记一次 rr 和硬件断点解决内存踩踏问题

在日常的调试过程中，我们总会遇到一些有趣的 bug，在本文我就遇到了一个有意思的查询结果不一致问题。

故事的开始

我们在测试 NebulaGraph 的 MATCH 语句的时候发现一个很神奇的事情：

(root@nebula) [gdlancer]> match (v1)-[e*1..1]->(v2) where id(v1) in [1, 2, 3, 4] and (v2)-[e*1..1]->(v1) return e; +-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | e | +-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | [[:Rel_5 2->2 @0 {Rel_5_0_Bool: true, Rel_5_1_Bool: true, Rel_5_2_Double: 0.533698, Rel_5_3_String: "Stephen Curry", Rel_5_4_Double: 0.162998}]] | | [[:Rel_1 2->2 @0 {Rel_1_0_Int: 3, Rel_1_1_Int: 5, Rel_1_2_Int: 81, Rel_1_3_Double: 0.975062, Rel_1_4_Bool: true, Rel_1_5_Int: 59}]] | | [[:Rel_0 2->2 @0 {Rel_0_0_Bool: true, Rel_0_1_String: "Kevin Durant", Rel_0_2_String: "Joel Embiid", Rel_0_3_Int: 96, Rel_0_4_Double: 0.468568, Rel_0_5_Int: 98, Rel_0_6_Int: 77}]] | | [[:Rel_2 2->2 @0 {Rel_2_0_Int: 38, Rel_2_1_Double: 0.120953, Rel_2_2_String: "Null1", Rel_2_3_Bool: false, Rel_2_4_Bool: true, Rel_2_5_Int: 6, Rel_2_6_String: "Tracy McGrady"}]] | | [[:Rel_3 2->2 @0 {Rel_3_0_String: "Aron Baynes", Rel_3_1_String: "LeBron James", Rel_3_2_Double: 0.831096, Rel_3_3_Int: 11}]] | | [[:Rel_4 2->2 @0 {Rel_4_0_Bool: true, Rel_4_1_String: "Kevin Durant", Rel_4_2_Double: 0.71757, Rel_4_3_String: "Marc Gasol", Rel_4_4_Double: 0.285247, Rel_4_5_String: "Cory Joseph"}]] | +-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ Got 6 rows (time spent 146.7ms/168.31625ms) Tue, 03 Jan 2023 14:10:03 CST (root@nebula) [gdlancer]> match (v1)-[e*1..1]->(v2) where id(v1) in [1, 2, 3, 4] and (v2)-[e*1..1]->(v1) return e; +---+ | e | +---+ +---+ Empty set (time spent 30.67ms/58.220042ms) Tue, 03 Jan 2023 14:10:05 CST 

同样的语句，两次查询的结果集居然不一样！

开始 Debug

profile 出问题的语句：

(root@nebula) [gdlancer]> profile match (v1)-[e*1..1]->(v2) where id(v1) in [1, 2, 3, 4] and (v2)-[e*1..1]->(v1) return e; +---+ | e | +---+ +---+ Empty set (time spent 18.755ms/79.84375ms) Execution Plan (optimize time 1656 us) -----+----------------+--------------+------------------------------------------------------+---------------------------------------------------------------------------- | id | name | dependencies | profiling data | operator info | -----+----------------+--------------+------------------------------------------------------+---------------------------------------------------------------------------- | 12 | Project | 11 | ver: 0, rows: 0, execTime: 17us, totalTime: 19us | outputVar: { | | | | | | "colNames": [ | | | | | | "e" | | | | | | ], | | | | | | "type": "DATASET", | | | | | | "name": "__Project_12" | | | | | | } | | | | | | inputVar: __Filter_11 | | | | | | columns: [ | | | | | | "$e" | | | | | | ] | -----+----------------+--------------+------------------------------------------------------+---------------------------------------------------------------------------- | 11 | Filter | 10 | ver: 0, rows: 0, execTime: 26us, totalTime: 29us | outputVar: { | | | | | | "colNames": [ | | | | | | "v1", | | | | | | "e", | | | | | | "v2" | | | | | | ], | | | | | | "type": "DATASET", | | | | | | "name": "__Filter_11" | | | | | | } | | | | | | inputVar: __PatternApply_10 | | | | | | condition: ((id($v1)==1) OR (id($v1)==2) OR (id($v1)==3) OR (id($v1)==4)) | | | | | | isStable: false | -----+----------------+--------------+------------------------------------------------------+---------------------------------------------------------------------------- | 10 | PatternApply | 6,9 | ver: 0, rows: 0, execTime: 84us, totalTime: 87us | outputVar: { | | | | | | "colNames": [ | | | | | | "v1", | | | | | | "e", | | | | | | "v2" | | | | | | ], | | | | | | "type": "DATASET", | | | | | | "name": "__PatternApply_10" | | | | | | } | | | | | | inputVar: { | | | | | | "rightVar": "__AppendVertices_9", | | | | | | "leftVar": "__Project_6" | | | | | | } | | | | | | keyCols: [ | | | | | | "id($-.v2)", | | | | | | "id($-.v1)" | | | | | | ] | -----+----------------+--------------+------------------------------------------------------+---------------------------------------------------------------------------- | 6 | Project | 5 | ver: 0, rows: 18, execTime: 103us, totalTime: 106us | outputVar: { | | | | | | "colNames": [ | | | | | | "v1", | | | | | | "e", | | | | | | "v2" | | | | | | ], | | | | | | "name": "__Project_6", | | | | | | "type": "DATASET" | | | | | | } | | | | | | inputVar: __AppendVertices_5 | | | | | | columns: [ | | | | | | "$-.v1 AS v1", | | | | | | "[__VAR_2 IN $-.e WHERE is_edge($__VAR_2)] AS e", | | | | | | "$-.v2 AS v2" | | | | | | ] | -----+----------------+--------------+------------------------------------------------------+---------------------------------------------------------------------------- | 5 | AppendVertices | 4 | { | outputVar: { | | | | | ver: 0, rows: 18, execTime: 438us, totalTime: 1613us | "colNames": [ | | | | | resp[2]: { | "v1", | | | | | "exec": "308(us)", | "e", | | | | | "host": "store1:9779", | "v2" | | | | | "total": "1114(us)" | ], | | | | | } | "name": "__AppendVertices_5", | | | | | total_rpc: 1350(us) | "type": "DATASET" | | | | | resp[0]: { | } | | | | | "exec": "356(us)", | inputVar: __Traverse_4 | | | | | "host": "store3:9779", | space: 8 | | | | | "total": "1248(us)" | dedup: true | | | | | } | limit: -1 | | | | | resp[1]: { | filter: | | | | | "exec": "323(us)", | orderBy: [] | | | | | "host": "store2:9779", | src: none_direct_dst($-.e) | | | | | "total": "966(us)" | props: [ | | | | | } | { | | | | | } | "tagId": 13, | | | | | | "props": [ | | | | | | "_tag" | | | | | | ] | | | | | | }, | | | | | | { | | | | | | "tagId": 12, | | | | | | "props": [ | | | | | | "_tag" | | | | | | ] | | | | | | }, | | | | | | { | | | | | | "props": [ | | | | | | "_tag" | | | | | | ], | | | | | | "tagId": 11 | | | | | | }, | | | | | | { | | | | | | "tagId": 9, | | | | | | "props": [ | | | | | | "_tag" | | | | | | ] | | | | | | }, | | | | | | { | | | | | | "tagId": 10, | | | | | | "props": [ | | | | | | "_tag" | | | | | | ] | | | | | | }, | | | | | | { | | | | | | "props": [ | | | | | | "_tag" | | | | | | ], | | | | | | "tagId": 14 | | | | | | }, | | | | | | { | | | | | | "props": [ | | | | | | "_tag" | | | | | | ], | | | | | | "tagId": 15 | | | | | | } | | | | | | ] | | | | | | exprs: | | | | | | vertex_filter: | | | | | | if_track_previous_path: true | -----+----------------+--------------+------------------------------------------------------+---------------------------------------------------------------------------- | 4 | Traverse | 2 | { | outputVar: { | | | | | ver: 0, rows: 18, execTime: 597us, totalTime: 2943us | "colNames": [ | | | | | step[1]: [ | "v1", | | | | | { | "e" | | | | | "exec": "811(us)", | ], | | | | | "host": "store2:9779", | "name": "__Traverse_4", | | | | | "storage_detail": { | "type": "DATASET" | | | | | "GetNeighborsNode": "551(us)", | } | | | | | "HashJoinNode": "415(us)", | inputVar: __Dedup_2 | | | | | "RelNode": "551(us)", | space: 8 | | | | | "SingleEdgeNode": "391(us)" | dedup: true | | | | | }, | limit: -1 | | | | | "total": "2139(us)", | filter: | | | | | "total_rpc_time": "2328(us)", | orderBy: [] | | | | | "vertices": 2 | src: $-._vid | | | | | }, | edgeTypes: [] | | | | | { | edgeDirection: OUT_EDGE | | | | | "exec": "769(us)", | vertexProps: | | | | | "host": "store1:9779", | edgeProps: [ | | | | | "storage_detail": { | { | | | | | "GetNeighborsNode": "259(us)", | "type": 21, | | | | | "HashJoinNode": "177(us)", | "props": [ | | | | | "RelNode": "259(us)", | "_src", | | | | | "SingleEdgeNode": "161(us)" | "_type", | | | | | }, | "_rank", | | | | | "total": "1938(us)", | "_dst", | | | | | "total_rpc_time": "2328(us)", | "Rel_5_0_Bool", | | | | | "vertices": 1 | "Rel_5_1_Bool", | | | | | }, | "Rel_5_4_Double", | | | | | { | "Rel_5_3_String", | | | | | "exec": "699(us)", | "Rel_5_2_Double" | | | | | "host": "store6:9779", | ] | | | | | "storage_detail": { | }, | | | | | "GetNeighborsNode": "161(us)", | { | | | | | "HashJoinNode": "152(us)", | "props": [ | | | | | "RelNode": "162(us)", | "_src", | | | | | "SingleEdgeNode": "142(us)" | "_type", | | | | | }, | "_rank", | | | | | "total": "1735(us)", | "_dst", | | | | | "total_rpc_time": "2328(us)", | "Rel_1_0_Int", | | | | | "vertices": 1 | "Rel_1_3_Double", | | | | | } | "Rel_1_2_Int", | | | | | ] | "Rel_1_4_Bool", | | | | | } | "Rel_1_5_Int", | | | | | | "Rel_1_1_Int" | | | | | | ], | | | | | | "type": 17 | | | | | | }, | | | | | | { | | | | | | "type": 16, | | | | | | "props": [ | | | | | | "_src", | | | | | | "_type", | | | | | | "_rank", | | | | | | "_dst", | | | | | | "Rel_0_6_Int", | | | | | | "Rel_0_0_Bool", | | | | | | "Rel_0_3_Int", | | | | | | "Rel_0_2_String", | | | | | | "Rel_0_4_Double", | | | | | | "Rel_0_1_String", | | | | | | "Rel_0_5_Int" | | | | | | ] | | | | | | }, | | | | | | { | | | | | | "type": 18, | | | | | | "props": [ | | | | | | "_src", | | | | | | "_type", | | | | | | "_rank", | | | | | | "_dst", | | | | | | "Rel_2_3_Bool", | | | | | | "Rel_2_1_Double", | | | | | | "Rel_2_4_Bool", | | | | | | "Rel_2_5_Int", | | | | | | "Rel_2_2_String", | | | | | | "Rel_2_6_String", | | | | | | "Rel_2_0_Int" | | | | | | ] | | | | | | }, | | | | | | { | | | | | | "type": 19, | | | | | | "props": [ | | | | | | "_src", | | | | | | "_type", | | | | | | "_rank", | | | | | | "_dst", | | | | | | "Rel_3_0_String", | | | | | | "Rel_3_3_Int", | | | | | | "Rel_3_1_String", | | | | | | "Rel_3_2_Double" | | | | | | ] | | | | | | }, | | | | | | { | | | | | | "props": [ | | | | | | "_src", | | | | | | "_type", | | | | | | "_rank", | | | | | | "_dst", | | | | | | "Rel_4_0_Bool", | | | | | | "Rel_4_2_Double", | | | | | | "Rel_4_5_String", | | | | | | "Rel_4_1_String", | | | | | | "Rel_4_4_Double", | | | | | | "Rel_4_3_String" | | | | | | ], | | | | | | "type": 20 | | | | | | } | | | | | | ] | | | | | | statProps: | | | | | | exprs: | | | | | | random: false | | | | | | steps: 1..1 | | | | | | vertex filter: | | | | | | edge filter: | | | | | | if_track_previous_path: false | | | | | | first step filter: | | | | | | tag filter: | -----+----------------+--------------+------------------------------------------------------+---------------------------------------------------------------------------- | 2 | Dedup | 1 | ver: 0, rows: 4, execTime: 16us, totalTime: 18us | outputVar: { | | | | | | "colNames": [ | | | | | | "_vid" | | | | | | ], | | | | | | "type": "DATASET", | | | | | | "name": "__Dedup_2" | | | | | | } | | | | | | inputVar: __VAR_1 | -----+----------------+--------------+------------------------------------------------------+---------------------------------------------------------------------------- | 1 | PassThrough | 3 | ver: 0, rows: 0, execTime: 14us, totalTime: 19us | outputVar: { | | | | | | "colNames": [ | | | | | | "_vid" | | | | | | ], | | | | | | "type": "DATASET", | | | | | | "name": "__VAR_1" | | | | | | } | | | | | | inputVar: | -----+----------------+--------------+------------------------------------------------------+---------------------------------------------------------------------------- | 3 | Start | | ver: 0, rows: 0, execTime: 2us, totalTime: 29us | outputVar: { | | | | | | "colNames": [], | | | | | | "type": "DATASET", | | | | | | "name": "__Start_3" | | | | | | } | -----+----------------+--------------+------------------------------------------------------+---------------------------------------------------------------------------- | 9 | AppendVertices | 8 | ver: 0, rows: 0, execTime: 46us, totalTime: 50us | outputVar: { | | | | | | "colNames": [ | | | | | | "v2", | | | | | | "e", | | | | | | "v1" | | | | | | ], | | | | | | "type": "DATASET", | | | | | | "name": "__AppendVertices_9" | | | | | | } | | | | | | inputVar: __Traverse_8 | | | | | | space: 8 | | | | | | dedup: true | | | | | | limit: -1 | | | | | | filter: | | | | | | orderBy: [] | | | | | | src: none_direct_dst($-.e) | | | | | | props: [ | | | | | | { | | | | | | "props": [ | | | | | | "_tag" | | | | | | ], | | | | | | "tagId": 13 | | | | | | }, | | | | | | { | | | | | | "props": [ | | | | | | "_tag" | | | | | | ], | | | | | | "tagId": 12 | | | | | | }, | | | | | | { | | | | | | "tagId": 11, | | | | | | "props": [ | | | | | | "_tag" | | | | | | ] | | | | | | }, | | | | | | { | | | | | | "tagId": 9, | | | | | | "props": [ | | | | | | "_tag" | | | | | | ] | | | | | | }, | | | | | | { | | | | | | "tagId": 10, | | | | | | "props": [ | | | | | | "_tag" | | | | | | ] | | | | | | }, | | | | | | { | | | | | | "tagId": 14, | | | | | | "props": [ | | | | | | "_tag" | | | | | | ] | | | | | | }, | | | | | | { | | | | | | "tagId": 15, | | | | | | "props": [ | | | | | | "_tag" | | | | | | ] | | | | | | } | | | | | | ] | | | | | | exprs: | | | | | | vertex_filter: | | | | | | if_track_previous_path: true | -----+----------------+--------------+------------------------------------------------------+---------------------------------------------------------------------------- | 8 | Traverse | 7 | { | outputVar: { | | | | | ver: 0, rows: 0, execTime: 4867us, totalTime: 9173us | "colNames": [ | | | | | step[2]: [ | "v2", | | | | | { | "e" | | | | | "exec": "488(us)", | ], | | | | | "host": "store2:9779", | "type": "DATASET", | | | | | "storage_detail": { | "name": "__Traverse_8" | | | | | "GetNeighborsNode": "371(us)", | } | | | | | "HashJoinNode": "261(us)", | inputVar: __Argument_7 | | | | | "RelNode": "371(us)", | space: 8 | | | | | "SingleEdgeNode": "243(us)" | dedup: true | | | | | }, | limit: -1 | | | | | "total": "1509(us)", | filter: | | | | | "total_rpc_time": "1948(us)", | orderBy: [] | | | | | "vertices": 2 | src: id($-.v2) | | | | | }, | edgeTypes: [] | | | | | { | edgeDirection: OUT_EDGE | | | | | "exec": "331(us)", | vertexProps: | | | | | "host": "store3:9779", | edgeProps: [ | | | | | "storage_detail": { | { | | | | | "GetNeighborsNode": "86(us)", | "type": 21, | | | | | "HashJoinNode": "63(us)", | "props": [ | | | | | "RelNode": "86(us)", | "_src", | | | | | "SingleEdgeNode": "54(us)" | "_type", | | | | | }, | "_rank", | | | | | "total": "1208(us)", | "_dst", | | | | | "total_rpc_time": "1948(us)", | "Rel_5_0_Bool", | | | | | "vertices": 1 | "Rel_5_1_Bool", | | | | | }, | "Rel_5_4_Double", | | | | | { | "Rel_5_3_String", | | | | | "exec": "686(us)", | "Rel_5_2_Double" | | | | | "host": "store5:9779", | ] | | | | | "storage_detail": { | }, | | | | | "GetNeighborsNode": "311(us)", | { | | | | | "HashJoinNode": "254(us)", | "props": [ | | | | | "RelNode": "311(us)", | "_src", | | | | | "SingleEdgeNode": "237(us)" | "_type", | | | | | }, | "_rank", | | | | | "total": "1532(us)", | "_dst", | | | | | "total_rpc_time": "1948(us)", | "Rel_1_0_Int", | | | | | "vertices": 2 | "Rel_1_3_Double", | | | | | }, | "Rel_1_2_Int", | | | | | { | "Rel_1_4_Bool", | | | | | "exec": "467(us)", | "Rel_1_5_Int", | | | | | "host": "store6:9779", | "Rel_1_1_Int" | | | | | "storage_detail": { | ], | | | | | "GetNeighborsNode": "173(us)", | "type": 17 | | | | | "HashJoinNode": "124(us)", | }, | | | | | "RelNode": "173(us)", | { | | | | | "SingleEdgeNode": "115(us)" | "type": 16, | | | | | }, | "props": [ | | | | | "total": "1368(us)", | "_src", | | | | | "total_rpc_time": "1948(us)", | "_type", | | | | | "vertices": 1 | "_rank", | | | | | }, | "_dst", | | | | | { | "Rel_0_6_Int", | | | | | "exec": "494(us)", | "Rel_0_0_Bool", | | | | | "host": "store1:9779", | "Rel_0_3_Int", | | | | | "storage_detail": { | "Rel_0_2_String", | | | | | "GetNeighborsNode": "238(us)", | "Rel_0_4_Double", | | | | | "HashJoinNode": "147(us)", | "Rel_0_1_String", | | | | | "RelNode": "239(us)", | "Rel_0_5_Int" | | | | | "SingleEdgeNode": "137(us)" | ] | | | | | }, | }, | | | | | "total": "1246(us)", | { | | | | | "total_rpc_time": "1948(us)", | "type": 18, | | | | | "vertices": 1 | "props": [ | | | | | } | "_src", | | | | | ] | "_type", | | | | | step[3]: [ | "_rank", | | | | | { | "_dst", | | | | | "exec": "643(us)", | "Rel_2_3_Bool", | | | | | "host": "store5:9779", | "Rel_2_1_Double", | | | | | "storage_detail": { | "Rel_2_4_Bool", | | | | | "GetNeighborsNode": "432(us)", | "Rel_2_5_Int", | | | | | "HashJoinNode": "296(us)", | "Rel_2_2_String", | | | | | "RelNode": "433(us)", | "Rel_2_6_String", | | | | | "SingleEdgeNode": "272(us)" | "Rel_2_0_Int" | | | | | }, | ] | | | | | "total": "1556(us)", | }, | | | | | "total_rpc_time": "1913(us)", | { | | | | | "vertices": 3 | "type": 19, | | | | | }, | "props": [ | | | | | { | "_src", | | | | | "exec": "581(us)", | "_type", | | | | | "host": "store6:9779", | "_rank", | | | | | "storage_detail": { | "_dst", | | | | | "GetNeighborsNode": "255(us)", | "Rel_3_0_String", | | | | | "HashJoinNode": "162(us)", | "Rel_3_3_Int", | | | | | "RelNode": "256(us)", | "Rel_3_1_String", | | | | | "SingleEdgeNode": "151(us)" | "Rel_3_2_Double" | | | | | }, | ] | | | | | "total": "1612(us)", | }, | | | | | "total_rpc_time": "1913(us)", | { | | | | | "vertices": 1 | "type": 20, | | | | | }, | "props": [ | | | | | { | "_src", | | | | | "exec": "373(us)", | "_type", | | | | | "host": "store2:9779", | "_rank", | | | | | "storage_detail": { | "_dst", | | | | | "GetNeighborsNode": "124(us)", | "Rel_4_0_Bool", | | | | | "HashJoinNode": "93(us)", | "Rel_4_2_Double", | | | | | "RelNode": "124(us)", | "Rel_4_5_String", | | | | | "SingleEdgeNode": "84(us)" | "Rel_4_1_String", | | | | | }, | "Rel_4_4_Double", | | | | | "total": "1285(us)", | "Rel_4_3_String" | | | | | "total_rpc_time": "1913(us)", | ] | | | | | "vertices": 1 | } | | | | | }, | ] | | | | | { | statProps: | | | | | "exec": "502(us)", | exprs: | | | | | "host": "store7:9779", | random: false | | | | | "storage_detail": { | steps: 4..3 | | | | | "GetNeighborsNode": "157(us)", | vertex filter: | | | | | "HashJoinNode": "132(us)", | edge filter: | | | | | "RelNode": "157(us)", | if_track_previous_path: false | | | | | "SingleEdgeNode": "123(us)" | first step filter: | | | | | }, | tag filter: | | | | | "total": "1295(us)", | | | | | | "total_rpc_time": "1913(us)", | | | | | | "vertices": 1 | | | | | | } | | | | | | ] | | | | | | step[1]: [ | | | | | | { | | | | | | "exec": "522(us)", | | | | | | "host": "store3:9779", | | | | | | "storage_detail": { | | | | | | "GetNeighborsNode": "361(us)", | | | | | | "HashJoinNode": "272(us)", | | | | | | "RelNode": "361(us)", | | | | | | "SingleEdgeNode": "253(us)" | | | | | | }, | | | | | | "total": "1534(us)", | | | | | | "total_rpc_time": "1702(us)", | | | | | | "vertices": 2 | | | | | | }, | | | | | | { | | | | | | "exec": "445(us)", | | | | | | "host": "store2:9779", | | | | | | "storage_detail": { | | | | | | "GetNeighborsNode": "185(us)", | | | | | | "HashJoinNode": "77(us)", | | | | | | "RelNode": "185(us)", | | | | | | "SingleEdgeNode": "69(us)" | | | | | | }, | | | | | | "total": "1296(us)", | | | | | | "total_rpc_time": "1702(us)", | | | | | | "vertices": 1 | | | | | | }, | | | | | | { | | | | | | "exec": "529(us)", | | | | | | "host": "store1:9779", | | | | | | "storage_detail": { | | | | | | "GetNeighborsNode": "245(us)", | | | | | | "HashJoinNode": "155(us)", | | | | | | "RelNode": "245(us)", | | | | | | "SingleEdgeNode": "146(us)" | | | | | | }, | | | | | | "total": "1276(us)", | | | | | | "total_rpc_time": "1702(us)", | | | | | | "vertices": 1 | | | | | | } | | | | | | ] | | | | | | } | | -----+----------------+--------------+------------------------------------------------------+---------------------------------------------------------------------------- | 7 | Argument | | ver: 0, rows: 4, execTime: 0us, totalTime: 55us | outputVar: { | | | | | | "colNames": [ | | | | | | "v2" | | | | | | ], | | | | | | "type": "DATASET", | | | | | | "name": "__Argument_7" | | | | | | } | | | | | | inputVar: __Project_6 | -----+----------------+--------------+------------------------------------------------------+---------------------------------------------------------------------------- Tue, 03 Jan 2023 15:54:06 CST 

我们发现执行计划中编号 8 的节点对应的 step range 明显是错的：steps: 4..3（结合语句中的 e*1..1，正确值应该是 1..1）。

下面，我们通过 rr 录下一次错误的执行过程，然后在设置 MatchStepRange 的地方（src/graph/planner/match/MatchPathPlanner.cpp:282）下断点：

[New Thread 34.61] [Switching to Thread 34.47] Thread 3 hit Breakpoint 3, nebula::graph::MatchPathPlanner::rightExpandFromNode (this=0x18e60dc5c58, startIndex=0, subplan=...) at /data/src/nebula-comm/src/graph/planner/match/MatchPathPlanner.cpp:282 282 traverse->setStepRange(edge.range); (rr) bt #0 nebula::graph::MatchPathPlanner::rightExpandFromNode (this=0x18e60dc5c58, startIndex=0, subplan=...) at /data/src/nebula-comm/src/graph/planner/match/MatchPathPlanner.cpp:282 #1 0x00000000033198dd in nebula::graph::MatchPathPlanner::expandFromNode (this=0x18e60dc5c58, startIndex=0, subplan=...) at /data/src/nebula-comm/src/graph/planner/match/MatchPathPlanner.cpp:169 #2 0x000000000331937b in nebula::graph::MatchPathPlanner::expand (this=0x18e60dc5c58, startFromEdge=false, startIndex=0, subplan=...) at /data/src/nebula-comm/src/graph/planner/match/MatchPathPlanner.cpp:158 #3 0x00000000033185ca in nebula::graph::MatchPathPlanner::transform (this=0x18e60dc5c58, bindWhere=0x69433b909880, nodeAliasesSeen=...) at /data/src/nebula-comm/src/graph/planner/match/MatchPathPlanner.cpp:78 #4 0x0000000003305b16 in nebula::graph::MatchClausePlanner::transform (this=0x69433bbd64b0, clauseCtx=0x7f25a94881c0) at /data/src/nebula-comm/src/graph/planner/match/MatchClausePlanner.cpp:33 #5 0x0000000003302a11 in nebula::graph::MatchPlanner::genPlan (this=0x69433b9998b0, clauseCtx=0x7f25a94881c0) at /data/src/nebula-comm/src/graph/planner/match/MatchPlanner.cpp:42 #6 0x0000000003303030 in nebula::graph::MatchPlanner::connectMatchPlan (this=0x69433b9998b0, queryPlan=..., matchCtx=0x7f25a94881c0) at /data/src/nebula-comm/src/graph/planner/match/MatchPlanner.cpp:63 #7 0x0000000003302101 in nebula::graph::MatchPlanner::genQueryPartPlan (this=0x69433b9998b0, qctx=0x7f25a94672a0, queryPlan=..., queryPart=...) at /data/src/nebula-comm/src/graph/planner/match/MatchPlanner.cpp:137 #8 0x0000000003301e84 in nebula::graph::MatchPlanner::transform (this=0x69433b9998b0, astCtx=0x7f25a95eb700) at /data/src/nebula-comm/src/graph/planner/match/MatchPlanner.cpp:33 #9 0x00000000032e40b1 in nebula::graph::Planner::toPlan (astCtx=0x7f25a95eb700) at /data/src/nebula-comm/src/graph/planner/Planner.cpp:38 #10 0x00000000030d6b7e in nebula::graph::Validator::toPlan (this=0x69433bbd0f80) at /data/src/nebula-comm/src/graph/validator/Validator.cpp:401 #11 0x00000000030d5b93 in nebula::graph::Validator::validate (this=0x69433bbd0f80) at /data/src/nebula-comm/src/graph/validator/Validator.cpp:364 #12 0x0000000003114880 in nebula::graph::SequentialValidator::validateImpl (this=0x69433bbd0c00) at /data/src/nebula-comm/src/graph/validator/SequentialValidator.cpp:40 #13 0x00000000030d58e7 in nebula::graph::Validator::validate (this=0x69433bbd0c00) at /data/src/nebula-comm/src/graph/validator/Validator.cpp:354 #14 0x00000000030d4c8f in nebula::graph::Validator::validate (sentence=0x69433bc58870, qctx=0x7f25a94672a0) at /data/src/nebula-comm/src/graph/validator/Validator.cpp:285 #15 0x0000000002ff4841 in nebula::graph::QueryInstance::validateAndOptimize (this=0x69433bc07640) at /data/src/nebula-comm/src/graph/service/QueryInstance.cpp:102 #16 0x0000000002ff3920 in nebula::graph::QueryInstance::execute (this=0x69433bc07640) at /data/src/nebula-comm/src/graph/service/QueryInstance.cpp:42 #17 0x0000000002fe9219 in nebula::graph::QueryEngine::execute (this=0x69433bc603c0, rctx=...) at /data/src/nebula-comm/src/graph/service/QueryEngine.cpp:57 #18 0x0000000002f6145f in nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1::operator()(nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >) (this=0x7f25a9452460, ret=...) at /data/src/nebula-comm/src/graph/service/GraphService.cpp:183 #19 0x0000000002f60626 in folly::futures::detail::wrapInvoke<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&)::{lambda()#1}::operator()() const (this=0x18e60dc8120) at /data/src/nebula-comm/build-debug/third-party/install/include/folly/futures/Future-inl.h:98 #20 0x0000000002f605bf in folly::futures::detail::InvokeResultWrapper<void>::wrapResult<folly::futures::detail::wrapInvoke<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&)::{lambda()#1}>(folly::futures::detail::wrapInvoke<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&)::{lambda()#1}) (fn=...) at /data/src/nebula-comm/build-debug/third-party/install/include/folly/futures/Future-inl.h:90 #21 0x0000000002f6057c in folly::futures::detail::wrapInvoke<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&) ( t=..., f=...) at /data/src/nebula-comm/build-debug/third-party/install/include/folly/futures/Future-inl.h:108 #22 0x0000000002f604cf in folly::Future<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >::thenValue<nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&) &&::{lambda(folly::Executor::KeepAlive<folly::Executor>&&, folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&)#1}::operator()(folly::Executor::KeepAlive<folly::Executor>&&, folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&) (this=0x7f25a9452460, t=...) at /data/src/nebula-comm/build-debug/third-party/install/include/folly/futures/Future-inl.h:991 #23 0x0000000002f6046e in folly::futures::detail::CoreCallbackState<folly::Unit, folly::Future<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >::thenValue<nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&) &&::{lambda(folly::Executor::KeepAlive<folly::Executor>&&, folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&)#1}>::invoke<folly::Executor::KeepAlive<folly::Executor>, folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > > >(folly::Executor::KeepAlive<folly::Executor>&&, folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&) (this=0x7f25a9452460, args=..., args=...) at /data/src/nebula-comm/build-debug/third-party/install/include/folly/futures/Future-inl.h:144 #24 0x0000000002f603cb in folly::futures::detail::detail_msvc_15_7_workaround::invoke<folly::futures::detail::tryExecutorCallableResult<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >, folly::Future<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >::thenValue<nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::alloc--Type <RET> for more, q to quit, c to continue without paging--q Quit (rr) p edge.range $1 = (nebula::MatchStepRange *) 0x69433b948320 (rr) p *edge.range $2 = {min_ = 1, max_ = 1} (rr) c Continuing. Thread 3 hit Breakpoint 3, nebula::graph::MatchPathPlanner::rightExpandFromNode (this=0x18e60dc61f8, startIndex=0, subplan=...) at /data/src/nebula-comm/src/graph/planner/match/MatchPathPlanner.cpp:282 282 traverse->setStepRange(edge.range); (rr) p edge.range $3 = (nebula::MatchStepRange *) 0x69433b9998a0 (rr) p *edge.range $4 = {min_ = 4, max_ = 3} (rr) p &edge.range->min_ $5 = (size_t *) 0x69433b9998a0 (rr) watch *((size_t *) 0x69433b9998a0) Hardware watchpoint 4: *((size_t *) 0x69433b9998a0) (rr) 

我们发现第二次设置的 MatchStepRange(4..3) 显然已经出错。

我们在 &edge.range→min_ 这个地址（0x69433b9998a0）下个硬件断点，重新运行程序。

我们观察到 0x69433b9998a0 这个地址一直被反复的释放直到它被分配给一个 MatchStepRange 对象：

0x0000000003319f1d 282 traverse->setStepRange(edge.range); The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /root/src/nebula-comm/build-debug/bin/nebula-graphd Program stopped. 0x00007f25a9200100 in ?? () from /lib64/ld-linux-x86-64.so.2 (rr) c Continuing. [New Thread 34.39] [New Thread 34.35] [New Thread 34.36] [New Thread 34.37] [New Thread 34.38] [Switching to Thread 34.39] Thread 2 hit Hardware watchpoint 4: *((size_t *) 0x69433b9998a0) Old value = <unreadable> New value = 0 0x0000000070000002 in syscall_traced () (rr) c Continuing. [New Thread 34.56] [New Thread 34.57] [New Thread 34.40] [New Thread 34.41] [New Thread 34.42] [New Thread 34.43] [New Thread 34.44] [New Thread 34.45] [New Thread 34.46] [New Thread 34.47] [New Thread 34.48] [New Thread 34.49] [New Thread 34.50] [New Thread 34.51] [New Thread 34.52] [New Thread 34.53] [New Thread 34.54] [New Thread 34.55] [New Thread 34.58] [New Thread 34.59] [New Thread 34.60] [New Thread 34.61] [Switching to Thread 34.57] Thread 8 hit Hardware watchpoint 4: *((size_t *) 0x69433b9998a0) Old value = 0 New value = 128849018911 __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:315 315 ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S: No such file or directory. (rr) c Continuing. Thread 8 hit Hardware watchpoint 4: *((size_t *) 0x69433b9998a0) Old value = 128849018911 New value = 0 __memset_avx2_unaligned_erms () at ../sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S:260 260 ../sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S: No such file or directory. (rr) Continuing. Thread 8 hit Hardware watchpoint 4: *((size_t *) 0x69433b9998a0) Old value = 0 New value = 139799731034544 std::_Hashtable<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, long>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, long> >, std::__detail::_Select1st, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<true, false, true> >::_M_insert_bucket_begin (this=0x7f25a94ed9a0, __bkt=0, __node=0x7f25a94e1a80) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/hashtable.h:1619 1619 { (rr) Continuing. Thread 8 hit Hardware watchpoint 4: *((size_t *) 0x69433b9998a0) Old value = 139799731034544 New value = 0 __memset_avx2_unaligned_erms () at ../sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S:260 260 ../sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S: No such file or directory. (rr) Continuing. Thread 8 hit Hardware watchpoint 4: *((size_t *) 0x69433b9998a0) Old value = 0 New value = 89457155694696 std::_Hashtable<int, std::pair<int const, std::vector<std::shared_ptr<nebula::meta::NebulaSchemaProvider const>, std::allocator<std::shared_ptr<nebula::meta::NebulaSchemaProvider const> > > >, std::allocator<std::pair<int const, std::vector<std::shared_ptr<nebula::meta::NebulaSchemaProvider const>, std::allocator<std::shared_ptr<nebula::meta::NebulaSchemaProvider const> > > > >, std::__detail::_Select1st, std::equal_to<int>, std::hash<int>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_insert_bucket_begin (this=0x515c5dfce058, __bkt=0, __node=0x69433bc58e70) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/hashtable.h:1619 1619 { (rr) Continuing. Thread 8 hit Hardware watchpoint 4: *((size_t *) 0x69433b9998a0) Old value = 89457155694696 New value = 115737483335024 0x0000000004066efa in std::_Hashtable<int, std::pair<int const, std::vector<std::shared_ptr<nebula::meta::NebulaSchemaProvider const>, std::allocator<std::shared_ptr<nebula::meta::NebulaSchemaProvider const> > > >, std::allocator<std::pair<int const, std::vector<std::shared_ptr<nebula::meta::NebulaSchemaProvider const>, std::allocator<std::shared_ptr<nebula::meta::NebulaSchemaProvider const> > > > >, std::__detail::_Select1st, std::equal_to<int>, std::hash<int>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_insert_bucket_begin (this=0x515c5dfce058, __bkt=1, __node=0x69433b94d570) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/hashtable.h:1616 1616 _H1, _H2, _Hash, _RehashPolicy, _Traits>:: (rr) Continuing. Thread 8 hit Hardware watchpoint 4: *((size_t *) 0x69433b9998a0) Old value = 115737483335024 New value = 0 0x0000000003153d10 in std::__shared_ptr<nebula::meta::NebulaSchemaProvider const, (__gnu_cxx::_Lock_policy)2>::__shared_ptr (this=0x69433b9998a0) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/shared_ptr_base.h:1119 1119 : _M_ptr(0), _M_refcount() (rr) Continuing. Thread 8 hit Hardware watchpoint 4: *((size_t *) 0x69433b9998a0) Old value = 0 New value = 139799732183408 std::swap<nebula::meta::NebulaSchemaProvider const*> (__a=@0x515c5dfcd878: 0x0, __b=@0x69433b9998a0: 0x7f25a9606170) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/move.h:196 196 } (rr) Continuing. Thread 8 hit Hardware watchpoint 4: *((size_t *) 0x69433b9998a0) Old value = 139799732183408 New value = 0 __memset_avx2_unaligned_erms () at ../sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S:260 260 ../sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S: No such file or directory. (rr) Continuing. [Switching to Thread 34.47] Thread 16 hit Hardware watchpoint 4: *((size_t *) 0x69433b9998a0) Old value = 0 New value = 98202129293344 __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:315 315 ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S: No such file or directory. (rr) Continuing. Thread 16 hit Hardware watchpoint 4: *((size_t *) 0x69433b9998a0) Old value = 98202129293344 New value = 1 0x00000000031e675d in std::make_unique<nebula::MatchStepRange, nebula::MatchStepRange&> (__args=...) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/unique_ptr.h:857 857 { return unique_ptr<_Tp>(new _Tp(std::forward<_Args>(__args)...)); } (rr) bt #0 0x00000000031e675d in std::make_unique<nebula::MatchStepRange, nebula::MatchStepRange&> (__args=...) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/unique_ptr.h:857 #1 0x00000000031e586a in nebula::MatchEdge::clone (this=0x69433b919530) at /data/src/nebula-comm/src/parser/MatchPath.h:128 #2 0x00000000031e082d in nebula::MatchPath::clone (this=0x7f25a94d3b00) at /data/src/nebula-comm/src/parser/MatchPath.h:363 #3 0x00000000031e0161 in nebula::graph::extractSinglePathPredicate (expr=0x595077086880, pathPreds=...) at /data/src/nebula-comm/src/graph/validator/MatchValidator.cpp:1122 #4 0x00000000031e0b43 in nebula::graph::extractMultiPathPredicate (expr=0x595077085e60, pathPreds=...) at /data/src/nebula-comm/src/graph/validator/MatchValidator.cpp:1158 #5 0x00000000031d87aa in nebula::graph::MatchValidator::validatePathInWhere (this=0x69433bbd0f80, wctx=..., availableAliases=..., paths=...) at /data/src/nebula-comm/src/graph/validator/MatchValidator.cpp:1182 #6 0x00000000031cfddc in nebula::graph::MatchValidator::validateFilter (this=0x69433bbd0f80, filter=0x595077006eb0, whereClauseCtx=...) at /data/src/nebula-comm/src/graph/validator/MatchValidator.cpp:361 #7 0x00000000031cdd60 in nebula::graph::MatchValidator::validateImpl (this=0x69433bbd0f80) at /data/src/nebula-comm/src/graph/validator/MatchValidator.cpp:66 #8 0x00000000030d58e7 in nebula::graph::Validator::validate (this=0x69433bbd0f80) at /data/src/nebula-comm/src/graph/validator/Validator.cpp:354 #9 0x0000000003114880 in nebula::graph::SequentialValidator::validateImpl (this=0x69433bbd0c00) at /data/src/nebula-comm/src/graph/validator/SequentialValidator.cpp:40 #10 0x00000000030d58e7 in nebula::graph::Validator::validate (this=0x69433bbd0c00) at /data/src/nebula-comm/src/graph/validator/Validator.cpp:354 #11 0x00000000030d4c8f in nebula::graph::Validator::validate (sentence=0x69433bc58870, qctx=0x7f25a94672a0) at /data/src/nebula-comm/src/graph/validator/Validator.cpp:285 #12 0x0000000002ff4841 in nebula::graph::QueryInstance::validateAndOptimize (this=0x69433bc07640) at /data/src/nebula-comm/src/graph/service/QueryInstance.cpp:102 #13 0x0000000002ff3920 in nebula::graph::QueryInstance::execute (this=0x69433bc07640) at /data/src/nebula-comm/src/graph/service/QueryInstance.cpp:42 #14 0x0000000002fe9219 in nebula::graph::QueryEngine::execute (this=0x69433bc603c0, rctx=...) at /data/src/nebula-comm/src/graph/service/QueryEngine.cpp:57 #15 0x0000000002f6145f in nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1::operator()(nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >) (this=0x7f25a9452460, ret=...) at /data/src/nebula-comm/src/graph/service/GraphService.cpp:183 #16 0x0000000002f60626 in folly::futures::detail::wrapInvoke<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&)::{lambda()#1}::operator()() const (this=0x18e60dc8120) at /data/src/nebula-comm/build-debug/third-party/install/include/folly/futures/Future-inl.h:98 #17 0x0000000002f605bf in folly::futures::detail::InvokeResultWrapper<void>::wrapResult<folly::futures::detail::wrapInvoke<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&)::{lambda()#1}>(folly::futures::detail::wrapInvoke<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&)::{lambda()#1}) (fn=...) at /data/src/nebula-comm/build-debug/third-party/install/include/folly/futures/Future-inl.h:90 #18 0x0000000002f6057c in folly::futures::detail::wrapInvoke<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&) ( t=..., f=...) at /data/src/nebula-comm/build-debug/third-party/install/include/folly/futures/Future-inl.h:108 #19 0x0000000002f604cf in folly::Future<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >::thenValue<nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&) &&::{lambda(folly::Executor::KeepAlive<folly::Executor>&&, folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&)#1}::operator()(folly::Executor::KeepAlive<folly::Executor>&&, folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&) (this=0x7f25a9452460, t=...) at /data/src/nebula-comm/build-debug/third-party/install/include/folly/futures/Future-inl.h:991 #20 0x0000000002f6046e in folly::futures::detail::CoreCallbackState<folly::Unit, folly::Future<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >::thenValue<nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&) &&::{lambda(folly::Executor::KeepAlive<folly::Executor>&&, folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&)#1}>::invoke<folly::Executor::KeepAlive<folly::Executor>, folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > > >(folly::Executor::KeepAlive<folly::Executor>&&, folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&) (this=0x7f25a9452460, args=..., args=...) at /data/src/nebula-comm/build-debug/third-party/install/include/folly/futures/Future-inl.h:144 #21 0x0000000002f603cb in folly::futures::detail::detail_msvc_15_7_workaround::invoke<folly::futures::detail::tryExecutorCallableResult<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >, folly::Future<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >::thenValue<nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&) &&::{lambda(folly::Executor::KeepAlive<folly::Executor>&&, folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&)#1}, void>, folly::futures::detail::CoreCallbackState<folly::Unit, {lambda(folly::Executor::KeepAlive<folly::Executor>&&, folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&)#1}>, nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >, 0>(folly::futures::detail::tryExecutorCallableResult<nebula::StatusOr< --Type <RET> for more, q to quit, c to continue without paging--q Quit (rr) 

可以看到出问题的 MatchStepRange 在 src/parser/MatchPath.h:128 通过 make_unique 分配出的内存并初始化的：

119 120 MatchEdge clone() const { 121 auto me = MatchEdge(); 122 me.direction_ = direction_; 123 me.alias_ = alias_; 124 for (const auto& type : types_) { 125 me.types_.emplace_back(std::make_unique<std::string>(*DCHECK_NOTNULL(type))); 126 } 127 if (range_ != nullptr) { 128 me.range_ = std::make_unique<MatchStepRange>(*range_); 129 } 130 if (props_ != nullptr) { 131 me.props_ = static_cast<MapExpression*>(props_->clone()); 132 } 133 return me; 134 } 135 136 private: 137 Direction direction_; 138 std::string alias_; 

继续 continue 看这块内存上的数据什么时候被篡改成错误的值：

Continuing. Thread 16 hit Hardware watchpoint 4: *((size_t *) 0x69433b9998a0) Old value = 1 New value = 0 0x0000000002ec2901 in std::__detail::_Hash_node_base::_Hash_node_base (this=0x69433b9998a0) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/hashtable_policy.h:218 218 _Hash_node_base() noexcept : _M_nxt() { } (rr) bt #0 0x0000000002ec2901 in std::__detail::_Hash_node_base::_Hash_node_base (this=0x69433b9998a0) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/hashtable_policy.h:218 #1 0x0000000002ed1191 in std::__detail::_Hash_node_value_base<nebula::Expression::Kind>::_Hash_node_value_base (this=0x69433b9998a0) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/hashtable_policy.h:229 #2 0x0000000002ed10c1 in std::__detail::_Hash_node<nebula::Expression::Kind, false>::_Hash_node (this=0x69433b9998a0) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/hashtable_policy.h:279 #3 0x0000000002ed0f9b in std::__detail::_Hashtable_alloc<std::allocator<std::__detail::_Hash_node<nebula::Expression::Kind, false> > >::_M_allocate_node<nebula::Expression::Kind const&> (this=0x18e60dc63b8, __args=@0x18e60dc63a6: nebula::Expression::Kind::kVertex) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/hashtable_policy.h:2085 #4 0x0000000002ed0cf3 in std::__detail::_AllocNode<std::allocator<std::__detail::_Hash_node<nebula::Expression::Kind, false> > >::operator()<nebula::Expression::Kind const&> (this=0x18e60dc5ef8, __arg=@0x18e60dc63a6: nebula::Expression::Kind::kVertex) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/hashtable_policy.h:167 #5 0x0000000002ed0bc2 in std::_Hashtable<nebula::Expression::Kind, nebula::Expression::Kind, std::allocator<nebula::Expression::Kind>, std::__detail::_Identity, std::equal_to<nebula::Expression::Kind>, std::hash<nebula::Expression::Kind>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, true, true> >::_M_insert<nebula::Expression::Kind const&, std::__detail::_AllocNode<std::allocator<std::__detail::_Hash_node<nebula::Expression::Kind, false> > > > ( this=0x18e60dc63b8, __v=@0x18e60dc63a6: nebula::Expression::Kind::kVertex, __node_gen=..., __n_elt=1) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/hashtable.h:1852 #6 0x0000000002ed06cd in std::__detail::_Insert_base<nebula::Expression::Kind, nebula::Expression::Kind, std::allocator<nebula::Expression::Kind>, std::__detail::_Identity, std::equal_to<nebula::Expression::Kind>, std::hash<nebula::Expression::Kind>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, true, true> >::insert (this=0x18e60dc63b8, __v=@0x18e60dc63a6: nebula::Expression::Kind::kVertex) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/hashtable_policy.h:824 #7 0x0000000002ed042d in std::_Hashtable<nebula::Expression::Kind, nebula::Expression::Kind, std::allocator<nebula::Expression::Kind>, std::__detail::_Identity, std::equal_to<nebula::Expression::Kind>, std::hash<nebula::Expression::Kind>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, true, true> >::_Hashtable<nebula::Expression::Kind const*> (this=0x18e60dc63b8, __f=0x18e60dc63a6, __l=0x18e60dc63a8, __bucket_hint=0, __h1=..., __h2=..., __h=..., __eq=..., __exk=..., __a=...) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/hashtable.h:1026 #8 0x0000000002ed01bc in std::_Hashtable<nebula::Expression::Kind, nebula::Expression::Kind, std::allocator<nebula::Expression::Kind>, std::__detail::_Identity, std::equal_to<nebula::Expression::Kind>, std::hash<nebula::Expression::Kind>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, true, true> >::_Hashtable (this=0x18e60dc63b8, __l=..., __n=0, __hf=..., __eql=..., __a=...) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/hashtable.h:497 #9 0x0000000002eae859 in std::unordered_set<nebula::Expression::Kind, std::hash<nebula::Expression::Kind>, std::equal_to<nebula::Expression::Kind>, std::allocator<nebula::Expression::Kind> >::unordered_set (this=0x18e60dc63b8, __l=..., __n=0, __hf=..., __eql=..., __a=...) at /usr/lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/bits/unordered_set.h:226 #10 0x00000000031d2df0 in nebula::graph::MatchValidator::validateReturn (this=0x69433bbd0f80, ret=0x69433bc587b0, queryParts=..., retClauseCtx=...) at /data/src/nebula-comm/src/graph/validator/MatchValidator.cpp:471 #11 0x00000000031ce962 in nebula::graph::MatchValidator::validateImpl (this=0x69433bbd0f80) at /data/src/nebula-comm/src/graph/validator/MatchValidator.cpp:117 #12 0x00000000030d58e7 in nebula::graph::Validator::validate (this=0x69433bbd0f80) at /data/src/nebula-comm/src/graph/validator/Validator.cpp:354 #13 0x0000000003114880 in nebula::graph::SequentialValidator::validateImpl (this=0x69433bbd0c00) at /data/src/nebula-comm/src/graph/validator/SequentialValidator.cpp:40 #14 0x00000000030d58e7 in nebula::graph::Validator::validate (this=0x69433bbd0c00) at /data/src/nebula-comm/src/graph/validator/Validator.cpp:354 #15 0x00000000030d4c8f in nebula::graph::Validator::validate (sentence=0x69433bc58870, qctx=0x7f25a94672a0) at /data/src/nebula-comm/src/graph/validator/Validator.cpp:285 #16 0x0000000002ff4841 in nebula::graph::QueryInstance::validateAndOptimize (this=0x69433bc07640) at /data/src/nebula-comm/src/graph/service/QueryInstance.cpp:102 #17 0x0000000002ff3920 in nebula::graph::QueryInstance::execute (this=0x69433bc07640) at /data/src/nebula-comm/src/graph/service/QueryInstance.cpp:42 #18 0x0000000002fe9219 in nebula::graph::QueryEngine::execute (this=0x69433bc603c0, rctx=...) at /data/src/nebula-comm/src/graph/service/QueryEngine.cpp:57 #19 0x0000000002f6145f in nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1::operator()(nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >) (this=0x7f25a9452460, ret=...) at /data/src/nebula-comm/src/graph/service/GraphService.cpp:183 #20 0x0000000002f60626 in folly::futures::detail::wrapInvoke<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&)::{lambda()#1}::operator()() const (this=0x18e60dc8120) at /data/src/nebula-comm/build-debug/third-party/install/include/folly/futures/Future-inl.h:98 #21 0x0000000002f605bf in folly::futures::detail::InvokeResultWrapper<void>::wrapResult<folly::futures::detail::wrapInvoke<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&)::{lambda()#1}>(folly::futures::detail::wrapInvoke<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&)::{lambda()#1}) (fn=...) at /data/src/nebula-comm/build-debug/third-party/install/include/folly/futures/Future-inl.h:90 #22 0x0000000002f6057c in folly::futures::detail::wrapInvoke<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> >, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&, nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&) ( t=..., f=...) at /data/src/nebula-comm/build-debug/third-party/install/include/folly/futures/Future-inl.h:108 #23 0x0000000002f604cf in folly::Future<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >::thenValue<nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1>(nebula::graph::GraphService::future_executeWithParameter(long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, nebula::Value, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, nebula::Value> > > const&)::$_1&&) &&::{lambda(folly::Executor::KeepAlive<folly::Executor>&&, folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&)#1}::operator()(folly::Executor::KeepAlive<folly::Executor>&&, folly::Try<nebula::StatusOr<std::shared_ptr<nebula::graph::ClientSession> > >&&) (this=0x7f25a9452460, t=...) at /data/src/nebula-comm/build-debug/third-party/install/include/folly/futures/Future-inl.h:991 --Type <RET> for more, q to quit, c to continue without paging--q Quit (rr) 

非常神奇的是，这块内存在 src/graph/validator/MatchValidator.cpp:471 中又分配给某个 hash 表了：

 449 // Check validity of return clause. 450 // Disable return * without symbols, disable invalid expressions, check aggregate expression, 451 // rewrite expression to fit semantic, check available aliases, check columns, check limit and 452 // order by options. 453 Status MatchValidator::validateReturn(MatchReturn *ret, 454 const std::vector<QueryPart> &queryParts, 455 ReturnClauseContext &retClauseCtx) { 456 YieldColumns *columns = retClauseCtx.qctx->objPool()->makeAndAdd<YieldColumns>(); 457 if (ret->returnItems()->allNamedAliases() && !queryParts.empty()) { 458 auto status = buildColumnsForAllNamedAliases(queryParts, columns); 459 if (!status.ok()) { 460 return status; 461 } 462 if (columns->empty() && !ret->returnItems()->columns()) { 463 return Status::SemanticError("RETURN * is not allowed when there are no variables in scope"); 464 } 465 } 466 std::vector<const Expression *> exprs; 467 if (ret->returnItems()->columns()) { 468 exprs.reserve(ret->returnItems()->columns()->size()); 469 for (auto *column : ret->returnItems()->columns()->columns()) { 470 if (ExpressionUtils::hasAny(column->expr(), 471 {Expression::Kind::kVertex, Expression::Kind::kEdge})) { 472 return Status::SemanticError( 473 "keywords: vertex and edge are not supported in return clause `%s'", 474 column->toString().c_str()); 475 } 476 if (!retClauseCtx.yield->hasAgg_ && 477 ExpressionUtils::hasAny(column->expr(), {Expression::Kind::kAggregate})) { 478 retClauseCtx.yield->hasAgg_ = true; 479 } 480 column->setExpr(ExpressionUtils::rewriteAttr2LabelTagProp( 481 column->expr(), retClauseCtx.yield->aliasesAvailable)); 482 exprs.push_back(column->expr()); 483 columns->addColumn(column->clone().release()); 484 } 485 } 

唯一的解释就是 MatchStepRange 所在的内存被释放然后又分配出去了。重点关注 MatchStepRange 内存的分配、释放过程，我们顺着 make_unique() 分配 MatchStepRange 的堆栈跟过去：

1171 1172 Status MatchValidator::validatePathInWhere( 1173 WhereClauseContext &wctx, 1174 const std::unordered_map<std::string, AliasType> &availableAliases, 1175 std::vector<Path> &paths) { 1176 auto expr = ExpressionUtils::flattenInnerLogicalExpr(wctx.filter); 1177 auto *pool = qctx_->objPool(); 1178 ValidatePatternExpressionVisitor visitor(pool, vctx_); 1179 expr->accept(&visitor); 1180 std::vector<MatchPath> pathPreds; 1181 // FIXME(czp): Delete this function and add new expression visitor to cover all general cases 1182 if (extractMultiPathPredicate(expr, pathPreds)) { 1183 wctx.filter = nullptr; 1184 } else { 1185 // Flatten and fold the inner logical expressions that already have operands that can be 1186 // compacted 1187 wctx.filter = 1188 ExpressionUtils::foldInnerLogicalExpr(ExpressionUtils::flattenInnerLogicalExpr(expr)); 1189 } 1190 for (auto &pred : pathPreds) { 1191 NG_RETURN_IF_ERROR(checkMatchPathExpr(pred, availableAliases)); 1192 // Build path alias 1193 auto pathAlias = pred.toString(); 1194 pred.setAlias(new std::string(pathAlias)); 1195 paths.emplace_back(); 1196 NG_RETURN_IF_ERROR(validatePath(&pred, paths.back())); 1197 NG_RETURN_IF_ERROR(buildRollUpPathInfo(&pred, paths.back())); 1198 } 

MatchStepRange 是 graph/validator/MatchValidator.cpp:1182 这行代码触发分配的，保存在 pathPreds 这个 vector 中。在 NebulaGraph 中不定长（变长）查询 :<edge_type>*[minHop..maxHop] 会触发 extractMultiPathPredicate() 函数来分配 match path range，本文就是触发了 extractMultiPathPredicate() 函数。

回到上面代码，这里就有个问题：pathPreds 是个局部变量，validatePathInWhere() 一旦执行结束它的内存就释放了，这当然包括 MatchStepRange 这个 unique_ptr。再看 MatchStepRange 这块内存是否在释放后还被其他地方被用到。查看代码我们发现 graph/validator/MatchValidator.cpp:1196 这行代码的产生的调用链 validatePath()-> buildEdgeInfo() 把 pred 中的 MatchStepRange 裸指针赋值出去了：

 138 // Validate pattern from expression 139 Status MatchValidator::validatePath(const MatchPath *path, Path &pathInfo) { 140 // Pattern from expression won't generate new variable 141 std::unordered_map<std::string, AliasType> dummy; 142 NG_RETURN_IF_ERROR(buildNodeInfo(path, pathInfo.nodeInfos, dummy)); 143 NG_RETURN_IF_ERROR(buildEdgeInfo(path, pathInfo.edgeInfos, dummy)); 144 NG_RETURN_IF_ERROR(buildPathExpr(path, pathInfo, dummy)); 145 pathInfo.isPred = path->isPredicate(); 146 pathInfo.isAntiPred = path->isAntiPredicate(); 147 148 return Status::OK(); 149 } ... 263 // Build edges information by match pattern. 264 Status MatchValidator::buildEdgeInfo(const MatchPath *path, 265 std::vector<EdgeInfo> &edgeInfos, 266 std::unordered_map<std::string, AliasType> &aliases) { 267 auto *sm = qctx_->schemaMng(); 268 auto steps = path->steps(); 269 edgeInfos.resize(steps); 270 271 for (auto i = 0u; i < steps; i++) { 272 auto *edge = path->edge(i); 273 auto &types = edge->types(); ... 298 AliasType aliasType = AliasType::kEdge; 299 auto *stepRange = edge->range(); 300 if (stepRange != nullptr) { 301 NG_RETURN_IF_ERROR(validateStepRange(stepRange)); 302 edgeInfos[i].range = stepRange; 

看 src/graph/validator/MatchValidator.cpp:299，直接赋值了那块即将被释放的 MatchStepRange 指针，这是一切悲剧的根源。

问题定位到了，也就好解决了。

---

谢谢你读完本文 (///▽///)

NebulaGraph Desktop，Windows 和 macOS 用户安装图数据库的绿色通道，10s 拉起搞定海量数据的图服务。通道传送门：http://c.nxw.so/95xjV

想看源码的小伙伴可以前往 GitHub 阅读、使用、(^з^)-☆ star 它 -> GitHub；和其他的 NebulaGraph 用户一起交流图数据库技术和应用技能，留下「你的名片」一起玩耍呢~