const string& str = fp[0]->data()->getStrVal(row, isNull);

  if (isNull)

    return "";

  size_t strLen = str.length();

  const string& fromstr = fp[1]->data()->getStrVal(row, isNull);

  if (isNull)

    return "";

  if (fromstr.length() == 0)

    return str;

  size_t fromLen = fromstr.length();

  const string& tostr = fp[2]->data()->getStrVal(row, isNull);

  if (isNull)

    return "";

  size_t toLen = tostr.length();

  bool binaryCmp = (cs->state & MY_CS_BINSORT) || !cs->use_mb();

  string newstr;

  size_t pos = 0;

  if (binaryCmp)

  {

    // Count the number of fromstr in strend so we can reserve buffer space.

    int count = 0;

    do

    {

      ++count;

      pos = str.find(fromstr, pos + fromLen);

    } while (pos != string::npos);

    newstr.reserve(strLen + (count * ((int)toLen - (int)fromLen)) + 1); // <- the culprit.

    uint32_t i = 0;

    pos = str.find(fromstr);

    if (pos == string::npos)

      return str;

    // Move the stuff into newstr

    do

    {

      if (pos > i)

        newstr = newstr + str.substr(i, pos - i);

      newstr = newstr + tostr;

      i = pos + fromLen;

      pos = str.find(fromstr, i);

    } while (pos != string::npos);

    newstr = newstr + str.substr(i, string::npos);

  }

...