Merge 11.1 into 11.2

sql/sql_select.cc

@@ -11192,7 +11192,7 @@ double table_after_join_selectivity(JOIN *join, uint idx, JOIN_TAB *s,
   else
   {
     sel= records_out / pos->records_read;
-    DBUG_ASSERT(sel >= 0.0 and sel <= 1.00001);
+    DBUG_ASSERT(sel >= 0.0 && sel <= 1.00001);
     if (sel > 1.0)
       sel= 1.0;
   }

storage/innobase/buf/buf0buf.cc

@@ -2706,6 +2706,7 @@ buf_page_get_gen(
 		if (mode == BUF_PEEK_IF_IN_POOL) {
 ignore_block:
 			block->unfix();
+ignore_unfixed:
 			ut_ad(mode == BUF_GET_POSSIBLY_FREED
 			      || mode == BUF_PEEK_IF_IN_POOL);
 			if (err) {
@@ -2897,6 +2898,15 @@ buf_page_get_gen(
 #endif /* UNIV_DEBUG */
 	ut_ad(block->page.frame);
 
+	/* The state = block->page.state() may be stale at this point,
+	and in fact, at any point of time if we consider its
+	buffer-fix component. If the block is being read into the
+	buffer pool, it is possible that buf_page_t::read_complete()
+	will invoke buf_pool_t::corrupted_evict() and therefore
+	invalidate it (invoke buf_page_t::set_corrupt_id() and set the
+	state to FREED). Therefore, after acquiring the page latch we
+	must recheck the state. */
+
 	switch (rw_latch) {
 	case RW_NO_LATCH:
 		mtr->memo_push(block, MTR_MEMO_BUF_FIX);
@@ -2919,6 +2929,15 @@ buf_page_get_gen(
 	}
 
 	mtr->memo_push(block, mtr_memo_type_t(rw_latch));
+	state = block->page.state();
+
+	if (UNIV_UNLIKELY(state < buf_page_t::UNFIXED)) {
+		mtr->release_last_page();
+		goto ignore_unfixed;
+	}
+
+	ut_ad(state < buf_page_t::READ_FIX || state > buf_page_t::WRITE_FIX);
+
 #ifdef BTR_CUR_HASH_ADAPT
 	btr_search_drop_page_hash_index(block, true);
 #endif /* BTR_CUR_HASH_ADAPT */
@@ -2929,10 +2948,6 @@ buf_page_get_gen(
 	return block;
 }
 
-/********************************************************************//**
-This is the general function used to get optimistic access to a database
-page.
-@return TRUE if success */
 TRANSACTIONAL_TARGET
 buf_block_t *buf_page_optimistic_fix(buf_block_t *block, page_id_t id)
 {

storage/innobase/ibuf/ibuf0ibuf.cc

@@ -22,7 +22,6 @@ this program; if not, write to the Free Software Foundation, Inc.,
 Upgrade and removal of the InnoDB change buffer
 */
 
-#include <tuple>
 #include "ibuf0ibuf.h"
 #include "btr0sea.h"
 #include "btr0pcur.h"
@@ -257,8 +256,7 @@ ATTRIBUTE_COLD static dberr_t ibuf_remove_free_page(mtr_t &mtr)
 
   const uint32_t page_no= flst_get_last(PAGE_HEADER + PAGE_BTR_IBUF_FREE_LIST +
                                         root->page.frame).page;
-
-  if (page_no == FIL_NULL || page_no >= fil_system.sys_space->free_limit)
+  if (page_no == FIL_NULL)
   {
     mtr.set_modified(*root);
     fsp_init_file_page(fil_system.sys_space, root, &mtr);
@@ -266,6 +264,9 @@ ATTRIBUTE_COLD static dberr_t ibuf_remove_free_page(mtr_t &mtr)
     goto func_exit;
   }
 
+  if (page_no >= fil_system.sys_space->free_limit)
+    goto corrupted;
+
   /* Since pessimistic inserts were prevented, we know that the
   page is still in the free list. NOTE that also deletes may take
   pages from the free list, but they take them from the start, and
@@ -281,6 +282,7 @@ ATTRIBUTE_COLD static dberr_t ibuf_remove_free_page(mtr_t &mtr)
   if (page_no != flst_get_last(PAGE_HEADER + PAGE_BTR_IBUF_FREE_LIST +
                                root->page.frame).page)
   {
+  corrupted:
     err= DB_CORRUPTION;
     goto func_exit;
   }