Skip to content

stack-use-after-scope in random places #41500

@Avogar

Description

@Avogar

https://s3.amazonaws.com/clickhouse-test-reports/41286/01b5b9cebad80bdb8b17091814523d0ce6b909e7/stateless_tests__asan__[2/2].html

==646==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fa738d89980 at pc 0x00000dc45db7 bp 0x7fa45136b210 sp 0x7fa45136a9e0
READ of size 16594 at 0x7fa738d89980 thread T873 (QueryPipelineEx)
    #0 0xdc45db6 in __asan_memcpy (/usr/bin/clickhouse+0xdc45db6) (BuildId: 0232572cf83dc64f3fade01480a22c7e06f784f7)
    #1 0xde5ae88 in DB::ReadBuffer::read(char*, unsigned long) build_docker/../src/IO/ReadBuffer.h:178:13
    #2 0xde5ae88 in DB::ReadBuffer::readStrict(char*, unsigned long) build_docker/../src/IO/ReadBuffer.h:189:27
    #3 0x2cac7d42 in DB::CompressedReadBufferBase::readCompressedData(unsigned long&, unsigned long&, bool) build_docker/../src/Compression/CompressedReadBufferBase.cpp:192:24
    #4 0x2cace3e1 in DB::CompressedReadBufferFromFile::nextImpl() build_docker/../src/Compression/CompressedReadBufferFromFile.cpp:22:23
    #5 0x2cff9b8b in DB::ReadBuffer::next() build_docker/../src/IO/ReadBuffer.h:64:20
    #6 0x2cff9b8b in DB::ReadBuffer::eof() build_docker/../src/IO/ReadBuffer.h:98:38
    #7 0x2cff9b8b in DB::SerializationLowCardinality::deserializeBinaryBulkWithMultipleStreams(COW<DB::IColumn>::immutable_ptr<DB::IColumn>&, unsigned long, DB::ISerialization::DeserializeBinaryBulkSettings&, std::__1::shared_ptr<DB::ISerialization::DeserializeBinaryBulkState>&, std::__1::unordered_map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, COW<DB::IColumn>::immutable_ptr<DB::IColumn>, std::__1::hash<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::equal_to<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, COW<DB::IColumn>::immutable_ptr<DB::IColumn>>>>*) const build_docker/../src/DataTypes/Serializations/SerializationLowCardinality.cpp:687:33
    #8 0x318b1efd in DB::MergeTreeReaderWide::readData(DB::NameAndTypePair const&, std::__1::shared_ptr<DB::ISerialization const> const&, COW<DB::IColumn>::immutable_ptr<DB::IColumn>&, unsigned long, bool, unsigned long, unsigned long, std::__1::unordered_map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, COW<DB::IColumn>::immutable_ptr<DB::IColumn>, std::__1::hash<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::equal_to<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, COW<DB::IColumn>::immutable_ptr<DB::IColumn>>>>&, bool) build_docker/../src/Storages/MergeTree/MergeTreeReaderWide.cpp:306:20
    #9 0x318af140 in DB::MergeTreeReaderWide::readRows(unsigned long, unsigned long, bool, unsigned long, std::__1::vector<COW<DB::IColumn>::immutable_ptr<DB::IColumn>, std::__1::allocator<COW<DB::IColumn>::immutable_ptr<DB::IColumn>>>&) build_docker/../src/Storages/MergeTree/MergeTreeReaderWide.cpp:111:17
    #10 0x32b19f8a in DB::MergeTreeRangeReader::DelayedStream::readRows(std::__1::vector<COW<DB::IColumn>::immutable_ptr<DB::IColumn>, std::__1::allocator<COW<DB::IColumn>::immutable_ptr<DB::IColumn>>>&, unsigned long) build_docker/../src/Storages/MergeTree/MergeTreeRangeReader.cpp:101:47
    #11 0x32b19f8a in DB::MergeTreeRangeReader::DelayedStream::finalize(std::__1::vector<COW<DB::IColumn>::immutable_ptr<DB::IColumn>, std::__1::allocator<COW<DB::IColumn>::immutable_ptr<DB::IColumn>>>&) build_docker/../src/Storages/MergeTree/MergeTreeRangeReader.cpp:175:12
    #12 0x32b2919c in DB::MergeTreeRangeReader::Stream::finalize(std::__1::vector<COW<DB::IColumn>::immutable_ptr<DB::IColumn>, std::__1::allocator<COW<DB::IColumn>::immutable_ptr<DB::IColumn>>>&) build_docker/../src/Storages/MergeTree/MergeTreeRangeReader.cpp:286:31
    #13 0x32b2919c in DB::MergeTreeRangeReader::startReadingChain(unsigned long, std::__1::deque<DB::MarkRange, std::__1::allocator<DB::MarkRange>>&) build_docker/../src/Storages/MergeTree/MergeTreeRangeReader.cpp:946:27
    #14 0x32b24466 in DB::MergeTreeRangeReader::read(unsigned long, std::__1::deque<DB::MarkRange, std::__1::allocator<DB::MarkRange>>&) build_docker/../src/Storages/MergeTree/MergeTreeRangeReader.cpp:854:23
    #15 0x32b04573 in DB::MergeTreeBaseSelectProcessor::readFromPartImpl() build_docker/../src/Storages/MergeTree/MergeTreeBaseSelectProcessor.cpp:385:43
    #16 0x32b056d6 in DB::MergeTreeBaseSelectProcessor::readFromPart() build_docker/../src/Storages/MergeTree/MergeTreeBaseSelectProcessor.cpp:425:12
    #17 0x32afb3d7 in DB::MergeTreeBaseSelectProcessor::generate() build_docker/../src/Storages/MergeTree/MergeTreeBaseSelectProcessor.cpp:217:20
    #18 0x32059ed5 in DB::ISource::tryGenerate() build_docker/../src/Processors/ISource.cpp:124:18
    #19 0x3205905e in DB::ISource::work() build_docker/../src/Processors/ISource.cpp:94:26
    #20 0x320a650d in DB::executeJob(DB::ExecutingGraph::Node*, DB::ReadProgressCallback*) build_docker/../src/Processors/Executors/ExecutionThreadContext.cpp:47:26
    #21 0x320a650d in DB::ExecutionThreadContext::executeTask() build_docker/../src/Processors/Executors/ExecutionThreadContext.cpp:92:9
    #22 0x320858a4 in DB::PipelineExecutor::executeStepImpl(unsigned long, std::__1::atomic<bool>*) build_docker/../src/Processors/Executors/PipelineExecutor.cpp:228:26
    #23 0x320892eb in DB::PipelineExecutor::executeSingleThread(unsigned long) build_docker/../src/Processors/Executors/PipelineExecutor.cpp:194:5
    #24 0x320892eb in DB::PipelineExecutor::spawnThreads()::$_0::operator()() const build_docker/../src/Processors/Executors/PipelineExecutor.cpp:315:17
    #25 0x320892eb in decltype(static_cast<DB::PipelineExecutor::spawnThreads()::$_0&>(fp)()) std::__1::__invoke_constexpr<DB::PipelineExecutor::spawnThreads()::$_0&>(DB::PipelineExecutor::spawnThreads()::$_0&) build_docker/../contrib/libcxx/include/type_traits:3648:23
    #26 0x320892eb in decltype(auto) std::__1::__apply_tuple_impl<DB::PipelineExecutor::spawnThreads()::$_0&, std::__1::tuple<>&>(DB::PipelineExecutor::spawnThreads()::$_0&, std::__1::tuple<>&, std::__1::__tuple_indices<>) build_docker/../contrib/libcxx/include/tuple:1595:1
    #27 0x320892eb in decltype(auto) std::__1::apply<DB::PipelineExecutor::spawnThreads()::$_0&, std::__1::tuple<>&>(DB::PipelineExecutor::spawnThreads()::$_0&, std::__1::tuple<>&) build_docker/../contrib/libcxx/include/tuple:1604:1
    #28 0x320892eb in ThreadFromGlobalPoolImpl<true>::ThreadFromGlobalPoolImpl<DB::PipelineExecutor::spawnThreads()::$_0>(DB::PipelineExecutor::spawnThreads()::$_0&&)::'lambda'()::operator()() build_docker/../src/Common/ThreadPool.h:193:13
    #29 0x320892eb in decltype(static_cast<DB::PipelineExecutor::spawnThreads()::$_0>(fp)()) std::__1::__invoke<ThreadFromGlobalPoolImpl<true>::ThreadFromGlobalPoolImpl<DB::PipelineExecutor::spawnThreads()::$_0>(DB::PipelineExecutor::spawnThreads()::$_0&&)::'lambda'()&>(DB::PipelineExecutor::spawnThreads()::$_0&&) build_docker/../contrib/libcxx/include/type_traits:3640:23
    #30 0x320892eb in void std::__1::__invoke_void_return_wrapper<void, true>::__call<ThreadFromGlobalPoolImpl<true>::ThreadFromGlobalPoolImpl<DB::PipelineExecutor::spawnThreads()::$_0>(DB::PipelineExecutor::spawnThreads()::$_0&&)::'lambda'()&>(ThreadFromGlobalPoolImpl<true>::ThreadFromGlobalPoolImpl<DB::PipelineExecutor::spawnThreads()::$_0>(DB::PipelineExecutor::spawnThreads()::$_0&&)::'lambda'()&) build_docker/../contrib/libcxx/include/__functional/invoke.h:61:9
    #31 0x320892eb in std::__1::__function::__default_alloc_func<ThreadFromGlobalPoolImpl<true>::ThreadFromGlobalPoolImpl<DB::PipelineExecutor::spawnThreads()::$_0>(DB::PipelineExecutor::spawnThreads()::$_0&&)::'lambda'(), void ()>::operator()() build_docker/../contrib/libcxx/include/__functional/function.h:230:12
    #32 0x320892eb in void std::__1::__function::__policy_invoker<void ()>::__call_impl<std::__1::__function::__default_alloc_func<ThreadFromGlobalPoolImpl<true>::ThreadFromGlobalPoolImpl<DB::PipelineExecutor::spawnThreads()::$_0>(DB::PipelineExecutor::spawnThreads()::$_0&&)::'lambda'(), void ()>>(std::__1::__function::__policy_storage const*) build_docker/../contrib/libcxx/include/__functional/function.h:711:16
    #33 0xdea5c7f in std::__1::__function::__policy_func<void ()>::operator()() const build_docker/../contrib/libcxx/include/__functional/function.h:843:16
    #34 0xdea5c7f in std::__1::function<void ()>::operator()() const build_docker/../contrib/libcxx/include/__functional/function.h:1184:12
    #35 0xdea5c7f in ThreadPoolImpl<std::__1::thread>::worker(std::__1::__list_iterator<std::__1::thread, void*>) build_docker/../src/Common/ThreadPool.cpp:294:17
    #36 0xdeaf76c in void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>, bool)::'lambda0'()::operator()() const build_docker/../src/Common/ThreadPool.cpp:144:73
    #37 0xdeaf76c in decltype(static_cast<void>(fp)()) std::__1::__invoke<void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>, bool)::'lambda0'()>(void&&) build_docker/../contrib/libcxx/include/type_traits:3640:23
    #38 0xdeaf76c in void std::__1::__thread_execute<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct>>, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>, bool)::'lambda0'()>(std::__1::tuple<void, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>, bool)::'lambda0'()>&, std::__1::__tuple_indices<>) build_docker/../contrib/libcxx/include/thread:282:5
    #39 0xdeaf76c in void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct>>, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>, bool)::'lambda0'()>>(void*) build_docker/../contrib/libcxx/include/thread:293:5
    #40 0x7fa952840608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8608) (BuildId: 7b4536f41cdaa5888408e82d0836e33dcf436466)
    #41 0x7fa952765132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee)

But I cannot reproduce it by running 01441_low_cardinality_array_index.sql under address sanitizer...

Metadata

Metadata

Assignees

No one assigned

    Labels

    fuzzProblem found by one of the fuzzerstestingSpecial issue with list of bugs found by CI

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions