[Bug] asan report use after free due to bad deconstruct order in IndexChannel #8762
Description
Search before asking
- I had searched in the issues and found no similar issues.
Version
dev-1.0.0
What's Wrong?
use after free
What You Expected?
do not use after free
How to Reproduce?
No response
Anything Else?
Thread 267 (Thread 0x7f5078c32700 (LWP 4088406)):
#0 syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:38
#1 0x000000000afc7f3e in bthread::futex_wait_private (addr1=0x7f5078c28ce0, expected=0, timeout=0x0) at /root/regression/incubator-doris/thirdparty/src/incubator-brpc-1.0.0/src/bthread/sys_futex.h:40
#2 bthread::wait_pthread (pw=..., ptimeout=ptimeout@entry=0x0) at /root/regression/incubator-doris/thirdparty/src/incubator-brpc-1.0.0/src/bthread/butex.cpp:141
#3 0x000000000afc8d95 in bthread::butex_wait_from_pthread (g=, b=0x625001050d40, expected_value=433, abstime=) at /root/regression/incubator-doris/thirdparty/src/incubator-brpc-1.0.0/src/bthread/butex.cpp:588
#4 bthread::butex_wait (arg=arg@entry=0x625001050d40, expected_value=expected_value@entry=433, abstime=, abstime@entry=0x0) at /root/regression/incubator-doris/thirdparty/src/incubator-brpc-1.0.0/src/bthread/butex.cpp:621
#5 0x000000000afcf43d in bthread_id_join (id=...) at /root/regression/incubator-doris/thirdparty/src/incubator-brpc-1.0.0/src/bthread/id.cpp:529
#6 0x000000000650baee in doris::stream_load::ReusableClosuredoris::PTabletWriterAddBatchResult::join (this=0x618001893880) at /root/regression/incubator-doris/be/src/exec/tablet_sink.h:104
#7 0x000000000650b206 in doris::stream_load::ReusableClosuredoris::PTabletWriterAddBatchResult::~ReusableClosure (this=0x618001893880) at /root/regression/incubator-doris/be/src/exec/tablet_sink.h:94
#8 0x000000000650b2d9 in doris::stream_load::ReusableClosuredoris::PTabletWriterAddBatchResult::~ReusableClosure (this=0x618001893880) at /root/regression/incubator-doris/be/src/exec/tablet_sink.h:92
#9 0x00000000064bb508 in doris::stream_load::NodeChannel::~NodeChannel (this=0x618000d0b490) at /root/regression/incubator-doris/be/src/exec/tablet_sink.cpp:63
#25 0x00000000064c850d in doris::stream_load::IndexChannel::~IndexChannel (this=0x616008562390) at /root/regression/incubator-doris/be/src/exec/tablet_sink.cpp:590001
#37 0x00000000064f1f67 in std::vector<std::shared_ptrdoris::stream_load::IndexChannel, std::allocator<std::shared_ptrdoris::stream_load::IndexChannel > >::~vector (this=0x619001fcc6f0) at /var/local/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/stl_vector.h:680
#38 0x00000000064cd7fb in doris::stream_load::OlapTableSink::~OlapTableSink (this=0x619001fcc580) at /root/regression/incubator-doris/be/src/exec/tablet_sink.cpp:718
#39 0x00000000064cdb69 in doris::stream_load::OlapTableSink::~OlapTableSink (this=0x619001fcc580) at /root/regression/incubator-doris/be/src/exec/tablet_sink.cpp:711
Thread 262 (Thread 0x7f5005699700 (LWP 1562641)):
#0 syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:38
#1 0x000000000afc7f3e in bthread::futex_wait_private (addr1=0x7f500568fce0, expected=0, timeout=0x0) at /root/regression/incubator-doris/thirdparty/src/incubator-brpc-1.0.0/src/bthread/sys_futex.h:40
#2 bthread::wait_pthread (pw=..., ptimeout=ptimeout@entry=0x0) at /root/regression/incubator-doris/thirdparty/src/incubator-brpc-1.0.0/src/bthread/butex.cpp:141
#3 0x000000000afc8d95 in bthread::butex_wait_from_pthread (g=, b=0x6250103883c0, expected_value=1041, abstime=) at /root/regression/incubator-doris/thirdparty/src/incubator-brpc-1.0.0/src/bthread/butex.cpp:588
#4 bthread::butex_wait (arg=arg@entry=0x6250103883c0, expected_value=expected_value@entry=1041, abstime=, abstime@entry=0x0) at /root/regression/incubator-doris/thirdparty/src/incubator-brpc-1.0.0/src/bthread/butex.cpp:621
#5 0x000000000afcf43d in bthread_id_join (id=...) at /root/regression/incubator-doris/thirdparty/src/incubator-brpc-1.0.0/src/bthread/id.cpp:529
#6 0x000000000650baee in doris::stream_load::ReusableClosuredoris::PTabletWriterAddBatchResult::join (this=0x61800049ec80) at /root/regression/incubator-doris/be/src/exec/tablet_sink.h:104
#7 0x000000000650b206 in doris::stream_load::ReusableClosuredoris::PTabletWriterAddBatchResult::~ReusableClosure (this=0x61800049ec80) at /root/regression/incubator-doris/be/src/exec/tablet_sink.h:94
#8 0x000000000650b2d9 in doris::stream_load::ReusableClosuredoris::PTabletWriterAddBatchResult::~ReusableClosure (this=0x61800049ec80) at /root/regression/incubator-doris/be/src/exec/tablet_sink.h:92
#9 0x00000000064bb508 in doris::stream_load::NodeChannel::~NodeChannel (this=0x618001086090) at /root/regression/incubator-doris/be/src/exec/tablet_sink.cpp:63
#10 0x0000000006517399 in __gnu_cxx::new_allocatordoris::stream_load::NodeChannel::destroydoris::stream_load::NodeChannel (this=0x618001086090, __p=0x618001086090) at /var/local/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/ext/new_allocator.h:162
#11 0x000000000651732d in std::allocator_traits<std::allocatordoris::stream_load::NodeChannel >::destroydoris::stream_load::NodeChannel (__a=..., __p=0x618001086090) at /var/local/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/alloc_traits.h:531
#12 0x0000000006516f86 in std::_Sp_counted_ptr_inplace<doris::stream_load::NodeChannel, std::allocatordoris::stream_load::NodeChannel, (__gnu_cxx::_Lock_policy)2>::_M_dispose (this=0x618001086080) at /var/local/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/shared_ptr_base.h:528
#25 0x00000000064c850d in doris::stream_load::IndexChannel::~IndexChannel (this=0x616017f0a690) at /root/regression/incubator-doris/be/src/exec/tablet_sink.cpp:591
#38 0x00000000064cd7fb in doris::stream_load::OlapTableSink::~OlapTableSink (this=0x6190021e4480) at /root/regression/incubator-doris/be/src/exec/tablet_sink.cpp:718
#39 0x00000000064cdb69 in doris::stream_load::OlapTableSink::~OlapTableSink (this=0x6190021e4480) at /root/regression/incubator-doris/be/src/exec/tablet_sink.cpp:711
Thread 261 (Thread 0x7f50923de700 (LWP 4035532)):
#0 syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:38
#1 0x000000000afc7f3e in bthread::futex_wait_private (addr1=0x7f50923d4ce0, expected=0, timeout=0x0) at /root/regression/incubator-doris/thirdparty/src/incubator-brpc-1.0.0/src/bthread/sys_futex.h:40
#2 bthread::wait_pthread (pw=..., ptimeout=ptimeout@entry=0x0) at /root/regression/incubator-doris/thirdparty/src/incubator-brpc-1.0.0/src/bthread/butex.cpp:141
#3 0x000000000afc8d95 in bthread::butex_wait_from_pthread (g=, b=0x625002cc2dc0, expected_value=329, abstime=) at /root/regression/incubator-doris/thirdparty/src/incubator-brpc-1.0.0/src/bthread/butex.cpp:588
#4 bthread::butex_wait (arg=arg@entry=0x625002cc2dc0, expected_value=expected_value@entry=329, abstime=, abstime@entry=0x0) at /root/regression/incubator-doris/thirdparty/src/incubator-brpc-1.0.0/src/bthread/butex.cpp:621
#5 0x000000000afcf43d in bthread_id_join (id=...) at /root/regression/incubator-doris/thirdparty/src/incubator-brpc-1.0.0/src/bthread/id.cpp:529
#6 0x000000000650baee in doris::stream_load::ReusableClosuredoris::PTabletWriterAddBatchResult::join (this=0x6180017d7080) at /root/regression/incubator-doris/be/src/exec/tablet_sink.h:104
#7 0x000000000650b206 in doris::stream_load::ReusableClosuredoris::PTabletWriterAddBatchResult::~ReusableClosure (this=0x6180017d7080) at /root/regression/incubator-doris/be/src/exec/tablet_sink.h:94
#8 0x000000000650b2d9 in doris::stream_load::ReusableClosuredoris::PTabletWriterAddBatchResult::~ReusableClosure (this=0x6180017d7080) at /root/regression/incubator-doris/be/src/exec/tablet_sink.h:92
#9 0x00000000064bb508 in doris::stream_load::NodeChannel::~NodeChannel (this=0x618000db8490) at /root/regression/incubator-doris/be/src/exec/tablet_sink.cpp:63
#10 0x0000000006517399 in __gnu_cxx::new_allocatordoris::stream_load::NodeChannel::destroydoris::stream_load::NodeChannel (this=0x618000db8490, __p=0x618000db8490) at /var/local/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/ext/new_allocator.h:162
#11 0x000000000651732d in std::allocator_traits<std::allocatordoris::stream_load::NodeChannel >::destroydoris::stream_load::NodeChannel (__a=..., __p=0x618000db8490) at /var/local/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/alloc_traits.h:531
#12 0x0000000006516f86 in std::_Sp_counted_ptr_inplace<doris::stream_load::NodeChannel, std::allocatordoris::stream_load::NodeChannel, (__gnu_cxx::_Lock_policy)2>::_M_dispose (this=0x618000db8480) at /var/local/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/shared_ptr_base.h:528
Thread 259 (Thread 0x7f5064bfd700 (LWP 85170)):
Thread 251 (Thread 0x7f5037a9d700 (LWP 391381)):
Thread 156 (Thread 0x7f5080cb8700 (LWP 3432070)):
Thread 140 (Thread 0x7f51a9cb1700 (LWP 3099648)):
Thread 107 (Thread 0x7f50091f0700 (LWP 3896235)):
Thread 318 (Thread 0x7f5155a3d700 (LWP 3099799)):
#4 0x0000000003ad5711 in __sanitizer::Die() () at /root/regression/incubator-doris/be/src/olap/utils.h:49
#5 0x0000000003abc801 in __asan::ScopedInErrorReport::~ScopedInErrorReport() () at /root/regression/incubator-doris/be/src/olap/utils.h:49
#6 0x0000000003abe346 in __asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool) () at /root/regression/incubator-doris/be/src/olap/utils.h:49
#7 0x0000000003abebb8 in __asan_report_load8 () at /root/regression/incubator-doris/be/src/olap/utils.h:49
#8 0x00000000042e6bda in std::_Hashtable<long, std::pair<long const, std::unordered_set<long, std::hash, std::equal_to, std::allocator > >, std::allocator<std::pair<long const, std::unordered_set<long, std::hash, std::equal_to, std::allocator > > >, std::__detail::_Select1st, std::equal_to, std::hash, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_find_before_node (this=0x616017f0a750, __bkt=7, __k=@0x7f511d5fbf00: 1297498, __code=1297498) at /var/local/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/hashtable.h:1810
#9 0x00000000042e697d in std::_Hashtable<long, std::pair<long const, std::unordered_set<long, std::hash, std::equal_to, std::allocator > >, std::allocator<std::pair<long const, std::unordered_set<long, std::hash, std::equal_to, std::allocator > > >, std::__detail::_Select1st, std::equal_to, std::hash, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_find_node (this=0x616017f0a750, __bkt=7, __key=@0x7f511d5fbf00: 1297498, __c=1297498) at /var/local/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/hashtable.h:791
#10 0x00000000042e7566 in std::__detail::_Map_base<long, std::pair<long const, std::unordered_set<long, std::hash, std::equal_to, std::allocator > >, std::allocator<std::pair<long const, std::unordered_set<long, std::hash, std::equal_to, std::allocator > > >, std::__detail::_Select1st, std::equal_to, std::hash, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true>, true>::operator[] (this=0x616017f0a750, __k=@0x7f511d5fbf00: 1297498) at /var/local/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/hashtable_policy.h:703
#11 0x00000000042d8e5d in std::unordered_map<long, std::unordered_set<long, std::hash, std::equal_to, std::allocator >, std::hash, std::equal_to, std::allocator<std::pair<long const, std::unordered_set<long, std::hash, std::equal_to, std::allocator > > > >::operator[] (this=0x616017f0a750, __k=@0x7f511d5fbf00: 1297498) at /var/local/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/unordered_map.h:980
#12 0x00000000064ca7ec in doris::stream_load::IndexChannel::mark_as_failed (this=0x616017f0a690, node_id=10002, host=..., err=..., tablet_id=-1) at /root/regression/incubator-doris/be/src/exec/tablet_sink.cpp:663
#13 0x00000000064e1158 in doris::stream_load::NodeChannel::open_wait()::$_0::operator()(bool) const (this=0x61800049ef78, is_last_rpc=false) at /root/regression/incubator-doris/be/src/exec/tablet_sink.cpp:194
#14 0x00000000064e0d0f in std::__invoke_impl<void, doris::stream_load::NodeChannel::open_wait()::$_0&, bool>(std::__invoke_other, doris::stream_load::NodeChannel::open_wait()::$_0&, bool&&) (__f=..., __args=@0x7f511d5fcc80: false) at /var/local/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61
0x616017f0a690 IndexChannel
0x6190021e4480 OlapTableSink
0x618001086090 NodeChannel
0x61800049ec80
Thread 262
Are you willing to submit PR?
- Yes I am willing to submit a PR!
Code of Conduct
- I agree to follow this project's Code of Conduct