use-after-free in MDL_context::release_lock on FLUSH TABLE GTT

--source include/have_innodb.inc

CREATE GLOBAL TEMPORARY TABLE t (x INT) ON COMMIT PRESERVE ROWS ENGINE=InnoDB;

SET SESSION tx_read_only=1;

HANDLER t OPEN;

LOCK TABLES t READ;

LOCK TABLES t WRITE;

FLUSH TABLE t;

Core was generated by `/test/MDEV-35915_2_MD060925-mariadb-12.0.1-linux-x86_64-opt/bin/mariadbd --no-d'.

Program terminated with signal SIGSEGV, Segmentation fault.

#0  ilist<MDL_ticket, void>::erase (this=0x630adde0c2c8, pos=...)at /test/bb-12.0-nikita-global-tmp_opt/include/ilist.h:193

[Current thread is 1 (LWP 640652)]

(gdb) bt

#0  ilist<MDL_ticket, void>::erase (this=0x630adde0c2c8, pos={node_ = 0x748c44013898})at /test/bb-12.0-nikita-global-tmp_opt/include/ilist.h:193

#1  ilist<MDL_ticket, void>::remove (this=0x630adde0c2c8, value=@0x748c44013890: {<MDL_wait_for_subgraph> = {_vptr$MDL_wait_for_subgraph = 0x748b0cc53303, static _vtable$ = <optimized out>}, <ilist_node<void>> = {next = 0x91826bf1476a0c77, prev = 0x630adde0c2c8}, next_in_context = 0x748c44016ea0, prev_in_context = 0x748c44000ef0, m_time = 0, m_type = MDL_SHARED_READ, m_ctx = 0x748c44000e78, m_lock = 0x630adde0c0c8, m_psi = 0x0, static _vtable$ = <optimized out>}) at /test/bb-12.0-nikita-global-tmp_opt/include/ilist.h:212

#2  MDL_lock::Ticket_list::remove_ticket (this=0x630adde0c2c8, ticket=0x748c44013890)at /test/bb-12.0-nikita-global-tmp_opt/sql/mdl.cc:1291

#3  MDL_lock::remove_ticket (this=0x630adde0c0c8, pins=0x630addc41a30, list=list@entry=&MDL_lock::m_granted, ticket=ticket@entry=0x748c44013890)at /test/bb-12.0-nikita-global-tmp_opt/sql/mdl.cc:1835

#4  0x0000630ada5ad4d4 in MDL_context::release_lock (this=<optimized out>, duration=MDL_EXPLICIT, ticket=0x748c44013890)at /test/bb-12.0-nikita-global-tmp_opt/sql/mdl.cc:2936

#5  MDL_context::release_lock (this=<optimized out>, ticket=0x748c44013890)at /test/bb-12.0-nikita-global-tmp_opt/sql/mdl.cc:2956

#6  0x0000630ada40d4ee in mysql_ha_close_table (handler=0x748c4402cfc0)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_handler.cc:231

#7  0x0000630ada40e91a in mysql_ha_flush_tables (thd=thd@entry=0x748c44000c68, all_tables=all_tables@entry=0x748c440177a8)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_handler.cc:1154

#8  0x0000630ada37de80 in close_cached_tables (thd=thd@entry=0x748c44000c68, tables=tables@entry=0x748c440177a8, wait_for_refresh=true, timeout=86400)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_base.cc:449

#9  0x0000630ada5d9956 in reload_acl_and_cache (thd=thd@entry=0x748c44000c68, options=4, tables=tables@entry=0x748c440177a8, write_to_binlog=write_to_binlog@entry=0x748d6c968070)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_reload.cc:358

#10 0x0000630ada451f99 in mysql_execute_command (thd=thd@entry=0x748c44000c68, is_called_from_prepared_stmt=false)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_parse.cc:5333

#11 0x0000630ada44b8d4 in mysql_parse (thd=thd@entry=0x748c44000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x748d6c968420)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_parse.cc:7893

#12 0x0000630ada44a07d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x748c44000c68, packet=packet@entry=0x748c44008a69 "FLUSH TABLE t", packet_length=packet_length@entry=13, blocking=true)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_parse.cc:1881

#13 0x0000630ada44bd51 in do_command (thd=thd@entry=0x748c44000c68, blocking=true) at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_parse.cc:1420

#14 0x0000630ada5a127d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x630adde51a38, put_in_cache=true)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_connect.cc:1414

#15 0x0000630ada5a103f in handle_one_connection (arg=arg@entry=0x630adde51a38)at /test/bb-12.0-nikita-global-tmp_opt/sql/sql_connect.cc:1326

#16 0x0000630ada75f7e9 in pfs_spawn_thread (arg=0x630adde01748)at /test/bb-12.0-nikita-global-tmp_opt/storage/perfschema/pfs.cc:2198

#17 0x0000748d6fa9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#18 0x0000748d6fb29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

mariadbd: /test/bb-12.0-nikita-global-tmp_dbg/sql/mdl.cc:2954: void MDL_context::release_lock(MDL_ticket *): Assertion `ticket->m_duration == MDL_EXPLICIT' failed.

Core was generated by `/test/MDEV-35915_2_MD060925-mariadb-12.0.1-linux-x86_64-dbg/bin/mariadbd --no-d'.

Program terminated with signal SIGABRT, Aborted.

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 656567)]

(gdb) bt

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

#1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78

#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89

#3  0x00007c87cb24526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26

#4  0x00007c87cb2288ff in __GI_abort () at ./stdlib/abort.c:79

#5  0x00007c87cb22881b in __assert_fail_base (fmt=0x7c87cb3d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5c219f37407c "ticket->m_duration == MDL_EXPLICIT", file=file@entry=0x5c219f38ea73 "/test/bb-12.0-nikita-global-tmp_dbg/sql/mdl.cc", line=line@entry=2954, function=function@entry=0x5c219f2f68c3 "void MDL_context::release_lock(MDL_ticket *)") at ./assert/assert.c:94

#6  0x00007c87cb23b507 in __assert_fail (assertion=0x5c219f37407c "ticket->m_duration == MDL_EXPLICIT", file=0x5c219f38ea73 "/test/bb-12.0-nikita-global-tmp_dbg/sql/mdl.cc", line=2954, function=0x5c219f2f68c3 "void MDL_context::release_lock(MDL_ticket *)")at ./assert/assert.c:103

#7  0x00005c21a00c4e36 in MDL_context::release_lock (this=0x7c867c000f70, ticket=0x7c867c015f50)at /test/bb-12.0-nikita-global-tmp_dbg/sql/mdl.cc:2954

#8  0x00005c219fe6558e in mysql_ha_close_table (handler=0x7c867c035e40)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_handler.cc:231

#9  0x00005c219fe672f9 in mysql_ha_flush_tables (thd=0x7c867c000d58, all_tables=0x7c867c019fa8)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_handler.cc:1154

#10 0x00005c219fd6a8f1 in close_cached_tables (thd=0x7c867c000d58, tables=0x7c867c019fa8, wait_for_refresh=true, timeout=86400)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_base.cc:449

#11 0x00005c21a01032d0 in reload_acl_and_cache (thd=0x7c867c000d58, options=4, tables=0x7c867c019fa8, write_to_binlog=0x7c87c8216b94)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_reload.cc:358

#12 0x00005c219fecda05 in mysql_execute_command (thd=0x7c867c000d58, is_called_from_prepared_stmt=false)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_parse.cc:5333

#13 0x00005c219fec0ea8 in mysql_parse (thd=0x7c867c000d58, rawbuf=0x7c867c019ef0 "FLUSH TABLE t", length=13, parser_state=0x7c87c8217a10)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_parse.cc:7893

#14 0x00005c219febe689 in dispatch_command (command=COM_QUERY, thd=0x7c867c000d58, packet=0x7c867c00b269 "FLUSH TABLE t", packet_length=13, blocking=true)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_parse.cc:1881

#15 0x00005c219fec192a in do_command (thd=0x7c867c000d58, blocking=true)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_parse.cc:1420

#16 0x00005c21a00b2c1e in do_handle_one_connection (connect=0x5c21a29e9048, put_in_cache=true)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_connect.cc:1414

#17 0x00005c21a00b2a01 in handle_one_connection (arg=0x5c21a29117d8)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_connect.cc:1326

#18 0x00007c87cb29ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#19 0x00007c87cb329c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

CREATE GLOBAL TEMPORARY TABLE t (x INT) ON COMMIT PRESERVE ROWS ENGINE=MyISAM;

SET SESSION tx_read_only=1;

HANDLER t OPEN;

LOCK TABLES t READ;

LOCK TABLES t WRITE;

FLUSH TABLE t;

mariadbd: /test/bb-12.0-nikita-global-tmp_dbg/sql/mdl.cc:2954: void MDL_context::release_lock(MDL_ticket *): Assertion `ticket->m_duration == MDL_EXPLICIT' failed.

Core was generated by `/test/MDEV-35915_2_MD060925-mariadb-12.0.1-linux-x86_64-dbg/bin/mariadbd --defa'.

Program terminated with signal SIGABRT, Aborted.

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 1208692)]

(gdb) bt

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

#1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78

#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89

#3  0x000070fe9164526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26

#4  0x000070fe916288ff in __GI_abort () at ./stdlib/abort.c:79

#5  0x000070fe9162881b in __assert_fail_base (fmt=0x70fe917d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5a5390b5407c "ticket->m_duration == MDL_EXPLICIT", file=file@entry=0x5a5390b6ea73 "/test/bb-12.0-nikita-global-tmp_dbg/sql/mdl.cc", line=line@entry=2954, function=function@entry=0x5a5390ad68c3 "void MDL_context::release_lock(MDL_ticket *)") at ./assert/assert.c:94

#6  0x000070fe9163b507 in __assert_fail (assertion=0x5a5390b5407c "ticket->m_duration == MDL_EXPLICIT", file=0x5a5390b6ea73 "/test/bb-12.0-nikita-global-tmp_dbg/sql/mdl.cc", line=2954, function=0x5a5390ad68c3 "void MDL_context::release_lock(MDL_ticket *)")at ./assert/assert.c:103

#7  0x00005a53918a4e36 in MDL_context::release_lock (this=0x70fe58000f70, ticket=0x70fe5803a0d0)at /test/bb-12.0-nikita-global-tmp_dbg/sql/mdl.cc:2954

#8  0x00005a539164558e in mysql_ha_close_table (handler=0x70fe581e2010)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_handler.cc:231

#9  0x00005a539164744f in mysql_ha_cleanup_no_free (thd=0x70fe58000d58)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_handler.cc:1220

#10 0x00005a5391647485 in mysql_ha_cleanup (thd=0x70fe58000d58)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_handler.cc:1229

#11 0x00005a5391572994 in THD::cleanup (this=0x70fe58000d58)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_class.cc:1687

#12 0x00005a5391217e67 in unlink_thd (thd=0x70fe58000d58)at /test/bb-12.0-nikita-global-tmp_dbg/sql/mysqld.cc:2868

#13 0x00005a5391892c7c in do_handle_one_connection (connect=0x5a5393ee9058, put_in_cache=true)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_connect.cc:1425

#14 0x00005a5391892a01 in handle_one_connection (arg=0x5a5393fabd98)at /test/bb-12.0-nikita-global-tmp_dbg/sql/sql_connect.cc:1326

#15 0x000070fe9169ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447

#16 0x000070fe91729c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78