BUG #17126: Server crashes on dropping user while enumerating owned objects that are droppped concurrently

The following bug has been logged on the website:

Bug reference: 17126
Logged by: Alexander Lakhin
Email address: exclusion(at)gmail(dot)com
PostgreSQL version: Unsupported/Unknown
Operating system: Ubuntu 20.04
Description:

Dropping a user that owns a number of procedures, while some of them are
being dropped, can cause the server crash:

Core was generated by `postgres: law regression [local] DROP ROLE
'.
Program terminated with signal SIGABRT, Aborted.
#0 __GI_raise (sig=sig(at)entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 __GI_raise (sig=sig(at)entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1 0x00007f268882b859 in __GI_abort () at abort.c:79
#2 0x000055a23a628276 in ExceptionalCondition
(conditionName=conditionName(at)entry=0x55a23a77fd4d "pointer != NULL",
errorType=errorType(at)entry=0x55a23a68700b "FailedAssertion",
fileName=0x7ffdf4459470 "W\202b:\242U",
fileName(at)entry=0x55a23a7886b0
"../../../../src/include/utils/memutils.h",
lineNumber=lineNumber(at)entry=123)
at assert.c:69
#3 0x000055a23a65b46e in GetMemoryChunkContext (pointer=0x0) at
../../../../src/include/utils/memutils.h:123
#4 pfree (pointer=pointer(at)entry=0x0) at mcxt.c:1171
#5 0x000055a23a23254f in storeObjectDescription
(descs=descs(at)entry=0x7ffdf44598b0, type=LOCAL_OBJECT,
object=object(at)entry=0x55a23b5efe10, deptype=SHARED_DEPENDENCY_OWNER,
count=count(at)entry=0) at pg_shdepend.c:1267
#6 0x000055a23a232955 in checkSharedDependencies
(classId=classId(at)entry=1260, objectId=objectId(at)entry=16385,
detail_msg=detail_msg(at)entry=0x7ffdf44599f0,
detail_log_msg=detail_log_msg(at)entry=0x7ffdf44599f8) at pg_shdepend.c:771
#7 0x000055a23a310c51 in DropRole (stmt=stmt(at)entry=0x55a23b5c7ee8) at
user.c:1028
#8 0x000055a23a4ed922 in standard_ProcessUtility (pstmt=0x55a23b5c81f8,
queryString=0x55a23b5c7450 "DROP USER u;",
readOnlyTree=<optimized out>, context=PROCESS_UTILITY_TOPLEVEL,
params=0x0, queryEnv=0x0, dest=0x55a23b5c82c8,
qc=0x7ffdf4459d90) at utility.c:901
#9 0x000055a23a4edd31 in ProcessUtility (pstmt=pstmt(at)entry=0x55a23b5c81f8,
queryString=<optimized out>,
readOnlyTree=<optimized out>,
context=context(at)entry=PROCESS_UTILITY_TOPLEVEL, params=<optimized out>,
queryEnv=<optimized out>, dest=0x55a23b5c82c8, qc=0x7ffdf4459d90) at
utility.c:527
#10 0x000055a23a4eb251 in PortalRunUtility
(portal=portal(at)entry=0x55a23b629090, pstmt=pstmt(at)entry=0x55a23b5c81f8,
isTopLevel=isTopLevel(at)entry=true,
setHoldSnapshot=setHoldSnapshot(at)entry=false, dest=dest(at)entry=0x55a23b5c82c8,

qc=qc(at)entry=0x7ffdf4459d90) at pquery.c:1147
#11 0x000055a23a4eb553 in PortalRunMulti
(portal=portal(at)entry=0x55a23b629090, isTopLevel=isTopLevel(at)entry=true,
setHoldSnapshot=setHoldSnapshot(at)entry=false,
dest=dest(at)entry=0x55a23b5c82c8, altdest=altdest(at)entry=0x55a23b5c82c8,
qc=qc(at)entry=0x7ffdf4459d90) at pquery.c:1304
#12 0x000055a23a4eb987 in PortalRun (portal=portal(at)entry=0x55a23b629090,
count=count(at)entry=9223372036854775807,
isTopLevel=isTopLevel(at)entry=true, run_once=run_once(at)entry=true,
dest=dest(at)entry=0x55a23b5c82c8,
altdest=altdest(at)entry=0x55a23b5c82c8, qc=0x7ffdf4459d90) at
pquery.c:786
#13 0x000055a23a4e7bd4 in exec_simple_query
(query_string=query_string(at)entry=0x55a23b5c7450 "DROP USER u;")
at postgres.c:1214
#14 0x000055a23a4e9ba6 in PostgresMain (argc=argc(at)entry=1,
argv=argv(at)entry=0x7ffdf4459f80, dbname=<optimized out>,
username=<optimized out>) at postgres.c:4486
#15 0x000055a23a442f19 in BackendRun (port=port(at)entry=0x55a23b5ea870) at
postmaster.c:4506
#16 0x000055a23a44612e in BackendStartup (port=port(at)entry=0x55a23b5ea870) at
postmaster.c:4228
#17 0x000055a23a446375 in ServerLoop () at postmaster.c:1745
#18 0x000055a23a4478c2 in PostmasterMain (argc=3, argv=<optimized out>) at
postmaster.c:1417
#19 0x000055a23a388291 in main (argc=3, argv=0x55a23b5c14c0) at main.c:209
(gdb) frame 5
(gdb) print -elements unlimited -- descs.data
$7 = 0x55a23b6ef1c0 "owner of function p1()\n...owner of function
p88()\nowner of (null)"

The reproducing script:
rm /tmp/c.sql
for i in `seq 90`; do echo "CREATE OR REPLACE PROCEDURE p$i() LANGUAGE SQL
AS 'SELECT 1';" >>/tmp/c.sql; done
rm /tmp/d.sql
for i in `seq 90 -1 2`; do echo "DROP PROCEDURE IF EXISTS p$i();"
>>/tmp/d.sql; done

psql -c "CREATE USER u";
psql -U u -f /tmp/c.sql >psql0.log 2>&1
for n in `seq 100`; do
echo "iteration $n"
( { for f in `seq 100`; do echo "DROP USER u; SELECT pg_sleep(0.001);";
done } | psql ) >psql1.log 2>&1 &
( { for f in `seq 10`; do cat /tmp/c.sql; done } | psql -U u ) >psql2.log
2>&1 &
( { for f in `seq 10`; do cat /tmp/d.sql; done } | psql -U u ) >psql3.log
2>&1 &
wait
sleep 1
coredumpctl --no-pager && break;
done

(Turning fsync off helps in reproducing for me.)
Interestingly enough, the crash does not occur with tables (but occurs with
functions):
(
...
for i in `seq 90`; do echo "CREATE TABLE t$i(i int);" >>/tmp/c.sql; done
...
for i in `seq 90 -1 2`; do echo "DROP TABLE IF EXISTS t$i;" >>/tmp/d.sql;
done
...
)

Reproduced on master (after 3779ac62).