MDEV-39792 InnoDB: ALTER TABLE FORCE triggers assertion "s" in buf_page_get_gen()

When rebuilding a table from ROW_FORMAT=COMPACT or DYNAMIC into
ROW_FORMAT=REDUNDANT, row_merge_buf_add() fetches the full value of an
externally stored (off-page) CHAR column in a multi-byte character set
and pads it to REDUNDANT's fixed local width via
row_merge_buf_redundant_convert(). That helper already dereferences the
BLOB and calls dfield_set_data(), which clears the field's "externally
stored" flag, since the value is now held in full locally.

The "flag externally stored fields" step further down in
row_merge_buf_add() did not know this had happened. It still consulted
the row_ext_t cache built from the original (pre-conversion) record and,
for a column that is not part of the clustered index's unique key,
called dfield_set_ext() again on the very field that had just been
converted, without restoring its data pointer to a valid 20-byte
external reference. row_merge_copy_blobs() would then read the tail of
the padded, space-filled buffer as if it were a BTR_EXTERN_FIELD_REF,
deriving a garbage tablespace id and crashing buf_page_get_gen()'s
fil_space_get() assertion when the alter tried to build the new
clustered index.

Skip the re-flagging step for a field whose "externally stored" flag is
no longer set. row_build() flags every off-page column, and the
row_ext_t cache only holds a subset of those columns, so a field that
is not flagged is either a converted one (already fully local) or one
that the cache does not hold.

With the field no longer re-flagged, the rebuild completes, and the
rebuilt table passes CHECK TABLE with the full column value.

The MDEV-31025 case in innodb.default_row_format_alter failed on
innodb_page_size=4k and 8k: its ROW_FORMAT=REDUNDANT table has eight
utf32 CHAR(255) columns, which CREATE TABLE rejects with
ER_TOO_BIG_ROWSIZE on those page sizes. Derive the number of columns
from the page size, so that the record still exceeds the maximum local
record size and the fixed-length column c is stored externally. The
whole test now passes on every page size.

Author: iMineLink

mysql-test/suite/innodb/r/default_row_format_alter.result

@@ -135,10 +135,6 @@ DROP TABLE t1;
 #
 set @old_sql_mode = @@sql_mode;
 SET @@sql_mode='';
-CREATE TABLE t1(pk INT,c CHAR(255),c2 CHAR(255),c3 CHAR(255),
-c4 char(255), c5 char(255), c6 char(255),
-c7 char(255), c8 char(255), primary key(pk)
-)Engine=InnoDB character set utf32 ROW_FORMAT=REDUNDANT;
 INSERT INTO t1(pk, c) VALUES (1, repeat('a', 255));
 ALTER TABLE t1 FORCE;
 CHECK TABLE t1;
@@ -150,4 +146,20 @@ LENGTH(c)
 DROP TABLE t1;
 set @@sql_mode = @old_sql_mode;
 # End of 10.4 tests
+#
+# MDEV-39792 InnoDB: ALTER TABLE FORCE triggers assertion "s"
+# in buf_page_get_gen() when converting an externally stored
+# CHAR column to ROW_FORMAT=REDUNDANT
+#
+SET @a=REPEAT(_utf8mb4 0xF09F9880,254);
+SET GLOBAL innodb_default_row_format = @row_format;
+ALTER TABLE t1 ROW_FORMAT=REDUNDANT;
+CHECK TABLE t1;
+Table	Op	Msg_type	Msg_text
+test.t1	check	status	OK
+SELECT c1=@a FROM t1;
+c1=@a
+1
+DROP TABLE t1;
+# End of 11.4 tests
 SET GLOBAL innodb_default_row_format = @row_format;

mysql-test/suite/innodb/t/default_row_format_alter.test

@@ -156,10 +156,20 @@ DROP TABLE t1;
 --echo #
 set @old_sql_mode = @@sql_mode;
 SET @@sql_mode='';
-CREATE TABLE t1(pk INT,c CHAR(255),c2 CHAR(255),c3 CHAR(255),
-		c4 char(255), c5 char(255), c6 char(255),
-		c7 char(255), c8 char(255), primary key(pk)
-		)Engine=InnoDB character set utf32 ROW_FORMAT=REDUNDANT;
+# The record must exceed the maximum local record size of the page,
+# so that the fixed-length column c is stored externally.
+let $n_cols = `SELECT LEAST(8, @@innodb_page_size DIV 2048)`;
+let $cols = c CHAR(255);
+let $i = 2;
+while ($i <= $n_cols)
+{
+  let $cols = $cols, c$i CHAR(255);
+  inc $i;
+}
+--disable_query_log
+eval CREATE TABLE t1(pk INT, $cols, PRIMARY KEY(pk))
+ENGINE=InnoDB CHARACTER SET utf32 ROW_FORMAT=REDUNDANT;
+--enable_query_log
 INSERT INTO t1(pk, c) VALUES (1, repeat('a', 255));
 ALTER TABLE t1 FORCE;
 CHECK TABLE t1;
@@ -169,4 +179,34 @@ set @@sql_mode = @old_sql_mode;
 
 --echo # End of 10.4 tests
 
+--echo #
+--echo # MDEV-39792 InnoDB: ALTER TABLE FORCE triggers assertion "s"
+--echo # in buf_page_get_gen() when converting an externally stored
+--echo # CHAR column to ROW_FORMAT=REDUNDANT
+--echo #
+# The record must exceed the maximum local record size of the page, so
+# that c1 is stored externally, and still fit in ROW_FORMAT=REDUNDANT.
+let $n_cols = `SELECT IF(@@innodb_page_size <= 16384, @@innodb_page_size DIV 2048, 18)`;
+let $cols = c1 CHAR(255);
+let $vals = @a;
+let $i = 2;
+while ($i <= $n_cols)
+{
+  let $cols = $cols, c$i CHAR(255);
+  let $vals = $vals, @a;
+  inc $i;
+}
+SET @a=REPEAT(_utf8mb4 0xF09F9880,254);
+SET GLOBAL innodb_default_row_format = @row_format;
+--disable_query_log
+eval CREATE TABLE t1 ($cols, KEY(c1(1))) ENGINE=InnoDB CHARSET=utf8mb4;
+eval INSERT INTO t1 VALUES ($vals);
+--enable_query_log
+ALTER TABLE t1 ROW_FORMAT=REDUNDANT;
+CHECK TABLE t1;
+SELECT c1=@a FROM t1;
+DROP TABLE t1;
+
+--echo # End of 11.4 tests
+
 SET GLOBAL innodb_default_row_format = @row_format;

storage/innobase/row/row0merge.cc

@@ -774,7 +774,11 @@ row_merge_buf_add(
 		if (dfield_is_null(field)) {
 			ut_ad(!(col->prtype & DATA_NOT_NULL));
 			continue;
-		} else if (!ext) {
+		} else if (!ext || !dfield_is_ext(field)) {
+			/* A field that
+			row_merge_buf_redundant_convert() fetched
+			in full is no longer externally stored,
+			and must not be re-flagged as such. */
 		} else if (dict_index_is_clust(index)) {
 			/* Flag externally stored fields. */
 			const byte*	buf = row_ext_lookup(ext, col->ind,