Bug #32460315 ONLINE RESIZING BUFFER POOL CAN CRASH CONCURRENT BP LOOKUP

This patch changes it so that we do not free old BP `page_hash`, but rather modify it's parameters, during resize.

RB: 26084
Reviewed-by: Marcin Babij <marcin.babij@oracle.com>
Reviewed-by: Yasufumi Kinoshita <yasufumi.kinoshita@oracle.com>

storage/innobase/buf/buf0buf.cc

@@ -1817,8 +1817,6 @@ buf_pool_init_instance(
 			LATCH_ID_HASH_TABLE_RW_LOCK,
 			srv_n_page_hash_locks, MEM_HEAP_FOR_PAGE_HASH);
 
-		buf_pool->page_hash_old = NULL;
-
 		buf_pool->zip_hash = hash_create(2 * buf_pool->curr_size);
 
 		buf_pool->last_printout_time = ut_time_monotonic();
@@ -2442,8 +2440,6 @@ buf_pool_resize_hash(
 {
 	hash_table_t*	new_hash_table;
 
-	ut_ad(buf_pool->page_hash_old == NULL);
-
 	/* recreate page_hash */
 	new_hash_table = ib_recreate(
 		buf_pool->page_hash, 2 * buf_pool->curr_size);
@@ -2474,9 +2470,12 @@ buf_pool_resize_hash(
 				prev_bpage);
 		}
 	}
-
-	buf_pool->page_hash_old = buf_pool->page_hash;
-	buf_pool->page_hash = new_hash_table;
+        /* Concurrent threads may be accessing buf_pool->page_hash->n_cells,
+        n_sync_obj and try to latch sync_obj[i] while we are resizing. Therefore we
+        never deallocate page_hash, instead we overwrite n_cells (and other fields)
+        with the new values. The n_sync_obj and sync_obj are actually same in both. */
+        std::swap(*buf_pool->page_hash, *new_hash_table);
+        hash_table_free(new_hash_table);
 
 	/* recreate zip_hash */
 	new_hash_table = hash_create(2 * buf_pool->curr_size);
@@ -2929,11 +2928,6 @@ buf_pool_resize()
 
 		hash_unlock_x_all(buf_pool->page_hash);
 		buf_pool_mutex_exit(buf_pool);
-
-		if (buf_pool->page_hash_old != NULL) {
-			hash_table_free(buf_pool->page_hash_old);
-			buf_pool->page_hash_old = NULL;
-		}
 	}
 
 	UT_DELETE(chunk_map_old);

storage/innobase/include/buf0buf.h

@@ -2094,8 +2094,6 @@ struct buf_pool_t{
 					page_hash mutex. Lookups can happen
 					while holding the buf_pool->mutex or
 					the relevant page_hash mutex. */
-	hash_table_t*	page_hash_old;	/*!< old pointer to page_hash to be
-					freed after resizing buffer pool */
 	hash_table_t*	zip_hash;	/*!< hash table of buf_block_t blocks
 					whose frames are allocated to the
 					zip buddy system,