Failing assertion: list.count > 0 in ut_list_remove or Assertion `lock->trx == this' failed in dberr_t trx_t::drop_table

--source include/have_innodb.inc

CREATE TABLE t1 (pk INT PRIMARY KEY) ENGINE=InnoDB;

INSERT INTO t1 VALUES (1);

CREATE TABLE t2 (pk INT PRIMARY KEY, FOREIGN KEY(pk) REFERENCES t1(pk)) ENGINE=InnoDB;

--connect (con1,localhost,root,,test)

SET FOREIGN_KEY_CHECKS= OFF;

--send

  CREATE OR REPLACE TABLE t1 (b INT) ENGINE=InnoDB;

--connection default

--error 0,ER_NO_REFERENCED_ROW_2

INSERT INTO t2 VALUES (1);

--connection con1

--error 0,ER_CANT_CREATE_TABLE

--reap

# Cleanup

--disconnect con1

--connection default

DROP TABLE IF EXISTS t2, t1;

mariadbd: /data/src/10.6/storage/innobase/dict/drop.cc:161: dberr_t trx_t::drop_table(const dict_table_t&): Assertion `lock->trx == this' failed.

210722 20:47:20 [ERROR] mysqld got signal 6 ;

#7  0x00007f90122e5f36 in __GI___assert_fail (assertion=0x5570e43f93cf "lock->trx == this", file=0x5570e43f9088 "/data/src/10.6/storage/innobase/dict/drop.cc", line=161, function=0x5570e43f9318 "dberr_t trx_t::drop_table(const dict_table_t&)") at assert.c:101

#8  0x00005570e3d8cc45 in trx_t::drop_table (this=0x7f900c7da540, table=...) at /data/src/10.6/storage/innobase/dict/drop.cc:161

#9  0x00005570e3a314b1 in ha_innobase::delete_table (this=0x7f8fd0014e10, name=0x7f900c4e1820 "./test/t1") at /data/src/10.6/storage/innobase/handler/ha_innodb.cc:13491

#10 0x00005570e35aac20 in hton_drop_table (hton=0x5570e75953f8, path=0x7f900c4e1820 "./test/t1") at /data/src/10.6/sql/handler.cc:576

#11 0x00005570e35b0fbe in ha_delete_table (thd=0x7f8fd0000db8, hton=0x5570e75953f8, path=0x7f900c4e1820 "./test/t1", db=0x7f900c4e15f0, alias=0x7f900c4e1600, generate_warning=false) at /data/src/10.6/sql/handler.cc:3086

#12 0x00005570e33042d5 in mysql_rm_table_no_locks (thd=0x7f8fd0000db8, tables=0x7f900c4e1d70, current_db=0x7f8fd0000e50, ddl_log_state=0x7f900c4e2810, if_exists=false, drop_temporary=false, drop_view=false, drop_sequence=false, dont_log_query=true, dont_free_locks=true) at /data/src/10.6/sql/sql_table.cc:1469

#13 0x00005570e330d272 in create_table_impl (thd=0x7f8fd0000db8, ddl_log_state_create=0x7f900c4e27f0, ddl_log_state_rm=0x7f900c4e2810, orig_db=..., orig_table_name=..., db=..., table_name=..., path=..., options=..., create_info=0x7f900c4e2ac0, alter_info=0x7f900c4e29d0, create_table_mode=0, is_trans=0x7f900c4e27ce, key_info=0x7f900c4e2530, key_count=0x7f900c4e2524, frm=0x7f900c4e2550) at /data/src/10.6/sql/sql_table.cc:4308

#14 0x00005570e330de17 in mysql_create_table_no_lock (thd=0x7f8fd0000db8, ddl_log_state_create=0x7f900c4e27f0, ddl_log_state_rm=0x7f900c4e2810, db=0x7f8fd0014298, table_name=0x7f8fd00142a8, create_info=0x7f900c4e2ac0, alter_info=0x7f900c4e29d0, is_trans=0x7f900c4e27ce, create_table_mode=0, table_list=0x7f8fd0014280) at /data/src/10.6/sql/sql_table.cc:4546

#15 0x00005570e330e3a8 in mysql_create_table (thd=0x7f8fd0000db8, create_table=0x7f8fd0014280, create_info=0x7f900c4e2ac0, alter_info=0x7f900c4e29d0) at /data/src/10.6/sql/sql_table.cc:4658

#16 0x00005570e332402f in Sql_cmd_create_table_like::execute (this=0x7f8fd0014220, thd=0x7f8fd0000db8) at /data/src/10.6/sql/sql_table.cc:11778

#17 0x00005570e321ab52 in mysql_execute_command (thd=0x7f8fd0000db8, is_called_from_prepared_stmt=false) at /data/src/10.6/sql/sql_parse.cc:5993

#18 0x00005570e3220cfd in mysql_parse (thd=0x7f8fd0000db8, rawbuf=0x7f8fd0014160 "CREATE OR REPLACE TABLE t1 (b INT) ENGINE=InnoDB", length=48, parser_state=0x7f900c4e3480) at /data/src/10.6/sql/sql_parse.cc:8026

#19 0x00005570e320d165 in dispatch_command (command=COM_QUERY, thd=0x7f8fd0000db8, packet=0x7f8fd000b879 "CREATE OR REPLACE TABLE t1 (b INT) ENGINE=InnoDB", packet_length=48, blocking=true) at /data/src/10.6/sql/sql_parse.cc:1896

#20 0x00005570e320bb01 in do_command (thd=0x7f8fd0000db8, blocking=true) at /data/src/10.6/sql/sql_parse.cc:1404

#21 0x00005570e33c921b in do_handle_one_connection (connect=0x5570e7b36db8, put_in_cache=true) at /data/src/10.6/sql/sql_connect.cc:1410

#22 0x00005570e33c8f77 in handle_one_connection (arg=0x5570e7b36db8) at /data/src/10.6/sql/sql_connect.cc:1312

#23 0x00005570e39391a5 in pfs_spawn_thread (arg=0x5570e7b36e98) at /data/src/10.6/storage/perfschema/pfs.cc:2201

#24 0x00007f90127fe609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#25 0x00007f90123d1293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

2021-07-22 20:49:26 0x7f15f40de700  InnoDB: Assertion failure in file /data/src/10.6/storage/innobase/include/ut0lst.h line 334

InnoDB: Failing assertion: list.count > 0

#6  0x0000558744e04e4e in ut_dbg_assertion_failed (expr=expr@entry=0x5587459f3f91 "list.count > 0", file=file@entry=0x5587459f3f60 "/data/src/10.6/storage/innobase/include/ut0lst.h", line=line@entry=334) at /data/src/10.6/storage/innobase/ut/ut0dbg.cc:60

#7  0x0000558744de45ef in ut_list_remove<ut_list_base<ib_lock_t, ut_list_node<ib_lock_t> ib_lock_t::*>, GenericGetNode<ib_lock_t> > (get_node=..., node=..., list=...) at /data/src/10.6/storage/innobase/lock/lock0lock.cc:3236

#8  ut_list_remove<ut_list_base<ib_lock_t, ut_list_node<ib_lock_t> ib_lock_t::*> > (elem=<optimized out>, list=...) at /data/src/10.6/storage/innobase/include/ut0lst.h:386

#9  lock_table_remove_low (lock=0x7f15eec5dcc8) at /data/src/10.6/storage/innobase/lock/lock0lock.cc:3291

#10 lock_table_dequeue (in_lock=0x7f15eec5dcc8, owns_wait_mutex=false) at /data/src/10.6/storage/innobase/lock/lock0lock.cc:3529

#11 0x00005587454c63c4 in lock_release_try (trx=<optimized out>) at /data/src/10.6/storage/innobase/lock/lock0lock.cc:3770

#12 lock_release (trx=trx@entry=0x7f15eec5d130) at /data/src/10.6/storage/innobase/lock/lock0lock.cc:3806

#13 0x0000558745581050 in trx_t::release_locks (this=0x7f15eec5d130) at /data/src/10.6/storage/innobase/trx/trx0trx.cc:490

#14 trx_t::commit_in_memory (this=this@entry=0x7f15eec5d130, mtr=mtr@entry=0x0) at /data/src/10.6/storage/innobase/trx/trx0trx.cc:1297

#15 0x000055874557fdd7 in trx_t::commit_low (mtr=<optimized out>, this=0x7f15eec5d130) at /data/src/10.6/storage/innobase/trx/trx0trx.cc:1453

#16 trx_t::commit_persist (this=0x7f15eec5d130) at /data/src/10.6/storage/innobase/trx/trx0trx.cc:1467

#17 0x000055874557ff06 in trx_t::commit (this=0x7f15eec5d130) at /data/src/10.6/storage/innobase/trx/trx0trx.cc:1473

#18 0x0000558745572656 in trx_t::rollback_finish (this=0x7f15eec5d130) at /data/src/10.6/storage/innobase/trx/trx0roll.cc:66

#19 trx_t::rollback_low (this=this@entry=0x7f15eec5d130, savept=savept@entry=0x0) at /data/src/10.6/storage/innobase/trx/trx0roll.cc:133

#20 0x0000558745571510 in trx_rollback_for_mysql_low (trx=0x7f15eec5d130) at /data/src/10.6/storage/innobase/trx/trx0roll.cc:190

#21 trx_rollback_for_mysql (trx=trx@entry=0x7f15eec5d130) at /data/src/10.6/storage/innobase/trx/trx0roll.cc:259

#22 0x000055874546d592 in innobase_rollback (hton=<optimized out>, thd=0x7f15c4000c58, rollback_trx=<optimized out>) at /data/src/10.6/storage/innobase/handler/ha_innodb.cc:4563

#23 0x0000558745168900 in ha_rollback_trans (thd=thd@entry=0x7f15c4000c58, all=all@entry=false) at /data/src/10.6/sql/handler.cc:2153

#24 0x0000558745057fb9 in trans_rollback_stmt (thd=thd@entry=0x7f15c4000c58) at /data/src/10.6/sql/transaction.cc:535

#25 0x0000558744f39ea1 in mysql_execute_command (thd=0x7f15c4000c58, is_called_from_prepared_stmt=<optimized out>) at /data/src/10.6/sql/sql_parse.cc:6046

#26 0x0000558744f2ac77 in mysql_parse (thd=0x7f15c4000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /data/src/10.6/sql/sql_parse.cc:8026

#27 0x0000558744f36bdd in dispatch_command (command=COM_QUERY, thd=0x7f15c4000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /data/src/10.6/sql/sql_class.h:1340

#28 0x0000558744f38af8 in do_command (thd=0x7f15c4000c58, blocking=blocking@entry=true) at /data/src/10.6/sql/sql_parse.cc:1404

#29 0x0000558745047db7 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /data/src/10.6/sql/sql_connect.cc:1410

#30 0x000055874504811d in handle_one_connection (arg=arg@entry=0x5587472c2148) at /data/src/10.6/sql/sql_connect.cc:1312

#31 0x00005587453cfadd in pfs_spawn_thread (arg=0x558747251018) at /data/src/10.6/storage/perfschema/pfs.cc:2201

#32 0x00007f15f9009609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#33 0x00007f15f8bf7293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

2021-07-22 21:11:39 0x7f99ce43e300  InnoDB: Assertion failure in file /data/src/10.6/storage/innobase/dict/dict0dict.cc line 1891

InnoDB: Failing assertion: table->n_rec_locks == 0

#6  0x000055ed0a795cf0 in ut_dbg_assertion_failed (expr=expr@entry=0x55ed0cabdae0 "table->n_rec_locks == 0", file=file@entry=0x55ed0cabc360 "/data/src/10.6/storage/innobase/dict/dict0dict.cc", line=line@entry=1891) at /data/src/10.6/storage/innobase/ut/ut0dbg.cc:60

#7  0x000055ed0a7b2050 in dict_sys_t::remove (this=<optimized out>, table=table@entry=0x617000071988, lru=lru@entry=false, keep=keep@entry=false) at /data/src/10.6/storage/innobase/dict/dict0dict.cc:1891

#8  0x000055ed0c2ecd03 in trx_t::commit (this=this@entry=0x7f99d4df3b20, deleted=std::vector of length 0, capacity 0) at /data/src/10.6/storage/innobase/dict/drop.cc:251

#9  0x000055ed0bdbcd1e in ha_innobase::delete_table (this=<optimized out>, name=<optimized out>) at /data/src/10.6/storage/innobase/handler/ha_innodb.cc:13496

#10 0x000055ed0b33ce49 in hton_drop_table (hton=<optimized out>, path=<optimized out>) at /data/src/10.6/sql/handler.cc:576

#11 0x000055ed0b3531c7 in ha_delete_table (thd=thd@entry=0x62b00010a218, hton=hton@entry=0x615000002898, path=path@entry=0x7f99ce438b80 "./test/t1", db=db@entry=0x7f99ce438000, alias=alias@entry=0x7f99ce438020, generate_warning=generate_warning@entry=false) at /data/src/10.6/sql/handler.cc:3086

#12 0x000055ed0add3835 in mysql_rm_table_no_locks (thd=0x62b00010a218, tables=<optimized out>, current_db=<optimized out>, ddl_log_state=<optimized out>, if_exists=<optimized out>, drop_temporary=<optimized out>, drop_view=<optimized out>, drop_sequence=<optimized out>, dont_log_query=<optimized out>, dont_free_locks=<optimized out>) at /data/src/10.6/sql/sql_table.cc:1469

#13 0x000055ed0ae0fce3 in create_table_impl (thd=thd@entry=0x62b00010a218, ddl_log_state_create=ddl_log_state_create@entry=0x7f99ce43a730, ddl_log_state_rm=ddl_log_state_rm@entry=0x7f99ce43a770, orig_db=..., orig_table_name=..., db=..., table_name=..., path=..., options=..., create_info=<optimized out>, alter_info=<optimized out>, create_table_mode=<optimized out>, is_trans=<optimized out>, key_info=<optimized out>, key_count=<optimized out>, frm=<optimized out>) at /data/src/10.6/sql/sql_table.cc:4308

#14 0x000055ed0ae10a41 in mysql_create_table_no_lock (thd=thd@entry=0x62b00010a218, ddl_log_state_create=ddl_log_state_create@entry=0x7f99ce43a730, ddl_log_state_rm=ddl_log_state_rm@entry=0x7f99ce43a770, db=db@entry=0x62b0001113a8, table_name=table_name@entry=0x62b0001113b8, create_info=create_info@entry=0x7f99ce43ab90, alter_info=<optimized out>, is_trans=<optimized out>, create_table_mode=<optimized out>, table_list=<optimized out>) at /data/src/10.6/sql/sql_table.cc:4546

#15 0x000055ed0ae1141c in mysql_create_table (thd=thd@entry=0x62b00010a218, create_table=create_table@entry=0x62b000111390, create_info=create_info@entry=0x7f99ce43ab90, alter_info=alter_info@entry=0x7f99ce43aa60) at /data/src/10.6/sql/sql_table.cc:4658

#16 0x000055ed0ae16a6f in Sql_cmd_create_table_like::execute (this=<optimized out>, thd=0x62b00010a218) at /data/src/10.6/sql/sql_table.cc:11778

#17 0x000055ed0abbaac4 in mysql_execute_command (thd=0x62b00010a218, is_called_from_prepared_stmt=<optimized out>) at /data/src/10.6/sql/sql_parse.cc:5993

#18 0x000055ed0ab81e94 in mysql_parse (thd=0x62b00010a218, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /data/src/10.6/sql/sql_parse.cc:8026

#19 0x000055ed0abae1b8 in dispatch_command (command=COM_QUERY, thd=0x62b00010a218, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /data/src/10.6/sql/sql_class.h:1340

#20 0x000055ed0abb4787 in do_command (thd=0x62b00010a218, blocking=blocking@entry=true) at /data/src/10.6/sql/sql_parse.cc:1404

#21 0x000055ed0af73a3c in do_handle_one_connection (connect=<optimized out>, put_in_cache=<optimized out>) at /data/src/10.6/sql/sql_connect.cc:1410

#22 0x000055ed0af74295 in handle_one_connection (arg=arg@entry=0x608000002f38) at /data/src/10.6/sql/sql_connect.cc:1312

#23 0x000055ed0bb9c3a0 in pfs_spawn_thread (arg=0x61700000a898) at /data/src/10.6/storage/perfschema/pfs.cc:2201

#24 0x00007f99de38b609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#25 0x00007f99ddf5e293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

==4176551==ERROR: AddressSanitizer: heap-use-after-free on address 0x61600009c720 at pc 0x55ae52a25d28 bp 0x7f1d0def83c0 sp 0x7f1d0def83b0

READ of size 8 at 0x61600009c720 thread T12

    #0 0x55ae52a25d27 in lock_rec_dequeue_from_page /data/src/10.6/storage/innobase/lock/lock0lock.cc:1933

    #1 0x55ae52a2b561 in lock_release_try /data/src/10.6/storage/innobase/lock/lock0lock.cc:3755

    #2 0x55ae52a2b561 in lock_release(trx_t*) /data/src/10.6/storage/innobase/lock/lock0lock.cc:3806

    #3 0x55ae52cacb1f in trx_t::release_locks() /data/src/10.6/storage/innobase/trx/trx0trx.cc:490

    #4 0x55ae52cacb1f in trx_t::commit_in_memory(mtr_t const*) /data/src/10.6/storage/innobase/trx/trx0trx.cc:1297

    #5 0x55ae52cab240 in trx_t::commit_persist() /data/src/10.6/storage/innobase/trx/trx0trx.cc:1467

    #6 0x55ae52cabc40 in trx_t::commit() /data/src/10.6/storage/innobase/trx/trx0trx.cc:1473

    #7 0x55ae52cabc40 in trx_commit_for_mysql(trx_t*) /data/src/10.6/storage/innobase/trx/trx0trx.cc:1589

    #8 0x55ae52905a95 in innobase_commit_low(trx_t*) /data/src/10.6/storage/innobase/handler/ha_innodb.cc:4258

    #9 0x55ae52905d1a in innobase_commit_ordered_2 /data/src/10.6/storage/innobase/handler/ha_innodb.cc:4364

    #10 0x55ae52906131 in innobase_commit /data/src/10.6/storage/innobase/handler/ha_innodb.cc:4468

    #11 0x55ae51eb59b8 in commit_one_phase_2 /data/src/10.6/sql/handler.cc:2041

    #12 0x55ae51eb7fe9 in ha_commit_trans(THD*, bool) /data/src/10.6/sql/handler.cc:1788

    #13 0x55ae51b29150 in trans_commit_stmt(THD*) /data/src/10.6/sql/transaction.cc:472

    #14 0x55ae51739d91 in mysql_execute_command(THD*, bool) /data/src/10.6/sql/sql_parse.cc:6053

    #15 0x55ae51701e93 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/src/10.6/sql/sql_parse.cc:8026

    #16 0x55ae5172e1b7 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/src/10.6/sql/sql_parse.cc:1896

    #17 0x55ae51734786 in do_command(THD*, bool) /data/src/10.6/sql/sql_parse.cc:1404

    #18 0x55ae51af3a3b in do_handle_one_connection(CONNECT*, bool) /data/src/10.6/sql/sql_connect.cc:1410

    #19 0x55ae51af4294 in handle_one_connection /data/src/10.6/sql/sql_connect.cc:1312

    #20 0x55ae5271c39f in pfs_spawn_thread /data/src/10.6/storage/perfschema/pfs.cc:2201

    #21 0x7f1d1d28d608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

    #22 0x7f1d1ce60292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)