From 7282501d511d18ac65a66f1c11ca1dbefe2f59c0 Mon Sep 17 00:00:00 2001
From: Yuan <yuanzhou@apache.org>
Date: Wed, 27 May 2026 16:06:30 +0100
Subject: [PATCH] The code pattern defaultLeafVeloxMemoryPool().get() creates a
 temporary shared_ptr, calls .get() on it to extract the raw pointer, then
 immediately destroys the shared_ptr. This leaves a dangling raw pointer that
 can cause segfaults, especially in certain JDK distributions.

Signed-off-by: Yuan <yuanzhou@apache.org>
---
 cpp/velox/benchmarks/PlanValidatorUtil.cc   | 4 ++--
 cpp/velox/jni/VeloxJniWrapper.cc            | 8 ++++----
 cpp/velox/substrait/SubstraitToVeloxPlan.cc | 3 ++-
 cpp/velox/utils/VeloxArrowUtils.cc          | 3 ++-
 4 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/cpp/velox/benchmarks/PlanValidatorUtil.cc b/cpp/velox/benchmarks/PlanValidatorUtil.cc
index 20d02db6c49..7a474f181ae 100644
--- a/cpp/velox/benchmarks/PlanValidatorUtil.cc
+++ b/cpp/velox/benchmarks/PlanValidatorUtil.cc
@@ -44,8 +44,8 @@ int main(int argc, char** argv) {
   std::unordered_map<std::string, std::string> conf;
   conf.insert({kDebugModeEnabled, "true"});
   initVeloxBackend(conf);
-  auto pool = defaultLeafVeloxMemoryPool().get();
-  SubstraitToVeloxPlanValidator planValidator(pool);
+  auto pool = defaultLeafVeloxMemoryPool();
+  SubstraitToVeloxPlanValidator planValidator(pool.get());
 
   ::substrait::Plan subPlan;
   parseProtobuf(reinterpret_cast<uint8_t*>(plan.data()), plan.size(), &subPlan);
diff --git a/cpp/velox/jni/VeloxJniWrapper.cc b/cpp/velox/jni/VeloxJniWrapper.cc
index aa4d9599435..57a1d986e00 100644
--- a/cpp/velox/jni/VeloxJniWrapper.cc
+++ b/cpp/velox/jni/VeloxJniWrapper.cc
@@ -194,8 +194,8 @@ Java_org_apache_gluten_vectorized_PlanEvaluatorJniWrapper_nativeValidateWithFail
     }
   }
 
-  const auto pool = defaultLeafVeloxMemoryPool().get();
-  SubstraitToVeloxPlanValidator planValidator(pool);
+  auto pool = defaultLeafVeloxMemoryPool();
+  SubstraitToVeloxPlanValidator planValidator(pool.get());
   ::substrait::Plan subPlan;
   parseProtobuf(planData, planSize, &subPlan);
 
@@ -252,8 +252,8 @@ JNIEXPORT jboolean JNICALL Java_org_apache_gluten_vectorized_PlanEvaluatorJniWra
     env->DeleteLocalRef(mapping);
   }
 
-  auto pool = defaultLeafVeloxMemoryPool().get();
-  SubstraitToVeloxPlanValidator planValidator(pool);
+  auto pool = defaultLeafVeloxMemoryPool();
+  SubstraitToVeloxPlanValidator planValidator(pool.get());
   auto inputType = SubstraitParser::parseType(inputSubstraitType);
   if (inputType->kind() != TypeKind::ROW) {
     throw GlutenException("Input type is not a RowType.");
diff --git a/cpp/velox/substrait/SubstraitToVeloxPlan.cc b/cpp/velox/substrait/SubstraitToVeloxPlan.cc
index 5477176ce85..04f018b8a02 100644
--- a/cpp/velox/substrait/SubstraitToVeloxPlan.cc
+++ b/cpp/velox/substrait/SubstraitToVeloxPlan.cc
@@ -1473,10 +1473,11 @@ core::PlanNodePtr SubstraitToVeloxPlanConverter::constructValuesNode(
   // It loads all data from the iterator at plan construction time
   VELOX_CHECK_LT(streamIdx, inputIters_.size(), "Could not find stream index {} in input iterator list.", streamIdx);
   const auto iter = std::move(inputIters_[streamIdx]);
+  auto pool = defaultLeafVeloxMemoryPool();
   std::vector<RowVectorPtr> rowVectors;
   while (iter->hasNext()) {
     auto batch = iter->next();
-    auto veloxBatch = VeloxColumnarBatch::from(defaultLeafVeloxMemoryPool().get(), batch);
+    auto veloxBatch = VeloxColumnarBatch::from(pool.get(), batch);
     rowVectors.emplace_back(veloxBatch->getRowVector());
   }
   auto node = std::make_shared<facebook::velox::core::ValuesNode>(nextPlanNodeId(), std::move(rowVectors));
diff --git a/cpp/velox/utils/VeloxArrowUtils.cc b/cpp/velox/utils/VeloxArrowUtils.cc
index 7c958356257..fe150f3d3d3 100644
--- a/cpp/velox/utils/VeloxArrowUtils.cc
+++ b/cpp/velox/utils/VeloxArrowUtils.cc
@@ -53,7 +53,8 @@ arrow::Result<std::shared_ptr<ColumnarBatch>> recordBatch2VeloxColumnarBatch(con
   ArrowArray arrowArray;
   ArrowSchema arrowSchema;
   RETURN_NOT_OK(arrow::ExportRecordBatch(rb, &arrowArray, &arrowSchema));
-  auto vp = velox::importFromArrowAsOwner(arrowSchema, arrowArray, gluten::defaultLeafVeloxMemoryPool().get());
+  auto pool = gluten::defaultLeafVeloxMemoryPool();
+  auto vp = velox::importFromArrowAsOwner(arrowSchema, arrowArray, pool.get());
   return std::make_shared<VeloxColumnarBatch>(std::dynamic_pointer_cast<velox::RowVector>(vp));
 }