[ML] Crash in CEventRateModelDetailsView::dataTimeInterval

[droberts195]

A user saw autodetect crash with the following error message:

Datafeed is encountering errors submitting data for analysis: [kubernetes-app-log-rate-detector] Unexpected death of autodetect: Fatal error: 'si_signo 11, si_code: 1, si_errno: 0, address: 0x7fd9478c8a9a, library: /elasticsearch/modules/x-pack-ml/platform/linux-x86_64/bin/../lib/libMlModel.so, base: 0x7fd947556000, normalized address: 0x372a9a', version: 7.6.2 (build e06ef9d86d5332)

Looking at which function this was in shows the following:

bash$ objdump -T libMlModel.so | grep '^0000000000372a' | sort
0000000000372a20 g    DF .text  0000000000000005  Base        _ZNK2ml5model26CEventRateModelDetailsView4baseEv
0000000000372a30 g    DF .text  0000000000000009  Base        _ZNK2ml5model26CEventRateModelDetailsView18countVarianceScaleENS_7model_t8EFeatureEml
0000000000372a30 g    DF .text  0000000000000009  Base        _ZNK2ml5model36CEventRatePopulationModelDetailsView18countVarianceScaleENS_7model_t8EFeatureEml
0000000000372a40 g    DF .text  0000000000000005  Base        _ZNK2ml5model36CEventRatePopulationModelDetailsView4baseEv
0000000000372a50 g    DF .text  0000000000000005  Base        _ZNK2ml5model23CMetricModelDetailsView4baseEv
0000000000372a60 g    DF .text  0000000000000005  Base        _ZNK2ml5model33CMetricPopulationModelDetailsView4baseEv
0000000000372a70 g    DF .text  000000000000004e  Base        _ZNK2ml5model26CEventRateModelDetailsView16dataTimeIntervalEm
0000000000372ac0 g    DF .text  000000000000004e  Base        _ZNK2ml5model23CMetricModelDetailsView16dataTimeIntervalEm
bash$ c++filt _ZNK2ml5model26CEventRateModelDetailsView16dataTimeIntervalEm
ml::model::CEventRateModelDetailsView::dataTimeInterval(unsigned long) const

That method is small:

CEventRateModelDetailsView::TTimeTimePr
CEventRateModelDetailsView::dataTimeInterval(std::size_t byFieldId) const {
    return {m_Model->firstBucketTimes()[byFieldId], m_Model->lastBucketTimes()[byFieldId]};
}

The only possibilities are:

1. m_Model was nullptr
2. byFieldId was out of range for the lastBucketTimes() vector

The second possibility is most likely.

[tveasey]

Note that this function is only called on two places inside CAnomalyDetector::getForecastModels when performing a forecast which overflows to disk. One thing which strikes me as dubious looking at the code:

    core_t::TTime firstDataTime;
    core_t::TTime lastDataTime;
    std::tie(firstDataTime, lastDataTime) = view->dataTimeInterval(pid);
    if (model != nullptr && model->isForecastPossible()) {

is that the call happens outside this check if (model != nullptr.... I think this is almost certainly is the culprit since the model can be null if pruning removed it. I'll raise a PR to fix this.

[droberts195]

It looks like the bug was introduced in 7.2.0 by #214. Hence the fix does not need backporting to 6.8.