *old_key, const KEY *new_key)
+        : old_key(old_key), new_key(new_key)
+    {
+    }
+    const KEY *old_key;
+    const KEY *new_key;
+  };
+  /**
+     Vector of key pairs from DROP/ADD index which can be renamed.
+  */
+  typedef Mem_root_array<Rename_key_pair, true> Rename_keys_vector;
+
+  /**
+     A list of indexes which should be renamed.
+     Index definitions stays the same.
+  */
+  Rename_keys_vector rename_keys;
+
+  /** Size of key_info_buffer array. */
+  uint key_count;
+
+  /** Size of index_drop_buffer array. */
+  uint index_drop_count= 0;
 
+  /** Size of index_add_buffer array. */
+  uint index_add_count= 0;
+
+  /** Size of index_altered_ignorability_buffer array. */
+  uint index_altered_ignorability_count= 0;
+
+  /** which ALGORITHM and LOCK are supported by the storage engine */
+  enum_alter_inplace_result inplace_supported;
+
+  /** TRUE for online operation (LOCK=NONE) */
+  unsigned online : 1;
+  /** TRUE when innodb_file_per_table is set */
+  unsigned file_per_table : 1;
+  /** TRUE for ALTER IGNORE TABLE ... */
+  unsigned ignore : 1;
+  /** true when InnoDB should abort the alter when table is not empty */
+  unsigned error_if_not_empty : 1;
   /** True when DDL should avoid downgrading the MDL */
-  bool mdl_exclusive_after_prepare= false;
+  unsigned mdl_exclusive_after_prepare : 1;
 
   Alter_inplace_info(HA_CREATE_INFO *create_info_arg,
                      Alter_info *alter_info_arg,
diff --git a/sql/item_geofunc.cc b/sql/item_geofunc.cc
index 8e7d50b1aab56..c0b833becfd77 100644
--- a/sql/item_geofunc.cc
+++ b/sql/item_geofunc.cc
@@ -1367,6 +1367,8 @@ class Geometry_ptr_with_buffer_and_mbr
   }
   int store_shapes(Gcalc_shape_transporter *trn) const
   { return geom->store_shapes(trn); }
+  int shape_type() const
+  { return geom->get_class_info()->m_type_id; }
 };
 
 
@@ -1467,8 +1469,17 @@ bool Item_func_spatial_precise_rel::val_bool()
                          Gcalc_function::op_intersection, 2);
       null_value= g1.store_shapes(&trn) || g2.store_shapes(&trn);
       break;
-    case SP_OVERLAPS_FUNC:
     case SP_CROSSES_FUNC:
+      if (g1.shape_type() == Geometry::wkb_polygon ||
+          g1.shape_type() == Geometry::wkb_multipolygon ||
+          g2.shape_type() == Geometry::wkb_point ||
+          g2.shape_type() == Geometry::wkb_multipoint)
+      {
+        null_value= 1;
+        break;
+      }
+      /* fall through */
+    case SP_OVERLAPS_FUNC:
       func.add_operation(Gcalc_function::op_intersection, 2);
       if (func.reserve_op_buffer(3))
         break;
@@ -2665,6 +2676,16 @@ double Item_func_sphere_distance::spherical_distance_points(Geometry *g1,
 }
 
 
+static double count_h_x(double x1, double y1, double x2, double y2, double h)
+{
+  double dy= y2 - y1;
+  double dx= x2 - x1;
+  double dh= h - y1;
+
+  return x1 + dx * dh / dy;
+}
+
+
 String *Item_func_pointonsurface::val_str(String *str)
 {
   Gcalc_operation_transporter trn(&func, &collector);
@@ -2673,7 +2694,7 @@ String *Item_func_pointonsurface::val_str(String *str)
   Geometry *g;
   MBR mbr;
   const char *c_end;
-  double UNINIT_VAR(px), UNINIT_VAR(py), x0, UNINIT_VAR(y0);
+  double UNINIT_VAR(px), UNINIT_VAR(py);
   String *result= 0;
   const Gcalc_scan_iterator::point *pprev= NULL;
   uint32 srid;
@@ -2696,54 +2717,54 @@ String *Item_func_pointonsurface::val_str(String *str)
 
   while (scan_it.more_points())
   {
+    double h;
+
     if (scan_it.step())
       goto mem_error;
 
-    if (scan_it.get_h() > GIS_ZERO)
-    {
-      y0= scan_it.get_y();
-      break;
-    }
-  }
+    if (!scan_it.more_points())
+      goto exit;
 
-  if (!scan_it.more_points())
-  {
-    goto exit;
-  }
+    if ((h= scan_it.get_h()) <= GIS_ZERO)
+      continue;
 
-  if (scan_it.step())
-    goto mem_error;
+    py= scan_it.get_y() + h/2.0;
 
-  for (Gcalc_point_iterator pit(&scan_it); pit.point(); ++pit)
-  {
-    if (pprev == NULL)
+    for (Gcalc_point_iterator pit(&scan_it); pit.point(); ++pit)
     {
-      pprev= pit.point();
-      continue;
-    }
-    x0= scan_it.get_sp_x(pprev);
-    px= scan_it.get_sp_x(pit.point());
-    if (px - x0 > GIS_ZERO)
-    {
-      if (scan_it.get_h() > GIS_ZERO)
+      const Gcalc_scan_iterator::point *p= pit.point();
+      double x1, y1, x2, y2, xa, xb;
+
+      if (pprev == NULL)
       {
-        px= (px + x0) / 2.0;
-        py= scan_it.get_y();
+        pprev= pit.point();
+        continue;
       }
-      else
+
+      pprev->pi->get_xy(&x1, &y1);
+      pprev->next_pi->get_xy(&x2, &y2);
+
+      xa= count_h_x(x1, y1, x2, y2, py);
+
+      p->pi->get_xy(&x1, &y1);
+      p->next_pi->get_xy(&x2, &y2);
+      xb= count_h_x(x1, y1, x2, y2, py);
+
+      if (xb - xa > GIS_ZERO)
       {
-        px= (px + x0) / 2.0;
-        py= (y0 + scan_it.get_y()) / 2.0;
+        px= (xa + xb) / 2.0;
+        null_value= 0;
+        goto point_found;
       }
-      null_value= 0;
-      break;
+
+      pprev= NULL;
     }
-    pprev= NULL;
   }
 
   if (null_value)
     goto exit;
 
+point_found:
   str->set_charset(&my_charset_bin);
   str->length(0);
   if (str->reserve(SRID_SIZE, 512))
diff --git a/sql/log.cc b/sql/log.cc
index 962557ad769a4..5c1ba8833a2ac 100644
--- a/sql/log.cc
+++ b/sql/log.cc
@@ -3550,7 +3550,9 @@ MYSQL_BIN_LOG::MYSQL_BIN_LOG(uint *sync_period)
    is_relay_log(0), relay_signal_cnt(0),
    checksum_alg_reset(BINLOG_CHECKSUM_ALG_UNDEF),
    relay_log_checksum_alg(BINLOG_CHECKSUM_ALG_UNDEF),
-   description_event_for_exec(0), description_event_for_queue(0),
+   description_event_for_sql_thread
+
+(0), description_event_for_queue(0),
    current_binlog_id(0), reset_master_count(0)
 {
   /*
@@ -3598,7 +3600,9 @@ void MYSQL_BIN_LOG::cleanup()
     close(LOG_CLOSE_INDEX|LOG_CLOSE_STOP_EVENT);
     mysql_mutex_unlock(&LOCK_log);
     delete description_event_for_queue;
-    delete description_event_for_exec;
+    delete description_event_for_sql_thread
+
+;
 
     while ((b= binlog_xid_count_list.get()))
     {
diff --git a/sql/log.h b/sql/log.h
index 130b701378d9a..0405e195093cd 100644
--- a/sql/log.h
+++ b/sql/log.h
@@ -676,7 +676,8 @@ class MYSQL_BIN_LOG: public TC_LOG, private MYSQL_LOG
     the case of a master which has been upgraded from 5.0 to 5.1 without doing
     RESET MASTER, or from 4.x to 5.0).
   */
-  Format_description_log_event *description_event_for_exec,
+  Format_description_log_event *description_event_for_sql_thread
+,
     *description_event_for_queue;
   /*
     Binlog position of last commit (or non-transactional write) to the binlog.
diff --git a/sql/log_event_server.cc b/sql/log_event_server.cc
index 3700cb55ac0a4..a35b68b01d885 100644
--- a/sql/log_event_server.cc
+++ b/sql/log_event_server.cc
@@ -2331,7 +2331,9 @@ int Start_log_event_v3::do_apply_event(rpl_group_info *rgi)
        thread.
     */
   case 1:
-    if (strncmp(rli->relay_log.description_event_for_exec->server_version,
+    if (strncmp(rli->relay_log.description_event_for_sql_thread
+
+->server_version,
                 "3.23.57",7) >= 0 && created)
     {
       /*
@@ -2474,9 +2476,15 @@ int Format_description_log_event::do_apply_event(rpl_group_info *rgi)
   if (!ret)
   {
     /* Save the information describing this binlog */
-    copy_crypto_data(rli->relay_log.description_event_for_exec);
-    delete rli->relay_log.description_event_for_exec;
-    rli->relay_log.description_event_for_exec= this;
+    copy_crypto_data(rli->relay_log.description_event_for_sql_thread
+
+);
+    delete rli->relay_log.description_event_for_sql_thread
+
+;
+    rli->relay_log.description_event_for_sql_thread
+
+= this;
   }
 
   DBUG_RETURN(ret);
@@ -2520,7 +2528,9 @@ Format_description_log_event::do_shall_skip(rpl_group_info *rgi)
 #if defined(HAVE_REPLICATION)
 int Start_encryption_log_event::do_apply_event(rpl_group_info* rgi)
 {
-  return rgi->rli->relay_log.description_event_for_exec->start_decryption(this);
+  return rgi->rli->relay_log.description_event_for_sql_thread
+
+->start_decryption(this);
 }
 
 int Start_encryption_log_event::do_update_pos(rpl_group_info *rgi)
@@ -3216,7 +3226,9 @@ int Rotate_log_event::do_update_pos(rpl_group_info *rgi)
     /*
       Reset thd->variables.option_bits and sql_mode etc, because this could
       be the signal of a master's downgrade from 5.0 to 4.0.
-      However, no need to reset description_event_for_exec: indeed, if the next
+      However, no need to reset description_event_for_sql_thread
+
+: indeed, if the next
       master is 5.0 (even 5.0.1) we will soon get a Format_desc; if the next
       master is 4.0 then the events are in the slave's format (conversion).
     */
@@ -5064,7 +5076,9 @@ int Execute_load_log_event::do_apply_event(rpl_group_info *rgi)
   }
   if (!(lev= (Load_log_event*)
         Log_event::read_log_event(&file, &read_error,
-                                  rli->relay_log.description_event_for_exec,
+                                  rli->relay_log.description_event_for_sql_thread
+
+,
                                   opt_slave_sql_verify_checksum)) ||
       lev->get_type_code() != NEW_LOAD_EVENT)
   {
diff --git a/sql/rpl_rli.cc b/sql/rpl_rli.cc
index 97d70decb2e9f..ab5ec23b0b6c9 100644
--- a/sql/rpl_rli.cc
+++ b/sql/rpl_rli.cc
@@ -664,14 +664,18 @@ int init_relay_log_pos(Relay_log_info* rli,const char* log,
     the description_event here, in case, so that there is no memory leak in
     running, say, CHANGE MASTER.
   */
-  delete rli->relay_log.description_event_for_exec;
+  delete rli->relay_log.description_event_for_sql_thread
+
+;
   /*
     By default the relay log is in binlog format 3 (4.0).
     Even if format is 4, this will work enough to read the first event
     (Format_desc) (remember that format 4 is just lenghtened compared to format
     3; format 3 is a prefix of format 4).
   */
-  rli->relay_log.description_event_for_exec= new
+  rli->relay_log.description_event_for_sql_thread
+
+= new
     Format_description_log_event(3);
 
   mysql_mutex_lock(log_lock);
@@ -738,8 +742,12 @@ int init_relay_log_pos(Relay_log_info* rli,const char* log,
       Format_description_log_event *fdev;
       if (!(fdev= read_relay_log_description_event(rli->cur_log, pos, errmsg)))
         goto err;
-      delete rli->relay_log.description_event_for_exec;
-      rli->relay_log.description_event_for_exec= fdev;
+      delete rli->relay_log.description_event_for_sql_thread
+
+;
+      rli->relay_log.description_event_for_sql_thread
+
+= fdev;
     }
     my_b_seek(rli->cur_log,(off_t)pos);
     DBUG_PRINT("info", ("my_b_tell(rli->cur_log)=%llu rli->event_relay_log_pos=%llu",
@@ -760,7 +768,9 @@ int init_relay_log_pos(Relay_log_info* rli,const char* log,
 
   if (need_data_lock)
     mysql_mutex_unlock(&rli->data_lock);
-  if (!rli->relay_log.description_event_for_exec->is_valid() && !*errmsg)
+  if (!rli->relay_log.description_event_for_sql_thread
+
+->is_valid() && !*errmsg)
     *errmsg= "Invalid Format_description log event; could be out of memory";
 
   DBUG_PRINT("info", ("Returning %d from init_relay_log_pos", (*errmsg)?1:0));
diff --git a/sql/slave.cc b/sql/slave.cc
index de1476e592542..11ee7abb592e8 100644
--- a/sql/slave.cc
+++ b/sql/slave.cc
@@ -5893,8 +5893,12 @@ pthread_handler_t handle_slave_sql(void *arg)
   /* When master_pos_wait() wakes up it will check this and terminate */
   rli->slave_running= MYSQL_SLAVE_NOT_RUN;
   /* Forget the relay log's format */
-  delete rli->relay_log.description_event_for_exec;
-  rli->relay_log.description_event_for_exec= 0;
+  delete rli->relay_log.description_event_for_sql_thread
+
+;
+  rli->relay_log.description_event_for_sql_thread
+
+= 0;
   rli->reset_inuse_relaylog();
   /* Wake up master_pos_wait() */
   DBUG_PRINT("info",("Signaling possibly waiting master_pos_wait() functions"));
@@ -7849,7 +7853,9 @@ static Log_event* next_event(rpl_group_info *rgi, ulonglong *event_size)
     old_pos= rli->event_relay_log_pos;
     int error;
     if ((ev= Log_event::read_log_event(cur_log, &error,
-                                       rli->relay_log.description_event_for_exec,
+                                       rli->relay_log.description_event_for_sql_thread
+
+,
                                        opt_slave_sql_verify_checksum)))
 
     {
@@ -8037,7 +8043,9 @@ static Log_event* next_event(rpl_group_info *rgi, ulonglong *event_size)
       mysql_file_close(rli->cur_log_fd, MYF(MY_WME));
       rli->cur_log_fd = -1;
       rli->last_inuse_relaylog->completed= true;
-      rli->relay_log.description_event_for_exec->reset_crypto();
+      rli->relay_log.description_event_for_sql_thread
+
+->reset_crypto();
 
       if (relay_log_purge)
       {
@@ -8365,7 +8373,9 @@ bool rpl_master_has_bug(const Relay_log_info *rli, uint bug_id, bool report,
     {29621, { 10, 11,1  }, { 10, 11,3  } },
   };
   const Version &master_ver=
-    rli->relay_log.description_event_for_exec->server_version_split;
+    rli->relay_log.description_event_for_sql_thread
+
+->server_version_split;
   struct st_version_range_for_one_bug* versions_for_all_bugs= maria_master ?
     versions_for_our_bugs : versions_for_their_bugs;
   uint all_size= maria_master ?
@@ -8408,7 +8418,9 @@ bool rpl_master_has_bug(const Relay_log_info *rli, uint bug_id, bool report,
                       " that master be upgraded to a version at least"
                       " equal to '%d.%d.%d'. Then replication can be"
                       " restarted.",
-                      rli->relay_log.description_event_for_exec->server_version,
+                      rli->relay_log.description_event_for_sql_thread
+
+->server_version,
                       bug_source,
                       bug_id,
                       fixed_in[0], fixed_in[1], fixed_in[2]);
diff --git a/sql/sql_binlog.cc b/sql/sql_binlog.cc
index 63fe62d8a19d6..a22cda01b161d 100644
--- a/sql/sql_binlog.cc
+++ b/sql/sql_binlog.cc
@@ -33,7 +33,9 @@
 static int check_event_type(int type, Relay_log_info *rli)
 {
   Format_description_log_event *fd_event=
-    rli->relay_log.description_event_for_exec;
+    rli->relay_log.description_event_for_sql_thread
+
+;
 
   /*
     Convert event type id of certain old versions (see comment in
@@ -60,7 +62,9 @@ static int check_event_type(int type, Relay_log_info *rli)
       if we don't already have one.
     */
     if (!fd_event)
-      if (!(rli->relay_log.description_event_for_exec=
+      if (!(rli->relay_log.description_event_for_sql_thread
+
+=
             new Format_description_log_event(4)))
       {
         my_error(ER_OUTOFMEMORY, MYF(0), 1);
@@ -176,7 +180,9 @@ int binlog_defragment(THD *thd)
   BINLOG statement seen must be a base64 encoding of the
   Format_description_log_event, as outputted by mysqlbinlog.  This
   Format_description_log_event is cached in
-  rli->description_event_for_exec.
+  rli->description_event_for_sql_thread
+
+.
 
   @param thd Pointer to THD object for the client thread executing the
   statement.
@@ -319,7 +325,9 @@ void mysql_client_binlog_statement(THD* thd)
         goto end;
 
       ev= Log_event::read_log_event(bufptr, event_len, &error,
-                                    rli->relay_log.description_event_for_exec,
+                                    rli->relay_log.description_event_for_sql_thread
+
+,
                                     0);
 
       DBUG_PRINT("info",("binlog base64 err=%s", error));
diff --git a/sql/wsrep_applier.cc b/sql/wsrep_applier.cc
index 4ce644c52f79f..394cf4c08848a 100644
--- a/sql/wsrep_applier.cc
+++ b/sql/wsrep_applier.cc
@@ -80,7 +80,9 @@ wsrep_get_apply_format(THD* thd)
 
   DBUG_ASSERT(thd->wsrep_rgi);
 
-  return thd->wsrep_rgi->rli->relay_log.description_event_for_exec;
+  return thd->wsrep_rgi->rli->relay_log.description_event_for_sql_thread
+
+;
 }
 
 /* store error from rli */
diff --git a/sql/wsrep_high_priority_service.cc b/sql/wsrep_high_priority_service.cc
index ce3459db08e0e..39d283a310b72 100644
--- a/sql/wsrep_high_priority_service.cc
+++ b/sql/wsrep_high_priority_service.cc
@@ -67,9 +67,13 @@ static rpl_group_info* wsrep_relay_group_init(THD* thd, const char* log_fname)
 {
   Relay_log_info* rli= new Relay_log_info(false);
 
-  if (!rli->relay_log.description_event_for_exec)
+  if (!rli->relay_log.description_event_for_sql_thread
+
+)
   {
-    rli->relay_log.description_event_for_exec=
+    rli->relay_log.description_event_for_sql_thread
+
+=
       new Format_description_log_event(4);
   }
 
diff --git a/storage/innobase/handler/handler0alter.cc b/storage/innobase/handler/handler0alter.cc
index 43ea8c1466d19..48e0dcdf656e8 100644
--- a/storage/innobase/handler/handler0alter.cc
+++ b/storage/innobase/handler/handler0alter.cc
@@ -2227,6 +2227,8 @@ ha_innobase::check_if_supported_inplace_alter(
 {
 	DBUG_ENTER("check_if_supported_inplace_alter");
 
+	ha_alter_info->file_per_table= !!srv_file_per_table;
+
 	if ((ha_alter_info->handler_flags
 	     & INNOBASE_ALTER_VERSIONED_REBUILD)
 	    && altered_table->versioned(VERS_TIMESTAMP)) {
@@ -2341,7 +2343,8 @@ ha_innobase::check_if_supported_inplace_alter(
 
 	switch (ha_alter_info->handler_flags & ~INNOBASE_INPLACE_IGNORE) {
 	case ALTER_OPTIONS:
-		if ((srv_file_per_table && !m_prebuilt->table->space_id)
+		if ((ha_alter_info->file_per_table &&
+		     !m_prebuilt->table->space_id)
 		    || alter_options_need_rebuild(ha_alter_info, table)) {
 			reason_rebuild = my_get_err_msg(
 				ER_ALTER_OPERATION_TABLE_OPTIONS_NEED_REBUILD);
@@ -6600,7 +6603,7 @@ prepare_inplace_alter_table_dict(
 
 	create_table_info_t info(ctx->prebuilt->trx->mysql_thd, altered_table,
 				 ha_alter_info->create_info, NULL, NULL,
-				 srv_file_per_table);
+				 ha_alter_info->file_per_table);
 
 	/* The primary index would be rebuilt if a FTS Doc ID
 	column is to be added, and the primary index definition
@@ -8030,7 +8033,7 @@ ha_innobase::prepare_inplace_alter_table(
 				     ha_alter_info->create_info,
 				     NULL,
 				     NULL,
-				     srv_file_per_table);
+				     ha_alter_info->file_per_table);
 
 	info.set_tablespace_type(indexed_table->space != fil_system.sys_space);
 
diff --git a/storage/mroonga/ha_mroonga.cpp b/storage/mroonga/ha_mroonga.cpp
index 3a85eaf18cd50..5db9aa0b5847d 100644
--- a/storage/mroonga/ha_mroonga.cpp
+++ b/storage/mroonga/ha_mroonga.cpp
@@ -938,6 +938,12 @@ static void mrn_default_tokenizer_update(THD *thd, struct st_mysql_sys_var *var,
   char **old_value_ptr = (char **)var_ptr;
   grn_ctx *ctx = &mrn_ctx;
 
+  if(!new_value) {
+    new_value = "off";
+#ifndef MRN_NEED_FREE_STRING_MEMALLOC_PLUGIN_VAR
+    new_value = mrn_my_strdup(new_value, MYF(MY_WME));
+#endif
+  }
   mrn_change_encoding(ctx, system_charset_info);
   if (strcmp(*old_value_ptr, new_value) == 0) {
     GRN_LOG(ctx, GRN_LOG_NOTICE,
diff --git a/storage/mroonga/mysql-test/mroonga/storage/r/variable_default_tokenizer_disable.result b/storage/mroonga/mysql-test/mroonga/storage/r/variable_default_tokenizer_disable.result
new file mode 100644
index 0000000000000..45f1c7adddf39
--- /dev/null
+++ b/storage/mroonga/mysql-test/mroonga/storage/r/variable_default_tokenizer_disable.result
@@ -0,0 +1,5 @@
+SET GLOBAL mroonga_default_tokenizer = NULL;
+SHOW GLOBAL VARIABLES LIKE 'mroonga_default_tokenizer';
+Variable_name	Value
+mroonga_default_tokenizer	off
+SET GLOBAL mroonga_default_tokenizer = DEFAULT;
diff --git a/storage/mroonga/mysql-test/mroonga/storage/t/variable_default_tokenizer_disable.test b/storage/mroonga/mysql-test/mroonga/storage/t/variable_default_tokenizer_disable.test
new file mode 100644
index 0000000000000..63df372f3faae
--- /dev/null
+++ b/storage/mroonga/mysql-test/mroonga/storage/t/variable_default_tokenizer_disable.test
@@ -0,0 +1,25 @@
+# -*- mode: sql; sql-product: mysql -*-
+#
+# Copyright (C) 2026  hadeer <hadderramadan7@gmail.com>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+--source include/not_embedded.inc
+--source ../../include/mroonga/have_mroonga.inc
+
+SET GLOBAL mroonga_default_tokenizer = NULL;
+SHOW GLOBAL VARIABLES LIKE 'mroonga_default_tokenizer';
+SET GLOBAL mroonga_default_tokenizer = DEFAULT;
+
+--source ../../include/mroonga/have_mroonga_deinit.inc
diff --git a/storage/spider/mysql-test/spider/bugfix/r/xa_cmd.result b/storage/spider/mysql-test/spider/bugfix/r/xa_cmd.result
index 5a560ce25d181..fb5dcc76f86bf 100644
--- a/storage/spider/mysql-test/spider/bugfix/r/xa_cmd.result
+++ b/storage/spider/mysql-test/spider/bugfix/r/xa_cmd.result
@@ -34,6 +34,14 @@ INSERT INTO tbl_a (pkey) VALUES (0),(1),(2),(3),(4),(5),(6),(7),(8),(9);
 XA END 'test';
 XA PREPARE 'test';
 XA COMMIT 'test';
+# MDEV-35426 Stack smashing in spider_db_mbase::xa_end (opt), ASAN: stack-
+#  buffer-overflow in Binary_string::q_append, and Assertion
+#  `str.alloced_length() >= str.length() + data_len' failed in
+#  spider_string::q_append on SELECT.
+XA START 'xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc1','xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc2',1234567890;
+INSERT INTO tbl_a (pkey) VALUES (10);
+XA END 'xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc1','xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc2',1234567890;
+XA ROLLBACK 'xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc1','xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc2',1234567890;
 # MDEV-37829 XA COMMIT ONE PHASE fails with "This xid does not
 # exist" if a trigger references a SPIDER table
 #
@@ -103,6 +111,7 @@ connection child2_1;
 SELECT argument FROM mysql.general_log WHERE command_type != 'Execute' AND argument LIKE '%insert %';
 argument
 insert into `auto_test_remote`.`tbl_a`(`pkey`)values(0),(1),(2),(3),(4),(5),(6),(7),(8),(9)
+insert into `auto_test_remote`.`tbl_a`(`pkey`)values(10)
 insert into `auto_test_remote`.`tbl_a`(`pkey`)values(100)
 insert high_priority into `auto_test_remote`.`tbl_a`(`pkey`)values(101)
 insert high_priority into `auto_test_remote`.`tbl_a`(`pkey`)values(102)
diff --git a/storage/spider/mysql-test/spider/bugfix/t/xa_cmd.test b/storage/spider/mysql-test/spider/bugfix/t/xa_cmd.test
index 5a44ab5e01bfe..b0116fdbeaced 100644
--- a/storage/spider/mysql-test/spider/bugfix/t/xa_cmd.test
+++ b/storage/spider/mysql-test/spider/bugfix/t/xa_cmd.test
@@ -48,6 +48,16 @@ XA END 'test';
 XA PREPARE 'test';
 XA COMMIT 'test';
 
+--echo # MDEV-35426 Stack smashing in spider_db_mbase::xa_end (opt), ASAN: stack-
+--echo #  buffer-overflow in Binary_string::q_append, and Assertion
+--echo #  `str.alloced_length() >= str.length() + data_len' failed in
+--echo #  spider_string::q_append on SELECT.
+
+XA START 'xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc1','xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc2',1234567890;
+INSERT INTO tbl_a (pkey) VALUES (10);
+XA END 'xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc1','xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc2',1234567890;
+XA ROLLBACK 'xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc1','xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc2',1234567890;
+
 --echo # MDEV-37829 XA COMMIT ONE PHASE fails with "This xid does not
 --echo # exist" if a trigger references a SPIDER table
 --echo #
diff --git a/storage/spider/spd_db_conn.cc b/storage/spider/spd_db_conn.cc
index 79cafaa8f304b..86c0e6f8ac15d 100644
--- a/storage/spider/spd_db_conn.cc
+++ b/storage/spider/spd_db_conn.cc
@@ -48,8 +48,6 @@ extern SPIDER_DBTON spider_dbton[SPIDER_DBTON_SIZE];
 
 #define SPIDER_SQL_COALESCE_STR "coalesce("
 #define SPIDER_SQL_COALESCE_LEN (sizeof(SPIDER_SQL_COALESCE_STR) - 1)
-#define SPIDER_SQL_HEX_STR "0x"
-#define SPIDER_SQL_HEX_LEN (sizeof(SPIDER_SQL_HEX_STR) - 1)
 
 #define SPIDER_SQL_SET_NAMES_STR "set names "
 #define SPIDER_SQL_SET_NAMES_LEN sizeof(SPIDER_SQL_SET_NAMES_STR) - 1
@@ -1130,7 +1128,7 @@ void spider_db_append_xid_str(
   spider_string *tmp_str,
   XID *xid
 ) {
-  char format_id[sizeof(long) + 3];
+  char format_id[3*sizeof(long) + 3];
   uint format_id_length;
   DBUG_ENTER("spider_db_append_xid_str");
 
diff --git a/storage/spider/spd_db_conn.h b/storage/spider/spd_db_conn.h
index eb0a55e628845..e8448a75631f4 100644
--- a/storage/spider/spd_db_conn.h
+++ b/storage/spider/spd_db_conn.h
@@ -24,6 +24,8 @@
 #define SPIDER_DB_KEY_NAME_LEN (sizeof(SPIDER_DB_KEY_NAME_STR) - 1)
 #define SPIDER_DB_SEQUENCE_NAME_STR ""
 #define SPIDER_DB_SEQUENCE_NAME_LEN (sizeof(SPIDER_DB_SEQUENCE_NAME_STR) - 1)
+#define SPIDER_SQL_HEX_STR "0x"
+#define SPIDER_SQL_HEX_LEN (sizeof(SPIDER_SQL_HEX_STR) - 1)
 
 #define SPIDER_DB_TABLE_LOCK_READ_LOCAL         0
 #define SPIDER_DB_TABLE_LOCK_READ               1
diff --git a/storage/spider/spd_db_mysql.cc b/storage/spider/spd_db_mysql.cc
index dce7573567aad..782ff6e26065f 100644
--- a/storage/spider/spd_db_mysql.cc
+++ b/storage/spider/spd_db_mysql.cc
@@ -2596,7 +2596,9 @@ int spider_db_mbase::xa_end(
   XID *xid,
   int *need_mon
 ) {
-  char sql_buf[SPIDER_SQL_XA_END_LEN + XIDDATASIZE + sizeof(long) + 9];
+  char sql_buf[SPIDER_SQL_XA_END_LEN + XIDDATASIZE*2 +
+               SPIDER_SQL_HEX_LEN*2 + SPIDER_SQL_COMMA_LEN*2 +
+               sizeof(long)*3 + 7];
   spider_string sql_str(sql_buf, sizeof(sql_buf), &my_charset_bin);
   DBUG_ENTER("spider_db_mbase::xa_end");
   DBUG_PRINT("info",("spider this=%p", this));
@@ -2613,7 +2615,9 @@ int spider_db_mbase::xa_prepare(
   XID *xid,
   int *need_mon
 ) {
-  char sql_buf[SPIDER_SQL_XA_PREPARE_LEN + XIDDATASIZE + sizeof(long) + 9];
+  char sql_buf[SPIDER_SQL_XA_PREPARE_LEN + XIDDATASIZE*2 +
+               SPIDER_SQL_HEX_LEN*2 + SPIDER_SQL_COMMA_LEN*2 +
+               sizeof(long)*3 + 7];
   spider_string sql_str(sql_buf, sizeof(sql_buf), &my_charset_bin);
   DBUG_ENTER("spider_db_mbase::xa_prepare");
   DBUG_PRINT("info",("spider this=%p", this));
@@ -2630,7 +2634,9 @@ int spider_db_mbase::xa_commit(
   XID *xid,
   int *need_mon
 ) {
-  char sql_buf[SPIDER_SQL_XA_COMMIT_LEN + XIDDATASIZE + sizeof(long) + 9];
+  char sql_buf[SPIDER_SQL_XA_COMMIT_LEN + XIDDATASIZE*2 +
+               SPIDER_SQL_HEX_LEN*2 + SPIDER_SQL_COMMA_LEN*2 +
+               sizeof(long)*3 + 7];
   spider_string sql_str(sql_buf, sizeof(sql_buf), &my_charset_bin);
   DBUG_ENTER("spider_db_mbase::xa_commit");
   DBUG_PRINT("info",("spider this=%p", this));
@@ -2647,7 +2653,9 @@ int spider_db_mbase::xa_rollback(
   XID *xid,
   int *need_mon
 ) {
-  char sql_buf[SPIDER_SQL_XA_ROLLBACK_LEN + XIDDATASIZE + sizeof(long) + 9];
+  char sql_buf[SPIDER_SQL_XA_ROLLBACK_LEN + XIDDATASIZE*2 +
+               SPIDER_SQL_HEX_LEN*2 + SPIDER_SQL_COMMA_LEN*2 +
+               sizeof(long)*3 + 7];
   spider_string sql_str(sql_buf, sizeof(sql_buf), &my_charset_bin);
   DBUG_ENTER("spider_db_mbase::xa_rollback");
   DBUG_PRINT("info",("spider this=%p", this));
@@ -4754,7 +4762,8 @@ int spider_db_mbase_util::append_xa_start(
   DBUG_ENTER("spider_db_mbase_util::append_xa_start");
   DBUG_PRINT("info",("spider this=%p", this));
   if (str->reserve(SPIDER_SQL_SEMICOLON_LEN +
-    SPIDER_SQL_XA_START_LEN + XIDDATASIZE + sizeof(long) + 9))
+    SPIDER_SQL_XA_START_LEN + XIDDATASIZE*2 + SPIDER_SQL_HEX_LEN*2 +
+    SPIDER_SQL_COMMA_LEN*2 + sizeof(long)*3 + 7))
     DBUG_RETURN(HA_ERR_OUT_OF_MEM);
   if (str->length())
   {