Galera crashes when running CoR for a locked table

SET autocommit=0;

CREATE TABLE t0 (x INT,y INT);

LOCK TABLES t0 WRITE;

CREATE OR REPLACE TABLE t0 SELECT 1;

Core was generated by `/test/mtest/10.11/mariadb-10.11.0-linux-x86_64/bin/mysqld --defaults-file=/test'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

[Current thread is 1 (Thread 0x147ff804b700 (LWP 3716530))]

(gdb) bt

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

#1  0x000056528e7f1daf in my_write_core (sig=sig@entry=11) at /test/mtest/10.11/mysys/stacktrace.c:424

#2  0x000056528e333fd0 in handle_fatal_signal (sig=11) at /test/mtest/10.11/sql/signal_handler.cc:355

#3  <signal handler called>

#4  gu_mutex_lock_SYS (mutex=<optimized out>) at /test/mtest/10.4_galera/galera/src/trx_handle.hpp:1144

#5  gu::Mutex::lock (this=<optimized out>) at /test/mtest/10.4_galera/galerautils/src/gu_mutex.hpp:51

#6  galera::TrxHandleMaster::lock (this=<optimized out>) at /test/mtest/10.4_galera/galera/src/trx_handle.hpp:845

#7  galera::TrxHandleLock::TrxHandleLock (trx=<error reading variable>, this=0x147ff8049b10) at /test/mtest/10.4_galera/galera/src/trx_handle.hpp:1148

#8  galera_replay_trx (gh=<optimized out>, trx_handle=<optimized out>, recv_ctx=0x147ff8049d50) at /test/mtest/10.4_galera/galera/src/wsrep_provider.cpp:338

#9  0x000056528e899bed in wsrep::wsrep_provider_v26::replay (this=<optimized out>, ws_handle=<optimized out>, reply_service=<optimized out>) at /test/mtest/10.11/wsrep-lib/src/wsrep_provider_v26.cpp:209

#10 0x000056528e5956e2 in Wsrep_client_service::replay (this=0x147f94007370) at /test/mtest/10.11/wsrep-lib/include/wsrep/transaction.hpp:225

#11 0x000056528e89133a in wsrep::transaction::replay (this=0x147f940073f0, lock=@0x147ff804a220: {_M_device = 0x147f94007350, _M_owns = false}) at /test/mtest/10.11/wsrep-lib/src/transaction.cpp:1999

#12 0x000056528e894406 in wsrep::transaction::after_statement (this=this@entry=0x147f940073f0) at /test/mtest/10.11/wsrep-lib/src/transaction.cpp:862

#13 0x000056528e87b6b2 in wsrep::client_state::after_statement (this=this@entry=0x147f94007388) at /test/mtest/10.11/wsrep-lib/src/client_state.cpp:278

#14 0x000056528e0e5e48 in wsrep_after_statement (thd=0x147f94000c58) at /test/mtest/10.11/sql/sql_class.h:5397

#15 wsrep_after_statement (thd=0x147f94000c58) at /test/mtest/10.11/sql/wsrep_trans_observer.h:432

#16 wsrep_mysql_parse (thd=0x147f94000c58, rawbuf=0x147f94010a60 "CREATE OR REPLACE TABLE t0 SELECT 1", length=35, parser_state=0x147ff804a3d0) at /test/mtest/10.11/sql/sql_parse.cc:7864

#17 0x000056528e0f3f44 in dispatch_command (command=COM_QUERY, thd=0x147f94000c58, packet=0x147f94008739 "CREATE OR REPLACE TABLE t0 SELECT 1", packet_length=<optimized out>, blocking=<optimized out>) at /test/mtest/10.11/sql/sql_class.h:1346

#18 0x000056528e0f495e in do_command (thd=0x147f94000c58, blocking=blocking@entry=true) at /test/mtest/10.11/sql/sql_parse.cc:1407

#19 0x000056528e2114b7 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/mtest/10.11/sql/sql_connect.cc:1416

#20 0x000056528e2117ed in handle_one_connection (arg=arg@entry=0x5652907c2398) at /test/mtest/10.11/sql/sql_connect.cc:1318

#21 0x000056528e53d22d in pfs_spawn_thread (arg=0x5652907dae98) at /test/mtest/10.11/storage/perfschema/pfs.cc:2201

#22 0x000014800a051609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#23 0x0000148009c22133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

mysqld: /test/10.11_dbg/wsrep-lib/src/transaction.cpp:445: int wsrep::transaction::before_commit(): Assertion `state() == s_executing || state() == s_prepared || state() == s_committing || state() == s_must_abort || state() == s_replaying' failed.

Core was generated by `/test/GAL_MD171022-mariadb-10.11.0-linux-x86_64-dbg/bin/mysqld --defaults-file='.

Program terminated with signal SIGABRT, Aborted.

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)

    at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

[Current thread is 1 (Thread 0x14e0edb1a700 (LWP 405916))]

(gdb) bt

#0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:56

#1  0x00005637e95e36d1 in my_write_core (sig=sig@entry=6) at /test/10.11_dbg/mysys/stacktrace.c:424

#2  0x00005637e8ebfda4 in handle_fatal_signal (sig=6) at /test/10.11_dbg/sql/signal_handler.cc:355

#3  <signal handler called>

#4  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50

#5  0x000014e123b92859 in __GI_abort () at abort.c:79

#6  0x000014e123b92729 in __assert_fail_base (fmt=0x14e123d28588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x5637e9d6e4c8 "state() == s_executing || state() == s_prepared || state() == s_committing || state() == s_must_abort || state() == s_replaying", file=0x5637e9d6d2f8 "/test/10.11_dbg/wsrep-lib/src/transaction.cpp", line=445, function=<optimized out>) at assert.c:92

#7  0x000014e123ba3fd6 in __GI___assert_fail (assertion=assertion@entry=0x5637e9d6e4c8 "state() == s_executing || state() == s_prepared || state() == s_committing || state() == s_must_abort || state() == s_replaying", file=file@entry=0x5637e9d6d2f8 "/test/10.11_dbg/wsrep-lib/src/transaction.cpp", line=line@entry=445, function=function@entry=0x5637e9d6e468 "int wsrep::transaction::before_commit()") at assert.c:101

#8  0x00005637e975e4ef in wsrep::transaction::before_commit (this=this@entry=0x14e0ac0075a8) at /test/10.11_dbg/wsrep-lib/src/transaction.cpp:531

#9  0x00005637e8ed5140 in wsrep::client_state::before_commit (this=0x14e0ac007540) at /test/10.11_dbg/wsrep-lib/include/wsrep/client_state.hpp:503

#10 wsrep_before_commit (all=true, thd=0x14e0ac000d48) at /test/10.11_dbg/sql/wsrep_trans_observer.h:283

#11 ha_commit_trans (thd=thd@entry=0x14e0ac000d48, all=all@entry=true) at /test/10.11_dbg/sql/handler.cc:1807

#12 0x00005637e8d54ffe in trans_commit_implicit (thd=thd@entry=0x14e0ac000d48) at /test/10.11_dbg/sql/transaction.cc:329

#13 0x00005637e8bec0a1 in mysql_execute_command (thd=thd@entry=0x14e0ac000d48, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.11_dbg/sql/sql_parse.cc:6096

#14 0x00005637e8bd3b31 in mysql_parse (thd=thd@entry=0x14e0ac000d48, rawbuf=rawbuf@entry=0x14e0ac013230 "CREATE OR REPLACE TABLE t0 SELECT 0 ms", length=length@entry=38, parser_state=parser_state@entry=0x14e0edb19300) at /test/10.11_dbg/sql/sql_parse.cc:8023

#15 0x00005637e8bd3531 in wsrep_mysql_parse (thd=thd@entry=0x14e0ac000d48, rawbuf=0x14e0ac013230 "CREATE OR REPLACE TABLE t0 SELECT 0 ms", length=38, parser_state=parser_state@entry=0x14e0edb19300) at /test/10.11_dbg/sql/sql_parse.cc:7834

#16 0x00005637e8be1151 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14e0ac000d48, packet=packet@entry=0x14e0ac00af09 "CREATE OR REPLACE TABLE t0 SELECT 0 ms", packet_length=packet_length@entry=38, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_class.h:1346

#17 0x00005637e8be3587 in do_command (thd=0x14e0ac000d48, blocking=blocking@entry=true) at /test/10.11_dbg/sql/sql_parse.cc:1407

#18 0x00005637e8d411b0 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5637ecf2a058, put_in_cache=put_in_cache@entry=true) at /test/10.11_dbg/sql/sql_connect.cc:1416

#19 0x00005637e8d41682 in handle_one_connection (arg=0x5637ecf2a058) at /test/10.11_dbg/sql/sql_connect.cc:1318

#20 0x000014e1240a3609 in start_thread (arg=<optimized out>) at pthread_create.c:477

#21 0x000014e123c8f133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95