Skip to content

[branch-1.2](bug) Fix heap-use-after-free in query cancelled by mem checker when process exceed memory limit #28092

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
lide-reed merged 1 commit into from
Dec 7, 2023
Merged

[branch-1.2](bug) Fix heap-use-after-free in query cancelled by mem checker when process exceed memory limit #28092

lide-reed merged 1 commit into from
Dec 7, 2023

Conversation

@xy720
Copy link
Member

@xy720 xy720 commented Dec 6, 2023 •
edited
Loading

Proposed changes

We have encountered be core when a query is cancelled by mem checker because the process exceed Memory limit.

Only reproduce in version 1.2

fe.audit.log

ErrorMessage=errCode = 2, detailMessage = (10.67.16.104)[MEM_LIMIT_EXCEEDED]PreCatch std::bad_alloc, Memory limit exceeded:<consuming tracker:<Load#Id=d235efb3413141ef-8660b4c7d1b56e24>, process memory used 50.59 GB exceed limit 49.42 GB or sys mem available 8.50 GB less than low water mark 1.60 GB, failed alloc size 19.52 MB>, executing msg:<execute:<>>. backend 10.67.16.104 process memory used 50.59 GB, limit 49.42 GB. If query tracker exceed, `set exec_mem_limit=8G` to change limit, details see be.INFO.

ASAN output

=================================================================
==715739==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300014ac48 at pc 0x560bf2e8f9c3 bp 0x7fe20e507cc0 sp 0x7fe20e507cb0
READ of size 8 at 0x60300014ac48 thread T22 (memory_gc_threa)
    #0 0x560bf2e8f9c2 in doris::TUniqueId::TUniqueId(doris::TUniqueId const&) /data/doris-1.x/gensrc/build/gen_cpp/Types_types.cpp:2064
    #1 0x560bf1d382d2 in doris::FragmentMgr::query_is_canceled(doris::TUniqueId const&) /data/doris-1.x/be/src/runtime/fragment_mgr.cpp:840
    #2 0x560bf22a9f34 in doris::MemTrackerLimiter::free_top_memory_query(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, doris::MemTrackerLimiter::Type) /data/doris-1.x/be/src/runtime/memory/mem_tracker_limiter.cpp:308
    #3 0x560bf2528f76 in doris::MemInfo::process_full_gc() /data/doris-1.x/be/src/util/mem_info.cpp:181
    #4 0x560bef7ac969 in doris::Daemon::memory_gc_thread() /data/doris-1.x/be/src/common/daemon.cpp:260
    #5 0x560bef7af09d in operator() /data/doris-1.x/be/src/common/daemon.cpp:488
    #6 0x560bef7b4e9b in __invoke_impl<void, doris::Daemon::start()::<lambda()>&> /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
    #7 0x560bef7b44b7 in __invoke_r<void, doris::Daemon::start()::<lambda()>&> /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
    #8 0x560bef7b3a11 in _M_invoke /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:291
    #9 0x560bf1bc734b in std::function<void ()>::operator()() const /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:560
    #10 0x560bf27164e3 in doris::Thread::supervise_thread(void*) /data/doris-1.x/be/src/util/thread.cpp:454
    #11 0x7fe2b750bea4 in start_thread (/lib64/libpthread.so.0+0x7ea4)
    #12 0x7fe2b781e9fc in __clone (/lib64/libc.so.6+0xfe9fc)

0x60300014ac48 is located 8 bytes inside of 24-byte region [0x60300014ac40,0x60300014ac58)
freed by thread T1020 (brpc_light) here:
    #0 0x560bef700767 in operator delete(void*, unsigned long) (/usr/local/service/doris/lib/be/doris_be+0x11dad767)
    #1 0x560bf1c3edca in __gnu_cxx::new_allocator<doris::TUniqueId>::deallocate(doris::TUniqueId*, unsigned long) /var/local/ldb-toolchain/include/c++/11/ext/new_allocator.h:139
    #2 0x560bf1c3c191 in std::allocator_traits<std::allocator<doris::TUniqueId> >::deallocate(std::allocator<doris::TUniqueId>&, doris::TUniqueId*, unsigned long) /var/local/ldb-toolchain/include/c++/11/bits/alloc_traits.h:492
    #3 0x560bf1c3a579 in std::_Vector_base<doris::TUniqueId, std::allocator<doris::TUniqueId> >::_M_deallocate(doris::TUniqueId*, unsigned long) /var/local/ldb-toolchain/include/c++/11/bits/stl_vector.h:354
    #4 0x560bf1c3aeec in void std::vector<doris::TUniqueId, std::allocator<doris::TUniqueId> >::_M_realloc_insert<doris::TUniqueId const&>(__gnu_cxx::__normal_iterator<doris::TUniqueId*, std::vector<doris::TUniqueId, std::allocator<doris::TUniqueId> > >, doris::TUniqueId const&) /var/local/ldb-toolchain/include/c++/11/bits/vector.tcc:500
    #5 0x560bf1c393d2 in std::vector<doris::TUniqueId, std::allocator<doris::TUniqueId> >::push_back(doris::TUniqueId const&) /var/local/ldb-toolchain/include/c++/11/bits/stl_vector.h:1198
    #6 0x560bf1d3569b in doris::FragmentMgr::exec_plan_fragment(doris::TExecPlanFragmentParams const&, std::function<void (doris::PlanFragmentExecutor*)>) /data/doris-1.x/be/src/runtime/fragment_mgr.cpp:701
    #7 0x560bf1d31aa4 in doris::FragmentMgr::exec_plan_fragment(doris::TExecPlanFragmentParams const&) /data/doris-1.x/be/src/runtime/fragment_mgr.cpp:564
    #8 0x560bf238a9eb in doris::PInternalServiceImpl::_exec_plan_fragment_impl(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, doris::PFragmentRequestVersion, bool) /data/doris-1.x/be/src/service/internal_service.cpp:480
    #9 0x560bf2385c17 in doris::PInternalServiceImpl::_exec_plan_fragment_in_pthread(google::protobuf::RpcController*, doris::PExecPlanFragmentRequest const*, doris::PExecPlanFragmentResult*, google::protobuf::Closure*) /data/doris-1.x/be/src/service/internal_service.cpp:254
    #10 0x560bf2386003 in operator() /data/doris-1.x/be/src/service/internal_service.cpp:266
    #11 0x560bf23ac81f in __invoke_impl<void, doris::PInternalServiceImpl::exec_plan_fragment_prepare(google::protobuf::RpcController*, const doris::PExecPlanFragmentRequest*, doris::PExecPlanFragmentResult*, google::protobuf::Closure*)::<lambda()>&> /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
    #12 0x560bf23a7095 in __invoke_r<void, doris::PInternalServiceImpl::exec_plan_fragment_prepare(google::protobuf::RpcController*, const doris::PExecPlanFragmentRequest*, doris::PExecPlanFragmentResult*, google::protobuf::Closure*)::<lambda()>&> /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
    #13 0x560bf23a394d in _M_invoke /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:291
    #14 0x560bf1bc734b in std::function<void ()>::operator()() const /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:560
    #15 0x560bf1bc3188 in doris::PriorityThreadPool::work_thread(int) /data/doris-1.x/be/src/util/priority_thread_pool.hpp:145
    #16 0x560bf1bdc5a5 in void std::__invoke_impl<void, void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>(std::__invoke_memfun_deref, void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:74
    #17 0x560bf1bdc225 in std::__invoke_result<void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>::type std::__invoke<void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>(void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:96
    #18 0x560bf1bdc15a in decltype (__invoke((*this)._M_pmf, (forward<doris::PriorityThreadPool*&>)({parm#1}), (forward<int&>)({parm#1}))) std::_Mem_fn_base<void (doris::PriorityThreadPool::*)(int), true>::operator()<doris::PriorityThreadPool*&, int&>(doris::PriorityThreadPool*&, int&) const /var/local/ldb-toolchain/include/c++/11/functional:131
    #19 0x560bf1bdc068 in void std::__invoke_impl<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>(std::__invoke_other, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
    #20 0x560bf1bdbf30 in std::enable_if<is_invocable_r_v<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>, void>::type std::__invoke_r<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>(std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
    #21 0x560bf1bdbd2a in void std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>::__call<void, , 0ul, 1ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul>) /var/local/ldb-toolchain/include/c++/11/functional:570
    #22 0x560bf1bdb9f8 in void std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>::operator()<>() /var/local/ldb-toolchain/include/c++/11/functional:629
    #23 0x560bf1bdb821 in void std::__invoke_impl<void, std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>(std::__invoke_other, std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
    #24 0x560bf1bdb76f in std::__invoke_result<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>::type std::__invoke<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>(std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:96
    #25 0x560bf1bdb6c9 in void std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> > >::_M_invoke<0ul>(std::_Index_tuple<0ul>) /var/local/ldb-toolchain/include/c++/11/bits/std_thread.h:253
    #26 0x560bf1bdb643 in std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> > >::operator()() /var/local/ldb-toolchain/include/c++/11/bits/std_thread.h:260
    #27 0x560bf1bdb5cb in std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> > > >::_M_run() /var/local/ldb-toolchain/include/c++/11/bits/std_thread.h:211
    #28 0x560c04f42eef in execute_native_thread_routine ../../../../../libstdc++-v3/src/c++11/thread.cc:82

previously allocated by thread T1020 (brpc_light) here:
    #0 0x560bef6ff707 in operator new(unsigned long) (/usr/local/service/doris/lib/be/doris_be+0x11dac707)
    #1 0x560bf1c404e4 in __gnu_cxx::new_allocator<doris::TUniqueId>::allocate(unsigned long, void const*) /var/local/ldb-toolchain/include/c++/11/ext/new_allocator.h:121
    #2 0x560bf1c3f0ad in std::allocator_traits<std::allocator<doris::TUniqueId> >::allocate(std::allocator<doris::TUniqueId>&, unsigned long) /var/local/ldb-toolchain/include/c++/11/bits/alloc_traits.h:460
    #3 0x560bf1c3d2ab in std::_Vector_base<doris::TUniqueId, std::allocator<doris::TUniqueId> >::_M_allocate(unsigned long) /var/local/ldb-toolchain/include/c++/11/bits/stl_vector.h:346
    #4 0x560bf1c3ad26 in void std::vector<doris::TUniqueId, std::allocator<doris::TUniqueId> >::_M_realloc_insert<doris::TUniqueId const&>(__gnu_cxx::__normal_iterator<doris::TUniqueId*, std::vector<doris::TUniqueId, std::allocator<doris::TUniqueId> > >, doris::TUniqueId const&) /var/local/ldb-toolchain/include/c++/11/bits/vector.tcc:440
    #5 0x560bf1c393d2 in std::vector<doris::TUniqueId, std::allocator<doris::TUniqueId> >::push_back(doris::TUniqueId const&) /var/local/ldb-toolchain/include/c++/11/bits/stl_vector.h:1198
    #6 0x560bf1d3569b in doris::FragmentMgr::exec_plan_fragment(doris::TExecPlanFragmentParams const&, std::function<void (doris::PlanFragmentExecutor*)>) /data/doris-1.x/be/src/runtime/fragment_mgr.cpp:701
    #7 0x560bf1d31aa4 in doris::FragmentMgr::exec_plan_fragment(doris::TExecPlanFragmentParams const&) /data/doris-1.x/be/src/runtime/fragment_mgr.cpp:564
    #8 0x560bf238a9eb in doris::PInternalServiceImpl::_exec_plan_fragment_impl(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, doris::PFragmentRequestVersion, bool) /data/doris-1.x/be/src/service/internal_service.cpp:480
    #9 0x560bf2385c17 in doris::PInternalServiceImpl::_exec_plan_fragment_in_pthread(google::protobuf::RpcController*, doris::PExecPlanFragmentRequest const*, doris::PExecPlanFragmentResult*, google::protobuf::Closure*) /data/doris-1.x/be/src/service/internal_service.cpp:254
    #10 0x560bf2386003 in operator() /data/doris-1.x/be/src/service/internal_service.cpp:266
    #11 0x560bf23ac81f in __invoke_impl<void, doris::PInternalServiceImpl::exec_plan_fragment_prepare(google::protobuf::RpcController*, const doris::PExecPlanFragmentRequest*, doris::PExecPlanFragmentResult*, google::protobuf::Closure*)::<lambda()>&> /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
    #12 0x560bf23a7095 in __invoke_r<void, doris::PInternalServiceImpl::exec_plan_fragment_prepare(google::protobuf::RpcController*, const doris::PExecPlanFragmentRequest*, doris::PExecPlanFragmentResult*, google::protobuf::Closure*)::<lambda()>&> /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
    #13 0x560bf23a394d in _M_invoke /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:291
    #14 0x560bf1bc734b in std::function<void ()>::operator()() const /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:560
    #15 0x560bf1bc3188 in doris::PriorityThreadPool::work_thread(int) /data/doris-1.x/be/src/util/priority_thread_pool.hpp:145
    #16 0x560bf1bdc5a5 in void std::__invoke_impl<void, void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>(std::__invoke_memfun_deref, void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:74
    #17 0x560bf1bdc225 in std::__invoke_result<void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>::type std::__invoke<void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>(void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:96
    #18 0x560bf1bdc15a in decltype (__invoke((*this)._M_pmf, (forward<doris::PriorityThreadPool*&>)({parm#1}), (forward<int&>)({parm#1}))) std::_Mem_fn_base<void (doris::PriorityThreadPool::*)(int), true>::operator()<doris::PriorityThreadPool*&, int&>(doris::PriorityThreadPool*&, int&) const /var/local/ldb-toolchain/include/c++/11/functional:131
    #19 0x560bf1bdc068 in void std::__invoke_impl<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>(std::__invoke_other, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
    #20 0x560bf1bdbf30 in std::enable_if<is_invocable_r_v<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>, void>::type std::__invoke_r<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>(std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
    #21 0x560bf1bdbd2a in void std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>::__call<void, , 0ul, 1ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul>) /var/local/ldb-toolchain/include/c++/11/functional:570
    #22 0x560bf1bdb9f8 in void std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>::operator()<>() /var/local/ldb-toolchain/include/c++/11/functional:629
    #23 0x560bf1bdb821 in void std::__invoke_impl<void, std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>(std::__invoke_other, std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
    #24 0x560bf1bdb76f in std::__invoke_result<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>::type std::__invoke<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>(std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:96
    #25 0x560bf1bdb6c9 in void std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> > >::_M_invoke<0ul>(std::_Index_tuple<0ul>) /var/local/ldb-toolchain/include/c++/11/bits/std_thread.h:253
    #26 0x560bf1bdb643 in std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> > >::operator()() /var/local/ldb-toolchain/include/c++/11/bits/std_thread.h:260
    #27 0x560bf1bdb5cb in std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> > > >::_M_run() /var/local/ldb-toolchain/include/c++/11/bits/std_thread.h:211
    #28 0x560c04f42eef in execute_native_thread_routine ../../../../../libstdc++-v3/src/c++11/thread.cc:82

Thread T22 (memory_gc_threa) created by T0 here:
    #0 0x560bef6a2061 in __interceptor_pthread_create (/usr/local/service/doris/lib/be/doris_be+0x11d4f061)
    #1 0x560bf27158bf in doris::Thread::start_thread(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::function<void ()> const&, unsigned long, scoped_refptr<doris::Thread>*) /data/doris-1.x/be/src/util/thread.cpp:408
    #2 0x560bef7b21bd in create<doris::Daemon::start()::<lambda()> > /data/doris-1.x/be/src/util/thread.h:51
    #3 0x560bef7affcc in doris::Daemon::start() /data/doris-1.x/be/src/common/daemon.cpp:487
    #4 0x560bef74f815 in main /data/doris-1.x/be/src/service/doris_main.cpp:389
    #5 0x7fe2b7742554 in __libc_start_main (/lib64/libc.so.6+0x22554)

Thread T1020 (brpc_light) created by T0 here:
    #0 0x560bef6a2061 in __interceptor_pthread_create (/usr/local/service/doris/lib/be/doris_be+0x11d4f061)
    #1 0x560c04f43015 in __gthread_create /data/gcc-11.1.0/build/x86_64-pc-linux-gnu/libstdc++-v3/include/x86_64-pc-linux-gnu/bits/gthr-default.h:663
    #2 0x560c04f43015 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) ../../../../../libstdc++-v3/src/c++11/thread.cc:147
    #3 0x560bf1bca199 in std::_MakeUniq<std::thread>::__single_object std::make_unique<std::thread, std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&>(std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&) /var/local/ldb-toolchain/include/c++/11/bits/unique_ptr.h:962
    #4 0x560bf1bc5fe8 in std::thread* doris::ThreadGroup::create_thread<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> >(std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>) /data/doris-1.x/be/src/util/thread_group.h:65
    #5 0x560bf1bc2470 in doris::PriorityThreadPool::PriorityThreadPool(unsigned int, unsigned int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /data/doris-1.x/be/src/util/priority_thread_pool.hpp:59
    #6 0x560bf2381919 in doris::PInternalServiceImpl::PInternalServiceImpl(doris::ExecEnv*) /data/doris-1.x/be/src/service/internal_service.cpp:109
    #7 0x560bf235374c in doris::BRpcService::start(int, int) /data/doris-1.x/be/src/service/brpc_service.cpp:45
    #8 0x560bef7500c7 in main /data/doris-1.x/be/src/service/doris_main.cpp:435
    #9 0x7fe2b7742554 in __libc_start_main (/lib64/libc.so.6+0x22554)

SUMMARY: AddressSanitizer: heap-use-after-free /data/doris-1.x/gensrc/build/gen_cpp/Types_types.cpp:2064 in doris::TUniqueId::TUniqueId(doris::TUniqueId const&)
Shadow bytes around the buggy address:
  0x0c0680021530: fd fa fa fa 00 00 00 07 fa fa 00 00 00 07 fa fa
  0x0c0680021540: fa fa fa fa fa fa fd fd fd fd fa fa fd fd fd fa
  0x0c0680021550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0680021560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0680021570: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c0680021580: fa fa fa fa fa fa fa fa fd[fd]fd fa fa fa fd fd
  0x0c0680021590: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c06800215a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c06800215b0: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fa fa
  0x0c06800215c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c06800215d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==715739==ABORTING

Further comments

If this is a relatively large or complex change, kick off the discussion at dev@doris.apache.org by explaining why you chose the solution you did and what alternatives you considered, etc...

@lide-reed lide-reed self-requested a review December 7, 2023 03:00
xinyiZzz
xinyiZzz approved these changes Dec 7, 2023
View reviewed changes
Copy link
Contributor

@xinyiZzz xinyiZzz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@github-actions
Copy link
Contributor

github-actions bot commented Dec 7, 2023

PR approved by at least one committer and no changes requested.

@github-actions github-actions bot added the approved Indicates a PR has been approved by one committer. label Dec 7, 2023
@github-actions
Copy link
Contributor

github-actions bot commented Dec 7, 2023

PR approved by anyone and no changes requested.

lide-reed
lide-reed approved these changes Dec 7, 2023
View reviewed changes
Copy link
Contributor

@lide-reed lide-reed left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@lide-reed lide-reed merged commit ac57c1a into apache:branch-1.2-lts Dec 7, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lide-reed lide-reed lide-reed approved these changes

@xinyiZzz xinyiZzz xinyiZzz approved these changes

Assignees

No one assigned

Labels

approved Indicates a PR has been approved by one committer. dev/1.2.8-merged reviewed

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@xy720 @lide-reed @xinyiZzz @morningman