branches/zip: Clarify that buf_buddy_alloc() should only be used for

allocating compressed page frames or their control blocks.  Also note
that if buf_buddy_alloc() is used for allocating a control block,
it must be initialized before releasing buf_pool->mutex.

buf_page_init_for_read(): When the page hash check fails after
buf_buddy_alloc(), free the uninitialized control block before freeing
the compressed page frame.  This fixes a potential error in
buf_buddy_relocate_block().

buf/buf0buddy.c

@@ -537,6 +537,14 @@ buf_buddy_relocate(
 	is used for either compressed pages or buf_page_t
 	objects covering compressed pages. */
 
+	/* We look inside the allocated objects returned by
+	buf_buddy_alloc() and assume that anything of
+	PAGE_ZIP_MIN_SIZE or larger is a compressed page that contains
+	a valid space_id and page_no in the page header.  Should the
+	fields be invalid, we will be unable to relocate the block.
+	We also assume that anything that fits sizeof(buf_page_t)
+	actually is a properly initialized buf_page_t object. */
+
 	if (size >= PAGE_ZIP_MIN_SIZE) {
 		/* This is a compressed page. */
 		mutex_t*	mutex;

buf/buf0buf.c

@@ -2595,8 +2595,8 @@ err_exit2:
 		    && UNIV_LIKELY_NULL(buf_page_hash_get(space, offset))) {
 
 			/* The block was added by some other thread. */
-			buf_buddy_free(data, zip_size);
 			buf_buddy_free(bpage, sizeof *bpage);
+			buf_buddy_free(data, zip_size);
 			goto err_exit2;
 		}
 

include/buf0buddy.h

@@ -19,9 +19,13 @@ Created December 2006 by Marko Makela
 
 /**************************************************************************
 Allocate a block.  The thread calling this function must hold
-buf_pool->mutex and must not hold buf_pool->zip_mutex or any block->mutex.
-The buf_pool->mutex may only be released and reacquired if
-lru == BUF_BUDDY_USE_LRU. */
+buf_pool->mutex and must not hold buf_pool->zip_mutex or any
+block->mutex.  The buf_pool->mutex may only be released and reacquired
+if lru == BUF_BUDDY_USE_LRU.  This function should only be used for
+allocating compressed page frames or control blocks (buf_page_t).
+Allocated control blocks must be properly initialized immediately
+after buf_buddy_alloc() has returned the memory, before releasing
+buf_pool->mutex. */
 UNIV_INLINE
 void*
 buf_buddy_alloc(

include/buf0buddy.ic

@@ -68,9 +68,13 @@ buf_buddy_get_slot(
 
 /**************************************************************************
 Allocate a block.  The thread calling this function must hold
-buf_pool->mutex and must not hold buf_pool->zip_mutex or any block->mutex.
-The buf_pool->mutex may only be released and reacquired if
-lru == BUF_BUDDY_USE_LRU. */
+buf_pool->mutex and must not hold buf_pool->zip_mutex or any
+block->mutex.  The buf_pool->mutex may only be released and reacquired
+if lru == BUF_BUDDY_USE_LRU.  This function should only be used for
+allocating compressed page frames or control blocks (buf_page_t).
+Allocated control blocks must be properly initialized immediately
+after buf_buddy_alloc() has returned the memory, before releasing
+buf_pool->mutex. */
 UNIV_INLINE
 void*
 buf_buddy_alloc(