MDEV-37755 fil_space_t::drop() doesn't remove space from fil_system.named_spaces

mtr.commit_file() call in fil_space_t::drop() removes space from
fil_system.named_spaces, but then the space can be inserted in the
container again by some another thread while fil_space_t::drop() is
waiting for pending operations finishing.

The fix is to check and remove a space from fil_system.named_spaces
after all pengind operations on the space are finished. Also the ut_d()
macro is removed for space->max_lsn=0 assignments to avoid repeated
space removing from fil_system.named_spaces.

There is error in ilist::pop_back(). ilist::end() returns sentinel,
and the pop_back() removes sentinel from the list instead of the last
element. The error is fixed in this commit.

Reviewed by Marko Mäkelä

Author: vlad-lesin

include/ilist.h

@@ -185,6 +185,9 @@ template <class T, class Tag= void> class ilist
     ListNode *prev= pos.node_->prev;
     ListNode *next= pos.node_->next;
 
+    DBUG_ASSERT(prev->next == pos.node_);
+    DBUG_ASSERT(next->prev == pos.node_);
+
     prev->next= next;
     next->prev= prev;
 
@@ -198,7 +201,7 @@ template <class T, class Tag= void> class ilist
   }
 
   void push_back(reference value) noexcept { insert(end(), value); }
-  void pop_back() noexcept { erase(end()); }
+  void pop_back() noexcept { erase(--end()); }
 
   void push_front(reference value) noexcept { insert(begin(), value); }
   void pop_front() noexcept { erase(begin()); }

storage/innobase/fil/fil0fil.cc

@@ -861,13 +861,7 @@ static void fil_space_free_low(fil_space_t *space) noexcept
 	/* The tablespace must not be in fil_system.named_spaces. */
 	ut_ad(srv_fast_shutdown == 2 || !srv_was_started
 	      || space->max_lsn == 0);
-
-	/* Wait for fil_space_t::release() after
-	fil_system_t::detach(), the tablespace cannot be found, so
-	fil_space_t::get() would return NULL */
-	while (space->referenced()) {
-		std::this_thread::sleep_for(std::chrono::microseconds(100));
-	}
+	ut_ad(!space->referenced());
 
 	for (fil_node_t* node = UT_LIST_GET_FIRST(space->chain);
 	     node != NULL; ) {
@@ -911,7 +905,7 @@ bool fil_space_free(ulint id, bool x_latched) noexcept
 		mysql_mutex_assert_owner(&log_sys.mutex);
 
 		if (space->max_lsn != 0) {
-			ut_d(space->max_lsn = 0);
+			space->max_lsn = 0;
 			fil_system.named_spaces.remove(*space);
 		}
 
@@ -1604,10 +1598,24 @@ fil_space_t *fil_space_t::drop(ulint id, pfs_os_file_t *detached_handle)
 
   pfs_os_file_t handle= fil_system.detach(space, true);
   mysql_mutex_unlock(&fil_system.mutex);
+  /* The above mtr.commit_file(*space, nullptr) should remove the space from
+  fil_system.named_spaces. Before we set the STOPPING_WRITES flag, another
+  concurrent operation could have marked the tablespace dirty again.
+  This clean-up corresponds to fil_space_free(). */
+  mysql_mutex_lock(&log_sys.mutex);
+  ut_ad((space->pending() & ~NEEDS_FSYNC) == (STOPPING | CLOSING));
+  if (space->max_lsn != 0)
+  {
+    space->max_lsn= 0;
+    fil_system.named_spaces.remove(*space);
+  }
+  mysql_mutex_unlock(&log_sys.mutex);
+
   if (detached_handle)
     *detached_handle = handle;
   else
     os_file_close(handle);
+
   return space;
 }
 
@@ -1630,12 +1638,6 @@ void fil_close_tablespace(ulint id) noexcept
 	while (buf_flush_list_space(space));
 
 	space->x_unlock();
-	mysql_mutex_lock(&log_sys.mutex);
-	if (space->max_lsn != 0) {
-		ut_d(space->max_lsn = 0);
-		fil_system.named_spaces.remove(*space);
-	}
-	mysql_mutex_unlock(&log_sys.mutex);
 	fil_space_free_low(space);
 }
 

storage/innobase/mtr/mtr0mtr.cc

@@ -375,7 +375,7 @@ bool mtr_t::commit_file(fil_space_t &space, const char *name)
 
   if (!name && space.max_lsn)
   {
-    ut_d(space.max_lsn= 0);
+    space.max_lsn= 0;
     fil_system.named_spaces.remove(space);
   }