Repository navigation
Fix Collector use-after-free during process exit - #3721
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
An active concurrency defect can allow a post-shutdown submission to escape final cleanup, and the regression tests do not cover the pre-main initialization teardown ordering.
2 open issues
What changed in this PR
This pull request adds coordinated shutdown for the process-wide bvar collector, ensuring worker threads finish before RPC dump configuration is destroyed during process exit.
Changes:
- Adds synchronized collector initialization and shutdown with an atomic stop state.
- Stops and joins collector workers, cleans up pending samples, and rejects post-shutdown submissions.
- Adds RPC dump exit-ordering safeguards.
- Adds shutdown, concurrency, and process-exit regression tests.
This pull request requires changes.
| File | Description |
|---|---|
test/brpc_collector_shutdown_unittest.cpp |
Adds process-exit and concurrency tests for collector shutdown behavior. |
src/bvar/collector.h |
Declares the internal collector shutdown hook and documents post-shutdown submission behavior. |
src/bvar/collector.cpp |
Implements serialized initialization, shutdown coordination, worker joining, pending-sample cleanup, and shutdown-aware submissions. |
src/brpc/rpc_dump.cpp |
Registers RPC dump shutdown before its flags are destroyed. |
Review effort: Lite
8eed801 to
7afeb4d
Compare
7afeb4d to
9635481
Compare
There was a problem hiding this comment.
🔵 Needs a closer look
Runtime sanitizer/build validation across pthread and TLS shutdown interleavings, atexit and static teardown ordering, and supported link modes was unavailable, leaving correctness and duplicate-source test-linking unconfirmed.
No open issues 🎉
2 resolved since last review
Review effort: Lite


What problem does this PR solve?
Issue Number: resolve
Problem Summary:
Collector uses a leaky singleton, so its destructor never stops its worker threads during normal process exit. A pending RPC dump can therefore read
rpc_dump_dirafter its string storage has been destroyed, causing a heap-use-after-free.What is changed and the side effects?
Changed:
main().Side effects:
Performance effects:
Breaking backward compatibility:
Check List: