Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Analyzer ComparisonTupleEliminationPass: Bad cast from type DB::ColumnLowCardinality to DB::ColumnVector<char8_t> #57274

Closed
evillique opened this issue Nov 27, 2023 · 1 comment · Fixed by #61887
Assignees
Labels
analyzer Issues and pull-requests related to new analyzer experimental feature Bug in the feature that should not be used in production fuzz Problem found by one of the fuzzers

Comments

@evillique
Copy link
Member

https://s3.amazonaws.com/clickhouse-test-reports/57147/78fe2eef2dad0160ffa6be4fe27e0badb8545eb5/fuzzer_astfuzzerubsan/report.html

Easily reproducible: fiddle

2023.11.24 23:10:26.427794 [ 232 ] {5b401358-2b53-4bab-a804-6baf936f1950} <Fatal> : Logical error: 'Bad cast from type DB::ColumnLowCardinality to DB::ColumnVector<char8_t>'.
2023.11.24 23:10:26.428043 [ 1655 ] {} <Fatal> BaseDaemon: ########## Short fault info ############
2023.11.24 23:10:26.428065 [ 1655 ] {} <Fatal> BaseDaemon: (version 23.11.1.1, build id: 57CA213D6C8E99DEBE847C078E6DB7A29C50B82B, git hash: d3dca596aee4a58d0a9ea38671d83dc65345218c) (from thread 232) Received signal 6
2023.11.24 23:10:26.428071 [ 1655 ] {} <Fatal> BaseDaemon: Signal description: Aborted
2023.11.24 23:10:26.428075 [ 1655 ] {} <Fatal> BaseDaemon: 
2023.11.24 23:10:26.428082 [ 1655 ] {} <Fatal> BaseDaemon: Stack trace: 0x00007f28cc4469fc 0x00007f28cc3f2476 0x00007f28cc3d87f3 0x0000558dab80e608 0x0000558dab80f3f5 0x0000558d9f603b4a 0x0000558da2f83c1a 0x0000558db77a9758 0x0000558db778ae11 0x0000558db77fabcb 0x0000558dba9c480c 0x0000558dba964ab5 0x0000558dba95fc57 0x0000558dba949a1d 0x0000558dba979892 0x0000558dbc59645e 0x0000558dbc59759a 0x0000558dbc7fe370 0x0000558dbc7f9471 0x00007f28cc444ac3 0x00007f28cc4d6a40
2023.11.24 23:10:26.428089 [ 1655 ] {} <Fatal> BaseDaemon: ########################################
2023.11.24 23:10:26.428109 [ 1655 ] {} <Fatal> BaseDaemon: (version 23.11.1.1, build id: 57CA213D6C8E99DEBE847C078E6DB7A29C50B82B, git hash: d3dca596aee4a58d0a9ea38671d83dc65345218c) (from thread 232) (query_id: 5b401358-2b53-4bab-a804-6baf936f1950) (query: SELECT (tuple(id) = tuple(1048576), tuple((1000.0001, NULL))), (65537, value) = (id, '\0'), * FROM test_tuple_filter__fuzz_0) Received signal Aborted (6)
2023.11.24 23:10:26.428117 [ 1655 ] {} <Fatal> BaseDaemon: 
2023.11.24 23:10:26.428128 [ 1655 ] {} <Fatal> BaseDaemon: Stack trace: 0x00007f28cc4469fc 0x00007f28cc3f2476 0x00007f28cc3d87f3 0x0000558dab80e608 0x0000558dab80f3f5 0x0000558d9f603b4a 0x0000558da2f83c1a 0x0000558db77a9758 0x0000558db778ae11 0x0000558db77fabcb 0x0000558dba9c480c 0x0000558dba964ab5 0x0000558dba95fc57 0x0000558dba949a1d 0x0000558dba979892 0x0000558dbc59645e 0x0000558dbc59759a 0x0000558dbc7fe370 0x0000558dbc7f9471 0x00007f28cc444ac3 0x00007f28cc4d6a40
2023.11.24 23:10:26.428139 [ 1655 ] {} <Fatal> BaseDaemon: 3. ? @ 0x00007f28cc4469fc in ?
2023.11.24 23:10:26.428145 [ 1655 ] {} <Fatal> BaseDaemon: 4. ? @ 0x00007f28cc3f2476 in ?
2023.11.24 23:10:26.428152 [ 1655 ] {} <Fatal> BaseDaemon: 5. ? @ 0x00007f28cc3d87f3 in ?
2023.11.24 23:10:26.441621 [ 1655 ] {} <Fatal> BaseDaemon: 6. ./build_docker/./src/Common/Exception.cpp:44: DB::abortOnFailedAssertion(String const&) @ 0x0000000023664608 in /workspace/clickhouse
2023.11.24 23:10:26.453976 [ 1655 ] {} <Fatal> BaseDaemon: 7.1. inlined from ./build_docker/./src/Common/Exception.cpp:64: DB::handle_error_code(String const&, int, bool, std::vector<void*, std::allocator<void*>> const&)
2023.11.24 23:10:26.453986 [ 1655 ] {} <Fatal> BaseDaemon: 7. ./build_docker/./src/Common/Exception.cpp:101: DB::Exception::Exception(DB::Exception::MessageMasked&&, int, bool) @ 0x00000000236653f5 in /workspace/clickhouse
2023.11.24 23:10:27.190582 [ 1655 ] {} <Fatal> BaseDaemon: 8. DB::Exception::Exception<String, String>(int, FormatStringHelperImpl<std::type_identity<String>::type, std::type_identity<String>::type>, String&&, String&&) @ 0x0000000017459b4a in /workspace/clickhouse
2023.11.24 23:10:27.901896 [ 1655 ] {} <Fatal> BaseDaemon: 9. DB::ColumnVector<char8_t> const& typeid_cast<DB::ColumnVector<char8_t> const&, DB::IColumn const>(DB::IColumn const&) @ 0x000000001add9c1a in /workspace/clickhouse
2023.11.24 23:10:27.911583 [ 1655 ] {} <Fatal> BaseDaemon: 10. ./build_docker/./src/DataTypes/Serializations/SerializationNumber.cpp:139: DB::SerializationNumber<char8_t>::serializeBinaryBulk(DB::IColumn const&, DB::WriteBuffer&, unsigned long, unsigned long) const @ 0x000000002f5ff758 in /workspace/clickhouse
2023.11.24 23:10:27.914985 [ 1655 ] {} <Fatal> BaseDaemon: 11.1. inlined from ./contrib/llvm-project/libcxx/include/vector:1613: std::vector<DB::ISerialization::Substream, std::allocator<DB::ISerialization::Substream>>::pop_back()
2023.11.24 23:10:27.915004 [ 1655 ] {} <Fatal> BaseDaemon: 11. ./build_docker/./src/DataTypes/Serializations/SerializationNamed.cpp:56: DB::SerializationNamed::serializeBinaryBulkWithMultipleStreams(DB::IColumn const&, unsigned long, unsigned long, DB::ISerialization::SerializeBinaryBulkSettings&, std::shared_ptr<DB::ISerialization::SerializeBinaryBulkState>&) const @ 0x000000002f5e0e11 in /workspace/clickhouse
2023.11.24 23:10:27.925081 [ 1655 ] {} <Fatal> BaseDaemon: 12. ./build_docker/./src/DataTypes/Serializations/SerializationTuple.cpp:0: DB::SerializationTuple::serializeBinaryBulkWithMultipleStreams(DB::IColumn const&, unsigned long, unsigned long, DB::ISerialization::SerializeBinaryBulkSettings&, std::shared_ptr<DB::ISerialization::SerializeBinaryBulkState>&) const @ 0x000000002f650bcb in /workspace/clickhouse
2023.11.24 23:10:27.933169 [ 1655 ] {} <Fatal> BaseDaemon: 13.1. inlined from ./build_docker/./src/Formats/NativeWriter.cpp:63: DB::writeData(DB::ISerialization const&, COW<DB::IColumn>::immutable_ptr<DB::IColumn> const&, DB::WriteBuffer&, unsigned long, unsigned long)
2023.11.24 23:10:27.933193 [ 1655 ] {} <Fatal> BaseDaemon: 13. ./build_docker/./src/Formats/NativeWriter.cpp:163: DB::NativeWriter::write(DB::Block const&) @ 0x000000003281a80c in /workspace/clickhouse
2023.11.24 23:10:27.979056 [ 1655 ] {} <Fatal> BaseDaemon: 14. ./build_docker/./src/Server/TCPHandler.cpp:2169: DB::TCPHandler::sendData(DB::Block const&) @ 0x00000000327baab5 in /workspace/clickhouse
2023.11.24 23:10:28.020792 [ 1655 ] {} <Fatal> BaseDaemon: 15. ./build_docker/./src/Server/TCPHandler.cpp:0: DB::TCPHandler::processOrdinaryQueryWithProcessors() @ 0x00000000327b5c57 in /workspace/clickhouse
2023.11.24 23:10:28.053796 [ 1655 ] {} <Fatal> BaseDaemon: 16. ./build_docker/./src/Server/TCPHandler.cpp:0: DB::TCPHandler::runImpl() @ 0x000000003279fa1d in /workspace/clickhouse
2023.11.24 23:10:28.103800 [ 1655 ] {} <Fatal> BaseDaemon: 17. ./build_docker/./src/Server/TCPHandler.cpp:2294: DB::TCPHandler::run() @ 0x00000000327cf892 in /workspace/clickhouse
2023.11.24 23:10:28.106325 [ 1655 ] {} <Fatal> BaseDaemon: 18. ./build_docker/./base/poco/Net/src/TCPServerConnection.cpp:57: Poco::Net::TCPServerConnection::start() @ 0x00000000343ec45e in /workspace/clickhouse
2023.11.24 23:10:28.109869 [ 1655 ] {} <Fatal> BaseDaemon: 19.1. inlined from ./contrib/llvm-project/libcxx/include/__memory/unique_ptr.h:302: std::unique_ptr<Poco::Net::TCPServerConnection, std::default_delete<Poco::Net::TCPServerConnection>>::reset[abi:v15000](Poco::Net::TCPServerConnection*)
2023.11.24 23:10:28.109890 [ 1655 ] {} <Fatal> BaseDaemon: 19.2. inlined from ./contrib/llvm-project/libcxx/include/__memory/unique_ptr.h:259: ~unique_ptr
2023.11.24 23:10:28.109896 [ 1655 ] {} <Fatal> BaseDaemon: 19. ./build_docker/./base/poco/Net/src/TCPServerDispatcher.cpp:116: Poco::Net::TCPServerDispatcher::run() @ 0x00000000343ed59a in /workspace/clickhouse
2023.11.24 23:10:28.113565 [ 1655 ] {} <Fatal> BaseDaemon: 20. ./build_docker/./base/poco/Foundation/src/ThreadPool.cpp:202: Poco::PooledThread::run() @ 0x0000000034654370 in /workspace/clickhouse
2023.11.24 23:10:28.117011 [ 1655 ] {} <Fatal> BaseDaemon: 21.1. inlined from ./base/poco/Foundation/include/Poco/AutoPtr.h:205: Poco::AutoPtr<Poco::ThreadImpl::ThreadData>::operator->()
2023.11.24 23:10:28.117028 [ 1655 ] {} <Fatal> BaseDaemon: 21. ./base/poco/Foundation/src/Thread_POSIX.cpp:350: Poco::ThreadImpl::runnableEntry(void*) @ 0x000000003464f471 in /workspace/clickhouse
2023.11.24 23:10:28.117036 [ 1655 ] {} <Fatal> BaseDaemon: 22. ? @ 0x00007f28cc444ac3 in ?
2023.11.24 23:10:28.117041 [ 1655 ] {} <Fatal> BaseDaemon: 23. ? @ 0x00007f28cc4d6a40 in ?
2023.11.24 23:10:28.117050 [ 1655 ] {} <Fatal> BaseDaemon: Integrity check of the executable skipped because the reference checksum could not be read.
2023.11.24 23:10:29.769240 [ 1655 ] {} <Fatal> BaseDaemon: This ClickHouse version is not official and should be upgraded to the official build.
2023.11.24 23:10:29.769415 [ 1655 ] {} <Fatal> BaseDaemon: Changed settings: receive_timeout = 10., receive_data_timeout_ms = 10000, use_hedged_requests = false, optimize_move_to_prewhere = true, allow_suspicious_low_cardinality_types = true, max_parallel_replicas = 3, cluster_for_parallel_replicas = 'test_cluster_one_shard_three_replicas_localhost', allow_experimental_parallel_reading_from_replicas = 1, force_index_by_date = false, force_primary_key = false, log_queries = true, insert_quorum = 2, insert_quorum_timeout = 0, insert_quorum_parallel = false, select_sequential_consistency = 1, table_function_remote_max_addresses = 200, join_use_nulls = true, allow_experimental_analyzer = true, max_execution_time = 10., join_algorithm = 'direct', max_memory_usage = 10000000000, send_logs_level = 'fatal', prefer_localhost_replica = true, allow_introspection_functions = true, convert_query_to_cnf = true, optimize_monotonous_functions_in_order_by = true, optimize_using_constraints = true, validate_polygons = false, aggregate_functions_null_for_empty = true, allow_deprecated_syntax_for_merge_tree = true, insert_keeper_fault_injection_probability = 0., allow_experimental_object_type = true, date_time_input_format = 'best_effort', output_format_json_named_tuples_as_objects = true
2023.11.24 23:11:51.881431 [ 153 ] {} <Fatal> Application: Child process was terminated by signal 6.
@evillique evillique added the fuzz Problem found by one of the fuzzers label Nov 27, 2023
@evillique evillique added the experimental feature Bug in the feature that should not be used in production label Nov 27, 2023
@Algunenano Algunenano added the analyzer Issues and pull-requests related to new analyzer label Jan 17, 2024
@Algunenano
Copy link
Member

Still broken in master:

2024.01.17 17:15:32.509350 [ 377716 ] {0c6a399f-be09-467a-8a6c-0422b02de098} <Fatal> : Logical error: 'Function tuple(__table1.id = 1048576) expects 1 argument to have UInt8 type but receives LowCardinality(UInt8) after running ComparisonTupleEliminationPass pass'.

@Algunenano Algunenano changed the title Analyzer: Bad cast from type DB::ColumnLowCardinality to DB::ColumnVector<char8_t> Analyzer ComparisonTupleEliminationPass: Bad cast from type DB::ColumnLowCardinality to DB::ColumnVector<char8_t> Jan 17, 2024
@devcrafter devcrafter self-assigned this Mar 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
analyzer Issues and pull-requests related to new analyzer experimental feature Bug in the feature that should not be used in production fuzz Problem found by one of the fuzzers
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants