From cab48ced206dbd59871b6fabfaf20571a6fd9e3e Mon Sep 17 00:00:00 2001
From: Alex Duan <417921451@qq.com>
Date: Mon, 28 Nov 2022 21:40:46 +0800
Subject: [PATCH 1/4] fix(query): memory leak with pPageIdList on sort

---
 source/libs/executor/src/tsort.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/source/libs/executor/src/tsort.c b/source/libs/executor/src/tsort.c
index e0a0b9442e..244d403aa0 100644
--- a/source/libs/executor/src/tsort.c
+++ b/source/libs/executor/src/tsort.c
@@ -116,9 +116,12 @@ void tsortClearOrderdSource(SArray *pOrderedSource) {
     if (NULL == *pSource) {
       continue;
     }
-    
+    // release pageIdList
+    if ((*pSource)->pageIdList) {
+      taosArrayDestroy((*pSource)->pageIdList);
+    }
     if ((*pSource)->param && !(*pSource)->onlyRef) {
-      taosMemoryFree((*pSource)->param);  
+      taosMemoryFree((*pSource)->param);
     }
     taosMemoryFreeClear(*pSource);
   }

From 48f4d26acdc52bb9e42670489b822dbbdfb29399 Mon Sep 17 00:00:00 2001
From: Alex Duan <417921451@qq.com>
Date: Mon, 28 Nov 2022 21:49:29 +0800
Subject: [PATCH 2/4] fix(query): memory leak with pPageIdList on sort1

---
 source/libs/executor/src/tsort.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source/libs/executor/src/tsort.c b/source/libs/executor/src/tsort.c
index 244d403aa0..8014074d90 100644
--- a/source/libs/executor/src/tsort.c
+++ b/source/libs/executor/src/tsort.c
@@ -121,7 +121,7 @@ void tsortClearOrderdSource(SArray *pOrderedSource) {
       taosArrayDestroy((*pSource)->pageIdList);
     }
     if ((*pSource)->param && !(*pSource)->onlyRef) {
-      taosMemoryFree((*pSource)->param);
+      taosMemoryFree((*pSource)->param); 
     }
     taosMemoryFreeClear(*pSource);
   }

From 0b3f21bef7d6766ae9a9b0b5567a67dfdd7f8ccf Mon Sep 17 00:00:00 2001
From: Alex Duan <417921451@qq.com>
Date: Mon, 28 Nov 2022 21:51:43 +0800
Subject: [PATCH 3/4] fix(query): memory leak with pPageIdList on sort1

---
 source/libs/executor/src/tsort.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source/libs/executor/src/tsort.c b/source/libs/executor/src/tsort.c
index 8014074d90..244d403aa0 100644
--- a/source/libs/executor/src/tsort.c
+++ b/source/libs/executor/src/tsort.c
@@ -121,7 +121,7 @@ void tsortClearOrderdSource(SArray *pOrderedSource) {
       taosArrayDestroy((*pSource)->pageIdList);
     }
     if ((*pSource)->param && !(*pSource)->onlyRef) {
-      taosMemoryFree((*pSource)->param); 
+      taosMemoryFree((*pSource)->param);
     }
     taosMemoryFreeClear(*pSource);
   }

From 3894856918b7e3b01f912213bbf6e83d8dc6fcd0 Mon Sep 17 00:00:00 2001
From: Hongze Cheng <hzcheng@taosdata.com>
Date: Mon, 28 Nov 2022 22:23:01 +0800
Subject: [PATCH 4/4] fix: alter db pages memory leak

---
 source/libs/tdb/src/db/tdbPCache.c | 38 +++++++++++++++++++++---------
 1 file changed, 27 insertions(+), 11 deletions(-)

diff --git a/source/libs/tdb/src/db/tdbPCache.c b/source/libs/tdb/src/db/tdbPCache.c
index a1fee4021e..425e494ab6 100644
--- a/source/libs/tdb/src/db/tdbPCache.c
+++ b/source/libs/tdb/src/db/tdbPCache.c
@@ -349,15 +349,23 @@ static void tdbPCacheUnpinPage(SPCache *pCache, SPage *pPage) {
 
   ASSERT(pPage->pLruNext == NULL);
 
-  pPage->pLruPrev = &(pCache->lru);
-  pPage->pLruNext = pCache->lru.pLruNext;
-  pCache->lru.pLruNext->pLruPrev = pPage;
-  pCache->lru.pLruNext = pPage;
+  tdbDebug("pCache:%p unpin page %p/%d/%d, nPages:%d", pCache, pPage, TDB_PAGE_PGNO(pPage), pPage->id, pCache->nPages);
+  if (pPage->id < pCache->nPages) {
+    pPage->pLruPrev = &(pCache->lru);
+    pPage->pLruNext = pCache->lru.pLruNext;
+    pCache->lru.pLruNext->pLruPrev = pPage;
+    pCache->lru.pLruNext = pPage;
 
-  pCache->nRecyclable++;
+    pCache->nRecyclable++;
 
-  // printf("unpin page %d pgno %d pPage %p\n", pPage->id, TDB_PAGE_PGNO(pPage), pPage);
-  tdbDebug("pcache/unpin page %p/%d/%d", pPage, TDB_PAGE_PGNO(pPage), pPage->id);
+    // printf("unpin page %d pgno %d pPage %p\n", pPage->id, TDB_PAGE_PGNO(pPage), pPage);
+    tdbDebug("pcache/unpin page %p/%d/%d", pPage, TDB_PAGE_PGNO(pPage), pPage->id);
+  } else {
+    tdbDebug("pcache destroy page: %p/%d/%d", pPage, TDB_PAGE_PGNO(pPage), pPage->id);
+
+    tdbPCacheRemovePageFromHash(pCache, pPage);
+    tdbPageDestroy(pPage, tdbDefaultFree, NULL);
+  }
 }
 
 static void tdbPCacheRemovePageFromHash(SPCache *pCache, SPage *pPage) {
@@ -443,10 +451,18 @@ static int tdbPCacheOpenImpl(SPCache *pCache) {
 }
 
 static int tdbPCacheCloseImpl(SPCache *pCache) {
-  for (i32 iPage = 0; iPage < pCache->nPages; iPage++) {
-    if (pCache->aPage[iPage]) {
-      tdbPageDestroy(pCache->aPage[iPage], tdbDefaultFree, NULL);
-      pCache->aPage[iPage] = NULL;
+  // free free page
+  for (SPage *pPage = pCache->pFree; pPage;) {
+    SPage *pPageT = pPage->pFreeNext;
+    tdbPageDestroy(pPage, tdbDefaultFree, NULL);
+    pPage = pPageT;
+  }
+
+  for (int32_t iBucket = 0; iBucket < pCache->nHash; iBucket++) {
+    for (SPage *pPage = pCache->pgHash[iBucket]; pPage;) {
+      SPage *pPageT = pPage->pHashNext;
+      tdbPageDestroy(pPage, tdbDefaultFree, NULL);
+      pPage = pPageT;
     }
   }