Bug#48197: Concurrent rw_lock_free may cause assertion failure

rw_lock_t: Remove magic_n unless UNIV_DEBUG is defined.
rw_lock_free(): Invalidate magic_n only after removing from rw_lock_list.

2 files changed, 13 insertions, 16 deletions

diff --git a/storage/innodb_plugin/include/sync0rw.h b/storage/innodb_plugin/include/sync0rw.h
index 6f7e13220c1..175f3deb77c 100644
--- a/storage/innodb_plugin/include/sync0rw.h
+++ b/storage/innodb_plugin/include/sync0rw.h
@@ -555,11 +555,12 @@ struct rw_lock_struct {
 	unsigned	cline:14;	/*!< Line where created */
 	unsigned	last_s_line:14;	/*!< Line number where last time s-locked */
 	unsigned	last_x_line:14;	/*!< Line number where last time x-locked */
+#ifdef UNIV_DEBUG
 	ulint	magic_n;	/*!< RW_LOCK_MAGIC_N */
-};
-
 /** Value of rw_lock_struct::magic_n */
 #define	RW_LOCK_MAGIC_N	22643
+#endif /* UNIV_DEBUG */
+};
 
 #ifdef UNIV_SYNC_DEBUG
 /** The structure for storing debug info of an rw-lock */
diff --git a/storage/innodb_plugin/sync/sync0rw.c b/storage/innodb_plugin/sync/sync0rw.c
index d231b6acdf7..52eaa5d0f43 100644
--- a/storage/innodb_plugin/sync/sync0rw.c
+++ b/storage/innodb_plugin/sync/sync0rw.c
@@ -267,7 +267,7 @@ rw_lock_create_func(
 	lock->level = level;
 #endif /* UNIV_SYNC_DEBUG */
 
-	lock->magic_n = RW_LOCK_MAGIC_N;
+	ut_d(lock->magic_n = RW_LOCK_MAGIC_N);
 
 	lock->cfile_name = cfile_name;
 	lock->cline = (unsigned int) cline;
@@ -282,10 +282,8 @@ rw_lock_create_func(
 
 	mutex_enter(&rw_lock_list_mutex);
 
-	if (UT_LIST_GET_LEN(rw_lock_list) > 0) {
-		ut_a(UT_LIST_GET_FIRST(rw_lock_list)->magic_n
-		     == RW_LOCK_MAGIC_N);
-	}
+	ut_ad(UT_LIST_GET_FIRST(rw_lock_list) == NULL
+	      || UT_LIST_GET_FIRST(rw_lock_list)->magic_n == RW_LOCK_MAGIC_N);
 
 	UT_LIST_ADD_FIRST(list, rw_lock_list, lock);
 
@@ -305,8 +303,6 @@ rw_lock_free(
 	ut_ad(rw_lock_validate(lock));
 	ut_a(lock->lock_word == X_LOCK_DECR);
 
-	lock->magic_n = 0;
-
 #ifndef INNODB_RW_LOCKS_USE_ATOMICS
 	mutex_free(rw_lock_get_mutex(lock));
 #endif /* INNODB_RW_LOCKS_USE_ATOMICS */
@@ -316,16 +312,16 @@ rw_lock_free(
 
 	os_event_free(lock->wait_ex_event);
 
-	if (UT_LIST_GET_PREV(list, lock)) {
-		ut_a(UT_LIST_GET_PREV(list, lock)->magic_n == RW_LOCK_MAGIC_N);
-	}
-	if (UT_LIST_GET_NEXT(list, lock)) {
-		ut_a(UT_LIST_GET_NEXT(list, lock)->magic_n == RW_LOCK_MAGIC_N);
-	}
+	ut_ad(UT_LIST_GET_PREV(list, lock) == NULL
+	      || UT_LIST_GET_PREV(list, lock)->magic_n == RW_LOCK_MAGIC_N);
+	ut_ad(UT_LIST_GET_NEXT(list, lock) == NULL
+	      || UT_LIST_GET_NEXT(list, lock)->magic_n == RW_LOCK_MAGIC_N);
 
 	UT_LIST_REMOVE(list, rw_lock_list, lock);
 
 	mutex_exit(&rw_lock_list_mutex);
+
+	ut_d(lock->magic_n = 0);
 }
 
 #ifdef UNIV_DEBUG
@@ -344,7 +340,7 @@ rw_lock_validate(
 	ulint waiters = rw_lock_get_waiters(lock);
 	lint lock_word = lock->lock_word;
 
-	ut_a(lock->magic_n == RW_LOCK_MAGIC_N);
+	ut_ad(lock->magic_n == RW_LOCK_MAGIC_N);
 	ut_a(waiters == 0 || waiters == 1);
 	ut_a(lock_word > -X_LOCK_DECR ||(-lock_word) % X_LOCK_DECR == 0);