Skip to content

span.cpp中destroy()方法存在内存重复释放问题,会导致服务崩掉 #3068

@Silocean

Description

@Silocean

Describe the bug
服务开启enable_rpcz后,上线跑一段时间就会内存暴涨然后core掉,经排查定位发现在destroy()中存在内存重复释放问题。

void Span::destroy() {
    EndAsParent();
    Span* p = _next_client;
    while (p) {
        if (p == this) {
            LOG(ERROR) << "Span next_client points to self, span_id=" << p->_span_id;
        }
        Span* p_next = p->_next_client;
        p->_info.clear();
        butil::return_object(p);
        p = p_next;
    }
    _info.clear();
    butil::return_object(this);
}

如上代码,ERROR日志是我debug时加的,经过验证在服务core掉时确实打印了该行日志。
说明span链表中有span异常指向了自身。

这个问题的根源是什么?新版本是否有解决该问题?

To Reproduce

Expected behavior

Versions
OS: centos7.6
Compiler: gcc4.8.5
brpc: 0.9.0
protobuf:

Additional context/screenshots

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions