This is an automated email from the ASF dual-hosted git repository.
yiguolei pushed a commit to branch branch-4.0
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/branch-4.0 by this push:
new 64975c0e1ad branch-4.0: [fix](cloud) Fix CloudRowsetWriter vtable
use-after-free in delete bitmap task #60528 (#60708)
64975c0e1ad is described below
commit 64975c0e1ad167fada9379a7e18248a52e641940
Author: github-actions[bot]
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Fri Feb 13 00:00:14 2026 +0800
branch-4.0: [fix](cloud) Fix CloudRowsetWriter vtable use-after-free in
delete bitmap task #60528 (#60708)
Cherry-picked from #60528
Co-authored-by: Xin Liao <[email protected]>
---
be/src/cloud/cloud_rowset_writer.cpp | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/be/src/cloud/cloud_rowset_writer.cpp
b/be/src/cloud/cloud_rowset_writer.cpp
index d4a9fbce7e2..0c1b79392e9 100644
--- a/be/src/cloud/cloud_rowset_writer.cpp
+++ b/be/src/cloud/cloud_rowset_writer.cpp
@@ -26,7 +26,16 @@ namespace doris {
CloudRowsetWriter::CloudRowsetWriter(CloudStorageEngine& engine) :
_engine(engine) {}
-CloudRowsetWriter::~CloudRowsetWriter() = default;
+CloudRowsetWriter::~CloudRowsetWriter() {
+ // Must cancel any pending delete bitmap tasks before destruction.
+ // Otherwise, the lambda in _generate_delete_bitmap may execute after the
+ // CloudRowsetWriter destructor runs but before BaseBetaRowsetWriter
destructor,
+ // causing virtual function calls to resolve to
BaseBetaRowsetWriter::_build_rowset_meta
+ // instead of CloudRowsetWriter::_build_rowset_meta (use-after-free on
vtable).
+ if (_calc_delete_bitmap_token != nullptr) {
+ _calc_delete_bitmap_token->cancel();
+ }
+}
Status CloudRowsetWriter::init(const RowsetWriterContext&
rowset_writer_context) {
_context = rowset_writer_context;
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
