You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@doris.apache.org by GitBox <gi...@apache.org> on 2020/06/18 02:35:30 UTC
[GitHub] [incubator-doris] vagetablechicken edited a comment on pull request #3899: [Bug] fix mem_tracker use-after-free & add UT for it
vagetablechicken edited a comment on pull request #3899:
URL: https://github.com/apache/incubator-doris/pull/3899#issuecomment-645732574
The detected error:
```
==11791==ERROR: AddressSanitizer: heap-use-after-free on address 0x61400000d4d0 at pc 0x00000173f25c bp 0x7ffc769fb940 sp 0x7ffc769fb938
READ of size 8 at 0x61400000d4d0 thread T0
I0618 02:30:07.237269 11803 socket.cpp:2260] Checking Socket{id=17179869185 addr=127.0.0.1:4357} (0x631000014a00)
#0 0x173f25b in doris::MemTracker::release(long) /root/git/incubator-doris/be/src/runtime/mem_tracker.h:222
#1 0x173770f in doris::MemPool::free_all() /root/git/incubator-doris/be/src/runtime/mem_pool.cpp:78
#2 0x177cfe4 in doris::RowBatch::clear() /root/git/incubator-doris/be/src/runtime/row_batch.cpp:276
#3 0x177d8c5 in doris::RowBatch::~RowBatch() /root/git/incubator-doris/be/src/runtime/row_batch.cpp:301
#4 0x177d9de in doris::RowBatch::~RowBatch() /root/git/incubator-doris/be/src/runtime/row_batch.cpp:302
#5 0x1365cea in std::default_delete<doris::RowBatch>::operator()(doris::RowBatch*) const /usr/include/c++/7.3.0/bits/unique_ptr.h:78
#6 0x1356cd4 in std::unique_ptr<doris::RowBatch, std::default_delete<doris::RowBatch> >::~unique_ptr() /usr/include/c++/7.3.0/bits/unique_ptr.h:268
#7 0x1325425 in doris::stream_load::NodeChannel::~NodeChannel() /root/git/incubator-doris/be/src/exec/tablet_sink.cpp:41
#8 0x1391887 in doris::ObjectPool::SpecificElement<doris::stream_load::NodeChannel>::~SpecificElement() (/root/git/incubator-doris/be/ut_build/test/exec/tablet_sink_test+0x1391887)
#9 0x13918e0 in doris::ObjectPool::SpecificElement<doris::stream_load::NodeChannel>::~SpecificElement() (/root/git/incubator-doris/be/ut_build/test/exec/tablet_sink_test+0x13918e0)
#10 0x12af245 in doris::ObjectPool::clear() /root/git/incubator-doris/be/src/common/object_pool.h:54
#11 0x12aefb8 in doris::ObjectPool::~ObjectPool() /root/git/incubator-doris/be/src/common/object_pool.h:37
#12 0x12a1c9d in doris::stream_load::OlapTableSinkTest_add_batch_failed_Test::TestBody() /root/git/incubator-doris/be/test/exec/tablet_sink_test.cpp:790
#13 0x368e3ae in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) (/root/git/incubator-doris/be/ut_build/test/exec/tablet_sink_test+0x368e3ae
)
#14 0x36897ed in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) (/root/git/incubator-doris/be/ut_build/test/exec/tablet_sink_test+0x36897ed)
#15 0x366f64f in testing::Test::Run() (/root/git/incubator-doris/be/ut_build/test/exec/tablet_sink_test+0x366f64f)
#16 0x366fed1 in testing::TestInfo::Run() (/root/git/incubator-doris/be/ut_build/test/exec/tablet_sink_test+0x366fed1)
#17 0x3670528 in testing::TestCase::Run() (/root/git/incubator-doris/be/ut_build/test/exec/tablet_sink_test+0x3670528)
#18 0x367709c in testing::internal::UnitTestImpl::RunAllTests() (/root/git/incubator-doris/be/ut_build/test/exec/tablet_sink_test+0x367709c)
#19 0x368f24e in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) (/root/git/incubator-
doris/be/ut_build/test/exec/tablet_sink_test+0x368f24e)
#20 0x368a3e5 in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) (/root/git/incubator-dor
is/be/ut_build/test/exec/tablet_sink_test+0x368a3e5)
#21 0x3675d73 in testing::UnitTest::Run() (/root/git/incubator-doris/be/ut_build/test/exec/tablet_sink_test+0x3675d73)
#22 0x12b997e in RUN_ALL_TESTS() (/root/git/incubator-doris/be/ut_build/test/exec/tablet_sink_test+0x12b997e)
#23 0x12aa24d in main /root/git/incubator-doris/be/test/exec/tablet_sink_test.cpp:983
#24 0x7fca8a9e1504 in __libc_start_main (/lib64/libc.so.6+0x22504)
#25 0x118adce (/root/git/incubator-doris/be/ut_build/test/exec/tablet_sink_test+0x118adce)
```
The root cause is, RowBatch in NodeChannel use the deleted tracker parent(state->instance_mem_tracker()).
So unregister OlapTableSink tracker from parent can solove it. But MemTracker::unregister_from_parent() won't delete the parent ref in MemTracker. Need fix too.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org