metadata: annotations: prow.k8s.io/context: pull-sanitizer-tsan prow.k8s.io/job: pull-sanitizer-tsan creationTimestamp: "2026-11-04T12:17:05Z" generation: 10 labels: created-by-prow: "true" event-GUID: a46f5d10-d849-11f1-8a13-d1470d08daaa prow.k8s.io/build-id: "2117954285168758784" prow.k8s.io/context: pull-sanitizer-tsan prow.k8s.io/id: b63393d8-d90e-4e6d-9e3d-20a62364195b prow.k8s.io/is-optional: "true" prow.k8s.io/job: pull-sanitizer-tsan prow.k8s.io/refs.author: windtalker prow.k8s.io/refs.base_ref: master prow.k8s.io/refs.org: pingcap prow.k8s.io/refs.pull: "11224" prow.k8s.io/refs.repo: tiflash prow.k8s.io/type: presubmit name: b63393d8-d90e-4e6d-9e3d-20a62364195b namespace: apps resourceVersion: "1793806297985023000" uid: 0143ad8e-b1dd-4a47-8d30-2fdd1d8d11cb spec: agent: kubernetes cluster: default context: pull-sanitizer-tsan decoration_config: gcs_configuration: bucket: gs://prow-tidb-logs path_strategy: explicit gcs_credentials_secret: gcs-credentials pod_pending_timeout: 20m0s ssh_host_fingerprints: - github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl - github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg= - github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk= ssh_key_secrets: - github-ssh-secret timeout: 3h0m0s utility_images: clonerefs: gcr.io/k8s-prow/clonerefs:v20230601-43eb1068e4 entrypoint: gcr.io/k8s-prow/entrypoint:v20230601-43eb1068e4 initupload: gcr.io/k8s-prow/initupload:v20230601-43eb1068e4 sidecar: gcr.io/k8s-prow/sidecar:v20230601-43eb1068e4 job: pull-sanitizer-tsan namespace: prow-test-pods pod_spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: kubernetes.io/arch operator: In values: - amd64 containers: - args: - | set -euo pipefail if ! command -v ccache >/dev/null 2>&1; then yum install -y ccache fi sanitizer="${SANITIZER:-}" if [[ "${sanitizer}" != "ASan" && "${sanitizer}" != "TSan" ]]; then echo "unsupported sanitizer: ${sanitizer}" >&2 exit 1 fi run_with_sanitizer_runtime() { "$@" } if [[ "${sanitizer}" == "TSan" ]] && ! command -v setarch >/dev/null 2>&1; then echo "setarch is required for TSan runtime on this job" >&2 exit 1 fi if [[ "${sanitizer}" == "TSan" ]] && command -v setarch >/dev/null 2>&1; then arch_name="$(uname -m)" run_with_sanitizer_runtime() { setarch "${arch_name}" -R "$@" } fi build_jobs="20" test_workers="16" if [[ "${sanitizer}" == "TSan" ]]; then test_workers="10" fi repo_root="$(pwd)" # Build state (rustup / cargo / ccache / ninja output) is tens of GiB; put it # on the pod's `ci-rwo` workspace volume when one is mounted instead of on # the node root disk, where kubelet evicts the pod mid-build. scratch_root="${CI_SCRATCH_ROOT:-${repo_root}}" mkdir -p "${scratch_root}" export RUSTUP_HOME="${scratch_root}/.rustup-${sanitizer}" export CARGO_HOME="${scratch_root}/.cargo-${sanitizer}" unset RUSTUP_TOOLCHAIN rm -rf "${scratch_root}/.ccache" "${scratch_root}/build-${sanitizer}" "${RUSTUP_HOME}" "${CARGO_HOME}" mkdir -p "${scratch_root}/build-${sanitizer}" "${RUSTUP_HOME}" "${CARGO_HOME}" echo "RUSTUP_HOME=${RUSTUP_HOME}" echo "CARGO_HOME=${CARGO_HOME}" echo "rustup active toolchain before install:" rustup show active-toolchain || true for attempt in 1 2 3; do if rustup toolchain install; then break fi if [[ "${attempt}" == "3" ]]; then echo "failed to install rust toolchain after ${attempt} attempts" >&2 exit 1 fi rm -rf "${RUSTUP_HOME}/tmp" "${RUSTUP_HOME}/downloads" sleep "$((attempt * 10))" done rustup show rustup which cargo cargo --version ccache -o cache_dir="$(realpath "${scratch_root}/.ccache")" || true ccache -o max_size=2G || true ccache -o limit_multiple=0.99 || true ccache -o hash_dir=false || true ccache -o compression=true || true ccache -o compression_level=6 || true ccache -z || true ( cd "${scratch_root}/build-${sanitizer}" cmake "${repo_root}" \ -DCMAKE_CXX_COMPILER=clang++ \ -DCMAKE_C_COMPILER=clang \ -DENABLE_TESTS=ON \ -DCMAKE_BUILD_TYPE="${sanitizer}" \ -DUSE_CCACHE=ON \ -DRUN_HAVE_STD_REGEX=0 \ -DCMAKE_PREFIX_PATH=/usr/local \ -DUSE_GM_SSL=0 \ -GNinja run_with_sanitizer_runtime ninja -j"${build_jobs}" gtests_dbms gtests_libcommon gtests_libdaemon ) rm -rf /tests /tiflash ln -s "${repo_root}/tests" /tests mkdir -p /tiflash cp "${scratch_root}/build-${sanitizer}/dbms/gtests_dbms" /tiflash cp "${scratch_root}/build-${sanitizer}/libs/libcommon/src/tests/gtests_libcommon" /tiflash cp "${scratch_root}/build-${sanitizer}/libs/libdaemon/src/tests/gtests_libdaemon" /tiflash source /tests/docker/util.sh show_env UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=0 \ LSAN_OPTIONS=suppressions=/tests/sanitize/asan.suppression \ TSAN_OPTIONS="suppressions=/tests/sanitize/tsan.suppression" \ ENV_VARS_PATH=/tests/docker/_env.sh \ NPROC="${test_workers}" \ run_with_sanitizer_runtime /tests/run-gtest.sh command: - /bin/bash - -ce env: - name: SANITIZER value: TSan - name: CI_SCRATCH_ROOT value: /workspace image: ghcr.io/pingcap-qe/cd/builders/tiflash:v2025.8.10-2-gc9e3144-centos7 imagePullPolicy: Always name: run-sanitizer resources: limits: cpu: "24" ephemeral-storage: 30Gi memory: 64Gi requests: cpu: "24" ephemeral-storage: 20Gi memory: 64Gi securityContext: privileged: true volumeMounts: - mountPath: /workspace name: workspace volumes: - ephemeral: volumeClaimTemplate: metadata: creationTimestamp: null spec: accessModes: - ReadWriteOnce resources: requests: storage: 100Gi storageClassName: ci-rwo name: workspace prowjob_defaults: tenant_id: GlobalDefaultID refs: base_link: https://github.com/pingcap/tiflash/commit/f6e44d5d31f4a9f7433222bf1c9492bb625e17dd base_ref: master base_sha: f6e44d5d31f4a9f7433222bf1c9492bb625e17dd clone_uri: git@github.com:pingcap/tiflash.git org: pingcap pulls: - author: windtalker author_link: https://github.com/windtalker commit_link: https://github.com/pingcap/tiflash/pull/11224/commits/d9e78a7fca90927470361318399299f80964a131 head_ref: fix/validate-arrow-chunk-decoding link: https://github.com/pingcap/tiflash/pull/11224 number: 11224 sha: d9e78a7fca90927470361318399299f80964a131 title: 'security: validate Arrow chunk payloads before decoding' repo: tiflash repo_link: https://github.com/pingcap/tiflash report: true rerun_command: /test pull-sanitizer-tsan type: presubmit status: build_id: "2117954285168758784" completionTime: "2026-11-04T15:31:34Z" description: Job failed. pendingTime: "2026-11-04T12:17:06Z" pod_name: b63393d8-d90e-4e6d-9e3d-20a62364195b prev_report_states: gcsk8sreporter: failure gcsreporter: failure github-reporter: failure startTime: "2026-11-04T12:17:05Z" state: failure url: https://prow.tidb.net/view/gs/prow-tidb-logs/pr-logs/pull/pingcap_tiflash/11224/pull-sanitizer-tsan/2117954285168758784