After review version.
Added a condition for MERGE tables. These do not have unique
indexes. But every key could be a unique key on the underlying
MyISAM table. So get the maximum key length for MERGE tables
instead of the maximum unique key length. This is used for
buffer allocation in write_record().


mysql-test/r/merge.result:
  Bug#10400 - Improperly-defined MERGE table crashes with INSERT ... ON DUPLICATE KEY UPDATE
  The test result.
mysql-test/t/merge.test:
  Bug#10400 - Improperly-defined MERGE table crashes with INSERT ... ON DUPLICATE KEY UPDATE
  The test case does not in all cases show the problem
  without the bugfix. The improper memory allocation
  might get through undetected in many cases.
sql/ha_myisammrg.h:
  Bug#10400 - Improperly-defined MERGE table crashes with INSERT ... ON DUPLICATE KEY UPDATE
  Set a table_flag for the MERGE engine telling that any index
  might be unique without being specified as such.
sql/handler.h:
  Bug#10400 - Improperly-defined MERGE table crashes with INSERT ... ON DUPLICATE KEY UPDATE
  Added a new table_flag telling that any index
  might be unique without being specified as such.
sql/sql_insert.cc:
  Bug#10400 - Improperly-defined MERGE table crashes with INSERT ... ON DUPLICATE KEY UPDATE
  Changed the freeing of the memory to be symmetric to its
  allocation (my_safe_alloc -> my_safe_afree).
  This is not directly related to the bug.
sql/table.cc:
  Bug#10400 - Improperly-defined MERGE table crashes with INSERT ... ON DUPLICATE KEY UPDATE
  Added a condition for MERGE tables. These do not have unique
  indexes. But every key could be a unique key on the underlying
  MyISAM table. So get the maximum key length for MERGE tables
  instead of the maximum unique key length. This is used for
  buffer allocation in write_record().