Backport #100234 to 26.2: Fix shared variant column pointers in ColumnVariant::filter

robot-clickhouse · robot-clickhouse · commit fb9e4697b8c5 · 2026-03-22T10:19:22.000Z
diff --git a/src/Columns/ColumnVariant.cpp b/src/Columns/ColumnVariant.cpp
@@ -933,7 +933,10 @@ ColumnPtr ColumnVariant::filter(const Filter & filt, ssize_t result_size_hint) c
     /// If we have only NULLs, just filter local_discriminators column.
     if (hasOnlyNulls())
     {
-        Columns new_variants(variants.begin(), variants.end());
+        Columns new_variants;
+        new_variants.reserve(variants.size());
+        for (const auto & variant : variants)
+            new_variants.emplace_back(variant->cloneEmpty());
         auto new_discriminators = local_discriminators->filter(filt, result_size_hint);
         /// In case of all NULL values offsets doesn't contain any useful values, just resize it.
         ColumnPtr new_offsets = offsets->cloneResized(new_discriminators->size());
diff --git a/src/Interpreters/Set.cpp b/src/Interpreters/Set.cpp
@@ -280,7 +280,7 @@ void Set::appendSetElements(SetKeyColumns & holder)
     {
         auto filtered_column = holder.key_columns[i]->filter(holder.filter->getData(), rows);
         if (set_elements[i]->empty())
-            set_elements[i] = filtered_column;
+            set_elements[i] = IColumn::mutate(std::move(filtered_column));
         else
             set_elements[i]->insertRangeFrom(*filtered_column, 0, filtered_column->size());
         if (transform_null_in && holder.null_map_holder)
@@ -294,6 +294,16 @@ void Set::checkIsCreated() const
         throw Exception(ErrorCodes::LOGICAL_ERROR, "Trying to use set before it has been built.");
 }
 
+Columns Set::getSetElements() const
+{
+    checkIsCreated();
+    Columns result;
+    result.reserve(set_elements.size());
+    for (const auto & col : set_elements)
+        result.push_back(col->getPtr());
+    return result;
+}
+
 ColumnUInt8::Ptr checkDateTimePrecision(const ColumnWithTypeAndName & column_to_cast)
 {
     // Handle nullable columns
diff --git a/src/Interpreters/Set.h b/src/Interpreters/Set.h
@@ -78,7 +78,7 @@ class Set
 
     bool hasExplicitSetElements() const { return fill_set_elements || (!set_elements.empty() && set_elements.front()->size() == data.getTotalRowCount()); }
     bool hasSetElements() const { return !set_elements.empty(); }
-    Columns getSetElements() const { checkIsCreated(); return { set_elements.begin(), set_elements.end() }; }
+    Columns getSetElements() const;
 
     void checkColumnsNumber(size_t num_key_columns) const;
     bool areTypesEqual(size_t set_type_idx, const DataTypePtr & other_type) const;
@@ -140,7 +140,7 @@ class Set
 
     /// Collected elements of `Set`.
     /// It is necessary for the index to work on the primary key in the IN statement.
-    std::vector<IColumn::WrappedPtr> set_elements;
+    MutableColumns set_elements;
 
     /** Protects work with the set in the functions `insertFromBlock` and `execute`.
       * These functions can be called simultaneously from different threads only when using StorageSet,
diff --git a/tests/queries/0_stateless/04042_hash_join_allocated_size_tracking.reference b/tests/queries/0_stateless/04042_hash_join_allocated_size_tracking.reference
@@ -0,0 +1 @@
+200000	2147483647
diff --git a/tests/queries/0_stateless/04042_hash_join_allocated_size_tracking.sql b/tests/queries/0_stateless/04042_hash_join_allocated_size_tracking.sql
@@ -0,0 +1,22 @@
+SET enable_analyzer = 1;
+
+CREATE TABLE test__fuzz_1 (`id` Nullable(UInt64), `d` Dynamic(max_types = 133)) ENGINE = Memory;
+
+INSERT INTO test__fuzz_1 SETTINGS min_insert_block_size_rows = 50000 SELECT number, number FROM numbers(100000) SETTINGS min_insert_block_size_rows = 50000;
+
+INSERT INTO test__fuzz_1 SETTINGS min_insert_block_size_rows = 50000 SELECT number, concat('str_', toString(number)) FROM numbers(100000, 100000) SETTINGS min_insert_block_size_rows = 50000;
+
+INSERT INTO test__fuzz_1 SETTINGS min_insert_block_size_rows = 50000 SELECT number, arrayMap(x -> multiIf((number % 9) = 0, NULL, (number % 9) = 3, concat('str_', toString(number)), number), range((number % 10) + 1)) FROM numbers(200000, 100000) SETTINGS min_insert_block_size_rows = 50000;
+
+INSERT INTO test__fuzz_1 SETTINGS min_insert_block_size_rows = 50000 SELECT number, NULL FROM numbers(300000, 100000) SETTINGS min_insert_block_size_rows = 50000;
+
+INSERT INTO test__fuzz_1 SETTINGS min_insert_block_size_rows = 50000 SELECT number, multiIf((number % 4) = 3, concat('str_', toString(number)), (number % 4) = 2, NULL, (number % 4) = 1, number, arrayMap(x -> multiIf((number % 9) = 0, NULL, (number % 9) = 3, concat('str_', toString(number)), number), range((number % 10) + 1))) FROM numbers(400000, 400000) SETTINGS min_insert_block_size_rows = 50000;
+
+INSERT INTO test__fuzz_1 SETTINGS min_insert_block_size_rows = 50000 SELECT number, if((number % 5) = 1, CAST([range(CAST((number % 10) + 1, 'UInt64'))], 'Array(Array(Dynamic))'), number) FROM numbers(100000, 100000) SETTINGS min_insert_block_size_rows = 50000;
+
+INSERT INTO test__fuzz_1 SETTINGS min_insert_block_size_rows = 50000 SELECT number, if((number % 5) = 1, CAST(CAST(concat('str_', number), 'LowCardinality(String)'), 'Dynamic'), CAST(number, 'Dynamic')) FROM numbers(100000, 100000) SETTINGS min_insert_block_size_rows = 50000;
+
+SELECT count(equals(toInt256(257), intDiv(65536, -2147483649) AS alias144)), toInt128(2147483647) FROM test__fuzz_1 WHERE NOT empty((SELECT d.`Array(Variant(String, UInt64))`));
+
+DROP TABLE test__fuzz_1;
+
diff --git a/tests/queries/0_stateless/04051_variant_filter_shared_columns_bug.reference b/tests/queries/0_stateless/04051_variant_filter_shared_columns_bug.reference
diff --git a/tests/queries/0_stateless/04051_variant_filter_shared_columns_bug.sql b/tests/queries/0_stateless/04051_variant_filter_shared_columns_bug.sql
@@ -0,0 +1,19 @@
+-- Regression test for ColumnVariant::filter sharing variant column pointers
+-- in the hasOnlyNulls() optimization path. The filter was copying ColumnPtr
+-- shared pointers instead of cloning, causing two ColumnVariant objects to
+-- share the same variant columns. When one was mutated via insertRangeFrom,
+-- the other became inconsistent (discriminators_size=0 but variant_sizes>0),
+-- leading to a LOGICAL_ERROR in compress().
+
+SET cross_join_min_rows_to_compress = 1;
+SET enable_analyzer = 1;
+
+DROP TABLE IF EXISTS test_variant_filter;
+CREATE TABLE test_variant_filter (`id` UInt64, `d` Dynamic) ENGINE = Memory;
+
+INSERT INTO test_variant_filter SELECT number, NULL FROM numbers(50000);
+INSERT INTO test_variant_filter SELECT number, [number, 'str']::Array(Variant(String, UInt64)) FROM numbers(50000);
+
+SELECT 1 FROM test_variant_filter WHERE NOT empty((SELECT d.`Array(Variant(String, UInt64))`)) FORMAT Null;
+
+DROP TABLE test_variant_filter;
