[fix](binlog) Keep allocated LSN map alive during group flush cleanup - #67384
[fix](binlog) Keep allocated LSN map alive during group flush cleanup#67384foxtail463 wants to merge 1 commit into
Conversation
|
Thank you for your contribution to Apache Doris. Please clearly describe your PR:
|
|
run buildall |
|
==306468==ERROR: AddressSanitizer: heap-use-after-free #2 doris::RowsetWriterContext::remove_segment_allocated_lsns(long) freed by thread T3835 here: #3 std::__shared_ptrdoris::RowsetWriter::~__shared_ptr() SUMMARY: AddressSanitizer: heap-use-after-free |
|
run buildall |
TPC-H: Total hot run time: 16876 ms |
TPC-DS: Total hot run time: 82104 ms |
ClickBench: Total hot run time: 14.78 s |
BE Regression && UT Coverage ReportIncrement line coverage Increment coverage report
|
Problem Summary:
Group memtable flush stores a raw RowsetWriterContext* in SharedMemtable only to remove the segment’s allocated LSNs during teardown. A queued group flush task can retain SharedMemtable after FlushToken has released its GroupRowsetWriter and context, causing the later cleanup to dereference a freed context and crash the BE under ASan.
Solution:
Make SharedMemtable own the specific resource required for cleanup—the shared allocated-LSN map—rather than borrow the enclosing writer context. Capture the map only when the group writer requires allocated LSNs and assert that the map exists under that invariant. Both insertion during memtable conversion and removal during SharedMemtable teardown now operate directly on the retained map, so delayed task destruction remains safe after writer-context teardown.