Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Bug] using Array caused coredump in ASAN build #10638

Closed
3 tasks done
eldenmoon opened this issue Jul 6, 2022 · 0 comments · Fixed by #10640 or #10777
Closed
3 tasks done

[Bug] using Array caused coredump in ASAN build #10638

eldenmoon opened this issue Jul 6, 2022 · 0 comments · Fixed by #10640 or #10777

Comments

@eldenmoon
Copy link
Member

eldenmoon commented Jul 6, 2022 •
edited by qidaye
Loading

Search before asking

  • I had searched in the issues and found no similar issues.

Version

master

What's Wrong?

==120598==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000700a08 at pc 0x5605ae18ada7 bp 0x7fb76fe69d10 sp 0x7fb76fe69d00
READ of size 8 at 0x603000700a08 thread T411
    #0 0x5605ae18ada6 in COW<doris::vectorized::IColumn>::intrusive_ptr<doris::vectorized::IColumn const>::operator*() const & /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/common/cow.h:206
    #1 0x5605ae18a041 in COW<doris::vectorized::IColumn>::chameleon_ptr<doris::vectorized::IColumn>::operator*() const /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/common/cow.h:350
    #2 0x5605b00d5bec in doris::vectorized::ColumnArray::get_offsets() const /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/columns/column_array.h:126
    #3 0x5605b00d5bec in doris::vectorized::DataTypeArray::to_string[abi:cxx11](doris::vectorized::IColumn const&, unsigned long) const /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/data_types/data_type_array.cpp:116
    #4 0x5605b0101a1e in doris::vectorized::DataTypeNullable::to_string[abi:cxx11](doris::vectorized::IColumn const&, unsigned long) const /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/data_types/data_type_nullable.cpp:52
    #5 0x5605b00bc609 in doris::vectorized::ColumnWithTypeAndName::to_string[abi:cxx11](unsigned long) const /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/core/column_with_type_and_name.cpp:70
    #6 0x5605b335d3f0 in doris::DeltaWriter::write(doris::vectorized::Block const*, std::vector<int, std::allocator<int> > const&) /mnt/disk/lihangyu/eldenmoon/doris/be/src/olap/delta_writer.cpp:206
    #7 0x5605af20262d in doris::Status doris::TabletsChannel::add_batch<doris::PTabletWriterAddBlockRequest, doris::PTabletWriterAddBlockResult>(doris::PTabletWriterAddBlockRequest const&, doris::PTabletWriterAddBlockResult*) /mnt/disk/lihangyu/eldenmoon/doris/be/src/runtime/tablets_channel.h:226
    #8 0x5605af1fe7e5 in doris::Status doris::LoadChannel::add_batch<doris::PTabletWriterAddBlockRequest, doris::PTabletWriterAddBlockResult>(doris::PTabletWriterAddBlockRequest const&, doris::PTabletWriterAddBlockResult*) /mnt/disk/lihangyu/eldenmoon/doris/be/src/runtime/load_channel.h:150
    #9 0x5605af1f8087 in doris::Status doris::LoadChannelMgr::add_batch<doris::PTabletWriterAddBlockRequest, doris::PTabletWriterAddBlockResult>(doris::PTabletWriterAddBlockRequest const&, doris::PTabletWriterAddBlockResult*) /mnt/disk/lihangyu/eldenmoon/doris/be/src/runtime/load_channel_mgr.h:137
    #10 0x5605af1dc0b8 in operator() /mnt/disk/lihangyu/eldenmoon/doris/be/src/service/internal_service.cpp:249
    #11 0x5605af1e814d in __invoke_impl<void, doris::PInternalServiceImpl::_tablet_writer_add_block(google::protobuf::RpcController*, const doris::PTabletWriterAddBlockRequest*, doris::PTabletWriterAddBlockResult*, google::protobuf::Closure*)::<lambda()>&> /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:61
    #12 0x5605af1e7c35 in __invoke_r<void, doris::PInternalServiceImpl::_tablet_writer_add_block(google::protobuf::RpcController*, const doris::PTabletWriterAddBlockRequest*, doris::PTabletWriterAddBlockResult*, google::protobuf::Closure*)::<lambda()>&> /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:111
    #13 0x5605af1e76b9 in _M_invoke /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/std_function.h:291
    #14 0x5605aed7ad27 in std::function<void ()>::operator()() const /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/std_function.h:560
    #15 0x5605aed75c44 in doris::PriorityThreadPool::work_thread(int) (/mnt/disk/lihangyu/eldenmoon/doris/test_env/be/lib/doris-be+0x6912c44)
    #16 0x5605aed9b051 in void std::__invoke_impl<void, void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>(std::__invoke_memfun_deref, void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:74
    #17 0x5605aed9acd1 in std::__invoke_result<void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>::type std::__invoke<void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>(void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:96
    #18 0x5605aed9ac06 in decltype (__invoke((*this)._M_pmf, (forward<doris::PriorityThreadPool*&>)({parm#1}), (forward<int&>)({parm#1}))) std::_Mem_fn_base<void (doris::PriorityThreadPool::*)(int), true>::operator()<doris::PriorityThreadPool*&, int&>(doris::PriorityThreadPool*&, int&) const /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/functional:131
    #19 0x5605aed9ab14 in void std::__invoke_impl<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>(std::__invoke_other, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:61
    #20 0x5605aed9a9dc in std::enable_if<is_invocable_r_v<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>, void>::type std::__invoke_r<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>(std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:111
    #21 0x5605aed9a7d6 in void std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>::__call<void, , 0ul, 1ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul>) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/functional:570
    #22 0x5605aed9a4a4 in void std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>::operator()<>() /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/functional:629
    #23 0x5605aed9a2cd in void std::__invoke_impl<void, std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>(std::__invoke_other, std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:61
    #24 0x5605aed9a21b in std::__invoke_result<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>::type std::__invoke<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>(std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:96
    #25 0x5605aed98fab in void std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> > >::_M_invoke<0ul>(std::_Index_tuple<0ul>) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/std_thread.h:253
    #26 0x5605aed960d9 in std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> > >::operator()() /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/std_thread.h:260
    #27 0x5605aed9579b in std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> > > >::_M_run() /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/std_thread.h:211
    #28 0x5605b6eadc5f in execute_native_thread_routine (/mnt/disk/lihangyu/eldenmoon/doris/test_env/be/lib/doris-be+0xea4ac5f)
    #29 0x7fb8245e2ea4 in start_thread (/lib64/libpthread.so.0+0x7ea4)
    #30 0x7fb8248f5b0c in clone (/lib64/libc.so.6+0xfeb0c)

0x603000700a08 is located 24 bytes inside of 32-byte region [0x6030007009f0,0x603000700a10)
freed by thread T411 here:
    #0 0x5605adcc7f47 in operator delete(void*, unsigned long) (/mnt/disk/lihangyu/eldenmoon/doris/test_env/be/lib/doris-be+0x5864f47)
    #1 0x5605b2af53f0 in doris::vectorized::ColumnArray::~ColumnArray() /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/columns/column_array.h:36
    #2 0x5605ae195a42 in COW<doris::vectorized::IColumn>::release_ref() /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/common/cow.h:109
    #3 0x5605ae1872c1 in COW<doris::vectorized::IColumn>::intrusive_ptr<doris::vectorized::IColumn const>::~intrusive_ptr() /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/common/cow.h:136
    #4 0x5605ae17d8c9 in COW<doris::vectorized::IColumn>::immutable_ptr<doris::vectorized::IColumn>::~immutable_ptr() /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/common/cow.h:257
    #5 0x5605b00d5bb6 in doris::vectorized::DataTypeArray::to_string[abi:cxx11](doris::vectorized::IColumn const&, unsigned long) const /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/data_types/data_type_array.cpp:115
    #6 0x5605b0101a1e in doris::vectorized::DataTypeNullable::to_string[abi:cxx11](doris::vectorized::IColumn const&, unsigned long) const /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/data_types/data_type_nullable.cpp:52
    #7 0x5605b00bc609 in doris::vectorized::ColumnWithTypeAndName::to_string[abi:cxx11](unsigned long) const /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/core/column_with_type_and_name.cpp:70
    #8 0x5605b335d3f0 in doris::DeltaWriter::write(doris::vectorized::Block const*, std::vector<int, std::allocator<int> > const&) /mnt/disk/lihangyu/eldenmoon/doris/be/src/olap/delta_writer.cpp:206
    #9 0x5605af20262d in doris::Status doris::TabletsChannel::add_batch<doris::PTabletWriterAddBlockRequest, doris::PTabletWriterAddBlockResult>(doris::PTabletWriterAddBlockRequest const&, doris::PTabletWriterAddBlockResult*) /mnt/disk/lihangyu/eldenmoon/doris/be/src/runtime/tablets_channel.h:226
    #10 0x5605af1fe7e5 in doris::Status doris::LoadChannel::add_batch<doris::PTabletWriterAddBlockRequest, doris::PTabletWriterAddBlockResult>(doris::PTabletWriterAddBlockRequest const&, doris::PTabletWriterAddBlockResult*) /mnt/disk/lihangyu/eldenmoon/doris/be/src/runtime/load_channel.h:150
    #11 0x5605af1f8087 in doris::Status doris::LoadChannelMgr::add_batch<doris::PTabletWriterAddBlockRequest, doris::PTabletWriterAddBlockResult>(doris::PTabletWriterAddBlockRequest const&, doris::PTabletWriterAddBlockResult*) /mnt/disk/lihangyu/eldenmoon/doris/be/src/runtime/load_channel_mgr.h:137
    #12 0x5605af1dc0b8 in operator() /mnt/disk/lihangyu/eldenmoon/doris/be/src/service/internal_service.cpp:249
    #13 0x5605af1e814d in __invoke_impl<void, doris::PInternalServiceImpl::_tablet_writer_add_block(google::protobuf::RpcController*, const doris::PTabletWriterAddBlockRequest*, doris::PTabletWriterAddBlockResult*, google::protobuf::Closure*)::<lambda()>&> /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:61
    #14 0x5605af1e7c35 in __invoke_r<void, doris::PInternalServiceImpl::_tablet_writer_add_block(google::protobuf::RpcController*, const doris::PTabletWriterAddBlockRequest*, doris::PTabletWriterAddBlockResult*, google::protobuf::Closure*)::<lambda()>&> /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:111
    #15 0x5605af1e76b9 in _M_invoke /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/std_function.h:291
    #16 0x5605aed7ad27 in std::function<void ()>::operator()() const /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/std_function.h:560
    #17 0x5605aed75c44 in doris::PriorityThreadPool::work_thread(int) (/mnt/disk/lihangyu/eldenmoon/doris/test_env/be/lib/doris-be+0x6912c44)
    #18 0x5605aed9b051 in void std::__invoke_impl<void, void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>(std::__invoke_memfun_deref, void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:74
    #19 0x5605aed9acd1 in std::__invoke_result<void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>::type std::__invoke<void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>(void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:96
    #20 0x5605aed9ac06 in decltype (__invoke((*this)._M_pmf, (forward<doris::PriorityThreadPool*&>)({parm#1}), (forward<int&>)({parm#1}))) std::_Mem_fn_base<void (doris::PriorityThreadPool::*)(int), true>::operator()<doris::PriorityThreadPool*&, int&>(doris::PriorityThreadPool*&, int&) const /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/functional:131
    #21 0x5605aed9ab14 in void std::__invoke_impl<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>(std::__invoke_other, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:61
    #22 0x5605aed9a9dc in std::enable_if<is_invocable_r_v<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>, void>::type std::__invoke_r<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>(std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:111
    #23 0x5605aed9a7d6 in void std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>::__call<void, , 0ul, 1ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul>) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/functional:570
    #24 0x5605aed9a4a4 in void std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>::operator()<>() /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/functional:629
    #25 0x5605aed9a2cd in void std::__invoke_impl<void, std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>(std::__invoke_other, std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:61
    #26 0x5605aed9a21b in std::__invoke_result<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>::type std::__invoke<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>(std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:96
    #27 0x5605aed98fab in void std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> > >::_M_invoke<0ul>(std::_Index_tuple<0ul>) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/std_thread.h:253
    #28 0x5605aed960d9 in std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> > >::operator()() /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/std_thread.h:260
    #29 0x5605aed9579b in std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> > > >::_M_run() /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/std_thread.h:211

previously allocated by thread T411 here:
    #0 0x5605adcc6ee7 in operator new(unsigned long) (/mnt/disk/lihangyu/eldenmoon/doris/test_env/be/lib/doris-be+0x5863ee7)
    #1 0x5605b00689f0 in COW<doris::vectorized::IColumn>::mutable_ptr<doris::vectorized::ColumnArray> COWHelper<doris::vectorized::IColumn, doris::vectorized::ColumnArray>::create<COW<doris::vectorized::IColumn>::mutable_ptr<doris::vectorized::IColumn>, COW<doris::vectorized::IColumn>::mutable_ptr<doris::vectorized::IColumn> >(COW<doris::vectorized::IColumn>::mutable_ptr<doris::vectorized::IColumn>&&, COW<doris::vectorized::IColumn>::mutable_ptr<doris::vectorized::IColumn>&&) /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/common/cow.h:413
    #2 0x5605b005c733 in COW<doris::vectorized::IColumn>::mutable_ptr<doris::vectorized::ColumnArray> doris::vectorized::ColumnArray::create<COW<doris::vectorized::IColumn>::mutable_ptr<doris::vectorized::IColumn>, COW<doris::vectorized::IColumn>::mutable_ptr<doris::vectorized::IColumn>, void>(COW<doris::vectorized::IColumn>::mutable_ptr<doris::vectorized::IColumn>&&, COW<doris::vectorized::IColumn>::mutable_ptr<doris::vectorized::IColumn>&&) /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/columns/column_array.h:66
    #3 0x5605b005a09d in doris::vectorized::ColumnArray::create(COW<doris::vectorized::IColumn>::immutable_ptr<doris::vectorized::IColumn> const&, COW<doris::vectorized::IColumn>::immutable_ptr<doris::vectorized::IColumn> const&) /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/columns/column_array.h:55
    #4 0x5605b2ad8dc0 in doris::vectorized::ColumnArray::convert_to_full_column_if_const() const /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/columns/column_array.cpp:299
    #5 0x5605b00d5b87 in doris::vectorized::DataTypeArray::to_string[abi:cxx11](doris::vectorized::IColumn const&, unsigned long) const /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/data_types/data_type_array.cpp:115
    #6 0x5605b0101a1e in doris::vectorized::DataTypeNullable::to_string[abi:cxx11](doris::vectorized::IColumn const&, unsigned long) const /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/data_types/data_type_nullable.cpp:52
    #7 0x5605b00bc609 in doris::vectorized::ColumnWithTypeAndName::to_string[abi:cxx11](unsigned long) const /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/core/column_with_type_and_name.cpp:70
    #8 0x5605b335d3f0 in doris::DeltaWriter::write(doris::vectorized::Block const*, std::vector<int, std::allocator<int> > const&) /mnt/disk/lihangyu/eldenmoon/doris/be/src/olap/delta_writer.cpp:206
    #9 0x5605af20262d in doris::Status doris::TabletsChannel::add_batch<doris::PTabletWriterAddBlockRequest, doris::PTabletWriterAddBlockResult>(doris::PTabletWriterAddBlockRequest const&, doris::PTabletWriterAddBlockResult*) /mnt/disk/lihangyu/eldenmoon/doris/be/src/runtime/tablets_channel.h:226
    #10 0x5605af1fe7e5 in doris::Status doris::LoadChannel::add_batch<doris::PTabletWriterAddBlockRequest, doris::PTabletWriterAddBlockResult>(doris::PTabletWriterAddBlockRequest const&, doris::PTabletWriterAddBlockResult*) /mnt/disk/lihangyu/eldenmoon/doris/be/src/runtime/load_channel.h:150
    #11 0x5605af1f8087 in doris::Status doris::LoadChannelMgr::add_batch<doris::PTabletWriterAddBlockRequest, doris::PTabletWriterAddBlockResult>(doris::PTabletWriterAddBlockRequest const&, doris::PTabletWriterAddBlockResult*) /mnt/disk/lihangyu/eldenmoon/doris/be/src/runtime/load_channel_mgr.h:137
    #12 0x5605af1dc0b8 in operator() /mnt/disk/lihangyu/eldenmoon/doris/be/src/service/internal_service.cpp:249
    #13 0x5605af1e814d in __invoke_impl<void, doris::PInternalServiceImpl::_tablet_writer_add_block(google::protobuf::RpcController*, const doris::PTabletWriterAddBlockRequest*, doris::PTabletWriterAddBlockResult*, google::protobuf::Closure*)::<lambda()>&> /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:61
    #14 0x5605af1e7c35 in __invoke_r<void, doris::PInternalServiceImpl::_tablet_writer_add_block(google::protobuf::RpcController*, const doris::PTabletWriterAddBlockRequest*, doris::PTabletWriterAddBlockResult*, google::protobuf::Closure*)::<lambda()>&> /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:111
    #15 0x5605af1e76b9 in _M_invoke /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/std_function.h:291
    #16 0x5605aed7ad27 in std::function<void ()>::operator()() const /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/std_function.h:560
    #17 0x5605aed75c44 in doris::PriorityThreadPool::work_thread(int) (/mnt/disk/lihangyu/eldenmoon/doris/test_env/be/lib/doris-be+0x6912c44)
    #18 0x5605aed9b051 in void std::__invoke_impl<void, void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>(std::__invoke_memfun_deref, void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:74
    #19 0x5605aed9acd1 in std::__invoke_result<void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>::type std::__invoke<void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>(void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:96
    #20 0x5605aed9ac06 in decltype (__invoke((*this)._M_pmf, (forward<doris::PriorityThreadPool*&>)({parm#1}), (forward<int&>)({parm#1}))) std::_Mem_fn_base<void (doris::PriorityThreadPool::*)(int), true>::operator()<doris::PriorityThreadPool*&, int&>(doris::PriorityThreadPool*&, int&) const /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/functional:131
    #21 0x5605aed9ab14 in void std::__invoke_impl<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>(std::__invoke_other, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:61
    #22 0x5605aed9a9dc in std::enable_if<is_invocable_r_v<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>, void>::type std::__invoke_r<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>(std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:111
    #23 0x5605aed9a7d6 in void std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>::__call<void, , 0ul, 1ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul>) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/functional:570
    #24 0x5605aed9a4a4 in void std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>::operator()<>() /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/functional:629
    #25 0x5605aed9a2cd in void std::__invoke_impl<void, std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>(std::__invoke_other, std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:61
    #26 0x5605aed9a21b in std::__invoke_result<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>::type std::__invoke<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>(std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&&) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/invoke.h:96
    #27 0x5605aed98fab in void std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> > >::_M_invoke<0ul>(std::_Index_tuple<0ul>) /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/std_thread.h:253
    #28 0x5605aed960d9 in std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> > >::operator()() /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/std_thread.h:260
    #29 0x5605aed9579b in std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> > > >::_M_run() /mnt/disk/lihangyu/ldb_toolchain/include/c++/11/bits/std_thread.h:211

Thread T411 created by T0 here:
    #0 0x5605adc69841 in __interceptor_pthread_create (/mnt/disk/lihangyu/eldenmoon/doris/test_env/be/lib/doris-be+0x5806841)
    #1 0x5605b6eadd35 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/mnt/disk/lihangyu/eldenmoon/doris/test_env/be/lib/doris-be+0xea4ad35)
    #2 0x5605aed7ebf7 in std::_MakeUniq<std::thread>::__single_object std::make_unique<std::thread, std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&>(std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&) (/mnt/disk/lihangyu/eldenmoon/doris/test_env/be/lib/doris-be+0x691bbf7)
    #3 0x5605aed79940 in std::thread* doris::ThreadGroup::create_thread<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)> >(std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>) (/mnt/disk/lihangyu/eldenmoon/doris/test_env/be/lib/doris-be+0x6916940)
    #4 0x5605aed751ab in doris::PriorityThreadPool::PriorityThreadPool(unsigned int, unsigned int) (/mnt/disk/lihangyu/eldenmoon/doris/test_env/be/lib/doris-be+0x69121ab)
    #5 0x5605af1d89a1 in doris::PInternalServiceImpl::PInternalServiceImpl(doris::ExecEnv*) /mnt/disk/lihangyu/eldenmoon/doris/be/src/service/internal_service.cpp:75
    #6 0x5605af1c34ea in doris::BRpcService::start(int) /mnt/disk/lihangyu/eldenmoon/doris/be/src/service/brpc_service.cpp:45
    #7 0x5605add104f0 in main /mnt/disk/lihangyu/eldenmoon/doris/be/src/service/doris_main.cpp:422
    #8 0x7fb824819554 in __libc_start_main (/lib64/libc.so.6+0x22554)

SUMMARY: AddressSanitizer: heap-use-after-free /mnt/disk/lihangyu/eldenmoon/doris/be/src/vec/common/cow.h:206 in COW<doris::vectorized::IColumn>::intrusive_ptr<doris::vectorized::IColumn const>::operator*() const &
Shadow bytes around the buggy address:
  0x0c06800d80f0: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
  0x0c06800d8100: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
  0x0c06800d8110: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa
  0x0c06800d8120: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
  0x0c06800d8130: fa fa 00 00 00 fa fa fa 00 00 00 07 fa fa fd fd
=>0x0c06800d8140: fd[fd]fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c06800d8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c06800d8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c06800d8170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c06800d8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c06800d8190: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):

What You Expected?

no core

How to Reproduce?

compile in asan

create table test_array_string (k1 INT, k2 INT, k3 array<text>) ENGINE=olap DUPLICATE KEY(k1, k2) PARTITION BY RANGE (k1) (partition `p1` values less than ("1000"), partition `p2` values less than ("2000"),partition `p3` values less than ("3000"))  DISTRIBUTED BY HASH(k2) BUCKETS 3 PROPERTIES("replication_num" = "1");
set enable_vectorized_engine=true;
insert into test_array_string  values(1, 2, ["c", "b", "c"]);

Anything Else?

No response

Are you willing to submit PR?

  • Yes I am willing to submit a PR!

Code of Conduct
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
1 participant
@eldenmoon