Merge lp:~laurynas-biveinis/percona-server/bug1227581 into lp:percona-server/5.6

[Laurynas Biveinis]

Fix bug 1227581 (InnoDB: Failing assertion: buf_page_in_file(bpage) in
file buf0flu.cc line 2674 | abort (sig=6) in
buf_pool_get_dirty_pages_count on ALTER TABLE).

The issue is that buf_LRU_free_page() may perform a flush list
relocation for a dirty zip page, making it possible to observe a page
in BUF_BLOCK_REMOVE_HASH state on the flush list between
buf_LRU_block_remove_hashed() and buf_flush_relocate_on_flush_list()
calls, if another thread reads flush list pages without the LRU list
mutex.

Places where a thread iterates through the flush list without the LRU
list mutex and does not expect to see a BUF_BLOCK_REMOVE_HASH page are
buf_pool_get_dirty_pages_count(), buf_do_flush_list_batch(), and
buf_get_latched_pages_number_instance(). The fix is to accept such
pages there:
- in buf_pool_get_dirty_pages_count() check such page as if it were
  BUF_BLOCK_FILE_PAGE;
- in buf_flush_page_and_try_neighbors(), called from
  buf_do_flush_list_batch(), do not attempt to flush such page.
- in buf_flush_set_hp(), also called from buf_do_flush_list_batch(),
  allow setting hazard pointer on such page.
- in buf_get_latched_pages_number_instance(), silently accept such
  page as BUF_BLOCK_FILE_PAGE.

http://jenkins.percona.com/job/percona-server-5.6-param/301/

[Laurynas Biveinis (laurynas-biveinis)]

Thread 1 (LWP 20662):
+bt
#0 0x000000363720c69c in pthread_kill () from /lib64/libpthread.so.0
#1 0x0000000000687c4e in handle_fatal_signal (sig=6) at /bzr/5.6-QA_dbg/Percona-Server-5.6.13-rc60.5/sql/signal_handler.cc:254
#2 <signal handler called>
#3 0x0000003636e328a5 in raise () from /lib64/libc.so.6
#4 0x0000003636e34085 in abort () from /lib64/libc.so.6
#5 0x0000000000b91582 in buf_page_get_space (bpage=<optimized out>) at /bzr/5.6-QA_dbg/Percona-Server-5.6.13-rc60.5/storage/innobase/include/buf0buf.ic:719
#6 buf_pool_get_dirty_pages_count (buf_pool=0x1eb78f8, id=84) at /bzr/5.6-QA_dbg/Percona-Server-5.6.13-rc60.5/storage/innobase/buf/buf0flu.cc:2688
#7 0x0000000000b994f4 in buf_flush_dirty_pages (buf_pool=0x1eb78f8, id=84, flush=false, trx=0x0) at /bzr/5.6-QA_dbg/Percona-Server-5.6.13-rc60.5/storage/innobase/buf/buf0lru.cc:728
#8 0x0000000000b9a1b8 in buf_LRU_remove_pages (trx=0x0, buf_remove=<optimized out>, id=84, buf_pool=0x1eb78f8) at /bzr/5.6-QA_dbg/Percona-Server-5.6.13-rc60.5/storage/innobase/buf/buf0lru.cc:908
#9 buf_LRU_flush_or_remove_pages (id=84, buf_remove=BUF_REMOVE_FLUSH_NO_WRITE, trx=0x0) at /bzr/5.6-QA_dbg/Percona-Server-5.6.13-rc60.5/storage/innobase/buf/buf0lru.cc:964
#10 0x0000000000bd6b5b in fil_delete_tablespace (id=84, buf_remove=BUF_REMOVE_FLUSH_NO_WRITE) at /bzr/5.6-QA_dbg/Percona-Server-5.6.13-rc60.5/storage/innobase/fil/fil0fil.cc:2753
#11 0x0000000000ad5df0 in row_drop_table_for_mysql (name=0x7fd828641901 "\260", <incomplete sequence \340>, trx=<optimized out>, drop_db=<optimized out>, nonatomic=<optimized out>) at /bzr/5.6-QA_dbg/Percona-Server-5.6.13-rc60.5/storage/innobase/row/row0mysql.cc:4242
#12 0x0000000000a0780f in ha_innobase::delete_table (this=<optimized out>, name=0x7fd828642dc0 "./test/trigger120626") at /bzr/5.6-QA_dbg/Percona-Server-5.6.13-rc60.5/storage/innobase/handler/ha_innodb.cc:10460
#13 0x00000000005c0e66 in ha_delete_table (thd=0x2656660, table_type=<optimized out>, path=0x7fd828642dc0 "./test/trigger120626", db=0x7fd7b0005410 "test", alias=0x7fd7b0004e68 "trigger120626", generate_warning=true) at /bzr/5.6-QA_dbg/Percona-Server-5.6.13-rc60.5/sql/handler.cc:2367
#14 0x000000000077e5de in mysql_rm_table_no_locks (thd=0x2656660, tables=0x7fd7b0004eb0, if_exists=true, drop_temporary=false, drop_view=false, dont_log_query=false) at /bzr/5.6-QA_dbg/Percona-Server-5.6.13-rc60.5/sql/sql_table.cc:2467
#15 0x000000000077f6f6 in mysql_rm_table (thd=0x2656660, tables=0x7fd7b0004eb0, if_exists=1 '\001', drop_temporary=0 '\000') at /bzr/5.6-QA_dbg/Percona-Server-5.6.13-rc60.5/sql/sql_table.cc:2163
#16 0x0000000000724cb2 in mysql_execute_command (thd=0x2656660) at /bzr/5.6-QA_dbg/Percona-Server-5.6.13-rc60.5/sql/sql_parse.cc:3931
#17 0x0000000000729108 in mysql_parse (thd=0x2656660, rawbuf=0x2658a50 "P#9\001", length=<optimized out>, parser_state=<optimized out>) at /bzr/5.6-QA_dbg/Percona-Server-5.6.13-rc60.5/sql/sql_parse.cc:6569
#18 0x000000000072a26c in dispatch_command (command=COM_QUERY, thd=0x2656660, packet=0x7fd828644910 "`fe\002", packet_length=61) at /bzr/5.6-QA_dbg/Percona-Server-5.6.13-rc60.5/sql/sql_parse.cc:1436
#19 0x000000000072b467 in do_command (thd=0x2656660) at /bzr/5.6-...

review: Needs Fixing

=== modified file 'Percona-Server/storage/innobase/buf/buf0buf.cc'
--- Percona-Server/storage/innobase/buf/buf0buf.cc	2013-09-20 05:27:28 +0000
+++ Percona-Server/storage/innobase/buf/buf0buf.cc	2013-09-25 05:21:27 +0000
@@ -4938,13 +4938,16 @@
 			break;
 		case BUF_BLOCK_FILE_PAGE:
 			/* uncompressed page */
+		case BUF_BLOCK_REMOVE_HASH:
+			/* We hold flush list but not LRU list mutex here.
+			Thus encountering BUF_BLOCK_REMOVE_HASH pages is
+			possible.  */
 			break;
 		case BUF_BLOCK_POOL_WATCH:
 		case BUF_BLOCK_ZIP_PAGE:
 		case BUF_BLOCK_NOT_USED:
 		case BUF_BLOCK_READY_FOR_USE:
 		case BUF_BLOCK_MEMORY:
-		case BUF_BLOCK_REMOVE_HASH:
 			ut_error;
 			break;
 		}
 
=== modified file 'Percona-Server/storage/innobase/buf/buf0flu.cc'
--- Percona-Server/storage/innobase/buf/buf0flu.cc	2013-09-20 05:27:28 +0000
+++ Percona-Server/storage/innobase/buf/buf0flu.cc	2013-09-25 05:21:27 +0000
@@ -141,7 +141,8 @@
 {
 	ut_ad(buf_flush_list_mutex_own(buf_pool));
 	ut_ad(buf_pool->flush_list_hp == NULL || bpage == NULL);
-	ut_ad(!bpage || buf_page_in_file(bpage));
+	ut_ad(!bpage || buf_page_in_file(bpage)
+	      || buf_page_get_state(bpage) == BUF_BLOCK_REMOVE_HASH);
 	ut_ad(!bpage || bpage->in_flush_list);
 	ut_ad(!bpage || buf_pool_from_bpage(bpage) == buf_pool);
 
@@ -1373,6 +1374,16 @@
 		mutex_enter(block_mutex);
 	}
 
+	if (UNIV_UNLIKELY(buf_page_get_state(bpage)
+			  == BUF_BLOCK_REMOVE_HASH)) {
+
+		/* In case we don't hold the LRU list mutex, we may see a page
+		that is about to be relocated on the flush list.  Do not
+		attempt to flush it.  */
+		ut_ad(flush_type == BUF_FLUSH_LIST);
+		return (flushed);
+	}
+
 	ut_a(buf_page_in_file(bpage));
 
 	if (buf_flush_ready_for_flush(bpage, flush_type)) {
@@ -2667,11 +2678,12 @@
 	     bpage != 0;
 	     bpage = UT_LIST_GET_NEXT(list, bpage)) {
 
-		ut_ad(buf_page_in_file(bpage));
+		ut_ad(buf_page_in_file(bpage)
+		      || buf_page_get_state(bpage) == BUF_BLOCK_REMOVE_HASH);
 		ut_ad(bpage->in_flush_list);
 		ut_ad(bpage->oldest_modification > 0);
 
-		if (buf_page_get_space(bpage) == id) {
+		if (bpage->space == id) {
 			++count;
 		}
 	}