From 30df78fb5ce9501b72bcaf54d9d4d600aca17f48 Mon Sep 17 00:00:00 2001
From: Alexey Botchkov <holyfoot@askmonty.org>
Date: Mon, 22 Dec 2025 00:46:10 +0400
Subject: [PATCH 01/12] MDEV-35426 Stack smashing in spider_db_mbase::xa_end
 (opt), ASAN: stack-buffer-overflow in Binary_string::q_append, and Assertion
 `str.alloced_length() >= str.length() + data_len' failed in
 spider_string::q_append on SELECT.

The buffer size has to be increased because we store the hexadecimal
representation of the data which takes twice it's length plust the '0x'
starter. Also string representation of the long should be increased.
---
 .../mysql-test/spider/bugfix/r/xa_cmd.result  |  9 +++++++++
 .../mysql-test/spider/bugfix/t/xa_cmd.test    | 10 ++++++++++
 storage/spider/spd_db_conn.cc                 |  4 +---
 storage/spider/spd_db_conn.h                  |  2 ++
 storage/spider/spd_db_mysql.cc                | 19 ++++++++++++++-----
 5 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/storage/spider/mysql-test/spider/bugfix/r/xa_cmd.result b/storage/spider/mysql-test/spider/bugfix/r/xa_cmd.result
index 5a560ce25d181..fb5dcc76f86bf 100644
--- a/storage/spider/mysql-test/spider/bugfix/r/xa_cmd.result
+++ b/storage/spider/mysql-test/spider/bugfix/r/xa_cmd.result
@@ -34,6 +34,14 @@ INSERT INTO tbl_a (pkey) VALUES (0),(1),(2),(3),(4),(5),(6),(7),(8),(9);
 XA END 'test';
 XA PREPARE 'test';
 XA COMMIT 'test';
+# MDEV-35426 Stack smashing in spider_db_mbase::xa_end (opt), ASAN: stack-
+#  buffer-overflow in Binary_string::q_append, and Assertion
+#  `str.alloced_length() >= str.length() + data_len' failed in
+#  spider_string::q_append on SELECT.
+XA START 'xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc1','xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc2',1234567890;
+INSERT INTO tbl_a (pkey) VALUES (10);
+XA END 'xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc1','xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc2',1234567890;
+XA ROLLBACK 'xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc1','xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc2',1234567890;
 # MDEV-37829 XA COMMIT ONE PHASE fails with "This xid does not
 # exist" if a trigger references a SPIDER table
 #
@@ -103,6 +111,7 @@ connection child2_1;
 SELECT argument FROM mysql.general_log WHERE command_type != 'Execute' AND argument LIKE '%insert %';
 argument
 insert into `auto_test_remote`.`tbl_a`(`pkey`)values(0),(1),(2),(3),(4),(5),(6),(7),(8),(9)
+insert into `auto_test_remote`.`tbl_a`(`pkey`)values(10)
 insert into `auto_test_remote`.`tbl_a`(`pkey`)values(100)
 insert high_priority into `auto_test_remote`.`tbl_a`(`pkey`)values(101)
 insert high_priority into `auto_test_remote`.`tbl_a`(`pkey`)values(102)
diff --git a/storage/spider/mysql-test/spider/bugfix/t/xa_cmd.test b/storage/spider/mysql-test/spider/bugfix/t/xa_cmd.test
index 5a44ab5e01bfe..b0116fdbeaced 100644
--- a/storage/spider/mysql-test/spider/bugfix/t/xa_cmd.test
+++ b/storage/spider/mysql-test/spider/bugfix/t/xa_cmd.test
@@ -48,6 +48,16 @@ XA END 'test';
 XA PREPARE 'test';
 XA COMMIT 'test';
 
+--echo # MDEV-35426 Stack smashing in spider_db_mbase::xa_end (opt), ASAN: stack-
+--echo #  buffer-overflow in Binary_string::q_append, and Assertion
+--echo #  `str.alloced_length() >= str.length() + data_len' failed in
+--echo #  spider_string::q_append on SELECT.
+
+XA START 'xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc1','xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc2',1234567890;
+INSERT INTO tbl_a (pkey) VALUES (10);
+XA END 'xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc1','xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc2',1234567890;
+XA ROLLBACK 'xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc1','xaaaaaaaaaaaaaaabbbbbbbbbbbbbbbccc2',1234567890;
+
 --echo # MDEV-37829 XA COMMIT ONE PHASE fails with "This xid does not
 --echo # exist" if a trigger references a SPIDER table
 --echo #
diff --git a/storage/spider/spd_db_conn.cc b/storage/spider/spd_db_conn.cc
index 79cafaa8f304b..86c0e6f8ac15d 100644
--- a/storage/spider/spd_db_conn.cc
+++ b/storage/spider/spd_db_conn.cc
@@ -48,8 +48,6 @@ extern SPIDER_DBTON spider_dbton[SPIDER_DBTON_SIZE];
 
 #define SPIDER_SQL_COALESCE_STR "coalesce("
 #define SPIDER_SQL_COALESCE_LEN (sizeof(SPIDER_SQL_COALESCE_STR) - 1)
-#define SPIDER_SQL_HEX_STR "0x"
-#define SPIDER_SQL_HEX_LEN (sizeof(SPIDER_SQL_HEX_STR) - 1)
 
 #define SPIDER_SQL_SET_NAMES_STR "set names "
 #define SPIDER_SQL_SET_NAMES_LEN sizeof(SPIDER_SQL_SET_NAMES_STR) - 1
@@ -1130,7 +1128,7 @@ void spider_db_append_xid_str(
   spider_string *tmp_str,
   XID *xid
 ) {
-  char format_id[sizeof(long) + 3];
+  char format_id[3*sizeof(long) + 3];
   uint format_id_length;
   DBUG_ENTER("spider_db_append_xid_str");
 
diff --git a/storage/spider/spd_db_conn.h b/storage/spider/spd_db_conn.h
index eb0a55e628845..e8448a75631f4 100644
--- a/storage/spider/spd_db_conn.h
+++ b/storage/spider/spd_db_conn.h
@@ -24,6 +24,8 @@
 #define SPIDER_DB_KEY_NAME_LEN (sizeof(SPIDER_DB_KEY_NAME_STR) - 1)
 #define SPIDER_DB_SEQUENCE_NAME_STR ""
 #define SPIDER_DB_SEQUENCE_NAME_LEN (sizeof(SPIDER_DB_SEQUENCE_NAME_STR) - 1)
+#define SPIDER_SQL_HEX_STR "0x"
+#define SPIDER_SQL_HEX_LEN (sizeof(SPIDER_SQL_HEX_STR) - 1)
 
 #define SPIDER_DB_TABLE_LOCK_READ_LOCAL         0
 #define SPIDER_DB_TABLE_LOCK_READ               1
diff --git a/storage/spider/spd_db_mysql.cc b/storage/spider/spd_db_mysql.cc
index dce7573567aad..782ff6e26065f 100644
--- a/storage/spider/spd_db_mysql.cc
+++ b/storage/spider/spd_db_mysql.cc
@@ -2596,7 +2596,9 @@ int spider_db_mbase::xa_end(
   XID *xid,
   int *need_mon
 ) {
-  char sql_buf[SPIDER_SQL_XA_END_LEN + XIDDATASIZE + sizeof(long) + 9];
+  char sql_buf[SPIDER_SQL_XA_END_LEN + XIDDATASIZE*2 +
+               SPIDER_SQL_HEX_LEN*2 + SPIDER_SQL_COMMA_LEN*2 +
+               sizeof(long)*3 + 7];
   spider_string sql_str(sql_buf, sizeof(sql_buf), &my_charset_bin);
   DBUG_ENTER("spider_db_mbase::xa_end");
   DBUG_PRINT("info",("spider this=%p", this));
@@ -2613,7 +2615,9 @@ int spider_db_mbase::xa_prepare(
   XID *xid,
   int *need_mon
 ) {
-  char sql_buf[SPIDER_SQL_XA_PREPARE_LEN + XIDDATASIZE + sizeof(long) + 9];
+  char sql_buf[SPIDER_SQL_XA_PREPARE_LEN + XIDDATASIZE*2 +
+               SPIDER_SQL_HEX_LEN*2 + SPIDER_SQL_COMMA_LEN*2 +
+               sizeof(long)*3 + 7];
   spider_string sql_str(sql_buf, sizeof(sql_buf), &my_charset_bin);
   DBUG_ENTER("spider_db_mbase::xa_prepare");
   DBUG_PRINT("info",("spider this=%p", this));
@@ -2630,7 +2634,9 @@ int spider_db_mbase::xa_commit(
   XID *xid,
   int *need_mon
 ) {
-  char sql_buf[SPIDER_SQL_XA_COMMIT_LEN + XIDDATASIZE + sizeof(long) + 9];
+  char sql_buf[SPIDER_SQL_XA_COMMIT_LEN + XIDDATASIZE*2 +
+               SPIDER_SQL_HEX_LEN*2 + SPIDER_SQL_COMMA_LEN*2 +
+               sizeof(long)*3 + 7];
   spider_string sql_str(sql_buf, sizeof(sql_buf), &my_charset_bin);
   DBUG_ENTER("spider_db_mbase::xa_commit");
   DBUG_PRINT("info",("spider this=%p", this));
@@ -2647,7 +2653,9 @@ int spider_db_mbase::xa_rollback(
   XID *xid,
   int *need_mon
 ) {
-  char sql_buf[SPIDER_SQL_XA_ROLLBACK_LEN + XIDDATASIZE + sizeof(long) + 9];
+  char sql_buf[SPIDER_SQL_XA_ROLLBACK_LEN + XIDDATASIZE*2 +
+               SPIDER_SQL_HEX_LEN*2 + SPIDER_SQL_COMMA_LEN*2 +
+               sizeof(long)*3 + 7];
   spider_string sql_str(sql_buf, sizeof(sql_buf), &my_charset_bin);
   DBUG_ENTER("spider_db_mbase::xa_rollback");
   DBUG_PRINT("info",("spider this=%p", this));
@@ -4754,7 +4762,8 @@ int spider_db_mbase_util::append_xa_start(
   DBUG_ENTER("spider_db_mbase_util::append_xa_start");
   DBUG_PRINT("info",("spider this=%p", this));
   if (str->reserve(SPIDER_SQL_SEMICOLON_LEN +
-    SPIDER_SQL_XA_START_LEN + XIDDATASIZE + sizeof(long) + 9))
+    SPIDER_SQL_XA_START_LEN + XIDDATASIZE*2 + SPIDER_SQL_HEX_LEN*2 +
+    SPIDER_SQL_COMMA_LEN*2 + sizeof(long)*3 + 7))
     DBUG_RETURN(HA_ERR_OUT_OF_MEM);
   if (str->length())
   {

From 09d3ee3643b1f3ad74e18bebe26b4d35d5108bc2 Mon Sep 17 00:00:00 2001
From: Alexey Botchkov <holyfoot@askmonty.org>
Date: Tue, 20 Jan 2026 00:30:43 +0400
Subject: [PATCH 02/12] MDEV-35766 ST_PointOnSurface returns NULL with Polygon
 in some case.

We have to take the ending of a polygon into account.
So the order of checking the scan changed.
---
 mysql-test/main/gis.result |  9 ++++-
 mysql-test/main/gis.test   |  7 ++++
 sql/gcalc_slicescan.cc     | 38 ++++++++++++++------
 sql/gcalc_slicescan.h      |  3 +-
 sql/gcalc_tools.cc         |  4 +--
 sql/item_geofunc.cc        | 74 +++++++++++++++++++++-----------------
 6 files changed, 88 insertions(+), 47 deletions(-)

diff --git a/mysql-test/main/gis.result b/mysql-test/main/gis.result
index 9e92de66d090c..8b4bdb1dc0585 100644
--- a/mysql-test/main/gis.result
+++ b/mysql-test/main/gis.result
@@ -1825,7 +1825,7 @@ exp
 #
 SELECT ST_GEOMETRYTYPE(ST_PointOnSurface(ST_PolyFromText('POLYGON((-70.916 42.1002,-70.9468 42.0946,-70.9754 42.0875,-70.9749 42.0879,-70.9759 42.0897,-70.916 42.1002))'))) as exp;
 exp
-NULL
+POINT
 #
 # MDEV-7529 GIS: ST_Relate returns unexpected results for POINT relations
 #
@@ -5507,3 +5507,10 @@ ST_SRID(g1)	ST_SRID(ST_GeomFromWKB(g1, 4326))	ST_SRID(ST_GeomFromWKB(g1))	ST_AsT
 SELECT ST_DISTANCE_SPHERE(st_geomfromtext('linestring( 2 2, 2 8) '), ST_GeomFromText('POINT(18.413076 43.856258)')) ;
 ERROR HY000: Calling geometry function st_distance_sphere with unsupported types of arguments.
 # End of 10.5 tests
+#
+# MDEV-35766 ST_PointOnSurface returns NULL with Polygon in some case.
+#
+SELECT ST_ASTEXT(ST_POINTONSURFACE(ST_GeomFromText('POLYGON((-1 0, 1 2, 1 0, -1 0))'))) as T;
+T
+POINT(0.5 1)
+# End of 10.6 tests
diff --git a/mysql-test/main/gis.test b/mysql-test/main/gis.test
index 860fc8a4d4a31..6de6180db91b4 100644
--- a/mysql-test/main/gis.test
+++ b/mysql-test/main/gis.test
@@ -3515,3 +3515,10 @@ FROM (
 SELECT ST_DISTANCE_SPHERE(st_geomfromtext('linestring( 2 2, 2 8) '), ST_GeomFromText('POINT(18.413076 43.856258)')) ;
 
 --echo # End of 10.5 tests
+
+--echo #
+--echo # MDEV-35766 ST_PointOnSurface returns NULL with Polygon in some case.
+--echo #
+SELECT ST_ASTEXT(ST_POINTONSURFACE(ST_GeomFromText('POLYGON((-1 0, 1 2, 1 0, -1 0))'))) as T;
+
+--echo # End of 10.6 tests
diff --git a/sql/gcalc_slicescan.cc b/sql/gcalc_slicescan.cc
index 662783ea4ea26..b0d41e9dc0596 100644
--- a/sql/gcalc_slicescan.cc
+++ b/sql/gcalc_slicescan.cc
@@ -902,14 +902,18 @@ static Gcalc_heap::Info *new_eq_point(
 }
 
 
-void Gcalc_heap::Info::calc_xy(double *x, double *y) const
+void Gcalc_heap::Info::calc_intersection_xy(double *x, double *y) const
 {
+  GCALC_DBUG_ASSERT(type == nt_intersection);
   double b0_x= node.intersection.p2->node.shape.x - node.intersection.p1->node.shape.x;
   double b0_y= node.intersection.p2->node.shape.y - node.intersection.p1->node.shape.y;
   double b1_x= node.intersection.p4->node.shape.x - node.intersection.p3->node.shape.x;
   double b1_y= node.intersection.p4->node.shape.y - node.intersection.p3->node.shape.y;
   double b0xb1= b0_x * b1_y - b0_y * b1_x;
-  double t= (node.intersection.p3->node.shape.x - node.intersection.p1->node.shape.x) * b1_y - (node.intersection.p3->node.shape.y - node.intersection.p1->node.shape.y) * b1_x;
+  double t=(node.intersection.p3->node.shape.x -
+               node.intersection.p1->node.shape.x) * b1_y -
+            (node.intersection.p3->node.shape.y -
+               node.intersection.p1->node.shape.y) * b1_x;
 
   t/= b0xb1;
 
@@ -918,6 +922,19 @@ void Gcalc_heap::Info::calc_xy(double *x, double *y) const
 }
 
 
+void Gcalc_heap::Info::get_xy(double *x, double *y) const
+{
+  if (type == nt_intersection)
+    calc_intersection_xy(x, y);
+  else
+  {
+    GCALC_DBUG_ASSERT(type == nt_shape_node);
+    *x= node.shape.x;
+    *y= node.shape.y;
+  }
+}
+
+
 #ifdef GCALC_CHECK_WITH_FLOAT
 void Gcalc_heap::Info::calc_xy_ld(long double *x, long double *y) const
 {
@@ -1925,7 +1942,8 @@ double Gcalc_scan_iterator::get_y() const
     Gcalc_coord2 t_a, t_b;
     Gcalc_coord3 a_tb, b_ta, y_exp;
     calc_t(t_a, t_b, dxa, dya,
-           state.pi->node.intersection.p1, state.pi->node.intersection.p2, state.pi->node.intersection.p3, state.pi->node.intersection.p4);
+           state.pi->node.intersection.p1, state.pi->node.intersection.p2,
+           state.pi->node.intersection.p3, state.pi->node.intersection.p4);
 
 
     gcalc_mul_coord(a_tb, GCALC_COORD_BASE3,
@@ -1971,14 +1989,12 @@ double Gcalc_scan_iterator::get_event_x() const
 double Gcalc_scan_iterator::get_h() const
 {
   double cur_y= get_y();
-  double next_y;
-  if (state.pi->type == Gcalc_heap::nt_intersection)
-  {
-    double x;
-    state.pi->calc_xy(&x, &next_y);
-  }
-  else
-    next_y= state.pi->next ? state.pi->get_next()->node.shape.y : 0.0;
+  double x, next_y;
+
+  GCALC_DBUG_ASSERT(m_cur_pi);
+
+  m_cur_pi->get_xy(&x, &next_y);
+
   return next_y - cur_y;
 }
 
diff --git a/sql/gcalc_slicescan.h b/sql/gcalc_slicescan.h
index 37e887e87e5a3..48f5cf345ded0 100644
--- a/sql/gcalc_slicescan.h
+++ b/sql/gcalc_slicescan.h
@@ -216,7 +216,8 @@ class Gcalc_heap : public Gcalc_dyn_list
     bool is_single_node() const
       { return is_bottom() && is_top(); }
 
-    void calc_xy(double *x, double *y) const;
+    void calc_intersection_xy(double *x, double *y) const;
+    void get_xy(double *x, double *y) const;
     int equal_pi(const Info *pi) const;
 #ifdef GCALC_CHECK_WITH_FLOAT
     void calc_xy_ld(long double *x, long double *y) const;
diff --git a/sql/gcalc_tools.cc b/sql/gcalc_tools.cc
index 62c42f087a038..3d6a574b28a74 100644
--- a/sql/gcalc_tools.cc
+++ b/sql/gcalc_tools.cc
@@ -1285,7 +1285,7 @@ inline int Gcalc_operation_reducer::get_single_result(res_point *res,
   if (res->intersection_point)
   {
     double x, y;
-    res->pi->calc_xy(&x, &y);
+    res->pi->calc_intersection_xy(&x, &y);
     if (storage->single_point(x,y))
       GCALC_DBUG_RETURN(1);
   }
@@ -1312,7 +1312,7 @@ int Gcalc_operation_reducer::get_result_thread(res_point *cur,
     {
       if (cur->intersection_point)
       {
-        cur->pi->calc_xy(&x, &y);
+        cur->pi->calc_intersection_xy(&x, &y);
       }
       else
       {
diff --git a/sql/item_geofunc.cc b/sql/item_geofunc.cc
index 8e7d50b1aab56..d107e7c52d042 100644
--- a/sql/item_geofunc.cc
+++ b/sql/item_geofunc.cc
@@ -2665,6 +2665,16 @@ double Item_func_sphere_distance::spherical_distance_points(Geometry *g1,
 }
 
 
+static double count_h_x(double x1, double y1, double x2, double y2, double h)
+{
+  double dy= y2 - y1;
+  double dx= x2 - x1;
+  double dh= h - y1;
+
+  return x1 + dx * dh / dy;
+}
+
+
 String *Item_func_pointonsurface::val_str(String *str)
 {
   Gcalc_operation_transporter trn(&func, &collector);
@@ -2673,7 +2683,7 @@ String *Item_func_pointonsurface::val_str(String *str)
   Geometry *g;
   MBR mbr;
   const char *c_end;
-  double UNINIT_VAR(px), UNINIT_VAR(py), x0, UNINIT_VAR(y0);
+  double UNINIT_VAR(px), UNINIT_VAR(py);
   String *result= 0;
   const Gcalc_scan_iterator::point *pprev= NULL;
   uint32 srid;
@@ -2696,54 +2706,54 @@ String *Item_func_pointonsurface::val_str(String *str)
 
   while (scan_it.more_points())
   {
+    double h;
+
     if (scan_it.step())
       goto mem_error;
 
-    if (scan_it.get_h() > GIS_ZERO)
-    {
-      y0= scan_it.get_y();
-      break;
-    }
-  }
+    if (!scan_it.more_points())
+      goto exit;
 
-  if (!scan_it.more_points())
-  {
-    goto exit;
-  }
+    if ((h= scan_it.get_h()) <= GIS_ZERO)
+      continue;
 
-  if (scan_it.step())
-    goto mem_error;
+    py= scan_it.get_y() + h/2.0;
 
-  for (Gcalc_point_iterator pit(&scan_it); pit.point(); ++pit)
-  {
-    if (pprev == NULL)
-    {
-      pprev= pit.point();
-      continue;
-    }
-    x0= scan_it.get_sp_x(pprev);
-    px= scan_it.get_sp_x(pit.point());
-    if (px - x0 > GIS_ZERO)
+    for (Gcalc_point_iterator pit(&scan_it); pit.point(); ++pit)
     {
-      if (scan_it.get_h() > GIS_ZERO)
+      const Gcalc_scan_iterator::point *p= pit.point();
+      double x1, y1, x2, y2, xa, xb;
+
+      if (pprev == NULL)
       {
-        px= (px + x0) / 2.0;
-        py= scan_it.get_y();
+        pprev= pit.point();
+        continue;
       }
-      else
+
+      pprev->pi->get_xy(&x1, &y1);
+      pprev->next_pi->get_xy(&x2, &y2);
+
+      xa= count_h_x(x1, y1, x2, y2, py);
+
+      p->pi->get_xy(&x1, &y1);
+      p->next_pi->get_xy(&x2, &y2);
+      xb= count_h_x(x1, y1, x2, y2, py);
+
+      if (xb - xa > GIS_ZERO)
       {
-        px= (px + x0) / 2.0;
-        py= (y0 + scan_it.get_y()) / 2.0;
+        px= (xa + xb) / 2.0;
+        null_value= 0;
+        goto point_found;
       }
-      null_value= 0;
-      break;
+
+      pprev= NULL;
     }
-    pprev= NULL;
   }
 
   if (null_value)
     goto exit;
 
+point_found:
   str->set_charset(&my_charset_bin);
   str->length(0);
   if (str->reserve(SRID_SIZE, 512))

From 62c8c177565592b1da584d28c9d280b2433a8dc0 Mon Sep 17 00:00:00 2001
From: Alexey Botchkov <holyfoot@askmonty.org>
Date: Fri, 5 Sep 2025 23:33:03 +0400
Subject: [PATCH 03/12] MDEV-36058 ST_CROSSES returns 0 instead of NULL.

Add check for the arguments.
---
 mysql-test/main/gis-precise.result                | 14 +++++++++++++-
 mysql-test/main/gis-precise.test                  | 10 +++++++++-
 .../suite/innodb_gis/r/alter_spatial_index.result | 15 +++++++--------
 .../innodb_gis/r/create_spatial_index.result      |  8 --------
 sql/item_geofunc.cc                               | 13 ++++++++++++-
 5 files changed, 41 insertions(+), 19 deletions(-)

diff --git a/mysql-test/main/gis-precise.result b/mysql-test/main/gis-precise.result
index 242fa2eb5ef76..a454fbf00ba13 100644
--- a/mysql-test/main/gis-precise.result
+++ b/mysql-test/main/gis-precise.result
@@ -389,7 +389,7 @@ result
 MULTIPOINT(7 5,7 5.142857142857142,5.899999999999998 5.300000000000001,5.799999999999997 5.600000000000001,3 7)
 SELECT ST_CROSSES( GEOMETRYFROMTEXT(' POLYGON( (3 5, 2 4, 2 5, 3 5) ) ') , POLYGONFROMTEXT(' POLYGON((2 4,3 4,3 5,2 5,2 4)) ')) as result;
 result
-0
+NULL
 SELECT ST_WITHIN( POLYGONFROMTEXT(' POLYGON( (0 5, 3 5, 3 4, 2 0 , 1 0, 2 4 , 0 4, 0 5) ) ') , POLYGONFROMTEXT(' POLYGON( (0 5, 3 5, 3 4, 1 4 , 1 3 , 3 3 , 3 0 , 0 0 , 0 5), ( 1 1 , 2 1 , 2 2 , 1 2 , 1 1 ) ) ') ) as result;
 result
 0
@@ -868,3 +868,15 @@ ST_INTERSECTION(
 ST_MULTIPOLYGONFROMTEXT(' MULTIPOLYGON(((3.8571428571428568 2.857142857142857,5.571428571428571 4.571428571428571,9 4,3.8571428571428568 2.857142857142857)),((4.5 4.75,3 5,4.6 7.4,6 6,4.5 4.75))) '),                   ST_MULTIPOLYGONFROMTEXT(' MULTIPOLYGON(((3 4,3 5,2 5,2 7,5 4,3 4),(5 4,7.4 7,8 7,8 4,5 4))) ') )) as V;
 V
 3
+#
+# MDEV-36058 ST_CROSSES returns 0 instead of NULL.
+#
+SELECT ST_CROSSES( ST_GEOMFROMTEXT('point(1 1)'), st_geomfromtext('point(1 1)') ) a;
+a
+NULL
+SELECT ST_CROSSES( ST_GEOMFROMTEXT('POLYGON ((59 18,67 18,67 13,59 13,59 18)) '), st_geomfromtext('polygon((2 2,2 4, 4 2,2 2))') ) a;
+a
+NULL
+SELECT ST_CROSSES( ST_GEOMFROMTEXT('POLYGON ((59 18,67 18,67 13,59 13,59 18)) '), st_geomfromtext('point(1 1)') ) a;
+a
+NULL
diff --git a/mysql-test/main/gis-precise.test b/mysql-test/main/gis-precise.test
index 4f84589c9995b..abf9ccb939439 100644
--- a/mysql-test/main/gis-precise.test
+++ b/mysql-test/main/gis-precise.test
@@ -477,7 +477,6 @@ set @sarajevo = ST_GeomFromText('POINT(18.413076 43.856258)');
 SELECT TRUNCATE(ST_Distance_Sphere(@zenica, @sarajevo), 10);
 SELECT TRUNCATE(ST_Distance_Sphere(@sarajevo, @zenica), 10);
 
-
 --echo #
 --echo # MDEV-31499 Assertion `(0)' failed in Gis_geometry_collection::init_from_opresult.
 --echo #
@@ -486,3 +485,12 @@ SELECT ST_NUMGEOMETRIES(
        ST_INTERSECTION(
                 ST_MULTIPOLYGONFROMTEXT(' MULTIPOLYGON(((3.8571428571428568 2.857142857142857,5.571428571428571 4.571428571428571,9 4,3.8571428571428568 2.857142857142857)),((4.5 4.75,3 5,4.6 7.4,6 6,4.5 4.75))) '),                   ST_MULTIPOLYGONFROMTEXT(' MULTIPOLYGON(((3 4,3 5,2 5,2 7,5 4,3 4),(5 4,7.4 7,8 7,8 4,5 4))) ') )) as V;
 
+--echo #
+--echo # MDEV-36058 ST_CROSSES returns 0 instead of NULL.
+--echo #
+
+
+SELECT ST_CROSSES( ST_GEOMFROMTEXT('point(1 1)'), st_geomfromtext('point(1 1)') ) a;
+SELECT ST_CROSSES( ST_GEOMFROMTEXT('POLYGON ((59 18,67 18,67 13,59 13,59 18)) '), st_geomfromtext('polygon((2 2,2 4, 4 2,2 2))') ) a;
+SELECT ST_CROSSES( ST_GEOMFROMTEXT('POLYGON ((59 18,67 18,67 13,59 13,59 18)) '), st_geomfromtext('point(1 1)') ) a;
+
diff --git a/mysql-test/suite/innodb_gis/r/alter_spatial_index.result b/mysql-test/suite/innodb_gis/r/alter_spatial_index.result
index 08632b6751426..b8ec214e8aeea 100644
--- a/mysql-test/suite/innodb_gis/r/alter_spatial_index.result
+++ b/mysql-test/suite/innodb_gis/r/alter_spatial_index.result
@@ -140,14 +140,10 @@ tab	1	idx6	1	c4	A	#	10	NULL		BTREE			NO
 SET @g1 = ST_GeomFromText('POLYGON((20 20,30 30,40 40,50 50,40 50,30 40,30 30,20 20))');
 SELECT c1,ST_Astext(c2),ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1);
 c1	ST_Astext(c2)	ST_Astext(c4)
-2	POINT(20 20)	POLYGON((40 50,40 70,50 100,70 100,80 80,70 50,40 50))
-1	POINT(10 10)	POLYGON((30 30,40 40,50 50,30 50,30 40,30 30))
 UPDATE tab SET C2 = ST_GeomFromText('POINT(1000 1000)')
 WHERE ST_Crosses(tab.c4, @g1);
 SELECT c1,ST_Astext(c2),ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1);
 c1	ST_Astext(c2)	ST_Astext(c4)
-2	POINT(1000 1000)	POLYGON((40 50,40 70,50 100,70 100,80 80,70 50,40 50))
-1	POINT(1000 1000)	POLYGON((30 30,40 40,50 50,30 50,30 40,30 30))
 DELETE FROM tab WHERE ST_Crosses(tab.c4, @g1);
 ALTER TABLE tab CHANGE COLUMN c2 c22 POINT NOT NULL;
 affected rows: 0
@@ -232,18 +228,20 @@ DELETE FROM tab WHERE MBREquals(tab.c4, @g1);
 SELECT c1,ST_Astext(c2),ST_Astext(c4) FROM tab WHERE MBREquals(tab.c4, @g1);
 c1	ST_Astext(c2)	ST_Astext(c4)
 ALTER TABLE tab  DROP PRIMARY KEY;
-affected rows: 4
-info: Records: 4  Duplicates: 0  Warnings: 0
+affected rows: 6
+info: Records: 6  Duplicates: 0  Warnings: 0
 ALTER TABLE tab ADD PRIMARY KEY(c2) ;
 affected rows: 0
 info: Records: 0  Duplicates: 0  Warnings: 0
 SET @g1 = ST_GeomFromText( 'POLYGON((0 0,0 30,30 40,40 50,50 30,0 0))');
 SELECT c1,ST_Astext(c2),ST_Astext(c4) FROM tab WHERE ST_Touches(tab.c4, @g1);
 c1	ST_Astext(c2)	ST_Astext(c4)
+2	POINT(20 20)	POLYGON((40 50,40 70,50 100,70 100,80 80,70 50,40 50))
 UPDATE tab SET C2 = ST_GeomFromText('POINT(3000 3000)') 
 WHERE ST_Touches(tab.c4, @g1);
 SELECT c1,ST_Astext(c2),ST_Astext(c4) FROM tab WHERE ST_Touches(tab.c4, @g1);
 c1	ST_Astext(c2)	ST_Astext(c4)
+2	POINT(3000 3000)	POLYGON((40 50,40 70,50 100,70 100,80 80,70 50,40 50))
 DELETE FROM tab WHERE ST_Touches(tab.c4, @g1);
 SELECT c1,ST_Astext(c2),ST_Astext(c4) FROM tab WHERE ST_Touches(tab.c4, @g1);
 c1	ST_Astext(c2)	ST_Astext(c4)
@@ -267,6 +265,7 @@ Table	Op	Msg_type	Msg_text
 test.tab	check	status	OK
 SELECT c1,ST_Astext(c2),ST_Astext(c4) FROM tab ORDER BY c1;
 c1	ST_Astext(c2)	ST_Astext(c4)
+1	POINT(10 10)	POLYGON((30 30,40 40,50 50,30 50,30 40,30 30))
 6	POINT(3 3)	POLYGON((2010 2010,2020 2020,2030 2030,2040 2030,2020 2010,2010 2010))
 7	POINT(60 70)	POLYGON((3010 3010,3020 3020,3030 3030,3040 3030,3020 3010,3010 3010))
 8	POINT(0 0)	POLYGON((3010 3010,3020 3020,3030 3030,3040 3030,3020 3010,3010 3010))
@@ -290,8 +289,8 @@ SELECT c1,ST_Astext(c2),ST_Astext(c4) FROM tab WHERE MBROverlaps(tab.c4, @g1) OR
 c1	ST_Astext(c2)	ST_Astext(c4)
 INSERT INTO tab SELECT * FROM tab1;
 ALTER TABLE tab DROP PRIMARY KEY;
-affected rows: 1
-info: Records: 1  Duplicates: 0  Warnings: 0
+affected rows: 2
+info: Records: 2  Duplicates: 0  Warnings: 0
 SET STATEMENT sql_mode = 'NO_ENGINE_SUBSTITUTION' FOR
 CREATE TEMPORARY TABLE temp_tab AS SELECT * FROM tab where c1 = c2;
 ERROR HY000: Illegal parameter data types int and point for operation '='
diff --git a/mysql-test/suite/innodb_gis/r/create_spatial_index.result b/mysql-test/suite/innodb_gis/r/create_spatial_index.result
index d91947136850b..1ae97a603bc0a 100644
--- a/mysql-test/suite/innodb_gis/r/create_spatial_index.result
+++ b/mysql-test/suite/innodb_gis/r/create_spatial_index.result
@@ -105,7 +105,6 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	tab	range	idx3	idx3	34	NULL	1	Using where; Using filesort
 SELECT c1,ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
-4	POLYGON((300 300,400 400,500 500,300 500,300 400,300 300))
 EXPLAIN UPDATE tab SET C2 = ST_GeomFromText('POINT(0 0)') 
 WHERE ST_Crosses(tab.c4, @g1);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
@@ -119,7 +118,6 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	tab	range	idx3	idx3	34	NULL	1	Using where; Using filesort
 SELECT c1,ST_Astext(c4) FROM tab WHERE  ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
-1	POLYGON((30 30,40 40,50 50,30 50,30 40,30 30))
 EXPLAIN UPDATE tab SET C2 = ST_GeomFromText('POINT(0 0)') 
 WHERE ST_Crosses(tab.c4, @g1);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
@@ -411,7 +409,6 @@ test.tab	check	status	OK
 SET @g1 = ST_GeomFromText('POLYGON((100 200,1010 1010,1020 1020,500 300,300 200,100 300,100 200))');
 SELECT c1,ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
-5	POLYGON((1010 1010,1020 1020,1030 1030,1040 1030,1020 1010,1010 1010))
 DELETE FROM tab WHERE ST_Crosses(tab.c4, @g1);
 SELECT c1,ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
@@ -534,7 +531,6 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	tab	range	idx3	idx3	34	NULL	1	Using where; Using filesort
 SELECT c1,ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
-4	POLYGON((300 300,400 400,500 500,300 500,300 400,300 300))
 EXPLAIN UPDATE tab SET C2 = ST_GeomFromText('POINT(0 0)') 
 WHERE ST_Crosses(tab.c4, @g1);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
@@ -548,7 +544,6 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	tab	range	idx3	idx3	34	NULL	1	Using where; Using filesort
 SELECT c1,ST_Astext(c4) FROM tab WHERE  ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
-1	POLYGON((30 30,40 40,50 50,30 50,30 40,30 30))
 EXPLAIN UPDATE tab SET C2 = ST_GeomFromText('POINT(0 0)') 
 WHERE ST_Crosses(tab.c4, @g1);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
@@ -830,7 +825,6 @@ test.tab	check	status	OK
 SET @g1 = ST_GeomFromText('POLYGON((100 200,200 300,400 500,500 300,300 200,100 300,100 200))');
 SELECT c1,ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
-4	POLYGON((300 300,400 400,500 500,300 500,300 400,300 300))
 DELETE FROM tab WHERE ST_Crosses(tab.c4, @g1);
 SELECT c1,ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
@@ -952,7 +946,6 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	tab	range	idx3	idx3	34	NULL	1	Using where; Using filesort
 SELECT c1,ST_Astext(c4) FROM tab WHERE ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
-4	POLYGON((300 300,400 400,500 500,300 500,300 400,300 300))
 EXPLAIN UPDATE tab SET C2 = ST_GeomFromText('POINT(0 0)') 
 WHERE ST_Crosses(tab.c4, @g1);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
@@ -966,7 +959,6 @@ id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
 1	SIMPLE	tab	range	idx3	idx3	34	NULL	1	Using where; Using filesort
 SELECT c1,ST_Astext(c4) FROM tab WHERE  ST_Crosses(tab.c4, @g1) ORDER BY c1;
 c1	ST_Astext(c4)
-1	POLYGON((30 30,40 40,50 50,30 50,30 40,30 30))
 EXPLAIN UPDATE tab SET C2 = ST_GeomFromText('POINT(0 0)') 
 WHERE ST_Crosses(tab.c4, @g1);
 id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
diff --git a/sql/item_geofunc.cc b/sql/item_geofunc.cc
index d107e7c52d042..c0b833becfd77 100644
--- a/sql/item_geofunc.cc
+++ b/sql/item_geofunc.cc
@@ -1367,6 +1367,8 @@ class Geometry_ptr_with_buffer_and_mbr
   }
   int store_shapes(Gcalc_shape_transporter *trn) const
   { return geom->store_shapes(trn); }
+  int shape_type() const
+  { return geom->get_class_info()->m_type_id; }
 };
 
 
@@ -1467,8 +1469,17 @@ bool Item_func_spatial_precise_rel::val_bool()
                          Gcalc_function::op_intersection, 2);
       null_value= g1.store_shapes(&trn) || g2.store_shapes(&trn);
       break;
-    case SP_OVERLAPS_FUNC:
     case SP_CROSSES_FUNC:
+      if (g1.shape_type() == Geometry::wkb_polygon ||
+          g1.shape_type() == Geometry::wkb_multipolygon ||
+          g2.shape_type() == Geometry::wkb_point ||
+          g2.shape_type() == Geometry::wkb_multipoint)
+      {
+        null_value= 1;
+        break;
+      }
+      /* fall through */
+    case SP_OVERLAPS_FUNC:
       func.add_operation(Gcalc_function::op_intersection, 2);
       if (func.reserve_op_buffer(3))
         break;

From bf686bb987766bce4ca842d12178d0c08710cab8 Mon Sep 17 00:00:00 2001
From: Pooja Lamba <pooja.lamba@mariadb.com>
Date: Wed, 22 Oct 2025 16:19:30 +0530
Subject: [PATCH 04/12] MDEV-37911 Add Missing Test cases for abs() Function

Adding test cases for abs() .
---
 .../main/mysqltest_string_functions.result    | 26 +++++++
 .../main/mysqltest_string_functions.test      | 73 +++++++++++++++++++
 2 files changed, 99 insertions(+)

diff --git a/mysql-test/main/mysqltest_string_functions.result b/mysql-test/main/mysqltest_string_functions.result
index e6f848cef6f9a..eb3d56e655408 100644
--- a/mysql-test/main/mysqltest_string_functions.result
+++ b/mysql-test/main/mysqltest_string_functions.result
@@ -2,6 +2,32 @@
 # Test for MDEV-36108: Variable substitutions in mysqltest
 # ----------------------------------------------------------------------------
 # ----------------------------------------------------------------------------
+# Test absolute value function
+# ----------------------------------------------------------------------------
+# Basic abs() function tests
+abs(10) -> 10;
+abs(-10) -> 10;
+abs(0) -> 0;
+abs(123456789) -> 123456789;
+abs(-987654321) -> 987654321;
+abs(NULL) -> ;
+abs(5 - 10) -> 5;
+abs(10 - 5) -> 5;
+abs(-(-25)) -> 25;
+abs(-2147483648) -> 2147483648;
+abs(2147483647) -> 2147483647;
+abs(1 == 1) -> 1;
+abs(1 == 0) -> 0;
+abs(-((5 * -3) + (2 - 8))) -> 21;
+abs(((10 - 25) * (3 + 2))) -> 75;
+abs(((2 - 6) * (-4 + 1))) -> 12;
+abs((((-5 * 6) + 10) - (8 * -2))) -> 4;
+abs(((((3 - 9) * 2) + 4) - 1)) -> 9;
+abs(((-100 + 50) * (2 - 5))) -> 150;
+abs(((-3 * (2 + 4)) + (18 / 3))) -> 12;
+abs(((((10 - 5) * -3) + 4) * -2)) -> 22;
+abs((((-2 * -2) - (5 * 3)) + 20)) -> 9;
+# ----------------------------------------------------------------------------
 # Test conversion functions (conv, bin, oct, hex)
 # ----------------------------------------------------------------------------
 # Basic conv() function tests
diff --git a/mysql-test/main/mysqltest_string_functions.test b/mysql-test/main/mysqltest_string_functions.test
index 9115e46923d56..10e0d546e157c 100644
--- a/mysql-test/main/mysqltest_string_functions.test
+++ b/mysql-test/main/mysqltest_string_functions.test
@@ -4,6 +4,79 @@
 
 --source include/not_embedded.inc
 
+--echo # ----------------------------------------------------------------------------
+--echo # Test absolute value function
+--echo # ----------------------------------------------------------------------------
+
+--echo # Basic abs() function tests
+
+let $a1 = $(abs(10));
+-- echo abs(10) -> $a1;
+
+let $a2 = $(abs(-10));
+-- echo abs(-10) -> $a2;
+
+let $a3 = $(abs(0));
+-- echo abs(0) -> $a3;
+
+let $a4 = $(abs(123456789));
+-- echo abs(123456789) -> $a4;
+
+let $a5 = $(abs(-987654321));
+-- echo abs(-987654321) -> $a5;
+
+let $a6 = $(abs(NULL));
+-- echo abs(NULL) -> $a6;
+
+let $a7 = $(abs(5 - 10));
+-- echo abs(5 - 10) -> $a7;
+
+let $a8 = $(abs(10 - 5));
+-- echo abs(10 - 5) -> $a8;
+
+let $a9 = $(abs(-(-25)));
+-- echo abs(-(-25)) -> $a9;
+
+let $a10 = $(abs(-2147483648));
+-- echo abs(-2147483648) -> $a10;
+
+let $a11 = $(abs(2147483647));
+-- echo abs(2147483647) -> $a11;
+
+let $a12 = $(abs(1 == 1));
+-- echo abs(1 == 1) -> $a12;
+
+let $a13 = $(abs(1 == 0));
+-- echo abs(1 == 0) -> $a13;
+
+let $a14 = $(abs(-((5 * -3) + (2 - 8))));
+-- echo abs(-((5 * -3) + (2 - 8))) -> $a14;
+
+let $a15 = $(abs(((10 - 25) * (3 + 2))));
+-- echo abs(((10 - 25) * (3 + 2))) -> $a15;
+
+let $a16 = $(abs(((2 - 6) * (-4 + 1))));
+-- echo abs(((2 - 6) * (-4 + 1))) -> $a16;
+
+let $a17 = $(abs((((-5 * 6) + 10) - (8 * -2))));
+-- echo abs((((-5 * 6) + 10) - (8 * -2))) -> $a17;
+
+let $a18 = $(abs(((((3 - 9) * 2) + 4) - 1)));
+-- echo abs(((((3 - 9) * 2) + 4) - 1)) -> $a18;
+
+let $a19 = $(abs(((-100 + 50) * (2 - 5))));
+-- echo abs(((-100 + 50) * (2 - 5))) -> $a19;
+
+let $a20 = $(abs(((-3 * (2 + 4)) + (18 / 3))));
+-- echo abs(((-3 * (2 + 4)) + (18 / 3))) -> $a20;
+
+let $a21 = $(abs(((((10 - 5) * -3) + 4) * -2)));
+-- echo abs(((((10 - 5) * -3) + 4) * -2)) -> $a21;
+
+let $a22 = $(abs((((-2 * -2) - (5 * 3)) + 20)));
+-- echo abs((((-2 * -2) - (5 * 3)) + 20)) -> $a22;
+
+
 --echo # ----------------------------------------------------------------------------
 --echo # Test conversion functions (conv, bin, oct, hex)
 --echo # ----------------------------------------------------------------------------

From 1758b2578a8cc7e193bb35de0d8dc9a5e517c89c Mon Sep 17 00:00:00 2001
From: Daniel Bartholomew <db@dbart.us>
Date: Wed, 4 Feb 2026 17:04:49 -0500
Subject: [PATCH 05/12] bump the VERSION

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 4522ed40cbddc..7fa0a03e5b67e 100644
--- a/VERSION
+++ b/VERSION
@@ -1,4 +1,4 @@
 MYSQL_VERSION_MAJOR=10
 MYSQL_VERSION_MINOR=6
-MYSQL_VERSION_PATCH=25
+MYSQL_VERSION_PATCH=26
 SERVER_MATURITY=stable

From 68288e1fe78fdc5bd7f9f86d46b90734a82deefd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20M=C3=A4kel=C3=A4?= <marko.makela@mariadb.com>
Date: Thu, 12 Feb 2026 08:58:51 +0200
Subject: [PATCH 06/12] Remove an unused file

---
 mysql-test/suite/encryption/t/innodb-first-page-read.opt | 5 -----
 1 file changed, 5 deletions(-)
 delete mode 100644 mysql-test/suite/encryption/t/innodb-first-page-read.opt

diff --git a/mysql-test/suite/encryption/t/innodb-first-page-read.opt b/mysql-test/suite/encryption/t/innodb-first-page-read.opt
deleted file mode 100644
index 38d69691ed6aa..0000000000000
--- a/mysql-test/suite/encryption/t/innodb-first-page-read.opt
+++ /dev/null
@@ -1,5 +0,0 @@
---innodb-encrypt-tables=ON
---innodb-encrypt-log=ON
---innodb-encryption-rotate-key-age=15
---innodb-encryption-threads=4
---innodb-tablespaces-encryption

From a2c798a8d06222952ca6494dd977d05176a74db0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20M=C3=A4kel=C3=A4?= <marko.makela@mariadb.com>
Date: Thu, 12 Feb 2026 09:27:30 +0200
Subject: [PATCH 07/12] innodb.xa_recovery: Work around MDEV-38741

Starting with MariaDB Server 10.11, the test innodb.xa_recovery
would consume innodb_lock_wait_timeout (default: 50) extra seconds.
The exact difference between 10.6 and 10.11 is not known, but the
issue is that a client disconnect fails to abort a lock wait.
Let us set a minimal timeout for the problematic statement in order
to allow the test to complete faster.
---
 mysql-test/suite/innodb/r/xa_recovery.result | 1 +
 mysql-test/suite/innodb/t/xa_recovery.test   | 6 ++++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/mysql-test/suite/innodb/r/xa_recovery.result b/mysql-test/suite/innodb/r/xa_recovery.result
index 0caa501c1e1d1..133f9780c5797 100644
--- a/mysql-test/suite/innodb/r/xa_recovery.result
+++ b/mysql-test/suite/innodb/r/xa_recovery.result
@@ -16,6 +16,7 @@ connection default;
 disconnect con1;
 disconnect con2;
 connect  con1,localhost,root;
+SET STATEMENT innodb_lock_wait_timeout=1 FOR # work around MDEV-38741
 SELECT * FROM t1 LOCK IN SHARE MODE;
 connection default;
 SET innodb_lock_wait_timeout=1;
diff --git a/mysql-test/suite/innodb/t/xa_recovery.test b/mysql-test/suite/innodb/t/xa_recovery.test
index e3479f6fe783d..d649812071946 100644
--- a/mysql-test/suite/innodb/t/xa_recovery.test
+++ b/mysql-test/suite/innodb/t/xa_recovery.test
@@ -31,13 +31,15 @@ connection default;
 disconnect con1;
 disconnect con2;
 connect (con1,localhost,root);
---send SELECT * FROM t1 LOCK IN SHARE MODE
+send
+SET STATEMENT innodb_lock_wait_timeout=1 FOR # work around MDEV-38741
+SELECT * FROM t1 LOCK IN SHARE MODE;
 
 connection default;
 let $wait_condition=
   select count(*) = 1 from information_schema.processlist
   where state = 'Sending data' and
-        info = 'SELECT * FROM t1 LOCK IN SHARE MODE';
+        info LIKE 'SET STATEMENT innodb_lock_wait_timeout%';
 --source include/wait_condition.inc
 
 SET innodb_lock_wait_timeout=1;

From 8bb8d898ef4a8d8113f6924336cc528870b6a9e9 Mon Sep 17 00:00:00 2001
From: hadeer <hadderramadan7@gmail.com>
Date: Sun, 1 Feb 2026 23:02:10 +0200
Subject: [PATCH 08/12] MDEV-37952: Fix crash when setting
 mroonga_default_tokenizer to NULL

Setting mroonga_default_tokenizer to NULL caused a server
crash because the update function did not handle the NULL value before
passing it to strcmp.

Handle NULL values by treating them as "off" to allow safe variable
reset.
---
 storage/mroonga/ha_mroonga.cpp                             | 3 +++
 .../storage/r/variable_default_tokenizer_disable.result    | 5 +++++
 .../storage/t/variable_default_tokenizer_disable.test      | 7 +++++++
 3 files changed, 15 insertions(+)
 create mode 100644 storage/mroonga/mysql-test/mroonga/storage/r/variable_default_tokenizer_disable.result
 create mode 100644 storage/mroonga/mysql-test/mroonga/storage/t/variable_default_tokenizer_disable.test

diff --git a/storage/mroonga/ha_mroonga.cpp b/storage/mroonga/ha_mroonga.cpp
index 3a85eaf18cd50..eab8d8ee3960b 100644
--- a/storage/mroonga/ha_mroonga.cpp
+++ b/storage/mroonga/ha_mroonga.cpp
@@ -938,6 +938,9 @@ static void mrn_default_tokenizer_update(THD *thd, struct st_mysql_sys_var *var,
   char **old_value_ptr = (char **)var_ptr;
   grn_ctx *ctx = &mrn_ctx;
 
+  if(!new_value) {
+    new_value = "off";
+  }
   mrn_change_encoding(ctx, system_charset_info);
   if (strcmp(*old_value_ptr, new_value) == 0) {
     GRN_LOG(ctx, GRN_LOG_NOTICE,
diff --git a/storage/mroonga/mysql-test/mroonga/storage/r/variable_default_tokenizer_disable.result b/storage/mroonga/mysql-test/mroonga/storage/r/variable_default_tokenizer_disable.result
new file mode 100644
index 0000000000000..45f1c7adddf39
--- /dev/null
+++ b/storage/mroonga/mysql-test/mroonga/storage/r/variable_default_tokenizer_disable.result
@@ -0,0 +1,5 @@
+SET GLOBAL mroonga_default_tokenizer = NULL;
+SHOW GLOBAL VARIABLES LIKE 'mroonga_default_tokenizer';
+Variable_name	Value
+mroonga_default_tokenizer	off
+SET GLOBAL mroonga_default_tokenizer = DEFAULT;
diff --git a/storage/mroonga/mysql-test/mroonga/storage/t/variable_default_tokenizer_disable.test b/storage/mroonga/mysql-test/mroonga/storage/t/variable_default_tokenizer_disable.test
new file mode 100644
index 0000000000000..3fd993e4bb593
--- /dev/null
+++ b/storage/mroonga/mysql-test/mroonga/storage/t/variable_default_tokenizer_disable.test
@@ -0,0 +1,7 @@
+--source ../../include/mroonga/have_mroonga.inc
+
+SET GLOBAL mroonga_default_tokenizer = NULL;
+SHOW GLOBAL VARIABLES LIKE 'mroonga_default_tokenizer';
+SET GLOBAL mroonga_default_tokenizer = DEFAULT;
+
+--source ../../include/mroonga/have_mroonga_deinit.inc

From 758aa7aebc07be4d392b5fc7830c38a29c8e0e60 Mon Sep 17 00:00:00 2001
From: hadeer <hadderramadan7@gmail.com>
Date: Sat, 7 Feb 2026 13:24:34 +0200
Subject: [PATCH 09/12] mroonga: handle allocation for new_value in
 mrn_default_tokenizer_update

Align with existing mroonga memory management patterns to ensure consistency,
rather than relying on the MariaDB framework default behavior.
---
 storage/mroonga/ha_mroonga.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/storage/mroonga/ha_mroonga.cpp b/storage/mroonga/ha_mroonga.cpp
index eab8d8ee3960b..5db9aa0b5847d 100644
--- a/storage/mroonga/ha_mroonga.cpp
+++ b/storage/mroonga/ha_mroonga.cpp
@@ -940,6 +940,9 @@ static void mrn_default_tokenizer_update(THD *thd, struct st_mysql_sys_var *var,
 
   if(!new_value) {
     new_value = "off";
+#ifndef MRN_NEED_FREE_STRING_MEMALLOC_PLUGIN_VAR
+    new_value = mrn_my_strdup(new_value, MYF(MY_WME));
+#endif
   }
   mrn_change_encoding(ctx, system_charset_info);
   if (strcmp(*old_value_ptr, new_value) == 0) {

From 2dbd5bb326dd8bbdffb50d032f37763da9401e67 Mon Sep 17 00:00:00 2001
From: hadeer <hadderramadan7@gmail.com>
Date: Mon, 9 Feb 2026 19:50:23 +0200
Subject: [PATCH 10/12] Mroonga: Refactor variable_default_tokenizer_disable
 test

Add copyright header to the test file.
Disable the test in embedded mode by sourcing include/not_embedded.inc."
---
 .../t/variable_default_tokenizer_disable.test  | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/storage/mroonga/mysql-test/mroonga/storage/t/variable_default_tokenizer_disable.test b/storage/mroonga/mysql-test/mroonga/storage/t/variable_default_tokenizer_disable.test
index 3fd993e4bb593..63df372f3faae 100644
--- a/storage/mroonga/mysql-test/mroonga/storage/t/variable_default_tokenizer_disable.test
+++ b/storage/mroonga/mysql-test/mroonga/storage/t/variable_default_tokenizer_disable.test
@@ -1,3 +1,21 @@
+# -*- mode: sql; sql-product: mysql -*-
+#
+# Copyright (C) 2026  hadeer <hadderramadan7@gmail.com>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+--source include/not_embedded.inc
 --source ../../include/mroonga/have_mroonga.inc
 
 SET GLOBAL mroonga_default_tokenizer = NULL;

From 8882f8fe6c5a87e2b367e260627af88ce9130d44 Mon Sep 17 00:00:00 2001
From: Thirunarayanan Balathandayuthapani <thiru@mariadb.com>
Date: Tue, 17 Feb 2026 21:13:34 +0530
Subject: [PATCH 11/12] MDEV-37886  PAGE_COMPRESSED ALTER TABLE operations
 inconsistent with innodb_file_per_table setting

Problem:
=======
InnoDB DDL does ALTER TABLE PAGE_COMPRESSED=1 because:
1. check_if_supported_inplace_alter() reads srv_file_per_table
during precheck and does allow INSTANT operation.
2. User does change innodb_file_per_table later.
But prepare phase read srv_file_per_table again during execution.
3. If the global variable changed between these phases, causes
server abort for page_compressed tables.

Solution:
=========
- Add a file_per_table member to Alter_inplace_info to
capture the innodb_file_per_table value during the
precheck phase and use that consistent value throughout
the entire ALTER TABLE operation.
- Converted boolean flags (online, ignore, error_if_not_empty,
mdl_exclusive_after_prepare) from individual boolean
members to bitfields packed in a single byte
- Reduced Alter_inplace_info structure size by 24 bytes
---
 mysql-test/suite/innodb/r/alter_crash.result | 16 ++++
 mysql-test/suite/innodb/t/alter_crash.test   | 19 ++++
 sql/handler.cc                               |  9 +-
 sql/handler.h                                | 99 ++++++++++----------
 storage/innobase/handler/handler0alter.cc    |  9 +-
 5 files changed, 96 insertions(+), 56 deletions(-)

diff --git a/mysql-test/suite/innodb/r/alter_crash.result b/mysql-test/suite/innodb/r/alter_crash.result
index 77acd237218b0..6659b91522f03 100644
--- a/mysql-test/suite/innodb/r/alter_crash.result
+++ b/mysql-test/suite/innodb/r/alter_crash.result
@@ -243,3 +243,19 @@ a	b
 1	1
 2	1
 DROP TABLE t1;
+#
+#  MDEV-37886 PAGE_COMPRESSED ALTER TABLE operations
+#    inconsistent with innodb_file_per_table setting
+#
+SET GLOBAL innodb_file_per_table=0;
+CREATE TABLE t1(a INT PRIMARY KEY) ENGINE=InnoDB;
+SET DEBUG_SYNC='before_lock_tables_takes_lock SIGNAL stuck WAIT_FOR go';
+ALTER TABLE t1 PAGE_COMPRESSED=1, ALGORITHM=INSTANT;
+connect con1,localhost,root;
+SET DEBUG_SYNC='now WAIT_FOR stuck';
+SET GLOBAL innodb_file_per_table=1;
+SET DEBUG_SYNC='now SIGNAL go';
+disconnect con1;
+connection default;
+ERROR HY000: Table storage engine 'InnoDB' does not support the create option 'PAGE_COMPRESSED'
+DROP TABLE t1;
diff --git a/mysql-test/suite/innodb/t/alter_crash.test b/mysql-test/suite/innodb/t/alter_crash.test
index 1829529450ddc..320befe0dba2b 100644
--- a/mysql-test/suite/innodb/t/alter_crash.test
+++ b/mysql-test/suite/innodb/t/alter_crash.test
@@ -241,3 +241,22 @@ CHECK TABLE t1;
 SHOW CREATE TABLE t1;
 SELECT * FROM t1;
 DROP TABLE t1;
+
+--echo #
+--echo #  MDEV-37886 PAGE_COMPRESSED ALTER TABLE operations
+--echo #    inconsistent with innodb_file_per_table setting
+--echo #
+SET GLOBAL innodb_file_per_table=0;
+CREATE TABLE t1(a INT PRIMARY KEY) ENGINE=InnoDB;
+SET DEBUG_SYNC='before_lock_tables_takes_lock SIGNAL stuck WAIT_FOR go';
+send ALTER TABLE t1 PAGE_COMPRESSED=1, ALGORITHM=INSTANT;
+
+--connect con1,localhost,root
+SET DEBUG_SYNC='now WAIT_FOR stuck';
+SET GLOBAL innodb_file_per_table=1;
+SET DEBUG_SYNC='now SIGNAL go';
+--disconnect con1
+--connection default
+--error ER_ILLEGAL_HA_CREATE_OPTION
+--reap
+DROP TABLE t1;
diff --git a/sql/handler.cc b/sql/handler.cc
index 67ccb31e4f9f7..a2508d75fb945 100644
--- a/sql/handler.cc
+++ b/sql/handler.cc
@@ -5519,11 +5519,14 @@ Alter_inplace_info::Alter_inplace_info(HA_CREATE_INFO *create_info_arg,
     : create_info(create_info_arg),
     alter_info(alter_info_arg),
     key_info_buffer(key_info_arg),
-    key_count(key_count_arg),
-    rename_keys(current_thd->mem_root),
     modified_part_info(modified_part_info_arg),
+    rename_keys(current_thd->mem_root),
+    key_count(key_count_arg),
+    online(false),
+    file_per_table(false),
     ignore(ignore_arg),
-    error_if_not_empty(error_non_empty)
+    error_if_not_empty(error_non_empty),
+    mdl_exclusive_after_prepare(false)
   {}
 
 void Alter_inplace_info::report_unsupported_error(const char *not_supported,
diff --git a/sql/handler.h b/sql/handler.h
index c6071bce85ae2..7dcb8bbe68070 100644
--- a/sql/handler.h
+++ b/sql/handler.h
@@ -2547,21 +2547,12 @@ class Alter_inplace_info
   */
   KEY  *key_info_buffer;
 
-  /** Size of key_info_buffer array. */
-  uint key_count;
-
-  /** Size of index_drop_buffer array. */
-  uint index_drop_count= 0;
-
   /**
      Array of pointers to KEYs to be dropped belonging to the TABLE instance
      for the old version of the table.
   */
   KEY  **index_drop_buffer= nullptr;
 
-  /** Size of index_add_buffer array. */
-  uint index_add_count= 0;
-
   /**
      Array of indexes into key_info_buffer for KEYs to be added,
      sorted in increasing order.
@@ -2570,32 +2561,6 @@ class Alter_inplace_info
 
   KEY_PAIR  *index_altered_ignorability_buffer= nullptr;
 
-  /** Size of index_altered_ignorability_buffer array. */
-  uint index_altered_ignorability_count= 0;
-
-  /**
-     Old and new index names. Used for index rename.
-  */
-  struct Rename_key_pair
-  {
-    Rename_key_pair(const KEY *old_key, const KEY *new_key)
-        : old_key(old_key), new_key(new_key)
-    {
-    }
-    const KEY *old_key;
-    const KEY *new_key;
-  };
-  /**
-     Vector of key pairs from DROP/ADD index which can be renamed.
-  */
-  typedef Mem_root_array<Rename_key_pair, true> Rename_keys_vector;
-
-  /**
-     A list of indexes which should be renamed.
-     Index definitions stays the same.
-  */
-  Rename_keys_vector rename_keys;
-
   /**
      Context information to allow handlers to keep context between in-place
      alter API calls.
@@ -2622,9 +2587,6 @@ class Alter_inplace_info
   */
   alter_table_operations handler_flags= 0;
 
-  /* Alter operations involving parititons are strored here */
-  ulong partition_flags;
-
   /**
      Partition_info taking into account the partition changes to be performed.
      Contains all partitions which are present in the old version of the table
@@ -2633,12 +2595,6 @@ class Alter_inplace_info
   */
   partition_info * const modified_part_info;
 
-  /** true for ALTER IGNORE TABLE ... */
-  const bool ignore;
-
-  /** true for online operation (LOCK=NONE) */
-  bool online= false;
-
   /**
     When ha_commit_inplace_alter_table() is called the the engine can
     set this to a function to be called after the ddl log
@@ -2650,9 +2606,6 @@ class Alter_inplace_info
   /* This will be used as the argument to the above function when called */
   void *inplace_alter_table_committed_argument= nullptr;
 
-  /** which ALGORITHM and LOCK are supported by the storage engine */
-  enum_alter_inplace_result inplace_supported;
-
   /**
      Can be set by handler to describe why a given operation cannot be done
      in-place (HA_ALTER_INPLACE_NOT_SUPPORTED) or why it cannot be done
@@ -2667,11 +2620,57 @@ class Alter_inplace_info
   */
   const char *unsupported_reason= nullptr;
 
-  /** true when InnoDB should abort the alter when table is not empty */
-  const bool error_if_not_empty;
+  /* Alter operations involving parititons are strored here */
+  ulong partition_flags;
+
+  /**
+     Old and new index names. Used for index rename.
+  */
+  struct Rename_key_pair
+  {
+    Rename_key_pair(const KEY *old_key, const KEY *new_key)
+        : old_key(old_key), new_key(new_key)
+    {
+    }
+    const KEY *old_key;
+    const KEY *new_key;
+  };
+  /**
+     Vector of key pairs from DROP/ADD index which can be renamed.
+  */
+  typedef Mem_root_array<Rename_key_pair, true> Rename_keys_vector;
+
+  /**
+     A list of indexes which should be renamed.
+     Index definitions stays the same.
+  */
+  Rename_keys_vector rename_keys;
+
+  /** Size of key_info_buffer array. */
+  uint key_count;
+
+  /** Size of index_drop_buffer array. */
+  uint index_drop_count= 0;
 
+  /** Size of index_add_buffer array. */
+  uint index_add_count= 0;
+
+  /** Size of index_altered_ignorability_buffer array. */
+  uint index_altered_ignorability_count= 0;
+
+  /** which ALGORITHM and LOCK are supported by the storage engine */
+  enum_alter_inplace_result inplace_supported;
+
+  /** TRUE for online operation (LOCK=NONE) */
+  unsigned online : 1;
+  /** TRUE when innodb_file_per_table is set */
+  unsigned file_per_table : 1;
+  /** TRUE for ALTER IGNORE TABLE ... */
+  unsigned ignore : 1;
+  /** true when InnoDB should abort the alter when table is not empty */
+  unsigned error_if_not_empty : 1;
   /** True when DDL should avoid downgrading the MDL */
-  bool mdl_exclusive_after_prepare= false;
+  unsigned mdl_exclusive_after_prepare : 1;
 
   Alter_inplace_info(HA_CREATE_INFO *create_info_arg,
                      Alter_info *alter_info_arg,
diff --git a/storage/innobase/handler/handler0alter.cc b/storage/innobase/handler/handler0alter.cc
index 43ea8c1466d19..48e0dcdf656e8 100644
--- a/storage/innobase/handler/handler0alter.cc
+++ b/storage/innobase/handler/handler0alter.cc
@@ -2227,6 +2227,8 @@ ha_innobase::check_if_supported_inplace_alter(
 {
 	DBUG_ENTER("check_if_supported_inplace_alter");
 
+	ha_alter_info->file_per_table= !!srv_file_per_table;
+
 	if ((ha_alter_info->handler_flags
 	     & INNOBASE_ALTER_VERSIONED_REBUILD)
 	    && altered_table->versioned(VERS_TIMESTAMP)) {
@@ -2341,7 +2343,8 @@ ha_innobase::check_if_supported_inplace_alter(
 
 	switch (ha_alter_info->handler_flags & ~INNOBASE_INPLACE_IGNORE) {
 	case ALTER_OPTIONS:
-		if ((srv_file_per_table && !m_prebuilt->table->space_id)
+		if ((ha_alter_info->file_per_table &&
+		     !m_prebuilt->table->space_id)
 		    || alter_options_need_rebuild(ha_alter_info, table)) {
 			reason_rebuild = my_get_err_msg(
 				ER_ALTER_OPERATION_TABLE_OPTIONS_NEED_REBUILD);
@@ -6600,7 +6603,7 @@ prepare_inplace_alter_table_dict(
 
 	create_table_info_t info(ctx->prebuilt->trx->mysql_thd, altered_table,
 				 ha_alter_info->create_info, NULL, NULL,
-				 srv_file_per_table);
+				 ha_alter_info->file_per_table);
 
 	/* The primary index would be rebuilt if a FTS Doc ID
 	column is to be added, and the primary index definition
@@ -8030,7 +8033,7 @@ ha_innobase::prepare_inplace_alter_table(
 				     ha_alter_info->create_info,
 				     NULL,
 				     NULL,
-				     srv_file_per_table);
+				     ha_alter_info->file_per_table);
 
 	info.set_tablespace_type(indexed_table->space != fil_system.sys_space);
 

From ad7bc157326580dc2a1ecdc53f38ced49dfe6d21 Mon Sep 17 00:00:00 2001
From: ChandanaRamakrishna <chandanachandu1963@gmail.com>
Date: Thu, 19 Feb 2026 22:19:13 +0530
Subject: [PATCH 12/12] MDEV-29466 Rename description_event_for_exec to
 description_event_for_sql_thread

Pure rename for clarity. No functional changes.
---
 sql/log.cc                         |  8 ++++++--
 sql/log.h                          |  3 ++-
 sql/log_event_server.cc            | 28 +++++++++++++++++++++-------
 sql/rpl_rli.cc                     | 20 +++++++++++++++-----
 sql/slave.cc                       | 24 ++++++++++++++++++------
 sql/sql_binlog.cc                  | 16 ++++++++++++----
 sql/wsrep_applier.cc               |  4 +++-
 sql/wsrep_high_priority_service.cc |  8 ++++++--
 8 files changed, 83 insertions(+), 28 deletions(-)

diff --git a/sql/log.cc b/sql/log.cc
index 962557ad769a4..5c1ba8833a2ac 100644
--- a/sql/log.cc
+++ b/sql/log.cc
@@ -3550,7 +3550,9 @@ MYSQL_BIN_LOG::MYSQL_BIN_LOG(uint *sync_period)
    is_relay_log(0), relay_signal_cnt(0),
    checksum_alg_reset(BINLOG_CHECKSUM_ALG_UNDEF),
    relay_log_checksum_alg(BINLOG_CHECKSUM_ALG_UNDEF),
-   description_event_for_exec(0), description_event_for_queue(0),
+   description_event_for_sql_thread
+
+(0), description_event_for_queue(0),
    current_binlog_id(0), reset_master_count(0)
 {
   /*
@@ -3598,7 +3600,9 @@ void MYSQL_BIN_LOG::cleanup()
     close(LOG_CLOSE_INDEX|LOG_CLOSE_STOP_EVENT);
     mysql_mutex_unlock(&LOCK_log);
     delete description_event_for_queue;
-    delete description_event_for_exec;
+    delete description_event_for_sql_thread
+
+;
 
     while ((b= binlog_xid_count_list.get()))
     {
diff --git a/sql/log.h b/sql/log.h
index 130b701378d9a..0405e195093cd 100644
--- a/sql/log.h
+++ b/sql/log.h
@@ -676,7 +676,8 @@ class MYSQL_BIN_LOG: public TC_LOG, private MYSQL_LOG
     the case of a master which has been upgraded from 5.0 to 5.1 without doing
     RESET MASTER, or from 4.x to 5.0).
   */
-  Format_description_log_event *description_event_for_exec,
+  Format_description_log_event *description_event_for_sql_thread
+,
     *description_event_for_queue;
   /*
     Binlog position of last commit (or non-transactional write) to the binlog.
diff --git a/sql/log_event_server.cc b/sql/log_event_server.cc
index 3700cb55ac0a4..a35b68b01d885 100644
--- a/sql/log_event_server.cc
+++ b/sql/log_event_server.cc
@@ -2331,7 +2331,9 @@ int Start_log_event_v3::do_apply_event(rpl_group_info *rgi)
        thread.
     */
   case 1:
-    if (strncmp(rli->relay_log.description_event_for_exec->server_version,
+    if (strncmp(rli->relay_log.description_event_for_sql_thread
+
+->server_version,
                 "3.23.57",7) >= 0 && created)
     {
       /*
@@ -2474,9 +2476,15 @@ int Format_description_log_event::do_apply_event(rpl_group_info *rgi)
   if (!ret)
   {
     /* Save the information describing this binlog */
-    copy_crypto_data(rli->relay_log.description_event_for_exec);
-    delete rli->relay_log.description_event_for_exec;
-    rli->relay_log.description_event_for_exec= this;
+    copy_crypto_data(rli->relay_log.description_event_for_sql_thread
+
+);
+    delete rli->relay_log.description_event_for_sql_thread
+
+;
+    rli->relay_log.description_event_for_sql_thread
+
+= this;
   }
 
   DBUG_RETURN(ret);
@@ -2520,7 +2528,9 @@ Format_description_log_event::do_shall_skip(rpl_group_info *rgi)
 #if defined(HAVE_REPLICATION)
 int Start_encryption_log_event::do_apply_event(rpl_group_info* rgi)
 {
-  return rgi->rli->relay_log.description_event_for_exec->start_decryption(this);
+  return rgi->rli->relay_log.description_event_for_sql_thread
+
+->start_decryption(this);
 }
 
 int Start_encryption_log_event::do_update_pos(rpl_group_info *rgi)
@@ -3216,7 +3226,9 @@ int Rotate_log_event::do_update_pos(rpl_group_info *rgi)
     /*
       Reset thd->variables.option_bits and sql_mode etc, because this could
       be the signal of a master's downgrade from 5.0 to 4.0.
-      However, no need to reset description_event_for_exec: indeed, if the next
+      However, no need to reset description_event_for_sql_thread
+
+: indeed, if the next
       master is 5.0 (even 5.0.1) we will soon get a Format_desc; if the next
       master is 4.0 then the events are in the slave's format (conversion).
     */
@@ -5064,7 +5076,9 @@ int Execute_load_log_event::do_apply_event(rpl_group_info *rgi)
   }
   if (!(lev= (Load_log_event*)
         Log_event::read_log_event(&file, &read_error,
-                                  rli->relay_log.description_event_for_exec,
+                                  rli->relay_log.description_event_for_sql_thread
+
+,
                                   opt_slave_sql_verify_checksum)) ||
       lev->get_type_code() != NEW_LOAD_EVENT)
   {
diff --git a/sql/rpl_rli.cc b/sql/rpl_rli.cc
index 97d70decb2e9f..ab5ec23b0b6c9 100644
--- a/sql/rpl_rli.cc
+++ b/sql/rpl_rli.cc
@@ -664,14 +664,18 @@ int init_relay_log_pos(Relay_log_info* rli,const char* log,
     the description_event here, in case, so that there is no memory leak in
     running, say, CHANGE MASTER.
   */
-  delete rli->relay_log.description_event_for_exec;
+  delete rli->relay_log.description_event_for_sql_thread
+
+;
   /*
     By default the relay log is in binlog format 3 (4.0).
     Even if format is 4, this will work enough to read the first event
     (Format_desc) (remember that format 4 is just lenghtened compared to format
     3; format 3 is a prefix of format 4).
   */
-  rli->relay_log.description_event_for_exec= new
+  rli->relay_log.description_event_for_sql_thread
+
+= new
     Format_description_log_event(3);
 
   mysql_mutex_lock(log_lock);
@@ -738,8 +742,12 @@ int init_relay_log_pos(Relay_log_info* rli,const char* log,
       Format_description_log_event *fdev;
       if (!(fdev= read_relay_log_description_event(rli->cur_log, pos, errmsg)))
         goto err;
-      delete rli->relay_log.description_event_for_exec;
-      rli->relay_log.description_event_for_exec= fdev;
+      delete rli->relay_log.description_event_for_sql_thread
+
+;
+      rli->relay_log.description_event_for_sql_thread
+
+= fdev;
     }
     my_b_seek(rli->cur_log,(off_t)pos);
     DBUG_PRINT("info", ("my_b_tell(rli->cur_log)=%llu rli->event_relay_log_pos=%llu",
@@ -760,7 +768,9 @@ int init_relay_log_pos(Relay_log_info* rli,const char* log,
 
   if (need_data_lock)
     mysql_mutex_unlock(&rli->data_lock);
-  if (!rli->relay_log.description_event_for_exec->is_valid() && !*errmsg)
+  if (!rli->relay_log.description_event_for_sql_thread
+
+->is_valid() && !*errmsg)
     *errmsg= "Invalid Format_description log event; could be out of memory";
 
   DBUG_PRINT("info", ("Returning %d from init_relay_log_pos", (*errmsg)?1:0));
diff --git a/sql/slave.cc b/sql/slave.cc
index de1476e592542..11ee7abb592e8 100644
--- a/sql/slave.cc
+++ b/sql/slave.cc
@@ -5893,8 +5893,12 @@ pthread_handler_t handle_slave_sql(void *arg)
   /* When master_pos_wait() wakes up it will check this and terminate */
   rli->slave_running= MYSQL_SLAVE_NOT_RUN;
   /* Forget the relay log's format */
-  delete rli->relay_log.description_event_for_exec;
-  rli->relay_log.description_event_for_exec= 0;
+  delete rli->relay_log.description_event_for_sql_thread
+
+;
+  rli->relay_log.description_event_for_sql_thread
+
+= 0;
   rli->reset_inuse_relaylog();
   /* Wake up master_pos_wait() */
   DBUG_PRINT("info",("Signaling possibly waiting master_pos_wait() functions"));
@@ -7849,7 +7853,9 @@ static Log_event* next_event(rpl_group_info *rgi, ulonglong *event_size)
     old_pos= rli->event_relay_log_pos;
     int error;
     if ((ev= Log_event::read_log_event(cur_log, &error,
-                                       rli->relay_log.description_event_for_exec,
+                                       rli->relay_log.description_event_for_sql_thread
+
+,
                                        opt_slave_sql_verify_checksum)))
 
     {
@@ -8037,7 +8043,9 @@ static Log_event* next_event(rpl_group_info *rgi, ulonglong *event_size)
       mysql_file_close(rli->cur_log_fd, MYF(MY_WME));
       rli->cur_log_fd = -1;
       rli->last_inuse_relaylog->completed= true;
-      rli->relay_log.description_event_for_exec->reset_crypto();
+      rli->relay_log.description_event_for_sql_thread
+
+->reset_crypto();
 
       if (relay_log_purge)
       {
@@ -8365,7 +8373,9 @@ bool rpl_master_has_bug(const Relay_log_info *rli, uint bug_id, bool report,
     {29621, { 10, 11,1  }, { 10, 11,3  } },
   };
   const Version &master_ver=
-    rli->relay_log.description_event_for_exec->server_version_split;
+    rli->relay_log.description_event_for_sql_thread
+
+->server_version_split;
   struct st_version_range_for_one_bug* versions_for_all_bugs= maria_master ?
     versions_for_our_bugs : versions_for_their_bugs;
   uint all_size= maria_master ?
@@ -8408,7 +8418,9 @@ bool rpl_master_has_bug(const Relay_log_info *rli, uint bug_id, bool report,
                       " that master be upgraded to a version at least"
                       " equal to '%d.%d.%d'. Then replication can be"
                       " restarted.",
-                      rli->relay_log.description_event_for_exec->server_version,
+                      rli->relay_log.description_event_for_sql_thread
+
+->server_version,
                       bug_source,
                       bug_id,
                       fixed_in[0], fixed_in[1], fixed_in[2]);
diff --git a/sql/sql_binlog.cc b/sql/sql_binlog.cc
index 63fe62d8a19d6..a22cda01b161d 100644
--- a/sql/sql_binlog.cc
+++ b/sql/sql_binlog.cc
@@ -33,7 +33,9 @@
 static int check_event_type(int type, Relay_log_info *rli)
 {
   Format_description_log_event *fd_event=
-    rli->relay_log.description_event_for_exec;
+    rli->relay_log.description_event_for_sql_thread
+
+;
 
   /*
     Convert event type id of certain old versions (see comment in
@@ -60,7 +62,9 @@ static int check_event_type(int type, Relay_log_info *rli)
       if we don't already have one.
     */
     if (!fd_event)
-      if (!(rli->relay_log.description_event_for_exec=
+      if (!(rli->relay_log.description_event_for_sql_thread
+
+=
             new Format_description_log_event(4)))
       {
         my_error(ER_OUTOFMEMORY, MYF(0), 1);
@@ -176,7 +180,9 @@ int binlog_defragment(THD *thd)
   BINLOG statement seen must be a base64 encoding of the
   Format_description_log_event, as outputted by mysqlbinlog.  This
   Format_description_log_event is cached in
-  rli->description_event_for_exec.
+  rli->description_event_for_sql_thread
+
+.
 
   @param thd Pointer to THD object for the client thread executing the
   statement.
@@ -319,7 +325,9 @@ void mysql_client_binlog_statement(THD* thd)
         goto end;
 
       ev= Log_event::read_log_event(bufptr, event_len, &error,
-                                    rli->relay_log.description_event_for_exec,
+                                    rli->relay_log.description_event_for_sql_thread
+
+,
                                     0);
 
       DBUG_PRINT("info",("binlog base64 err=%s", error));
diff --git a/sql/wsrep_applier.cc b/sql/wsrep_applier.cc
index 4ce644c52f79f..394cf4c08848a 100644
--- a/sql/wsrep_applier.cc
+++ b/sql/wsrep_applier.cc
@@ -80,7 +80,9 @@ wsrep_get_apply_format(THD* thd)
 
   DBUG_ASSERT(thd->wsrep_rgi);
 
-  return thd->wsrep_rgi->rli->relay_log.description_event_for_exec;
+  return thd->wsrep_rgi->rli->relay_log.description_event_for_sql_thread
+
+;
 }
 
 /* store error from rli */
diff --git a/sql/wsrep_high_priority_service.cc b/sql/wsrep_high_priority_service.cc
index ce3459db08e0e..39d283a310b72 100644
--- a/sql/wsrep_high_priority_service.cc
+++ b/sql/wsrep_high_priority_service.cc
@@ -67,9 +67,13 @@ static rpl_group_info* wsrep_relay_group_init(THD* thd, const char* log_fname)
 {
   Relay_log_info* rli= new Relay_log_info(false);
 
-  if (!rli->relay_log.description_event_for_exec)
+  if (!rli->relay_log.description_event_for_sql_thread
+
+)
   {
-    rli->relay_log.description_event_for_exec=
+    rli->relay_log.description_event_for_sql_thread
+
+=
       new Format_description_log_event(4);
   }