Skip to content

src/Common/assert_cast.h:50:12: runtime error: downcast of address which does not point to an object of type 'const DB::ColumnConst' #24184

Closed
Closed
src/Common/assert_cast.h:50:12: runtime error: downcast of address which does not point to an object of type 'const DB::ColumnConst'#24184
Assignees
akuzm
Labels
comp-window-functionsWindow function execution + frame handling (ROW_NUMBER/RANK/LAG/LEAD, frames, partitions, order).fuzzProblem found by one of the fuzzers
@qoega

Description

@qoega
qoega
opened on May 17, 2021

https://clickhouse-test-reports.s3.yandex.net/24132/a7af0b6f4f50a7cb964717ebe4e997c61a082d99/fuzzer_ubsan/report.html#fail1

SELECT rand(toDateTime(NULL)), cityHash64(toString(groupArray(NULL, tuple(*)))) FROM (SELECT brand_id, rack_id, quantity FROM (SELECT brand_id, rack_id, quantity, row_number() OVER (PARTITION BY brand_id ORDER BY '0.0000000001' ASC NULLS LAST, quantity DESC RANGE BETWEEN CURRENT ROW AND UNBOUNDED FOLLOWING) AS rn FROM stack) AS t0 WHERE rn <= 2 ORDER BY brand_id ASC NULLS FIRST, rack_id DESC NULLS FIRST, quantity DESC NULLS FIRST) AS t
../src/Common/assert_cast.h:50:12: runtime error: downcast of address 0x7f822c1a8070 which does not point to an object of type 'const DB::ColumnConst'
0x7f822c1a8070: note: object is of type 'DB::ColumnString'
 00 00 00 00  e0 25 e9 09 00 00 00 00  01 00 00 00 00 00 00 00  f0 60 f5 bf 81 7f 00 00  70 99 f6 bf
              ^~~~~~~~~~~~~~~~~~~~~~~
              vptr for 'DB::ColumnString'
    #0 0x1c40d5cb in DB::ColumnConst const& assert_cast<DB::ColumnConst const&, DB::IColumn const&>(DB::IColumn const&) obj-x86_64-linux-gnu/../src/Common/assert_cast.h:50:12
    #1 0x1c40d5cb in DB::ColumnConst::compareAt(unsigned long, unsigned long, DB::IColumn const&, int) const obj-x86_64-linux-gnu/../src/Columns/ColumnConst.h:207:39
    #2 0x1d243ade in DB::WindowTransform::arePeers(DB::RowNumber const&, DB::RowNumber const&) const obj-x86_64-linux-gnu/../src/Processors/Transforms/WindowTransform.cpp:646:23
    #3 0x1d2474cc in DB::WindowTransform::appendChunk(DB::Chunk&) obj-x86_64-linux-gnu/../src/Processors/Transforms/WindowTransform.cpp:1033:18
    #4 0x1d24c2ea in DB::WindowTransform::work() obj-x86_64-linux-gnu/../src/Processors/Transforms/WindowTransform.cpp:1302:9
    #5 0x1cf655f8 in DB::executeJob(DB::IProcessor*) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:80:20
    #6 0x1cf654e6 in DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0::operator()() const obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:97:13
    #7 0x1cf654e6 in decltype(std::__1::forward<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(fp)()) std::__1::__invoke<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
    #8 0x1cf63e33 in std::__1::__function::__policy_func<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2221:16
    #9 0x1cf63e33 in std::__1::function<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560:12
    #10 0x1cf63e33 in DB::PipelineExecutor::executeStepImpl(unsigned long, unsigned long, std::__1::atomic<bool>*) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:586:17
    #11 0x1cf65e7d in DB::PipelineExecutor::executeSingleThread(unsigned long, unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:474:5
    #12 0x1cf65e7d in DB::PipelineExecutor::executeImpl(unsigned long)::$_4::operator()() const obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:777:21
    #13 0x1cf65e7d in decltype(std::__1::forward<DB::PipelineExecutor::executeImpl(unsigned long)::$_4&>(fp)()) std::__1::__invoke_constexpr<DB::PipelineExecutor::executeImpl(unsigned long)::$_4&>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3682:1
    #14 0x1cf65d19 in decltype(auto) std::__1::__apply_tuple_impl<DB::PipelineExecutor::executeImpl(unsigned long)::$_4&, std::__1::tuple<>&>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&, std::__1::tuple<>&, std::__1::__tuple_indices<>) obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:1415:1
    #15 0x1cf65d19 in decltype(auto) std::__1::apply<DB::PipelineExecutor::executeImpl(unsigned long)::$_4&, std::__1::tuple<>&>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&, std::__1::tuple<>&) obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:1424:1
    #16 0x1cf65d19 in ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PipelineExecutor::executeImpl(unsigned long)::$_4>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&&)::'lambda'()::operator()() obj-x86_64-linux-gnu/../src/Common/ThreadPool.h:182:13
    #17 0x1cf65d19 in decltype(std::__1::forward<DB::PipelineExecutor::executeImpl(unsigned long)::$_4>(fp)()) std::__1::__invoke<ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PipelineExecutor::executeImpl(unsigned long)::$_4>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&&)::'lambda'()&>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
    #18 0xf2764de in std::__1::function<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560:12
    #19 0xf2764de in ThreadPoolImpl<std::__1::thread>::worker(std::__1::__list_iterator<std::__1::thread, void*>) obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:254:17
    #20 0xf27a4f5 in void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()::operator()() const obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:124:73
    #21 0xf27a4f5 in decltype(std::__1::forward<void>(fp)(std::__1::forward<void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>(fp0)...)) std::__1::__invoke<void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>(void&&, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()&&...) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
    #22 0xf27a4f5 in void std::__1::__thread_execute<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>(std::__1::tuple<void, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>&, std::__1::__tuple_indices<>) obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:280:5
    #23 0xf27a4f5 in void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()> >(void*) obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:291:5
    #24 0x7f83c7aa9608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
    #25 0x7f83c79d0292 in clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../src/Common/assert_cast.h:50:12 in

2021.05.15 01:05:52.020516 [ 178 ] {} <Fatal> BaseDaemon: ########################################
2021.05.15 01:05:52.020641 [ 178 ] {} <Fatal> BaseDaemon: (version 21.6.1.6840, build id: 2EFE7C3919459DFFC4A9AA66D9E51CE24F2FB0C9) (from thread 152) (query_id: 237db5cf-ca48-4a0d-8381-e7f31df12822) Received signal Unknown signal (-3)
2021.05.15 01:05:52.020688 [ 178 ] {} <Fatal> BaseDaemon: Sanitizer trap.
2021.05.15 01:05:52.020763 [ 178 ] {} <Fatal> BaseDaemon: Stack trace: 0xf2422a5 0xf484cb6 0xf2037d6 0xf2142b9 0x1c40d5cc 0x1d243adf 0x1d2474cd 0x1d24c2eb 0x1cf655f9 0x1cf654e7 0x1cf63e34 0x1cf65e7e 0x1cf65d1a 0xf2764df 0xf27a4f6 0x7f83c7aa9609 0x7f83c79d0293
2021.05.15 01:05:52.040556 [ 178 ] {} <Fatal> BaseDaemon: 0.1. inlined from ./obj-x86_64-linux-gnu/../src/Common/StackTrace.cpp:304: StackTrace::tryCapture()
2021.05.15 01:05:52.040590 [ 178 ] {} <Fatal> BaseDaemon: 0. ../src/Common/StackTrace.cpp:265: StackTrace::StackTrace() @ 0xf2422a5 in /workspace/clickhouse
2021.05.15 01:05:52.103120 [ 178 ] {} <Fatal> BaseDaemon: 1. ./obj-x86_64-linux-gnu/../base/daemon/BaseDaemon.cpp:381: sanitizerDeathCallback() @ 0xf484cb6 in /workspace/clickhouse
2021.05.15 01:05:53.074557 [ 178 ] {} <Fatal> BaseDaemon: 2. __sanitizer::Die() @ 0xf2037d6 in /workspace/clickhouse
2021.05.15 01:05:54.035015 [ 178 ] {} <Fatal> BaseDaemon: 3. ? @ 0xf2142b9 in /workspace/clickhouse
2021.05.15 01:05:54.048959 [ 178 ] {} <Fatal> BaseDaemon: 4.1. inlined from ./obj-x86_64-linux-gnu/../src/Common/assert_cast.h:0: DB::ColumnConst const& assert_cast<DB::ColumnConst const&, DB::IColumn const&>(DB::IColumn const&)
2021.05.15 01:05:54.049031 [ 178 ] {} <Fatal> BaseDaemon: 4. ../src/Columns/ColumnConst.h:207: DB::ColumnConst::compareAt(unsigned long, unsigned long, DB::IColumn const&, int) const @ 0x1c40d5cc in /workspace/clickhouse
2021.05.15 01:05:54.103862 [ 178 ] {} <Fatal> BaseDaemon: 5. ./obj-x86_64-linux-gnu/../src/Processors/Transforms/WindowTransform.cpp:647: DB::WindowTransform::arePeers(DB::RowNumber const&, DB::RowNumber const&) const @ 0x1d243adf in /workspace/clickhouse
2021.05.15 01:05:54.157576 [ 178 ] {} <Fatal> BaseDaemon: 6. ./obj-x86_64-linux-gnu/../src/Processors/Transforms/WindowTransform.cpp:1033: DB::WindowTransform::appendChunk(DB::Chunk&) @ 0x1d2474cd in /workspace/clickhouse
2021.05.15 01:05:54.213108 [ 178 ] {} <Fatal> BaseDaemon: 7. ./obj-x86_64-linux-gnu/../src/Processors/Transforms/WindowTransform.cpp:1317: DB::WindowTransform::work() @ 0x1d24c2eb in /workspace/clickhouse
2021.05.15 01:05:54.298756 [ 178 ] {} <Fatal> BaseDaemon: 8. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:88: DB::executeJob(DB::IProcessor*) @ 0x1cf655f9 in /workspace/clickhouse
2021.05.15 01:05:54.381068 [ 178 ] {} <Fatal> BaseDaemon: 9.1. inlined from ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:100: operator()
2021.05.15 01:05:54.381113 [ 178 ] {} <Fatal> BaseDaemon: 9. ../contrib/libcxx/include/type_traits:3676: decltype(std::__1::forward<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(fp)()) std::__1::__invoke<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&) @ 0x1cf654e7 in /workspace/clickhouse
2021.05.15 01:05:54.459982 [ 178 ] {} <Fatal> BaseDaemon: 10.1. inlined from ./obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:0: std::__1::__function::__policy_func<void ()>::operator()() const
2021.05.15 01:05:54.460059 [ 178 ] {} <Fatal> BaseDaemon: 10.2. inlined from ../contrib/libcxx/include/functional:2560: std::__1::function<void ()>::operator()() const
2021.05.15 01:05:54.460082 [ 178 ] {} <Fatal> BaseDaemon: 10. ../src/Processors/Executors/PipelineExecutor.cpp:586: DB::PipelineExecutor::executeStepImpl(unsigned long, unsigned long, std::__1::atomic<bool>*) @ 0x1cf63e34 in /workspace/clickhouse
2021.05.15 01:05:54.544023 [ 178 ] {} <Fatal> BaseDaemon: 11.1. inlined from ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:0: operator()
2021.05.15 01:05:54.544090 [ 178 ] {} <Fatal> BaseDaemon: 11. ../contrib/libcxx/include/type_traits:3682: decltype(std::__1::forward<DB::PipelineExecutor::executeImpl(unsigned long)::$_4&>(fp)()) std::__1::__invoke_constexpr<DB::PipelineExecutor::executeImpl(unsigned long)::$_4&>(DB::PipelineExecutor::executeImpl(unsigned long)::$_4&) @ 0x1cf65e7e in /workspace/clickhouse

Metadata

Metadata

Assignees

Labels

comp-window-functionsWindow function execution + frame handling (ROW_NUMBER/RANK/LAG/LEAD, frames, partitions, order).fuzzProblem found by one of the fuzzers

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions