You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
After HMS has renamed old_table to new_table, querying new_table from this check can load it from HMS and return true. The event is then cancelled, and cached state for old_table may remain. AlterDatabaseEvent.processRename() has the same structural problem through catalog.getDbNullable(dbAfter.getName()), although database rename is less commonly reachable in standard Hive.
The current revision of #65126 removes the load-through target-existence checks and makes both rename handlers converge local state by unregistering the old identity and registering the new identity. Its focused FE unit tests cover cold and already-hot rename targets.
2. ADD/DROP PARTITION events do not fence an in-flight partition-values load, and DROP may skip lower-level cache invalidation
Both addPartitionsCache() and dropPartitionsCache() return immediately when the partition-values entry is absent:
If a partition-values load started before the event, the event does not invalidate/bump the entry, so the pre-event snapshot may still be published afterward.
If the partition-values entry has been evicted while partition metadata or file listings remain cached, a DROP PARTITION event returns before invalidating those lower-level entries.
The second case can expose stale data when a partition name is later recreated with a different path or files. It also prevents the cache-miss fallback added by #65334 from being reached through this DROP event path.
3. Incremental CREATE_DATABASE/CREATE_TABLE events can bypass include/exclude visibility filters
Full names loading applies include_database_list, exclude_database_list, and include_table_list:
When a names cache is already hot, an HMS CREATE event can therefore add a database/table that should remain hidden. The object can subsequently become queryable through the cached name.
4. DROP_PARTITION records a DATABASE deletion in ExternalMetaIdMgr
DropPartitionEvent.transferToMetaIdMappings() uses META_OBJECT_TYPE_DATABASE instead of META_OBJECT_TYPE_PARTITION:
Current production use of the ExternalMetaIdMgr lookup APIs is limited, so the immediate query impact appears limited, but the persisted/replayed external metadata ID state is incorrect.
5. ALTER_DATABASE rename can generate an ID from the remote name instead of the canonical local name
Status: Open. This is present on the master baseline and is not introduced by #65126.
CatalogMgr.registerExternalDatabaseFromEvent() generates the event-created database ID directly from the incoming remote dbName:
When lower_case_database_names = 1, or more generally whenever the incoming remote name differs from its canonical local cache key, the same database can therefore have two deterministic IDs:
Immediately after the event: ID(remote name) -> canonical local name.
After cache reset or normal reload: ID(canonical local name) -> canonical local name.
This makes the database ID and the local ID-to-name index unstable across refresh/reload and can break ID-based lookup consistency.
Partition events should prevent pre-event snapshots from being published and should invalidate partition/file caches even when partition-values cache state is cold.
Incremental create events should apply the same visibility rules as full names loading.
DROP_PARTITION should delete only the corresponding partition metadata-ID mapping.
Incremental database registration should derive the database ID from the same canonical local name used by normal object loading.
How to Reproduce?
Rename cancellation (fixed by the current revision of #65126)
Enable HMS incremental event synchronization.
Ensure the target name is not locally cached.
Rename old_table to new_table in Hive.
Process the ALTER_TABLE event.
On the affected baseline, the existence check loads new_table from HMS and cancels the event; cached old_table state may remain.
Partition cache
Cache partition metadata/file listings for p=1.
Evict or invalidate only the table's partition-values entry, or block an in-flight partition-values load.
Drop p=1 through HMS and process the DROP_PARTITION event.
Recreate p=1 with a different location/files.
The old partition metadata or file listing may still be reused.
Visibility filter
Create an HMS catalog with an include/exclude database filter or include_table_list.
Warm the corresponding names cache.
Create a filtered-out database/table directly in Hive.
Process the HMS CREATE event.
Observe that the filtered object is inserted into the cached names and becomes visible/queryable.
External metadata ID mapping
Add a database/table/partition mapping to ExternalMetaIdMgr.
Process the partition's DROP_PARTITION mapping.
Observe that the database mapping subtree is removed instead of only the partition mapping.
Database ID stability
Configure an HMS catalog with lower_case_database_names = 1.
Process an ALTER_DATABASE rename event whose new remote name contains uppercase characters.
Observe that registerExternalDatabaseFromEvent() generates the new ID from the remote mixed-case name while the local cache key is lowercase.
Reset or reload the catalog so the normal database-object loader runs.
Observe that the reloaded database ID is generated from the lowercase local name and differs from the event-created ID.
For ADD/DROP PARTITION, invalidate or bump the partition-values key when it is cold/loading. DROP should unconditionally invalidate partition metadata/file cache entries for each dropped partition before optionally updating a hot partition-values snapshot.
Reuse a shared database/table visibility predicate in both full names loading and incremental registration.
Change the DROP_PARTITION mapping type to META_OBJECT_TYPE_PARTITION and add an event mapping unit test.
Resolve the canonical local database name with a cache-only helper, and use it consistently for event registration, invalidation, and Util.genIdByName(). Add mode-1 coverage that asserts the event-created ID equals the normal reload ID.
The remaining four open fixes can be implemented as separate PRs if preferred.
Search before asking
I searched existing Apache Doris issues and did not find an issue covering these HMS incremental-event cache consistency problems.
Version
Apache Doris
masterat3a75387e61388bd886eeef38b794d5ed4eb298bf.These problems were found while reviewing #65126, but they are already present on the current master baseline and were not introduced by that PR.
What's Wrong?
There are five independent correctness gaps in HMS incremental event handling.
1. ALTER TABLE/ALTER DATABASE rename can be incorrectly cancelled by a load-through "local existence" check
Status: Fixed by the current revision of #65126 (pending merge).
AlterTableEvent.processRename()callsexternalTableExistInLocal()before applying the rename:doris/fe/fe-core/src/main/java/org/apache/doris/datasource/hive/event/AlterTableEvent.java
Lines 107 to 123 in 3a75387
However,
HMSExternalCatalog.tableExistInLocal()eventually calls the normal load-through table lookup rather than a cache-only lookup:doris/fe/fe-core/src/main/java/org/apache/doris/datasource/hive/HMSExternalCatalog.java
Lines 190 to 198 in 3a75387
After HMS has renamed
old_tabletonew_table, queryingnew_tablefrom this check can load it from HMS and returntrue. The event is then cancelled, and cached state forold_tablemay remain.AlterDatabaseEvent.processRename()has the same structural problem throughcatalog.getDbNullable(dbAfter.getName()), although database rename is less commonly reachable in standard Hive.The current revision of #65126 removes the load-through target-existence checks and makes both rename handlers converge local state by unregistering the old identity and registering the new identity. Its focused FE unit tests cover cold and already-hot rename targets.
2. ADD/DROP PARTITION events do not fence an in-flight partition-values load, and DROP may skip lower-level cache invalidation
Both
addPartitionsCache()anddropPartitionsCache()return immediately when the partition-values entry is absent:doris/fe/fe-core/src/main/java/org/apache/doris/datasource/hive/HiveExternalMetaCache.java
Lines 707 to 746 in 3a75387
doris/fe/fe-core/src/main/java/org/apache/doris/datasource/hive/HiveExternalMetaCache.java
Lines 748 to 789 in 3a75387
This causes two problems:
The second case can expose stale data when a partition name is later recreated with a different path or files. It also prevents the cache-miss fallback added by #65334 from being reached through this DROP event path.
3. Incremental CREATE_DATABASE/CREATE_TABLE events can bypass include/exclude visibility filters
Full names loading applies
include_database_list,exclude_database_list, andinclude_table_list:doris/fe/fe-core/src/main/java/org/apache/doris/datasource/ExternalCatalog.java
Lines 551 to 616 in 3a75387
doris/fe/fe-core/src/main/java/org/apache/doris/datasource/ExternalCatalog.java
Lines 343 to 356 in 3a75387
The incremental register paths directly update the legacy metadata cache without applying the same visibility policy:
doris/fe/fe-core/src/main/java/org/apache/doris/datasource/hive/HMSExternalCatalog.java
Lines 205 to 216 in 3a75387
doris/fe/fe-core/src/main/java/org/apache/doris/datasource/ExternalDatabase.java
Lines 649 to 663 in 3a75387
When a names cache is already hot, an HMS CREATE event can therefore add a database/table that should remain hidden. The object can subsequently become queryable through the cached name.
4. DROP_PARTITION records a DATABASE deletion in ExternalMetaIdMgr
DropPartitionEvent.transferToMetaIdMappings()usesMETA_OBJECT_TYPE_DATABASEinstead ofMETA_OBJECT_TYPE_PARTITION:doris/fe/fe-core/src/main/java/org/apache/doris/datasource/hive/event/DropPartitionEvent.java
Lines 142 to 152 in 3a75387
ExternalMetaIdMgrinterprets this as a request to remove the entire database mapping subtree:doris/fe/fe-core/src/main/java/org/apache/doris/datasource/ExternalMetaIdMgr.java
Lines 145 to 169 in 3a75387
Current production use of the ExternalMetaIdMgr lookup APIs is limited, so the immediate query impact appears limited, but the persisted/replayed external metadata ID state is incorrect.
5. ALTER_DATABASE rename can generate an ID from the remote name instead of the canonical local name
Status: Open. This is present on the master baseline and is not introduced by #65126.
CatalogMgr.registerExternalDatabaseFromEvent()generates the event-created database ID directly from the incoming remotedbName:doris/fe/fe-core/src/main/java/org/apache/doris/datasource/CatalogMgr.java
Lines 772 to 789 in 54e0e97
Normal external-database object loading instead generates the ID from the canonical
localDbName:doris/fe/fe-core/src/main/java/org/apache/doris/datasource/ExternalCatalog.java
Lines 459 to 466 in 54e0e97
When
lower_case_database_names = 1, or more generally whenever the incoming remote name differs from its canonical local cache key, the same database can therefore have two deterministic IDs:ID(remote name) -> canonical local name.ID(canonical local name) -> canonical local name.This makes the database ID and the local ID-to-name index unstable across refresh/reload and can break ID-based lookup consistency.
What You Expected?
How to Reproduce?
Rename cancellation (fixed by the current revision of #65126)
old_tabletonew_tablein Hive.new_tablefrom HMS and cancels the event; cachedold_tablestate may remain.Partition cache
p=1.p=1through HMS and process the DROP_PARTITION event.p=1with a different location/files.Visibility filter
include_table_list.External metadata ID mapping
ExternalMetaIdMgr.Database ID stability
lower_case_database_names = 1.registerExternalDatabaseFromEvent()generates the new ID from the remote mixed-case name while the local cache key is lowercase.Suggested Fixes
META_OBJECT_TYPE_PARTITIONand add an event mapping unit test.Util.genIdByName(). Add mode-1 coverage that asserts the event-created ID equals the normal reload ID.The remaining four open fixes can be implemented as separate PRs if preferred.