Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Segmentation fault at DB::FunctionComparison<DB::LessOp, DB::NameLess>::executeString #50236

Closed
JZuming opened this issue May 25, 2023 · 1 comment · Fixed by #50343
Closed
Assignees
Labels
bug Confirmed user-visible misbehaviour in official release crash Crash / segfault / abort v22.8-affected v23.3-affected

Comments

@JZuming
Copy link

JZuming commented May 25, 2023

Describe what's wrong

The SELECT statement makes the server segmentation fault.

Does it reproduce on recent release?

It can be reproduced in the latest version.

How to reproduce

Version: 23.5.1.1 (commit 3e63146)

Easy reproduce in ClickHouse fiddle: https://fiddle.clickhouse.com/7218a67f-5321-4bf3-b8f9-fb587bc4bd2c

Set up database

create table t0 (vkey UInt32, pkey UInt32, c0 UInt32) engine = TinyLog;
create table t1 (vkey UInt32, primary key(vkey)) engine = AggregatingMergeTree;
insert into t0 values (15, 25000, 58);

Bug-triggering query

select
    ref_5.pkey as c_2_c2392_6
  from
    t0 as ref_5
  where ('J[' < (case when (ref_5.pkey in (select 1)
          ) then (bitShiftLeft(case when (ref_5.c0 > (
            select
                ref_7.vkey as c_8_c2385_0
              from
                t1 as ref_7
              order by c_8_c2385_0 asc limit 1
            )) then '1' else ')' end, 40)) else null end));

Expected behavior

No segmentation fault.

Actual behavior

Trigger a segmentation fault.

The log:

[a2b250d9872b] 2023.05.25 14:46:01.551600 [ 572892 ] <Fatal> BaseDaemon: ########################################
[a2b250d9872b] 2023.05.25 14:46:01.551807 [ 572892 ] <Fatal> BaseDaemon: (version 23.5.1.1, build id: 123EBFA2B6BC92FB463A515591CBB3E19FF6AE27) (from thread 3598) (query_id: ed333e38-c410-4729-9260-89c4436aeada) (query: select
    ref_5.pkey as c_2_c2392_6
  from
    t0 as ref_5
  where ('J[' < (case when (ref_5.pkey in (select 1)
          ) then (bitShiftLeft(case when (ref_5.c0 > (
            select
                ref_7.vkey as c_8_c2385_0
              from
                t1 as ref_7
              order by c_8_c2385_0 asc limit 1
            )) then '1' else ')' end, 40)) else null end));) Received signal Segmentation fault (11)
[a2b250d9872b] 2023.05.25 14:46:01.551867 [ 572892 ] <Fatal> BaseDaemon: Address: 0x6e3b3c0. Access: write. Attempted access has violated the permissions assigned to the memory area.
[a2b250d9872b] 2023.05.25 14:46:01.551898 [ 572892 ] <Fatal> BaseDaemon: Stack trace: 0x000000000ea916eb 0x000000000f826130 0x000000000f816c4e 0x000000000cdd8ace 0x00000000165d05cb 0x00000000165d081c 0x00000000165d057d 0x00000000165d0e2a 0x00000000165d1e5b 0x0000000016e4f29c 0x0000000016e4fff8 0x0000000016e7177f 0x00000000176dff4f 0x00000000176da0ee 0x00000000176d53ee 0x00000000176d29d1 0x000000001776041a 0x000000001775e368 0x000000001769b833 0x000000001769aa15 0x0000000017a13618 0x0000000017a11476 0x00000000186a9e0b 0x00000000186ba299 0x000000001ac7f807 0x000000001ac7fced 0x000000001ade62e7 0x000000001ade3ea3 0x00007fda3696e609 0x00007fda36893133
[a2b250d9872b] 2023.05.25 14:46:02.995074 [ 572892 ] <Fatal> BaseDaemon: 3. DB::StringComparisonImpl<DB::GreaterOp<int, int>>::string_vector_constant(DB::PODArray<char8_t, 4096ul, Allocator<false, false>, 63ul, 64ul> const&, DB::PODArray<unsigned long, 4096ul, Allocator<false, false>, 63ul, 64ul> const&, DB::PODArray<char8_t, 4096ul, Allocator<false, false>, 63ul, 64ul> const&, unsigned long, DB::PODArray<char8_t, 4096ul, Allocator<false, false>, 63ul, 64ul>&) @ 0x000000000ea916eb in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:04.467124 [ 572892 ] <Fatal> BaseDaemon: 4. DB::FunctionComparison<DB::LessOp, DB::NameLess>::executeString(DB::IColumn const*, DB::IColumn const*) const @ 0x000000000f826130 in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:05.946233 [ 572892 ] <Fatal> BaseDaemon: 5. DB::FunctionComparison<DB::LessOp, DB::NameLess>::executeImpl(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x000000000f816c4e in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:07.204851 [ 572892 ] <Fatal> BaseDaemon: 6. DB::FunctionToExecutableFunctionAdaptor::executeImpl(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x000000000cdd8ace in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:07.235020 [ 572892 ] <Fatal> BaseDaemon: 7. ./build/./src/Functions/IFunction.cpp:0: DB::IExecutableFunction::executeWithoutLowCardinalityColumns(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x00000000165d05cb in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:07.255458 [ 572892 ] <Fatal> BaseDaemon: 8. ./build/./src/Functions/IFunction.cpp:0: DB::IExecutableFunction::defaultImplementationForNulls(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x00000000165d081c in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:07.275171 [ 572892 ] <Fatal> BaseDaemon: 9. ./build/./src/Functions/IFunction.cpp:0: DB::IExecutableFunction::executeWithoutLowCardinalityColumns(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x00000000165d057d in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:07.296226 [ 572892 ] <Fatal> BaseDaemon: 10.1. inlined from ./build/./contrib/boost/boost/smart_ptr/intrusive_ptr.hpp:115: intrusive_ptr
[a2b250d9872b] 2023.05.25 14:46:07.296339 [ 572892 ] <Fatal> BaseDaemon: 10.2. inlined from ./build/./contrib/boost/boost/smart_ptr/intrusive_ptr.hpp:122: boost::intrusive_ptr<DB::IColumn const>::operator=(boost::intrusive_ptr<DB::IColumn const>&&)
[a2b250d9872b] 2023.05.25 14:46:07.296411 [ 572892 ] <Fatal> BaseDaemon: 10.3. inlined from ./build/./src/Common/COW.h:136: COW<DB::IColumn>::immutable_ptr<DB::IColumn>::operator=(COW<DB::IColumn>::immutable_ptr<DB::IColumn>&&)
[a2b250d9872b] 2023.05.25 14:46:07.296459 [ 572892 ] <Fatal> BaseDaemon: 10. ./build/./src/Functions/IFunction.cpp:302: DB::IExecutableFunction::executeWithoutSparseColumns(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x00000000165d0e2a in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:07.319268 [ 572892 ] <Fatal> BaseDaemon: 11. ./build/./src/Functions/IFunction.cpp:374: DB::IExecutableFunction::execute(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x00000000165d1e5b in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:07.385235 [ 572892 ] <Fatal> BaseDaemon: 12.1. inlined from ./build/./contrib/boost/boost/smart_ptr/intrusive_ptr.hpp:115: intrusive_ptr
[a2b250d9872b] 2023.05.25 14:46:07.385347 [ 572892 ] <Fatal> BaseDaemon: 12.2. inlined from ./build/./contrib/boost/boost/smart_ptr/intrusive_ptr.hpp:122: boost::intrusive_ptr<DB::IColumn const>::operator=(boost::intrusive_ptr<DB::IColumn const>&&)
[a2b250d9872b] 2023.05.25 14:46:07.385385 [ 572892 ] <Fatal> BaseDaemon: 12.3. inlined from ./build/./src/Common/COW.h:136: COW<DB::IColumn>::immutable_ptr<DB::IColumn>::operator=(COW<DB::IColumn>::immutable_ptr<DB::IColumn>&&)
[a2b250d9872b] 2023.05.25 14:46:07.385451 [ 572892 ] <Fatal> BaseDaemon: 12.4. inlined from ./build/./src/Interpreters/ExpressionActions.cpp:613: DB::executeAction(DB::ExpressionActions::Action const&, DB::(anonymous namespace)::ExecutionContext&, bool)
[a2b250d9872b] 2023.05.25 14:46:07.385502 [ 572892 ] <Fatal> BaseDaemon: 12. ./build/./src/Interpreters/ExpressionActions.cpp:730: DB::ExpressionActions::execute(DB::Block&, unsigned long&, bool) const @ 0x0000000016e4f29c in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:07.456474 [ 572892 ] <Fatal> BaseDaemon: 13.1. inlined from ./build/./contrib/llvm-project/libcxx/include/vector:537: std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>>::size[abi:v15000]() const
[a2b250d9872b] 2023.05.25 14:46:07.456592 [ 572892 ] <Fatal> BaseDaemon: 13.2. inlined from ./build/./src/Core/Block.h:106: DB::Block::columns() const
[a2b250d9872b] 2023.05.25 14:46:07.456673 [ 572892 ] <Fatal> BaseDaemon: 13.3. inlined from ./build/./src/Core/Block.h:117: DB::Block::operator bool() const
[a2b250d9872b] 2023.05.25 14:46:07.456726 [ 572892 ] <Fatal> BaseDaemon: 13.4. inlined from ./build/./src/Core/Block.h:118: DB::Block::operator!() const
[a2b250d9872b] 2023.05.25 14:46:07.456838 [ 572892 ] <Fatal> BaseDaemon: 13. ./build/./src/Interpreters/ExpressionActions.cpp:776: DB::ExpressionActions::execute(DB::Block&, bool) const @ 0x0000000016e4fff8 in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:07.598060 [ 572892 ] <Fatal> BaseDaemon: 14. ./build/./src/Interpreters/ExpressionAnalyzer.cpp:0: DB::ExpressionAnalysisResult::ExpressionAnalysisResult(DB::SelectQueryExpressionAnalyzer&, std::shared_ptr<DB::StorageInMemoryMetadata const> const&, bool, bool, bool, std::shared_ptr<DB::FilterDAGInfo> const&, std::shared_ptr<DB::FilterDAGInfo> const&, DB::Block const&) @ 0x0000000016e7177f in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:07.775460 [ 572892 ] <Fatal> BaseDaemon: 15. ./build/./src/Interpreters/InterpreterSelectQuery.cpp:932: DB::InterpreterSelectQuery::getSampleBlockImpl() @ 0x00000000176dff4f in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:07.932171 [ 572892 ] <Fatal> BaseDaemon: 16. ./build/./src/Interpreters/InterpreterSelectQuery.cpp:765: DB::InterpreterSelectQuery::InterpreterSelectQuery(std::shared_ptr<DB::IAST> const&, std::shared_ptr<DB::Context> const&, std::optional<DB::Pipe>, std::shared_ptr<DB::IStorage> const&, DB::SelectQueryOptions const&, std::vector<String, std::allocator<String>> const&, std::shared_ptr<DB::StorageInMemoryMetadata const> const&, std::shared_ptr<DB::PreparedSets>)::$_4::operator()(bool) const @ 0x00000000176da0ee in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:08.084486 [ 572892 ] <Fatal> BaseDaemon: 17. ./build/./src/Interpreters/InterpreterSelectQuery.cpp:0: DB::InterpreterSelectQuery::InterpreterSelectQuery(std::shared_ptr<DB::IAST> const&, std::shared_ptr<DB::Context> const&, std::optional<DB::Pipe>, std::shared_ptr<DB::IStorage> const&, DB::SelectQueryOptions const&, std::vector<String, std::allocator<String>> const&, std::shared_ptr<DB::StorageInMemoryMetadata const> const&, std::shared_ptr<DB::PreparedSets>) @ 0x00000000176d53ee in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:08.236788 [ 572892 ] <Fatal> BaseDaemon: 18.1. inlined from ./build/./contrib/llvm-project/libcxx/include/optional:260: ~__optional_destruct_base
[a2b250d9872b] 2023.05.25 14:46:08.236905 [ 572892 ] <Fatal> BaseDaemon: 18. ./build/./src/Interpreters/InterpreterSelectQuery.cpp:203: DB::InterpreterSelectQuery::InterpreterSelectQuery(std::shared_ptr<DB::IAST> const&, std::shared_ptr<DB::Context> const&, DB::SelectQueryOptions const&, std::vector<String, std::allocator<String>> const&) @ 0x00000000176d29d1 in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:08.289769 [ 572892 ] <Fatal> BaseDaemon: 19. ./build/./src/Interpreters/InterpreterSelectWithUnionQuery.cpp:257: DB::InterpreterSelectWithUnionQuery::buildCurrentChildInterpreter(std::shared_ptr<DB::IAST> const&, std::vector<String, std::allocator<String>> const&) @ 0x000000001776041a in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:08.334398 [ 572892 ] <Fatal> BaseDaemon: 20. ./build/./src/Interpreters/InterpreterSelectWithUnionQuery.cpp:152: DB::InterpreterSelectWithUnionQuery::InterpreterSelectWithUnionQuery(std::shared_ptr<DB::IAST> const&, std::shared_ptr<DB::Context>, DB::SelectQueryOptions const&, std::vector<String, std::allocator<String>> const&) @ 0x000000001775e368 in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:08.356810 [ 572892 ] <Fatal> BaseDaemon: 21.1. inlined from ./build/./contrib/llvm-project/libcxx/include/vector:434: ~vector
[a2b250d9872b] 2023.05.25 14:46:08.356949 [ 572892 ] <Fatal> BaseDaemon: 21. ./build/./contrib/llvm-project/libcxx/include/__memory/unique_ptr.h:714: std::__unique_if<DB::InterpreterSelectWithUnionQuery>::__unique_single std::make_unique[abi:v15000]<DB::InterpreterSelectWithUnionQuery, std::shared_ptr<DB::IAST>&, std::shared_ptr<DB::Context>&, DB::SelectQueryOptions const&>(std::shared_ptr<DB::IAST>&, std::shared_ptr<DB::Context>&, DB::SelectQueryOptions const&) @ 0x000000001769b833 in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:08.379324 [ 572892 ] <Fatal> BaseDaemon: 22. ./build/./src/Interpreters/InterpreterFactory.cpp:0: DB::InterpreterFactory::get(std::shared_ptr<DB::IAST>&, std::shared_ptr<DB::Context>, DB::SelectQueryOptions const&) @ 0x000000001769aa15 in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:08.479136 [ 572892 ] <Fatal> BaseDaemon: 23. ./build/./src/Interpreters/executeQuery.cpp:0: DB::executeQueryImpl(char const*, char const*, std::shared_ptr<DB::Context>, bool, DB::QueryProcessingStage::Enum, DB::ReadBuffer*) @ 0x0000000017a13618 in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:08.588016 [ 572892 ] <Fatal> BaseDaemon: 24. ./build/./src/Interpreters/executeQuery.cpp:1173: DB::executeQuery(String const&, std::shared_ptr<DB::Context>, bool, DB::QueryProcessingStage::Enum) @ 0x0000000017a11476 in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:08.669112 [ 572892 ] <Fatal> BaseDaemon: 25. ./build/./src/Server/TCPHandler.cpp:0: DB::TCPHandler::runImpl() @ 0x00000000186a9e0b in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:08.786201 [ 572892 ] <Fatal> BaseDaemon: 26. ./build/./src/Server/TCPHandler.cpp:2045: DB::TCPHandler::run() @ 0x00000000186ba299 in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:08.789770 [ 572892 ] <Fatal> BaseDaemon: 27. ./build/./base/poco/Net/src/TCPServerConnection.cpp:57: Poco::Net::TCPServerConnection::start() @ 0x000000001ac7f807 in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:08.795516 [ 572892 ] <Fatal> BaseDaemon: 28.1. inlined from ./build/./contrib/llvm-project/libcxx/include/__memory/unique_ptr.h:48: std::default_delete<Poco::Net::TCPServerConnection>::operator()[abi:v15000](Poco::Net::TCPServerConnection*) const
[a2b250d9872b] 2023.05.25 14:46:08.795627 [ 572892 ] <Fatal> BaseDaemon: 28.2. inlined from ./build/./contrib/llvm-project/libcxx/include/__memory/unique_ptr.h:305: std::unique_ptr<Poco::Net::TCPServerConnection, std::default_delete<Poco::Net::TCPServerConnection>>::reset[abi:v15000](Poco::Net::TCPServerConnection*)
[a2b250d9872b] 2023.05.25 14:46:08.795665 [ 572892 ] <Fatal> BaseDaemon: 28.3. inlined from ./build/./contrib/llvm-project/libcxx/include/__memory/unique_ptr.h:259: ~unique_ptr
[a2b250d9872b] 2023.05.25 14:46:08.795703 [ 572892 ] <Fatal> BaseDaemon: 28. ./build/./base/poco/Net/src/TCPServerDispatcher.cpp:116: Poco::Net::TCPServerDispatcher::run() @ 0x000000001ac7fced in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:08.802784 [ 572892 ] <Fatal> BaseDaemon: 29. ./build/./base/poco/Foundation/src/ThreadPool.cpp:202: Poco::PooledThread::run() @ 0x000000001ade62e7 in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:08.808592 [ 572892 ] <Fatal> BaseDaemon: 30.1. inlined from ./build/./base/poco/Foundation/include/Poco/SharedPtr.h:139: Poco::SharedPtr<Poco::Runnable, Poco::ReferenceCounter, Poco::ReleasePolicy<Poco::Runnable>>::assign(Poco::Runnable*)
[a2b250d9872b] 2023.05.25 14:46:08.808708 [ 572892 ] <Fatal> BaseDaemon: 30.2. inlined from ./build/./base/poco/Foundation/include/Poco/SharedPtr.h:180: Poco::SharedPtr<Poco::Runnable, Poco::ReferenceCounter, Poco::ReleasePolicy<Poco::Runnable>>::operator=(Poco::Runnable*)
[a2b250d9872b] 2023.05.25 14:46:08.808778 [ 572892 ] <Fatal> BaseDaemon: 30. ./build/./base/poco/Foundation/src/Thread_POSIX.cpp:350: Poco::ThreadImpl::runnableEntry(void*) @ 0x000000001ade3ea3 in /usr/bin/clickhouse
[a2b250d9872b] 2023.05.25 14:46:08.808825 [ 572892 ] <Fatal> BaseDaemon: 31. ? @ 0x00007fda3696e609 in ?
[a2b250d9872b] 2023.05.25 14:46:08.808880 [ 572892 ] <Fatal> BaseDaemon: 32. __clone @ 0x00007fda36893133 in ?
[a2b250d9872b] 2023.05.25 14:46:08.808933 [ 572892 ] <Fatal> BaseDaemon: Integrity check of the executable skipped because the reference checksum could not be read.
Error on processing query: Code: 32. DB::Exception: Attempt to read after eof: while receiving packet from localhost:9000. (ATTEMPT_TO_READ_AFTER_EOF) (version 23.5.1.1)
(query: select
    ref_5.pkey as c_2_c2392_6
  from
    t0 as ref_5
  where ('J[' < (case when (ref_5.pkey in (select 1)
          ) then (bitShiftLeft(case when (ref_5.c0 > (
            select
                ref_7.vkey as c_8_c2385_0
              from
                t1 as ref_7
              order by c_8_c2385_0 asc limit 1
            )) then '1' else ')' end, 40)) else null end));)
@JZuming JZuming added the potential bug To be reviewed by developers and confirmed/rejected. label May 25, 2023
@den-crane den-crane added bug Confirmed user-visible misbehaviour in official release crash Crash / segfault / abort v22.8-affected v23.3-affected and removed potential bug To be reviewed by developers and confirmed/rejected. labels May 25, 2023
@canhld94
Copy link
Contributor

The following query returns 2 rows instead of 1 row. Two issues may relate.

SELECT bitShiftLeft(If(number = NULL, '14342', '4242348'), 1)
FROM numbers(1)

Query id: 57122bf5-74fb-48d5-8503-54fd84c654d3

┌─bitShiftLeft(if(equals(number, NULL), '14342', '4242348'), 1)─┐
│ hdhdfhp                                                       │
└───────────────────────────────────────────────────────────────┘
┌─bitShiftLeft(if(equals(number, NULL), '14342', '4242348'), 1)─┐
│ hdhdfhp                                                       │
└───────────────────────────────────────────────────────────────┘

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Confirmed user-visible misbehaviour in official release crash Crash / segfault / abort v22.8-affected v23.3-affected
Projects
None yet
4 participants