[Bug] double close in FunctionLikeBase

[deardeng]

Search before asking

• I had searched in the issues and found no similar issues.

Version

dev 1.0.1

What's Wrong?

core
asan log

I0000 00:00:00.000000 1380518 vlog_is_on.cc:197] RAW: Set VLOG level for "*" to 10

==1380518==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b001a01670 at pc 0x55b142072763 bp 0x7fc35bd09970 sp 0x7fc35bd09960
READ of size 8 at 0x60b001a01670 thread T2277 (FragmentMgrThre)
#0 0x55b142072762 in std::_Function_base::~_Function_base() /usr/include/c++/11/bits/std_function.h:244
#1 0x55b147a01e55 in std::function<doris::Status (doris::vectorized::LikeSearchState*, doris::StringValue const&, doris::StringValue const&, unsigned char*)>::~function() /usr/include/c++/11/bits/std_function.h:328
#2 0x55b147a01e79 in doris::vectorized::LikeState::~LikeState() /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/functions/like.h:71
#3 0x55b1479faa12 in doris::vectorized::FunctionLikeBase::close(doris_udf::FunctionContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/functions/like.cpp:120
#4 0x55b1457d7c28 in doris::vectorized::DefaultFunction::close(doris_udf::FunctionContext*, doris_udf::FunctionContext::FunctionStateScope) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x85ccc28)
#5 0x55b145782d00 in doris::vectorized::VExpr::close_function_context(doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope, std::shared_ptrdoris::vectorized::IFunctionBase const&) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vexpr.cpp:341
#6 0x55b147c7989a in doris::vectorized::VectorizedFnCall::close(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vectorized_fn_call.cpp:72
#7 0x55b14577cfaa in doris::vectorized::VExpr::close(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vexpr.cpp:82
#8 0x55b147c798b1 in doris::vectorized::VectorizedFnCall::close(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vectorized_fn_call.cpp:73
#9 0x55b14577cfaa in doris::vectorized::VExpr::close(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vexpr.cpp:82
#10 0x55b147c798b1 in doris::vectorized::VectorizedFnCall::close(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vectorized_fn_call.cpp:73
#11 0x55b1441f09ea in doris::vectorized::VExprContext::close(doris::RuntimeState*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vexpr_context.cpp:63
#12 0x55b14427d5ec in doris::ExecNode::close(doris::RuntimeState*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/exec/exec_node.cpp:272
#13 0x55b144c501eb in doris::vectorized::VOlapScanNode::close(doris::RuntimeState*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exec/volap_scan_node.cpp:436
#14 0x55b14427d4c2 in doris::ExecNode::close(doris::RuntimeState*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/exec/exec_node.cpp:266
#15 0x55b144c6b818 in doris::vectorized::VSortNode::close(doris::RuntimeState*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exec/vsort_node.cpp:107
#16 0x55b1431251cd in doris::PlanFragmentExecutor::close() /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/runtime/plan_fragment_executor.cpp:667
#17 0x55b142f0dd59 in doris::FragmentExecState::execute() /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/runtime/fragment_mgr.cpp:233
#18 0x55b142f157d5 in doris::FragmentMgr::_exec_actual(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/runtime/fragment_mgr.cpp:464
#19 0x55b142f5dcb5 in void std::__invoke_impl<void, void (doris::FragmentMgr::&)(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor)>), doris::FragmentMgr*&, std::shared_ptrdoris::FragmentExecState&, std::function<void (doris::PlanFragmentExecutor*)>&>(std::__invoke_memfun_deref, void (doris::FragmentMgr::&)(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor)>), doris::FragmentMgr*&, std::shared_ptrdoris::FragmentExecState&, std::function<void (doris::PlanFragmentExecutor*)>&) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x5d52cb5)
#20 0x55b142f5c63a in std::enable_if<is_invocable_r_v<void, void (doris::FragmentMgr::&)(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor)>), doris::FragmentMgr*&, std::shared_ptrdoris::FragmentExecState&, std::function<void (doris::PlanFragmentExecutor*)>&>, void>::type std::__invoke_r<void, void (doris::FragmentMgr::&)(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor)>), doris::FragmentMgr*&, std::shared_ptrdoris::FragmentExecState&, std::function<void (doris::PlanFragmentExecutor*)>&>(void (doris::FragmentMgr::&)(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor)>), doris::FragmentMgr*&, std::shared_ptrdoris::FragmentExecState&, std::function<void (doris::PlanFragmentExecutor*)>&) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x5d5163a)
#21 0x55b142f5a78d in void std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>::__call<void, , 0ul, 1ul, 2ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul, 2ul>) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x5d4f78d)
#22 0x55b142f56dfe in void std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>::operator()<>() /usr/include/c++/11/functional:629
#23 0x55b142f51b51 in void std::__invoke_impl<void, std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>&>(std::__invoke_other, std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>&) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x5d46b51)
#24 0x55b142f49913 in std::enable_if<is_invocable_r_v<void, std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>&>, void>::type std::__invoke_r<void, std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>&>(std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>&) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x5d3e913)
#25 0x55b142f41394 in std::_Function_handler<void (), std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)> >::_M_invoke(std::_Any_data const&) /usr/include/c++/11/bits/std_function.h:291
#26 0x55b142e8c137 in std::function<void ()>::operator()() const /usr/include/c++/11/bits/std_function.h:560
#27 0x55b1434e035d in doris::FunctionRunnable::run() /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/util/threadpool.cpp:42
#28 0x55b1434db2d7 in doris::ThreadPool::dispatch_thread() /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/util/threadpool.cpp:570
#29 0x55b1434fc7cf in void std::__invoke_impl<void, void (doris::ThreadPool::&)(), doris::ThreadPool&>(std::__invoke_memfun_deref, void (doris::ThreadPool::&)(), doris::ThreadPool&) /usr/include/c++/11/bits/invoke.h:74
#30 0x55b1434fc016 in std::__invoke_result<void (doris::ThreadPool::&)(), doris::ThreadPool&>::type std::__invoke<void (doris::ThreadPool::&)(), doris::ThreadPool&>(void (doris::ThreadPool::&)(), doris::ThreadPool&) /usr/include/c++/11/bits/invoke.h:96
#31 0x55b1434fb339 in void std::_Bind<void (doris::ThreadPool::(doris::ThreadPool))()>::__call<void, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/11/functional:420
#32 0x55b1434f9d58 in void std::_Bind<void (doris::ThreadPool::(doris::ThreadPool))()>::operator()<, void>() /usr/include/c++/11/functional:503
#33 0x55b1434f6797 in void std::__invoke_impl<void, std::_Bind<void (doris::ThreadPool::(doris::ThreadPool))()>&>(std::__invoke_other, std::_Bind<void (doris::ThreadPool::(doris::ThreadPool))()>&) /usr/include/c++/11/bits/invoke.h:61
#34 0x55b1434f3f7f in std::enable_if<is_invocable_r_v<void, std::_Bind<void (doris::ThreadPool::(doris::ThreadPool))()>&>, void>::type std::__invoke_r<void, std::_Bind<void (doris::ThreadPool::(doris::ThreadPool))()>&>(std::_Bind<void (doris::ThreadPool::(doris::ThreadPool))()>&) /usr/include/c++/11/bits/invoke.h:111
#35 0x55b1434ef188 in std::_Function_handler<void (), std::_Bind<void (doris::ThreadPool::(doris::ThreadPool))()> >::_M_invoke(std::_Any_data const&) /usr/include/c++/11/bits/std_function.h:291
#36 0x55b142e8c137 in std::function<void ()>::operator()() const /usr/include/c++/11/bits/std_function.h:560
#37 0x55b1434bf0b9 in doris::Thread::supervise_thread(void*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/util/thread.cpp:406
#38 0x7fc520c8a44f in start_thread nptl/pthread_create.c:473
#39 0x7fc520dbad52 in clone (/lib/x86_64-linux-gnu/libc.so.6+0x117d52)

0x60b001a01670 is located 96 bytes inside of 112-byte region [0x60b001a01610,0x60b001a01680)
freed by thread T2277 (FragmentMgrThre) here:
#0 0x55b141fe30ff in operator delete(void*, unsigned long) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x4dd80ff)
#1 0x55b1479faa1f in doris::vectorized::FunctionLikeBase::close(doris_udf::FunctionContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/functions/like.cpp:120
#2 0x55b1457d7c28 in doris::vectorized::DefaultFunction::close(doris_udf::FunctionContext*, doris_udf::FunctionContext::FunctionStateScope) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x85ccc28)
#3 0x55b145782d00 in doris::vectorized::VExpr::close_function_context(doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope, std::shared_ptrdoris::vectorized::IFunctionBase const&) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vexpr.cpp:341
#4 0x55b147c7989a in doris::vectorized::VectorizedFnCall::close(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vectorized_fn_call.cpp:72
#5 0x55b14577cfaa in doris::vectorized::VExpr::close(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vexpr.cpp:82
#6 0x55b147c798b1 in doris::vectorized::VectorizedFnCall::close(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vectorized_fn_call.cpp:73
#7 0x55b14577cfaa in doris::vectorized::VExpr::close(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vexpr.cpp:82
#8 0x55b147c798b1 in doris::vectorized::VectorizedFnCall::close(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vectorized_fn_call.cpp:73
#9 0x55b1442f69f0 in doris::vectorized::VExpr::set_children(doris::RuntimeState*, doris::vectorized::VExprContext*, std::vector<doris::vectorized::VExpr*, std::allocatordoris::vectorized::VExpr* >) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vexpr.h:110
#10 0x55b1442f6eb9 in doris::vectorized::VectorizedUtils::dfs_peel_conjunct(doris::RuntimeState*, doris::vectorized::VExprContext*, doris::vectorized::VExpr*, int&, std::function<bool (int)>) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x70ebeb9)
#11 0x55b1442f6ca2 in doris::vectorized::VectorizedUtils::dfs_peel_conjunct(doris::RuntimeState*, doris::vectorized::VExprContext*, doris::vectorized::VExpr*, int&, std::function<bool (int)>) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x70ebca2)
#12 0x55b1442f4aa7 in doris::ScanNode::_peel_pushed_vconjunct[abi:cxx11](doris::RuntimeState*, std::function<bool (int)> const&) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/exec/scan_node.cpp:59
#13 0x55b14431c933 in doris::OlapScanNode::remove_pushed_conjuncts(doris::RuntimeState*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/exec/olap_scan_node.cpp:545
#14 0x55b14431b21b in doris::OlapScanNode::start_scan(doris::RuntimeState*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/exec/olap_scan_node.cpp:476
#15 0x55b144c50972 in doris::vectorized::VOlapScanNode::get_next(doris::RuntimeState*, doris::vectorized::Block*, bool*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exec/volap_scan_node.cpp:456
#16 0x55b144c6bfcb in doris::vectorized::VSortNode::sort_input(doris::RuntimeState*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exec/vsort_node.cpp:126
#17 0x55b144c6ab60 in doris::vectorized::VSortNode::open(doris::RuntimeState*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exec/vsort_node.cpp:61
#18 0x55b14311d742 in doris::PlanFragmentExecutor::open_vectorized_internal() /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/runtime/plan_fragment_executor.cpp:280
#19 0x55b14311cc1f in doris::PlanFragmentExecutor::open() /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/runtime/plan_fragment_executor.cpp:255
#20 0x55b142f0d9ab in doris::FragmentExecState::execute() /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/runtime/fragment_mgr.cpp:231
#21 0x55b142f157d5 in doris::FragmentMgr::_exec_actual(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/runtime/fragment_mgr.cpp:464
#22 0x55b142f5dcb5 in void std::__invoke_impl<void, void (doris::FragmentMgr::&)(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor)>), doris::FragmentMgr*&, std::shared_ptrdoris::FragmentExecState&, std::function<void (doris::PlanFragmentExecutor*)>&>(std::__invoke_memfun_deref, void (doris::FragmentMgr::&)(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor)>), doris::FragmentMgr*&, std::shared_ptrdoris::FragmentExecState&, std::function<void (doris::PlanFragmentExecutor*)>&) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x5d52cb5)
#23 0x55b142f5c63a in std::enable_if<is_invocable_r_v<void, void (doris::FragmentMgr::&)(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor)>), doris::FragmentMgr*&, std::shared_ptrdoris::FragmentExecState&, std::function<void (doris::PlanFragmentExecutor*)>&>, void>::type std::__invoke_r<void, void (doris::FragmentMgr::&)(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor)>), doris::FragmentMgr*&, std::shared_ptrdoris::FragmentExecState&, std::function<void (doris::PlanFragmentExecutor*)>&>(void (doris::FragmentMgr::&)(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor)>), doris::FragmentMgr*&, std::shared_ptrdoris::FragmentExecState&, std::function<void (doris::PlanFragmentExecutor*)>&) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x5d5163a)
#24 0x55b142f5a78d in void std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>::__call<void, , 0ul, 1ul, 2ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul, 2ul>) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x5d4f78d)
#25 0x55b142f56dfe in void std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>::operator()<>() /usr/include/c++/11/functional:629
#26 0x55b142f51b51 in void std::__invoke_impl<void, std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>&>(std::__invoke_other, std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>&) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x5d46b51)
#27 0x55b142f49913 in std::enable_if<is_invocable_r_v<void, std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>&>, void>::type std::__invoke_r<void, std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>&>(std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>&) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x5d3e913)
#28 0x55b142f41394 in std::_Function_handler<void (), std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)> >::_M_invoke(std::_Any_data const&) /usr/include/c++/11/bits/std_function.h:291
#29 0x55b142e8c137 in std::function<void ()>::operator()() const /usr/include/c++/11/bits/std_function.h:560

previously allocated by thread T2277 (FragmentMgrThre) here:
#0 0x55b141fe2097 in operator new(unsigned long) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x4dd7097)
#1 0x55b1479fccb3 in doris::vectorized::FunctionLike::prepare(doris_udf::FunctionContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/functions/like.cpp:216
#2 0x55b1457d7b0d in doris::vectorized::DefaultFunction::prepare(doris_udf::FunctionContext*, doris_udf::FunctionContext::FunctionStateScope) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x85ccb0d)
#3 0x55b1457828a9 in doris::vectorized::VExpr::init_function_context(doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope, std::shared_ptrdoris::vectorized::IFunctionBase const&) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vexpr.cpp:333
#4 0x55b147c796da in doris::vectorized::VectorizedFnCall::open(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vectorized_fn_call.cpp:66
#5 0x55b14577cd49 in doris::vectorized::VExpr::open(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vexpr.cpp:74
#6 0x55b147c795f1 in doris::vectorized::VectorizedFnCall::open(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vectorized_fn_call.cpp:65
#7 0x55b14577cd49 in doris::vectorized::VExpr::open(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vexpr.cpp:74
#8 0x55b147c795f1 in doris::vectorized::VectorizedFnCall::open(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vectorized_fn_call.cpp:65
#9 0x55b14577cd49 in doris::vectorized::VExpr::open(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vexpr.cpp:74
#10 0x55b147c795f1 in doris::vectorized::VectorizedFnCall::open(doris::RuntimeState*, doris::vectorized::VExprContext*, doris_udf::FunctionContext::FunctionStateScope) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vectorized_fn_call.cpp:65
#11 0x55b1441f065d in doris::vectorized::VExprContext::open(doris::RuntimeState*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exprs/vexpr_context.cpp:56
#12 0x55b14427c3d3 in doris::ExecNode::open(doris::RuntimeState*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/exec/exec_node.cpp:232
#13 0x55b144315722 in doris::OlapScanNode::open(doris::RuntimeState*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/exec/olap_scan_node.cpp:219
#14 0x55b144c6aa8e in doris::vectorized::VSortNode::open(doris::RuntimeState*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/vec/exec/vsort_node.cpp:57
#15 0x55b14311d742 in doris::PlanFragmentExecutor::open_vectorized_internal() /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/runtime/plan_fragment_executor.cpp:280
#16 0x55b14311cc1f in doris::PlanFragmentExecutor::open() /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/runtime/plan_fragment_executor.cpp:255
#17 0x55b142f0d9ab in doris::FragmentExecState::execute() /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/runtime/fragment_mgr.cpp:231
#18 0x55b142f157d5 in doris::FragmentMgr::_exec_actual(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/runtime/fragment_mgr.cpp:464
#19 0x55b142f5dcb5 in void std::__invoke_impl<void, void (doris::FragmentMgr::&)(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor)>), doris::FragmentMgr*&, std::shared_ptrdoris::FragmentExecState&, std::function<void (doris::PlanFragmentExecutor*)>&>(std::__invoke_memfun_deref, void (doris::FragmentMgr::&)(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor)>), doris::FragmentMgr*&, std::shared_ptrdoris::FragmentExecState&, std::function<void (doris::PlanFragmentExecutor*)>&) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x5d52cb5)
#20 0x55b142f5c63a in std::enable_if<is_invocable_r_v<void, void (doris::FragmentMgr::&)(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor)>), doris::FragmentMgr*&, std::shared_ptrdoris::FragmentExecState&, std::function<void (doris::PlanFragmentExecutor*)>&>, void>::type std::__invoke_r<void, void (doris::FragmentMgr::&)(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor)>), doris::FragmentMgr*&, std::shared_ptrdoris::FragmentExecState&, std::function<void (doris::PlanFragmentExecutor*)>&>(void (doris::FragmentMgr::&)(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor)>), doris::FragmentMgr*&, std::shared_ptrdoris::FragmentExecState&, std::function<void (doris::PlanFragmentExecutor*)>&) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x5d5163a)
#21 0x55b142f5a78d in void std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>::__call<void, , 0ul, 1ul, 2ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul, 2ul>) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x5d4f78d)
#22 0x55b142f56dfe in void std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>::operator()<>() /usr/include/c++/11/functional:629
#23 0x55b142f51b51 in void std::__invoke_impl<void, std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>&>(std::__invoke_other, std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>&) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x5d46b51)
#24 0x55b142f49913 in std::enable_if<is_invocable_r_v<void, std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>&>, void>::type std::__invoke_r<void, std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>&>(std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)>&) (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x5d3e913)
#25 0x55b142f41394 in std::_Function_handler<void (), std::_Bind_result<void, void (doris::FragmentMgr::(doris::FragmentMgr, std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptrdoris::FragmentExecState, std::function<void (doris::PlanFragmentExecutor*)>)> >::_M_invoke(std::_Any_data const&) /usr/include/c++/11/bits/std_function.h:291
#26 0x55b142e8c137 in std::function<void ()>::operator()() const /usr/include/c++/11/bits/std_function.h:560
#27 0x55b1434e035d in doris::FunctionRunnable::run() /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/util/threadpool.cpp:42
#28 0x55b1434db2d7 in doris::ThreadPool::dispatch_thread() /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/util/threadpool.cpp:570
#29 0x55b1434fc7cf in void std::__invoke_impl<void, void (doris::ThreadPool::&)(), doris::ThreadPool&>(std::__invoke_memfun_deref, void (doris::ThreadPool::&)(), doris::ThreadPool&) /usr/include/c++/11/bits/invoke.h:74

Thread T2277 (FragmentMgrThre) created by T1127 here:
#0 0x55b141f841e5 in pthread_create (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x4d791e5)

Thread T1127 created by T0 here:
#0 0x55b141f841e5 in pthread_create (/mnt/hdd01/SELECTDB_1.0.1_ASAN/be/lib/palo_be+0x4d791e5)
#1 0x55b1488379bb in bthread::TaskControl::add_workers(int) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/thirdparty/src/incubator-brpc-1.0.0/src/bthread/task_control.cpp:199
#2 0x55b148824d4c in bthread_setconcurrency /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/thirdparty/src/incubator-brpc-1.0.0/src/bthread/bthread.cpp:310
#3 0x55b148767149 in brpc::Server::StartInternal(in_addr const&, brpc::PortRange const&, brpc::ServerOptions const*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/thirdparty/src/incubator-brpc-1.0.0/src/brpc/server.cpp:916
#4 0x55b148768e69 in brpc::Server::Start(butil::EndPoint const&, brpc::ServerOptions const*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/thirdparty/src/incubator-brpc-1.0.0/src/brpc/server.cpp:1062
#5 0x55b148768fda in brpc::Server::Start(int, brpc::ServerOptions const*) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/thirdparty/src/incubator-brpc-1.0.0/src/brpc/server.cpp:1081
#6 0x55b1432900b8 in doris::BRpcService::start(int) /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/service/brpc_service.cpp:53
#7 0x55b14202c54d in main /mnt/hdd01/repo_center/selectdb_dev-1.0.1/selectdb/be/src/service/doris_main.cpp:434
#8 0x7fc520ccb564 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x28564)

SUMMARY: AddressSanitizer: heap-use-after-free /usr/include/c++/11/bits/std_function.h:244 in std::_Function_base::~_Function_base()
Shadow bytes around the buggy address:
0x0c1680338270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1680338280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1680338290: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
0x0c16803382a0: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c16803382b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c16803382c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]fa
0x0c16803382d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c16803382e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa 00 00
0x0c16803382f0: 00 00 00 00 00 00 00 00 00 00 00 03 fa fa fa fa
0x0c1680338300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1680338310: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==1380518==ABORTING
start time: Tue May 31 08:28:42 PM CST 2022
WARNING: Logging before InitGoogleLogging() is written to STDERR
I0531 20:28:42.428324 1442387 env.cpp:46] Env init successfully.
I0000 00:00:00.000000 1442387 vlog_is_on.cc:197] RAW: Set VLOG level for "*" to 10

What You Expected?

no core

How to Reproduce?

in core, i find this sql:
SELECT repo_name, sum(fork) AS forks, sum(star) AS stars, round(sum(star) / sum(fork), 3) AS ratio FROM ( SELECT repo_name, CASE WHEN event_type = 'ForkEvent' THEN 1 ELSE 0 END AS fork, CASE WHEN event_type = 'WatchEvent' THEN 1 ELSE 0 END AS star FROM github_events WHERE event_type IN ('ForkEvent', 'WatchEvent') ) t GROUP BY repo_name HAVING (stars > 100) AND (forks > 100) ORDER BY ratio DESC LIMIT 50;

fe.audit.log
2022-05-31 19:56:08,949 [query] |Client=127.0.0.1:60906|User=root|Db=default_cluster:regression_test_github_events|State=ERR|Time=80345|ScanBytes=0|ScanRows=0|ReturnRows=0|StmtId=3780|QueryId=47798549c30a484f-8539885620b4ddbb|IsQuery=true|feIp=172.21.16.15|Stmt=SELECT repo_name, sum(fork) AS forks, sum(star) AS stars, round(sum(star) / sum(fork), 3) AS ratio FROM ( SELECT repo_name, CASE WHEN event_type = 'ForkEvent' THEN 1 ELSE 0 END AS fork, CASE WHEN event_type = 'WatchEvent' THEN 1 ELSE 0 END AS star FROM github_events WHERE event_type IN ('ForkEvent', 'WatchEvent') ) t GROUP BY repo_name HAVING (stars > 100) AND (forks > 100) ORDER BY ratio DESC LIMIT 50 |CpuTimeMS=0|SqlHash=4d00f27cda2a2437e42d9c30723d4c74|peakMemoryBytes=0

fe.log
2022-05-31 19:56:08,946 WARN (doris-mysql-nio-pool-3|153) [Coordinator.getNext():787] get next fail, need cancel. query id: 47798549c30a484f-8539885620b4ddbb
2022-05-31 19:56:08,946 WARN (doris-mysql-nio-pool-3|153) [Coordinator.updateStatus():769] one instance report fail throw updateStatus(), need cancel. job id: -1, query id: 47798549c30a484f-8539885620b4ddbb, instance id: NaN
2022-05-31 19:56:08,948 WARN (doris-mysql-nio-pool-3|153) [StmtExecutor.execute():463] execute Exception. stmt[3780, 47798549c30a484f-8539885620b4ddbb]

but, i use mysql client to query this, it work, still slow.

Anything Else?

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct