You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@doris.apache.org by yi...@apache.org on 2026/02/12 16:00:22 UTC
(doris) branch branch-4.0 updated: branch-4.0: [fix](cloud) Fix CloudRowsetWriter vtable use-after-free in delete bitmap task #60528 (#60708)
This is an automated email from the ASF dual-hosted git repository.
yiguolei pushed a commit to branch branch-4.0
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/branch-4.0 by this push:
new 64975c0e1ad branch-4.0: [fix](cloud) Fix CloudRowsetWriter vtable use-after-free in delete bitmap task #60528 (#60708)
64975c0e1ad is described below
commit 64975c0e1ad167fada9379a7e18248a52e641940
Author: github-actions[bot] <41...@users.noreply.github.com>
AuthorDate: Fri Feb 13 00:00:14 2026 +0800
branch-4.0: [fix](cloud) Fix CloudRowsetWriter vtable use-after-free in delete bitmap task #60528 (#60708)
Cherry-picked from #60528
Co-authored-by: Xin Liao <li...@selectdb.com>
---
be/src/cloud/cloud_rowset_writer.cpp | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/be/src/cloud/cloud_rowset_writer.cpp b/be/src/cloud/cloud_rowset_writer.cpp
index d4a9fbce7e2..0c1b79392e9 100644
--- a/be/src/cloud/cloud_rowset_writer.cpp
+++ b/be/src/cloud/cloud_rowset_writer.cpp
@@ -26,7 +26,16 @@ namespace doris {
CloudRowsetWriter::CloudRowsetWriter(CloudStorageEngine& engine) : _engine(engine) {}
-CloudRowsetWriter::~CloudRowsetWriter() = default;
+CloudRowsetWriter::~CloudRowsetWriter() {
+ // Must cancel any pending delete bitmap tasks before destruction.
+ // Otherwise, the lambda in _generate_delete_bitmap may execute after the
+ // CloudRowsetWriter destructor runs but before BaseBetaRowsetWriter destructor,
+ // causing virtual function calls to resolve to BaseBetaRowsetWriter::_build_rowset_meta
+ // instead of CloudRowsetWriter::_build_rowset_meta (use-after-free on vtable).
+ if (_calc_delete_bitmap_token != nullptr) {
+ _calc_delete_bitmap_token->cancel();
+ }
+}
Status CloudRowsetWriter::init(const RowsetWriterContext& rowset_writer_context) {
_context = rowset_writer_context;
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org