MDEV-29883 Deadlock between InnoDB statistics update and BLOB insert

This is a backport of commit 8b6a308e463f937eb8d2498b04967a222c83af90
from MariaDB Server 10.6.11. No attempt to reproduce the hang
in earlier an earlier version of MariaDB Server than 10.6 was made.

In each caller of fseg_n_reserved_pages() except ibuf_init_at_db_start()
which is a special case for ibuf.index at database startup, we must hold
an index latch that prevents concurrent allocation or freeing of index
pages.

Any operation that allocates or free pages that belong to an index tree
must first acquire an index latch in non-shared mode, and while
holding that, acquire an index root page latch in non-shared mode.

btr_get_size(), btr_get_size_and_reserved(): Assert that a strong enough
index latch is being held.

dict_stats_update_transient_for_index(),
dict_stats_analyze_index(): Acquire a strong enough index latch.

These operations had followed the same order of acquiring latches in
every InnoDB version since the very beginning
(commit c533308a158795f91247e9fe3c7304fa5e7d2b3c).

The hang was introduced in
commit 2e814d4702d71a04388386a9f591d14a35980bfe which imported
mysql/mysql-server@ac74632293bea967b352d1b472abedeeaa921b98
which failed to strengthen the locking requirements of the function
btr_get_size().

3 files changed, 7 insertions, 7 deletions

diff --git a/storage/innobase/btr/btr0btr.cc b/storage/innobase/btr/btr0btr.cc
index f041e35e501..6b575885f81 100644
--- a/storage/innobase/btr/btr0btr.cc
+++ b/storage/innobase/btr/btr0btr.cc
@@ -603,7 +603,7 @@ btr_get_size(
 
 	ut_ad(srv_read_only_mode
 	      || mtr_memo_contains(mtr, dict_index_get_lock(index),
-				   MTR_MEMO_S_LOCK));
+				   MTR_MEMO_SX_LOCK));
 
 	if (index->page == FIL_NULL
 	    || dict_index_is_online_ddl(index)
@@ -657,7 +657,7 @@ btr_get_size_and_reserved(
 	ulint		dummy;
 
 	ut_ad(mtr_memo_contains(mtr, dict_index_get_lock(index),
-				MTR_MEMO_S_LOCK));
+				MTR_MEMO_SX_LOCK));
 
 	ut_a(flag == BTR_N_LEAF_PAGES || flag == BTR_TOTAL_SIZE);
 
diff --git a/storage/innobase/dict/dict0defrag_bg.cc b/storage/innobase/dict/dict0defrag_bg.cc
index 7c6f5d75b5d..9cc23a89c1b 100644
--- a/storage/innobase/dict/dict0defrag_bg.cc
+++ b/storage/innobase/dict/dict0defrag_bg.cc
@@ -1,6 +1,6 @@
 /*****************************************************************************
 
-Copyright (c) 2016, 2019, MariaDB Corporation.
+Copyright (c) 2016, 2022, MariaDB Corporation.
 
 This program is free software; you can redistribute it and/or modify it under
 the terms of the GNU General Public License as published by the Free Software
@@ -282,7 +282,7 @@ dict_stats_save_defrag_stats(
 	ulint	n_leaf_pages;
 	ulint	n_leaf_reserved;
 	mtr.start();
-	mtr_s_lock_index(index, &mtr);
+	mtr_sx_lock_index(index, &mtr);
 	n_leaf_reserved = btr_get_size_and_reserved(index, BTR_N_LEAF_PAGES,
 						    &n_leaf_pages, &mtr);
 	mtr.commit();
diff --git a/storage/innobase/dict/dict0stats.cc b/storage/innobase/dict/dict0stats.cc
index e36e2184e2d..b74edee5669 100644
--- a/storage/innobase/dict/dict0stats.cc
+++ b/storage/innobase/dict/dict0stats.cc
@@ -1,7 +1,7 @@
 /*****************************************************************************
 
 Copyright (c) 2009, 2019, Oracle and/or its affiliates. All Rights Reserved.
-Copyright (c) 2015, 2021, MariaDB Corporation.
+Copyright (c) 2015, 2022, MariaDB Corporation.
 
 This program is free software; you can redistribute it and/or modify it under
 the terms of the GNU General Public License as published by the Free Software
@@ -852,7 +852,7 @@ dict_stats_update_transient_for_index(
 		ulint	size;
 
 		mtr.start();
-		mtr_s_lock_index(index, &mtr);
+		mtr_sx_lock_index(index, &mtr);
 		size = btr_get_size(index, BTR_TOTAL_SIZE, &mtr);
 
 		if (size != ULINT_UNDEFINED) {
@@ -1945,7 +1945,7 @@ static index_stats_t dict_stats_analyze_index(dict_index_t* index)
 	DEBUG_PRINTF("  %s(index=%s)\n", __func__, index->name());
 
 	mtr.start();
-	mtr_s_lock_index(index, &mtr);
+	mtr_sx_lock_index(index, &mtr);
 	size = btr_get_size(index, BTR_TOTAL_SIZE, &mtr);
 
 	if (size != ULINT_UNDEFINED) {