Skip to content

Use after free in HedgedConnections::sendScalarsData #26815

@tavplubix

Description

@tavplubix

test_distributed_queries_stress: https://clickhouse-test-reports.s3.yandex.net/26129/2929cf3ba82b6b2cbff372884c72f067eb789282/integration_tests_(thread).html#fail1

==================
WARNING: ThreadSanitizer: heap-use-after-free (pid=7)
  Read of size 8 at 0x7b5c00700188 by thread T373 (mutexes: write M105970260681111776):
    #0 std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, DB::Block, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const, DB::Block> > >::empty() const obj-x86_64-linux-gnu/../contrib/libcxx/include/map:1125:55 (clickhouse+0x150ce28e)
    #1 DB::Connection::sendScalarsData(std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, DB::Block, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const, DB::Block> > >&) obj-x86_64-linux-gnu/../src/Client/Connection.cpp:583:14 (clickhouse+0x150ce28e)
    #2 DB::HedgedConnections::sendScalarsData(std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, DB::Block, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const, DB::Block> > >&)::$_1::operator()(DB::HedgedConnections::ReplicaState&) const obj-x86_64-linux-gnu/../src/Client/HedgedConnections.cpp:80:84 (clickhouse+0x150ef2d3)
    #3 decltype(std::__1::forward<DB::HedgedConnections::sendScalarsData(std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, DB::Block, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const, DB::Block> > >&)::$_1&>(fp)(std::__1::forward<DB::HedgedConnections::ReplicaState&>(fp0))) std::__1::__invoke<DB::HedgedConnections::sendScalarsData(std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, DB::Block, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const, DB::Block> > >&)::$_1&, DB::HedgedConnections::ReplicaState&>(DB::HedgedConnections::sendScalarsData(std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, DB::Block, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const, DB::Block> > >&)::$_1&, DB::HedgedConnections::ReplicaState&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1 (clickhouse+0x150ef2d3)
    #4 void std::__1::__invoke_void_return_wrapper<void>::__call<DB::HedgedConnections::sendScalarsData(std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, DB::Block, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const, DB::Block> > >&)::$_1&, DB::HedgedConnections::ReplicaState&>(DB::HedgedConnections::sendScalarsData(std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, DB::Block, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const, DB::Block> > >&)::$_1&, DB::HedgedConnections::ReplicaState&) obj-x86_64-linux-gnu/../contrib/libcxx/include/__functional_base:348:9 (clickhouse+0x150ef2d3)
    #5 std::__1::__function::__default_alloc_func<DB::HedgedConnections::sendScalarsData(std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, DB::Block, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const, DB::Block> > >&)::$_1, void (DB::HedgedConnections::ReplicaState&)>::operator()(DB::HedgedConnections::ReplicaState&) obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:1608:12 (clickhouse+0x150ef2d3)
    #6 void std::__1::__function::__policy_invoker<void (DB::HedgedConnections::ReplicaState&)>::__call_impl<std::__1::__function::__default_alloc_func<DB::HedgedConnections::sendScalarsData(std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, DB::Block, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const, DB::Block> > >&)::$_1, void (DB::HedgedConnections::ReplicaState&)> >(std::__1::__function::__policy_storage const*, DB::HedgedConnections::ReplicaState&) obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2089:16 (clickhouse+0x150ef2d3)
    #7 std::__1::__function::__policy_func<void (DB::HedgedConnections::ReplicaState&)>::operator()(DB::HedgedConnections::ReplicaState&) const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2221:16 (clickhouse+0x150eebd1)
    #8 std::__1::function<void (DB::HedgedConnections::ReplicaState&)>::operator()(DB::HedgedConnections::ReplicaState&) const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560:12 (clickhouse+0x150eebd1)
    #9 DB::HedgedConnections::Pipeline::run(DB::HedgedConnections::ReplicaState&) obj-x86_64-linux-gnu/../src/Client/HedgedConnections.cpp:70:9 (clickhouse+0x150eebd1)
    #10 DB::HedgedConnections::processNewReplicaState(DB::HedgedConnectionsFactory::State, DB::Connection*) obj-x86_64-linux-gnu/../src/Client/HedgedConnections.cpp:509:39 (clickhouse+0x150eebd1)
    #11 DB::HedgedConnections::checkNewReplica() obj-x86_64-linux-gnu/../src/Client/HedgedConnections.cpp:482:5 (clickhouse+0x150ed0ca)
    #12 DB::HedgedConnections::getReadyReplicaLocation(std::__1::function<void (int, Poco::Timespan, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&)>) obj-x86_64-linux-gnu/../src/Client/HedgedConnections.cpp:318:13 (clickhouse+0x150ed0ca)
    #13 DB::HedgedConnections::drain() obj-x86_64-linux-gnu/../src/Client/HedgedConnections.cpp:256:36 (clickhouse+0x150ecad8)
    #14 DB::ConnectionCollector::drainConnections(DB::IConnections&) obj-x86_64-linux-gnu/../src/DataStreams/ConnectionCollector.cpp:78:37 (clickhouse+0x13b39cd8)
    #15 DB::AsyncDrainTask::operator()() const obj-x86_64-linux-gnu/../src/DataStreams/ConnectionCollector.cpp:48:9 (clickhouse+0x13b3a6ce)
    #16 decltype(std::__1::forward<DB::AsyncDrainTask&>(fp)()) std::__1::__invoke<DB::AsyncDrainTask&>(DB::AsyncDrainTask&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1 (clickhouse+0x13b3a6ce)
    #17 void std::__1::__invoke_void_return_wrapper<void>::__call<DB::AsyncDrainTask&>(DB::AsyncDrainTask&) obj-x86_64-linux-gnu/../contrib/libcxx/include/__functional_base:348:9 (clickhouse+0x13b3a6ce)
    #18 std::__1::__function::__default_alloc_func<DB::AsyncDrainTask, void ()>::operator()() obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:1608:12 (clickhouse+0x13b3a6ce)
    #19 void std::__1::__function::__policy_invoker<void ()>::__call_impl<std::__1::__function::__default_alloc_func<DB::AsyncDrainTask, void ()> >(std::__1::__function::__policy_storage const*) obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2089:16 (clickhouse+0x13b3a6ce)
    #20 std::__1::__function::__policy_func<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2221:16 (clickhouse+0x965e150)
    #21 std::__1::function<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560:12 (clickhouse+0x965e150)
    #22 ThreadPoolImpl<ThreadFromGlobalPool>::worker(std::__1::__list_iterator<ThreadFromGlobalPool, void*>) obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:266:17 (clickhouse+0x965e150)
    #23 bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()::operator()() const obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:136:73 (clickhouse+0x9661380)
    #24 decltype(std::__1::forward<bool>(fp)(std::__1::forward<bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()&>(fp0)...)) std::__1::__invoke_constexpr<bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()&>(bool&&, bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()&...) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3682:1 (clickhouse+0x9661380)
    #25 decltype(auto) std::__1::__apply_tuple_impl<bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()&, std::__1::tuple<>&>(bool&&, bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()&, std::__1::__tuple_indices<std::__1::tuple<>&...>) obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:1415:1 (clickhouse+0x9661380)
    #26 decltype(auto) std::__1::apply<bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()&, std::__1::tuple<>&>(bool&&, bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()&) obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:1424:1 (clickhouse+0x9661380)
    #27 ThreadFromGlobalPool::ThreadFromGlobalPool<bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()>(bool&&, bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()&&...)::'lambda'()::operator()() obj-x86_64-linux-gnu/../src/Common/ThreadPool.h:182:13 (clickhouse+0x9661380)
    #28 decltype(std::__1::forward<bool>(fp)(std::__1::forward<bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()>(fp0)...)) std::__1::__invoke<ThreadFromGlobalPool::ThreadFromGlobalPool<bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()>(bool&&, bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()&&...)::'lambda'()&>(bool&&, bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()&&...) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1 (clickhouse+0x96612e1)
    #29 void std::__1::__invoke_void_return_wrapper<void>::__call<ThreadFromGlobalPool::ThreadFromGlobalPool<bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()>(bool&&, bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()&&...)::'lambda'()&>(bool&&...) obj-x86_64-linux-gnu/../contrib/libcxx/include/__functional_base:348:9 (clickhouse+0x96612e1)
    #30 std::__1::__function::__default_alloc_func<ThreadFromGlobalPool::ThreadFromGlobalPool<bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()>(bool&&, bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()&&...)::'lambda'(), void ()>::operator()() obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:1608:12 (clickhouse+0x96612e1)
    #31 void std::__1::__function::__policy_invoker<void ()>::__call_impl<std::__1::__function::__default_alloc_func<ThreadFromGlobalPool::ThreadFromGlobalPool<bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()>(bool&&, bool ThreadPoolImpl<ThreadFromGlobalPool>::scheduleImpl<bool>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()&&...)::'lambda'(), void ()> >(std::__1::__function::__policy_storage const*) obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2089:16 (clickhouse+0x96612e1)
    #32 std::__1::__function::__policy_func<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2221:16 (clickhouse+0x965ba15)
    #33 std::__1::function<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560:12 (clickhouse+0x965ba15)
    #34 ThreadPoolImpl<std::__1::thread>::worker(std::__1::__list_iterator<std::__1::thread, void*>) obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:266:17 (clickhouse+0x965ba15)
    #35 void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()::operator()() const obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:136:73 (clickhouse+0x965ed98)
    #36 decltype(std::__1::forward<void>(fp)(std::__1::forward<void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()>(fp0)...)) std::__1::__invoke<void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()>(void&&, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()&&...) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1 (clickhouse+0x965ed98)
    #37 void std::__1::__thread_execute<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()>(std::__1::tuple<void, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()>&, std::__1::__tuple_indices<>) obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:280:5 (clickhouse+0x965ed98)
    #38 void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()> >(void*) obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:291:5 (clickhouse+0x965ed98)

  Previous write of size 8 at 0x7b5c00700188 by thread T309:
    #0 operator delete(void*, unsigned long) <null> (clickhouse+0x95b6ade)
    #1 void std::__1::__libcpp_operator_delete<void*, unsigned long>(void*, unsigned long) obj-x86_64-linux-gnu/../contrib/libcxx/include/new:245:3 (clickhouse+0x154e2c3e)
    #2 void std::__1::__do_deallocate_handle_size<>(void*, unsigned long) obj-x86_64-linux-gnu/../contrib/libcxx/include/new:271:10 (clickhouse+0x154e2c3e)
    #3 std::__1::__libcpp_deallocate(void*, unsigned long, unsigned long) obj-x86_64-linux-gnu/../contrib/libcxx/include/new:285:14 (clickhouse+0x154e2c3e)
    #4 std::__1::allocator<std::__1::__shared_ptr_emplace<DB::MergeTreeThreadSelectBlockInputProcessor, std::__1::allocator<DB::MergeTreeThreadSelectBlockInputProcessor> > >::deallocate(std::__1::__shared_ptr_emplace<DB::MergeTreeThreadSelectBlockInputProcessor, std::__1::allocator<DB::MergeTreeThreadSelectBlockInputProcessor> >*, unsigned long) obj-x86_64-linux-gnu/../contrib/libcxx/include/memory:849:13 (clickhouse+0x154e2c3e)
    #5 std::__1::allocator_traits<std::__1::allocator<std::__1::__shared_ptr_emplace<DB::MergeTreeThreadSelectBlockInputProcessor, std::__1::allocator<DB::MergeTreeThreadSelectBlockInputProcessor> > > >::deallocate(std::__1::allocator<std::__1::__shared_ptr_emplace<DB::MergeTreeThreadSelectBlockInputProcessor, std::__1::allocator<DB::MergeTreeThreadSelectBlockInputProcessor> > >&, std::__1::__shared_ptr_emplace<DB::MergeTreeThreadSelectBlockInputProcessor, std::__1::allocator<DB::MergeTreeThreadSelectBlockInputProcessor> >*, unsigned long) obj-x86_64-linux-gnu/../contrib/libcxx/include/__memory/allocator_traits.h:476:14 (clickhouse+0x154e2c3e)
    #6 std::__1::__shared_ptr_emplace<DB::MergeTreeThreadSelectBlockInputProcessor, std::__1::allocator<DB::MergeTreeThreadSelectBlockInputProcessor> >::__on_zero_shared_weak() obj-x86_64-linux-gnu/../contrib/libcxx/include/memory:2622:9 (clickhouse+0x154e2c3e)
    #7 std::__1::__shared_weak_count::__release_weak() obj-x86_64-linux-gnu/../contrib/libcxx/src/memory.cpp (clickhouse+0x1ad82256)
    #8 std::__1::__shared_weak_count::__release_shared() obj-x86_64-linux-gnu/../contrib/libcxx/include/memory:2518:9 (clickhouse+0x151fe2d0)
    #9 std::__1::shared_ptr<DB::IProcessor>::~shared_ptr() obj-x86_64-linux-gnu/../contrib/libcxx/include/memory:3212:19 (clickhouse+0x151fe2d0)
    #10 std::__1::allocator<std::__1::shared_ptr<DB::IProcessor> >::destroy(std::__1::shared_ptr<DB::IProcessor>*) obj-x86_64-linux-gnu/../contrib/libcxx/include/memory:891:15 (clickhouse+0x151fe2d0)
    #11 void std::__1::allocator_traits<std::__1::allocator<std::__1::shared_ptr<DB::IProcessor> > >::__destroy<std::__1::shared_ptr<DB::IProcessor> >(std::__1::integral_constant<bool, true>, std::__1::allocator<std::__1::shared_ptr<DB::IProcessor> >&, std::__1::shared_ptr<DB::IProcessor>*) obj-x86_64-linux-gnu/../contrib/libcxx/include/__memory/allocator_traits.h:539:21 (clickhouse+0x151fe2d0)
    #12 void std::__1::allocator_traits<std::__1::allocator<std::__1::shared_ptr<DB::IProcessor> > >::destroy<std::__1::shared_ptr<DB::IProcessor> >(std::__1::allocator<std::__1::shared_ptr<DB::IProcessor> >&, std::__1::shared_ptr<DB::IProcessor>*) obj-x86_64-linux-gnu/../contrib/libcxx/include/__memory/allocator_traits.h:487:14 (clickhouse+0x151fe2d0)
    #13 std::__1::__vector_base<std::__1::shared_ptr<DB::IProcessor>, std::__1::allocator<std::__1::shared_ptr<DB::IProcessor> > >::__destruct_at_end(std::__1::shared_ptr<DB::IProcessor>*) obj-x86_64-linux-gnu/../contrib/libcxx/include/vector:428:9 (clickhouse+0x151fe2d0)
    #14 std::__1::__vector_base<std::__1::shared_ptr<DB::IProcessor>, std::__1::allocator<std::__1::shared_ptr<DB::IProcessor> > >::clear() obj-x86_64-linux-gnu/../contrib/libcxx/include/vector:371:29 (clickhouse+0x151fe2d0)
    #15 std::__1::__vector_base<std::__1::shared_ptr<DB::IProcessor>, std::__1::allocator<std::__1::shared_ptr<DB::IProcessor> > >::~__vector_base() obj-x86_64-linux-gnu/../contrib/libcxx/include/vector:465:9 (clickhouse+0x151fe2d0)
    #16 std::__1::vector<std::__1::shared_ptr<DB::IProcessor>, std::__1::allocator<std::__1::shared_ptr<DB::IProcessor> > >::~vector() obj-x86_64-linux-gnu/../contrib/libcxx/include/vector:557:5 (clickhouse+0x151fe2d0)
    #17 DB::Pipe::~Pipe() obj-x86_64-linux-gnu/../src/Processors/Pipe.h:29:7 (clickhouse+0x151fe2d0)
    #18 DB::QueryPipeline::reset() obj-x86_64-linux-gnu/../src/Processors/QueryPipeline.cpp:80:1 (clickhouse+0x151fe2d0)
    #19 DB::BlockIO::reset() obj-x86_64-linux-gnu/../src/DataStreams/BlockIO.cpp:45:14 (clickhouse+0x13b37474)
    #20 DB::BlockIO::operator=(DB::BlockIO&&) obj-x86_64-linux-gnu/../src/DataStreams/BlockIO.cpp:57:5 (clickhouse+0x13b37530)
    #21 DB::QueryState::operator=(DB::QueryState&&) obj-x86_64-linux-gnu/../src/Server/TCPHandler.h:32:8 (clickhouse+0x151ad351)
    #22 DB::QueryState::reset() obj-x86_64-linux-gnu/../src/Server/TCPHandler.h:89:15 (clickhouse+0x1519adbf)
    #23 DB::TCPHandler::runImpl() obj-x86_64-linux-gnu/../src/Server/TCPHandler.cpp:349:19 (clickhouse+0x1519adbf)
    #24 DB::TCPHandler::run() obj-x86_64-linux-gnu/../src/Server/TCPHandler.cpp:1649:9 (clickhouse+0x151aac27)
    #25 Poco::Net::TCPServerConnection::start() obj-x86_64-linux-gnu/../contrib/poco/Net/src/TCPServerConnection.cpp:43:3 (clickhouse+0x184c15a2)
    #26 Poco::Net::TCPServerDispatcher::run() obj-x86_64-linux-gnu/../contrib/poco/Net/src/TCPServerDispatcher.cpp:115:20 (clickhouse+0x184c1d2f)
    #27 Poco::PooledThread::run() obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/ThreadPool.cpp:199:14 (clickhouse+0x18638381)
    #28 Poco::(anonymous namespace)::RunnableHolder::run() obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Thread.cpp:55:11 (clickhouse+0x1863680f)
    #29 Poco::ThreadImpl::runnableEntry(void*) obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Thread_POSIX.cpp:345:27 (clickhouse+0x18634f87)

  Mutex M105970260681111776 is already destroyed.

  Thread T373 'QueryPipelineEx' (tid=807, running) created by thread T165 at:
    #0 pthread_create <null> (clickhouse+0x952750b)
    #1 std::__1::__libcpp_thread_create(unsigned long*, void* (*)(void*), void*) obj-x86_64-linux-gnu/../contrib/libcxx/include/__threading_support:509:10 (clickhouse+0x965e870)
    #2 std::__1::thread::thread<void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'(), void>(void&&, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()&&...) obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:307:16 (clickhouse+0x965e870)
    #3 void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>) obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:136:35 (clickhouse+0x965a37c)
    #4 ThreadPoolImpl<std::__1::thread>::scheduleOrThrow(std::__1::function<void ()>, int, unsigned long) obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:168:5 (clickhouse+0x965acc7)
    #5 ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&) obj-x86_64-linux-gnu/../src/Common/ThreadPool.h:166:38 (clickhouse+0x1523679d)
    #6 DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PullingAsyncPipelineExecutor.cpp:110:24 (clickhouse+0x1523679d)
    #7 DB::PullingAsyncPipelineExecutor::pull(DB::Block&, unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PullingAsyncPipelineExecutor.cpp:147:10 (clickhouse+0x15236f46)
    #8 DB::TCPHandler::processOrdinaryQueryWithProcessors() obj-x86_64-linux-gnu/../src/Server/TCPHandler.cpp:675:25 (clickhouse+0x151a15aa)
    #9 DB::TCPHandler::runImpl() obj-x86_64-linux-gnu/../src/Server/TCPHandler.cpp:331:17 (clickhouse+0x1519b5b4)
    #10 DB::TCPHandler::run() obj-x86_64-linux-gnu/../src/Server/TCPHandler.cpp:1649:9 (clickhouse+0x151aac27)
    #11 Poco::Net::TCPServerConnection::start() obj-x86_64-linux-gnu/../contrib/poco/Net/src/TCPServerConnection.cpp:43:3 (clickhouse+0x184c15a2)
    #12 Poco::Net::TCPServerDispatcher::run() obj-x86_64-linux-gnu/../contrib/poco/Net/src/TCPServerDispatcher.cpp:115:20 (clickhouse+0x184c1d2f)
    #13 Poco::PooledThread::run() obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/ThreadPool.cpp:199:14 (clickhouse+0x18638381)
    #14 Poco::(anonymous namespace)::RunnableHolder::run() obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Thread.cpp:55:11 (clickhouse+0x1863680f)
    #15 Poco::ThreadImpl::runnableEntry(void*) obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Thread_POSIX.cpp:345:27 (clickhouse+0x18634f87)

  Thread T309 'TCPHandler' (tid=399, running) created by thread T149 at:
    #0 pthread_create <null> (clickhouse+0x952750b)
    #1 Poco::ThreadImpl::startImpl(Poco::SharedPtr<Poco::Runnable, Poco::ReferenceCounter, Poco::ReleasePolicy<Poco::Runnable> >) obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Thread_POSIX.cpp:202:6 (clickhouse+0x18634a17)
    #2 Poco::Thread::start(Poco::Runnable&) obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Thread.cpp:128:2 (clickhouse+0x186361cc)
    #3 Poco::PooledThread::start() obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/ThreadPool.cpp:85:10 (clickhouse+0x1863a747)
    #4 Poco::ThreadPool::getThread() obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/ThreadPool.cpp:461:14 (clickhouse+0x1863a747)
    #5 Poco::ThreadPool::startWithPriority(Poco::Thread::Priority, Poco::Runnable&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/ThreadPool.cpp:365:2 (clickhouse+0x1863ab27)
    #6 Poco::Net::TCPServerDispatcher::enqueue(Poco::Net::StreamSocket const&) obj-x86_64-linux-gnu/../contrib/poco/Net/src/TCPServerDispatcher.cpp:152:17 (clickhouse+0x184c22aa)
    #7 Poco::Net::TCPServer::run() obj-x86_64-linux-gnu/../contrib/poco/Net/src/TCPServer.cpp:148:21 (clickhouse+0x184c0e27)
    #8 Poco::(anonymous namespace)::RunnableHolder::run() obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Thread.cpp:55:11 (clickhouse+0x1863680f)
    #9 Poco::ThreadImpl::runnableEntry(void*) obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Thread_POSIX.cpp:345:27 (clickhouse+0x18634f87)

SUMMARY: ThreadSanitizer: heap-use-after-free obj-x86_64-linux-gnu/../contrib/libcxx/include/map:1125:55 in std::__1::map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, DB::Block, std::__1::less<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const, DB::Block> > >::empty() const
==================

Metadata

Metadata

Labels

testingSpecial issue with list of bugs found by CI

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions