[Bug]: core when use histogram

[geezhu]

What type of bug is this?

Crash

What subsystems and features are affected?

Other

What happened?

core when inputting following SQL with double precision limits

TimescaleDB version affected

2.9.2

PostgreSQL version used

14.6

What operating system did you use?

WSL with Linux Kernel 5.15.0

What installation method did you use?

Docker

What platform did you run on?

Other

Relevant log output and stack trace

No response

How can we reproduce the bug?

CREATE TABLE weather ( time TIMESTAMPTZ NOT NULL, city TEXT, temperature FLOAT, PRIMARY KEY(time, city)); 
SELECT * FROM create_hypertable('weather', 'time', 'city', 3); 
insert into weather values('2023-02-10 09:16:51.133584+00','city1',10.4),
('2023-02-10 11:16:51.611618+00','city1',10.3),
('2023-02-10 06:58:59.999999+00','city1',10.3),
('2023-02-10 01:58:59.999999+00','city1',10.3),
('2023-02-09 01:58:59.999999+00','city1',10.3),
('2023-02-10 08:58:59.999999+00','city1',10.3),
('2023-03-23 06:12:02.73765+00 ','city1', 9.7),
('2023-03-23 06:12:06.990998+00','city1',11.7);

select histogram(temperature,-1.79769e+308,1.79769e+308,10) from weather_for_hist group by city;

[mkindahl]

@geezhu This was trivial to reproduce. Thanks for an excellent bug report!

[mkindahl]

The issue is caused because there is a "bug" in width_bucket where very large interval between either the low and high or the operand and min can cause an intermediate infinite result, producing in a NaN result, which translates to -2147483648.

mats=# select width_bucket(op, mn, mx, cnt) from foo;
 width_bucket 
--------------
  -2147483648
(1 row)

Since this is used as an index into an array here, it will cause an invalid memory access:

	int32 bucket = DatumGetInt32(DirectFunctionCall4(width_bucket_float8,
													 val_datum,
													 min_datum,
													 max_datum,
													 Int32GetDatum(nbuckets)));

	/* Increment the proper histogram bucket */
	Assert(bucket < state->nbuckets);
>>>	if (DatumGetInt32(state->buckets[bucket]) >= PG_INT32_MAX - 1)
		elog(ERROR, "overflow in histogram");

	state->buckets[bucket] = Int32GetDatum(DatumGetInt32(state->buckets[bucket]) + 1);

[mkindahl]

Fix for the width_bucket issue committed to PostgreSQL.