[Query Fuzz] Query panic - influxql.Expr is *influxql.Wildcard, not *influxql.VarRef

[e-dard]

This issue was found by fuzzing the database with a query generator tool. It may be possible to simplify the query to help identify the root cause.

Dataset

$ curl https://s3.amazonaws.com/noaa.water-database/NOAA_data.txt -o NOAA_data.txt
$ influx -import -path=NOAA_data.txt

Query

QUERY: SELECT    COUNT(*) +   MIN("pH") *   MEDIAN("index")  AS "fA" FROM ( SELECT    DISTINCT("index")  AS "_" FROM  "average_temperature" LIMIT 6162) ORDER BY time ASC

Result

Server returns a panic response.

See attached trace.

1488219733564080130-panic.txt

[e-dard]

Further examples which I believe may be the same panic:

1488219744271203574-panic.txt
1488219749799180959-panic.txt
1488219783949433866-panic.txt
1488219784274789674-panic.txt
1488219858286334718-panic.txt
1488219959854317737-panic.txt
1488219975159021313-panic.txt
1488219975938728265-panic.txt
1488219980131072766-panic.txt
1488220045879950882-panic.txt
1488220162935703106-panic.txt
1488220199616613808-panic.txt
1488220393906083238-panic.txt
1488220401760049354-panic.txt
1488220432585038269-panic.txt
1488220515165036047-panic.txt
1488220528324224756-panic.txt
1488220576028736525-panic.txt
1488220606956366191-panic.txt
1488220703491897190-panic.txt
1488220751761977833-panic.txt
1488220754828598389-panic.txt
1488220819956786864-panic.txt
1488220879570619784-panic.txt
1488221029481144191-panic.txt
1488221122832762639-panic.txt
1488221141435341877-panic.txt
1488221334192078618-panic.txt
1488221335963530507-panic.txt
1488221355513478176-panic.txt
1488221396639559914-panic.txt
1488221416315065597-panic.txt
1488221446470839843-panic.txt
1488221465124526802-panic.txt
1488221642213625422-panic.txt

[jsternberg]

The reason this seems to happen is because the wildcard expansion code just outright ignores any binary expression.

The fix isn't that simple. The main problem is that when calls are substituted, they're given an alternative name so they don't all just show up as the function name like mean. They do this by setting the alias attribute on the field that gets created.

Unfortunately, the only way to do this reliably would be to recurse through the binary expression and return a list of new expressions. But the Field type isn't an expression and is treated differently (only at the top level) so I'm not yet sure how to get that iteration process working yet.

I'll look at it and see what I can come up with though.

[jsternberg]

@e-dard I'm just going to prevent the panic and say this is currently impossible. Since it panicked before a change that now forbids it, I'm pretty certain nobody was using this successfully.