Prevent latch lock interception by other already scheduled or active
fiber if there is only one waiting. This is needed for strict latch
ordering.

Incomming ACK lead to race condition and prevent heartbeat
messages. It ends up with disconnect on timeout.
This fix is based on @locker proposal to send vclock only
to reply master (since it itself sends heartbeat messages).

Closes #3160

This reverts commit a7871247.

This reverts commit 99c7a971.

If a vinyl transaction stalls waiting for quota for more than
box.cfg.too_long_threshold seconds, emit a warning to the log:

  W> waited for 699089 bytes of vinyl memory quota for too long: 0.504 sec

This will help us understand whether our users experience lags
due to absence of throttling in vinyl (see #1862).

Closes #3096

The name of the universe is optional, so we don't check it. If a user
wants to specify extra options in the grant, such as if_not_exists, and
mistakes object name argument with options argument, options are
silently ignored:

  box.schema.user.grant('tnt', 'read,write,execute', 'universe', {if_not_exists = true})

Fix this by adding Lua code that ensures that universe name is a scalar
(string or nil).

Closes #3146

In replication schema if one of the instances was powered off, it isn't
detected by others and the connection hangs. Alive machines show
'follow' state. Add timeout to solve this issue. It's safe since
applier and relay both send messages every replication_timeout so we can
assume that if we read nothing we have problem with connection. Use
replication_disconnect_timeout which is replication_timeout * 4 as for
now.

The test fixed and comments improved by @locker.

Closes #3025

If an instance is 'orphan', it is read-only hence box.ctl.wait_rw()
should block until the instance syncs, but currently it doesn't. Fix it.

vy_log_rotate() releases the log latch between reading the last vylog
file and writing the new vylog file. This works as long as the latch
implementation guarantees that latch_lock() called immediately after
latch_unlock() on the same lock doesn't yield. Although this is true
now, we shouldn't rely on that, because this may change any time.

Closes #2789

* Create constant SUPER - id of super role
* Forward the constant to box.schema
* Add checks on drop super role

Closes #3084

 - space.bsize returns the size of user data stored in the space.
   It is the sum of memory.bytes and disk.bytes as reported by
   the primary index.

 - index.bsize returns the size of memory used for indexing data.
   It is the sum of memory.index_size, disk.index_size, and
   disk.bloom_size as reported by index.info. For secondary indexes
   we also add the size of binary data stored on disk (disk.bytes),
   because it is only needed to build the index.

 - index.len returns the total number of rows stored in the index.
   It is the sum of memory.rows and disk.rows as reported by
   index.info. Note, it may be greater than the number of tuples
   stored in the space, because it includes DELETE and UPDATE
   statements.

Closes #2863
Closes #3056

This patch adds the following statistics to index.info:

 - memory.index_size - size of memory tree extents
 - cache.index_size - size of cache tree extents
 - disk.index_size - size of page index
 - disk.bloom_size - size of bloom filters

This patch adds a new connection option to http client, 'unix_socket'.
The option specifies the path to the unix socket to use as connection
endpoint instead of TCP:

  httpc = require('http.client')
  httpc.request('GET', 'http://localhost/index.html', nil,
                {unix_socket = '/var/run/docker.sock'})

The option is supported only if tarantool was built with libcurl 7.40.0
or newer. For older versions, an attempt to use the option will result
in a Lua exception.

Suggested and first implemented by @rosik.
The test was refactored by @locker.

Closes #3040

It will help resolve box.once() conflicts in case master is rw
and replica is ro.

Closes #2537

This patch adds two new Lua function, box.ctl.wait_ro() and
box.ctl.wait_rw(), that block the current fiber until the
server switches to read-only or read-write mode, respectively.
Both functions take the timeout as an optional argument.

Needed for #2537

  src/lua/init.c: In function ‘tarantool_panic_handler’:
  src/lua/init.c:321:2: error: implicit declaration of function ‘print_backtrace’ [-Werror=implicit-function-declaration]
    print_backtrace();
    ^~~~~~~~~~~~~~~

  src/lua/fiber.c:244:1: error: ‘lbox_fiber_statof_bt’ defined but not used [-Werror=unused-function]
   lbox_fiber_statof_bt(struct fiber *f, void *cb_ctx)
   ^~~~~~~~~~~~~~~~~~~~

There are two issues in the rollback code:

 - txn_rollback_stmt() rollbacks the current autocommit transaction even
   if it is called from a sub-statement. As a result, if a sub-statement
   (i.e. a statement called from a before_replace or on_replace trigger)
   fails (e.g. due to a conflict), it will trash the current transaction
   leading to a bad memory access upon returning from the trigger.

 - txn_begin_stmt() calls txn_rollback_stmt() on failure even if it did
   not instantiate the statement. So if it is called from a trigger and
   fails (e.g. due to nesting limit), it may trash the parent statement,
   again leading to a crash.

Fix them both and add some tests.

Closes #3127

Obviously, there's no point in rebuilding an index if all we do is
relaxing the uniqueness property. This will also allow us to clear
the uniqueness flag for vinyl indexes, which do not support rebuild.

Note, a memtx tree index stores a pointer to either cmp_def or key_def
depending on whether the index is unique. Hence to clear the uniqueness
flag without rebuilding the index, we need to update this pointer. To do
that, we add a new index virtual method, update_def.

Closes #2449

If an instance is read-only, an attempt to join a new replica to it will
fail with ER_READONLY, because joining a replica to a cluster implies
registration in the _cluster system space. However, if the replica is
already registered, which is the case if it is being rebootstrapped with
the same uuid (see box.cfg.instance_uuid), the record corresponding to
the replica is already present in the _cluster space and hence no write
operation is required. Still, rebootstrap fails with the same error.

Let's rearrange the access checks to make it possible to rebootstrap a
replica from a read-only master provided it has the same uuid.

Closes #3111

We can save a lookup in a secondary index on update if indexed fields
are not modified. The extra check comes for free as we have a bit mask
of all updated fields.

Closes #2980

When a tarantool instance starts for the first time (the local directory
is empty), it chooses the peer with the lowest UUID as the bootstrap
master. As a result, one cannot reliably rebootstrap a cluster node
(delete all local files and restart): if the node happens to have the
lowest UUID in the cluster after restart, it will assume that it is the
leader of a new cluster and bootstrap locally, splitting the cluster in
two.

To fix this problem, let's always give preference to peers with a higher
vclock when choosing a bootstrap master and only fall back on selection
by UUID if two or more peers have the same vclock. To achieve that, we
need to introduce a new iproto request type for fetching the current
vclock of a tarantool instance (we cannot squeeze the vclock in the
greeting, because the latter is already packed). The new request type is
called IPROTO_REQUEST_VOTE so that in future it can be reused for a more
sophisticated leader election algorithm. It has no body and does not
require authentication. In reply to such a request, a tarantool instance
will send IPROTO_OK and its current vclock. If the version of the master
is >= 1.7.7, an applier will send IPROTO_REQUEST_VOTE to fetch the
master's vclock before trying to authenticate. The vclock will then be
to determine the node to bootstrap from.

Closes #3108

No functional changes, just a trivial cleanup:

 - Move all C functions inside extern "C" section.
 - Rename xrow_decode_join to xrow_decode_join_xc.
 - Make XXX_xc wrappers around XXX functions.

Before commit 2788dc1b ("Add APPLIER_READY state") we only printed
the 'authenticated' message to the log in case credentials were set in
the replication URI. The commit changed that: now we print the message
even in case of guest connections, when applier does not send the AUTH
command to the master at all. As a result if guest connections are not
permitted by the master, the applier will keep printing 'authenticated'
after every unsuccessful attempt to subscribe. This is misleading. Let
us revert back to the behavior we had before commit 2788dc1b.

Closes #3113

As there is now support for Alpine Linux in packpack, there is no
longer any need in a custom Dockerfile builder.

This patch is to get in line with the Alpine support in packpack:

- don't rely on git, and use a source package instead
- add subpackages with debug symbols, documentation and headers
- don't build tarantool 3 times in a row

If one node of a cluster is rebootstrapped (i.e. restarted from an
empty directory with the same configuration), other replicas will
never try to reconnect to it - the appliers will simply stop with
the ER_REPLICASET_UUID_MISMATCH error. The only way to fix this is
reconfigure replication on all other nodes.

Let's fix this problem by reassigning an applier to a new replica
in case its UUID mismatches the UUID of the replica it is currently
assigned to.

Cannot write a test, because rebootstrap is unreliable - see #3108.

Closes #3112

If the master closes its end of the socket when there are still unread
rows available for the replica to apply, we will get tons of EPIPE error
messages at the replica's side, emitted every time it attempts to send
an ACK back to the master (i.e. one per each row left in the socket):

  main/107/applierw/ sio.cc:303 !> SystemError writev(2), called on fd 12, aka 127.0.0.1:50852: Broken pipe

To avoid that, let's make the applier writer fiber (the one that sends
ACKs) exit immediately if it receives EPIPE error while trying to send
an ACK.

Closes #2945

* Fix force_recovery behaviour on empty xlog files and ones with corrupted
  header.
* Add a test
* Update xlog-py/empty.test.py, since corrupted xlog no longer leads
  to a broken startup.

Closes #3026, #3076

For backward compatibility, automatically grant CREATE, DROP
ACL to all users who have READ and WRITE access.

Our automatic upgrade script automatically grants CREATE and
ALTER to users with READ/WRITE access on universe, but this is
insufficient, since new users could be created after upgrade.

Follow up on gh-945  and gh-3089.

* Add privileges Create, Drop, Alter on universe support.
* Fix super role behavior, allowing users with
  this role to drop any objects.

Relates #945
Closes #3089

* Add possibility to use file:read without len parameter.
In this case, whole file will be read.

Closes #2925

11 was initially used for SQL EXECUTE in 1.8, but 1.7 commit
b73030f2 ("iproto: add IPROTO_NOP request type") reassigned
it to NOP so after the merge SQL EXECUTE landed at 12, which
broke connectors. Let's shift NOP to 12 and move EXECUTE back
to 11. This is OK as 1.7.7 which introduced the new iproto type
hasn't been officially released yet.

fio.is_mount() routine is not working properly on Docker,
since it uses non-transparent incremental filesystem and
hence each new file has new device id which in turns means
for fio.is_mount() that its parent is actually mount. But
it is not. Remove the routine and corresponding test entries.

 - Start a long call, which runs forever
 - Close the connection
 - Stop the fiber running the long call
 - Check that the connection does not leak, box.session.on_disconnect
   trigger is called once the fiber has been stopped

Suggested by @kostja

Follow-up #946