MDEV-25869 Change buffer entries are lost on InnoDB restart

buf_read_ibuf_merge_pages(): If space->size is 0, invoke
fil_space_get_size() to determine the size of the tablespace
by reading the header page. Only after that proceed to delete
any entries that are beyond the end of the tablespace.
Otherwise, we could be deleting valid entries that actually
need to be applied.

This fixes a regression that had been introduced in
commit b80df9e (MDEV-21069),
which aimed to avoid crashes during DROP TABLE of corrupted tables.

storage/innobase/buf/buf0rea.cc

@@ -1,7 +1,7 @@
 /*****************************************************************************
 
 Copyright (c) 1995, 2017, Oracle and/or its affiliates. All Rights Reserved.
-Copyright (c) 2015, 2020, MariaDB Corporation.
+Copyright (c) 2015, 2021, MariaDB Corporation.
 
 This program is free software; you can redistribute it and/or modify it under
 the terms of the GNU General Public License as published by the Free Software
@@ -806,13 +806,18 @@ buf_read_ibuf_merge_pages(
 			continue;
 		}
 
-		if (UNIV_UNLIKELY(page_nos[i] >= space->size)) {
+		ulint size = space->size;
+		if (!size) {
+			size = fil_space_get_size(space->id);
+		}
+
+		if (UNIV_UNLIKELY(page_nos[i] >= size)) {
 			do {
 				ibuf_delete_recs(page_id_t(space_ids[i],
 							   page_nos[i]));
 			} while (++i < n_stored
 				 && space_ids[i - 1] == space_ids[i]
-				 && page_nos[i] >= space->size);
+				 && page_nos[i] >= size);
 			i--;
 next:
 			fil_space_release(space);