Skip to content

[fix](be) Fix SEGV in OrcReader when _row_reader is nullptr#63922

Open
heguanhui wants to merge 1 commit into
apache:masterfrom
heguanhui:fix/orc-reader-segv-when-row-reader-null
Open

[fix](be) Fix SEGV in OrcReader when _row_reader is nullptr#63922
heguanhui wants to merge 1 commit into
apache:masterfrom
heguanhui:fix/orc-reader-segv-when-row-reader-null

Conversation

@heguanhui
Copy link
Copy Markdown
Contributor

What problem does this PR solve?

Issue Number: close #63921

Related PR: #xxx

Problem Summary:

When OrcReader::_init_orc_row_reader() catches an exception from createRowReader with should_stop=true and error message "stop", it swallows the exception and returns Status::OK(), leaving _row_reader as nullptr. Subsequent calls to _seek_to_read_one_line() dereference the null _row_reader via _row_reader->seekToRow(), causing SEGV.

This is inconsistent with _create_file_reader() which returns Status::EndOfFile("stop") in the same should_stop scenario.

ASAN crash stack:

==XX==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000030
    #0 orc::RowReaderImpl::seekToRow(unsigned long)
    #1 doris::vectorized::OrcReader::_seek_to_read_one_line() vorc_reader.h:710
    #2 doris::vectorized::OrcReader::_get_next_block_impl() vorc_reader.cpp:2350

Root cause chain:

  1. _init_orc_row_reader() catch block: should_stop + "stop" → swallows exception, returns Status::OK(), _row_reader remains nullptr
  2. Caller sees Status::OK(), proceeds to call get_next_block()
  3. _get_next_block_impl()_seek_to_read_one_line()_row_reader->seekToRow() → SEGV

Fix:

  1. _init_orc_row_reader() catch block: return Status::EndOfFile("stop") instead of Status::OK(), consistent with _create_file_reader()
  2. _seek_to_read_one_line(): change return type from bool to Status, add DORIS_CHECK(_row_reader) assertion for precondition
  3. _get_next_block_impl(): adapt to handle Status return from _seek_to_read_one_line(), distinguish END_OF_FILE from other errors
  4. Test: EXPECT_TRUEASSERT_TRUE to prevent continuing after init failure

Release note

None

Check List (For Author)

  • Test

    • Regression test
    • Unit Test
    • Manual test (add detailed scripts or steps below)
    • No need to test or manual test. Explain why:
      • This is a refactor/code format and no logic has been changed.
      • Previous test can cover this change.
      • No code files have been changed.
      • Other reason
  • Behavior changed:

    • No.
    • Yes.
  • Does this need documentation?

    • No.
    • Yes.

Check List (For Reviewer who merge this PR)

  • Confirm the release note
  • Confirm test cases
  • Confirm document
  • Add branch pick label

@hello-stephen
Copy link
Copy Markdown
Contributor

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

  1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
  2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
  3. What features were added. Why was this function added?
  4. Which code was refactored and why was this part of the code refactored?
  5. Which functions were optimized and what is the difference before and after the optimization?

@heguanhui
Copy link
Copy Markdown
Contributor Author

:run buildall

@heguanhui
Copy link
Copy Markdown
Contributor Author

run buildall

@morrySnow morrySnow requested a review from Gabriel39 June 1, 2026 06:59
### What problem does this PR solve?

Issue Number: close apache#63921

Problem Summary: When OrcReader::_init_orc_row_reader() catches an exception
from createRowReader with should_stop=true and error message "stop", it
swallows the exception and returns Status::OK(), leaving _row_reader as
nullptr. Subsequent calls to _seek_to_read_one_line() dereference the null
_row_reader via _row_reader->seekToRow(), causing SEGV. This is inconsistent
with _create_file_reader() which returns Status::EndOfFile("stop") in the
same should_stop scenario.

### Release note

None

### Check List (For Author)

- Test: Unit Test
    - Existing OrcReadLinesTest can cover this change
- Behavior changed: No
- Does this need documentation: No
@heguanhui heguanhui force-pushed the fix/orc-reader-segv-when-row-reader-null branch from 7556630 to 340ae89 Compare June 1, 2026 16:25
@heguanhui
Copy link
Copy Markdown
Contributor Author

run buildall

@hello-stephen
Copy link
Copy Markdown
Contributor

TPC-H: Total hot run time: 28854 ms
machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpch-tools
Tpch sf100 test result on commit 340ae8951c0531ebd1fd7055bf20dd9ab8bd7be1, data reload: false

------ Round 1 ----------------------------------
orders	Doris	NULL	NULL	0	0	0	NULL	0	NULL	NULL	2023-12-26 18:27:23	2023-12-26 18:42:55	NULL	utf-8	NULL	NULL	
============================================
q1	17624	4092	4119	4092
q2	q3	10761	1366	829	829
q4	4687	476	349	349
q5	7550	869	585	585
q6	187	175	137	137
q7	788	861	629	629
q8	9921	1564	1533	1533
q9	6592	4518	4486	4486
q10	6834	1853	1506	1506
q11	437	275	250	250
q12	659	426	289	289
q13	18187	3431	2770	2770
q14	277	253	237	237
q15	q16	821	772	709	709
q17	987	859	969	859
q18	6838	5668	5537	5537
q19	1364	1320	1112	1112
q20	511	398	253	253
q21	5914	2626	2394	2394
q22	437	367	298	298
Total cold run time: 101376 ms
Total hot run time: 28854 ms

----- Round 2, with runtime_filter_mode=off -----
orders	Doris	NULL	NULL	150000000	42	6422171781	NULL	22778155	NULL	NULL	2023-12-26 18:27:23	2023-12-26 18:42:55	NULL	utf-8	NULL	NULL	
============================================
q1	4485	4537	4480	4480
q2	q3	4714	5132	4393	4393
q4	2094	2214	1379	1379
q5	4413	4334	4347	4334
q6	231	173	129	129
q7	1782	2129	1840	1840
q8	2582	2285	2189	2189
q9	8271	8058	8194	8058
q10	4852	4744	4275	4275
q11	603	460	396	396
q12	751	752	528	528
q13	3590	3610	2971	2971
q14	323	313	290	290
q15	q16	736	718	649	649
q17	1395	1383	1335	1335
q18	8387	7664	6996	6996
q19	1112	1140	1120	1120
q20	2219	2230	1967	1967
q21	5403	4649	4492	4492
q22	524	453	397	397
Total cold run time: 58467 ms
Total hot run time: 52218 ms

@hello-stephen
Copy link
Copy Markdown
Contributor

TPC-DS: Total hot run time: 171252 ms
machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpcds-tools
TPC-DS sf100 test result on commit 340ae8951c0531ebd1fd7055bf20dd9ab8bd7be1, data reload: false

query5	4330	695	522	522
query6	326	237	218	218
query7	4282	540	319	319
query8	342	243	221	221
query9	8823	4101	4070	4070
query10	475	344	304	304
query11	5714	2342	2198	2198
query12	183	137	129	129
query13	1304	643	444	444
query14	6138	5510	5169	5169
query14_1	4595	4576	4519	4519
query15	216	202	184	184
query16	976	447	456	447
query17	979	725	592	592
query18	2465	480	355	355
query19	220	212	169	169
query20	138	139	135	135
query21	224	148	119	119
query22	13632	13528	13357	13357
query23	17228	16496	16279	16279
query23_1	16432	16217	16247	16217
query24	7594	1786	1291	1291
query24_1	1321	1313	1317	1313
query25	573	500	436	436
query26	1362	336	182	182
query27	2667	581	360	360
query28	4493	2003	2005	2003
query29	1004	653	508	508
query30	315	240	200	200
query31	1154	1078	968	968
query32	97	83	83	83
query33	550	396	314	314
query34	1196	1135	681	681
query35	777	803	720	720
query36	1446	1399	1226	1226
query37	162	111	97	97
query38	3221	3186	3074	3074
query39	934	904	896	896
query39_1	863	876	889	876
query40	239	157	137	137
query41	72	69	70	69
query42	118	117	117	117
query43	352	354	311	311
query44	
query45	222	207	204	204
query46	1118	1235	752	752
query47	2339	2351	2259	2259
query48	408	435	304	304
query49	668	518	411	411
query50	1019	369	268	268
query51	4313	4336	4203	4203
query52	112	114	102	102
query53	258	286	221	221
query54	342	313	289	289
query55	97	94	88	88
query56	329	327	327	327
query57	1463	1407	1311	1311
query58	322	284	291	284
query59	1585	1698	1435	1435
query60	345	353	329	329
query61	192	191	187	187
query62	720	653	599	599
query63	252	209	216	209
query64	2515	888	651	651
query65	
query66	1716	480	359	359
query67	29878	29675	28835	28835
query68	
query69	469	343	310	310
query70	1024	1010	963	963
query71	314	286	275	275
query72	2993	2708	2515	2515
query73	849	752	440	440
query74	5116	4934	4732	4732
query75	2711	2611	2281	2281
query76	2308	1187	777	777
query77	416	419	346	346
query78	12440	12493	11868	11868
query79	1469	1037	767	767
query80	685	551	476	476
query81	463	281	238	238
query82	1354	159	131	131
query83	342	281	262	262
query84	312	143	117	117
query85	899	554	470	470
query86	412	344	331	331
query87	3417	3362	3252	3252
query88	3701	2784	2777	2777
query89	461	393	361	361
query90	1873	189	187	187
query91	177	172	141	141
query92	79	79	72	72
query93	1600	1455	952	952
query94	533	360	345	345
query95	686	483	355	355
query96	1040	812	348	348
query97	2716	2700	2621	2621
query98	243	231	230	230
query99	1162	1197	1028	1028
Total cold run time: 254878 ms
Total hot run time: 171252 ms

@hello-stephen
Copy link
Copy Markdown
Contributor

BE UT Coverage Report

Increment line coverage 78.57% (11/14) 🎉

Increment coverage report
Complete coverage report

Category Coverage
Function Coverage 54.08% (21052/38925)
Line Coverage 37.59% (199412/530440)
Region Coverage 33.89% (156301/461268)
Branch Coverage 34.83% (67905/194970)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] BE SEGV in OrcReader::_seek_to_read_one_line when _row_reader is nullptr

2 participants