OLAP: SIGSEGV in IFetchingStep::DebugString / ProfileDebugString (script.cpp:73) on UploadTpch1000

[naspirato]

Фактура

Suite / DB	UploadTpch1000 / sas_big_column
Branch · Version	main · d6dd620
Run	2026-07-27_d6dd620 · 2026-07-27T08:24:30 UTC
Allure	https://proxy.sandbox.yandex-team.ru/12931774388/index.html
Failed	UploadTpch1000.Query05 (SIGSEGV → node down)

Что сломалось

SIGSEGV (signal 11) в IFetchingStep::DebugString (script.cpp:73) при TColumnShardScan::Finish / ProfileDebugString — краш на сборке debug-строки reader script.

К чему приводит

• Crash dyn-ноды sas9-1608 (после рестарта Registered as 50075)
• Соседние query видят node down / connection lost

Детали ошибки

Host: sas9-1608.host.testing.ydb.yandex.net
Coredump: https://coredumps.yandex-team.ru/v3/cores?filter=program_type%3Dkikimr%3B+%40cluster_name%3Dolap-testing-sas-perf&since_ts=2026-07-27T11%3A59%3A13.829277%2B03%3A00&till_ts=2026-07-27T12%3A00%3A01.873667%2B03%3A00

Received signal 11
Backtrace:
#0 std::__y1::__function::__value_func<void (int, siginfo_t*, void*)>::operator()[abi:ne210000](int&&, siginfo_t*&&, void*&&) const at /-S/contrib/libs/cxxsupp/libcxx/include/__functional/function.h:299:0
#1 std::__y1::function<void (int, siginfo_t*, void*)>::operator()(int, siginfo_t*, void*) const at /-S/contrib/libs/cxxsupp/libcxx/include/__functional/function.h:825:0
#2 (anonymous namespace)::SetSignalHandler(int, std::__y1::function<void (int, siginfo_t*, void*)>&&, sigaction*)::$_0::operator()(int, siginfo_t*, void*) const at /-S/ydb/library/signal_backtrace/signal_backtrace.cpp:32:0
#3 (anonymous namespace)::SetSignalHandler(int, std::__y1::function<void (int, siginfo_t*, void*)>&&, sigaction*)::$_0::__invoke(int, siginfo_t*, void*) at /-S/ydb/library/signal_backtrace/signal_backtrace.cpp:31:0
#4 ??? at ???:0:0
#5 ??? at ???:0:0
#6 char* std::__y1::__constexpr_memmove[abi:ne210000]<char, char const>(char*, char const*, std::__y1::__element_count) at /-S/contrib/libs/cxxsupp/libcxx/include/__string/constexpr_c_functions.h:229:0
#7 std::__y1::char_traits<char>::copy[abi:ne210000](char*, char const*, unsigned long) at /-S/contrib/libs/cxxsupp/libcxx/include/__string/char_traits.h:247:0
#8 std::__y1::basic_string<char, std::__y1::char_traits<char>, std::__y1::allocator<char>>::append(char const*, unsigned long) at /-S/contrib/libs/cxxsupp/libcxx/include/string:3040:0
#9 std::__y1::enable_if<!std::is_scalar<TBasicString<char, std::__y1::char_traits<char>>>::value, IOutputStream&>::type operator<<<TBasicString<char, std::__y1::char_traits<char>>>(IOutputStream&, TBasicString<char, std::__y1::char_traits<char>> const&) at /-S/util/stream/output.h:238:0
#10 NPrivateStringBuilder::TStringBuilder& NPrivateStringBuilder::operator<<<TBasicString<char, std::__y1::char_traits<char>>>(NPrivateStringBuilder::TStringBuilder&, TBasicString<char, std::__y1::char_traits<char>> const&) at /-S/util/string/builder.h:26:0
#11 NKikimr::NOlap::NReader::NCommon::IFetchingStep::DebugString(bool) const at /-S/ydb/core/tx/columnshard/engines/reader/common_reader/common/script.cpp:73:0
#12 NKikimr::NOlap::NReader::NCommon::TFetchingScript::ProfileDebugString() const at /-S/ydb/core/tx/columnshard/engines/reader/common_reader/common/script.cpp:28:0
#13 NKikimr::NOlap::NReader::NCommon::TFetchingScriptOwner::ProfileDebugString() const at /-S/ydb/core/tx/columnshard/engines/reader/common_reader/common/script.h:121:0
#14 NKikimr::NOlap::NReader::NTrivial::TSpecialReadContext::ProfileDebugString() const at /-S/ydb/core/tx/columnshard/engines/reader/trivial_reader/iterator/context.cpp:167:0
#15 NKikimr::NOlap::NReader::NTrivial::TPlainReadData::DoDebugString(bool) const at /-S/ydb/core/tx/columnshard/engines/reader/trivial_reader/iterator/plain_read_data.h:32:0
#16 NKikimr::NOlap::NReader::IDataReader::DebugString(bool) const at /-S/ydb/core/tx/columnshard/engines/reader/abstract/read_context.h:232:0
#17 NKikimr::NOlap::NReader::NCommon::TColumnShardScanIterator::DebugString(bool) const at /-S/ydb/core/tx/columnshard/engines/reader/common_reader/iterator/iterator.cpp:30:0
#18 NKikimr::NOlap::NReader::TColumnShardScan::Finish(NKikimr::NColumnShard::TScanCounters::EStatusFinish) at /-S/ydb/core/tx/columnshard/engines/reader/actor/actor.cpp:593:0
#19 NKikimr::NOlap::NReader::TColumnShardScan::ContinueProcessing() at /-S/ydb/core/tx/columnshard/engines/reader/actor/actor.cpp:431:0
#20 NKikimr::NOlap::NReader::TColumnShardScan::HandleScan(TAutoPtr<NActors::TEventHandle<NKikimr::NKqp::TEvKqpCompute::TEvScanDataAck>, TDelete>&) at /-S/ydb/core/tx/columnshard/engines/reader/actor/actor.cpp:180:0
#21 NKikimr::NOlap::NReader::TColumnShardScan::StateScan(TAutoPtr<NActors::IEventHandle, TDelete>&) at /-S/ydb/core/tx/columnshard/engines/reader/actor/actor.h:58:0
#22 NActors::IActor::Receive(TAutoPtr<NActors::IEventHandle, TDelete>&) at /-S/ydb/library/actors/core/actor.cpp:422:0
#23 NActors::TExecutorThread::Execute(NActors::TMailbox*, bool, long) at /-S/ydb/library/actors/core/executor_thread.cpp:279:0
#24 NActors::TExecutorThread::ProcessExecutorPool()::$_0::operator()(NActors::TMailbox*, bool, long) const at /-S/ydb/library/actors/core/executor_thread.cpp:468:0
#25 NActors::TExecutorThread::ProcessExecutorPool() at /-S/ydb/library/actors/core/executor_thread.cpp:520:0
#26 NActors::TExecutorThread::ThreadProc() at /-S/ydb/library/actors/core/executor_thread.cpp:546:0
#27 (anonymous namespace)::TPosixThread::ThreadProxy(void*) at /-S/util/system/thread.cpp:245:0
#28 ??? at ???:0:0
#29 ??? at ???:0:0

Код

Место падения	script.cpp:71-79 @ d6dd620 IFetchingStep::DebugString
Менялся ли файл в окне	нет (da957bd…d6dd620)
Когда файл меняли последний раз	история кода, не виновник разбираемого прогона
Связанный issue	нет

[lberserq]

Investigated. The crash path (Finish with EnableDiagnostics → ProfileDebugString over CacheFetchingScripts) contains real UB, fixed in #48139:

1. TFetchingScriptOwner published Script (plain shared_ptr) without synchronization — HasScript()/ProfileDebugString()/GetScriptVerified() read it while FinishInitialization() assigns it. In the plain reader initialization runs on conveyor threads (TDetectInMem → GetColumnsFetchingPlan), so the torn read is a provable data race (TSan-confirmed by the new TestScript::OwnerConcurrentInitialization test, which fails before the fix and is clean after). Reads are now gated on the InitializationDetector acquire load paired with the release CAS.
2. The iterator-error path in ContinueProcessing calls Finish after ScanIterator.reset(), and Finish dereferenced ScanIterator->DebugString(true) unguarded — a guaranteed null deref for any failed scan with diagnostics enabled.
3. TFetchingScript::FinishInstant was uninitialized and read by ProfileDebugString.

Caveat: in the trivial reader (the one in this coredump) all script-cache writers trace to the scan actor thread, so this particular crash may also be a victim of the systemic scan-pipeline heap corruption tracked in #47942. The fixed defects match the crash signature and are real regardless.