Merge 10.6 into 10.11

storage/innobase/buf/buf0buf.cc

@@ -3674,7 +3674,7 @@ buf_block_t*
 buf_page_create(fil_space_t *space, uint32_t offset,
                 ulint zip_size, mtr_t *mtr, buf_block_t *free_block) noexcept
 {
-  space->free_page(offset, false);
+  space->free_page<false>(offset);
   return buf_page_create_low({space->id, offset}, zip_size, mtr, free_block);
 }
 

storage/innobase/fil/fil0crypt.cc

@@ -2022,7 +2022,7 @@ static void fil_crypt_thread()
 #endif /* UNIV_PFS_THREAD */
 	mysql_mutex_lock(&fil_crypt_threads_mutex);
 	rotate_thread_t thr(srv_n_fil_crypt_threads_started++);
-	pthread_cond_signal(&fil_crypt_cond); /* signal that we started */
+	pthread_cond_broadcast(&fil_crypt_cond);
 
 	if (!thr.should_shutdown()) {
 		/* if we find a tablespace that is starting, skip over it
@@ -2094,7 +2094,7 @@ wait_for_work:
 
 	fil_crypt_return_iops(&thr);
 	srv_n_fil_crypt_threads_started--;
-	pthread_cond_signal(&fil_crypt_cond); /* signal that we stopped */
+	pthread_cond_broadcast(&fil_crypt_cond);
 	mysql_mutex_unlock(&fil_crypt_threads_mutex);
 
 	my_thread_end();

storage/innobase/fsp/fsp0fsp.cc

@@ -1673,8 +1673,7 @@ fseg_create(fil_space_t *space, ulint byte_offset, mtr_t *mtr, dberr_t *err,
 {
 	fseg_inode_t*	inode;
 	ib_id_t		seg_id;
-	uint32_t	n_reserved;
-	bool		reserved_extent = false;
+	uint32_t	n_reserved = 0;
 
 	DBUG_ENTER("fseg_create");
 
@@ -1702,16 +1701,16 @@ inode_alloc:
 	if (!inode) {
 		block = nullptr;
 reserve_extent:
-		if (!has_done_reservation && !reserved_extent) {
+		if (!has_done_reservation && !n_reserved) {
 			*err = fsp_reserve_free_extents(&n_reserved, space, 2,
 							FSP_NORMAL, mtr);
 			if (UNIV_UNLIKELY(*err != DB_SUCCESS)) {
 				DBUG_RETURN(nullptr);
 			}
 
+			ut_ad(n_reserved > 0);
 			/* Extents reserved successfully. So
 			try allocating the page or inode */
-			reserved_extent = true;
 			if (inode) {
 				goto page_alloc;
 			}
@@ -1781,7 +1780,8 @@ page_alloc:
 				       + block->page.frame, space->id);
 
 funct_exit:
-	if (!has_done_reservation && reserved_extent) {
+	if (n_reserved) {
+		ut_ad(!has_done_reservation);
 		space->release_free_extents(n_reserved);
 	}
 
@@ -2165,8 +2165,6 @@ take_hinted_page:
 		buf_block_t* block = fsp_alloc_free_page(
 			space, hint, mtr, init_mtr, err);
 
-		ut_ad(block || !has_done_reservation || *err);
-
 		if (block) {
 			/* Put the page in the fragment page array of the
 			segment */
@@ -2179,6 +2177,8 @@ take_hinted_page:
 			fseg_set_nth_frag_page_no(
 				seg_inode, iblock, n,
 				block->page.id().page_no(), mtr);
+		} else {
+			ut_ad(*err != DB_SUCCESS);
 		}
 
 		/* fsp_alloc_free_page() invoked fsp_init_file_page()

storage/innobase/fut/fut0lst.cc

@@ -281,12 +281,15 @@ dberr_t flst_add_last(buf_block_t *base, uint16_t boffset,
       return DB_CORRUPTION;
 
     buf_block_t *cur= add;
-    dberr_t err;
-    if (addr.page != add->page.id().page_no() &&
-        !(cur= buf_page_get_gen(page_id_t{add->page.id().space(), addr.page},
-                                add->zip_size(), RW_SX_LATCH, nullptr,
-                                BUF_GET_POSSIBLY_FREED, mtr, &err)))
-      return err;
+    if (addr.page != add->page.id().page_no())
+    {
+      dberr_t err;
+      cur= buf_page_get_gen(page_id_t{add->page.id().space(), addr.page},
+                            add->zip_size(), RW_SX_LATCH, nullptr,
+                            BUF_GET_POSSIBLY_FREED, mtr, &err);
+      if (!cur)
+        return err;
+    }
     return flst_insert_after(base, boffset, cur, addr.boffset,
                              add, aoffset, limit, mtr);
   }
@@ -382,16 +385,21 @@ dberr_t flst_remove(buf_block_t *base, uint16_t boffset,
                     prev_addr.page, prev_addr.boffset, mtr);
   else
   {
-    dberr_t err2;
-    if (next_addr.page == cur->page.id().page_no() ||
-        (cur= buf_page_get_gen(page_id_t(cur->page.id().space(),
-                                         next_addr.page),
-                               cur->zip_size(), RW_SX_LATCH, nullptr,
-                               BUF_GET_POSSIBLY_FREED, mtr, &err2)))
+    if (next_addr.page == cur->page.id().page_no())
+    write_addr:
       flst_write_addr(*cur, cur->page.frame + next_addr.boffset + FLST_PREV,
                       prev_addr.page, prev_addr.boffset, mtr);
-    else if (err == DB_SUCCESS)
-      err= err2;
+    else
+    {
+      dberr_t err2;
+      cur= buf_page_get_gen(page_id_t(cur->page.id().space(), next_addr.page),
+                            cur->zip_size(), RW_SX_LATCH, nullptr,
+                            BUF_GET_POSSIBLY_FREED, mtr, &err2);
+      if (cur)
+        goto write_addr;
+      if (err == DB_SUCCESS)
+        err= err2;
+    }
   }
 
   byte *len= &base->page.frame[boffset + FLST_LEN];

storage/innobase/handler/ha_innodb.cc

@@ -6842,12 +6842,12 @@ wsrep_store_key_val_for_row(
 						 wsrep_thd_query(thd));
 					true_len = buff_space;
 				}
+				memcpy(buff, normalized, true_len);
 				buff       += true_len;
 				buff_space -= true_len;
 			} else {
 				buff += key_len;
 			}
-			memcpy(buff, normalized, true_len);
 		} else {
 			/* Here we handle all other data types except the
 			true VARCHAR, BLOB and TEXT. Note that the column

storage/innobase/include/fil0fil.h

@@ -950,19 +950,16 @@ public:
   @retval nullptr if the tablespace is missing or inaccessible */
   static fil_space_t *get_for_write(uint32_t id) noexcept;
 
-  /** Add/remove the free page in the freed ranges list.
-  @param[in] offset     page number to be added
-  @param[in] free       true if page to be freed */
-  void free_page(uint32_t offset, bool add=true) noexcept
+  /** Add/remove a page in freed_ranges.
+  @tparam add   true=add, false=remove
+  @param offset page number */
+  template<bool add=true> void free_page(uint32_t offset) noexcept
   {
     std::lock_guard<std::mutex> freed_lock(freed_range_mutex);
     if (add)
-      return freed_ranges.add_value(offset);
-
-    if (freed_ranges.empty())
-      return;
-
-    return freed_ranges.remove_value(offset);
+      freed_ranges.add_value(offset);
+    else
+      freed_ranges.remove_value(offset);
   }
 
   /** Add the range of freed pages */

storage/innobase/log/log0recv.cc

@@ -2278,8 +2278,13 @@ void store_freed_or_init_rec(page_id_t page_id, bool freed) noexcept
   uint32_t page_no= page_id.page_no();
   if (space_id == TRX_SYS_SPACE || srv_is_undo_tablespace(space_id))
   {
-    if (srv_immediate_scrub_data_uncompressed)
-      fil_space_get(space_id)->free_page(page_no, freed);
+    if (!srv_immediate_scrub_data_uncompressed)
+      return;
+    fil_space_t *space= fil_space_get(space_id);
+    if (freed)
+      space->free_page<true>(page_no);
+    else
+      space->free_page<false>(page_no);
     return;
   }
 

storage/innobase/row/row0log.cc

@@ -2806,10 +2806,10 @@ process_next_block:
 			ut_ad(0);
 			goto unexpected_eof;
 		} else {
-			memcpy(index->online_log->head.buf, mrec,
-			       ulint(mrec_end - mrec));
-			mrec_end -= ulint(mrec - index->online_log->head.buf);
+			const size_t s = size_t(mrec_end - mrec);
+			memcpy(index->online_log->head.buf, mrec, s);
 			mrec = index->online_log->head.buf;
+			mrec_end = mrec + s;
 			goto process_next_block;
 		}
 	}
@@ -3698,10 +3698,10 @@ process_next_block:
 			ut_ad(0);
 			goto unexpected_eof;
 		} else {
-			memcpy(index->online_log->head.buf, mrec,
-			       ulint(mrec_end - mrec));
-			mrec_end -= ulint(mrec - index->online_log->head.buf);
+			const size_t s = size_t(mrec_end - mrec);
+			memcpy(index->online_log->head.buf, mrec, s);
 			mrec = index->online_log->head.buf;
+			mrec_end = mrec + s;
 			goto process_next_block;
 		}
 	}

storage/spider/mysql-test/spider/include/have_group_by_handler.inc

@@ -0,0 +1 @@
+# see .opt file

storage/spider/mysql-test/spider/include/have_group_by_handler.opt

@@ -0,0 +1 @@
+--loose_spider_disable_group_by_handler=0

storage/spider/mysql-test/spider/r/loop_check_long_var.result

@@ -0,0 +1,28 @@
+install plugin spider soname 'ha_spider';
+#
+# MDEV-38368 Spider crash on fake loop detection variables
+#
+set global spider_same_server_link=1;
+create server srv1
+foreign data wrapper mysql
+options (
+host 'localhost',
+user 'root',
+socket '$MASTER_1_MYSOCK'
+  );
+create table t1 (id int primary key, data varchar(255));
+insert into t1 values (1, 'test'), (2, 'data');
+create table st1 (id int primary key, data varchar(255)) engine=spider
+comment='wrapper "mysql", srv "srv1", table "t1"';
+set @`spider_lc_./test/st1` = concat('-', repeat('x', 900000), '-pid-tbl-');
+select * from st1 limit 1;
+id	data
+1	test
+drop table st1, t1;
+drop server srv1;
+uninstall plugin spider;
+Warnings:
+Warning	1620	Plugin is busy and will be uninstalled on shutdown
+drop tables mysql.spider_link_failed_log, mysql.spider_link_mon_servers, mysql.spider_tables, mysql.spider_table_crd, mysql.spider_table_position_for_recovery, mysql.spider_table_sts, mysql.spider_xa, mysql.spider_xa_failed_log, mysql.spider_xa_member;
+truncate mysql.func;
+# End of 10.6 tests

storage/spider/mysql-test/spider/t/loop_check_long_var.test

@@ -0,0 +1,36 @@
+# group by hander doesn't matter here, let's not run this test twice
+source include/have_group_by_handler.inc;
+
+install plugin spider soname 'ha_spider';
+
+--echo #
+--echo # MDEV-38368 Spider crash on fake loop detection variables
+--echo #
+
+set global spider_same_server_link=1;
+
+evalp create server srv1
+  foreign data wrapper mysql
+  options (
+    host 'localhost',
+    user 'root',
+    socket '$MASTER_1_MYSOCK'
+  );
+
+create table t1 (id int primary key, data varchar(255));
+insert into t1 values (1, 'test'), (2, 'data');
+
+create table st1 (id int primary key, data varchar(255)) engine=spider
+comment='wrapper "mysql", srv "srv1", table "t1"';
+
+set @`spider_lc_./test/st1` = concat('-', repeat('x', 900000), '-pid-tbl-');
+select * from st1 limit 1;
+
+drop table st1, t1;
+drop server srv1;
+
+uninstall plugin spider;
+drop tables mysql.spider_link_failed_log, mysql.spider_link_mon_servers, mysql.spider_tables, mysql.spider_table_crd, mysql.spider_table_position_for_recovery, mysql.spider_table_sts, mysql.spider_xa, mysql.spider_xa_failed_log, mysql.spider_xa_member;
+truncate mysql.func;
+
+--echo # End of 10.6 tests

storage/spider/spd_conn.cc

@@ -1236,7 +1236,7 @@ int spider_conn_queue_loop_check(
   */
   lex_str.length = top_share->path.length + SPIDER_SQL_LOP_CHK_PRM_PRF_LEN;
   buf_sz = lex_str.length + 2;
-  loop_check_buf = (char *) my_alloca(buf_sz);
+  loop_check_buf = (char *) my_safe_alloca(buf_sz);
   if (unlikely(!loop_check_buf))
   {
     DBUG_RETURN(HA_ERR_OUT_OF_MEM);
@@ -1303,7 +1303,7 @@ int spider_conn_queue_loop_check(
       from_str.length = tmp_name - lex_str.str + 1;
     }
   }
-  my_afree(loop_check_buf);
+  my_safe_afree(loop_check_buf, buf_sz);
   /*
     construct loop_check_buf as <from_str>-<cur>-<to_str> e.g.
     "-<mac>-<pid>-./test/t0--./test/t1-./test/t2", later used as
@@ -1319,7 +1319,7 @@ int spider_conn_queue_loop_check(
   to_str.str = path;
   DBUG_PRINT("info", ("spider to=%s", to_str.str));
   buf_sz = from_str.length + top_share->path.length + to_str.length + 3;
-  loop_check_buf = (char *) my_alloca(buf_sz);
+  loop_check_buf = (char *) my_safe_alloca(buf_sz);
   if (unlikely(!loop_check_buf))
   {
     DBUG_RETURN(HA_ERR_OUT_OF_MEM);
@@ -1370,7 +1370,7 @@ int spider_conn_queue_loop_check(
         lex_str.length + 2),
       NullS)
     )) {
-      my_afree(loop_check_buf);
+      my_safe_afree(loop_check_buf, buf_sz);
       goto error_alloc_loop_check;
     }
     lcptr->flag = 0;
@@ -1399,7 +1399,7 @@ int spider_conn_queue_loop_check(
     */
     if (unlikely(my_hash_insert(&conn->loop_checked, (uchar *) lcptr)))
     {
-      my_afree(loop_check_buf);
+      my_safe_afree(loop_check_buf, buf_sz);
       goto error_hash_insert;
     }
   } else {
@@ -1410,11 +1410,11 @@ int spider_conn_queue_loop_check(
       lcptr->flag |= SPIDER_LOP_CHK_IGNORED;
     }
     pthread_mutex_unlock(&conn->loop_check_mutex);
-    my_afree(loop_check_buf);
+    my_safe_afree(loop_check_buf, buf_sz);
     DBUG_PRINT("info", ("spider be sent or queued already"));
     DBUG_RETURN(0);
   }
-  my_afree(loop_check_buf);
+  my_safe_afree(loop_check_buf, buf_sz);
 
   if ((error_num = spider_conn_queue_and_merge_loop_check(conn, lcptr)))
   {