crossbeam-skiplist: fix RefRange iterator memory leak by ekexium · Pull Request #19284 · tikv/tikv

ekexium · 2026-01-15T07:31:24Z

What is changed and how it works?

Issue Number: Close #19285

What's Changed:

Fix a memory leak in crossbeam-skiplist's RefRange iterator.

RefRange::next() and next_back() were using clone_from() to update self.head/self.tail. Since RefEntry has no Drop implementation (by design - callers must explicitly call release()), the old entry was dropped without decrementing its refcount, causing permanent memory leaks.
Note that the the comment of RefEntry says

/// You *must* call `release` to free this type, otherwise the node will be
/// leaked. This is because releasing the entry requires a `Guard`.

This bug affects any code using SkipMap::range() iterators. In TiKV, this manifests as memory leaks in LockTable when check_range() or find_first() are called.

// Before (buggy):
self.head.clone_from(&next_head);  // Old entry dropped without decrement!

// After (fixed):
if let Some(e) = mem::replace(&mut self.head, next_head.clone()) {
    unsafe { e.node.decrement(guard); }  // Properly decrement old entry
}

The fix matches the pattern already used in RefIter::next().

Stress test results (10 seconds, range iteration + insert/remove cycle):

before fix:
t=10s ops=11710 len=3422 alloc=613MB
after fix:
t=10s ops=11786 len=7530 alloc=3MB

Fix RefRange::next() and next_back() to properly decrement old self.head/self.tail refcount.

Related changes

PR to update pingcap/docs/pingcap/docs-cn:
Need to cherry-pick to the release branch

Check List

Tests

Unit test
Integration test
Manual test (add detailed scripts or steps below)
No code

Side effects

Performance regression: Consumes more CPU
Performance regression: Consumes more Memory
Breaking backward compatibility

Release note

Fix a memory leak in crossbeam-skiplist's RefRange iterator that caused LockTable memory to grow unboundedly when using range queries.

Copilot

Pull request overview

This PR fixes a critical memory leak in the crossbeam-skiplist crate's RefRange iterator implementation. The issue occurred because RefRange::next() and next_back() were using clone_from() to update internal state, which dropped old RefEntry objects without decrementing their reference counts, leading to memory leaks.

Changes:

Fixed memory leak in RefRange::next() by properly decrementing old entry refcount
Fixed memory leak in RefRange::next_back() by properly decrementing old entry refcount
Added regression test range_iter_refcount_leak to prevent future regressions

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
components/crossbeam-skiplist/src/base.rs	Fixed `RefRange::next()` and `next_back()` to use `mem::replace()` with explicit `decrement()` instead of `clone_from()`
components/crossbeam-skiplist/tests/map.rs	Added regression test that exercises range iteration to detect memory leaks

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

RefRange::next() and next_back() were using clone_from() to update self.head/self.tail. Since RefEntry has no Drop implementation, the old entry was dropped without decrementing its refcount, causing permanent memory leaks. Fix by using mem::replace() and manually calling decrement() on the old entry, matching the pattern used in RefIter::next(). Signed-off-by: ekexium <eke@fastmail.com>

overvenus

Should we impl Drop for RefRange and call drop_impl?

ekexium · 2026-01-15T08:57:34Z

Should we impl Drop for RefRange and call drop_impl?

I suppose no because we cannot access guard in drop.
I will submit a PR to upstream and we may discuss there

cfzjywxk

LGTM

ti-chi-bot · 2026-01-19T07:01:49Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cfzjywxk, overvenus

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [cfzjywxk,overvenus]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ti-chi-bot · 2026-01-19T07:01:51Z

[LGTM Timeline notifier]

Timeline:

2026-01-19 05:38:44.486896602 +0000 UTC m=+385952.100853458: ☑️ agreed by overvenus.
2026-01-19 07:01:50.456409072 +0000 UTC m=+390938.070365929: ☑️ agreed by cfzjywxk.

ekexium · 2026-01-19T08:25:31Z

/cherry-pick release-8.5

ti-chi-bot · 2026-01-19T08:26:49Z

@ekexium: new pull request created to branch release-8.5: #19292.

Details

In response to this:

/cherry-pick release-8.5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.

close tikv#19285 Fix RefRange::next() and next_back() to properly decrement old self.head/self.tail refcount. Signed-off-by: ekexium <eke@fastmail.com>

ekexium · 2026-01-19T09:25:31Z

/cherry-pick release-8.5-20251208-v8.5.4

ti-chi-bot · 2026-01-19T09:26:11Z

@ekexium: new pull request created to branch release-8.5-20251208-v8.5.4: #19293.

Details

In response to this:

/cherry-pick release-8.5-20251208-v8.5.4

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.

close #19285 Fix RefRange::next() and next_back() to properly decrement old self.head/self.tail refcount. Signed-off-by: ekexium <eke@fastmail.com> Signed-off-by: lucasliang <nkcs_lykx@hotmail.com> Signed-off-by: you06 <you1474600@gmail.com> Co-authored-by: ekexium <eke@fastmail.com> Co-authored-by: lucasliang <nkcs_lykx@hotmail.com> Co-authored-by: you06 <you1474600@gmail.com>

close tikv#19285 Signed-off-by: ti-chi-bot <ti-community-prow-bot@tidb.io>

ti-chi-bot · 2026-01-22T04:58:12Z

In response to a cherrypick label: new pull request created to branch release-7.5: #19307.

close tikv#19285 Signed-off-by: ti-chi-bot <ti-community-prow-bot@tidb.io>

ti-chi-bot · 2026-01-22T04:58:13Z

In response to a cherrypick label: new pull request created to branch release-8.1: #19308.

close tikv#19285 Signed-off-by: ti-chi-bot <ti-community-prow-bot@tidb.io>

ti-chi-bot · 2026-01-22T04:58:15Z

In response to a cherrypick label: new pull request created to branch release-7.1: #19309.

close #19285 Fix RefRange::next() and next_back() to properly decrement old self.head/self.tail refcount. Signed-off-by: ekexium <eke@fastmail.com> Co-authored-by: ekexium <eke@fastmail.com>

…ikv#19292) close tikv#19285 Fix RefRange::next() and next_back() to properly decrement old self.head/self.tail refcount. Signed-off-by: ekexium <eke@fastmail.com> Co-authored-by: ekexium <eke@fastmail.com> Signed-off-by: Chao Wang <cclcwangchao@hotmail.com>

Copilot AI review requested due to automatic review settings January 15, 2026 07:31

Copilot started reviewing on behalf of ekexium January 15, 2026 07:31 View session

Copilot AI reviewed Jan 15, 2026

View reviewed changes

ekexium force-pushed the fix-skiplist-refrange-leak branch from efe2500 to e44ff00 Compare January 15, 2026 07:40

ti-chi-bot bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jan 15, 2026

ekexium force-pushed the fix-skiplist-refrange-leak branch from e44ff00 to d47fd3f Compare January 15, 2026 07:57

ekexium force-pushed the fix-skiplist-refrange-leak branch from d47fd3f to 043854d Compare January 15, 2026 08:05

ti-chi-bot bot removed the do-not-merge/needs-triage-completed label Jan 15, 2026

overvenus reviewed Jan 15, 2026

View reviewed changes

ekexium mentioned this pull request Jan 15, 2026

fix: release RefEntry in SkipList when dropping it crossbeam-rs/crossbeam#1217

Merged

ekexium requested a review from overvenus January 16, 2026 02:20

overvenus approved these changes Jan 19, 2026

View reviewed changes

ti-chi-bot bot added needs-1-more-lgtm Indicates a PR needs 1 more LGTM. approved labels Jan 19, 2026

ekexium requested a review from cfzjywxk January 19, 2026 05:50

cfzjywxk approved these changes Jan 19, 2026

View reviewed changes

ti-chi-bot bot added lgtm and removed needs-1-more-lgtm Indicates a PR needs 1 more LGTM. labels Jan 19, 2026

ti-chi-bot bot merged commit 2d4737d into tikv:master Jan 19, 2026
9 checks passed

ti-chi-bot bot added this to the Pool milestone Jan 19, 2026

ti-chi-bot mentioned this pull request Jan 19, 2026

crossbeam-skiplist: fix RefRange iterator memory leak (#19284) #19292

Merged

9 tasks

ti-chi-bot mentioned this pull request Jan 19, 2026

crossbeam-skiplist: fix RefRange iterator memory leak (#19284) #19293

Merged

9 tasks

ti-chi-bot bot added needs-cherry-pick-release-8.1 Should cherry pick this PR to release-8.1 branch. needs-cherry-pick-release-7.5 Should cherry pick this PR to release-7.5 branch. needs-cherry-pick-release-7.1 Should cherry pick this PR to release-7.1 branch. labels Jan 22, 2026

ti-chi-bot pushed a commit to ti-chi-bot/tikv that referenced this pull request Jan 22, 2026

This is an automated cherry-pick of tikv#19284

4f9b532

close tikv#19285 Signed-off-by: ti-chi-bot <ti-community-prow-bot@tidb.io>

ti-chi-bot pushed a commit to ti-chi-bot/tikv that referenced this pull request Jan 22, 2026

This is an automated cherry-pick of tikv#19284

fbe79d0

close tikv#19285 Signed-off-by: ti-chi-bot <ti-community-prow-bot@tidb.io>

ti-chi-bot mentioned this pull request Jan 22, 2026

crossbeam-skiplist: fix RefRange iterator memory leak (#19284) #19307

Open

9 tasks

ti-chi-bot mentioned this pull request Jan 22, 2026

crossbeam-skiplist: fix RefRange iterator memory leak (#19284) #19308

Open

9 tasks

ti-chi-bot pushed a commit to ti-chi-bot/tikv that referenced this pull request Jan 22, 2026

This is an automated cherry-pick of tikv#19284

672cb7f

close tikv#19285 Signed-off-by: ti-chi-bot <ti-community-prow-bot@tidb.io>

ti-chi-bot mentioned this pull request Jan 22, 2026

crossbeam-skiplist: fix RefRange iterator memory leak (#19284) #19309

Open

9 tasks

Conversation

ekexium commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What is changed and how it works?

Related changes

Check List

Release note

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

overvenus left a comment

Choose a reason for hiding this comment

Uh oh!

ekexium commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cfzjywxk left a comment

Choose a reason for hiding this comment

Uh oh!

ti-chi-bot bot commented Jan 19, 2026

Uh oh!

ti-chi-bot bot commented Jan 19, 2026

[LGTM Timeline notifier]

Uh oh!

Uh oh!

ekexium commented Jan 19, 2026

Uh oh!

ti-chi-bot commented Jan 19, 2026

Uh oh!

ekexium commented Jan 19, 2026

Uh oh!

ti-chi-bot commented Jan 19, 2026

Uh oh!

ti-chi-bot commented Jan 22, 2026

Uh oh!

ti-chi-bot commented Jan 22, 2026

Uh oh!

ti-chi-bot commented Jan 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ekexium commented Jan 15, 2026 •

edited

Loading

ekexium commented Jan 15, 2026 •

edited

Loading