Merge 10.6 into 10.7

16 files changed, 245 insertions, 54 deletions

diff --git a/mysql-test/lib/mtr_cases.pm b/mysql-test/lib/mtr_cases.pm
index adc911ba937..de7041409f6 100644
--- a/mysql-test/lib/mtr_cases.pm
+++ b/mysql-test/lib/mtr_cases.pm
@@ -1037,7 +1037,7 @@ sub get_tags_from_file($$) {
     }
 
     # Check for a sourced include file.
-    if ($line =~ /^(--)?[[:space:]]*source[[:space:]]+([^;[:space:]]+)/)
+    if ($line =~ /^[[:space:]]*(--)?[[:space:]]*source[[:space:]]+([^;[:space:]]+)/)
     {
       my $include= $2;
       # The rules below must match open_file() function of mysqltest.cc
diff --git a/mysql-test/main/sql_safe_updates.result b/mysql-test/main/sql_safe_updates.result
index 356cd36bad9..f2944e60489 100644
--- a/mysql-test/main/sql_safe_updates.result
+++ b/mysql-test/main/sql_safe_updates.result
@@ -1,3 +1,27 @@
+#
+# MDEV-14429 sql_safe_updates in my.cnf not work
+#
 select @@sql_safe_updates;
 @@sql_safe_updates
 1
+#
+# MDEV-18304 sql_safe_updates does not work with OR clauses
+#
+create table t1 (a int, b int, primary key (a), key (b));
+update t1 set b=2 where a=1 or b=2;
+ERROR HY000: You are using safe update mode and you tried to update a table without a WHERE that uses a KEY column
+explain update t1 set b=2 where a=1 or b=2;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	SIMPLE	t1	ALL	NULL	NULL	NULL	NULL	1	Using where
+delete from t1 where a=1 or b=2;
+ERROR HY000: You are using safe update mode and you tried to update a table without a WHERE that uses a KEY column
+explain delete from t1 where a=1 or b=2;
+id	select_type	table	type	possible_keys	key	key_len	ref	rows	Extra
+1	SIMPLE	t1	ALL	NULL	NULL	NULL	NULL	1	Using where
+insert into t1 values (1,1),(2,2),(3,3),(4,4),(5,5),(6,6),(7,7),(8,8);
+update t1 set b=2 where a=1 or b=2;
+delete from t1 where a=1 or b=2;
+drop table t1;
+#
+# End of 10.3 tests
+#
diff --git a/mysql-test/main/sql_safe_updates.test b/mysql-test/main/sql_safe_updates.test
index 18decd0ff2c..25fe4a15ca2 100644
--- a/mysql-test/main/sql_safe_updates.test
+++ b/mysql-test/main/sql_safe_updates.test
@@ -1,4 +1,23 @@
-#
-# MDEV-14429 sql_safe_updates in my.cnf not work
-#
+--echo #
+--echo # MDEV-14429 sql_safe_updates in my.cnf not work
+--echo #
 select @@sql_safe_updates;
+
+--echo #
+--echo # MDEV-18304 sql_safe_updates does not work with OR clauses
+--echo #
+create table t1 (a int, b int, primary key (a), key (b));
+--error ER_UPDATE_WITHOUT_KEY_IN_SAFE_MODE
+update t1 set b=2 where a=1 or b=2;
+explain update t1 set b=2 where a=1 or b=2;
+--error ER_UPDATE_WITHOUT_KEY_IN_SAFE_MODE
+delete from t1 where a=1 or b=2;
+explain delete from t1 where a=1 or b=2;
+insert into t1 values (1,1),(2,2),(3,3),(4,4),(5,5),(6,6),(7,7),(8,8);
+update t1 set b=2 where a=1 or b=2;
+delete from t1 where a=1 or b=2;
+drop table t1;
+
+--echo #
+--echo # End of 10.3 tests
+--echo #
diff --git a/mysql-test/suite/binlog/r/binlog_xa_recover_using_new_server_id.result b/mysql-test/suite/binlog/r/binlog_xa_recover_using_new_server_id.result
new file mode 100644
index 00000000000..2495df1845f
--- /dev/null
+++ b/mysql-test/suite/binlog/r/binlog_xa_recover_using_new_server_id.result
@@ -0,0 +1,17 @@
+========= Set server_id to 99 and prepare test table.
+SET GLOBAL server_id= 99;
+CREATE TABLE t1 (a INT PRIMARY KEY, b MEDIUMTEXT) ENGINE=Innodb;
+========= Crash the server.
+SET SESSION debug_dbug="+d,crash_commit_after_log";
+INSERT INTO t1 VALUES (1, NULL);
+Got one of the listed errors
+========= Restart the server with default config file in which server_id= 1.
+========= Check that recover succeeds and server is up.
+connection default;
+========= Check that all transactions are recovered.
+SELECT a FROM t1 ORDER BY a;
+a
+1
+========= Cleanup.
+connection default;
+DROP TABLE t1;
diff --git a/mysql-test/suite/binlog/t/binlog_xa_recover_using_new_server_id.test b/mysql-test/suite/binlog/t/binlog_xa_recover_using_new_server_id.test
new file mode 100644
index 00000000000..a7f2a206bae
--- /dev/null
+++ b/mysql-test/suite/binlog/t/binlog_xa_recover_using_new_server_id.test
@@ -0,0 +1,44 @@
+# This test verifies attempt to xa recover using a new server id that
+# different from the transaction's original server_id.
+#
+
+--source include/have_innodb.inc
+--source include/have_debug.inc
+--source include/have_binlog_format_row.inc
+# Valgrind does not work well with test that crashes the server
+--source include/not_valgrind.inc
+
+
+--echo ========= Set server_id to 99 and prepare test table.
+SET GLOBAL server_id= 99;
+CREATE TABLE t1 (a INT PRIMARY KEY, b MEDIUMTEXT) ENGINE=Innodb;
+
+
+--echo ========= Crash the server.
+--write_file $MYSQLTEST_VARDIR/tmp/mysqld.1.expect
+wait-binlog_xa_recover_using_new_server_id.test
+EOF
+SET SESSION debug_dbug="+d,crash_commit_after_log";
+--error 2006,2013
+INSERT INTO t1 VALUES (1, NULL);
+
+
+--echo ========= Restart the server with default config file in which server_id= 1.
+--append_file $MYSQLTEST_VARDIR/tmp/mysqld.1.expect
+restart-binlog_xa_recover_using_new_server_id.test
+EOF
+
+
+--echo ========= Check that recover succeeds and server is up.
+connection default;
+--enable_reconnect
+--source include/wait_until_connected_again.inc
+
+
+--echo ========= Check that all transactions are recovered.
+SELECT a FROM t1 ORDER BY a;
+
+
+--echo ========= Cleanup.
+connection default;
+DROP TABLE t1;
diff --git a/mysql-test/suite/innodb/r/instant_alter_bugs.result b/mysql-test/suite/innodb/r/instant_alter_bugs.result
index 79f1b0eb068..1f8351b87f0 100644
--- a/mysql-test/suite/innodb/r/instant_alter_bugs.result
+++ b/mysql-test/suite/innodb/r/instant_alter_bugs.result
@@ -451,4 +451,13 @@ ALTER TABLE t ADD d INT;
 affected rows: 0
 info: Records: 0  Duplicates: 0  Warnings: 0
 DROP TABLE t;
+#
+# MDEV-28060 Online DDL fails while checking for instant
+#		alter condition
+#
+CREATE TABLE t1(f1 CHAR(10) NOT NULL)ROW_FORMAT=REDUNDANT,ENGINE=InnoDB;
+ALTER TABLE t1 ADD COLUMN(f2 INT NOT NULL, f3 INT NOT NULL,
+f4 INT NOT NULL, f5 INT NOT NULL),
+CHANGE COLUMN f1 f1 CHAR(10) DEFAULT NULL;
+DROP TABLE t1;
 SET GLOBAL innodb_purge_rseg_truncate_frequency=@save_frequency;
diff --git a/mysql-test/suite/innodb/r/undo_truncate.result b/mysql-test/suite/innodb/r/undo_truncate.result
index fbfd061c9cc..5be1e5c3426 100644
--- a/mysql-test/suite/innodb/r/undo_truncate.result
+++ b/mysql-test/suite/innodb/r/undo_truncate.result
@@ -28,6 +28,8 @@ connection con2;
 commit;
 disconnect con2;
 connection default;
+SET GLOBAL innodb_purge_rseg_truncate_frequency=1;
+SET GLOBAL innodb_max_purge_lag_wait=0;
 set global innodb_fast_shutdown=0;
 # restart
 drop table t1, t2;
diff --git a/mysql-test/suite/innodb/t/instant_alter_bugs.test b/mysql-test/suite/innodb/t/instant_alter_bugs.test
index 03465ee86ee..d72624347f7 100644
--- a/mysql-test/suite/innodb/t/instant_alter_bugs.test
+++ b/mysql-test/suite/innodb/t/instant_alter_bugs.test
@@ -473,4 +473,13 @@ ALTER TABLE t ADD d INT;
 --disable_info
 DROP TABLE t;
 
+--echo #
+--echo # MDEV-28060 Online DDL fails while checking for instant
+--echo #		alter condition
+--echo #
+CREATE TABLE t1(f1 CHAR(10) NOT NULL)ROW_FORMAT=REDUNDANT,ENGINE=InnoDB;
+ALTER TABLE t1 ADD COLUMN(f2 INT NOT NULL, f3 INT NOT NULL,
+			  f4 INT NOT NULL, f5 INT NOT NULL),
+	       CHANGE COLUMN f1 f1 CHAR(10) DEFAULT NULL;
+DROP TABLE t1;
 SET GLOBAL innodb_purge_rseg_truncate_frequency=@save_frequency;
diff --git a/mysql-test/suite/innodb/t/undo_truncate.test b/mysql-test/suite/innodb/t/undo_truncate.test
index cf8c1a8d5e3..437103de787 100644
--- a/mysql-test/suite/innodb/t/undo_truncate.test
+++ b/mysql-test/suite/innodb/t/undo_truncate.test
@@ -46,6 +46,8 @@ connection default;
 let $trx_before= `SHOW ENGINE INNODB STATUS`;
 let $trx_before= `select substr('$trx_before',9)+2`;
 
+SET GLOBAL innodb_purge_rseg_truncate_frequency=1;
+SET GLOBAL innodb_max_purge_lag_wait=0;
 set global innodb_fast_shutdown=0;
 --source include/restart_mysqld.inc
 --replace_regex /.*Trx id counter ([0-9]+).*/\1/
diff --git a/sql/handler.cc b/sql/handler.cc
index 269115bc0da..3f15fa04d6e 100644
--- a/sql/handler.cc
+++ b/sql/handler.cc
@@ -2411,7 +2411,7 @@ struct xarecover_st
 */
 static xid_recovery_member*
 xid_member_insert(HASH *hash_arg, my_xid xid_arg, MEM_ROOT *ptr_mem_root,
-                  XID *full_xid_arg)
+                  XID *full_xid_arg, decltype(::server_id) server_id_arg)
 {
   xid_recovery_member *member= (xid_recovery_member *)
     alloc_root(ptr_mem_root, sizeof(xid_recovery_member));
@@ -2425,7 +2425,7 @@ xid_member_insert(HASH *hash_arg, my_xid xid_arg, MEM_ROOT *ptr_mem_root,
 
   if (full_xid_arg)
     *xid_full= *full_xid_arg;
-  *member= xid_recovery_member(xid_arg, 1, false, xid_full);
+  *member= xid_recovery_member(xid_arg, 1, false, xid_full, server_id_arg);
 
   return
     my_hash_insert(hash_arg, (uchar*) member) ? NULL : member;
@@ -2440,14 +2440,15 @@ xid_member_insert(HASH *hash_arg, my_xid xid_arg, MEM_ROOT *ptr_mem_root,
 */
 static bool xid_member_replace(HASH *hash_arg, my_xid xid_arg,
                                MEM_ROOT *ptr_mem_root,
-                               XID *full_xid_arg)
+                               XID *full_xid_arg,
+                               decltype(::server_id) server_id_arg)
 {
   xid_recovery_member* member;
   if ((member= (xid_recovery_member *)
        my_hash_search(hash_arg, (uchar *)& xid_arg, sizeof(xid_arg))))
     member->in_engine_prepare++;
   else
-    member= xid_member_insert(hash_arg, xid_arg, ptr_mem_root, full_xid_arg);
+    member= xid_member_insert(hash_arg, xid_arg, ptr_mem_root, full_xid_arg,  server_id_arg);
 
   return member == NULL;
 }
@@ -2499,7 +2500,8 @@ static void xarecover_do_commit_or_rollback(handlerton *hton,
   Binlog_offset *ptr_commit_max= arg->binlog_coord;
 
   if (!member->full_xid)
-    x.set(member->xid);
+    // Populate xid using the server_id from original transaction
+    x.set(member->xid, member->server_id);
   else
     x= *member->full_xid;
 
@@ -2655,9 +2657,12 @@ static my_bool xarecover_handlerton(THD *unused, plugin_ref plugin,
         */
         if (info->mem_root)
         {
-          // remember "full" xid too when it's not in mysql format
+          // remember "full" xid too when it's not in mysql format.
+          // Also record the transaction's original server_id. It will be used for
+          // populating the input XID to be searched in hash.
           if (xid_member_replace(info->commit_list, x, info->mem_root,
-                                 is_server_xid? NULL : &info->list[i]))
+                                 is_server_xid? NULL : &info->list[i],
+                                 is_server_xid? info->list[i].get_trx_server_id() : server_id))
           {
             info->error= true;
             sql_print_error("Error in memory allocation at xarecover_handlerton");
diff --git a/sql/handler.h b/sql/handler.h
index 052554d5747..56e828e5465 100644
--- a/sql/handler.h
+++ b/sql/handler.h
@@ -902,12 +902,13 @@ struct xid_t {
     if ((bqual_length= bl))
       memcpy(data+gl, b, bl);
   }
-  void set(ulonglong xid)
+  // Populate server_id if it's specified, otherwise use the current server_id
+  void set(ulonglong xid, decltype(::server_id) trx_server_id= server_id)
   {
     my_xid tmp;
     formatID= 1;
     set(MYSQL_XID_PREFIX_LEN, 0, MYSQL_XID_PREFIX);
-    memcpy(data+MYSQL_XID_PREFIX_LEN, &server_id, sizeof(server_id));
+    memcpy(data+MYSQL_XID_PREFIX_LEN, &trx_server_id, sizeof(trx_server_id));
     tmp= xid;
     memcpy(data+MYSQL_XID_OFFSET, &tmp, sizeof(tmp));
     gtrid_length=MYSQL_XID_GTRID_LEN;
@@ -933,6 +934,12 @@ struct xid_t {
            !memcmp(data, MYSQL_XID_PREFIX, MYSQL_XID_PREFIX_LEN) ?
            quick_get_my_xid() : 0;
   }
+  decltype(::server_id) get_trx_server_id()
+  {
+    decltype(::server_id) trx_server_id;
+    memcpy(&trx_server_id, data+MYSQL_XID_PREFIX_LEN, sizeof(trx_server_id));
+    return trx_server_id;
+  }
   uint length()
   {
     return static_cast<uint>(sizeof(formatID)) + key_length();
@@ -974,11 +981,12 @@ struct xid_recovery_member
   bool decided_to_commit;
   Binlog_offset binlog_coord; // semisync recovery binlog offset
   XID *full_xid;           // needed by wsrep or past it recovery
+  decltype(::server_id) server_id;         // server id of orginal server
 
   xid_recovery_member(my_xid xid_arg, uint prepare_arg, bool decided_arg,
-                      XID *full_xid_arg)
+                      XID *full_xid_arg, decltype(::server_id) server_id_arg)
     : xid(xid_arg), in_engine_prepare(prepare_arg),
-      decided_to_commit(decided_arg), full_xid(full_xid_arg) {};
+      decided_to_commit(decided_arg), full_xid(full_xid_arg) , server_id(server_id_arg) {};
 };
 
 /* for recover() handlerton call */
diff --git a/sql/sql_delete.cc b/sql/sql_delete.cc
index 0403d6e73c3..95adf17987c 100644
--- a/sql/sql_delete.cc
+++ b/sql/sql_delete.cc
@@ -1,6 +1,6 @@
 /*
    Copyright (c) 2000, 2019, Oracle and/or its affiliates.
-   Copyright (c) 2010, 2021, MariaDB
+   Copyright (c) 2010, 2022, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -417,7 +417,8 @@ bool mysql_delete(THD *thd, TABLE_LIST *table_list, COND *conds,
     DBUG_RETURN(TRUE);
 
   const_cond= (!conds || conds->const_item());
-  safe_update= MY_TEST(thd->variables.option_bits & OPTION_SAFE_UPDATES);
+  safe_update= (thd->variables.option_bits & OPTION_SAFE_UPDATES) &&
+               !thd->lex->describe;
   if (safe_update && const_cond)
   {
     my_message(ER_UPDATE_WITHOUT_KEY_IN_SAFE_MODE,
@@ -542,7 +543,7 @@ bool mysql_delete(THD *thd, TABLE_LIST *table_list, COND *conds,
   }
 
   /* If running in safe sql mode, don't allow updates without keys */
-  if (table->opt_range_keys.is_clear_all())
+  if (!select || !select->quick)
   {
     thd->set_status_no_index_used();
     if (safe_update && !using_limit)
diff --git a/sql/sql_update.cc b/sql/sql_update.cc
index 539bea958e8..6a5f1f39e6d 100644
--- a/sql/sql_update.cc
+++ b/sql/sql_update.cc
@@ -1,5 +1,5 @@
 /* Copyright (c) 2000, 2016, Oracle and/or its affiliates.
-   Copyright (c) 2011, 2021, MariaDB
+   Copyright (c) 2011, 2022, MariaDB
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -370,7 +370,8 @@ int mysql_update(THD *thd,
                  ha_rows *found_return, ha_rows *updated_return)
 {
   bool		using_limit= limit != HA_POS_ERROR;
-  bool          safe_update= thd->variables.option_bits & OPTION_SAFE_UPDATES;
+  bool          safe_update= (thd->variables.option_bits & OPTION_SAFE_UPDATES)
+                             && !thd->lex->describe;
   bool          used_key_is_modified= FALSE, transactional_table;
   bool          will_batch= FALSE;
   bool		can_compare_record;
@@ -597,7 +598,7 @@ int mysql_update(THD *thd,
   }
 
   /* If running in safe sql mode, don't allow updates without keys */
-  if (table->opt_range_keys.is_clear_all())
+  if (!select || !select->quick)
   {
     thd->set_status_no_index_used();
     if (safe_update && !using_limit)
diff --git a/storage/innobase/buf/buf0flu.cc b/storage/innobase/buf/buf0flu.cc
index e25627395dc..ebd6b0fe947 100644
--- a/storage/innobase/buf/buf0flu.cc
+++ b/storage/innobase/buf/buf0flu.cc
@@ -998,42 +998,52 @@ static page_id_t buf_flush_check_neighbors(const fil_space_t &space,
   return i;
 }
 
-MY_ATTRIBUTE((nonnull))
+MY_ATTRIBUTE((nonnull, warn_unused_result))
 /** Write punch-hole or zeroes of the freed ranges when
 innodb_immediate_scrub_data_uncompressed from the freed ranges.
-@param space   tablespace which may contain ranges of freed pages */
-static void buf_flush_freed_pages(fil_space_t *space)
+@param space    tablespace which may contain ranges of freed pages
+@param writable whether the tablespace is writable
+@return number of pages written or hole-punched */
+static uint32_t buf_flush_freed_pages(fil_space_t *space, bool writable)
 {
   const bool punch_hole= space->chain.start->punch_hole == 1;
   if (!punch_hole && !srv_immediate_scrub_data_uncompressed)
-    return;
-  lsn_t flush_to_disk_lsn= log_sys.get_flushed_lsn();
+    return 0;
+
+  mysql_mutex_assert_not_owner(&buf_pool.flush_list_mutex);
+  mysql_mutex_assert_not_owner(&buf_pool.mutex);
 
-  std::unique_lock<std::mutex> freed_lock(space->freed_range_mutex);
-  if (space->freed_ranges.empty()
-      || flush_to_disk_lsn < space->get_last_freed_lsn())
+  space->freed_range_mutex.lock();
+  if (space->freed_ranges.empty() ||
+      log_sys.get_flushed_lsn() < space->get_last_freed_lsn())
   {
-    freed_lock.unlock();
-    return;
+    space->freed_range_mutex.unlock();
+    return 0;
   }
 
+  const unsigned physical_size{space->physical_size()};
+
   range_set freed_ranges= std::move(space->freed_ranges);
-  freed_lock.unlock();
+  uint32_t written= 0;
 
-  for (const auto &range : freed_ranges)
+  if (!writable);
+  else if (punch_hole)
   {
-    const ulint physical_size= space->physical_size();
-
-    if (punch_hole)
+    for (const auto &range : freed_ranges)
     {
+      written+= range.last - range.first + 1;
       space->reacquire();
       space->io(IORequest(IORequest::PUNCH_RANGE),
                           os_offset_t{range.first} * physical_size,
                           (range.last - range.first + 1) * physical_size,
                           nullptr);
     }
-    else
+  }
+  else
+  {
+    for (const auto &range : freed_ranges)
     {
+      written+= range.last - range.first + 1;
       for (os_offset_t i= range.first; i <= range.last; i++)
       {
         space->reacquire();
@@ -1042,8 +1052,10 @@ static void buf_flush_freed_pages(fil_space_t *space)
                   const_cast<byte*>(field_ref_zero));
       }
     }
-    buf_pool.stat.n_pages_written+= (range.last - range.first + 1);
   }
+
+  space->freed_range_mutex.unlock();
+  return written;
 }
 
 /** Flushes to disk all flushable pages within the flush area
@@ -1166,14 +1178,12 @@ static ulint buf_free_from_unzip_LRU_list_batch(ulint max)
 
 /** Start writing out pages for a tablespace.
 @param id   tablespace identifier
-@return tablespace
-@retval nullptr if the pages for this tablespace should be discarded */
-static fil_space_t *buf_flush_space(const uint32_t id)
+@return tablespace and number of pages written */
+static std::pair<fil_space_t*, uint32_t> buf_flush_space(const uint32_t id)
 {
-  fil_space_t *space= fil_space_t::get(id);
-  if (space)
-    buf_flush_freed_pages(space);
-  return space;
+  if (fil_space_t *space= fil_space_t::get(id))
+    return {space, buf_flush_freed_pages(space, true)};
+  return {nullptr, 0};
 }
 
 struct flush_counters_t
@@ -1234,6 +1244,7 @@ static void buf_flush_LRU_list_batch(ulint max, flush_counters_t *n)
          n->flushed + n->evicted < max) ||
         recv_recovery_is_on()); ++scanned)
   {
+  retry:
     buf_page_t *prev= UT_LIST_GET_PREV(LRU, bpage);
     const lsn_t oldest_modification= bpage->oldest_modification();
     buf_pool.lru_hp.set(prev);
@@ -1259,10 +1270,18 @@ static void buf_flush_LRU_list_batch(ulint max, flush_counters_t *n)
       {
         if (last_space_id != space_id)
         {
+          buf_pool.lru_hp.set(bpage);
+          mysql_mutex_unlock(&buf_pool.mutex);
           if (space)
             space->release();
-          space= buf_flush_space(space_id);
+          auto p= buf_flush_space(space_id);
+          space= p.first;
           last_space_id= space_id;
+          mysql_mutex_lock(&buf_pool.mutex);
+          if (p.second)
+            buf_pool.stat.n_pages_written+= p.second;
+          bpage= buf_pool.lru_hp.get();
+          goto retry;
         }
         else
           ut_ad(!space);
@@ -1397,10 +1416,28 @@ static ulint buf_do_flush_list_batch(ulint max_n, lsn_t lsn)
     {
       if (last_space_id != space_id)
       {
+        mysql_mutex_lock(&buf_pool.flush_list_mutex);
+        buf_pool.flush_hp.set(bpage);
+        mysql_mutex_unlock(&buf_pool.flush_list_mutex);
+        mysql_mutex_unlock(&buf_pool.mutex);
         if (space)
           space->release();
-        space= buf_flush_space(space_id);
+        auto p= buf_flush_space(space_id);
+        space= p.first;
         last_space_id= space_id;
+        mysql_mutex_lock(&buf_pool.mutex);
+        if (p.second)
+          buf_pool.stat.n_pages_written+= p.second;
+        mysql_mutex_lock(&buf_pool.flush_list_mutex);
+        bpage= buf_pool.flush_hp.get();
+        if (!bpage)
+          break;
+        if (bpage->id() != page_id)
+          continue;
+        buf_pool.flush_hp.set(UT_LIST_GET_PREV(list, bpage));
+        if (bpage->oldest_modification() <= 1 || !bpage->ready_for_flush())
+          goto next;
+        mysql_mutex_unlock(&buf_pool.flush_list_mutex);
       }
       else
         ut_ad(!space);
@@ -1428,6 +1465,7 @@ static ulint buf_do_flush_list_batch(ulint max_n, lsn_t lsn)
     }
 
     mysql_mutex_lock(&buf_pool.flush_list_mutex);
+  next:
     bpage= buf_pool.flush_hp.get();
   }
 
@@ -1524,11 +1562,14 @@ bool buf_flush_list_space(fil_space_t *space, ulint *n_flushed)
   bool may_have_skipped= false;
   ulint max_n_flush= srv_io_capacity;
 
-  mysql_mutex_lock(&buf_pool.mutex);
-  mysql_mutex_lock(&buf_pool.flush_list_mutex);
-
   bool acquired= space->acquire();
-  buf_flush_freed_pages(space);
+  {
+    const uint32_t written{buf_flush_freed_pages(space, acquired)};
+    mysql_mutex_lock(&buf_pool.mutex);
+    if (written)
+      buf_pool.stat.n_pages_written+= written;
+  }
+  mysql_mutex_lock(&buf_pool.flush_list_mutex);
 
   for (buf_page_t *bpage= UT_LIST_GET_LAST(buf_pool.flush_list); bpage; )
   {
diff --git a/storage/innobase/fil/fil0fil.cc b/storage/innobase/fil/fil0fil.cc
index 37ac293c259..ef650d70eeb 100644
--- a/storage/innobase/fil/fil0fil.cc
+++ b/storage/innobase/fil/fil0fil.cc
@@ -1,7 +1,7 @@
 /*****************************************************************************
 
 Copyright (c) 1995, 2021, Oracle and/or its affiliates. All Rights Reserved.
-Copyright (c) 2014, 2021, MariaDB Corporation.
+Copyright (c) 2014, 2022, MariaDB Corporation.
 
 This program is free software; you can redistribute it and/or modify it under
 the terms of the GNU General Public License as published by the Free Software
@@ -83,7 +83,9 @@ bool fil_space_t::try_to_close(bool print_info)
     of fil_system.space_list, so that they would be less likely to be
     closed here. */
     fil_node_t *node= UT_LIST_GET_FIRST(space.chain);
-    ut_ad(node);
+    if (!node)
+      /* fil_ibd_create() did not invoke fil_space_t::add() yet */
+      continue;
     ut_ad(!UT_LIST_GET_NEXT(chain, node));
 
     if (!node->is_open())
@@ -444,6 +446,8 @@ static bool fil_node_open_file(fil_node_t *node)
       /* Flush tablespaces so that we can close modified files. */
       fil_flush_file_spaces();
       mysql_mutex_lock(&fil_system.mutex);
+      if (node->is_open())
+        return true;
     }
   }
 
diff --git a/storage/innobase/handler/handler0alter.cc b/storage/innobase/handler/handler0alter.cc
index 12deba40913..ca13b21803c 100644
--- a/storage/innobase/handler/handler0alter.cc
+++ b/storage/innobase/handler/handler0alter.cc
@@ -1760,8 +1760,13 @@ set_max_size:
 		Field** af = altered_table->field;
 		Field** const end = altered_table->field
 			+ altered_table->s->fields;
+		List_iterator_fast<Create_field> cf_it(
+			ha_alter_info->alter_info->create_list);
 		for (unsigned c = 0; af < end; af++) {
-			if (!(*af)->stored_in_db()) {
+			const Create_field* cf = cf_it++;
+			if (!cf->field || !(*af)->stored_in_db()) {
+				/* Ignore virtual or newly created
+				column */
 				continue;
 			}