Details
-
Bug
-
Status: Resolved
-
Critical
-
Resolution: Fixed
-
Impala 2.0.1
Description
Currently, most of the allocations are managed via the FreePool class. Unfortunately, this class has a sever drawback that it uses a signed 32 bit integer to specify allocations. Interestingly, the FreePool manages a list of 64 sub-lists with free blocks, but the upper half of these lists is never used. The FreePool uses a MemPool to perform the actual allocation, but the MemPool only uses a 32 bit signed integer as well to indicate the allocation size.
If an allocation requests more than 1GB of data, the 32 bit integer will overflow and request a negative amount of memory which will ultimately lead to a crash.
To reproduce the crash issue:
select length(group_concat(l_comment, "!")) from (select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem union all
select l_comment from tpch_parquet.lineitem) a;
Attachments
Issue Links
- is blocked by
-
IMPALA-2284 Handle large string allocations (>1GB) in built-in UDFs gracefully
- Resolved
- is duplicated by
-
IMPALA-2814 Impala daemons crash with large Snappy compressed text files
- Resolved
- is related to
-
IMPALA-2065 Crash: impala::BufferedBlockMgr::ConsumeMemory (PartitionedHashJoinNode)
- Resolved
-
IMPALA-3069 mem-pool.cc:254] Check failed: chunks_[i].allocated_bytes > 0 (-2104452104 vs. 0)
- Resolved
- relates to
-
IMPALA-2249 Avoid allocating stringbuffer larger than 1GB in HdfsTextScanner::FillByteBufferCompressedFile()
- Resolved