Repository navigation
Antalya 26.6, backport of 120098: Keep the target storage alive for a snapshot handed out by an Alias table - #2557
Merged
mkmkme merged 4 commits intoOct 13, 2026
Conversation
`StorageSnapshot` keeps a bare reference to its storage, and `Alias` returned that snapshot after the temporary from `getTargetTable` was destroyed. This brings `withStorageHolder` from upstream, cloning snapshot `Data` because it is still a `unique_ptr` on this branch. https: //github.com/ClickHouse/pull/120098 Co-authored-by: Cursor <cursoragent@cursor.com>
9 of 30 tasks
ianton-ru
changed the title
`getStorageSnapshotWithoutData` had no pin test, and the data clone was only exercised with an empty snapshot. The stateless join now goes through a `View`, because an `Alias` of a `Distributed` table does not itself request filter collection. Related: #2557 Co-authored-by: Cursor <cursoragent@cursor.com>
ianton-ru
changed the title
A null snapshot made the pointer comparison pass even when `clone` dropped the field. Related: #2557 Co-authored-by: Cursor <cursoragent@cursor.com>
mkmkme
approved these changes
Oct 13, 2026
zvonand
added a commit
that referenced
this pull request
Oct 20, 2026
`StorageSnapshot` keeps a bare reference to its storage, and `Alias` returned that snapshot after the temporary from `getTargetTable` was destroyed. `DataLakeCatalog` builds a new storage on every lookup, so the analyzer read freed memory under ASan in `test_alias_iceberg_catalog_cluster`. https://altinity-build-artifacts.s3.amazonaws.com/json.html?PR=2578&sha=d283c4830fe3a292b75b983c3887adc8641d6243&name_0=PR&name_1=Integration%20tests%20%28amd_asan_ubsan%2C%20db%20disk%2C%20old%20analyzer%2C%204%2F8%29 Related: #2578 Related: ClickHouse#120098 Related: #2557
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of ClickHouse#120098.
StorageSnapshotrefers to its storage through a bare reference.Alias::getStorageSnapshotforwards togetTargetTable, and that call returns the owning pointer by value, so it dies at the end of the expression. The snapshot then refers to the target with no owner, while the query owns and share-locks theAliasinstead. ASan reported this as a heap-use-after-free inQueryAnalyzer::initializeTableExpressionDatafor anAliasover a catalogIcebergtable. Upstream fixed the same lifetime gap after a TSan report during join reordering.The upstream change adds
withStorageHolder, which returns a new snapshot instead of writing the holder into a snapshot that other readers of the query may already share. AnAliaschain keeps the first holder, so the pin stays on the innermost storage.clonecopies the holder.On this branch snapshot
Datais still aunique_ptr. ClickHouse#110186 changed it toshared_ptr<const Data>onmaster, and ClickHouse#120098 then copies that pointer insidewithStorageHolder. Pull request 110186 is not inantalya-26.6, so this backport cannot shareDatathe same way.withStorageHolderclones it instead, which addscloneon theMergeTree,Memory, and hybridDistributedsnapshot data. That is why this backport is larger than the original pull request.Changelog category (leave one):
Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):
Reading through an
Aliasno longer uses a freed target storage. The snapshot keeps that storage alive until the query releases it.Documentation entry for user-facing changes
No user-facing documentation change.
CI/CD Options
Exclude tests:
Regression jobs to run: