BiteTheDDDDt opened a new issue, #13011: URL: https://github.com/apache/doris/issues/13011
### Search before asking - [X] I had searched in the [issues](https://github.com/apache/incubator-doris/issues?q=is%3Aissue) and found no similar issues. ### Version master ### What's Wrong? ```sql CREATE TABLE `test` ( `k1` smallint NULL, `k2` int NULL, `k3` bigint NULL, `k4` largeint NULL ) ENGINE=OLAP DUPLICATE KEY(`k1`,`k2`,`k3`,`k4`) DISTRIBUTED BY HASH(`k1`) BUCKETS 1 PROPERTIES("replication_num" = "1"); insert into test select e1,e1,e1,e1 from (select 1 k1) as t lateral view explode_numbers(100000000) tmp1 as e1; ``` ```cpp ================================================================= ==225980==ERROR: AddressSanitizer: global-buffer-overflow on address 0x563c7fb77140 at pc 0x563c86f50d6b bp 0x7f3fad3370a0 sp 0x7f3fad337098 READ of size 2 at 0x563c7fb77140 thread T631 #0 0x563c86f50d6a in doris::vectorized::ColumnVector<short>::insert_indices_from(doris::vectorized::IColumn const&, int const*, int const*) /mnt/disk1/pxl/doris/be/src/vec/columns/column_vector.cpp:365:70 #1 0x563c86e722a8 in doris::vectorized::ColumnNullable::insert_indices_from(doris::vectorized::IColumn const&, int const*, int const*) /mnt/disk1/pxl/doris/be/src/vec/columns/column_nullable.cpp:241:25 #2 0x563c872cab97 in doris::vectorized::MutableBlock::add_rows(doris::vectorized::Block const*, int const*, int const*) /mnt/disk1/pxl/doris/be/src/vec/core/block.cpp:966:14 #3 0x563c8317b1a6 in doris::MemTable::insert(doris::vectorized::Block const*, std::vector<int, std::allocator<int>> const&) /mnt/disk1/pxl/doris/be/src/olap/memtable.cpp:192:26 #4 0x563c835bcd5f in doris::DeltaWriter::write(doris::vectorized::Block const*, std::vector<int, std::allocator<int>> const&) /mnt/disk1/pxl/doris/be/src/olap/delta_writer.cpp:219:17 #5 0x563c84835026 in doris::Status doris::TabletsChannel::add_batch<doris::PTabletWriterAddBlockRequest, doris::PTabletWriterAddBlockResult>(doris::PTabletWriterAddBlockRequest const&, doris::PTabletWriterAddBlockResult*) /mnt/disk1/pxl/doris/be/src/runtime/tablets_channel.cpp:420:47 #6 0x563c84acb5ca in doris::Status doris::LoadChannel::add_batch<doris::PTabletWriterAddBlockRequest, doris::PTabletWriterAddBlockResult>(doris::PTabletWriterAddBlockRequest const&, doris::PTabletWriterAddBlockResult*) /mnt/disk1/pxl/doris/be/src/runtime/load_channel.h:151:13 #7 0x563c84ac89f3 in doris::Status doris::LoadChannelMgr::add_batch<doris::PTabletWriterAddBlockRequest, doris::PTabletWriterAddBlockResult>(doris::PTabletWriterAddBlockRequest const&, doris::PTabletWriterAddBlockResult*) /mnt/disk1/pxl/doris/be/src/runtime/load_channel_mgr.h:144:5 #8 0x563c84a9ee48 in doris::PInternalServiceImpl::_tablet_writer_add_block(google::protobuf::RpcController*, doris::PTabletWriterAddBlockRequest const*, doris::PTabletWriterAddBlockResult*, google::protobuf::Closure*)::$_1::operator()() const /mnt/disk1/pxl/doris/be/src/service/internal_service.cpp:268:54 #9 0x563c84a9ea64 in void std::__invoke_impl<void, doris::PInternalServiceImpl::_tablet_writer_add_block(google::protobuf::RpcController*, doris::PTabletWriterAddBlockRequest const*, doris::PTabletWriterAddBlockResult*, google::protobuf::Closure*)::$_1&>(std::__invoke_other, doris::PInternalServiceImpl::_tablet_writer_add_block(google::protobuf::RpcController*, doris::PTabletWriterAddBlockRequest const*, doris::PTabletWriterAddBlockResult*, google::protobuf::Closure*)::$_1&) /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14 #10 0x563c84a9ea04 in std::enable_if<is_invocable_r_v<void, doris::PInternalServiceImpl::_tablet_writer_add_block(google::protobuf::RpcController*, doris::PTabletWriterAddBlockRequest const*, doris::PTabletWriterAddBlockResult*, google::protobuf::Closure*)::$_1&>, void>::type std::__invoke_r<void, doris::PInternalServiceImpl::_tablet_writer_add_block(google::protobuf::RpcController*, doris::PTabletWriterAddBlockRequest const*, doris::PTabletWriterAddBlockResult*, google::protobuf::Closure*)::$_1&>(doris::PInternalServiceImpl::_tablet_writer_add_block(google::protobuf::RpcController*, doris::PTabletWriterAddBlockRequest const*, doris::PTabletWriterAddBlockResult*, google::protobuf::Closure*)::$_1&) /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:111:2 #11 0x563c84a9e86c in std::_Function_handler<void (), doris::PInternalServiceImpl::_tablet_writer_add_block(google::protobuf::RpcController*, doris::PTabletWriterAddBlockRequest const*, doris::PTabletWriterAddBlockResult*, google::protobuf::Closure*)::$_1>::_M_invoke(std::_Any_data const&) /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:291:9 #12 0x563c8439ad12 in std::function<void ()>::operator()() const /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_function.h:560:9 #13 0x563c843976e0 in doris::PriorityThreadPool::work_thread(int) /mnt/disk1/pxl/doris/be/src/util/priority_thread_pool.hpp:136:17 #14 0x563c84398fe2 in void std::__invoke_impl<void, void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>(std::__invoke_memfun_deref, void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&) /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:74:14 #15 0x563c84398eb4 in std::__invoke_result<void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>::type std::__invoke<void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&>(void (doris::PriorityThreadPool::* const&)(int), doris::PriorityThreadPool*&, int&) /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:96:14 #16 0x563c84398e84 in decltype(std::__invoke((*this)._M_pmf, std::forward<doris::PriorityThreadPool*&>(fp), std::forward<int&>(fp))) std::_Mem_fn_base<void (doris::PriorityThreadPool::*)(int), true>::operator()<doris::PriorityThreadPool*&, int&>(doris::PriorityThreadPool*&, int&) const /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/functional:131:11 #17 0x563c84398e54 in void std::__invoke_impl<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>(std::__invoke_other, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&) /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14 #18 0x563c84398da4 in std::enable_if<is_invocable_r_v<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>, void>::type std::__invoke_r<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&>(std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)>&, doris::PriorityThreadPool*&, int&) /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:111:2 #19 0x563c84398d13 in void std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>::__call<void, 0ul, 1ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul>) /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/functional:570:11 #20 0x563c84398b7d in void std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>::operator()<>() /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/functional:629:17 #21 0x563c84398a94 in void std::__invoke_impl<void, std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>(std::__invoke_other, std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&&) /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:61:14 #22 0x563c84398a54 in std::__invoke_result<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>::type std::__invoke<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>(std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&&) /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/invoke.h:96:14 #23 0x563c84398a2c in void std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>>::_M_invoke<0ul>(std::_Index_tuple<0ul>) /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_thread.h:253:13 #24 0x563c84398a04 in std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>>::operator()() /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_thread.h:260:11 #25 0x563c84398988 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>>>::_M_run() /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/std_thread.h:211:13 #26 0x563c904b6c0f in execute_native_thread_routine scalbn.c #27 0x7f4259ed4ea4 in start_thread pthread_create.c #28 0x7f425a6edb0c in clone (/lib64/libc.so.6+0xfeb0c) (BuildId: 9470e279388f7f9cb2ed3b2872d0c2095b191ff4) 0x563c7fb77140 is located 0 bytes to the right of global variable 'doris::vectorized::empty_pod_array' defined in '/mnt/disk1/pxl/doris/be/src/vec/common/pod_array.cpp:25' (0x563c7fb76d40) of size 1024 SUMMARY: AddressSanitizer: global-buffer-overflow /mnt/disk1/pxl/doris/be/src/vec/columns/column_vector.cpp:365:70 in doris::vectorized::ColumnVector<short>::insert_indices_from(doris::vectorized::IColumn const&, int const*, int const*) Shadow bytes around the buggy address: 0x0ac80ff66dd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ac80ff66de0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ac80ff66df0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ac80ff66e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0ac80ff66e10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0ac80ff66e20: 00 00 00 00 00 00 00 00[f9]f9 f9 f9 f9 f9 f9 f9 0x0ac80ff66e30: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 0x0ac80ff66e40: f9 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 02 f9 f9 0x0ac80ff66e50: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 0x0ac80ff66e60: 00 00 00 06 f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x0ac80ff66e70: 00 00 00 03 f9 f9 f9 f9 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Thread T631 created by T0 here: #0 0x563c82135a9c in pthread_create (/mnt/disk1/pxl/doris/output/be/lib/doris_be+0x89dea9c) (BuildId: 287849e94c82b311) #1 0x563c904b6d35 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State>>, void (*)()) (/mnt/disk1/pxl/doris/output/be/lib/doris_be+0x16d5fd35) (BuildId: 287849e94c82b311) #2 0x563c843983e7 in std::_MakeUniq<std::thread>::__single_object std::make_unique<std::thread, std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&>(std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>&) /mnt/disk1/pxl/ldb/ldb_toolchain/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/unique_ptr.h:962:34 #3 0x563c84397078 in std::thread* doris::ThreadGroup::create_thread<std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>>(std::_Bind_result<void, std::_Mem_fn<void (doris::PriorityThreadPool::*)(int)> (doris::PriorityThreadPool*, int)>) /mnt/disk1/pxl/doris/be/src/util/thread_group.h:65:51 #4 0x563c843922df in doris::PriorityThreadPool::PriorityThreadPool(unsigned int, unsigned int) /mnt/disk1/pxl/doris/be/src/util/priority_thread_pool.hpp:58:22 #5 0x563c84a89f89 in doris::PInternalServiceImpl::PInternalServiceImpl(doris::ExecEnv*) /mnt/disk1/pxl/doris/be/src/service/internal_service.cpp:88:11 #6 0x563c84a73ba1 in doris::BRpcService::start(int, int) /mnt/disk1/pxl/doris/be/src/service/brpc_service.cpp:45:29 #7 0x563c8218dd39 in main /mnt/disk1/pxl/doris/be/src/service/doris_main.cpp:420:27 #8 0x7f425a611554 in __libc_start_main (/lib64/libc.so.6+0x22554) (BuildId: 9470e279388f7f9cb2ed3b2872d0c2095b191ff4) ``` ### What You Expected? fix ### How to Reproduce? _No response_ ### Anything Else? _No response_ ### Are you willing to submit PR? - [X] Yes I am willing to submit a PR! ### Code of Conduct - [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: commits-unsubscr...@doris.apache.org.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: commits-unsubscr...@doris.apache.org For additional commands, e-mail: commits-h...@doris.apache.org
