Uh oh!
There was an error while loading. Please reload this page.
[fix](binlog) Keep allocated LSN map alive during group flush cleanup - #67384
[fix](binlog) Keep allocated LSN map alive during group flush cleanup#67384foxtail463 wants to merge 1 commit into
Conversation
hello-stephen
commented
Sep 1, 2026
Thank you for your contribution to Apache Doris. Please clearly describe your PR:
|
foxtail463
commented
Sep 1, 2026
run buildall |
foxtail463
commented
Sep 1, 2026
==306468==ERROR: AddressSanitizer: heap-use-after-free #2 doris::RowsetWriterContext::remove_segment_allocated_lsns(long) freed by thread T3835 here: #3 std::__shared_ptrdoris::RowsetWriter::~__shared_ptr() SUMMARY: AddressSanitizer: heap-use-after-free |
foxtail463
commented
Sep 1, 2026
run buildall |
hello-stephen
commented
Sep 1, 2026
TPC-H: Total hot run time: 16876 ms |
hello-stephen
commented
Sep 1, 2026
TPC-DS: Total hot run time: 82104 ms |
hello-stephen
commented
Sep 1, 2026
ClickBench: Total hot run time: 14.78 s |
hello-stephen
commented
Sep 1, 2026
BE Regression && UT Coverage ReportIncrement line coverage Increment coverage report
|
Problem Summary:
Group memtable flush stores a raw RowsetWriterContext* in SharedMemtable only to remove the segment’s allocated LSNs during teardown. A queued group flush task can retain SharedMemtable after FlushToken has released its GroupRowsetWriter and context, causing the later cleanup to dereference a freed context and crash the BE under ASan.
Solution:
Make SharedMemtable own the specific resource required for cleanup—the shared allocated-LSN map—rather than borrow the enclosing writer context. Capture the map only when the group writer requires allocated LSNs and assert that the map exists under that invariant. Both insertion during memtable conversion and removal during SharedMemtable teardown now operate directly on the retained map, so delayed task destruction remains safe after writer-context teardown.