[IMPALA-8969] Grouping aggregator can cause segmentation fault when doing multiple aggregations.

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: Impala 3.4.0
• Labels: crash
• Epic Color: ghx-label-10
• Assignee: Zoltán Borók-Nagy
• Reporter: Zoltán Borók-Nagy
• Created: 24/Sep/19 10:04
• Updated: 25/Aug/20 15:52
• Resolved: 23/Oct/19 15:39

Description

The following query deterministically crashes Impala:

select group_concat(distinct cast(l_orderkey as string))), group_concat(distinct(l_comment))) from tpch_parquet.lineitem group by l_comment

The stack trace during the crash:

#0  0x00007fd3f605a428 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007fd3f605c02a in abort () from /lib/x86_64-linux-gnu/libc.so.6
#2  0x00007fd3fa8ad149 in ?? () from /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/server/libjvm.so
#3  0x00007fd3faa60d27 in ?? () from /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/server/libjvm.so
#4  0x00007fd3fa8b6e4f in JVM_handle_linux_signal () from /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/server/libjvm.so
#5  0x00007fd3fa8a9e48 in ?? () from /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/server/libjvm.so
#6  <signal handler called>
#7  0x00007fd400105bfa in impala::Tuple::IsNull (this=0x0, offset=...) at /home/boroknagyz/Impala/be/src/runtime/tuple.h:247
#8  0x00007fd3fd1c16d2 in impala::AggFnEvaluator::SerializeOrFinalize (this=0x75da4c0, src=0x0, dst_slot_desc=..., dst=0x0, fn=0x7fd3fd1cdc08 <impala::AggregateFunctions::StringValSerializeOrFinalize(impala_udf::FunctionContext*, impala_udf::StringVal const&)>)
    at /home/boroknagyz/Impala/be/src/exprs/agg-fn-evaluator.cc:398
#9  0x00007fd3fddbeb3a in impala::AggFnEvaluator::Serialize (this=0x75da4c0, tuple=0x0) at /home/boroknagyz/Impala/be/src/exprs/agg-fn-evaluator.h:267
#10 0x00007fd3fddbebe3 in impala::AggFnEvaluator::Serialize (evals=..., dst=0x0) at /home/boroknagyz/Impala/be/src/exprs/agg-fn-evaluator.h:296
#11 0x00007fd3fde4e847 in impala::GroupingAggregator::AddBatchStreamingImpl (this=0xd392300, agg_idx=1, needs_serialize=true, prefetch_mode=impala::TPrefetchMode::HT_BUCKET, in_batch=0xb7746c0, out_batch=0x758e040, ht_ctx=0xb336f80, remaining_capacity=0x7fd353bb6c40)
    at /home/boroknagyz/Impala/be/src/exec/grouping-aggregator-ir.cc:204
#12 0x00007fd3fde3e426 in impala::GroupingAggregator::AddBatchStreaming (this=0xd392300, state=0x7006e00, out_batch=0x758e040, child_batch=0xb7746c0, eos=0x7fd353bb6f0e) at /home/boroknagyz/Impala/be/src/exec/grouping-aggregator.cc:459
#13 0x00007fd3fdfa2773 in impala::StreamingAggregationNode::GetRowsStreaming (this=0x6205c00, state=0x7006e00, out_batch=0x758e040) at /home/boroknagyz/Impala/be/src/exec/streaming-aggregation-node.cc:160
#14 0x00007fd3fdfa1616 in impala::StreamingAggregationNode::GetNext (this=0x6205c00, state=0x7006e00, row_batch=0x758e040, eos=0x7fd353bb74c7) at /home/boroknagyz/Impala/be/src/exec/streaming-aggregation-node.cc:76
#15 0x00007fd3fe9ea566 in impala::FragmentInstanceState::ExecInternal (this=0x703b1e0) at /home/boroknagyz/Impala/be/src/runtime/fragment-instance-state.cc:368
#16 0x00007fd3fe9e6e39 in impala::FragmentInstanceState::Exec (this=0x703b1e0) at /home/boroknagyz/Impala/be/src/runtime/fragment-instance-state.cc:93
#17 0x00007fd3fea51c9d in impala::QueryState::ExecFInstance (this=0x6f9b200, fis=0x703b1e0) at /home/boroknagyz/Impala/be/src/runtime/query-state.cc:650
#18 0x00007fd3fea4ff6a in impala::QueryState::<lambda()>::operator()(void) const (__closure=0x7fd353bb7ca8) at /home/boroknagyz/Impala/be/src/runtime/query-state.cc:558
#19 0x00007fd3fea5397f in boost::detail::function::void_function_obj_invoker0<impala::QueryState::StartFInstances()::<lambda()>, void>::invoke(boost::detail::function::function_buffer &) (function_obj_ptr=...)
    at /opt/Impala-Toolchain/boost-1.57.0-p3/include/boost/function/function_template.hpp:153
#20 0x00007fd4005266f4 in boost::function0<void>::operator() (this=0x7fd353bb7ca0) at /opt/Impala-Toolchain/boost-1.57.0-p3/include/boost/function/function_template.hpp:767
#21 0x00007fd40020a44f in impala::Thread::SuperviseThread(std::string const&, std::string const&, boost::function<void ()>, impala::ThreadDebugInfo const*, impala::Promise<long, (impala::PromiseMode)0>*) (name=..., category=..., functor=..., 
    parent_thread_info=0x7fd354bbb950, thread_started=0x7fd354bba8f0) at /home/boroknagyz/Impala/be/src/util/thread.cc:360
#22 0x00007fd400213e13 in boost::_bi::list5<boost::_bi::value<std::string>, boost::_bi::value<std::string>, boost::_bi::value<boost::function<void ()> >, boost::_bi::value<impala::ThreadDebugInfo*>, boost::_bi::value<impala::Promise<long, (impala::PromiseMode)0>*> >::operator()<void (*)(std::string const&, std::string const&, boost::function<void ()>, impala::ThreadDebugInfo const*, impala::Promise<long, (impala::PromiseMode)0>*), boost::_bi::list0>(boost::_bi::type<void>, void (*&)(std::string const&, std::string const&, boost::function<void ()>, impala::ThreadDebugInfo const*, impala::Promise<long, (impala::PromiseMode)0>*), boost::_bi::list0&, int) (this=0x739f1c0, 
    f=@0x739f1b8: 0x7fd40020a0e8 <impala::Thread::SuperviseThread(std::string const&, std::string const&, boost::function<void ()>, impala::ThreadDebugInfo const*, impala::Promise<long, (impala::PromiseMode)0>*)>, a=...)
    at /opt/Impala-Toolchain/boost-1.57.0-p3/include/boost/bind/bind.hpp:525
#23 0x00007fd400213d37 in boost::_bi::bind_t<void, void (*)(std::string const&, std::string const&, boost::function<void ()>, impala::ThreadDebugInfo const*, impala::Promise<long, (impala::PromiseMode)0>*), boost::_bi::list5<boost::_bi::value<std::string>, boost::_bi::value<std::string>, boost::_bi::value<boost::function<void ()> >, boost::_bi::value<impala::ThreadDebugInfo*>, boost::_bi::value<impala::Promise<long, (impala::PromiseMode)0>*> > >::operator()() (this=0x739f1b8)
    at /opt/Impala-Toolchain/boost-1.57.0-p3/include/boost/bind/bind_template.hpp:20
#24 0x00007fd400213cfa in boost::detail::thread_data<boost::_bi::bind_t<void, void (*)(std::string const&, std::string const&, boost::function<void ()>, impala::ThreadDebugInfo const*, impala::Promise<long, (impala::PromiseMode)0>*), boost::_bi::list5<boost::_bi::value<std::string>, boost::_bi::value<std::string>, boost::_bi::value<boost::function<void ()> >, boost::_bi::value<impala::ThreadDebugInfo*>, boost::_bi::value<impala::Promise<long, (impala::PromiseMode)0>*> > > >::run() (this=0x739f000)
    at /opt/Impala-Toolchain/boost-1.57.0-p3/include/boost/thread/detail/thread.hpp:116
#25 0x0000000000a3bcaa in thread_proxy ()
#26 0x00007fd3fb60a6ba in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#27 0x00007fd3f612c41d in clone () from /lib/x86_64-linux-gnu/libc.so.6

The problem is in be/src/exec/grouping-aggregator-ir.cc:204:

AggFnEvaluator::Serialize(agg_fn_evals_, out_batch_iter.Get()->GetTuple(0));

GetTuple() should be called with 'agg_idx' instead of zero.

Issue Links

• is related to: IMPALA-10104 multiple if funtion and multiple-agg cause impalad crashed