Crash at llvm::X86InstrInfo::copyPhysReg #50323
Description
Describe what's wrong
The SELECT statement makes the server crash.
Does it reproduce on recent release?
It can be reproduced in the latest version.
How to reproduce
Version: 23.5.1 (commit 806ef08)
Easy reproduce in ClickHouse fiddle: https://fiddle.clickhouse.com/d399218b-824f-41b9-9d6e-fb824152c759
Set up database
create table t1 (pkey UInt32, c8 UInt32, c9 String, c10 Float32, c11 String, primary key(c8)) engine = ReplacingMergeTree;
create table t3 (vkey UInt32, pkey UInt32, c15 UInt32) engine = Log;Bug-triggering query
with cte_4 as (
select
ref_10.c11 as c_2_c2350_1,
ref_9.c9 as c_2_c2351_2
from
t1 as ref_9
right outer join t1 as ref_10
on (ref_9.c11 = ref_10.c9)
inner join t3 as ref_11
on (ref_10.c8 = ref_11.vkey)
where ((ref_10.pkey + ref_11.pkey) between ref_11.vkey and (case when (-30.87 >= ref_9.c10) then ref_11.c15 else ref_11.pkey end)))
select
ref_13.c_2_c2350_1 as c_2_c2357_3
from
cte_4 as ref_13
where (ref_13.c_2_c2351_2) in (
select
ref_14.c_2_c2351_2 as c_5_c2352_0
from
cte_4 as ref_14);Expected behavior
No crash.
Actual behavior
The server crashes.
The log:
[a42dd51a4b55] 2023.05.29 17:47:57.669009 [ 1780230 ] <Fatal> BaseDaemon: ########################################
[a42dd51a4b55] 2023.05.29 17:47:57.669257 [ 1780230 ] <Fatal> BaseDaemon: (version 23.5.1.1, build id: 91219368B241C6A86EEC6081927CBB6262DAE94A) (from thread 1779924) (query_id: 925605fe-1d79-40fd-8e27-39136e849fa0) (query: with cte_4 as (
select
ref_10.c11 as c_2_c2350_1,
ref_9.c9 as c_2_c2351_2
from
t1 as ref_9
right outer join t1 as ref_10
on (ref_9.c11 = ref_10.c9)
inner join t3 as ref_11
on (ref_10.c8 = ref_11.vkey)
where ((ref_10.pkey + ref_11.pkey) between ref_11.vkey and (case when (-30.87 >= ref_9.c10) then ref_11.c15 else ref_11.pkey end)))
select
ref_13.c_2_c2350_1 as c_2_c2357_3
from
cte_4 as ref_13
where (ref_13.c_2_c2351_2) in (
select
ref_14.c_2_c2351_2 as c_5_c2352_0
from
cte_4 as ref_14);) Received signal Aborted (6)
[a42dd51a4b55] 2023.05.29 17:47:57.669393 [ 1780230 ] <Fatal> BaseDaemon:
[a42dd51a4b55] 2023.05.29 17:47:57.669460 [ 1780230 ] <Fatal> BaseDaemon: Stack trace: 0x00007f569f5f500b 0x00007f569f5d4859 0x000000001a294cd8 0x000000001a294b86 0x0000000018e3f1b5 0x000000001955baa5 0x00000000193a3f4c 0x000000001a1a8b8a 0x000000001a1b0793 0x000000001a1a97a8 0x00000000174b0eea 0x00000000174afd3c 0x00000000174afa57 0x00000000174bb69e 0x0000000016bc5e06 0x00000000166d4b29 0x0000000016852bfc 0x00000000184348f9 0x000000001843758b 0x000000001844d623 0x00000000171690c3 0x000000001742aee7 0x00000000174281ef 0x00000000180bde24 0x00000000180ce159 0x000000001a68b547 0x000000001a68ba2d 0x000000001a7f2727 0x000000001a7f0342 0x00007f569f7ac609 0x00007f569f6d1133
[a42dd51a4b55] 2023.05.29 17:47:57.669540 [ 1780230 ] <Fatal> BaseDaemon: 3. raise @ 0x00007f569f5f500b in ?
[a42dd51a4b55] 2023.05.29 17:47:57.669604 [ 1780230 ] <Fatal> BaseDaemon: 4. abort @ 0x00007f569f5d4859 in ?
[a42dd51a4b55] 2023.05.29 17:47:59.098108 [ 1780230 ] <Fatal> BaseDaemon: 5. llvm::report_fatal_error(llvm::Twine const&, bool) @ 0x000000001a294cd8 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:00.516065 [ 1780230 ] <Fatal> BaseDaemon: 6. ? @ 0x000000001a294b86 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:01.869262 [ 1780230 ] <Fatal> BaseDaemon: 7. llvm::X86InstrInfo::copyPhysReg(llvm::MachineBasicBlock&, llvm::MachineInstrBundleIterator<llvm::MachineInstr, false>, llvm::DebugLoc const&, llvm::MCRegister, llvm::MCRegister, bool) const @ 0x0000000018e3f1b5 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:03.209189 [ 1780230 ] <Fatal> BaseDaemon: 8. (anonymous namespace)::ExpandPostRA::runOnMachineFunction(llvm::MachineFunction&) @ 0x000000001955baa5 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:04.634853 [ 1780230 ] <Fatal> BaseDaemon: 9. llvm::MachineFunctionPass::runOnFunction(llvm::Function&) @ 0x00000000193a3f4c in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:05.983760 [ 1780230 ] <Fatal> BaseDaemon: 10. llvm::FPPassManager::runOnFunction(llvm::Function&) @ 0x000000001a1a8b8a in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:07.316860 [ 1780230 ] <Fatal> BaseDaemon: 11. llvm::FPPassManager::runOnModule(llvm::Module&) @ 0x000000001a1b0793 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:08.701261 [ 1780230 ] <Fatal> BaseDaemon: 12. llvm::legacy::PassManagerImpl::run(llvm::Module&) @ 0x000000001a1a97a8 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:08.741010 [ 1780230 ] <Fatal> BaseDaemon: 13. ./build/./src/Interpreters/JIT/CHJIT.cpp:0: DB::JITCompiler::compile(llvm::Module&) @ 0x00000000174b0eea in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:08.778865 [ 1780230 ] <Fatal> BaseDaemon: 14. ./build/./src/Interpreters/JIT/CHJIT.cpp:0: DB::CHJIT::compileModule(std::unique_ptr<llvm::Module, std::default_delete<llvm::Module>>) @ 0x00000000174afd3c in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:08.811988 [ 1780230 ] <Fatal> BaseDaemon: 15. ./build/./src/Interpreters/JIT/CHJIT.cpp:361: DB::CHJIT::compileModule(std::function<void (llvm::Module&)>) @ 0x00000000174afa57 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:08.843042 [ 1780230 ] <Fatal> BaseDaemon: 16.1. inlined from ./build/./contrib/llvm-project/libcxx/include/__functional/function.h:818: ~__policy_func
[a42dd51a4b55] 2023.05.29 17:48:08.843208 [ 1780230 ] <Fatal> BaseDaemon: 16.2. inlined from ./build/./contrib/llvm-project/libcxx/include/__functional/function.h:1174: ~function
[a42dd51a4b55] 2023.05.29 17:48:08.843259 [ 1780230 ] <Fatal> BaseDaemon: 16. ./build/./src/Interpreters/JIT/compileFunction.cpp:167: DB::compileFunction(DB::CHJIT&, DB::IFunctionBase const&) @ 0x00000000174bb69e in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:08.881692 [ 1780230 ] <Fatal> BaseDaemon: 17.1. inlined from ./build/./contrib/llvm-project/libcxx/include/new:246: void* std::__libcpp_operator_new[abi:v15000]<unsigned long>(unsigned long)
[a42dd51a4b55] 2023.05.29 17:48:08.881856 [ 1780230 ] <Fatal> BaseDaemon: 17.2. inlined from ./build/./contrib/llvm-project/libcxx/include/new:272: std::__libcpp_allocate[abi:v15000](unsigned long, unsigned long)
[a42dd51a4b55] 2023.05.29 17:48:08.881956 [ 1780230 ] <Fatal> BaseDaemon: 17.3. inlined from ./build/./contrib/llvm-project/libcxx/include/__memory/allocator.h:112: std::allocator<std::__shared_ptr_emplace<DB::CompiledFunctionHolder, std::allocator<DB::CompiledFunctionHolder>>>::allocate[abi:v15000](unsigned long)
[a42dd51a4b55] 2023.05.29 17:48:08.882017 [ 1780230 ] <Fatal> BaseDaemon: 17.4. inlined from ./build/./contrib/llvm-project/libcxx/include/__memory/allocator_traits.h:262: std::allocator_traits<std::allocator<std::__shared_ptr_emplace<DB::CompiledFunctionHolder, std::allocator<DB::CompiledFunctionHolder>>>>::allocate[abi:v15000](std::allocator<std::__shared_ptr_emplace<DB::CompiledFunctionHolder, std::allocator<DB::CompiledFunctionHolder>>>&, unsigned long)
[a42dd51a4b55] 2023.05.29 17:48:08.882079 [ 1780230 ] <Fatal> BaseDaemon: 17.5. inlined from ./build/./contrib/llvm-project/libcxx/include/__memory/allocation_guard.h:53: __allocation_guard<std::allocator<DB::CompiledFunctionHolder> >
[a42dd51a4b55] 2023.05.29 17:48:08.882136 [ 1780230 ] <Fatal> BaseDaemon: 17.6. inlined from ./build/./contrib/llvm-project/libcxx/include/__memory/shared_ptr.h:952: std::shared_ptr<DB::CompiledFunctionHolder> std::allocate_shared[abi:v15000]<DB::CompiledFunctionHolder, std::allocator<DB::CompiledFunctionHolder>, DB::CompiledFunction&, void>(std::allocator<DB::CompiledFunctionHolder> const&, DB::CompiledFunction&)
[a42dd51a4b55] 2023.05.29 17:48:08.882201 [ 1780230 ] <Fatal> BaseDaemon: 17.7. inlined from ./build/./contrib/llvm-project/libcxx/include/__memory/shared_ptr.h:962: std::shared_ptr<DB::CompiledFunctionHolder> std::make_shared[abi:v15000]<DB::CompiledFunctionHolder, DB::CompiledFunction&, void>(DB::CompiledFunction&)
[a42dd51a4b55] 2023.05.29 17:48:08.882256 [ 1780230 ] <Fatal> BaseDaemon: 17.8. inlined from ./build/./src/Interpreters/ExpressionJIT.cpp:304: operator()
[a42dd51a4b55] 2023.05.29 17:48:08.882311 [ 1780230 ] <Fatal> BaseDaemon: 17.9. inlined from ./build/./src/Common/CacheBase.h:148: std::pair<std::shared_ptr<DB::CompiledExpressionCacheEntry>, bool> DB::CacheBase<wide::integer<128ul, unsigned int>, DB::CompiledExpressionCacheEntry, UInt128Hash, DB::CompiledFunctionWeightFunction>::getOrSet<DB::compile(DB::CompileDAG const&, unsigned long)::$_0>(wide::integer<128ul, unsigned int> const&, DB::compile(DB::CompileDAG const&, unsigned long)::$_0&&)
[a42dd51a4b55] 2023.05.29 17:48:08.882380 [ 1780230 ] <Fatal> BaseDaemon: 17.10. inlined from ./build/./src/Interpreters/ExpressionJIT.cpp:300: DB::compile(DB::CompileDAG const&, unsigned long)
[a42dd51a4b55] 2023.05.29 17:48:08.882459 [ 1780230 ] <Fatal> BaseDaemon: 17. ./build/./src/Interpreters/ExpressionJIT.cpp:593: DB::ActionsDAG::compileFunctions(unsigned long, std::unordered_set<DB::ActionsDAG::Node const*, std::hash<DB::ActionsDAG::Node const*>, std::equal_to<DB::ActionsDAG::Node const*>, std::allocator<DB::ActionsDAG::Node const*>> const&) @ 0x0000000016bc5e06 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:09.196679 [ 1780230 ] <Fatal> BaseDaemon: 18. ./build/./src/Interpreters/ActionsDAG.cpp:1070: DB::ActionsDAG::compileExpressions(unsigned long, std::unordered_set<DB::ActionsDAG::Node const*, std::hash<DB::ActionsDAG::Node const*>, std::equal_to<DB::ActionsDAG::Node const*>, std::allocator<DB::ActionsDAG::Node const*>> const&) @ 0x00000000166d4b29 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:09.262428 [ 1780230 ] <Fatal> BaseDaemon: 19. ./build/./src/Interpreters/ExpressionActions.cpp:0: DB::ExpressionActions::ExpressionActions(std::shared_ptr<DB::ActionsDAG>, DB::ExpressionActionsSettings const&) @ 0x0000000016852bfc in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:09.286035 [ 1780230 ] <Fatal> BaseDaemon: 20. ./build/./src/Processors/QueryPlan/FilterStep.cpp:57: DB::FilterStep::transformPipeline(DB::QueryPipelineBuilder&, DB::BuildQueryPipelineSettings const&) @ 0x00000000184348f9 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:09.303390 [ 1780230 ] <Fatal> BaseDaemon: 21. ./build/./src/Processors/QueryPlan/ITransformingStep.cpp:0: DB::ITransformingStep::updatePipeline(std::vector<std::unique_ptr<DB::QueryPipelineBuilder, std::default_delete<DB::QueryPipelineBuilder>>, std::allocator<std::unique_ptr<DB::QueryPipelineBuilder, std::default_delete<DB::QueryPipelineBuilder>>>>, DB::BuildQueryPipelineSettings const&) @ 0x000000001843758b in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:09.347798 [ 1780230 ] <Fatal> BaseDaemon: 22.1. inlined from ./build/./contrib/llvm-project/libcxx/include/__memory/unique_ptr.h:302: std::unique_ptr<DB::QueryPipelineBuilder, std::default_delete<DB::QueryPipelineBuilder>>::reset[abi:v15000](DB::QueryPipelineBuilder*)
[a42dd51a4b55] 2023.05.29 17:48:09.347968 [ 1780230 ] <Fatal> BaseDaemon: 22.2. inlined from ./build/./contrib/llvm-project/libcxx/include/__memory/unique_ptr.h:225: std::unique_ptr<DB::QueryPipelineBuilder, std::default_delete<DB::QueryPipelineBuilder>>::operator=[abi:v15000](std::unique_ptr<DB::QueryPipelineBuilder, std::default_delete<DB::QueryPipelineBuilder>>&&)
[a42dd51a4b55] 2023.05.29 17:48:09.348027 [ 1780230 ] <Fatal> BaseDaemon: 22. ./build/./src/Processors/QueryPlan/QueryPlan.cpp:189: DB::QueryPlan::buildQueryPipeline(DB::QueryPlanOptimizationSettings const&, DB::BuildQueryPipelineSettings const&) @ 0x000000001844d623 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:09.403658 [ 1780230 ] <Fatal> BaseDaemon: 23. ./build/./src/Interpreters/InterpreterSelectWithUnionQuery.cpp:379: DB::InterpreterSelectWithUnionQuery::execute() @ 0x00000000171690c3 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:09.494530 [ 1780230 ] <Fatal> BaseDaemon: 24. ./build/./src/Interpreters/executeQuery.cpp:0: DB::executeQueryImpl(char const*, char const*, std::shared_ptr<DB::Context>, bool, DB::QueryProcessingStage::Enum, DB::ReadBuffer*) @ 0x000000001742aee7 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:09.595519 [ 1780230 ] <Fatal> BaseDaemon: 25. ./build/./src/Interpreters/executeQuery.cpp:1180: DB::executeQuery(String const&, std::shared_ptr<DB::Context>, bool, DB::QueryProcessingStage::Enum) @ 0x00000000174281ef in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:09.666398 [ 1780230 ] <Fatal> BaseDaemon: 26. ./build/./src/Server/TCPHandler.cpp:0: DB::TCPHandler::runImpl() @ 0x00000000180bde24 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:09.781625 [ 1780230 ] <Fatal> BaseDaemon: 27. ./build/./src/Server/TCPHandler.cpp:2045: DB::TCPHandler::run() @ 0x00000000180ce159 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:09.785181 [ 1780230 ] <Fatal> BaseDaemon: 28. ./build/./base/poco/Net/src/TCPServerConnection.cpp:57: Poco::Net::TCPServerConnection::start() @ 0x000000001a68b547 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:09.790956 [ 1780230 ] <Fatal> BaseDaemon: 29.1. inlined from ./build/./contrib/llvm-project/libcxx/include/__memory/unique_ptr.h:48: std::default_delete<Poco::Net::TCPServerConnection>::operator()[abi:v15000](Poco::Net::TCPServerConnection*) const
[a42dd51a4b55] 2023.05.29 17:48:09.791106 [ 1780230 ] <Fatal> BaseDaemon: 29.2. inlined from ./build/./contrib/llvm-project/libcxx/include/__memory/unique_ptr.h:305: std::unique_ptr<Poco::Net::TCPServerConnection, std::default_delete<Poco::Net::TCPServerConnection>>::reset[abi:v15000](Poco::Net::TCPServerConnection*)
[a42dd51a4b55] 2023.05.29 17:48:09.791166 [ 1780230 ] <Fatal> BaseDaemon: 29.3. inlined from ./build/./contrib/llvm-project/libcxx/include/__memory/unique_ptr.h:259: ~unique_ptr
[a42dd51a4b55] 2023.05.29 17:48:09.791221 [ 1780230 ] <Fatal> BaseDaemon: 29. ./build/./base/poco/Net/src/TCPServerDispatcher.cpp:116: Poco::Net::TCPServerDispatcher::run() @ 0x000000001a68ba2d in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:09.797885 [ 1780230 ] <Fatal> BaseDaemon: 30. ./build/./base/poco/Foundation/src/ThreadPool.cpp:202: Poco::PooledThread::run() @ 0x000000001a7f2727 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:09.803906 [ 1780230 ] <Fatal> BaseDaemon: 31.1. inlined from ./build/./base/poco/Foundation/include/Poco/SharedPtr.h:139: Poco::SharedPtr<Poco::Runnable, Poco::ReferenceCounter, Poco::ReleasePolicy<Poco::Runnable>>::assign(Poco::Runnable*)
[a42dd51a4b55] 2023.05.29 17:48:09.804065 [ 1780230 ] <Fatal> BaseDaemon: 31.2. inlined from ./build/./base/poco/Foundation/include/Poco/SharedPtr.h:180: Poco::SharedPtr<Poco::Runnable, Poco::ReferenceCounter, Poco::ReleasePolicy<Poco::Runnable>>::operator=(Poco::Runnable*)
[a42dd51a4b55] 2023.05.29 17:48:09.804116 [ 1780230 ] <Fatal> BaseDaemon: 31. ./build/./base/poco/Foundation/src/Thread_POSIX.cpp:350: Poco::ThreadImpl::runnableEntry(void*) @ 0x000000001a7f0342 in /usr/bin/clickhouse
[a42dd51a4b55] 2023.05.29 17:48:09.804233 [ 1780230 ] <Fatal> BaseDaemon: 32. ? @ 0x00007f569f7ac609 in ?
[a42dd51a4b55] 2023.05.29 17:48:09.804315 [ 1780230 ] <Fatal> BaseDaemon: 33. clone @ 0x00007f569f6d1133 in ?
[a42dd51a4b55] 2023.05.29 17:48:09.804386 [ 1780230 ] <Fatal> BaseDaemon: Integrity check of the executable skipped because the reference checksum could not be read.
Error on processing query: Code: 32. DB::Exception: Attempt to read after eof: while receiving packet from localhost:9000. (ATTEMPT_TO_READ_AFTER_EOF) (version 23.5.1.1)
(query: with cte_4 as (
select
ref_10.c11 as c_2_c2350_1,
ref_9.c9 as c_2_c2351_2
from
t1 as ref_9
right outer join t1 as ref_10
on (ref_9.c11 = ref_10.c9)
inner join t3 as ref_11
on (ref_10.c8 = ref_11.vkey)
where ((ref_10.pkey + ref_11.pkey) between ref_11.vkey and (case when (-30.87 >= ref_9.c10) then ref_11.c15 else ref_11.pkey end)))
select
ref_13.c_2_c2350_1 as c_2_c2357_3
from
cte_4 as ref_13
where (ref_13.c_2_c2351_2) in (
select
ref_14.c_2_c2351_2 as c_5_c2352_0
from
cte_4 as ref_14);)
Additional context
The earliest reproducible version is 22.10 in fiddle: https://fiddle.clickhouse.com/3e5f6a67-80cf-415e-bfc1-d5f18cbf4313