[Bug] heap-use-after-free error when insert data into table with bitmap column #9525
Description
Search before asking
- I had searched in the issues and found no similar issues.
Version
master-74352c807
What's Wrong?
BE is build with ASAN.
Insert into table with bitmap column failed:
mysql> show create table bitmap_basic_agg
-> ;
+------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Table | Create Table |
+------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| bitmap_basic_agg | CREATE TABLE `bitmap_basic_agg` (
`k1` int(11) NULL COMMENT "",
`k2` bitmap BITMAP_UNION NULL COMMENT ""
) ENGINE=OLAP
AGGREGATE KEY(`k1`)
COMMENT "OLAP"
DISTRIBUTED BY HASH(`k1`) BUCKETS 1
PROPERTIES (
"replication_allocation" = "tag.location.default: 1",
"in_memory" = "false",
"storage_format" = "V2"
) |
+------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)
insert into bitmap_basic_agg values (1,bitmap_empty()), (2,bitmap_hash(0)),(2,bitmap_hash(0)), (3,bitmap_hash(0)),(3,bitmap_hash(1));
be error:
=================================================================
==782849==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300074c420 at pc 0x56510f61a4f0 bp 0x7f48079d89a0 sp 0x7f48079d8990
READ of size 1 at 0x60300074c420 thread T94 (MemTableFlushTh)
#0 0x56510f61a4ef in doris::faststring::append(void const*, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/util/faststring.h:120
#1 0x56510f61b0d2 in doris::segment_v2::BinaryPlainPageBuilder::add(unsigned char const*, unsigned long*) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/segment_v2/binary_plain_page.h:69
#2 0x565111ac46af in doris::segment_v2::ScalarColumnWriter::append_data_in_current_page(unsigned char const**, unsigned long*) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/segment_v2/column_writer.cpp:341
#3 0x565111ac41e6 in doris::segment_v2::ScalarColumnWriter::append_data(unsigned char const**, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/segment_v2/column_writer.cpp:329
#4 0x565111ac114e in doris::segment_v2::ColumnWriter::append_nullable(unsigned char const*, unsigned char const**, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/segment_v2/column_writer.cpp:219
#5 0x565111ac14b5 in doris::segment_v2::ColumnWriter::append(unsigned char const*, void const*, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/segment_v2/column_writer.cpp:231
#6 0x5651119750fc in doris::segment_v2::SegmentWriter::append_block(doris::vectorized::Block const*, unsigned long, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/segment_v2/segment_writer.cpp:140
#7 0x56510f7a50b3 in doris::BetaRowsetWriter::add_block(doris::vectorized::Block const*) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/beta_rowset_writer.cpp:123
#8 0x56510f5a4d7c in doris::MemTable::_do_flush(long&) /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable.cpp:305
#9 0x56510f5a3c77 in doris::MemTable::flush() /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable.cpp:277
#10 0x56510f23d677 in doris::FlushToken::_flush_memtable(std::shared_ptr<doris::MemTable>, long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable_flush_executor.cpp:74
#11 0x56510f243e25 in void std::__invoke_impl<void, void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>(std::__invoke_memfun_deref, void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf6e25)
#12 0x56510f243a44 in std::__invoke_result<void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>::type std::__invoke<void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>(void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf6a44)
#13 0x56510f24374f in void std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>::__call<void, , 0ul, 1ul, 2ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul, 2ul>) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf674f)
#14 0x56510f243430 in void std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>::operator()<, void>() /var/local/ldb-toolchain/include/c++/11/functional:503
#15 0x56510f242e69 in void std::__invoke_impl<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>(std::__invoke_other, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
#16 0x56510f2428e7 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>, void>::type std::__invoke_r<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>(std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
#17 0x56510f2423a4 in std::_Function_handler<void (), std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)> >::_M_invoke(std::_Any_data const&) /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:291
#18 0x56510f943aaf in std::function<void ()>::operator()() const /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:560
#19 0x56510ffd0e17 in doris::FunctionRunnable::run() /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:45
#20 0x56510ffcc0c4 in doris::ThreadPool::dispatch_thread() /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:540
#21 0x56510ffec945 in void std::__invoke_impl<void, void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(std::__invoke_memfun_deref, void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:74
#22 0x56510ffec1e4 in std::__invoke_result<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>::type std::__invoke<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:96
#23 0x56510ffeb583 in void std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>::__call<void, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /var/local/ldb-toolchain/include/c++/11/functional:420
#24 0x56510ffea086 in void std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>::operator()<, void>() /var/local/ldb-toolchain/include/c++/11/functional:503
#25 0x56510ffe6bed in void std::__invoke_impl<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>(std::__invoke_other, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
#26 0x56510ffe4511 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>, void>::type std::__invoke_r<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>(std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
#27 0x56510ffdf862 in std::_Function_handler<void (), std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()> >::_M_invoke(std::_Any_data const&) /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:291
#28 0x56510f943aaf in std::function<void ()>::operator()() const /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:560
#29 0x56510ffb0e1d in doris::Thread::supervise_thread(void*) /mnt/ssd01/tjp/incubator-doris/be/src/util/thread.cpp:408
#30 0x7f481fe72608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477
#31 0x7f481ffac162 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f162)
0x60300074c420 is located 16 bytes inside of 32-byte region [0x60300074c410,0x60300074c430)
freed by thread T94 (MemTableFlushTh) here:
#0 0x56510e9b7868 in realloc (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x536a868)
#1 0x56510ee8b913 in Allocator<false, false>::realloc(void*, unsigned long, unsigned long, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/allocator.h:125
#2 0x56510ee814bb in void doris::vectorized::PODArrayBase<1ul, 4096ul, Allocator<false, false>, 15ul, 16ul>::realloc<>(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/pod_array.h:147
#3 0x56510ee768ee in void doris::vectorized::PODArrayBase<1ul, 4096ul, Allocator<false, false>, 15ul, 16ul>::reserve<>(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/pod_array.h:213
#4 0x56510ee682da in void doris::vectorized::PODArrayBase<1ul, 4096ul, Allocator<false, false>, 15ul, 16ul>::resize<>(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/pod_array.h:219
#5 0x565114c415ef in doris::vectorized::OlapBlockDataConvertor::OlapColumnDataConvertorBitMap::convert_to_olap() /mnt/ssd01/tjp/incubator-doris/be/src/vec/olap/olap_data_convertor.cpp:208
#6 0x565114c409f7 in doris::vectorized::OlapBlockDataConvertor::convert_column_data(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/olap/olap_data_convertor.cpp:131
#7 0x565111974e43 in doris::segment_v2::SegmentWriter::append_block(doris::vectorized::Block const*, unsigned long, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/segment_v2/segment_writer.cpp:133
#8 0x56510f7a50b3 in doris::BetaRowsetWriter::add_block(doris::vectorized::Block const*) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/beta_rowset_writer.cpp:123
#9 0x56510f5a4d7c in doris::MemTable::_do_flush(long&) /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable.cpp:305
#10 0x56510f5a3c77 in doris::MemTable::flush() /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable.cpp:277
#11 0x56510f23d677 in doris::FlushToken::_flush_memtable(std::shared_ptr<doris::MemTable>, long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable_flush_executor.cpp:74
#12 0x56510f243e25 in void std::__invoke_impl<void, void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>(std::__invoke_memfun_deref, void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf6e25)
#13 0x56510f243a44 in std::__invoke_result<void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>::type std::__invoke<void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>(void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf6a44)
#14 0x56510f24374f in void std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>::__call<void, , 0ul, 1ul, 2ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul, 2ul>) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf674f)
#15 0x56510f243430 in void std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>::operator()<, void>() /var/local/ldb-toolchain/include/c++/11/functional:503
#16 0x56510f242e69 in void std::__invoke_impl<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>(std::__invoke_other, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
#17 0x56510f2428e7 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>, void>::type std::__invoke_r<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>(std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
#18 0x56510f2423a4 in std::_Function_handler<void (), std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)> >::_M_invoke(std::_Any_data const&) /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:291
#19 0x56510f943aaf in std::function<void ()>::operator()() const /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:560
#20 0x56510ffd0e17 in doris::FunctionRunnable::run() /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:45
#21 0x56510ffcc0c4 in doris::ThreadPool::dispatch_thread() /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:540
#22 0x56510ffec945 in void std::__invoke_impl<void, void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(std::__invoke_memfun_deref, void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:74
#23 0x56510ffec1e4 in std::__invoke_result<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>::type std::__invoke<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:96
#24 0x56510ffeb583 in void std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>::__call<void, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /var/local/ldb-toolchain/include/c++/11/functional:420
#25 0x56510ffea086 in void std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>::operator()<, void>() /var/local/ldb-toolchain/include/c++/11/functional:503
#26 0x56510ffe6bed in void std::__invoke_impl<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>(std::__invoke_other, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
#27 0x56510ffe4511 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>, void>::type std::__invoke_r<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>(std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
#28 0x56510ffdf862 in std::_Function_handler<void (), std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()> >::_M_invoke(std::_Any_data const&) /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:291
#29 0x56510f943aaf in std::function<void ()>::operator()() const /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:560
previously allocated by thread T94 (MemTableFlushTh) here:
#0 0x56510e9b74b7 in __interceptor_malloc (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x536a4b7)
#1 0x56510ee77745 in Allocator<false, false>::alloc_no_track(unsigned long, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/allocator.h:223
#2 0x56510ee68520 in Allocator<false, false>::alloc(unsigned long, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/allocator.h:104
#3 0x56510ee80e69 in void doris::vectorized::PODArrayBase<1ul, 4096ul, Allocator<false, false>, 15ul, 16ul>::alloc<>(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/pod_array.h:120
#4 0x56510ee813f4 in void doris::vectorized::PODArrayBase<1ul, 4096ul, Allocator<false, false>, 15ul, 16ul>::realloc<>(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/pod_array.h:139
#5 0x56510ee768ee in void doris::vectorized::PODArrayBase<1ul, 4096ul, Allocator<false, false>, 15ul, 16ul>::reserve<>(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/pod_array.h:213
#6 0x56510ee682da in void doris::vectorized::PODArrayBase<1ul, 4096ul, Allocator<false, false>, 15ul, 16ul>::resize<>(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/pod_array.h:219
#7 0x565114c415ef in doris::vectorized::OlapBlockDataConvertor::OlapColumnDataConvertorBitMap::convert_to_olap() /mnt/ssd01/tjp/incubator-doris/be/src/vec/olap/olap_data_convertor.cpp:208
#8 0x565114c409f7 in doris::vectorized::OlapBlockDataConvertor::convert_column_data(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/olap/olap_data_convertor.cpp:131
#9 0x565111974e43 in doris::segment_v2::SegmentWriter::append_block(doris::vectorized::Block const*, unsigned long, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/segment_v2/segment_writer.cpp:133
#10 0x56510f7a50b3 in doris::BetaRowsetWriter::add_block(doris::vectorized::Block const*) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/beta_rowset_writer.cpp:123
#11 0x56510f5a4d7c in doris::MemTable::_do_flush(long&) /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable.cpp:305
#12 0x56510f5a3c77 in doris::MemTable::flush() /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable.cpp:277
#13 0x56510f23d677 in doris::FlushToken::_flush_memtable(std::shared_ptr<doris::MemTable>, long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable_flush_executor.cpp:74
#14 0x56510f243e25 in void std::__invoke_impl<void, void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>(std::__invoke_memfun_deref, void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf6e25)
#15 0x56510f243a44 in std::__invoke_result<void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>::type std::__invoke<void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>(void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf6a44)
#16 0x56510f24374f in void std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>::__call<void, , 0ul, 1ul, 2ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul, 2ul>) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf674f)
#17 0x56510f243430 in void std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>::operator()<, void>() /var/local/ldb-toolchain/include/c++/11/functional:503
#18 0x56510f242e69 in void std::__invoke_impl<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>(std::__invoke_other, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
#19 0x56510f2428e7 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>, void>::type std::__invoke_r<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>(std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
#20 0x56510f2423a4 in std::_Function_handler<void (), std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)> >::_M_invoke(std::_Any_data const&) /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:291
#21 0x56510f943aaf in std::function<void ()>::operator()() const /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:560
#22 0x56510ffd0e17 in doris::FunctionRunnable::run() /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:45
#23 0x56510ffcc0c4 in doris::ThreadPool::dispatch_thread() /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:540
#24 0x56510ffec945 in void std::__invoke_impl<void, void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(std::__invoke_memfun_deref, void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:74
#25 0x56510ffec1e4 in std::__invoke_result<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>::type std::__invoke<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:96
#26 0x56510ffeb583 in void std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>::__call<void, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /var/local/ldb-toolchain/include/c++/11/functional:420
#27 0x56510ffea086 in void std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>::operator()<, void>() /var/local/ldb-toolchain/include/c++/11/functional:503
#28 0x56510ffe6bed in void std::__invoke_impl<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>(std::__invoke_other, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
#29 0x56510ffe4511 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>, void>::type std::__invoke_r<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>(std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
Thread T94 (MemTableFlushTh) created by T0 here:
#0 0x56510e95b751 in __interceptor_pthread_create (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x530e751)
#1 0x56510ffb01e1 in doris::Thread::start_thread(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::function<void ()> const&, unsigned long, scoped_refptr<doris::Thread>*) /mnt/ssd01/tjp/incubator-doris/be/src/util/thread.cpp:362
#2 0x56510ffd52f9 in doris::Status doris::Thread::create<void (doris::ThreadPool::*)(), doris::ThreadPool*>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, void (doris::ThreadPool::* const&)(), doris::ThreadPool* const&, scoped_refptr<doris::Thread>*) /mnt/ssd01/tjp/incubator-doris/be/src/util/thread.h:54
#3 0x56510ffcd8e4 in doris::ThreadPool::create_thread() /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:603
#4 0x56510ffc707e in doris::ThreadPool::init() /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:266
#5 0x56510ffc3938 in doris::ThreadPoolBuilder::build(std::unique_ptr<doris::ThreadPool, std::default_delete<doris::ThreadPool> >*) const /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:77
#6 0x56510f23dff2 in doris::MemTableFlushExecutor::init(std::vector<doris::DataDir*, std::allocator<doris::DataDir*> > const&) /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable_flush_executor.cpp:100
#7 0x56510ef65a6c in doris::StorageEngine::_open() /mnt/ssd01/tjp/incubator-doris/be/src/olap/storage_engine.cpp:205
#8 0x56510ef61598 in doris::StorageEngine::open(doris::EngineOptions const&, doris::StorageEngine**) /mnt/ssd01/tjp/incubator-doris/be/src/olap/storage_engine.cpp:108
#9 0x56510ea01a8c in main /mnt/ssd01/tjp/incubator-doris/be/src/service/doris_main.cpp:389
#10 0x7f481feb10b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)
SUMMARY: AddressSanitizer: heap-use-after-free /mnt/ssd01/tjp/incubator-doris/be/src/util/faststring.h:120 in doris::faststring::append(void const*, unsigned long)
Shadow bytes around the buggy address:
0x0c06800e1830: 00 fa fa fa 00 00 00 00 fa fa fd fd fd fd fa fa
0x0c06800e1840: 00 00 00 fa fa fa fd fd fd fa fa fa 00 00 00 fa
0x0c06800e1850: fa fa fd fd fd fd fa fa fd fd fd fd fa fa 00 00
0x0c06800e1860: 00 fa fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
0x0c06800e1870: 00 00 00 fa fa fa 00 00 00 00 fa fa 00 00 00 fa
=>0x0c06800e1880: fa fa fd fd[fd]fd fa fa 00 00 06 fa fa fa fa fa
0x0c06800e1890: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c06800e18a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c06800e18b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c06800e18c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c06800e18d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==782849==ABORTING
What You Expected?
Insert should be OK.
How to Reproduce?
No response
Anything Else?
No response
Are you willing to submit PR?
- Yes I am willing to submit a PR!
Code of Conduct
- I agree to follow this project's Code of Conduct