You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@doris.apache.org by GitBox <gi...@apache.org> on 2022/05/12 10:34:09 UTC
[GitHub] [incubator-doris] jacktengg opened a new issue, #9525: [Bug] heap-use-after-free error when insert data into table with bitmap column
jacktengg opened a new issue, #9525:
URL: https://github.com/apache/incubator-doris/issues/9525
### Search before asking
- [X] I had searched in the [issues](https://github.com/apache/incubator-doris/issues?q=is%3Aissue) and found no similar issues.
### Version
master-74352c807
### What's Wrong?
BE is build with ASAN.
Insert into table with bitmap column failed:
```
mysql> show create table bitmap_basic_agg
-> ;
+------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Table | Create Table |
+------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| bitmap_basic_agg | CREATE TABLE `bitmap_basic_agg` (
`k1` int(11) NULL COMMENT "",
`k2` bitmap BITMAP_UNION NULL COMMENT ""
) ENGINE=OLAP
AGGREGATE KEY(`k1`)
COMMENT "OLAP"
DISTRIBUTED BY HASH(`k1`) BUCKETS 1
PROPERTIES (
"replication_allocation" = "tag.location.default: 1",
"in_memory" = "false",
"storage_format" = "V2"
) |
+------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)
insert into bitmap_basic_agg values (1,bitmap_empty()), (2,bitmap_hash(0)),(2,bitmap_hash(0)), (3,bitmap_hash(0)),(3,bitmap_hash(1));
```
be error:
```
=================================================================
==782849==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300074c420 at pc 0x56510f61a4f0 bp 0x7f48079d89a0 sp 0x7f48079d8990
READ of size 1 at 0x60300074c420 thread T94 (MemTableFlushTh)
#0 0x56510f61a4ef in doris::faststring::append(void const*, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/util/faststring.h:120
#1 0x56510f61b0d2 in doris::segment_v2::BinaryPlainPageBuilder::add(unsigned char const*, unsigned long*) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/segment_v2/binary_plain_page.h:69
#2 0x565111ac46af in doris::segment_v2::ScalarColumnWriter::append_data_in_current_page(unsigned char const**, unsigned long*) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/segment_v2/column_writer.cpp:341
#3 0x565111ac41e6 in doris::segment_v2::ScalarColumnWriter::append_data(unsigned char const**, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/segment_v2/column_writer.cpp:329
#4 0x565111ac114e in doris::segment_v2::ColumnWriter::append_nullable(unsigned char const*, unsigned char const**, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/segment_v2/column_writer.cpp:219
#5 0x565111ac14b5 in doris::segment_v2::ColumnWriter::append(unsigned char const*, void const*, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/segment_v2/column_writer.cpp:231
#6 0x5651119750fc in doris::segment_v2::SegmentWriter::append_block(doris::vectorized::Block const*, unsigned long, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/segment_v2/segment_writer.cpp:140
#7 0x56510f7a50b3 in doris::BetaRowsetWriter::add_block(doris::vectorized::Block const*) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/beta_rowset_writer.cpp:123
#8 0x56510f5a4d7c in doris::MemTable::_do_flush(long&) /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable.cpp:305
#9 0x56510f5a3c77 in doris::MemTable::flush() /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable.cpp:277
#10 0x56510f23d677 in doris::FlushToken::_flush_memtable(std::shared_ptr<doris::MemTable>, long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable_flush_executor.cpp:74
#11 0x56510f243e25 in void std::__invoke_impl<void, void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>(std::__invoke_memfun_deref, void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf6e25)
#12 0x56510f243a44 in std::__invoke_result<void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>::type std::__invoke<void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>(void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf6a44)
#13 0x56510f24374f in void std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>::__call<void, , 0ul, 1ul, 2ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul, 2ul>) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf674f)
#14 0x56510f243430 in void std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>::operator()<, void>() /var/local/ldb-toolchain/include/c++/11/functional:503
#15 0x56510f242e69 in void std::__invoke_impl<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>(std::__invoke_other, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
#16 0x56510f2428e7 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>, void>::type std::__invoke_r<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>(std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
#17 0x56510f2423a4 in std::_Function_handler<void (), std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)> >::_M_invoke(std::_Any_data const&) /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:291
#18 0x56510f943aaf in std::function<void ()>::operator()() const /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:560
#19 0x56510ffd0e17 in doris::FunctionRunnable::run() /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:45
#20 0x56510ffcc0c4 in doris::ThreadPool::dispatch_thread() /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:540
#21 0x56510ffec945 in void std::__invoke_impl<void, void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(std::__invoke_memfun_deref, void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:74
#22 0x56510ffec1e4 in std::__invoke_result<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>::type std::__invoke<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:96
#23 0x56510ffeb583 in void std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>::__call<void, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /var/local/ldb-toolchain/include/c++/11/functional:420
#24 0x56510ffea086 in void std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>::operator()<, void>() /var/local/ldb-toolchain/include/c++/11/functional:503
#25 0x56510ffe6bed in void std::__invoke_impl<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>(std::__invoke_other, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
#26 0x56510ffe4511 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>, void>::type std::__invoke_r<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>(std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
#27 0x56510ffdf862 in std::_Function_handler<void (), std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()> >::_M_invoke(std::_Any_data const&) /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:291
#28 0x56510f943aaf in std::function<void ()>::operator()() const /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:560
#29 0x56510ffb0e1d in doris::Thread::supervise_thread(void*) /mnt/ssd01/tjp/incubator-doris/be/src/util/thread.cpp:408
#30 0x7f481fe72608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477
#31 0x7f481ffac162 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f162)
0x60300074c420 is located 16 bytes inside of 32-byte region [0x60300074c410,0x60300074c430)
freed by thread T94 (MemTableFlushTh) here:
#0 0x56510e9b7868 in realloc (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x536a868)
#1 0x56510ee8b913 in Allocator<false, false>::realloc(void*, unsigned long, unsigned long, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/allocator.h:125
#2 0x56510ee814bb in void doris::vectorized::PODArrayBase<1ul, 4096ul, Allocator<false, false>, 15ul, 16ul>::realloc<>(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/pod_array.h:147
#3 0x56510ee768ee in void doris::vectorized::PODArrayBase<1ul, 4096ul, Allocator<false, false>, 15ul, 16ul>::reserve<>(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/pod_array.h:213
#4 0x56510ee682da in void doris::vectorized::PODArrayBase<1ul, 4096ul, Allocator<false, false>, 15ul, 16ul>::resize<>(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/pod_array.h:219
#5 0x565114c415ef in doris::vectorized::OlapBlockDataConvertor::OlapColumnDataConvertorBitMap::convert_to_olap() /mnt/ssd01/tjp/incubator-doris/be/src/vec/olap/olap_data_convertor.cpp:208
#6 0x565114c409f7 in doris::vectorized::OlapBlockDataConvertor::convert_column_data(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/olap/olap_data_convertor.cpp:131
#7 0x565111974e43 in doris::segment_v2::SegmentWriter::append_block(doris::vectorized::Block const*, unsigned long, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/segment_v2/segment_writer.cpp:133
#8 0x56510f7a50b3 in doris::BetaRowsetWriter::add_block(doris::vectorized::Block const*) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/beta_rowset_writer.cpp:123
#9 0x56510f5a4d7c in doris::MemTable::_do_flush(long&) /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable.cpp:305
#10 0x56510f5a3c77 in doris::MemTable::flush() /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable.cpp:277
#11 0x56510f23d677 in doris::FlushToken::_flush_memtable(std::shared_ptr<doris::MemTable>, long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable_flush_executor.cpp:74
#12 0x56510f243e25 in void std::__invoke_impl<void, void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>(std::__invoke_memfun_deref, void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf6e25)
#13 0x56510f243a44 in std::__invoke_result<void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>::type std::__invoke<void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>(void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf6a44)
#14 0x56510f24374f in void std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>::__call<void, , 0ul, 1ul, 2ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul, 2ul>) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf674f)
#15 0x56510f243430 in void std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>::operator()<, void>() /var/local/ldb-toolchain/include/c++/11/functional:503
#16 0x56510f242e69 in void std::__invoke_impl<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>(std::__invoke_other, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
#17 0x56510f2428e7 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>, void>::type std::__invoke_r<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>(std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
#18 0x56510f2423a4 in std::_Function_handler<void (), std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)> >::_M_invoke(std::_Any_data const&) /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:291
#19 0x56510f943aaf in std::function<void ()>::operator()() const /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:560
#20 0x56510ffd0e17 in doris::FunctionRunnable::run() /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:45
#21 0x56510ffcc0c4 in doris::ThreadPool::dispatch_thread() /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:540
#22 0x56510ffec945 in void std::__invoke_impl<void, void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(std::__invoke_memfun_deref, void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:74
#23 0x56510ffec1e4 in std::__invoke_result<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>::type std::__invoke<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:96
#24 0x56510ffeb583 in void std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>::__call<void, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /var/local/ldb-toolchain/include/c++/11/functional:420
#25 0x56510ffea086 in void std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>::operator()<, void>() /var/local/ldb-toolchain/include/c++/11/functional:503
#26 0x56510ffe6bed in void std::__invoke_impl<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>(std::__invoke_other, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
#27 0x56510ffe4511 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>, void>::type std::__invoke_r<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>(std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
#28 0x56510ffdf862 in std::_Function_handler<void (), std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()> >::_M_invoke(std::_Any_data const&) /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:291
#29 0x56510f943aaf in std::function<void ()>::operator()() const /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:560
previously allocated by thread T94 (MemTableFlushTh) here:
#0 0x56510e9b74b7 in __interceptor_malloc (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x536a4b7)
#1 0x56510ee77745 in Allocator<false, false>::alloc_no_track(unsigned long, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/allocator.h:223
#2 0x56510ee68520 in Allocator<false, false>::alloc(unsigned long, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/allocator.h:104
#3 0x56510ee80e69 in void doris::vectorized::PODArrayBase<1ul, 4096ul, Allocator<false, false>, 15ul, 16ul>::alloc<>(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/pod_array.h:120
#4 0x56510ee813f4 in void doris::vectorized::PODArrayBase<1ul, 4096ul, Allocator<false, false>, 15ul, 16ul>::realloc<>(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/pod_array.h:139
#5 0x56510ee768ee in void doris::vectorized::PODArrayBase<1ul, 4096ul, Allocator<false, false>, 15ul, 16ul>::reserve<>(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/pod_array.h:213
#6 0x56510ee682da in void doris::vectorized::PODArrayBase<1ul, 4096ul, Allocator<false, false>, 15ul, 16ul>::resize<>(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/common/pod_array.h:219
#7 0x565114c415ef in doris::vectorized::OlapBlockDataConvertor::OlapColumnDataConvertorBitMap::convert_to_olap() /mnt/ssd01/tjp/incubator-doris/be/src/vec/olap/olap_data_convertor.cpp:208
#8 0x565114c409f7 in doris::vectorized::OlapBlockDataConvertor::convert_column_data(unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/vec/olap/olap_data_convertor.cpp:131
#9 0x565111974e43 in doris::segment_v2::SegmentWriter::append_block(doris::vectorized::Block const*, unsigned long, unsigned long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/segment_v2/segment_writer.cpp:133
#10 0x56510f7a50b3 in doris::BetaRowsetWriter::add_block(doris::vectorized::Block const*) /mnt/ssd01/tjp/incubator-doris/be/src/olap/rowset/beta_rowset_writer.cpp:123
#11 0x56510f5a4d7c in doris::MemTable::_do_flush(long&) /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable.cpp:305
#12 0x56510f5a3c77 in doris::MemTable::flush() /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable.cpp:277
#13 0x56510f23d677 in doris::FlushToken::_flush_memtable(std::shared_ptr<doris::MemTable>, long) /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable_flush_executor.cpp:74
#14 0x56510f243e25 in void std::__invoke_impl<void, void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>(std::__invoke_memfun_deref, void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf6e25)
#15 0x56510f243a44 in std::__invoke_result<void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>::type std::__invoke<void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&>(void (doris::FlushToken::*&)(std::shared_ptr<doris::MemTable>, long), doris::FlushToken*&, std::shared_ptr<doris::MemTable>&, long&) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf6a44)
#16 0x56510f24374f in void std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>::__call<void, , 0ul, 1ul, 2ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul, 2ul>) (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x5bf674f)
#17 0x56510f243430 in void std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>::operator()<, void>() /var/local/ldb-toolchain/include/c++/11/functional:503
#18 0x56510f242e69 in void std::__invoke_impl<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>(std::__invoke_other, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
#19 0x56510f2428e7 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>, void>::type std::__invoke_r<void, std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&>(std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
#20 0x56510f2423a4 in std::_Function_handler<void (), std::_Bind<void (doris::FlushToken::*(doris::FlushToken*, std::shared_ptr<doris::MemTable>, long))(std::shared_ptr<doris::MemTable>, long)> >::_M_invoke(std::_Any_data const&) /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:291
#21 0x56510f943aaf in std::function<void ()>::operator()() const /var/local/ldb-toolchain/include/c++/11/bits/std_function.h:560
#22 0x56510ffd0e17 in doris::FunctionRunnable::run() /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:45
#23 0x56510ffcc0c4 in doris::ThreadPool::dispatch_thread() /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:540
#24 0x56510ffec945 in void std::__invoke_impl<void, void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(std::__invoke_memfun_deref, void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:74
#25 0x56510ffec1e4 in std::__invoke_result<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>::type std::__invoke<void (doris::ThreadPool::*&)(), doris::ThreadPool*&>(void (doris::ThreadPool::*&)(), doris::ThreadPool*&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:96
#26 0x56510ffeb583 in void std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>::__call<void, , 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /var/local/ldb-toolchain/include/c++/11/functional:420
#27 0x56510ffea086 in void std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>::operator()<, void>() /var/local/ldb-toolchain/include/c++/11/functional:503
#28 0x56510ffe6bed in void std::__invoke_impl<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>(std::__invoke_other, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:61
#29 0x56510ffe4511 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>, void>::type std::__invoke_r<void, std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&>(std::_Bind<void (doris::ThreadPool::*(doris::ThreadPool*))()>&) /var/local/ldb-toolchain/include/c++/11/bits/invoke.h:111
Thread T94 (MemTableFlushTh) created by T0 here:
#0 0x56510e95b751 in __interceptor_pthread_create (/mnt/ssd01/tjp/regression_test/be/lib/palo_be+0x530e751)
#1 0x56510ffb01e1 in doris::Thread::start_thread(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::function<void ()> const&, unsigned long, scoped_refptr<doris::Thread>*) /mnt/ssd01/tjp/incubator-doris/be/src/util/thread.cpp:362
#2 0x56510ffd52f9 in doris::Status doris::Thread::create<void (doris::ThreadPool::*)(), doris::ThreadPool*>(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, void (doris::ThreadPool::* const&)(), doris::ThreadPool* const&, scoped_refptr<doris::Thread>*) /mnt/ssd01/tjp/incubator-doris/be/src/util/thread.h:54
#3 0x56510ffcd8e4 in doris::ThreadPool::create_thread() /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:603
#4 0x56510ffc707e in doris::ThreadPool::init() /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:266
#5 0x56510ffc3938 in doris::ThreadPoolBuilder::build(std::unique_ptr<doris::ThreadPool, std::default_delete<doris::ThreadPool> >*) const /mnt/ssd01/tjp/incubator-doris/be/src/util/threadpool.cpp:77
#6 0x56510f23dff2 in doris::MemTableFlushExecutor::init(std::vector<doris::DataDir*, std::allocator<doris::DataDir*> > const&) /mnt/ssd01/tjp/incubator-doris/be/src/olap/memtable_flush_executor.cpp:100
#7 0x56510ef65a6c in doris::StorageEngine::_open() /mnt/ssd01/tjp/incubator-doris/be/src/olap/storage_engine.cpp:205
#8 0x56510ef61598 in doris::StorageEngine::open(doris::EngineOptions const&, doris::StorageEngine**) /mnt/ssd01/tjp/incubator-doris/be/src/olap/storage_engine.cpp:108
#9 0x56510ea01a8c in main /mnt/ssd01/tjp/incubator-doris/be/src/service/doris_main.cpp:389
#10 0x7f481feb10b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)
SUMMARY: AddressSanitizer: heap-use-after-free /mnt/ssd01/tjp/incubator-doris/be/src/util/faststring.h:120 in doris::faststring::append(void const*, unsigned long)
Shadow bytes around the buggy address:
0x0c06800e1830: 00 fa fa fa 00 00 00 00 fa fa fd fd fd fd fa fa
0x0c06800e1840: 00 00 00 fa fa fa fd fd fd fa fa fa 00 00 00 fa
0x0c06800e1850: fa fa fd fd fd fd fa fa fd fd fd fd fa fa 00 00
0x0c06800e1860: 00 fa fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
0x0c06800e1870: 00 00 00 fa fa fa 00 00 00 00 fa fa 00 00 00 fa
=>0x0c06800e1880: fa fa fd fd[fd]fd fa fa 00 00 06 fa fa fa fa fa
0x0c06800e1890: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c06800e18a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c06800e18b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c06800e18c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c06800e18d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==782849==ABORTING
```
### What You Expected?
Insert should be OK.
### How to Reproduce?
_No response_
### Anything Else?
_No response_
### Are you willing to submit PR?
- [X] Yes I am willing to submit a PR!
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org
[GitHub] [incubator-doris] yiguolei closed issue #9525: [Bug] heap-use-after-free error when insert data into table with bitmap column
Posted by GitBox <gi...@apache.org>.
yiguolei closed issue #9525: [Bug] heap-use-after-free error when insert data into table with bitmap column
URL: https://github.com/apache/incubator-doris/issues/9525
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org