Bug#37189985: Crashing and widespread corruption of spatial indexes

               after INPLACE alter table

ANALYSIS

ALTER TABLE, INPLACE operation on a table containing both a spatial
index and an auto increment column can cause corruption. This is due
to auto increment column value getting overwritten in the old records
of spatial index while preparing the new record.

The records are accessed through a cursor, cached into a tuple vector
m_dtuple_vec in the index_tuple_info_t::add(). The row is built with
shallow copying of fields, and the auto-increment value is prepared
locally and copied. This process repeats until page traversal is
complete. In subsequent iterations, shallow-copied pointers are
overwritten, but since the source record remains intact and page is
latched, they stay valid. The row continues to reference the old
auto-incremented value, causing only the auto-increment field to be
overwritten, and older rows to point to the latest auto-incremented
value.

FIX

Perform deep copy of the auto-increment field while processing
the spatial index records.

Note: This is a 5.7 patch.

Change-Id: Ib8852ef5977d881bf06dadcc35d41acfa760c96f

Author: Nisha Gopalakrishnan

storage/innobase/row/row0merge.cc

@@ -1,6 +1,6 @@
 /*****************************************************************************
 
-Copyright (c) 2005, 2023, Oracle and/or its affiliates.
+Copyright (c) 2005, 2024, Oracle and/or its affiliates.
 
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License, version 2.0,
@@ -2093,9 +2093,15 @@ row_merge_read_clustered_index(
 			ut_ad(add_autoinc
 			      < dict_table_get_n_user_cols(new_table));
 
-			const dfield_t*	dfield;
+			dfield_t *dfield = dtuple_get_nth_field(row, add_autoinc);
+			if (num_spatial > 0) {
+				/* Perform a deep copy of the field because for
+				spatial indexes, the default tuple allocation is
+				overwritten, as tuples are processed at the end
+				of the page. */
+				dfield_dup(dfield, sp_heap);
+			}
 
-			dfield = dtuple_get_nth_field(row, add_autoinc);
 			if (dfield_is_null(dfield)) {
 				goto write_buffers;
 			}