Merge 10.5 into 10.6

10 files changed, 111 insertions, 8 deletions

diff --git a/mysql-test/main/func_json.result b/mysql-test/main/func_json.result
index 45a75ab082c..c963fdc966d 100644
--- a/mysql-test/main/func_json.result
+++ b/mysql-test/main/func_json.result
@@ -1623,6 +1623,21 @@ id	doc
 {"$oid":"611c0a463b150154132f6636"}	{ "_id" : { "$oid" : "611c0a463b150154132f6636" }, "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : [ { "a" : 1.0 } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] } ] }
 DROP TABLE arrNestTest;
 #
+# MDEV-30412 JSON_OBJECTAGG doesn't escape double quote in key
+#
+SELECT JSON_OBJECTAGG('"', 1);
+JSON_OBJECTAGG('"', 1)
+{"\"":1}
+SELECT JSON_OBJECTAGG('\"', 1);
+JSON_OBJECTAGG('\"', 1)
+{"\"":1}
+SELECT JSON_OBJECTAGG('\\', 1);
+JSON_OBJECTAGG('\\', 1)
+{"\\":1}
+#
+# End of 10.5 tests
+#
+#
 # MDEV-26054 Server crashes in Item_func_json_arrayagg::get_str_from_field
 #
 CREATE TABLE t (a VARCHAR(8));
@@ -1649,5 +1664,5 @@ JSON_INSERT(JSON_OBJECT(l1, l2, l3, l4), '$.k3', 'v3')	JSON_SET(JSON_OBJECT(l1,
 {"k1": "v1", "k2": "v2", "k3": "v3"}	{"k1": "v1", "k2": "new v2"}	{"k1": "v1", "k2": "new v2"}
 DROP TABLE t;
 #
-# End of 10.5 tests
+# End of 10.6 tests
 #
diff --git a/mysql-test/main/func_json.test b/mysql-test/main/func_json.test
index cbc6156a8c7..464e7d762d8 100644
--- a/mysql-test/main/func_json.test
+++ b/mysql-test/main/func_json.test
@@ -1068,6 +1068,18 @@ SELECT * FROM arrNestTest;
 DROP TABLE arrNestTest;
 
 --echo #
+--echo # MDEV-30412 JSON_OBJECTAGG doesn't escape double quote in key
+--echo #
+
+SELECT JSON_OBJECTAGG('"', 1);
+SELECT JSON_OBJECTAGG('\"', 1);
+SELECT JSON_OBJECTAGG('\\', 1);
+
+--echo #
+--echo # End of 10.5 tests
+--echo #
+
+--echo #
 --echo # MDEV-26054 Server crashes in Item_func_json_arrayagg::get_str_from_field
 --echo #
 
@@ -1078,7 +1090,6 @@ SELECT JSON_ARRAYAGG(a) AS f FROM v;
 DROP VIEW v;
 DROP TABLE t;
 
-
 --echo #
 --echo # MDEV-29264 JSON functions overflow error based ON LONGTEXT field
 --echo #
@@ -1090,6 +1101,5 @@ SELECT JSON_INSERT(JSON_OBJECT(l1, l2, l3, l4), '$.k3', 'v3'),JSON_SET(JSON_OBJE
 DROP TABLE t;
 
 --echo #
---echo # End of 10.5 tests
+--echo # End of 10.6 tests
 --echo #
-
diff --git a/mysql-test/suite/innodb/r/alter_copy.result b/mysql-test/suite/innodb/r/alter_copy.result
index 72ae28e9652..8c9e5966b2e 100644
--- a/mysql-test/suite/innodb/r/alter_copy.result
+++ b/mysql-test/suite/innodb/r/alter_copy.result
@@ -51,7 +51,7 @@ ADD INDEX(a,b,d), ADD INDEX(a,d,b), ADD INDEX(b,c,d), ADD INDEX(b,d,c),
 ALGORITHM=COPY;
 connection default;
 SET DEBUG_SYNC='now WAIT_FOR hung';
-# restart: --innodb-force-recovery=3
+# restart: --innodb-force-recovery=3 --debug_dbug=+d,recv_ran_out_of_buffer
 disconnect hang;
 FTS_INDEX_1.ibd
 FTS_INDEX_2.ibd
diff --git a/mysql-test/suite/innodb/r/recovery_memory.result b/mysql-test/suite/innodb/r/recovery_memory.result
index 4fa31009130..6faea097616 100644
--- a/mysql-test/suite/innodb/r/recovery_memory.result
+++ b/mysql-test/suite/innodb/r/recovery_memory.result
@@ -1,3 +1,7 @@
+call mtr.add_suppression("InnoDB: The change buffer is corrupted");
+call mtr.add_suppression("InnoDB: Plugin initialization aborted at srv0start.cc");
+call mtr.add_suppression("Plugin 'InnoDB' init function returned error");
+call mtr.add_suppression("Plugin 'InnoDB' registration as a STORAGE ENGINE failed.");
 CREATE TABLE t1(c TEXT, KEY(c(3072)))ENGINE=InnoDB;
 CREATE PROCEDURE dorepeat()
 LOOP
@@ -10,3 +14,19 @@ CALL dorepeat();
 connection default;
 # restart: --innodb_buffer_pool_size=5242880
 DROP TABLE t1;
+DROP PROCEDURE dorepeat;
+#
+# MDEV-30552  InnoDB recovery crashes when error
+#        handling scenario
+#
+SET DEBUG_DBUG="+d,ib_log_checkpoint_avoid_hard";
+CREATE TABLE t1(f1 INT NOT NULL)ENGINE=InnoDB;
+INSERT INTO t1 SELECT * FROM seq_1_to_65536;
+# restart: --innodb_buffer_pool_size=5242880 --debug_dbug=+d,ibuf_init_corrupt
+# restart
+SHOW CREATE TABLE t1;
+Table	Create Table
+t1	CREATE TABLE `t1` (
+  `f1` int(11) NOT NULL
+) ENGINE=InnoDB DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci
+DROP TABLE t1;
diff --git a/mysql-test/suite/innodb/t/alter_copy.test b/mysql-test/suite/innodb/t/alter_copy.test
index 90f2171d10b..b62f812f4b7 100644
--- a/mysql-test/suite/innodb/t/alter_copy.test
+++ b/mysql-test/suite/innodb/t/alter_copy.test
@@ -57,7 +57,7 @@ ALTER TABLE t ADD INDEX(b,c,d,a),ADD INDEX(b,c,a,d),ADD INDEX(b,a,c,d),ADD INDEX
 connection default;
 SET DEBUG_SYNC='now WAIT_FOR hung';
 let $shutdown_timeout=0;
---let $restart_parameters= --innodb-force-recovery=3
+--let $restart_parameters= --innodb-force-recovery=3 --debug_dbug="+d,recv_ran_out_of_buffer"
 --source include/restart_mysqld.inc
 disconnect hang;
 let $shutdown_timeout=;
diff --git a/mysql-test/suite/innodb/t/recovery_memory.test b/mysql-test/suite/innodb/t/recovery_memory.test
index d9afd52c499..e723ba25d36 100644
--- a/mysql-test/suite/innodb/t/recovery_memory.test
+++ b/mysql-test/suite/innodb/t/recovery_memory.test
@@ -1,5 +1,10 @@
 --source include/have_innodb.inc
 --source include/big_test.inc
+--source include/have_sequence.inc
+call mtr.add_suppression("InnoDB: The change buffer is corrupted");
+call mtr.add_suppression("InnoDB: Plugin initialization aborted at srv0start.cc");
+call mtr.add_suppression("Plugin 'InnoDB' init function returned error");
+call mtr.add_suppression("Plugin 'InnoDB' registration as a STORAGE ENGINE failed.");
 CREATE TABLE t1(c TEXT, KEY(c(3072)))ENGINE=InnoDB;
 DELIMITER |;
 
@@ -19,3 +24,19 @@ let $shutdown_timeout=0;
 let $restart_parameters=--innodb_buffer_pool_size=5242880;
 --source include/restart_mysqld.inc
 DROP TABLE t1;
+DROP PROCEDURE dorepeat;
+
+--echo #
+--echo # MDEV-30552  InnoDB recovery crashes when error
+--echo #        handling scenario
+--echo #
+SET DEBUG_DBUG="+d,ib_log_checkpoint_avoid_hard";
+CREATE TABLE t1(f1 INT NOT NULL)ENGINE=InnoDB;
+INSERT INTO t1 SELECT * FROM seq_1_to_65536;
+let $shutdown_timeout=0;
+let $restart_parameters=--innodb_buffer_pool_size=5242880 --debug_dbug="+d,ibuf_init_corrupt";
+--source include/restart_mysqld.inc
+let $restart_parameters=;
+--source include/restart_mysqld.inc
+SHOW CREATE TABLE t1;
+DROP TABLE t1;
diff --git a/sql/item_jsonfunc.cc b/sql/item_jsonfunc.cc
index 34b146c942b..3425f620dda 100644
--- a/sql/item_jsonfunc.cc
+++ b/sql/item_jsonfunc.cc
@@ -4083,7 +4083,7 @@ bool Item_func_json_objectagg::add()
     result.append(STRING_WITH_LEN(", "));
 
   result.append('"');
-  result.append(*key);
+  st_append_escaped(&result,key);
   result.append(STRING_WITH_LEN("\":"));
 
   buf.length(0);
diff --git a/storage/innobase/buf/buf0lru.cc b/storage/innobase/buf/buf0lru.cc
index ed638e254da..2c1f717fb9f 100644
--- a/storage/innobase/buf/buf0lru.cc
+++ b/storage/innobase/buf/buf0lru.cc
@@ -397,6 +397,11 @@ buf_block_t *buf_LRU_get_free_block(bool have_mutex)
 		mysql_mutex_assert_owner(&buf_pool.mutex);
 		goto got_mutex;
 	}
+	DBUG_EXECUTE_IF("recv_ran_out_of_buffer",
+			if (recv_recovery_is_on()
+			    && recv_sys.apply_log_recs) {
+				goto flush_lru;
+			});
 	mysql_mutex_lock(&buf_pool.mutex);
 got_mutex:
 	buf_LRU_check_size_of_non_data_objects();
@@ -482,7 +487,9 @@ not_found:
 	removing the block from buf_pool.page_hash and buf_pool.LRU is fairly
 	involved (particularly in case of ROW_FORMAT=COMPRESSED pages). We
 	can do that in a separate patch sometime in future. */
-
+#ifndef DBUG_OFF
+flush_lru:
+#endif
 	if (!buf_flush_LRU(innodb_lru_flush_size)) {
 		MONITOR_INC(MONITOR_LRU_SINGLE_FLUSH_FAILURE_COUNT);
 		++flush_failures;
diff --git a/storage/innobase/ibuf/ibuf0ibuf.cc b/storage/innobase/ibuf/ibuf0ibuf.cc
index 69ee0058d0b..b87c5b052ae 100644
--- a/storage/innobase/ibuf/ibuf0ibuf.cc
+++ b/storage/innobase/ibuf/ibuf0ibuf.cc
@@ -426,6 +426,10 @@ err_exit:
 		goto err_exit;
 	}
 
+	DBUG_EXECUTE_IF("ibuf_init_corrupt",
+			err = DB_CORRUPTION;
+			goto err_exit;);
+
 	if (page_is_comp(root) || fil_page_get_type(root) != FIL_PAGE_INDEX
 	    || btr_page_get_index_id(root) != DICT_IBUF_ID_MIN) {
 		err = DB_CORRUPTION;
diff --git a/storage/innobase/log/log0recv.cc b/storage/innobase/log/log0recv.cc
index c4d1bf7f137..f258023e4dd 100644
--- a/storage/innobase/log/log0recv.cc
+++ b/storage/innobase/log/log0recv.cc
@@ -747,8 +747,10 @@ static struct
   bool reinit_all()
   {
 retry:
+    mysql_mutex_unlock(&log_sys.mutex);
     bool fail= false;
     buf_block_t *free_block= buf_LRU_get_free_block(false);
+    mysql_mutex_lock(&log_sys.mutex);
     mysql_mutex_lock(&recv_sys.mutex);
 
     for (auto d= defers.begin(); d != defers.end(); )
@@ -3287,8 +3289,22 @@ void recv_sys_t::apply(bool last_batch)
 
     fil_system.extend_to_recv_size();
 
+    /* We must release log_sys.mutex and recv_sys.mutex before
+    invoking buf_LRU_get_free_block(). Allocating a block may initiate
+    a redo log write and therefore acquire log_sys.mutex. To avoid
+    deadlocks, log_sys.mutex must not be acquired while holding
+    recv_sys.mutex. */
+    mysql_mutex_unlock(&mutex);
+    if (!last_batch)
+      mysql_mutex_unlock(&log_sys.mutex);
+
+    mysql_mutex_assert_not_owner(&log_sys.mutex);
     buf_block_t *free_block= buf_LRU_get_free_block(false);
 
+    if (!last_batch)
+      mysql_mutex_lock(&log_sys.mutex);
+    mysql_mutex_lock(&mutex);
+
     for (map::iterator p= pages.begin(); p != pages.end(); )
     {
       const page_id_t page_id= p->first;
@@ -3334,7 +3350,12 @@ erase_for_space:
         {
 next_free_block:
           mysql_mutex_unlock(&mutex);
+          if (!last_batch)
+            mysql_mutex_unlock(&log_sys.mutex);
+          mysql_mutex_assert_not_owner(&log_sys.mutex);
           free_block= buf_LRU_get_free_block(false);
+          if (!last_batch)
+            mysql_mutex_lock(&log_sys.mutex);
           mysql_mutex_lock(&mutex);
           break;
         }
@@ -4305,6 +4326,11 @@ completed:
 				mysql_mutex_unlock(&log_sys.mutex);
 				return(DB_ERROR);
 			}
+
+			/* In case of multi-batch recovery,
+			redo log for the last batch is not
+			applied yet. */
+			ut_d(recv_sys.after_apply = false);
 		}
 	} else {
 		ut_ad(!rescan || recv_sys.pages.empty());