Bug#37189985: Crashing and widespread corruption of spatial indexes

                  after INPLACE alter table

ANALYSIS

ALTER TABLE, INPLACE operation on a table containing both a spatial
index and an auto increment column can cause corruption or trigger
debug assert in debug builds. This is due to auto increment column
value getting overwritten in the old records of spatial index while
preparing the new record.

Per-thread memory is allocated for a single dtuple (row) in while
processing the records. Records are accessed through a cursor, cached
into a tuple vector m_dtuples in the RTree_inserter::add_to_batch()
that is called through bulk_inserter. The row is built with shallow
copying of fields, and the auto-increment value is prepared locally and
copied. This process repeats until page traversal is complete.
In subsequent iterations, shallow-copied pointers are overwritten,
but since the source record remains intact and page is latched, they
stay valid. The row continues to reference the old auto-incremented
value, causing only the auto-increment field to be overwritten, and
older rows to point to the latest auto-incremented value.

FIX

Perform deep copy of the auto-increment field while processing
the index records.

Change-Id: I9c1b6bc4eab321d3421c12e8ee17882d25f46a4a

Author: Nisha Gopalakrishnan

storage/innobase/ddl/ddl0ctx.cc

@@ -236,11 +236,16 @@ bool Context::has_virtual_columns() const noexcept {
   return false;
 }
 
-dberr_t Context::handle_autoinc(const dtuple_t *dtuple) noexcept {
+dberr_t Context::handle_autoinc(const dtuple_t *dtuple,
+                                mem_heap_t *heap) noexcept {
   ut_ad(m_add_autoinc != ULINT_UNDEFINED);
   ut_ad(m_add_autoinc < m_new_table->get_n_user_cols());
 
   const auto dfield = dtuple_get_nth_field(dtuple, m_add_autoinc);
+  /* Perform a deep copy of the field because for spatial indexes,
+  the default tuple allocation is overwritten, as tuples are
+  processed at the end of the page. */
+  dfield_dup(dfield, heap);
 
   if (dfield_is_null(dfield)) {
     return DB_SUCCESS;

storage/innobase/ddl/ddl0ddl.cc

@@ -515,7 +515,7 @@ dberr_t Row::build(ddl::Context &ctx, dict_index_t *index, mem_heap_t *heap,
   }
 
   if (ctx.m_add_autoinc != ULINT_UNDEFINED) {
-    auto err = ctx.handle_autoinc(m_ptr);
+    auto err = ctx.handle_autoinc(m_ptr, heap);
 
     if (err != DB_SUCCESS) {
       return err;

storage/innobase/ddl/ddl0rtree.cc

@@ -106,6 +106,9 @@ dberr_t RTree_inserter::batch_insert(trx_id_t trx_id,
 
     ut_ad(dtuple != nullptr);
 
+    /* If there is no sufficient space in the redo logs then deep copy the
+    cached records and release the page(s) latches as that would be required to
+    commit the mini-transaction. */
     if (log_free_check_is_required() IF_DEBUG(|| force_log_free_check)) {
       if (!latches_released) {
         deep_copy_tuples(it);

storage/innobase/include/ddl0ddl.h

@@ -550,8 +550,10 @@ struct Context {
 
   /** Handle auto increment.
   @param[in] row                Row with autoinc column.
+  @param[in] heap               Heap to use for allocation of autoinc column.
   @return DB_SUCCESS or error code. */
-  [[nodiscard]] dberr_t handle_autoinc(const dtuple_t *row) noexcept;
+  [[nodiscard]] dberr_t handle_autoinc(const dtuple_t *row,
+                                       mem_heap_t *heap) noexcept;
 
   /** @return true if any virtual columns are involved. */
   [[nodiscard]] bool has_virtual_columns() const noexcept;