Nil pointer panic in expandSeriesSet

[juliusv]

The following PromQL expression makes the expression evaluator panic in Prometheus built off recent master revision 5fbda4c:

topk(scalar(count(node_cpu_seconds_total)), node_cpu_seconds_total)

Example: http://demo.robustperception.io:9090/graph?g0.range_input=1h&g0.expr=topk(scalar(count(node_cpu_seconds_total))%2C%20node_cpu_seconds_total)&g0.tab=1

Stack trace:

runtime error: invalid memory address or nil pointer dereference" stacktrace="goroutine 3141 [running]:
github.com/prometheus/prometheus/promql.(*evaluator).recover(0xc00083b310, 0xc00072cef0)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/promql/engine.go:688 +0xe2
panic(0x1b8e020, 0x341f920)
  /home/julius/go/src/runtime/panic.go:513 +0x1b9
github.com/prometheus/prometheus/promql.expandSeriesSet(0x22b3e60, 0xc000839d70, 0x0, 0x0, 0xc000b779e0, 0xc000b77a10, 0xc000b77a40, 0xc000b77a70, 0xc000b77aa0)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/promql/engine.go:642 +0x46
github.com/prometheus/prometheus/promql.checkForSeriesSetExpansion(0x22b3e60, 0xc000839d70, 0x22a55e0, 0xc0000c1620, 0x0, 0x0)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/promql/engine.go:630 +0x164
github.com/prometheus/prometheus/promql.(*evaluator).eval(0xc00083b310, 0x22a55e0, 0xc0000c1620, 0xc000839f20, 0x2)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/promql/engine.go:1103 +0x17fe
github.com/prometheus/prometheus/promql.(*evaluator).rangeEval(0xc00083b310, 0xc000ef1e40, 0xc00072b4b0, 0x2, 0x2, 0x0, 0x0, 0x0)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/promql/engine.go:772 +0x158e
github.com/prometheus/prometheus/promql.(*evaluator).eval(0xc00083b310, 0x22a53a0, 0xc00083b040, 0xc000ef1de0, 0x1)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/promql/engine.go:910 +0x30ef
github.com/prometheus/prometheus/promql.(*evaluator).rangeEval(0xc00083b310, 0xc00014caa0, 0xc00014c860, 0x1, 0x1, 0x0, 0x0, 0x0)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/promql/engine.go:772 +0x158e
github.com/prometheus/prometheus/promql.(*evaluator).eval(0xc00083b310, 0x22a5420, 0xc000ef1780, 0xc000839e30, 0x2)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/promql/engine.go:951 +0x1264
github.com/prometheus/prometheus/promql.(*evaluator).rangeEval(0xc00083b310, 0xc000ef1d20, 0xc00072ce00, 0x2, 0x2, 0x0, 0xc00103ac80, 0x22b49e0)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/promql/engine.go:772 +0x158e
github.com/prometheus/prometheus/promql.(*evaluator).eval(0xc00083b310, 0x22a53a0, 0xc00083b090, 0xc001224ef0, 0xc00083b310)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/promql/engine.go:910 +0x30ef
github.com/prometheus/prometheus/promql.(*evaluator).Eval(0xc00083b310, 0x22a53a0, 0xc00083b090, 0x0, 0x0, 0x0, 0x0)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/promql/engine.go:699 +0x80
github.com/prometheus/prometheus/promql.(*Engine).execEvalStmt(0xc0002e7ef0, 0x22b3e60, 0xc0008399e0, 0xc0000c16e0, 0xc00083b0e0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/promql/engine.go:436 +0x45b
github.com/prometheus/prometheus/promql.(*Engine).exec(0xc0002e7ef0, 0x22b3e60, 0xc0008399e0, 0xc0000c16e0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/promql/engine.go:390 +0x59f
github.com/prometheus/prometheus/promql.(*query).Exec(0xc0000c16e0, 0x22b3da0, 0xc00103a900, 0xc000ce00f0)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/promql/engine.go:178 +0x94
github.com/prometheus/prometheus/web/api/v1.(*API).query(0xc0000cb0e0, 0xc00013b200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/web/api/v1/api.go:295 +0x53b
github.com/prometheus/prometheus/web/api/v1.(*API).query-fm(0xc00013b200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/web/api/v1/api.go:224 +0x70
github.com/prometheus/prometheus/web/api/v1.(*API).Register.func1.1(0x22a5760, 0xc000ef1740, 0xc00013b200)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/web/api/v1/api.go:205 +0x8e
net/http.HandlerFunc.ServeHTTP(0xc00083c520, 0x22a5760, 0xc000ef1740, 0xc00013b200)
  /home/julius/go/src/net/http/server.go:1964 +0x44
github.com/prometheus/prometheus/util/httputil.CompressionHandler.ServeHTTP(0x2294ec0, 0xc00083c520, 0x7f45ceb88170, 0xc00083aff0, 0xc00013b200)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/util/httputil/compression.go:90 +0x7c
github.com/prometheus/prometheus/util/httputil.CompressionHandler.ServeHTTP-fm(0x7f45ceb88170, 0xc00083aff0, 0xc00013b200)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/web/web.go:295 +0x57
github.com/prometheus/prometheus/web.(*Handler).testReady.func1(0x7f45ceb88170, 0xc00083aff0, 0xc00013b200)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/web/web.go:391 +0x55
net/http.HandlerFunc.ServeHTTP(0xc00083c560, 0x7f45ceb88170, 0xc00083aff0, 0xc00013b200)
  /home/julius/go/src/net/http/server.go:1964 +0x44
github.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerResponseSize.func1(0x22a4be0, 0xc000ef1720, 0xc00013b200)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go:196 +0xe9
net/http.HandlerFunc.ServeHTTP(0xc000838ba0, 0x22a4be0, 0xc000ef1720, 0xc00013b200)
  /home/julius/go/src/net/http/server.go:1964 +0x44
github.com/prometheus/client_golang/prometheus/promhttp.InstrumentHandlerDuration.func2(0x22a4be0, 0xc000ef1720, 0xc00013b200)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.go:76 +0xb5
github.com/prometheus/common/route.(*Router).handle.func1(0x22a4be0, 0xc000ef1720, 0xc00013b100, 0x0, 0x0, 0x0)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/vendor/github.com/prometheus/common/route/route.go:60 +0x2b6
github.com/julienschmidt/httprouter.(*Router).ServeHTTP(0xc000140bc0, 0x22a4be0, 0xc000ef1720, 0xc00013b100)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/vendor/github.com/julienschmidt/httprouter/router.go:299 +0x6cf
github.com/prometheus/common/route.(*Router).ServeHTTP(0xc00083c3e0, 0x22a4be0, 0xc000ef1720, 0xc00013b100)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/vendor/github.com/prometheus/common/route/route.go:98 +0x4c
net/http.StripPrefix.func1(0x22a4be0, 0xc000ef1720, 0xc00013b000)
  /home/julius/go/src/net/http/server.go:2003 +0x18b
net/http.HandlerFunc.ServeHTTP(0xc000a7d7a0, 0x22a4be0, 0xc000ef1720, 0xc00013b000)
  /home/julius/go/src/net/http/server.go:1964 +0x44
net/http.(*ServeMux).ServeHTTP(0xc0008387b0, 0x22a4be0, 0xc000ef1720, 0xc00013b000)
  /home/julius/go/src/net/http/server.go:2361 +0x127
github.com/opentracing-contrib/go-stdlib/nethttp.Middleware.func2(0x22b0c20, 0xc000d44380, 0xc00013af00)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/vendor/github.com/opentracing-contrib/go-stdlib/nethttp/server.go:74 +0x432
net/http.HandlerFunc.ServeHTTP(0xc000a7d830, 0x22b0c20, 0xc000d44380, 0xc00013af00)
  /home/julius/go/src/net/http/server.go:1964 +0x44
github.com/prometheus/prometheus/web.withStackTracer.func1(0x22b0c20, 0xc000d44380, 0xc00013af00)
  /home/julius/gosrc/src/github.com/prometheus/prometheus/web/web.go:87 +0x9d
net/http.HandlerFunc.ServeHTTP(0xc000a7d860, 0x22b0c20, 0xc000d44380, 0xc00013af00)
  /home/julius/go/src/net/http/server.go:1964 +0x44
net/http.serverHandler.ServeHTTP(0xc000a8c000, 0x22b0c20, 0xc000d44380, 0xc00013af00)
  /home/julius/go/src/net/http/server.go:2741 +0xab
net/http.(*conn).serve(0xc000482140, 0x22b3da0, 0xc000141000)
  /home/julius/go/src/net/http/server.go:1847 +0x646
created by net/http.(*Server).Serve
  /home/julius/go/src/net/http/server.go:2851 +0x2f5

[juliusv]

I git bisect-ed this and the commit that introduced this is f0e9196 from #4832.

/cc @mknapphrt

[juliusv]

The query topk(scalar(foo), bar) is sufficient to cause the crash. Same for quantile(scalar(foo), bar) etc.