This is an automated email from the ASF dual-hosted git repository.

kxiao pushed a commit to branch branch-2.0
in repository https://gitbox.apache.org/repos/asf/doris.git

commit 58d26b9dc205bb2b04dbd2cad88992b5d1c9ff4e
Author: lihangyu <[email protected]>
AuthorDate: Fri Sep 22 19:48:05 2023 +0800

    [Fix](topn opt) fix heap use after free when shrink in fetch phase (#24774)
---
 be/src/exec/rowid_fetcher.cpp                      | 15 +++----
 .../data/query_p0/test_array_orderby_limit.out     |  4 ++
 .../query_p0/test_array_orderby_limit.groovy       | 48 ++++++++++++++++++++++
 3 files changed, 60 insertions(+), 7 deletions(-)

diff --git a/be/src/exec/rowid_fetcher.cpp b/be/src/exec/rowid_fetcher.cpp
index af8e71eed00..6a937932eac 100644
--- a/be/src/exec/rowid_fetcher.cpp
+++ b/be/src/exec/rowid_fetcher.cpp
@@ -44,8 +44,9 @@
 #include "olap/tablet_schema.h"
 #include "olap/utils.h"
 #include "runtime/descriptors.h"
-#include "runtime/exec_env.h"       // ExecEnv
-#include "runtime/runtime_state.h"  // RuntimeState
+#include "runtime/exec_env.h"      // ExecEnv
+#include "runtime/runtime_state.h" // RuntimeState
+#include "runtime/types.h"
 #include "util/brpc_client_cache.h" // BrpcClientCache
 #include "util/defer_op.h"
 #include "vec/columns/column.h"
@@ -232,17 +233,17 @@ Status RowIDFetcher::fetch(const vectorized::ColumnPtr& 
column_row_ids,
     // shrink for char type
     std::vector<size_t> char_type_idx;
     for (size_t i = 0; i < _fetch_option.desc->slots().size(); i++) {
-        auto column_desc = _fetch_option.desc->slots()[i];
-        auto type_desc = column_desc->type();
+        const auto& column_desc = _fetch_option.desc->slots()[i];
+        const TypeDescriptor* type_desc = &column_desc->type();
         do {
-            if (type_desc.type == TYPE_CHAR) {
+            if (type_desc->type == TYPE_CHAR) {
                 char_type_idx.emplace_back(i);
                 break;
-            } else if (type_desc.type != TYPE_ARRAY) {
+            } else if (type_desc->type != TYPE_ARRAY) {
                 break;
             }
             // for Array<Char> or Array<Array<Char>>
-            type_desc = type_desc.children[0];
+            type_desc = &type_desc->children[0];
         } while (true);
     }
     res_block->shrink_char_type_column_suffix_zero(char_type_idx);
diff --git a/regression-test/data/query_p0/test_array_orderby_limit.out 
b/regression-test/data/query_p0/test_array_orderby_limit.out
new file mode 100644
index 00000000000..abcea7af965
--- /dev/null
+++ b/regression-test/data/query_p0/test_array_orderby_limit.out
@@ -0,0 +1,4 @@
+-- This file is automatically generated. You should know what you did if you 
want to edit this
+-- !select --
+100    [["abc"]]
+
diff --git a/regression-test/suites/query_p0/test_array_orderby_limit.groovy 
b/regression-test/suites/query_p0/test_array_orderby_limit.groovy
new file mode 100644
index 00000000000..b63d936dfc6
--- /dev/null
+++ b/regression-test/suites/query_p0/test_array_orderby_limit.groovy
@@ -0,0 +1,48 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+suite("test_array_char_orderby", "query") {
+    // define a sql table
+    def testTable = "test_array_char_orderby"
+
+    sql """
+            CREATE TABLE IF NOT EXISTS ${testTable} (
+              `k1` INT(11) NULL,
+              `k2` array<array<char(50)>> NULL,
+            ) ENGINE=OLAP
+            DUPLICATE KEY(`k1`)
+            COMMENT 'OLAP'
+            DISTRIBUTED BY HASH(`k1`) BUCKETS 1
+            PROPERTIES (
+            "replication_allocation" = "tag.location.default: 1",
+            "in_memory" = "false",
+            "storage_format" = "V2",
+            "disable_auto_compaction" = "false"
+            )
+            """
+    // prepare data
+    sql """ INSERT INTO ${testTable} VALUES (100, [['abc']]) """
+    // set topn_opt_limit_threshold = 1024 to make sure _internal_service to 
be request with proto request
+    sql """ set topn_opt_limit_threshold = 1024 """
+
+    explain{
+        sql("select * from ${testTable} order by k1 limit 1")
+        contains "TOPN"
+    }
+
+    qt_select """ select * from ${testTable} order by k1 limit 1 """
+}


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to