chenBright opened a new pull request, #3305:
URL: https://github.com/apache/brpc/pull/3305

   ### What problem does this PR solve?
   
   Issue Number: resolve 
   
   Problem Summary:
   
    `StreamingRpcTest.batch_create_stream_feedback_race` crashes
     with SIGSEGV inside 
`Stream::Consume`([ci1](https://github.com/chenBright/brpc/actions/runs/26095041030/job/76730443077?pr=51)
 
[ci2](https://github.com/apache/brpc/actions/runs/25729038610/job/75549212531?pr=3294)):
   
   ```
   #0  0x00007ff22a810461 in brpc::Stream::Consume (meta=0x2757c540, iter=...) 
at src/brpc/stream.cpp:604
   #1  0x00007ff22a69453c in bthread::ExecutionQueueBase::_execute 
(this=this@entry=0x2757e300, head=<optimized out>, high_priority=<optimized 
out>, niterated=niterated@entry=0x0) at src/bthread/execution_queue.cpp:308
   #2  0x00007ff22a6948e0 in bthread::ExecutionQueueBase::_execute_tasks 
(arg=<optimized out>) at src/bthread/execution_queue.cpp:169
   #3  0x00007ff22a6bf510 in bthread::TaskGroup::task_runner 
(skip_remained=<optimized out>) at src/bthread/task_group.cpp:388
   #4  0x00007ff22a693b21 in bthread_make_fcontext () from ./libbrpc.dbg.so
   #5  0x0000000000000000 in ?? ()
   ```
   
     Stream close is asynchronous: `StreamClose` only marks the fake socket
     failed; the handler's `on_closed` is invoked later on the consumer
     bthread, when `Consume` is invoked with `iter.is_queue_stopped()`.
   
     The test allocates `BatchStreamClientHandler` and
     `BatchStreamFeedbackRaceState` on its stack and passes the handler
     pointer to two streams via `StreamOptions::handler`. It also keeps a
     `SocketUniquePtr` (`client_extra_ptr`) alive across the whole test body
     to enlarge the `SetConnected` race window. That reference pins the
     extra stream's fake socket, so `BeforeRecycle` ->
     `execution_queue_stop` -> the final `Consume(is_queue_stopped)` for the
     extra stream cannot run until `client_extra_ptr` itself destructs at
     scope exit — which happens *after* the handler/state stack objects have
     already been destroyed. When `Consume` finally runs,
     `_options.handler` is dangling.
   
     Other tests in this file avoid the issue by setting a flag in
     `on_closed` and waiting on it before returning, but
     `BatchStreamClientHandler::on_closed` was empty.
   
   ### What is changed and the side effects?
   
   Changed:
   
   Side effects:
   - Performance effects:
   
   - Breaking backward compatibility: 
   
   ---
   ### Check List:
   - Please make sure your changes are compilable.
   - When providing us with a new feature, it is best to add related tests.
   - Please follow [Contributor Covenant Code of 
Conduct](https://github.com/apache/brpc/blob/master/CODE_OF_CONDUCT.md).
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to