Assertion `"unexpected references" == 0' failed upon failing CREATE OR REPLACE

mysqld: /server/storage/innobase/handler/ha_innodb.cc:14561: virtual int ha_innobase::rename_table(const char*, const char*): Assertion `"unexpected references" == 0' failed.

260814  6:29:38 [ERROR] /server/sql/mysqld got signal 6 ;

#6  0x00007f97f56334ac in abort () from /lib/x86_64-linux-gnu/libc.so.6

#7  0x00007f97f5633420 in ?? () from /lib/x86_64-linux-gnu/libc.so.6

#8  0x0000559ee92c4dab in ha_innobase::rename_table (this=0x77977dc08900, from=0x7f97dc397ce0 "./partition_db/#sql-create-1f6b2-14-4#P#p0", to=0x7f97dc397ef0 "./partition_db/tlist_2_8#P#p0") at /server/storage/innobase/handler/ha_innodb.cc:14561

#9  0x0000559ee8dcbdb2 in handler::ha_rename_table (this=0x77977dc08900, from=0x7f97dc397ce0 "./partition_db/#sql-create-1f6b2-14-4#P#p0", to=0x7f97dc397ef0 "./partition_db/tlist_2_8#P#p0") at /server/sql/handler.cc:6140

#10 0x0000559ee912cffd in ha_partition::del_ren_table (this=0x77977dbff750, from=0x7f97dc3991c0 "./partition_db/#sql-create-1f6b2-14-4", to=0x7f97dc398fb0 "./partition_db/tlist_2_8") at /server/sql/ha_partition.cc:2524

#11 0x0000559ee912873d in ha_partition::rename_table (this=0x77977dbff750, from=0x7f97dc3991c0 "./partition_db/#sql-create-1f6b2-14-4", to=0x7f97dc398fb0 "./partition_db/tlist_2_8") at /server/sql/ha_partition.cc:686

#12 0x0000559ee8dcbdb2 in handler::ha_rename_table (this=0x77977dbff750, from=0x7f97dc3991c0 "./partition_db/#sql-create-1f6b2-14-4", to=0x7f97dc398fb0 "./partition_db/tlist_2_8") at /server/sql/handler.cc:6140

#13 0x0000559ee8a72305 in execute_rename_table (thd=0x77977c000dd0, ddl_log_entry=0x7f97dc399450, file=0x77977dbff750, from_db=0x7f97dc399480, from_table=0x7f97dc399450, to_db=0x7f97dc399490, to_table=0x7f97dc399460, flags=1, from_path=0x7f97dc3991c0 "./partition_db/#sql-create-1f6b2-14-4", to_path=0x7f97dc398fb0 "./partition_db/tlist_2_8") at /server/sql/ddl_log.cc:1164

#14 0x0000559ee8a739f8 in ddl_log_execute_action (thd=0x77977c000dd0, mem_root=0x7f97dc399410, ddl_log_entry=0x7f97dc399450) at /server/sql/ddl_log.cc:1609

#15 0x0000559ee8a76744 in ddl_log_execute_entry_no_lock (thd=0x77977c000dd0, first_entry=15) at /server/sql/ddl_log.cc:2593

#16 0x0000559ee8a776dc in ddl_log_revert (thd=0x77977c000dd0, state=0x7f97dc39b1d0) at /server/sql/ddl_log.cc:3129

#17 0x0000559ee8a32848 in create_table_impl (thd=0x77977c000dd0, ddl_log_state_create=0x7f97dc39b1d0, ddl_log_state_rm=0x7f97dc39b1f0, orig_db=..., orig_table_name=..., db=..., table_name=..., path=..., options=..., create_info=0x7f97dc39b550, alter_info=0x7f97dc39b3d0, create_table_mode=0, is_trans=0x7f97dc39b1c3, key_info=0x7f97dc39af30, key_count=0x7f97dc39af24, frm=0x7f97dc39af50) at /server/sql/sql_table.cc:5450

#18 0x0000559ee8a32b9f in mysql_create_table_no_lock (thd=0x77977c000dd0, ddl_log_state_create=0x7f97dc39b1d0, ddl_log_state_rm=0x7f97dc39b1f0, create_info=0x7f97dc39b550, alter_info=0x7f97dc39b3d0, is_trans=0x7f97dc39b1c3, create_table_mode=0, table_list=0x77977c017550) at /server/sql/sql_table.cc:5514

#19 0x0000559ee8a33551 in mysql_create_table (thd=0x77977c000dd0, create_table=0x77977c017550, create_info=0x7f97dc39b550, alter_info=0x7f97dc39b3d0) at /server/sql/sql_table.cc:5747

#20 0x0000559ee8a4da62 in Sql_cmd_create_table_like::execute (this=0x77977c017460, thd=0x77977c000dd0) at /server/sql/sql_table.cc:14284

#21 0x0000559ee88f5d15 in mysql_execute_command (thd=0x77977c000dd0, is_called_from_prepared_stmt=false) at /server/sql/sql_parse.cc:5905

#22 0x0000559ee88fc056 in mysql_parse (thd=0x77977c000dd0, rawbuf=0x77977c017320 "/* WRK-4 QNO 156 */  CREATE OR REPLACE TABLE `partition_db`.`tlist_2_8` ( col1 TIME NULL ) ENGINE=CSV", length=101, parser_state=0x7f97dc39c1c0) at /server/sql/sql_parse.cc:7956

#23 0x0000559ee88e7e87 in dispatch_command (command=COM_QUERY, thd=0x77977c000dd0, packet=0x77977c00c5c1 "/* WRK-4 QNO 156 */  CREATE OR REPLACE TABLE `partition_db`.`tlist_2_8` ( col1 TIME NULL ) ENGINE=CSV ", packet_length=102, blocking=true) at /server/sql/sql_parse.cc:1903

#24 0x0000559ee88e695a in do_command (thd=0x77977c000dd0, blocking=true) at /server/sql/sql_parse.cc:1437

#25 0x0000559ee8b168e7 in do_handle_one_connection (connect=0x559f2402ec40, put_in_cache=true) at /server/sql/sql_connect.cc:1514

#26 0x0000559ee8b16699 in handle_one_connection (arg=0x559f2402ec40) at /server/sql/sql_connect.cc:1426

#27 0x0000559ee914afa0 in pfs_spawn_thread (arg=0x559f2402ed30) at /server/storage/perfschema/pfs.cc:2198

Connection ID (thread ID): 20

Status: NOT_KILLED

Query (0x77977c017320): /* WRK-4 QNO 156 */  CREATE OR REPLACE TABLE `partition_db`.`tlist_2_8` ( col1 TIME NULL ) ENGINE=CSV

  Root cause: when CREATE OR REPLACE TABLE tlist_2_8 (col1 TIME NULL) ENGINE=CSV fails (CSV doesn't support nullable columns) after the new atomic

  machinery has already renamed the live partitioned InnoDB table to an internal #sql-create-... backup name, the ddl_log_revert() rename-back

  assumes it's the only holder of a reference to that table. But trx_purge_table_acquire() deliberately skips MDL entirely for tables whose

  current name starts with #sql — so InnoDB purge can grab its own unprotected reference to the backed-up table while it sits under that alias. If

  purge's reference is still live when the rename-back completes, ha_innobase::rename_table()'s final t->release() finds more than the expected

  one reference and hits ut_ad("unexpected references" == 0) at ha_innodb.cc:14561 — exactly the trial's signature.

  Reproduction: I confirmed this mechanism with a deterministic GDB fault-injection reproducer The injected crash matches the original 

  frame-for-frame, same file:line at every level — 

  ha_innobase::rename_table → ha_partition::del_ren_table → execute_rename_table → ddl_log_revert → create_table_impl →

  mysql_execute_command/mysql_parse.

set pagination off

set confirm off

set logging file /data/local/repro81040/gdb2.log

set logging on

set $hits = 0

break ha_innodb.cc:14558

commands 1

silent

set $hits = $hits + 1

if $hits == 6

  printf "INJECTING extra reference on hit #%d (from=%s to=%s)\n", $hits, from, to

  set variable t->n_ref_count.m_counter._M_i = t->n_ref_count.m_counter._M_i + 1

  delete 1

end

continue

end

continue

echo === GDB REGAINED CONTROL (likely crash) ===\n

bt

thread apply all bt

quit

DROP DATABASE IF EXISTS test810;

CREATE DATABASE test810;

USE test810;

CREATE TABLE tlist_2_8 (col_int_nokey INT, col_int_key INT NOT NULL, KEY(col_int_key))

  ENGINE=InnoDB PARTITION BY LIST (col_int_key)

  (PARTITION p0 VALUES IN (9, NULL), PARTITION p1 VALUES IN (0,6,7),

   PARTITION p2 VALUES IN (3,2,4), PARTITION p3 VALUES IN (8,5,1), PARTITION pdef DEFAULT);

INSERT INTO tlist_2_8 (col_int_key) VALUES (2),(4),(2),(1),(2),(2),(5),(3),(4),(5),(6),(2),(6),(2),(9),(2),(6),(8),(8),(3),(1),(7),(3),(8),(2),(4),(3),(4),(1),(0);

CREATE OR REPLACE TABLE tlist_2_8 (col1 TIME NULL) ENGINE=CSV;