StatsAccessLogger: fixes connection gauge underflow crashes when decrementing metrics after Scope evictions.

source/common/stats/thread_local_store.cc

@@ -1130,15 +1130,22 @@ void ThreadLocalStoreImpl::evictUnused() {
         MetricBag metrics(scope->scope_id_);
         CentralCacheEntrySharedPtr& central_cache = scope->centralCacheMutableNoThreadAnalysis();
         auto filter_unused = []<typename T>(StatNameHashMap<T>& unused_metrics) {
-          return [&unused_metrics](std::pair<StatName, T> kv) {
+          return [&unused_metrics](const std::pair<const StatName, T>& kv) {
             const auto& [name, metric] = kv;
+            // Evictable scopes can contain counters, gauges, text-readouts, and histograms. For all
+            // the gauges we find in one, we treat them as up/down counters that become evictable
+            // when they hit zero.
+            if constexpr (std::is_same_v<T, GaugeSharedPtr>) {
+              if (metric->value() != 0) {
+                return false;
+              }
+            }
             if (metric->used()) {
               metric->markUnused();
               return false;
-            } else {
-              unused_metrics.try_emplace(name, metric);
-              return true;
             }
+            unused_metrics.try_emplace(name, metric);
+            return true;
           };
         };
         absl::erase_if(central_cache->counters_, filter_unused(metrics.counters_));

source/extensions/access_loggers/stats/BUILD

@@ -19,6 +19,7 @@ envoy_cc_library(
         "//source/common/access_log:access_log_lib",
         "//source/common/formatter:substitution_format_string_lib",
         "//source/common/matcher:matcher_lib",
+        "//source/common/stats:tag_utility_lib",
         "//source/extensions/access_loggers/common:access_log_base",
         "//source/extensions/matching/actions/transform_stat:transform_stat_lib",
         "@envoy_api//envoy/data/accesslog/v3:pkg_cc_proto",

source/extensions/access_loggers/stats/stats.cc

@@ -17,68 +17,6 @@ namespace {
 
 using Extensions::Matching::Actions::TransformStat::ActionContext;
 
-class AccessLogState : public StreamInfo::FilterState::Object {
-public:
-  AccessLogState(Stats::ScopeSharedPtr scope) : scope_(std::move(scope)) {}
-
-  // When the request is destroyed, we need to subtract the value from the gauge.
-  // We need to look up the gauge again in the scope because it might have been evicted.
-  // The gauge object itself is kept alive by the shared_ptr in the state, so we can access its
-  // name and tags to re-lookup/re-create it in the scope.
-  ~AccessLogState() override {
-    for (const auto& [gauge_ptr, state] : inflight_gauges_) {
-      // TODO(taoxuy):  make this as an accessor of the
-      // Stat class.
-      Stats::StatNameTagVector tag_names;
-      state.gauge_->iterateTagStatNames(
-          [&tag_names](Stats::StatName name, Stats::StatName value) -> bool {
-            tag_names.emplace_back(name, value);
-            return true;
-          });
-
-      // Using state.gauge_->statName() directly would be incorrect because it returns the fully
-      // qualified name (including tags). Passing this full name to scope_->gaugeFromStatName(...)
-      // would cause the scope to attempt tag extraction on the full name. Since the tags in
-      // AccessLogState are often dynamic and not configured in the global tag extractors, this
-      // extraction would likely fail to identify the tags correctly, resulting in a gauge with a
-      // different identity (the full name as the stat name and no tags).
-      auto& gauge = scope_->gaugeFromStatNameWithTags(
-          state.gauge_->tagExtractedStatName(), tag_names, Stats::Gauge::ImportMode::Accumulate);
-      gauge.sub(state.value_);
-    }
-  }
-
-  void addInflightGauge(Stats::Gauge* gauge, uint64_t value) {
-    inflight_gauges_.try_emplace(gauge, Stats::GaugeSharedPtr(gauge), value);
-  }
-
-  absl::optional<uint64_t> removeInflightGauge(Stats::Gauge* gauge) {
-    auto it = inflight_gauges_.find(gauge);
-    if (it == inflight_gauges_.end()) {
-      return absl::nullopt;
-    }
-    uint64_t value = it->second.value_;
-    inflight_gauges_.erase(it);
-    return value;
-  }
-
-  static constexpr absl::string_view key() { return "envoy.access_loggers.stats.access_log_state"; }
-
-private:
-  struct State {
-    State(Stats::GaugeSharedPtr gauge, uint64_t value) : gauge_(std::move(gauge)), value_(value) {}
-
-    Stats::GaugeSharedPtr gauge_;
-    uint64_t value_;
-  };
-
-  Stats::ScopeSharedPtr scope_;
-
-  // The map key holds a raw pointer to the gauge. The value holds a ref-counted pointer to ensure
-  // the gauge is not destroyed if it is evicted from the stats scope.
-  absl::flat_hash_map<Stats::Gauge*, State> inflight_gauges_;
-};
-
 Formatter::FormatterProviderPtr
 parseValueFormat(absl::string_view format,
                  const std::vector<Formatter::CommandParserPtr>& commands) {
@@ -138,6 +76,61 @@ class TagActionValidationVisitor
 
 } // namespace
 
+AccessLogState::~AccessLogState() {
+  for (const auto& p : inflight_gauges_) {
+    Stats::Gauge& gauge_stat = parent_->scope().gaugeFromStatName(p.first, p.second.import_mode_);
+    gauge_stat.sub(p.second.value_);
+  }
+}
+
+void AccessLogState::addInflightGauge(Stats::StatName stat_name,
+                                      Stats::StatNameTagVectorOptConstRef tags,
+                                      Stats::Gauge::ImportMode import_mode, uint64_t value,
+                                      std::vector<Stats::StatNameDynamicStorage> tags_storage) {
+  if (value == 0) {
+    return;
+  }
+
+  Stats::TagUtility::TagStatNameJoiner joiner(Stats::StatName(), stat_name, tags,
+                                              parent_->scope().symbolTable());
+  Stats::StatName joined_name = joiner.nameWithTags();
+
+  auto it = inflight_gauges_.find(joined_name);
+  if (it == inflight_gauges_.end()) {
+    auto [new_it, inserted] = inflight_gauges_.try_emplace(
+        joined_name, 0, import_mode, std::move(tags_storage), std::move(joiner));
+    it = new_it;
+  }
+  it->second.value_ += value;
+  parent_->scope().gaugeFromStatName(joined_name, import_mode).add(value);
+}
+
+void AccessLogState::removeInflightGauge(Stats::StatName stat_name,
+                                         Stats::StatNameTagVectorOptConstRef tags,
+                                         Stats::Gauge::ImportMode import_mode, uint64_t value) {
+  if (value == 0) {
+    return;
+  }
+
+  Stats::TagUtility::TagStatNameJoiner joiner(Stats::StatName(), stat_name, tags,
+                                              parent_->scope().symbolTable());
+  Stats::StatName joined_name = joiner.nameWithTags();
+
+  Stats::Gauge& gauge_stat = parent_->scope().gaugeFromStatName(joined_name, import_mode);
+
+  auto it = inflight_gauges_.find(joined_name);
+  const bool was_found = (it != inflight_gauges_.end());
+  if (was_found) {
+    ENVOY_BUG(it->second.value_ >= value, "Connection gauge underflow in removeInflightGauge");
+    it->second.value_ -= value;
+    gauge_stat.sub(value);
+    if (it->second.value_ == 0) {
+      inflight_gauges_.erase(it);
+    }
+  }
+  ASSERT(was_found);
+}
+
 StatsAccessLog::StatsAccessLog(const envoy::extensions::access_loggers::stats::v3::Config& config,
                                Server::Configuration::GenericFactoryContext& context,
                                AccessLog::FilterPtr&& filter,
@@ -417,31 +410,28 @@ void StatsAccessLog::emitLogForGauge(const Gauge& gauge, const Formatter::Contex
   Stats::Gauge::ImportMode import_mode = op == Gauge::OperationType::SET
                                              ? Stats::Gauge::ImportMode::NeverImport
                                              : Stats::Gauge::ImportMode::Accumulate;
-  auto& gauge_stat = scope_->gaugeFromStatNameWithTags(gauge.stat_.name_, tags, import_mode);
 
-  if (op == Gauge::OperationType::PAIRED_ADD || op == Gauge::OperationType::PAIRED_SUBTRACT) {
+  if (op == Gauge::OperationType::SET) {
+    Stats::Gauge& gauge_stat =
+        scope_->gaugeFromStatNameWithTags(gauge.stat_.name_, tags, import_mode);
+    gauge_stat.set(value);
+  } else if (op == Gauge::OperationType::PAIRED_ADD ||
+             op == Gauge::OperationType::PAIRED_SUBTRACT) {
     auto& filter_state = const_cast<StreamInfo::FilterState&>(stream_info.filterState());
     if (!filter_state.hasData<AccessLogState>(AccessLogState::key())) {
-      filter_state.setData(AccessLogState::key(), std::make_shared<AccessLogState>(scope_),
-                           StreamInfo::FilterState::StateType::Mutable,
-                           StreamInfo::FilterState::LifeSpan::Request);
+      // TODO(TAOXUY): Create a new PR that adds test coverage around any corner cases of which
+      // level should be used, and adds this comment or an updated version.
+      filter_state.setData(
+          AccessLogState::key(), std::make_shared<AccessLogState>(shared_from_this()),
+          StreamInfo::FilterState::StateType::Mutable, StreamInfo::FilterState::LifeSpan::Request);
     }
     auto* state = filter_state.getDataMutable<AccessLogState>(AccessLogState::key());
 
     if (op == Gauge::OperationType::PAIRED_ADD) {
-      state->addInflightGauge(&gauge_stat, value);
-      gauge_stat.add(value);
+      state->addInflightGauge(gauge.stat_.name_, tags, import_mode, value, std::move(storage));
     } else {
-      absl::optional<uint64_t> added_value = state->removeInflightGauge(&gauge_stat);
-      if (added_value.has_value()) {
-        gauge_stat.sub(added_value.value());
-      }
+      state->removeInflightGauge(gauge.stat_.name_, tags, import_mode, value);
     }
-    return;
-  }
-
-  if (op == Gauge::OperationType::SET) {
-    gauge_stat.set(value);
   }
 }
 

source/extensions/access_loggers/stats/stats.h

@@ -4,18 +4,25 @@
 #include "envoy/extensions/access_loggers/stats/v3/stats.pb.h"
 #include "envoy/stats/stats.h"
 #include "envoy/stats/tag.h"
+#include "envoy/stream_info/filter_state.h"
 
 #include "source/common/matcher/matcher.h"
+#include "source/common/stats/symbol_table.h"
+#include "source/common/stats/tag_utility.h"
 #include "source/extensions/access_loggers/common/access_log_base.h"
 #include "source/extensions/matching/actions/transform_stat/transform_stat.h"
 
+#include "absl/container/flat_hash_map.h"
+
 namespace Envoy {
 namespace Extensions {
 namespace AccessLoggers {
 namespace StatsAccessLog {
 
-class StatsAccessLog : public AccessLoggers::Common::ImplBase {
+class StatsAccessLog : public AccessLoggers::Common::ImplBase,
+                       public std::enable_shared_from_this<StatsAccessLog> {
 public:
+  Stats::Scope& scope() const { return *scope_; }
   StatsAccessLog(const envoy::extensions::access_loggers::stats::v3::Config& config,
                  Server::Configuration::GenericFactoryContext& context,
                  AccessLog::FilterPtr&& filter,
@@ -102,7 +109,48 @@ class StatsAccessLog : public AccessLoggers::Common::ImplBase {
   const std::vector<Gauge> gauges_;
 };
 
+class AccessLogState : public StreamInfo::FilterState::Object {
+public:
+  AccessLogState(std::shared_ptr<const StatsAccessLog> parent) : parent_(std::move(parent)) {}
+
+  ~AccessLogState() override;
+
+  // Adds an incremental value to an existing gauge, or creates it if that gauge doesn't exist.
+  // Zero values are ignored. If the same value isn't removed with `removeInflightGauge`, the
+  // value is removed when the object is destroyed.
+  void addInflightGauge(Stats::StatName stat_name, Stats::StatNameTagVectorOptConstRef tags,
+                        Stats::Gauge::ImportMode import_mode, uint64_t value,
+                        std::vector<Stats::StatNameDynamicStorage> tags_storage);
+
+  // Removes an amount from an existing gauge, allowing the gauge to be evicted if the value reaches
+  // 0.
+  void removeInflightGauge(Stats::StatName stat_name, Stats::StatNameTagVectorOptConstRef tags,
+                           Stats::Gauge::ImportMode import_mode, uint64_t value);
+
+  static constexpr absl::string_view key() { return "envoy.access_loggers.stats.access_log_state"; }
+
+private:
+  // Hold a shared_ptr to the parent to ensure the parent and its members exist for the lifetime of
+  // AccessLogState.
+  std::shared_ptr<const StatsAccessLog> parent_;
+
+  struct InflightGauge {
+    InflightGauge(uint64_t value, Stats::Gauge::ImportMode import_mode,
+                  std::vector<Stats::StatNameDynamicStorage> tags_storage,
+                  Stats::TagUtility::TagStatNameJoiner&& joiner)
+        : tags_storage_(std::move(tags_storage)), value_(value), import_mode_(import_mode),
+          joiner_(std::move(joiner)) {}
+    std::vector<Stats::StatNameDynamicStorage> tags_storage_;
+    uint64_t value_;
+    Stats::Gauge::ImportMode import_mode_;
+    Stats::TagUtility::TagStatNameJoiner joiner_;
+  };
+
+  absl::flat_hash_map<Stats::StatName, InflightGauge> inflight_gauges_;
+};
+
 } // namespace StatsAccessLog
+
 } // namespace AccessLoggers
 } // namespace Extensions
 } // namespace Envoy