Skip to content

panic: array_repeat capacity overflow on constant scalar with large count #22228

@Dandandan

Description

@Dandandan

Describe the bug

array_repeat(<scalar_const>, <large_const>) — the simplest all-constant form — panics with capacity overflow from raw_vec::reserve, distinct from the previously-filed array_repeat overflows:

This issue is the constant-scalar / single-row path: nothing is summed across rows and nothing is a list, but the final Vec-reserve for the repeated values still requests more than isize::MAX bytes and panics in raw_vec.

To Reproduce

cargo run -p datafusion-cli -- -c "SELECT array_repeat(1, 9223372036854775807)"

Actual behavior

DataFusion CLI v53.1.0

thread 'main' panicked at .../library/alloc/src/raw_vec/mod.rs:28:5:
capacity overflow
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Expected behavior

Return an execution error like "array_repeat: requested length exceeds maximum array size" rather than panicking.

Environment

  • DataFusion CLI v53.1.0 (from main at commit 8741a77)

Additional context

Same family of missing-bounds-check panics as #22188, #22217, #22218, #22219 — but a third panic site (raw_vec capacity rather than accum::Sum or repeat::mul). A fix at the public array_repeat entry point that bounds count against isize::MAX / size_of::<element>() should close all three array_repeat variants at once; filing separately so each panic site is tracked.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions