MDEV-33588/MDEV-33325 after-merge fix

In the merge commit f9807aad
there were some omissions or errors.

ibuf_remove_free_page(): Return an error if the free list is corrupted
when removing the change buffer on an upgrade. A special 11.0 version of
commit 263932d5 would have been useful.

buf_page_get_gen(): Correctly handle the case that a page was being
concurrently read into the buffer pool and found out to be corrupted.
This was part of commit a4cda66e
but had been discarded in the merge.

Because MariaDB Server 11.0 has reached its end of life as of
commit 466ae1cf this fix is being applied
to the 11.1 branch.

storage/innobase/buf/buf0buf.cc

@@ -2706,6 +2706,7 @@ buf_page_get_gen(
 		if (mode == BUF_PEEK_IF_IN_POOL) {
 ignore_block:
 			block->unfix();
+ignore_unfixed:
 			ut_ad(mode == BUF_GET_POSSIBLY_FREED
 			      || mode == BUF_PEEK_IF_IN_POOL);
 			if (err) {
@@ -2897,6 +2898,15 @@ buf_page_get_gen(
 #endif /* UNIV_DEBUG */
 	ut_ad(block->page.frame);
 
+	/* The state = block->page.state() may be stale at this point,
+	and in fact, at any point of time if we consider its
+	buffer-fix component. If the block is being read into the
+	buffer pool, it is possible that buf_page_t::read_complete()
+	will invoke buf_pool_t::corrupted_evict() and therefore
+	invalidate it (invoke buf_page_t::set_corrupt_id() and set the
+	state to FREED). Therefore, after acquiring the page latch we
+	must recheck the state. */
+
 	switch (rw_latch) {
 	case RW_NO_LATCH:
 		mtr->memo_push(block, MTR_MEMO_BUF_FIX);
@@ -2919,6 +2929,15 @@ buf_page_get_gen(
 	}
 
 	mtr->memo_push(block, mtr_memo_type_t(rw_latch));
+	state = block->page.state();
+
+	if (UNIV_UNLIKELY(state < buf_page_t::UNFIXED)) {
+		mtr->release_last_page();
+		goto ignore_unfixed;
+	}
+
+	ut_ad(state < buf_page_t::READ_FIX || state > buf_page_t::WRITE_FIX);
+
 #ifdef BTR_CUR_HASH_ADAPT
 	btr_search_drop_page_hash_index(block, true);
 #endif /* BTR_CUR_HASH_ADAPT */
@@ -2929,10 +2948,6 @@ buf_page_get_gen(
 	return block;
 }
 
-/********************************************************************//**
-This is the general function used to get optimistic access to a database
-page.
-@return TRUE if success */
 TRANSACTIONAL_TARGET
 buf_block_t *buf_page_optimistic_fix(buf_block_t *block, page_id_t id)
 {

storage/innobase/ibuf/ibuf0ibuf.cc

@@ -22,7 +22,6 @@ this program; if not, write to the Free Software Foundation, Inc.,
 Upgrade and removal of the InnoDB change buffer
 */
 
-#include <tuple>
 #include "ibuf0ibuf.h"
 #include "btr0sea.h"
 #include "btr0pcur.h"
@@ -257,8 +256,7 @@ ATTRIBUTE_COLD static dberr_t ibuf_remove_free_page(mtr_t &mtr)
 
   const uint32_t page_no= flst_get_last(PAGE_HEADER + PAGE_BTR_IBUF_FREE_LIST +
                                         root->page.frame).page;
-
-  if (page_no == FIL_NULL || page_no >= fil_system.sys_space->free_limit)
+  if (page_no == FIL_NULL)
   {
     mtr.set_modified(*root);
     fsp_init_file_page(fil_system.sys_space, root, &mtr);
@@ -266,6 +264,9 @@ ATTRIBUTE_COLD static dberr_t ibuf_remove_free_page(mtr_t &mtr)
     goto func_exit;
   }
 
+  if (page_no >= fil_system.sys_space->free_limit)
+    goto corrupted;
+
   /* Since pessimistic inserts were prevented, we know that the
   page is still in the free list. NOTE that also deletes may take
   pages from the free list, but they take them from the start, and
@@ -281,6 +282,7 @@ ATTRIBUTE_COLD static dberr_t ibuf_remove_free_page(mtr_t &mtr)
   if (page_no != flst_get_last(PAGE_HEADER + PAGE_BTR_IBUF_FREE_LIST +
                                root->page.frame).page)
   {
+  corrupted:
     err= DB_CORRUPTION;
     goto func_exit;
   }
@@ -291,7 +293,7 @@ ATTRIBUTE_COLD static dberr_t ibuf_remove_free_page(mtr_t &mtr)
                        &mtr, &err))
     err= flst_remove(root, PAGE_HEADER + PAGE_BTR_IBUF_FREE_LIST,
                      block, PAGE_HEADER + PAGE_BTR_IBUF_FREE_LIST_NODE,
-		     fil_system.sys_space->free_limit, &mtr);
+                     fil_system.sys_space->free_limit, &mtr);
 
   if (err == DB_SUCCESS)
     buf_page_free(fil_system.sys_space, page_no, &mtr);