Skip to content

Use after free: Column identifier __table1.c0 is already registered #73142

@PedroTadim

Description

@PedroTadim

Describe the bug
Just run the Fiddle, related to analyzer_compatibility_join_using_top_level_identifier setting.

How to reproduce
Run Fiddle: https://fiddle.clickhouse.com/67278d49-b76e-4f68-a97d-735c8657df41

Stack trace:

0. std::exception::exception[abi:v15007]() @ 0x0000000018ed1bf4
1. base/poco/Foundation/src/Exception.cpp:27: Poco::Exception::Exception(String const&, int) @ 0x00000000389c75a0
2. src/Common/Exception.cpp:105: DB::Exception::Exception(DB::Exception::MessageMasked&&, int, bool) @ 0x00000000259c200b
3. DB::Exception::Exception(PreformattedMessage&&, int) @ 0x0000000018d6f8b6
4. DB::Exception::Exception<String&>(int, FormatStringHelperImpl<std::type_identity<String&>::type>, String&) @ 0x0000000018d9dbef
5. src/Planner/PlannerContext.cpp:36: DB::GlobalPlannerContext::createColumnIdentifier(DB::NameAndTypePair const&, std::shared_ptr<DB::IQueryTreeNode> const&) @ 0x0000000030e5934b
6. src/Planner/PlannerJoinTree.cpp:432: DB::buildJoinTreeQueryPlan(std::shared_ptr<DB::IQueryTreeNode> const&, DB::SelectQueryInfo const&, DB::SelectQueryOptions&, std::unordered_set<String, std::hash<String>, std::equal_to<String>, std::allocator<String>> const&, std::shared_ptr<DB::PlannerContext>&) @ 0x00000000320880c2
7. src/Planner/Planner.cpp:1546: DB::Planner::buildPlanForQueryNode() @ 0x000000003206197a
8. src/Planner/Planner.cpp:1300: DB::Planner::buildQueryPlanIfNeeded() @ 0x000000003205c6be
9. src/Interpreters/InterpreterSelectQueryAnalyzer.cpp:241: DB::InterpreterSelectQueryAnalyzer::getQueryPlan() @ 0x0000000032059299
10. src/Interpreters/executeQuery.cpp:1317: DB::executeQueryImpl(char const*, char const*, std::shared_ptr<DB::Context>, DB::QueryFlags, DB::QueryProcessingStage::Enum, DB::ReadBuffer*) @ 0x0000000032553bb6
11. src/Interpreters/executeQuery.cpp:1535: DB::executeQuery(String const&, std::shared_ptr<DB::Context>, DB::QueryFlags, DB::QueryProcessingStage::Enum) @ 0x000000003254e38e
12. src/Server/TCPHandler.cpp:656: DB::TCPHandler::runImpl() @ 0x0000000034fef63c
13. src/Server/TCPHandler.cpp:2598: DB::TCPHandler::run() @ 0x000000003501a58e
14. base/poco/Net/src/TCPServerConnection.cpp:40: Poco::Net::TCPServerConnection::start() @ 0x0000000038b005c2
15. base/poco/Net/src/TCPServerDispatcher.cpp:115: Poco::Net::TCPServerDispatcher::run() @ 0x0000000038b01292
16. base/poco/Foundation/src/ThreadPool.cpp:205: Poco::PooledThread::run() @ 0x0000000038a5ec17
17. base/poco/Foundation/src/Thread_POSIX.cpp:335: Poco::ThreadImpl::runnableEntry(void*) @ 0x0000000038a5a50e
18. ? @ 0x00007ffff7ca1e2e
19. ? @ 0x00007ffff7d33a4

Metadata

Metadata

Assignees

Labels

analyzerIssues and pull-requests related to new analyzerbugConfirmed user-visible misbehaviour in official releasecrashCrash / segfault / abortfuzzProblem found by one of the fuzzersv25.3-affected

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions