Fix crashing innodb due to innobase_share usage_count not being reduced for temp table accesses

sql/handler.h

@@ -2816,6 +2816,16 @@ class handler :public Sql_alloc
  double estimate_in_memory_buffer(ulonglong table_index_size) const;
 
 public:
+ /* Reduce the reference count for the storage in engine share
+ This member has been created to target the INNODB storage
+ engine, for a case where a thread other than the owning
+ thread of a temporary table accesses the temporary
+ table. In INNODB the reference count for the INNOBASE_SHARE
+ is increased when this access happens. This function is 
+ provided to allow MySQL to reduce this reference count once
+ the access is complete
+ */
+ virtual void reduce_share_refcount() { return; }
  virtual ha_rows multi_range_read_info_const(uint keyno, RANGE_SEQ_IF *seq,
  void *seq_init_param, 
  uint n_ranges, uint *bufsz,

sql/sql_base.cc

@@ -1612,6 +1612,16 @@ void close_thread_tables(THD *thd)
  table->file->extra(HA_EXTRA_DETACH_CHILDREN);
  table->cleanup_gc_items();
  }
+
+ char tmp_table_name_prefix[] = "#sql-";
+ const size_t prefix_len = 5;
+ /* Check if the table is a temp table owned by a different thread */
+ if (table->query_id != thd->query_id && !memcmp(tmp_table_name_prefix, table->s->table_name.str, prefix_len))
+ {
+ sql_print_information("table: '%s' owning_query_id: %lu but the query id for this thread is %lu",
+ table->s->table_name.str, (ulong) table->query_id, (ulong) thd->query_id);
+ reduce_se_share_ref_count(table);
+ }
  }
 
  /*

sql/table.cc

@@ -3143,6 +3143,11 @@ static bool unpack_gcol_info_from_frm(THD *thd,
  DBUG_RETURN(TRUE);
 }
 
+void reduce_se_share_ref_count(TABLE *table_arg)
+{
+ table_arg->file->reduce_share_refcount();
+}
+
 /*
  Read data from a binary .frm file from MySQL 3.23 - 5.0 into TABLE_SHARE
 */

sql/table.h

@@ -2974,6 +2974,7 @@ void init_tmp_table_share(THD *thd, TABLE_SHARE *share, const char *key,
  size_t key_length,
  const char *table_name, const char *path);
 void free_table_share(TABLE_SHARE *share);
+void reduce_se_share_ref_count(TABLE *table_arg);
 
 
 /**

storage/innobase/handler/ha_innodb.cc

@@ -6992,6 +6992,29 @@ ha_innobase::innobase_initialize_autoinc()
  dict_table_autoinc_initialize(m_prebuilt->table, auto_inc);
 }
 
+/*******************************************
+ * Reduced the reference count for the innobase_share
+ * This function is ONLY applicable when a thread that does not
+ * own a temporary table accesses the temporary table. This 
+ * access causes the reference count of the temporary table to
+ * be increased. INNODB was originally written with the
+ * assumption that a none owning thread will not accesss a 
+ * temporary table owned by another thread. But use cases
+ * have been observed that cause this access to happen.
+ * This increase of the refcount by the none-owning thread
+ * can cause the engine to crash if the innobase share is 
+ * recycled to be used to access a differrent table from
+ * within the owning thread
+ */
+void ha_innobase::reduce_share_refcount(){
+ mysql_mutex_lock(&innobase_share_mutex);
+ if (m_share->use_count > 0)
+ {
+ --m_share->use_count;
+ }
+ mysql_mutex_unlock(&innobase_share_mutex);
+}
+
 /*****************************************************************//**
 Creates and opens a handle to a table which already exists in an InnoDB
 database.

storage/innobase/handler/ha_innodb.h

@@ -108,6 +108,7 @@ class ha_innobase: public handler
  const key_map* keys_to_use_for_scanning();
 
  int open(const char *name, int mode, uint test_if_locked);
+ void reduce_share_refcount();
 
  /** Opens dictionary table object using table name. For partition, we need to
  try alternative lower/upper case names to support moving data files across