INFORMATION_SCHEMA.TABLES (or other schema info table) and GLOBAL_TEMPORARY_TABLES queries running in parallel may crash or hang

[Laurynas Biveinis]

INFORMATION_SCHEMA.TABLES (or COLUMNS etc) table query running in parallel with INFORMATION_SCHEMA.GLOBAL_TEMPORARY_TABLES query may result in TABLES-query thread context having a mutex locked twice, or unlocked twice, or left locked, resulting in crashes or hangs.

[Laurynas Biveinis (laurynas-biveinis)]

This is caused by GLOBAL_TEMPORARY_TABLES query locking thd->LOCK_temporary_tables, TABLES query taking the backup of open tables state - which involves a bitwise copy of the mutex - and later restoring the copy, overwriting the mutex.

[Laurynas Biveinis (laurynas-biveinis)]

First this was seen on 5.5 percona_show_temp_tables_stress, very intermittently, a TSan error:

==================
WARNING: ThreadSanitizer: data race (pid=12435)
  Write of size 8 at 0x7d9c000000c0 by thread T26:
    #0 Open_tables_state::set_open_tables_state(Open_tables_state*) /home/laurynas/mysql-server/sql/sql_class.h:1150 (mysqld+0x0000005b0b89)
    #1 THD::restore_backup_open_tables_state(Open_tables_backup*) /home/laurynas/mysql-server/sql/sql_class.cc:3847 (mysqld+0x0000005b0b89)
    #2 get_all_tables(THD*, TABLE_LIST*, Item*) /home/laurynas/mysql-server/sql/sql_show.cc:4582 (mysqld+0x0000006b56e8)
    #3 do_fill_table /home/laurynas/mysql-server/sql/sql_show.cc:7666 (mysqld+0x0000006b63a1)
    #4 get_schema_tables_result(JOIN*, enum_schema_table_state) /home/laurynas/mysql-server/sql/sql_show.cc:7773 (mysqld+0x0000006b63a1)
    #5 JOIN::exec() /home/laurynas/mysql-server/sql/sql_select.cc:1977 (mysqld+0x000000684f3d)
    #6 mysql_select(THD*, Item***, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /home/laurynas/mysql-server/sql/sql_select.cc:2662 (mysqld+0x00000067d053)
    #7 handle_select(THD*, LEX*, select_result*, unsigned long) /home/laurynas/mysql-server/sql/sql_select.cc:315 (mysqld+0x00000067d54a)
    #8 execute_sqlcom_select /home/laurynas/mysql-server/sql/sql_parse.cc:4870 (mysqld+0x0000005f1fc1)
    #9 mysql_execute_command(THD*) /home/laurynas/mysql-server/sql/sql_parse.cc:2363 (mysqld+0x0000005fdfec)
    #10 sp_instr_stmt::exec_core(THD*, unsigned int*) /home/laurynas/mysql-server/sql/sp_head.cc:3222 (mysqld+0x0000009bbedc)
    #11 sp_lex_keeper::reset_lex_and_exec_core(THD*, unsigned int*, bool, sp_instr*) /home/laurynas/mysql-server/sql/sp_head.cc:2991 (mysqld+0x0000009c8561)
    #12 sp_instr_stmt::execute(THD*, unsigned int*) /home/laurynas/mysql-server/sql/sp_head.cc:3149 (mysqld+0x0000009c8973)
    #13 sp_head::execute(THD*, bool) /home/laurynas/mysql-server/sql/sp_head.cc:1435 (mysqld+0x0000009c0c94)
    #14 sp_head::execute_procedure(THD*, List<Item>*) /home/laurynas/mysql-server/sql/sp_head.cc:2192 (mysqld+0x0000009c3766)
    #15 mysql_execute_command(THD*) /home/laurynas/mysql-server/sql/sql_parse.cc:4314 (mysqld+0x00000060791b)
    #16 mysql_parse(THD*, char*, unsigned int, Parser_state*) /home/laurynas/mysql-server/sql/sql_parse.cc:6060 (mysqld+0x00000060aedb)
    #17 dispatch_command(enum_server_command, THD*, char*, unsigned int) /home/laurynas/mysql-server/sql/sql_parse.cc:1075 (mysqld+0x00000060d689)
    #18 do_command(THD*) /home/laurynas/mysql-server/sql/sql_parse.cc:789 (mysqld+0x000000610769)
    #19 do_handle_one_connection(THD*) /home/laurynas/mysql-server/sql/sql_connect.cc:1418 (mysqld+0x00000075107d)
    #20 handle_one_connection /home/laurynas/mysql-server/sql/sql_connect.cc:1325 (mysqld+0x00000075123e)
    #21 pfs_spawn_thread /home/laurynas/mysql-server/storage/perfschema/pfs.cc:1015 (mysqld+0x000000a91eb4)
    #22 <null> <null> (libtsan.so.0+0x0000000230d9)

  Previous write of size 8 at 0x7d9c000000c0 by thread T25 (mutexes: write M604, write M96050, write M96049):...

[Laurynas Biveinis (laurynas-biveinis)]

     https://github.com/percona/percona-server/pull/870
     https://github.com/percona/percona-server/pull/871
     https://github.com/percona/percona-server/pull/872

[Shahriyar Rzayev (rzayev-sehriyar)]

Percona now uses JIRA for bug reports so this bug report is migrated to: https://jira.percona.com/browse/PS-999