Merge 10.5 into 10.6

37 files changed, 123 insertions, 96 deletions

diff --git a/debian/salsa-ci.yml b/debian/salsa-ci.yml
index 5c959b6c86d..26118f19b65 100644
--- a/debian/salsa-ci.yml
+++ b/debian/salsa-ci.yml
@@ -732,8 +732,8 @@ mariadb.org-10.2 to mariadb-10.6 upgrade:
     # prepending with --defaults-file=/etc/mysql/debian.cnf is needed in upstream 5.5–10.3
     - mysql --defaults-file=/etc/mysql/debian.cnf --skip-column-names -e "SELECT @@version, @@version_comment"
     - echo 'SHOW DATABASES;' | mysql --defaults-file=/etc/mysql/debian.cnf
-    - mysql --defaults-file=/etc/mysql/debian.cnf -e "SELECT Host,User,plugin,authentication_string FROM user;" mysql
-    - mysql --defaults-file=/etc/mysql/debian.cnf -e "SELECT * FROM plugin;" mysql
+    - mysql --defaults-file=/etc/mysql/debian.cnf -e "SELECT * FROM mysql.global_priv; SHOW CREATE USER root@localhost; SHOW CREATE USER 'mariadb.sys'@localhost"
+    - mysql --defaults-file=/etc/mysql/debian.cnf -e "SELECT * FROM mysql.plugin; SHOW PLUGINS"
     - *test-install
     - service mysql status
     - sleep 5 # Give the mysql_upgrade a bit of time to complete before querying the server
diff --git a/extra/innochecksum.cc b/extra/innochecksum.cc
index 3b12e3e24ca..6ca68c47834 100644
--- a/extra/innochecksum.cc
+++ b/extra/innochecksum.cc
@@ -94,6 +94,9 @@ FILE*				log_file = NULL;
 /* Enabled for log write option. */
 static bool			is_log_enabled = false;
 
+static byte field_ref_zero_buf[UNIV_PAGE_SIZE_MAX];
+const byte *field_ref_zero = field_ref_zero_buf;
+
 #ifndef _WIN32
 /* advisory lock for non-window system. */
 struct flock			lk;
diff --git a/extra/mariabackup/xtrabackup.cc b/extra/mariabackup/xtrabackup.cc
index 0b0cd5f55e3..6e321dcb436 100644
--- a/extra/mariabackup/xtrabackup.cc
+++ b/extra/mariabackup/xtrabackup.cc
@@ -4479,6 +4479,14 @@ fail:
 		goto fail;
 	}
 
+
+	if (auto b = aligned_malloc(UNIV_PAGE_SIZE_MAX, 4096)) {
+		field_ref_zero = static_cast<byte*>(
+			memset_aligned<4096>(b, 0, UNIV_PAGE_SIZE_MAX));
+	} else {
+		goto fail;
+	}
+
         {
 	/* definition from recv_recovery_from_checkpoint_start() */
 	ulint		max_cp_field;
@@ -4493,14 +4501,17 @@ reread_log_header:
 
 	if (err != DB_SUCCESS) {
 		msg("Error: cannot read redo log header");
+unlock_and_fail:
 		mysql_mutex_unlock(&log_sys.mutex);
+free_and_fail:
+		aligned_free(const_cast<byte*>(field_ref_zero));
+		field_ref_zero = nullptr;
 		goto fail;
 	}
 
 	if (log_sys.log.format == 0) {
 		msg("Error: cannot process redo log before MariaDB 10.2.2");
-		mysql_mutex_unlock(&log_sys.mutex);
-		goto fail;
+		goto unlock_and_fail;
 	}
 
 	byte* buf = log_sys.checkpoint_buf;
@@ -4521,7 +4532,7 @@ reread_log_header:
 	xtrabackup_init_datasinks();
 
 	if (!select_history()) {
-		goto fail;
+		goto free_and_fail;
 	}
 
 	/* open the log file */
@@ -4530,12 +4541,13 @@ reread_log_header:
 	if (dst_log_file == NULL) {
 		msg("Error: failed to open the target stream for '%s'.",
 		    LOG_FILE_NAME);
-		goto fail;
+		goto free_and_fail;
 	}
 
 	/* label it */
-	byte MY_ALIGNED(OS_FILE_LOG_BLOCK_SIZE) log_hdr_buf[LOG_FILE_HDR_SIZE];
-	memset(log_hdr_buf, 0, sizeof log_hdr_buf);
+	byte* log_hdr_buf = static_cast<byte*>(
+		aligned_malloc(LOG_FILE_HDR_SIZE, OS_FILE_LOG_BLOCK_SIZE));
+	memset(log_hdr_buf, 0, LOG_FILE_HDR_SIZE);
 
 	byte *log_hdr_field = log_hdr_buf;
 	mach_write_to_4(LOG_HEADER_FORMAT + log_hdr_field, log_sys.log.format);
@@ -4564,11 +4576,13 @@ reread_log_header:
 			log_block_calc_checksum_crc32(log_hdr_field));
 
 	/* Write log header*/
-	if (ds_write(dst_log_file, log_hdr_buf, sizeof(log_hdr_buf))) {
+	if (ds_write(dst_log_file, log_hdr_buf, LOG_FILE_HDR_SIZE)) {
 		msg("error: write to logfile failed");
-		goto fail;
+		aligned_free(log_hdr_buf);
+		goto free_and_fail;
 	}
 
+	aligned_free(log_hdr_buf);
 	log_copying_running = true;
 	/* start io throttle */
 	if(xtrabackup_throttle) {
@@ -4586,7 +4600,7 @@ reread_log_header:
 		    " error %s.", ut_strerr(err));
 fail_before_log_copying_thread_start:
 		log_copying_running = false;
-		goto fail;
+		goto free_and_fail;
 	}
 
 	/* copy log file by current position */
@@ -4609,7 +4623,7 @@ fail_before_log_copying_thread_start:
 
 	/* FLUSH CHANGED_PAGE_BITMAPS call */
 	if (!flush_changed_page_bitmaps()) {
-		goto fail;
+		goto free_and_fail;
 	}
 
 	ut_a(xtrabackup_parallel > 0);
@@ -4677,6 +4691,9 @@ fail_before_log_copying_thread_start:
 	if (opt_log_innodb_page_corruption)
 		ok = corrupted_pages.print_to_file(MB_CORRUPTED_PAGES_FILE);
 
+	aligned_free(const_cast<byte*>(field_ref_zero));
+	field_ref_zero = nullptr;
+
 	if (!ok) {
 		goto fail;
 	}
diff --git a/mysql-test/main/crash_commit_before-master.opt b/mysql-test/main/crash_commit_before-master.opt
index 9bcf94dca97..f464a1013d7 100644
--- a/mysql-test/main/crash_commit_before-master.opt
+++ b/mysql-test/main/crash_commit_before-master.opt
@@ -1,3 +1,3 @@
---skip-stack-trace --skip-core-file
+--loose-skip-stack-trace --skip-core-file
 --default-storage-engine=MyISAM
 --loose-skip-innodb-file-per-table
diff --git a/mysql-test/main/myisam_crash_before_flush_keys-master.opt b/mysql-test/main/myisam_crash_before_flush_keys-master.opt
index 425fda95086..590d44a6d12 100644
--- a/mysql-test/main/myisam_crash_before_flush_keys-master.opt
+++ b/mysql-test/main/myisam_crash_before_flush_keys-master.opt
@@ -1 +1 @@
---skip-stack-trace --skip-core-file
+--loose-skip-stack-trace --skip-core-file
diff --git a/mysql-test/suite/binlog/t/binlog_index-master.opt b/mysql-test/suite/binlog/t/binlog_index-master.opt
index a1ad7417ad3..c3754b4d8d0 100644
--- a/mysql-test/suite/binlog/t/binlog_index-master.opt
+++ b/mysql-test/suite/binlog/t/binlog_index-master.opt
@@ -1 +1 @@
---skip-stack-trace --log-warnings=0 --log-bin=master-bin --log-bin-index=master-bin
+--loose-skip-stack-trace --log-warnings=0 --log-bin=master-bin --log-bin-index=master-bin
diff --git a/mysql-test/suite/binlog/t/binlog_mdev342-master.opt b/mysql-test/suite/binlog/t/binlog_mdev342-master.opt
index 425fda95086..590d44a6d12 100644
--- a/mysql-test/suite/binlog/t/binlog_mdev342-master.opt
+++ b/mysql-test/suite/binlog/t/binlog_mdev342-master.opt
@@ -1 +1 @@
---skip-stack-trace --skip-core-file
+--loose-skip-stack-trace --skip-core-file
diff --git a/mysql-test/suite/binlog/t/binlog_xa_recover.opt b/mysql-test/suite/binlog/t/binlog_xa_recover.opt
index 3c44f9fad10..f645a058a7b 100644
--- a/mysql-test/suite/binlog/t/binlog_xa_recover.opt
+++ b/mysql-test/suite/binlog/t/binlog_xa_recover.opt
@@ -1 +1 @@
---skip-stack-trace --skip-core-file --loose-debug-dbug=+d,xa_recover_expect_master_bin_000004
+--loose-skip-stack-trace --skip-core-file --loose-debug-dbug=+d,xa_recover_expect_master_bin_000004
diff --git a/mysql-test/suite/innodb/t/group_commit_binlog_pos-master.opt b/mysql-test/suite/innodb/t/group_commit_binlog_pos-master.opt
index 425fda95086..590d44a6d12 100644
--- a/mysql-test/suite/innodb/t/group_commit_binlog_pos-master.opt
+++ b/mysql-test/suite/innodb/t/group_commit_binlog_pos-master.opt
@@ -1 +1 @@
---skip-stack-trace --skip-core-file
+--loose-skip-stack-trace --skip-core-file
diff --git a/mysql-test/suite/innodb/t/group_commit_binlog_pos_no_optimize_thread-master.opt b/mysql-test/suite/innodb/t/group_commit_binlog_pos_no_optimize_thread-master.opt
index 18d43988ffd..b8c4666a730 100644
--- a/mysql-test/suite/innodb/t/group_commit_binlog_pos_no_optimize_thread-master.opt
+++ b/mysql-test/suite/innodb/t/group_commit_binlog_pos_no_optimize_thread-master.opt
@@ -1 +1 @@
---binlog-optimize-thread-scheduling=0 --skip-stack-trace --skip-core-file
+--binlog-optimize-thread-scheduling=0 --loose-skip-stack-trace --skip-core-file
diff --git a/mysql-test/suite/innodb/t/group_commit_crash-master.opt b/mysql-test/suite/innodb/t/group_commit_crash-master.opt
index 425fda95086..590d44a6d12 100644
--- a/mysql-test/suite/innodb/t/group_commit_crash-master.opt
+++ b/mysql-test/suite/innodb/t/group_commit_crash-master.opt
@@ -1 +1 @@
---skip-stack-trace --skip-core-file
+--loose-skip-stack-trace --skip-core-file
diff --git a/mysql-test/suite/innodb/t/group_commit_crash_no_optimize_thread-master.opt b/mysql-test/suite/innodb/t/group_commit_crash_no_optimize_thread-master.opt
index 18d43988ffd..b8c4666a730 100644
--- a/mysql-test/suite/innodb/t/group_commit_crash_no_optimize_thread-master.opt
+++ b/mysql-test/suite/innodb/t/group_commit_crash_no_optimize_thread-master.opt
@@ -1 +1 @@
---binlog-optimize-thread-scheduling=0 --skip-stack-trace --skip-core-file
+--binlog-optimize-thread-scheduling=0 --loose-skip-stack-trace --skip-core-file
diff --git a/mysql-test/suite/innodb/t/innodb_bug14147491-master.opt b/mysql-test/suite/innodb/t/innodb_bug14147491-master.opt
index 410738202bd..614dd9356f1 100644
--- a/mysql-test/suite/innodb/t/innodb_bug14147491-master.opt
+++ b/mysql-test/suite/innodb/t/innodb_bug14147491-master.opt
@@ -1,4 +1,4 @@
 --innodb_file_per_table=1
---skip-stack-trace
+--loose-skip-stack-trace
 --skip-core-file
 --loose-innodb_buffer_pool_load_at_startup=OFF
diff --git a/mysql-test/suite/maria/bulk_insert_crash.opt b/mysql-test/suite/maria/bulk_insert_crash.opt
index f85a8d9c973..ecc7a8e8d92 100644
--- a/mysql-test/suite/maria/bulk_insert_crash.opt
+++ b/mysql-test/suite/maria/bulk_insert_crash.opt
@@ -1,2 +1,2 @@
---skip-stack-trace --skip-core-file
+--loose-skip-stack-trace --skip-core-file
 --default-storage-engine=Aria
diff --git a/mysql-test/suite/maria/maria-gis-recovery.opt b/mysql-test/suite/maria/maria-gis-recovery.opt
index 58d0d012c54..839411b10b8 100644
--- a/mysql-test/suite/maria/maria-gis-recovery.opt
+++ b/mysql-test/suite/maria/maria-gis-recovery.opt
@@ -1 +1 @@
---skip-stack-trace --skip-core-file --loose-aria-log-dir-path=$MYSQLTEST_VARDIR/tmp
+--loose-skip-stack-trace --skip-core-file --loose-aria-log-dir-path=$MYSQLTEST_VARDIR/tmp
diff --git a/mysql-test/suite/maria/maria-recovery-big-master.opt b/mysql-test/suite/maria/maria-recovery-big-master.opt
index d24a11c924f..f5119bbce3f 100644
--- a/mysql-test/suite/maria/maria-recovery-big-master.opt
+++ b/mysql-test/suite/maria/maria-recovery-big-master.opt
@@ -1 +1 @@
---skip-stack-trace --skip-core-file --max_allowed_packet=32000000
+--loose-skip-stack-trace --skip-core-file --max_allowed_packet=32000000
diff --git a/mysql-test/suite/maria/maria-recovery-bitmap-master.opt b/mysql-test/suite/maria/maria-recovery-bitmap-master.opt
index 425fda95086..590d44a6d12 100644
--- a/mysql-test/suite/maria/maria-recovery-bitmap-master.opt
+++ b/mysql-test/suite/maria/maria-recovery-bitmap-master.opt
@@ -1 +1 @@
---skip-stack-trace --skip-core-file
+--loose-skip-stack-trace --skip-core-file
diff --git a/mysql-test/suite/maria/maria-recovery-master.opt b/mysql-test/suite/maria/maria-recovery-master.opt
index 58d0d012c54..839411b10b8 100644
--- a/mysql-test/suite/maria/maria-recovery-master.opt
+++ b/mysql-test/suite/maria/maria-recovery-master.opt
@@ -1 +1 @@
---skip-stack-trace --skip-core-file --loose-aria-log-dir-path=$MYSQLTEST_VARDIR/tmp
+--loose-skip-stack-trace --skip-core-file --loose-aria-log-dir-path=$MYSQLTEST_VARDIR/tmp
diff --git a/mysql-test/suite/maria/maria-recovery-rtree-ft-master.opt b/mysql-test/suite/maria/maria-recovery-rtree-ft-master.opt
index 425fda95086..590d44a6d12 100644
--- a/mysql-test/suite/maria/maria-recovery-rtree-ft-master.opt
+++ b/mysql-test/suite/maria/maria-recovery-rtree-ft-master.opt
@@ -1 +1 @@
---skip-stack-trace --skip-core-file
+--loose-skip-stack-trace --skip-core-file
diff --git a/mysql-test/suite/maria/maria-recovery2-master.opt b/mysql-test/suite/maria/maria-recovery2-master.opt
index ca9560676a5..eeb6de091fd 100644
--- a/mysql-test/suite/maria/maria-recovery2-master.opt
+++ b/mysql-test/suite/maria/maria-recovery2-master.opt
@@ -1 +1 @@
---skip-stack-trace --skip-core-file --loose-aria-log-dir-path=$MYSQLTEST_VARDIR/tmp --myisam-recover-options=
+--loose-skip-stack-trace --skip-core-file --loose-aria-log-dir-path=$MYSQLTEST_VARDIR/tmp --myisam-recover-options=
diff --git a/mysql-test/suite/maria/maria-recovery3-master.opt b/mysql-test/suite/maria/maria-recovery3-master.opt
index 58d0d012c54..839411b10b8 100644
--- a/mysql-test/suite/maria/maria-recovery3-master.opt
+++ b/mysql-test/suite/maria/maria-recovery3-master.opt
@@ -1 +1 @@
---skip-stack-trace --skip-core-file --loose-aria-log-dir-path=$MYSQLTEST_VARDIR/tmp
+--loose-skip-stack-trace --skip-core-file --loose-aria-log-dir-path=$MYSQLTEST_VARDIR/tmp
diff --git a/mysql-test/suite/parts/t/debug_innodb_crash-master.opt b/mysql-test/suite/parts/t/debug_innodb_crash-master.opt
index 4fa3cb12e29..b7f94e14e12 100644
--- a/mysql-test/suite/parts/t/debug_innodb_crash-master.opt
+++ b/mysql-test/suite/parts/t/debug_innodb_crash-master.opt
@@ -1 +1 @@
---loose-innodb-file-per-table=1 --skip-stack-trace --skip-core-file --loose-innodb-buffer-pool-size=32M
+--loose-innodb-file-per-table=1 --loose-skip-stack-trace --skip-core-file --loose-innodb-buffer-pool-size=32M
diff --git a/mysql-test/suite/parts/t/debug_myisam_crash-master.opt b/mysql-test/suite/parts/t/debug_myisam_crash-master.opt
index eadc9396657..826d7c97aae 100644
--- a/mysql-test/suite/parts/t/debug_myisam_crash-master.opt
+++ b/mysql-test/suite/parts/t/debug_myisam_crash-master.opt
@@ -1 +1 @@
---skip-stack-trace --skip-core-file --myisam-recover-options=off
+--loose-skip-stack-trace --skip-core-file --myisam-recover-options=off
diff --git a/mysql-test/suite/parts/t/partition_debug_innodb-master.opt b/mysql-test/suite/parts/t/partition_debug_innodb-master.opt
index 4fa3cb12e29..b7f94e14e12 100644
--- a/mysql-test/suite/parts/t/partition_debug_innodb-master.opt
+++ b/mysql-test/suite/parts/t/partition_debug_innodb-master.opt
@@ -1 +1 @@
---loose-innodb-file-per-table=1 --skip-stack-trace --skip-core-file --loose-innodb-buffer-pool-size=32M
+--loose-innodb-file-per-table=1 --loose-skip-stack-trace --skip-core-file --loose-innodb-buffer-pool-size=32M
diff --git a/mysql-test/suite/rpl/t/rpl_gtid_crash-master.opt b/mysql-test/suite/rpl/t/rpl_gtid_crash-master.opt
index 425fda95086..590d44a6d12 100644
--- a/mysql-test/suite/rpl/t/rpl_gtid_crash-master.opt
+++ b/mysql-test/suite/rpl/t/rpl_gtid_crash-master.opt
@@ -1 +1 @@
---skip-stack-trace --skip-core-file
+--loose-skip-stack-trace --skip-core-file
diff --git a/mysql-test/suite/rpl/t/rpl_gtid_crash_myisam-master.opt b/mysql-test/suite/rpl/t/rpl_gtid_crash_myisam-master.opt
index 32711eb9726..16d8af5b6f1 100644
--- a/mysql-test/suite/rpl/t/rpl_gtid_crash_myisam-master.opt
+++ b/mysql-test/suite/rpl/t/rpl_gtid_crash_myisam-master.opt
@@ -1 +1 @@
---skip-stack-trace --skip-core-file --skip-innodb
+--loose-skip-stack-trace --skip-core-file --skip-innodb
diff --git a/mysql-test/suite/rpl/t/rpl_parallel_temptable-master.opt b/mysql-test/suite/rpl/t/rpl_parallel_temptable-master.opt
index 425fda95086..590d44a6d12 100644
--- a/mysql-test/suite/rpl/t/rpl_parallel_temptable-master.opt
+++ b/mysql-test/suite/rpl/t/rpl_parallel_temptable-master.opt
@@ -1 +1 @@
---skip-stack-trace --skip-core-file
+--loose-skip-stack-trace --skip-core-file
diff --git a/mysys/crc32/crc32_arm64.c b/mysys/crc32/crc32_arm64.c
index 62606c7ddea..0e70c21812a 100644
--- a/mysys/crc32/crc32_arm64.c
+++ b/mysys/crc32/crc32_arm64.c
@@ -2,13 +2,13 @@
 #include <string.h>
 #include <stdint.h>
 
+static int pmull_supported;
+
 #if defined(HAVE_ARMV8_CRC)
 
 #if defined(__APPLE__)
 #include <sys/sysctl.h>
 
-static int pmull_supported;
-
 int crc32_aarch64_available(void)
 {
   int ret;
@@ -48,8 +48,6 @@ static unsigned long getauxval(unsigned int key)
 # define HWCAP_PMULL (1 << 4)
 #endif
 
-static int pmull_supported;
-
 /* ARM made crc32 default from ARMv8.1 but optional in ARMv8A
  * Runtime check API.
  */
diff --git a/storage/innobase/buf/buf0buf.cc b/storage/innobase/buf/buf0buf.cc
index dcd45a9fdca..cca630872ac 100644
--- a/storage/innobase/buf/buf0buf.cc
+++ b/storage/innobase/buf/buf0buf.cc
@@ -318,6 +318,12 @@ constexpr ulint	BUF_PAGE_READ_MAX_RETRIES= 100;
 read-ahead buffer.  (Divide buf_pool size by this amount) */
 constexpr uint32_t BUF_READ_AHEAD_PORTION= 32;
 
+/** A 64KiB buffer of NUL bytes, for use in assertions and checks,
+and dummy default values of instantly dropped columns.
+Initially, BLOB field references are set to NUL bytes, in
+dtuple_convert_big_rec(). */
+const byte *field_ref_zero;
+
 /** The InnoDB buffer pool */
 buf_pool_t buf_pool;
 buf_pool_t::chunk_t::map *buf_pool_t::chunk_t::map_reg;
@@ -571,7 +577,7 @@ static void buf_page_check_lsn(bool check_lsn, const byte* read_buf)
 @return whether the buffer is all zeroes */
 bool buf_is_zeroes(span<const byte> buf)
 {
-  ut_ad(buf.size() <= sizeof field_ref_zero);
+  ut_ad(buf.size() <= UNIV_PAGE_SIZE_MAX);
   return memcmp(buf.data(), field_ref_zero, buf.size()) == 0;
 }
 
@@ -1151,11 +1157,17 @@ bool buf_pool_t::create()
   ut_ad(srv_buf_pool_size % srv_buf_pool_chunk_unit == 0);
   ut_ad(!is_initialised());
   ut_ad(srv_buf_pool_size > 0);
+  ut_ad(!resizing);
+  ut_ad(!chunks_old);
+  ut_ad(!field_ref_zero);
 
   NUMA_MEMPOLICY_INTERLEAVE_IN_SCOPE;
 
-  ut_ad(!resizing);
-  ut_ad(!chunks_old);
+  if (auto b= aligned_malloc(UNIV_PAGE_SIZE_MAX, 4096))
+    field_ref_zero= static_cast<const byte*>
+      (memset_aligned<4096>(b, 0, UNIV_PAGE_SIZE_MAX));
+  else
+    return true;
 
   chunk_t::map_reg= UT_NEW_NOKEY(chunk_t::map());
 
@@ -1186,6 +1198,8 @@ bool buf_pool_t::create()
       chunks= nullptr;
       UT_DELETE(chunk_t::map_reg);
       chunk_t::map_reg= nullptr;
+      aligned_free(const_cast<byte*>(field_ref_zero));
+      field_ref_zero= nullptr;
       ut_ad(!is_initialised());
       return true;
     }
@@ -1301,6 +1315,8 @@ void buf_pool_t::close()
   io_buf.close();
   UT_DELETE(chunk_t::map_reg);
   chunk_t::map_reg= chunk_t::map_ref= nullptr;
+  aligned_free(const_cast<byte*>(field_ref_zero));
+  field_ref_zero= nullptr;
 }
 
 /** Try to reallocate a control block.
@@ -1326,6 +1342,7 @@ inline bool buf_pool_t::realloc(buf_block_t *block)
 	if (block->page.can_relocate()) {
 		memcpy_aligned<OS_FILE_LOG_BLOCK_SIZE>(
 			new_block->frame, block->frame, srv_page_size);
+		mysql_mutex_lock(&buf_pool.flush_list_mutex);
 		new (&new_block->page) buf_page_t(block->page);
 
 		/* relocate LRU list */
@@ -1385,6 +1402,7 @@ inline bool buf_pool_t::realloc(buf_block_t *block)
 			buf_flush_relocate_on_flush_list(&block->page,
 							 &new_block->page);
 		}
+		mysql_mutex_unlock(&buf_pool.flush_list_mutex);
 		block->page.set_corrupt_id();
 
 		/* set other flags of buf_block_t */
@@ -2780,12 +2798,14 @@ evict_from_pool:
 		/* Note: this is the uncompressed block and it is not
 		accessible by other threads yet because it is not in
 		any list or hash table */
+		mysql_mutex_lock(&buf_pool.flush_list_mutex);
 		buf_relocate(bpage, &block->page);
 
 		/* Set after buf_relocate(). */
 		block->page.set_buf_fix_count(1);
 
 		buf_flush_relocate_on_flush_list(bpage, &block->page);
+		mysql_mutex_unlock(&buf_pool.flush_list_mutex);
 
 		/* Buffer-fix, I/O-fix, and X-latch the block
 		for the duration of the decompression.
@@ -3243,8 +3263,10 @@ loop:
       }
 
       free_block->lock.x_lock();
+      mysql_mutex_lock(&buf_pool.flush_list_mutex);
       buf_relocate(&block->page, &free_block->page);
       buf_flush_relocate_on_flush_list(&block->page, &free_block->page);
+      mysql_mutex_unlock(&buf_pool.flush_list_mutex);
 
       free_block->page.set_state(BUF_BLOCK_FILE_PAGE);
       buf_unzip_LRU_add_block(free_block, FALSE);
diff --git a/storage/innobase/buf/buf0flu.cc b/storage/innobase/buf/buf0flu.cc
index 7f09e607c56..1ddea7be89e 100644
--- a/storage/innobase/buf/buf0flu.cc
+++ b/storage/innobase/buf/buf0flu.cc
@@ -289,43 +289,29 @@ buf_flush_relocate_on_flush_list(
 {
 	buf_page_t*	prev;
 
-	mysql_mutex_assert_owner(&buf_pool.mutex);
+	mysql_mutex_assert_owner(&buf_pool.flush_list_mutex);
 	ut_ad(!fsp_is_system_temporary(bpage->id().space()));
 
-	const lsn_t lsn = bpage->oldest_modification_acquire();
+	const lsn_t lsn = bpage->oldest_modification();
 
 	if (!lsn) {
 		return;
 	}
 
 	ut_ad(lsn == 1 || lsn > 2);
-
-	mysql_mutex_lock(&buf_pool.flush_list_mutex);
-
-	/* FIXME: Can we avoid holding buf_pool.mutex here? */
 	ut_ad(dpage->oldest_modification() == lsn);
 
-	if (ut_d(const lsn_t o_lsn =) bpage->oldest_modification()) {
-		ut_ad(o_lsn == lsn);
+	/* Important that we adjust the hazard pointer before removing
+	the bpage from the flush list. */
+	buf_pool.flush_hp.adjust(bpage);
 
-		/* Important that we adjust the hazard pointer before removing
-		the bpage from the flush list. */
-		buf_pool.flush_hp.adjust(bpage);
+	prev = UT_LIST_GET_PREV(list, bpage);
+	UT_LIST_REMOVE(buf_pool.flush_list, bpage);
 
-		prev = UT_LIST_GET_PREV(list, bpage);
-		UT_LIST_REMOVE(buf_pool.flush_list, bpage);
-
-		bpage->clear_oldest_modification();
-	} else {
-		/* bpage was removed from buf_pool.flush_list
-		since we last checked, and before we acquired
-		buf_pool.flush_list_mutex. */
-		goto was_clean;
-	}
+	bpage->clear_oldest_modification();
 
 	if (lsn == 1) {
 		buf_pool.stat.flush_list_bytes -= dpage->physical_size();
-was_clean:
 		dpage->list.prev = nullptr;
 		dpage->list.next = nullptr;
 		dpage->clear_oldest_modification();
@@ -337,7 +323,6 @@ was_clean:
 	}
 
 	ut_d(buf_flush_validate_low());
-	mysql_mutex_unlock(&buf_pool.flush_list_mutex);
 }
 
 /** Complete write of a file page from buf_pool.
diff --git a/storage/innobase/buf/buf0lru.cc b/storage/innobase/buf/buf0lru.cc
index ff53724c48a..a5b3cc72fc7 100644
--- a/storage/innobase/buf/buf0lru.cc
+++ b/storage/innobase/buf/buf0lru.cc
@@ -845,6 +845,7 @@ func_exit:
 	} else if (bpage->state() == BUF_BLOCK_FILE_PAGE) {
 		b = buf_page_alloc_descriptor();
 		ut_a(b);
+		mysql_mutex_lock(&buf_pool.flush_list_mutex);
 		new (b) buf_page_t(*bpage);
 		b->set_state(BUF_BLOCK_ZIP_PAGE);
 	}
@@ -859,6 +860,8 @@ func_exit:
 	ut_ad(bpage->can_relocate());
 
 	if (!buf_LRU_block_remove_hashed(bpage, id, hash_lock, zip)) {
+		ut_ad(!b);
+		mysql_mutex_assert_not_owner(&buf_pool.flush_list_mutex);
 		return(true);
 	}
 
@@ -872,8 +875,6 @@ func_exit:
 	if (UNIV_LIKELY_NULL(b)) {
 		buf_page_t*	prev_b	= UT_LIST_GET_PREV(LRU, b);
 
-		hash_lock->write_lock();
-
 		ut_ad(!buf_pool.page_hash_get_low(id, fold));
 		ut_ad(b->zip_size());
 
@@ -940,6 +941,7 @@ func_exit:
 		}
 
 		buf_flush_relocate_on_flush_list(bpage, b);
+		mysql_mutex_unlock(&buf_pool.flush_list_mutex);
 
 		bpage->zip.data = nullptr;
 
@@ -950,6 +952,8 @@ func_exit:
 		hash_lock. */
 		b->set_io_fix(BUF_IO_PIN);
 		hash_lock->write_unlock();
+	} else if (!zip) {
+		hash_lock->write_unlock();
 	}
 
 	buf_block_t* block = reinterpret_cast<buf_block_t*>(bpage);
@@ -1182,6 +1186,10 @@ static bool buf_LRU_block_remove_hashed(buf_page_t *bpage, const page_id_t id,
 		MEM_UNDEFINED(((buf_block_t*) bpage)->frame, srv_page_size);
 		bpage->set_state(BUF_BLOCK_REMOVE_HASH);
 
+		if (!zip) {
+			return true;
+		}
+
 		/* Question: If we release hash_lock here
 		then what protects us against:
 		1) Some other thread buffer fixing this page
@@ -1203,7 +1211,7 @@ static bool buf_LRU_block_remove_hashed(buf_page_t *bpage, const page_id_t id,
 		page_hash. */
 		hash_lock->write_unlock();
 
-		if (zip && bpage->zip.data) {
+		if (bpage->zip.data) {
 			/* Free the compressed page. */
 			void*	data = bpage->zip.data;
 			bpage->zip.data = NULL;
diff --git a/storage/innobase/handler/handler0alter.cc b/storage/innobase/handler/handler0alter.cc
index 62f9d103aa1..044b760bf04 100644
--- a/storage/innobase/handler/handler0alter.cc
+++ b/storage/innobase/handler/handler0alter.cc
@@ -526,7 +526,7 @@ inline bool dict_table_t::instant_column(const dict_table_t& table,
 		}
 
 		DBUG_ASSERT(c.is_added());
-		if (c.def_val.len <= sizeof field_ref_zero
+		if (c.def_val.len <= UNIV_PAGE_SIZE_MAX
 		    && (!c.def_val.len
 			|| !memcmp(c.def_val.data, field_ref_zero,
 				   c.def_val.len))) {
diff --git a/storage/innobase/include/buf0types.h b/storage/innobase/include/buf0types.h
index 18b6a91abe2..04b47aaddab 100644
--- a/storage/innobase/include/buf0types.h
+++ b/storage/innobase/include/buf0types.h
@@ -159,11 +159,11 @@ private:
   uint64_t m_id;
 };
 
-/** A field reference full of zero, for use in assertions and checks,
+/** A 64KiB buffer of NUL bytes, for use in assertions and checks,
 and dummy default values of instantly dropped columns.
-Initially, BLOB field references are set to zero, in
+Initially, BLOB field references are set to NUL bytes, in
 dtuple_convert_big_rec(). */
-extern const byte field_ref_zero[UNIV_PAGE_SIZE_MAX];
+extern const byte *field_ref_zero;
 
 #ifndef UNIV_INNOCHECKSUM
 
diff --git a/storage/innobase/include/log0log.h b/storage/innobase/include/log0log.h
index 0fe7b22fb04..ca792f9e439 100644
--- a/storage/innobase/include/log0log.h
+++ b/storage/innobase/include/log0log.h
@@ -623,9 +623,8 @@ public:
 					/*!< number of currently pending
 					checkpoint writes */
 
-	/** buffer for checkpoint header */
-	MY_ALIGNED(OS_FILE_LOG_BLOCK_SIZE)
-	byte		checkpoint_buf[OS_FILE_LOG_BLOCK_SIZE];
+  /** buffer for checkpoint header */
+  byte *checkpoint_buf;
 	/* @} */
 
 private:
diff --git a/storage/innobase/log/log0log.cc b/storage/innobase/log/log0log.cc
index f0dc7852c15..2757571b52c 100644
--- a/storage/innobase/log/log0log.cc
+++ b/storage/innobase/log/log0log.cc
@@ -216,6 +216,8 @@ void log_t::create()
   log_block_set_first_rec_group(buf, LOG_BLOCK_HDR_SIZE);
 
   buf_free= LOG_BLOCK_HDR_SIZE;
+  checkpoint_buf= static_cast<byte*>
+    (aligned_malloc(OS_FILE_LOG_BLOCK_SIZE, OS_FILE_LOG_BLOCK_SIZE));
 }
 
 mapped_file_t::~mapped_file_t() noexcept
@@ -458,8 +460,8 @@ void log_t::file::write_header_durable(lsn_t lsn)
   ut_ad(log_sys.log.format == log_t::FORMAT_10_5 ||
         log_sys.log.format == log_t::FORMAT_ENC_10_5);
 
-  // man 2 open suggests this buffer to be aligned by 512 for O_DIRECT
-  MY_ALIGNED(OS_FILE_LOG_BLOCK_SIZE) byte buf[OS_FILE_LOG_BLOCK_SIZE] = {0};
+  byte *buf= log_sys.checkpoint_buf;
+  memset_aligned<OS_FILE_LOG_BLOCK_SIZE>(buf, 0, OS_FILE_LOG_BLOCK_SIZE);
 
   mach_write_to_4(buf + LOG_HEADER_FORMAT, log_sys.log.format);
   mach_write_to_4(buf + LOG_HEADER_SUBFORMAT, log_sys.log.subformat);
@@ -472,7 +474,7 @@ void log_t::file::write_header_durable(lsn_t lsn)
 
   DBUG_PRINT("ib_log", ("write " LSN_PF, lsn));
 
-  log_sys.log.write(0, buf);
+  log_sys.log.write(0, {buf, OS_FILE_LOG_BLOCK_SIZE});
   if (!log_sys.log.writes_are_durable())
     log_sys.log.flush();
 }
@@ -878,7 +880,7 @@ ATTRIBUTE_COLD void log_write_checkpoint_info(lsn_t end_lsn)
 			      log_sys.next_checkpoint_lsn));
 
 	byte* buf = log_sys.checkpoint_buf;
-	memset(buf, 0, OS_FILE_LOG_BLOCK_SIZE);
+	memset_aligned<OS_FILE_LOG_BLOCK_SIZE>(buf, 0, OS_FILE_LOG_BLOCK_SIZE);
 
 	mach_write_to_8(buf + LOG_CHECKPOINT_NO, log_sys.next_checkpoint_no);
 	mach_write_to_8(buf + LOG_CHECKPOINT_LSN, log_sys.next_checkpoint_lsn);
@@ -1277,18 +1279,21 @@ void log_t::close()
 {
   ut_ad(this == &log_sys);
   if (!is_initialised()) return;
-  m_initialised = false;
+  m_initialised= false;
   log.close();
 
   ut_free_dodump(buf, srv_log_buffer_size);
-  buf = NULL;
+  buf= nullptr;
   ut_free_dodump(flush_buf, srv_log_buffer_size);
-  flush_buf = NULL;
+  flush_buf= nullptr;
 
   mysql_mutex_destroy(&mutex);
   mysql_mutex_destroy(&flush_order_mutex);
 
   recv_sys.close();
+
+  aligned_free(checkpoint_buf);
+  checkpoint_buf= nullptr;
 }
 
 std::string get_log_file_path(const char *filename)
diff --git a/storage/innobase/page/page0zip.cc b/storage/innobase/page/page0zip.cc
index ca73ede64ae..547204003eb 100644
--- a/storage/innobase/page/page0zip.cc
+++ b/storage/innobase/page/page0zip.cc
@@ -35,12 +35,6 @@ Created June 2005 by Marko Makela
 
 using st_::span;
 
-/** A BLOB field reference full of zero, for use in assertions and tests.
-Initially, BLOB field references are set to zero, in
-dtuple_convert_big_rec(). */
-alignas(UNIV_PAGE_SIZE_MIN)
-const byte field_ref_zero[UNIV_PAGE_SIZE_MAX] = { 0, };
-
 #ifndef UNIV_INNOCHECKSUM
 #include "mtr0log.h"
 #include "dict0dict.h"
@@ -92,16 +86,12 @@ static const byte supremum_extra_data alignas(4) [] = {
 };
 
 /** Assert that a block of memory is filled with zero bytes.
-Compare at most sizeof(field_ref_zero) bytes.
 @param b in: memory block
 @param s in: size of the memory block, in bytes */
-#define ASSERT_ZERO(b, s)			\
-	ut_ad(!memcmp(b, field_ref_zero,	\
-		      std::min<size_t>(s, sizeof field_ref_zero)));
+#define ASSERT_ZERO(b, s) ut_ad(!memcmp(b, field_ref_zero, s))
 /** Assert that a BLOB pointer is filled with zero bytes.
 @param b in: BLOB pointer */
-#define ASSERT_ZERO_BLOB(b) \
-	ut_ad(!memcmp(b, field_ref_zero, FIELD_REF_SIZE))
+#define ASSERT_ZERO_BLOB(b) ASSERT_ZERO(b, FIELD_REF_SIZE)
 
 /* Enable some extra debugging output.  This code can be enabled
 independently of any UNIV_ debugging conditions. */
diff --git a/storage/innobase/row/row0ins.cc b/storage/innobase/row/row0ins.cc
index dace6a43587..912d54bb03d 100644
--- a/storage/innobase/row/row0ins.cc
+++ b/storage/innobase/row/row0ins.cc
@@ -3445,7 +3445,7 @@ row_ins_index_entry_set_vals(
 				field->len = UNIV_SQL_NULL;
 				field->type.prtype = DATA_BINARY_TYPE;
 			} else {
-				ut_ad(col->len <= sizeof field_ref_zero);
+				ut_ad(col->len <= UNIV_PAGE_SIZE_MAX);
 				ut_ad(ind_field->fixed_len <= col->len);
 				dfield_set_data(field, field_ref_zero,
 						ind_field->fixed_len);