MDEV-20100 MariaDB 13.3.9 Crash "[ERROR] mysqld got signal 11 ;"
Some functions on ha_partition call functions on all partitions, but handler->reset() is only called that pruned by m_partitions_to_reset. So Spider didn't clear pointer on unpruned partitions, if the unpruned partitions are used by next query, Spider reference the pointer that is already freed.
edfeb12...
by
Roman Nozdrin <email address hidden>
MDEV-23399 fixup: Remove double-free of a buffer page
In commit 7cffb5f6e8a231a041152447be8980ce35d2c9b8 we changed the
interface of buf_page_create() so that the free_block is allocated
by the caller. Both calls to buf_LRU_block_free_non_file_page()
should have been removed.
This caused an assertion failure 'block->page.state() == BUF_BLOCK_MEMORY'
in buf_LRU_block_free_non_file_page().
The bug only affected ROW_FORMAT=COMPRESSED pages.
MDEV-23973 Change buffer corruption when reallocating an recently freed page
After commit abb678b61894146fcb88eed7f4a5facf434aea7c
(a follow-up fix to MDEV-19514 to prevent potential hangs)
and MDEV-23399, the probability for hitting a dormant bug
that is related to MDEV-19514 was increased.
buf_page_create(): Call ibuf_merge_or_delete_for_page() also
when reusing a previously freed page.
InnoDB stores a 32-bit page number in page headers and in some
data structures, such as FIL_ADDR (consisting of a 32-bit page number
and a 16-bit byte offset within a page). For better compile-time
error detection and to reduce the memory footprint in some data
structures, let us use a uint32_t for the page number, instead
of ulint (size_t) which can be 64 bits.
