Fix #1124 TBASE-1483

src/client/src/tscServer.c

@@ -1101,8 +1101,10 @@ static void tscHandleSubRetrievalError(SRetrieveSupport *trsupport, SSqlObj *pSq
     }
   }
 
+  int32_t numOfTotal = pState->numOfTotal;
+
   int32_t finished = atomic_add_fetch_32(&pState->numOfCompleted, 1);
-  if (finished < pState->numOfTotal) {
+  if (finished < numOfTotal) {
     tscTrace("%p sub:%p orderOfSub:%d freed, finished subqueries:%d", pPObj, pSql, trsupport->subqueryIndex, finished);
     return tscFreeSubSqlObj(trsupport, pSql);
   }
@@ -1231,8 +1233,13 @@ void tscRetrieveFromVnodeCallBack(void *param, TAOS_RES *tres, int numOfRows) {
       return tscAbortFurtherRetryRetrieval(trsupport, tres, TSDB_CODE_CLI_NO_DISKSPACE);
     }
   
+    // keep this value local variable, since the pState variable may be released by other threads, if atomic_add opertion
+    // increases the finished value up to pState->numOfTotal value, which means all subqueries are completed.
+    // In this case, the comparsion between finished value and released pState->numOfTotal is not safe. 
+    int32_t numOfTotal = pState->numOfTotal;
+
     int32_t finished = atomic_add_fetch_32(&pState->numOfCompleted, 1);
-    if (finished < pState->numOfTotal) {
+    if (finished < numOfTotal) {
       tscTrace("%p sub:%p orderOfSub:%d freed, finished subqueries:%d", pPObj, pSql, trsupport->subqueryIndex, finished);
       return tscFreeSubSqlObj(trsupport, pSql);
     }
@@ -1241,7 +1248,7 @@ void tscRetrieveFromVnodeCallBack(void *param, TAOS_RES *tres, int numOfRows) {
     pDesc->pSchema->maxCapacity = trsupport->pExtMemBuffer[idx]->numOfElemsPerPage;
 
     tscTrace("%p retrieve from %d vnodes completed.final NumOfRows:%d,start to build loser tree", pPObj,
-             pState->numOfTotal, pState->numOfCompleted);
+             pState->numOfTotal, pState->numOfRetrievedRows);
 
     tscClearInterpInfo(&pPObj->cmd);
     tscCreateLocalReducer(trsupport->pExtMemBuffer, pState->numOfTotal, pDesc, trsupport->pFinalColModel,