StatsAccessLogger: fixes connection gauge underflow crashes when decrementing metrics after Scope evictions.

source/common/stats/thread_local_store.cc

@@ -1130,15 +1130,21 @@ void ThreadLocalStoreImpl::evictUnused() {
         MetricBag metrics(scope->scope_id_);
         CentralCacheEntrySharedPtr& central_cache = scope->centralCacheMutableNoThreadAnalysis();
         auto filter_unused = []<typename T>(StatNameHashMap<T>& unused_metrics) {
-          return [&unused_metrics](std::pair<StatName, T> kv) {
+          return [&unused_metrics](const std::pair<const StatName, T>& kv) {
             const auto& [name, metric] = kv;
+            // We assume the gauge is used as an `updown` counter here and if the value is 0, it is
+            // unused.
+            if constexpr (std::is_same_v<T, GaugeSharedPtr>) {
+              if (metric->value() != 0) {
+                return false;
+              }
+            }
             if (metric->used()) {
               metric->markUnused();
               return false;
-            } else {
-              unused_metrics.try_emplace(name, metric);
-              return true;
             }
+            unused_metrics.try_emplace(name, metric);
+            return true;
           };
         };
         absl::erase_if(central_cache->counters_, filter_unused(metrics.counters_));

source/extensions/access_loggers/stats/stats.cc

@@ -19,64 +19,77 @@ using Extensions::Matching::Actions::TransformStat::ActionContext;
 
 class AccessLogState : public StreamInfo::FilterState::Object {
 public:
-  AccessLogState(Stats::ScopeSharedPtr scope) : scope_(std::move(scope)) {}
+  AccessLogState(std::shared_ptr<const StatsAccessLog> parent) : parent_(std::move(parent)) {}
 
-  // When the request is destroyed, we need to subtract the value from the gauge.
-  // We need to look up the gauge again in the scope because it might have been evicted.
-  // The gauge object itself is kept alive by the shared_ptr in the state, so we can access its
-  // name and tags to re-lookup/re-create it in the scope.
   ~AccessLogState() override {
-    for (const auto& [gauge_ptr, state] : inflight_gauges_) {
-      // TODO(taoxuy):  make this as an accessor of the
-      // Stat class.
-      Stats::StatNameTagVector tag_names;
-      state.gauge_->iterateTagStatNames(
-          [&tag_names](Stats::StatName name, Stats::StatName value) -> bool {
-            tag_names.emplace_back(name, value);
-            return true;
-          });
-
-      // Using state.gauge_->statName() directly would be incorrect because it returns the fully
-      // qualified name (including tags). Passing this full name to scope_->gaugeFromStatName(...)
-      // would cause the scope to attempt tag extraction on the full name. Since the tags in
-      // AccessLogState are often dynamic and not configured in the global tag extractors, this
-      // extraction would likely fail to identify the tags correctly, resulting in a gauge with a
-      // different identity (the full name as the stat name and no tags).
-      auto& gauge = scope_->gaugeFromStatNameWithTags(
-          state.gauge_->tagExtractedStatName(), tag_names, Stats::Gauge::ImportMode::Accumulate);
-      gauge.sub(state.value_);
+    for (const std::pair<const GaugeKey, InflightGauge>& p : inflight_gauges_) {
+      Stats::Gauge& gauge_stat = parent_->scope().gaugeFromStatNameWithTags(
+          p.first.statName(), p.first.tags(), p.first.importMode());
+      gauge_stat.sub(p.second.value_);
     }
   }
 
-  void addInflightGauge(Stats::Gauge* gauge, uint64_t value) {
-    inflight_gauges_.try_emplace(gauge, Stats::GaugeSharedPtr(gauge), value);
-  }
+  // Adds an incremental value to an existing gauge, or creates it if that gauge doesn't exist.
+  // Zero values are ignored.
+  void addInflightGauge(Stats::StatName stat_name, Stats::StatNameTagVectorOptConstRef tags,
+                        Stats::Gauge::ImportMode import_mode, uint64_t value,
+                        std::vector<Stats::StatNameDynamicStorage> tags_storage) {
+    if (value == 0) {
+      return;
+    }
 
-  absl::optional<uint64_t> removeInflightGauge(Stats::Gauge* gauge) {
-    auto it = inflight_gauges_.find(gauge);
+    GaugeKey key{stat_name, import_mode, tags};
+
+    auto it = inflight_gauges_.find(key);
     if (it == inflight_gauges_.end()) {
-      return absl::nullopt;
+      key.makeOwned();
+      auto [new_it, inserted] =
+          inflight_gauges_.emplace(std::move(key), InflightGauge{std::move(tags_storage), 0});
+      it = new_it;
+    }
+    it->second.value_ += value;
+    parent_->scope().gaugeFromStatNameWithTags(stat_name, tags, import_mode).add(value);
+  }
+
+  // Removes an amount from an existing gauge, allowing the gauge to be evicted if the value reaches
+  // 0.
+  void removeInflightGauge(Stats::StatName stat_name, Stats::StatNameTagVectorOptConstRef tags,
+                           Stats::Gauge::ImportMode import_mode, uint64_t value) {
+    if (value == 0) {
+      return;
+    }
+
+    GaugeKey key{stat_name, import_mode, tags};
+
+    // Create the gauge so it gets registered in the stat store (expected by some tests and stats
+    // logic)
+    Stats::Gauge& gauge_stat =
+        parent_->scope().gaugeFromStatNameWithTags(stat_name, tags, import_mode);
+
+    auto it = inflight_gauges_.find(key);
+    if (it != inflight_gauges_.end()) {
+      ENVOY_BUG(it->second.value_ >= value, "Connection gauge underflow in removeInflightGauge");
+      it->second.value_ -= value;
+      gauge_stat.sub(value);
+      if (it->second.value_ == 0) {
+        inflight_gauges_.erase(it);
+      }
     }
-    uint64_t value = it->second.value_;
-    inflight_gauges_.erase(it);
-    return value;
   }
 
   static constexpr absl::string_view key() { return "envoy.access_loggers.stats.access_log_state"; }
 
 private:
-  struct State {
-    State(Stats::GaugeSharedPtr gauge, uint64_t value) : gauge_(std::move(gauge)), value_(value) {}
+  // Hold a shared_ptr to the parent to ensure the parent and its members exist for the lifetime of
+  // AccessLogState.
+  std::shared_ptr<const StatsAccessLog> parent_;
 
-    Stats::GaugeSharedPtr gauge_;
+  struct InflightGauge {
+    std::vector<Stats::StatNameDynamicStorage> tags_storage_;
     uint64_t value_;
   };
 
-  Stats::ScopeSharedPtr scope_;
-
-  // The map key holds a raw pointer to the gauge. The value holds a ref-counted pointer to ensure
-  // the gauge is not destroyed if it is evicted from the stats scope.
-  absl::flat_hash_map<Stats::Gauge*, State> inflight_gauges_;
+  absl::flat_hash_map<GaugeKey, InflightGauge> inflight_gauges_;
 };
 
 Formatter::FormatterProviderPtr
@@ -138,6 +151,38 @@ class TagActionValidationVisitor
 
 } // namespace
 
+GaugeKey::GaugeKey(Stats::StatName stat_name, Stats::Gauge::ImportMode import_mode,
+                   Stats::StatNameTagVectorOptConstRef borrowed_tags)
+    : stat_name_(stat_name), import_mode_(import_mode), borrowed_tags_(borrowed_tags) {}
+
+void GaugeKey::makeOwned() {
+  ASSERT(!(borrowed_tags_.has_value() && owned_tags_.has_value()),
+         "Both borrowed and owned tags are present in GaugeKey::makeOwned");
+  if (borrowed_tags_.has_value() && !owned_tags_.has_value()) {
+    owned_tags_ = borrowed_tags_.value().get();
+    borrowed_tags_ = absl::nullopt;
+  }
+}
+
+Stats::StatNameTagVectorOptConstRef GaugeKey::tags() const {
+  if (owned_tags_.has_value()) {
+    return std::cref(owned_tags_.value());
+  }
+  return borrowed_tags_;
+}
+
+bool GaugeKey::operator==(const GaugeKey& rhs) const {
+  if (stat_name_ != rhs.stat_name_ || import_mode_ != rhs.import_mode_) {
+    return false;
+  }
+  Stats::StatNameTagVectorOptConstRef lhs_tags = tags();
+  Stats::StatNameTagVectorOptConstRef rhs_tags = rhs.tags();
+  if (lhs_tags.has_value() != rhs_tags.has_value()) {
+    return false;
+  }
+  return !lhs_tags.has_value() || lhs_tags.value().get() == rhs_tags.value().get();
+}
+
 StatsAccessLog::StatsAccessLog(const envoy::extensions::access_loggers::stats::v3::Config& config,
                                Server::Configuration::GenericFactoryContext& context,
                                AccessLog::FilterPtr&& filter,
@@ -417,31 +462,26 @@ void StatsAccessLog::emitLogForGauge(const Gauge& gauge, const Formatter::Contex
   Stats::Gauge::ImportMode import_mode = op == Gauge::OperationType::SET
                                              ? Stats::Gauge::ImportMode::NeverImport
                                              : Stats::Gauge::ImportMode::Accumulate;
-  auto& gauge_stat = scope_->gaugeFromStatNameWithTags(gauge.stat_.name_, tags, import_mode);
 
-  if (op == Gauge::OperationType::PAIRED_ADD || op == Gauge::OperationType::PAIRED_SUBTRACT) {
+  if (op == Gauge::OperationType::SET) {
+    Stats::Gauge& gauge_stat =
+        scope_->gaugeFromStatNameWithTags(gauge.stat_.name_, tags, import_mode);
+    gauge_stat.set(value);
+  } else if (op == Gauge::OperationType::PAIRED_ADD ||
+             op == Gauge::OperationType::PAIRED_SUBTRACT) {
     auto& filter_state = const_cast<StreamInfo::FilterState&>(stream_info.filterState());
     if (!filter_state.hasData<AccessLogState>(AccessLogState::key())) {
-      filter_state.setData(AccessLogState::key(), std::make_shared<AccessLogState>(scope_),
-                           StreamInfo::FilterState::StateType::Mutable,
-                           StreamInfo::FilterState::LifeSpan::Request);
+      filter_state.setData(
+          AccessLogState::key(), std::make_shared<AccessLogState>(shared_from_this()),
+          StreamInfo::FilterState::StateType::Mutable, StreamInfo::FilterState::LifeSpan::Request);
     }
     auto* state = filter_state.getDataMutable<AccessLogState>(AccessLogState::key());
 
     if (op == Gauge::OperationType::PAIRED_ADD) {
-      state->addInflightGauge(&gauge_stat, value);
-      gauge_stat.add(value);
+      state->addInflightGauge(gauge.stat_.name_, tags, import_mode, value, std::move(storage));
     } else {
-      absl::optional<uint64_t> added_value = state->removeInflightGauge(&gauge_stat);
-      if (added_value.has_value()) {
-        gauge_stat.sub(added_value.value());
-      }
+      state->removeInflightGauge(gauge.stat_.name_, tags, import_mode, value);
     }
-    return;
-  }
-
-  if (op == Gauge::OperationType::SET) {
-    gauge_stat.set(value);
   }
 }
 

source/extensions/access_loggers/stats/stats.h

@@ -6,6 +6,7 @@
 #include "envoy/stats/tag.h"
 
 #include "source/common/matcher/matcher.h"
+#include "source/common/stats/symbol_table.h"
 #include "source/extensions/access_loggers/common/access_log_base.h"
 #include "source/extensions/matching/actions/transform_stat/transform_stat.h"
 
@@ -14,8 +15,57 @@ namespace Extensions {
 namespace AccessLoggers {
 namespace StatsAccessLog {
 
-class StatsAccessLog : public AccessLoggers::Common::ImplBase {
+// GaugeKey serves as a lock-free map key composed of exactly the configuration
+// properties that define a fully resolved gauge metric.
+//
+// It preserves the raw components (base name + tags) allowing us to safely
+// re-create the gauge from the scope if it gets evicted while the request is in-flight.
+//
+// To avoid heap-allocating a new std::vector on every map lookup (which happens
+// on every single gauge increment/decrement), this key acts as a lightweight
+// zero-allocation "view" using `borrowed_tags_` during map lookups.
+// When the key actually needs to be safely persisted into the map, `makeOwned()`
+// is explicitly called to allocate and copy the tags into `owned_tags_`.
+class GaugeKey {
 public:
+  GaugeKey(Stats::StatName stat_name, Stats::Gauge::ImportMode import_mode,
+           Stats::StatNameTagVectorOptConstRef borrowed_tags);
+
+  void makeOwned();
+
+  Stats::StatNameTagVectorOptConstRef tags() const;
+
+  Stats::StatName statName() const { return stat_name_; }
+  Stats::Gauge::ImportMode importMode() const { return import_mode_; }
+
+  bool operator==(const GaugeKey& rhs) const;
+
+  template <typename H> friend H AbslHashValue(H h, const GaugeKey& key) {
+    // We hash the logical tag content to match operator== behavior, ignoring
+    // whether the tags are stored in owned_tags_ or borrowed_tags_. This ensures
+    // that two equal keys produce the same hash regardless of their storage representation.
+    Stats::StatNameTagVectorOptConstRef tags = key.tags();
+    if (tags.has_value()) {
+      h = H::combine(std::move(h), key.stat_name_, key.import_mode_, true);
+      for (const auto& tag : tags.value().get()) {
+        h = H::combine(std::move(h), tag.first, tag.second);
+      }
+      return h;
+    }
+    return H::combine(std::move(h), key.stat_name_, key.import_mode_, false);
+  }
+
+private:
+  Stats::StatName stat_name_;
+  Stats::Gauge::ImportMode import_mode_;
+  absl::optional<Stats::StatNameTagVector> owned_tags_;
+  Stats::StatNameTagVectorOptConstRef borrowed_tags_{absl::nullopt};
+};
+
+class StatsAccessLog : public AccessLoggers::Common::ImplBase,
+                       public std::enable_shared_from_this<StatsAccessLog> {
+public:
+  Stats::Scope& scope() const { return *scope_; }
   StatsAccessLog(const envoy::extensions::access_loggers::stats::v3::Config& config,
                  Server::Configuration::GenericFactoryContext& context,
                  AccessLog::FilterPtr&& filter,
@@ -103,6 +153,7 @@ class StatsAccessLog : public AccessLoggers::Common::ImplBase {
 };
 
 } // namespace StatsAccessLog
+
 } // namespace AccessLoggers
 } // namespace Extensions
 } // namespace Envoy