Bug #30417719 ASSERTION FAILURE: FSP0FSP.CC:2371:N_USED_NOT_FULL > 0 || N_TOTAL_NOT_FULL == 0

Problem:

The original fix for this bug at rb#23349 has an issue.  When the persistent
cursor is stored and restored, the position of the record could change. Also,
when the purge thread does an intermediate commit, it is possible that the
delete marked record is re-used.

Solution:

After persistent cursor is restored, reset the LOB reference to the correct
value.  Also, the callers need to be aware that the cursor position could be
changed.  Check if the clust_rec is re-used by checking the delete mark flag.

rb#23459 approved by Kuba <[email protected]>

Author: gurusami

storage/innobase/btr/btr0cur.cc

@@ -4720,10 +4720,32 @@ ibool btr_cur_pessimistic_delete(dberr_t *err, ibool has_reserved_extents,
   if (rec_offs_any_extern(offsets)) {
     lob::BtrContext btr_ctx(mtr, pcur, index, rec, offsets, block);
 
+    /* The following call will restart the btr_mtr, which could change the
+    cursor position. */
     btr_ctx.free_externally_stored_fields(trx_id, undo_no, rollback, rec_type);
 #ifdef UNIV_ZIP_DEBUG
     ut_a(!page_zip || page_zip_validate(page_zip, page, index));
 #endif /* UNIV_ZIP_DEBUG */
+
+    /* The cursor position could have changed now. */
+    if (pcur != nullptr) {
+      cursor = pcur->get_btr_cur();
+      block = btr_cur_get_block(cursor);
+      page = buf_block_get_frame(block);
+      rec = btr_cur_get_rec(cursor);
+      rec_offs_make_valid(rec, index, offsets);
+    }
+
+    /* While purging LOBs, there are intermediate mtr commits which releases
+    the latches.  In that duration, it is possible that the clust_rec is reused.
+    In such situation, don't proceed further. */
+    if (!rollback && rec_type != 0 &&
+        !rec_get_deleted_flag(rec, rec_offs_comp(offsets))) {
+      /* This is the purge thread.  For the purge thread, rec_type will have a
+       * valid value. */
+      ret = TRUE;
+      goto return_after_reservations;
+    }
   }
 
   if (UNIV_UNLIKELY(page_get_n_recs(page) < 2) &&

storage/innobase/include/lob0inf.h

@@ -1,6 +1,6 @@
 /*****************************************************************************
 
-Copyright (c) 2016, 2018, Oracle and/or its affiliates. All Rights Reserved.
+Copyright (c) 2016, 2019, Oracle and/or its affiliates. All Rights Reserved.
 
 This program is free software; you can redistribute it and/or modify it under
 the terms of the GNU General Public License, version 2.0, as published by the
@@ -78,19 +78,6 @@ ulint read(ReadContext *ctx, ref_t ref, ulint offset, ulint len, byte *buf);
 ulint z_read(lob::ReadContext *ctx, lob::ref_t ref, ulint offset, ulint len,
              byte *buf);
 
-/** Purge an LOB (either of compressed or uncompressed).
-@param[in]	ctx		the delete operation context information.
-@param[in]	index		clustered index in which LOB is present
-@param[in]	trxid		the transaction that is being purged.
-@param[in]	undo_no		during rollback to savepoint, purge only upto
-                                this undo number.
-@param[in]	ref		reference to LOB that is purged.
-@param[in]	rec_type	undo record type.
-@param[in]	uf		update done on the field. */
-void purge(lob::DeleteContext *ctx, dict_index_t *index, trx_id_t trxid,
-           undo_no_t undo_no, lob::ref_t ref, ulint rec_type,
-           const upd_field_t *uf);
-
 /** Print information about the given LOB.
 @param[in]  trx  the current transaction.
 @param[in]  index  the clust index that contains the LOB.

storage/innobase/include/lob0lob.h

@@ -1350,11 +1350,6 @@ struct Reader {
 /** The context information when the delete operation on LOB is
 taking place. */
 struct DeleteContext : public BtrContext {
-  DeleteContext(byte *field_ref)
-      : m_blobref(field_ref),
-        m_page_size(table() == nullptr ? get_page_size()
-                                       : dict_table_page_size(table())) {}
-
   /** Constructor. */
   DeleteContext(const BtrContext &btr, byte *field_ref, ulint field_no,
                 bool rollback)
@@ -1363,7 +1358,13 @@ struct DeleteContext : public BtrContext {
         m_field_no(field_no),
         m_rollback(rollback),
         m_page_size(table() == nullptr ? get_page_size()
-                                       : dict_table_page_size(table())) {}
+                                       : dict_table_page_size(table())) {
+    m_blobref.parse(m_blobref_mem);
+  }
+
+  bool is_ref_valid() const {
+    return (m_blobref_mem.m_page_no == m_blobref.page_no());
+  }
 
   /** Determine if it is compressed page format.
   @return true if compressed. */
@@ -1377,6 +1378,14 @@ struct DeleteContext : public BtrContext {
     return (DICT_TF_HAS_ATOMIC_BLOBS(flags));
   }
 
+  bool is_delete_marked() const {
+    rec_t *clust_rec = rec();
+    if (clust_rec == nullptr) {
+      return (true);
+    }
+    return (rec_get_deleted_flag(clust_rec, page_rec_is_comp(clust_rec)));
+  }
+
 #ifdef UNIV_DEBUG
   /** Validate the LOB reference object.
   @return true if valid, false otherwise. */
@@ -1390,7 +1399,6 @@ struct DeleteContext : public BtrContext {
     }
     return (true);
   }
-
 #endif /* UNIV_DEBUG */
 
   /** Acquire an x-latch on the index page containing the clustered
@@ -1410,6 +1418,9 @@ struct DeleteContext : public BtrContext {
   page_size_t m_page_size;
 
  private:
+  /** Memory copy of the original LOB reference. */
+  ref_mem_t m_blobref_mem;
+
   /** Obtain the page size from the tablespace flags.
   @return the page size. */
   page_size_t get_page_size() const {
@@ -1523,11 +1534,10 @@ ulint btr_rec_get_externally_stored_len(const rec_t *rec, const ulint *offsets);
 @param[in]	trxid		the transaction that is being purged.
 @param[in]	undo_no		during rollback to savepoint, purge only upto
                                 this undo number.
-@param[in]	ref		reference to LOB that is purged.
-@param[in]	rec_type	undo record type.*/
+@param[in]	rec_type	undo record type.
+@param[in]	uf		the update vector for the field. */
 void purge(lob::DeleteContext *ctx, dict_index_t *index, trx_id_t trxid,
-           undo_no_t undo_no, lob::ref_t ref, ulint rec_type,
-           const upd_field_t *uf);
+           undo_no_t undo_no, ulint rec_type, const upd_field_t *uf);
 
 /** Update a portion of the given LOB.
 @param[in]	ctx		update operation context information.

storage/innobase/lob/lob0lob.cc

@@ -244,7 +244,7 @@ dberr_t zReader::fetch() {
         if (m_rctx.m_page_no == FIL_NULL) {
           goto end_of_blob;
         }
-        /* fall through */
+      /* fall through */
       default:
         err = DB_FAIL;
         ib::error(ER_IB_MSG_630)
@@ -1060,9 +1060,7 @@ void BtrContext::free_updated_extern_fields(trx_id_t trx_id, undo_no_t undo_no,
       byte *field_ref = data + len - BTR_EXTERN_FIELD_REF_SIZE;
 
       DeleteContext ctx(*this, field_ref, ufield->field_no, rollback);
-
-      ref_t lobref(field_ref);
-      lob::purge(&ctx, m_index, trx_id, undo_no, lobref, 0, ufield);
+      lob::purge(&ctx, m_index, trx_id, undo_no, 0, ufield);
     }
   }
 }
@@ -1160,10 +1158,9 @@ void BtrContext::free_externally_stored_fields(trx_id_t trx_id,
       byte *field_ref = btr_rec_get_field_ref(m_rec, m_offsets, i);
 
       DeleteContext ctx(*this, field_ref, i, rollback);
-      ref_t lobref(field_ref);
 
       upd_field_t *uf = nullptr;
-      lob::purge(&ctx, m_index, trx_id, undo_no, lobref, rec_type, uf);
+      lob::purge(&ctx, m_index, trx_id, undo_no, rec_type, uf);
     }
   }
 }

storage/innobase/lob/lob0purge.cc

@@ -41,15 +41,14 @@ namespace lob {
 /** Rollback from undo log information.
 @param[in]	ctx	the delete operation context.
 @param[in]	index	the clustered index to which LOB belongs.
-@param[in]	ref	the LOB reference object.
 @param[in]	uf	the update vector of concerned field. */
 static void rollback_from_undolog(DeleteContext *ctx, dict_index_t *index,
-                                  ref_t &ref, const upd_field_t *uf) {
+                                  const upd_field_t *uf) {
   DBUG_TRACE;
 
   trx_t *trx = nullptr;
 
-  dberr_t err = apply_undolog(ctx->get_mtr(), trx, index, ref, uf);
+  dberr_t err = apply_undolog(ctx->get_mtr(), trx, index, ctx->m_blobref, uf);
   ut_a(err == DB_SUCCESS);
 }
 
@@ -59,21 +58,21 @@ static void rollback_from_undolog(DeleteContext *ctx, dict_index_t *index,
 @param[in]	trxid		the transaction that is being rolled back.
 @param[in]	undo_no		during rollback to savepoint, rollback only
                                 upto this undo number.
-@param[in]	ref		reference to LOB that is being rolled back.
 @param[in]	rec_type	undo record type.
 @param[in]	uf		update vector of the concerned field. */
 static void rollback(DeleteContext *ctx, dict_index_t *index, trx_id_t trxid,
-                     undo_no_t undo_no, ref_t &ref, ulint rec_type,
-                     const upd_field_t *uf) {
+                     undo_no_t undo_no, ulint rec_type, const upd_field_t *uf) {
   DBUG_TRACE;
 
+  ref_t &ref = ctx->m_blobref;
+
   ut_ad(ctx->m_rollback);
 
   if (uf != nullptr && uf->lob_diffs != nullptr && uf->lob_diffs->size() > 0) {
     /* Undo log contains changes done to the LOB.  This must have
     been a small change done to LOB.  Apply the undo log on the
     LOB.*/
-    rollback_from_undolog(ctx, index, ref, uf);
+    rollback_from_undolog(ctx, index, uf);
     return;
   }
 
@@ -181,12 +180,13 @@ static void rollback(DeleteContext *ctx, dict_index_t *index, trx_id_t trxid,
 @param[in]	trxid		the transaction that is being rolled back.
 @param[in]	undo_no		during rollback to savepoint, rollback only
                                 upto this undo number.
-@param[in]	ref		reference to LOB that is purged.
 @param[in]	rec_type	undo record type. */
 static void z_rollback(DeleteContext *ctx, dict_index_t *index, trx_id_t trxid,
-                       undo_no_t undo_no, ref_t &ref, ulint rec_type) {
+                       undo_no_t undo_no, ulint rec_type) {
   ut_ad(ctx->m_rollback);
 
+  ref_t &ref = ctx->m_blobref;
+
   mtr_t local_mtr;
   mtr_start(&local_mtr);
 
@@ -196,7 +196,7 @@ static void z_rollback(DeleteContext *ctx, dict_index_t *index, trx_id_t trxid,
   data should not be read. OTOH we do not ref.set_page_no(FIL_NULL, 0)
   until we delete all the pages, so that the recovery can use the reference to
   find the remaining parts of the LOB. */
-  ref.set_length(0, 0);
+  ref.set_length(0, nullptr);
   ctx->zblob_write_blobref(ctx->m_field_no, &local_mtr);
 
   page_no_t first_page_no = ref.page_no();
@@ -256,7 +256,7 @@ static void z_rollback(DeleteContext *ctx, dict_index_t *index, trx_id_t trxid,
   ut_ad(ctx->get_page_zip() != nullptr);
   /* We are done with cleaning up index entries for the given version, so now we
   can modify the reference, so that it is no longer reachable. */
-  ref.set_page_no(FIL_NULL, 0);
+  ref.set_page_no(FIL_NULL, nullptr);
   ut_ad(ref.length() == 0);
   ctx->x_latch_rec_page(&local_mtr);
   ctx->zblob_write_blobref(ctx->m_field_no, &local_mtr);
@@ -272,14 +272,14 @@ static void z_rollback(DeleteContext *ctx, dict_index_t *index, trx_id_t trxid,
 @param[in]	trxid		the transaction that is being purged.
 @param[in]	undo_no		during rollback to savepoint, purge only upto
                                 this undo number.
-@param[in]	ref		reference to LOB that is purged.
 @param[in]	rec_type	undo record type. */
 static void z_purge(DeleteContext *ctx, dict_index_t *index, trx_id_t trxid,
-                    undo_no_t undo_no, ref_t &ref, ulint rec_type) {
+                    undo_no_t undo_no, ulint rec_type) {
   const bool is_rollback = ctx->m_rollback;
+  ref_t &ref = ctx->m_blobref;
 
   if (is_rollback) {
-    z_rollback(ctx, index, trxid, undo_no, ref, rec_type);
+    z_rollback(ctx, index, trxid, undo_no, rec_type);
     return;
   }
 
@@ -366,21 +366,12 @@ static void z_purge(DeleteContext *ctx, dict_index_t *index, trx_id_t trxid,
   }
 }
 
-/** Purge an uncompressed LOB.
-@param[in]	ctx		the delete operation context information.
-@param[in]	index		clustered index in which LOB is present
-@param[in]	trxid		the transaction that is being purged.
-@param[in]	undo_no		during rollback to savepoint, purge only upto
-                                this undo number.
-@param[in]	ref		reference to LOB that is purged.
-@param[in]	rec_type	undo record type.
-@param[in]	uf		the update vector for the field. */
 void purge(DeleteContext *ctx, dict_index_t *index, trx_id_t trxid,
-           undo_no_t undo_no, ref_t ref, ulint rec_type,
-           const upd_field_t *uf) {
+           undo_no_t undo_no, ulint rec_type, const upd_field_t *uf) {
   DBUG_TRACE;
   mtr_t lob_mtr;
 
+  ref_t &ref = ctx->m_blobref;
   mtr_t *mtr = ctx->get_mtr();
   const mtr_log_t log_mode = mtr->get_log_mode();
   const bool is_rollback = ctx->m_rollback;
@@ -409,29 +400,46 @@ void purge(DeleteContext *ctx, dict_index_t *index, trx_id_t trxid,
     return;
   }
 
-  /* Below we will restart the btr_mtr.  Between the cursor store and restore,
-  it is possible that the position of the record changes and hence the lob
-  reference could become invalid.  To avoid this take the latches before
-  restarting the btr_mtr. */
-
-  mtr_start(&lob_mtr);
-  mtr_sx_lock(dict_index_get_lock(index), &lob_mtr);
-
+  /* The purpose of the following block is to ensure that the parent mtr does
+  not hold any redo log while creating child mtrs. */
   if (ctx->m_pcur != nullptr) {
+    /* Below we will restart the btr_mtr.  Between the cursor store and restore,
+    it is possible that the position of the record changes and hence the lob
+    reference could become invalid.  Reset it to correct value. */
     ctx->restart_mtr();
+    byte *field_ref = ctx->get_field_ref(ctx->m_field_no);
+    ref.set_ref(field_ref);
   } else {
+    /* Since pcur is not available, take latches to ensure that the record
+    position does not change.  We imitate the purge thread for the latches
+    taken and the order in which they are taken.  Kindly refer to the
+    function row_purge_upd_exist_or_extern_func(). */
+    mtr_start(&lob_mtr);
+    mtr_sx_lock(dict_index_get_lock(index), &lob_mtr);
+    btr_root_get(index, &lob_mtr);
     ctx->x_latch_rec_page(&lob_mtr);
     ctx->restart_mtr();
     mtr_sx_lock(dict_index_get_lock(index), mtr);
+    btr_root_get(index, mtr);
     ctx->x_latch_rec_page(mtr);
+    mtr_commit(&lob_mtr);
   }
-  mtr_commit(&lob_mtr);
 
-  space_id_t space_id = ref.space_id();
+  /* If rec_type is 0, it is not the purge operation. */
+  if (!is_rollback && rec_type != 0 && !ctx->is_delete_marked()) {
+    /* This is the purge operation. The delete marked clustered record has been
+    reused. Purge shouldn't proceed. */
+    return;
+  }
+
+  ut_ad(ctx->is_ref_valid());
 
+  space_id_t space_id = ref.space_id();
+  ut_ad(space_id == index->space_id());
   page_no_t first_page_no = ref.page_no();
   page_id_t page_id(space_id, first_page_no);
   page_size_t page_size(dict_table_page_size(index->table));
+
   page_type_t page_type =
       first_page_t::get_page_type(index, page_id, page_size);
 
@@ -445,14 +453,14 @@ void purge(DeleteContext *ctx, dict_index_t *index, trx_id_t trxid,
   }
 
   if (page_type == FIL_PAGE_TYPE_ZLOB_FIRST) {
-    z_purge(ctx, index, trxid, undo_no, ref, rec_type);
+    z_purge(ctx, index, trxid, undo_no, rec_type);
     return;
   }
 
   ut_a(page_type == FIL_PAGE_TYPE_LOB_FIRST);
 
   if (is_rollback) {
-    rollback(ctx, index, trxid, undo_no, ref, rec_type, uf);
+    rollback(ctx, index, trxid, undo_no, rec_type, uf);
     return;
   }
 

storage/innobase/row/row0purge.cc

@@ -805,13 +805,10 @@ static void row_purge_upd_exist_or_extern_func(
 
       lob::BtrContext btr_ctx(&mtr, NULL, index, NULL, NULL, block);
 
-      lob::DeleteContext ctx(btr_ctx, field_ref, 0, false);
-
-      lob::ref_t lobref(field_ref);
+      lob::DeleteContext ctx(btr_ctx, field_ref, ufield->field_no, false);
 
       lob::purge(&ctx, index, node->modifier_trx_id,
-                 trx_undo_rec_get_undo_no(undo_rec), lobref, node->rec_type,
-                 ufield);
+                 trx_undo_rec_get_undo_no(undo_rec), node->rec_type, ufield);
 
       mtr_commit(&mtr);
     }