Gabriel39 opened a new pull request, #69181:
URL: https://github.com/apache/doris/pull/69181
### What problem does this PR solve?
A queued scan task can retain `ScannerContext` after its scan operator has
been destroyed. During adaptive scan cleanup, `debug_string()` dereferences the
operator-owned `_shared_scan_limit`, causing an ASAN heap-use-after-free. The
same diagnostic is also used when the scheduler cannot lock the task execution
context.
Remove the borrowed `remaining_limit` value from diagnostics so both paths
remain safe after the operator is released. Scan limit enforcement and memory
quota cleanup are unchanged. Add unit tests for diagnostics and scheduler
submission after owner destruction, and for adaptive cleanup with verbose
logging enabled.
### Release note
Fix a use-after-free in scan diagnostics during task cleanup.
### Check List (For Author)
- Test
- [x] Unit Test: add two lifecycle regression cases and update the
existing diagnostic-format assertion.
- [x] Manual test: a focused ASAN harness extracting the actual
`debug_string()` method reproduces the invalid read before the fix and passes
all four combinations of adaptive scanning enabled/disabled and
limited/unlimited scans after the fix. The surrounding fields are test
stand-ins; this is not a full BE UT run.
- Validation
- Clang syntax checks passed for the modified source and test
translation units using regenerated protocol headers and BE test flags.
- clang-format 16 and build hygiene checks passed.
- The full BE UT invocation was blocked before execution by the local
third-party installation missing `libsimdutf.a`; the new BE unit tests still
require CI execution.
- Behavior changed:
- [x] Yes: diagnostic output no longer includes `remaining_limit`.
- Does this need documentation?
- [x] No.
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
