metadata: annotations: prow.k8s.io/context: pull-sanitizer-tsan prow.k8s.io/job: pull-sanitizer-tsan creationTimestamp: "2026-11-04T07:44:47Z" generation: 10 labels: created-by-prow: "true" event-GUID: 99b97840-d823-11f1-8b6e-19d1bbb33c31 prow.k8s.io/build-id: "2117885755589136384" prow.k8s.io/context: pull-sanitizer-tsan prow.k8s.io/id: de1d9f3c-65ff-4a5c-97ba-3e3c40529acd prow.k8s.io/is-optional: "true" prow.k8s.io/job: pull-sanitizer-tsan prow.k8s.io/refs.author: windtalker prow.k8s.io/refs.base_ref: master prow.k8s.io/refs.org: pingcap prow.k8s.io/refs.pull: "11224" prow.k8s.io/refs.repo: tiflash prow.k8s.io/type: presubmit name: de1d9f3c-65ff-4a5c-97ba-3e3c40529acd namespace: apps resourceVersion: "1793782381218527012" uid: 7de8c4f4-4c89-4f2d-980a-929ca11558ce spec: agent: kubernetes cluster: default context: pull-sanitizer-tsan decoration_config: gcs_configuration: bucket: gs://prow-tidb-logs path_strategy: explicit gcs_credentials_secret: gcs-credentials pod_pending_timeout: 20m0s ssh_host_fingerprints: - github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl - github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg= - github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk= ssh_key_secrets: - github-ssh-secret timeout: 3h0m0s utility_images: clonerefs: gcr.io/k8s-prow/clonerefs:v20230601-43eb1068e4 entrypoint: gcr.io/k8s-prow/entrypoint:v20230601-43eb1068e4 initupload: gcr.io/k8s-prow/initupload:v20230601-43eb1068e4 sidecar: gcr.io/k8s-prow/sidecar:v20230601-43eb1068e4 job: pull-sanitizer-tsan namespace: prow-test-pods pod_spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: kubernetes.io/arch operator: In values: - amd64 containers: - args: - | set -euo pipefail if ! command -v ccache >/dev/null 2>&1; then yum install -y ccache fi sanitizer="${SANITIZER:-}" if [[ "${sanitizer}" != "ASan" && "${sanitizer}" != "TSan" ]]; then echo "unsupported sanitizer: ${sanitizer}" >&2 exit 1 fi run_with_sanitizer_runtime() { "$@" } if [[ "${sanitizer}" == "TSan" ]] && ! command -v setarch >/dev/null 2>&1; then echo "setarch is required for TSan runtime on this job" >&2 exit 1 fi if [[ "${sanitizer}" == "TSan" ]] && command -v setarch >/dev/null 2>&1; then arch_name="$(uname -m)" run_with_sanitizer_runtime() { setarch "${arch_name}" -R "$@" } fi build_jobs="20" test_workers="16" if [[ "${sanitizer}" == "TSan" ]]; then test_workers="10" fi repo_root="$(pwd)" # Build state (rustup / cargo / ccache / ninja output) is tens of GiB; put it # on the pod's `ci-rwo` workspace volume when one is mounted instead of on # the node root disk, where kubelet evicts the pod mid-build. scratch_root="${CI_SCRATCH_ROOT:-${repo_root}}" mkdir -p "${scratch_root}" export RUSTUP_HOME="${scratch_root}/.rustup-${sanitizer}" export CARGO_HOME="${scratch_root}/.cargo-${sanitizer}" unset RUSTUP_TOOLCHAIN rm -rf "${scratch_root}/.ccache" "${scratch_root}/build-${sanitizer}" "${RUSTUP_HOME}" "${CARGO_HOME}" mkdir -p "${scratch_root}/build-${sanitizer}" "${RUSTUP_HOME}" "${CARGO_HOME}" echo "RUSTUP_HOME=${RUSTUP_HOME}" echo "CARGO_HOME=${CARGO_HOME}" echo "rustup active toolchain before install:" rustup show active-toolchain || true for attempt in 1 2 3; do if rustup toolchain install; then break fi if [[ "${attempt}" == "3" ]]; then echo "failed to install rust toolchain after ${attempt} attempts" >&2 exit 1 fi rm -rf "${RUSTUP_HOME}/tmp" "${RUSTUP_HOME}/downloads" sleep "$((attempt * 10))" done rustup show rustup which cargo cargo --version ccache -o cache_dir="$(realpath "${scratch_root}/.ccache")" || true ccache -o max_size=2G || true ccache -o limit_multiple=0.99 || true ccache -o hash_dir=false || true ccache -o compression=true || true ccache -o compression_level=6 || true ccache -z || true ( cd "${scratch_root}/build-${sanitizer}" cmake "${repo_root}" \ -DCMAKE_CXX_COMPILER=clang++ \ -DCMAKE_C_COMPILER=clang \ -DENABLE_TESTS=ON \ -DCMAKE_BUILD_TYPE="${sanitizer}" \ -DUSE_CCACHE=ON \ -DRUN_HAVE_STD_REGEX=0 \ -DCMAKE_PREFIX_PATH=/usr/local \ -DUSE_GM_SSL=0 \ -GNinja run_with_sanitizer_runtime ninja -j"${build_jobs}" gtests_dbms gtests_libcommon gtests_libdaemon ) rm -rf /tests /tiflash ln -s "${repo_root}/tests" /tests mkdir -p /tiflash cp "${scratch_root}/build-${sanitizer}/dbms/gtests_dbms" /tiflash cp "${scratch_root}/build-${sanitizer}/libs/libcommon/src/tests/gtests_libcommon" /tiflash cp "${scratch_root}/build-${sanitizer}/libs/libdaemon/src/tests/gtests_libdaemon" /tiflash source /tests/docker/util.sh show_env UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=0 \ LSAN_OPTIONS=suppressions=/tests/sanitize/asan.suppression \ TSAN_OPTIONS="suppressions=/tests/sanitize/tsan.suppression" \ ENV_VARS_PATH=/tests/docker/_env.sh \ NPROC="${test_workers}" \ run_with_sanitizer_runtime /tests/run-gtest.sh command: - /bin/bash - -ce env: - name: SANITIZER value: TSan - name: CI_SCRATCH_ROOT value: /workspace image: ghcr.io/pingcap-qe/cd/builders/tiflash:v2025.8.10-2-gc9e3144-centos7 imagePullPolicy: Always name: run-sanitizer resources: limits: cpu: "24" ephemeral-storage: 30Gi memory: 64Gi requests: cpu: "24" ephemeral-storage: 20Gi memory: 64Gi securityContext: privileged: true volumeMounts: - mountPath: /workspace name: workspace volumes: - ephemeral: volumeClaimTemplate: metadata: creationTimestamp: null spec: accessModes: - ReadWriteOnce resources: requests: storage: 100Gi storageClassName: ci-rwo name: workspace prowjob_defaults: tenant_id: GlobalDefaultID refs: base_link: https://github.com/pingcap/tiflash/commit/f152f09259571fa19798036b983ec17434270db6 base_ref: master base_sha: f152f09259571fa19798036b983ec17434270db6 clone_uri: git@github.com:pingcap/tiflash.git org: pingcap pulls: - author: windtalker author_link: https://github.com/windtalker commit_link: https://github.com/pingcap/tiflash/pull/11224/commits/1e1ea5f4067c4586f662bee5ba6c33bd37991e0b head_ref: fix/validate-arrow-chunk-decoding link: https://github.com/pingcap/tiflash/pull/11224 number: 11224 sha: 1e1ea5f4067c4586f662bee5ba6c33bd37991e0b title: 'security: validate Arrow chunk payloads before decoding' repo: tiflash repo_link: https://github.com/pingcap/tiflash report: true rerun_command: /test pull-sanitizer-tsan type: presubmit status: build_id: "2117885755589136384" completionTime: "2026-11-04T08:52:58Z" description: Job succeeded. pendingTime: "2026-11-04T07:44:47Z" pod_name: de1d9f3c-65ff-4a5c-97ba-3e3c40529acd prev_report_states: gcsk8sreporter: success gcsreporter: success github-reporter: success startTime: "2026-11-04T07:44:47Z" state: success url: https://prow.tidb.net/view/gs/prow-tidb-logs/pr-logs/pull/pingcap_tiflash/11224/pull-sanitizer-tsan/2117885755589136384