[IMPALA-6489] ASAN use-after-poison in impala::HdfsScanner::InitTupleFromTemplate

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: Impala 2.11.0, Impala 3.0, Impala 2.12.0
• Fix Version/s: Impala 3.0, Impala 2.12.0
• Component/s: Backend
• Labels: broken-build crash
• Target Version: Impala 3.0, Impala 2.12.0
• Epic Color: ghx-label-7
• Assignee: Tim Armstrong
• Reporter: Alexander Behm
• Created: 07/Feb/18 19:51
• Updated: 26/Apr/18 16:47
• Resolved: 13/Feb/18 06:51

Description

Tim, can you take a look? Feel free to re-assign.

Relevant dump from impalad.ERROR:

==19705==ERROR: AddressSanitizer: use-after-poison on address 0x621000b60905 at pc 0x000001374875 bp 0x7f9c3366f000 sp 0x7f9c3366e7b0
READ of size 17 at 0x621000b60905 thread T76302
E0207 01:08:01.352087  4379 LiteralExpr.java:186] Failed to evaluate expr '85070591730234615865843651857942052864 - 58.48645002065785270268702445358000000'
E0207 01:08:02.044962  4379 LiteralExpr.java:186] Failed to evaluate expr '85070591730234615865843651857942052864 - 58.48645002065785270268702445358000000'
    #0 0x1374874 in __asan_memcpy /data/jenkins/workspace/impala-toolchain-package-build/label/ec2-package-centos-6/toolchain/source/llvm/llvm-3.9.1.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:413
    #1 0x1c2c111 in impala::HdfsScanner::InitTupleFromTemplate(impala::Tuple*, impala::Tuple*, int) /data/jenkins/workspace/impala-asf-master-core-asan/repos/Impala/be/src/exec/hdfs-scanner.h:445:5
    #2 0x1c9a97d in impala::HdfsParquetScanner::AssembleCollection(std::vector<impala::ParquetColumnReader*, std::allocator<impala::ParquetColumnReader*> > const&, int, impala::CollectionValueBuilder*) /data/jenkins/workspace/impala-asf-master-core-asan/repos/Impala/be/src/exec/hdfs-parquet-scanner.cc:1303:7
    #3 0x1d34752 in impala::CollectionColumnReader::ReadSlot(impala::Tuple*, impala::MemPool*) /data/jenkins/workspace/impala-asf-master-core-asan/repos/Impala/be/src/exec/parquet-column-readers.cc:1281:38
    #4 0x1d31b5f in impala::CollectionColumnReader::ReadValue(impala::MemPool*, impala::Tuple*) /data/jenkins/workspace/impala-asf-master-core-asan/repos/Impala/be/src/exec/parquet-column-readers.cc:1258:12
    #5 0x1d2a48e in impala::ParquetColumnReader::ReadValueBatch(impala::MemPool*, int, int, unsigned char*, int*) /data/jenkins/workspace/impala-asf-master-core-asan/repos/Impala/be/src/exec/parquet-column-readers.cc:804:26
    #6 0x1c93de2 in impala::HdfsParquetScanner::AssembleRows(std::vector<impala::ParquetColumnReader*, std::allocator<impala::ParquetColumnReader*> > const&, impala::RowBatch*, bool*) /data/jenkins/workspace/impala-asf-master-core-asan/repos/Impala/be/src/exec/hdfs-parquet-scanner.cc:1034:42
    #7 0x1c8fd58 in impala::HdfsParquetScanner::GetNextInternal(impala::RowBatch*) /data/jenkins/workspace/impala-asf-master-core-asan/repos/Impala/be/src/exec/hdfs-parquet-scanner.cc:507:19
    #8 0x1c8df5f in impala::HdfsParquetScanner::ProcessSplit() /data/jenkins/workspace/impala-asf-master-core-asan/repos/Impala/be/src/exec/hdfs-parquet-scanner.cc:405:21
    #9 0x1be6f0e in impala::HdfsScanNode::ProcessSplit(std::vector<impala::FilterContext, std::allocator<impala::FilterContext> > const&, impala::MemPool*, impala::io::ScanRange*) /data/jenkins/workspace/impala-asf-master-core-asan/repos/Impala/be/src/exec/hdfs-scan-node.cc:532:21
    #10 0x1be60c9 in impala::HdfsScanNode::ScannerThread() /data/jenkins/workspace/impala-asf-master-core-asan/repos/Impala/be/src/exec/hdfs-scan-node.cc:442:16
    #11 0x16a19c2 in boost::function0<void>::operator()() const /data/jenkins/workspace/impala-asf-master-core-asan/Impala-Toolchain/boost-1.57.0-p3/include/boost/function/function_template.hpp:766:14
    #12 0x1af97c3 in impala::Thread::SuperviseThread(std::string const&, std::string const&, boost::function<void ()>, impala::Promise<long>*) /data/jenkins/workspace/impala-asf-master-core-asan/repos/Impala/be/src/util/thread.cc:354:3
    #13 0x1b04685 in void boost::_bi::list4<boost::_bi::value<std::string>, boost::_bi::value<std::string>, boost::_bi::value<boost::function<void ()> >, boost::_bi::value<impala::Promise<long>*> >::operator()<void (*)(std::string const&, std::string const&, boost::function<void ()>, impala::Promise<long>*), boost::_bi::list0>(boost::_bi::type<void>, void (*&)(std::string const&, std::string const&, boost::function<void ()>, impala::Promise<long>*), boost::_bi::list0&, int) /data/jenkins/workspace/impala-asf-master-core-asan/Impala-Toolchain/boost-1.57.0-p3/include/boost/bind/bind.hpp:457:9
    #14 0x1b04501 in boost::_bi::bind_t<void, void (*)(std::string const&, std::string const&, boost::function<void ()>, impala::Promise<long>*), boost::_bi::list4<boost::_bi::value<std::string>, boost::_bi::value<std::string>, boost::_bi::value<boost::function<void ()> >, boost::_bi::value<impala::Promise<long>*> > >::operator()() /data/jenkins/workspace/impala-asf-master-core-asan/Impala-Toolchain/boost-1.57.0-p3/include/boost/bind/bind_template.hpp:20:16
    #15 0x2fc7c49 in thread_proxy (/data/jenkins/workspace/impala-asf-master-core-asan/repos/Impala/be/build/debug/service/impalad+0x2fc7c49)
    #16 0x37c3807850 in start_thread (/lib64/libpthread.so.0+0x37c3807850)
    #17 0x37c34e894c in clone (/lib64/libc.so.6+0x37c34e894c)

Issue Links

• is broken by: IMPALA-5307 Consider always copying-out Disk I/O buffers instead of attaching to RowBatches
• is broken by: IMPALA-5037 Change default Parquet array resolution according to Parquet standard.