-
Notifications
You must be signed in to change notification settings - Fork 8.3k
AST Fuzzer crash in MergeTreeConditionFullText::MergeTreeConditionFullText #54541
Description
AST fuzzer failure reported here: https://s3.amazonaws.com/clickhouse-test-reports/0/e9daff6c2f2d0a2bb1a7dd5a994dfb91da883521/fuzzer_astfuzzerdebug/report.html
Minimal reproducible example:
CREATE TABLE tab (row_id UInt32, str String, INDEX idx str TYPE tokenbf_v1(256, 2, 0)) ENGINE = MergeTree ORDER BY row_id;
INSERT INTO tab VALUES (0, 'a');
SELECT * FROM tab WHERE str == 'else' AND 1.0; -- crash, see belowIf we use a set index instead, we still get an exception:
CREATE TABLE tab (row_id UInt32, str String, INDEX idx str TYPE set(1)) ENGINE = MergeTree ORDER BY row_id;
INSERT INTO tab VALUES (0, 'a');
SELECT * FROM tab WHERE str == 'else' AND 1.0; -- Code: 36. DB::Exception: Received from localhost:9000. DB::Exception: It's a bug! Only UInt8 type is supported by __bitBoolMaskAnd.: while executing 'FUNCTION __bitBoolMaskAnd(__bitWrapperFunc(ifNull(equals(str, 'else'), 0)) : 2, 1. :: 3) -> __bitBoolMaskAnd(__bitWrapperFunc(ifNull(equals(str, 'else'), 0)), 1.) UInt8 : 1'. (BAD_ARGUMENTS)2023.09.12 05:04:57.218509 [ 706 ] {} BaseDaemon: (version 23.9.1.1 (official build), build id: 14BC887462A21B85DC255D2ADD0AC9251ECF4100, git hash: e9daff6) (from thread 181) (query_id: d30d8126-f02f-4775-a6b2-68f5b204b057) (query: SELECT '0', NULL FROM bf_tokenbf_map_values_test PREWHERE '10.25' != (map['']) WHERE -inf SETTINGS force_data_skipping_indices = 'map_values_tokenbf') Received signal Aborted (6)
2023.09.12 05:04:57.218689 [ 706 ] {} BaseDaemon:
2023.09.12 05:04:57.218834 [ 706 ] {} BaseDaemon: Stack trace: 0x00007f171eaeca7c 0x00007f171ea98476 0x00007f171ea7e7f3 0x000000001394529e 0x0000000013945315 0x00000000139457a6 0x000000000b1e676a 0x000000000b23746c 0x000000000b23d7a7 0x000000001e05f532 0x000000001e063768 0x000000001e063725 0x000000001e0636e5 0x000000001e0636a5 0x000000001e06366d 0x000000001e06e646 0x000000001e06e485 0x000000001e06e211 0x000000001e06e151 0x000000001e06e151 0x000000001e064287 0x000000001e05df1f 0x000000001e06fae5 0x000000001e06f861 0x000000001e06f54d 0x000000001e06f3a0 0x000000001e065246 0x000000001e062486 0x000000001eec8031 0x000000001eec6b6b 0x000000001ef4ea08 0x000000001ee9f7d1 0x000000001ee9f257 0x000000001cc5e7eb 0x000000001d1496b7 0x000000001d144984 0x000000001e66748d 0x000000001e679845 0x00000000248e8679 0x00000000248e8ebc 0x0000000024b3e8d4
2023.09.12 05:04:57.219027 [ 706 ] {} BaseDaemon: 4. ? @ 0x00007f171eaeca7c in ?
2023.09.12 05:04:57.219198 [ 706 ] {} BaseDaemon: 5. ? @ 0x00007f171ea98476 in ?
2023.09.12 05:04:57.219315 [ 706 ] {} BaseDaemon: 6. ? @ 0x00007f171ea7e7f3 in ?
2023.09.12 05:04:57.329146 [ 706 ] {} BaseDaemon: 7. /build/src/Common/Exception.cpp:43: DB::abortOnFailedAssertion(String const&) @ 0x000000001394529e in /workspace/clickhouse
2023.09.12 05:04:57.437133 [ 706 ] {} BaseDaemon: 8. /build/src/Common/Exception.cpp:68: DB::handle_error_code(String const&, int, bool, std::vector<void*, std::allocator<void*>> const&) @ 0x0000000013945315 in /workspace/clickhouse
2023.09.12 05:04:57.530909 [ 706 ] {} BaseDaemon: 9. /build/src/Common/Exception.cpp:102: DB::Exception::Exception(DB::Exception::MessageMasked&&, int, bool) @ 0x00000000139457a6 in /workspace/clickhouse
2023.09.12 05:04:57.630194 [ 706 ] {} BaseDaemon: 10. /build/src/Common/Exception.h:73: DB::Exception::Exception(String&&, int, bool) @ 0x000000000b1e676a in /workspace/clickhouse
2023.09.12 05:04:58.762923 [ 706 ] {} BaseDaemon: 11. /build/src/Common/Exception.h:101: DB::Exception::Exception<DB::Field::Types::Which&, DB::Field::Types::Which const&>(int, FormatStringHelperImpl<std::type_identityDB::Field::Types::Which&::type, std::type_identity<DB::Field::Types::Which const&>::type>, DB::Field::Types::Which&, DB::Field::Types::Which const&) @ 0x000000000b23746c in /workspace/clickhouse
2023.09.12 05:04:59.740381 [ 706 ] {} BaseDaemon: 12. /build/src/Core/Field.h:874: DB::NearestFieldTypeImpl<std::decay::type, void>::Type& DB::Field::get() @ 0x000000000b23d7a7 in /workspace/clickhouse
2023.09.12 05:04:59.928844 [ 706 ] {} BaseDaemon: 13. /build/src/Storages/MergeTree/MergeTreeIndexFullText.cpp:345: DB::MergeTreeConditionFullText::extractAtomFromTree(DB::RPNBuilderTreeNode const&, DB::MergeTreeConditionFullText::RPNElement&) @ 0x000000001e05f532 in /workspace/clickhouse
2023.09.12 05:05:00.146570 [ 706 ] {} BaseDaemon: 14. /build/src/Storages/MergeTree/MergeTreeIndexFullText.cpp:181: DB::MergeTreeConditionFullText::MergeTreeConditionFullText(DB::SelectQueryInfo const&, std::shared_ptr<DB::Context const>, DB::Block const&, DB::BloomFilterParameters const&, DB::ITokenExtractor const*)::$_1::operator()(DB::RPNBuilderTreeNode const&, DB::MergeTreeConditionFullText::RPNElement&) const @ 0x000000001e063768 in /workspace/clickhouse
2023.09.12 05:05:00.368350 [ 706 ] {} BaseDaemon: 15. /build/contrib/llvm-project/libcxx/include/__functional/invoke.h:394: decltype(std::declval<DB::MergeTreeConditionFullText::MergeTreeConditionFullText(DB::SelectQueryInfo const&, std::shared_ptr<DB::Context const>, DB::Block const&, DB::BloomFilterParameters const&, DB::ITokenExtractor const*)::$_1&>()(std::declval<DB::RPNBuilderTreeNode const&>(), std::declvalDB::MergeTreeConditionFullText::RPNElement&())) std::__invoke[abi:v15000]<DB::MergeTreeConditionFullText::MergeTreeConditionFullText(DB::SelectQueryInfo const&, std::shared_ptr<DB::Context const>, DB::Block const&, DB::BloomFilterParameters const&, DB::ITokenExtractor const*)::$_1&, DB::RPNBuilderTreeNode const&, DB::MergeTreeConditionFullText::RPNElement&>(DB::MergeTreeConditionFullText::MergeTreeConditionFullText(DB::SelectQueryInfo const&, std::shared_ptr<DB::Context const>, DB::Block const&, DB::BloomFilterParameters const&, DB::ITokenExtractor const*)::$_1&, DB::RPNBuilderTreeNode const&, DB::MergeTreeConditionFullText::RPNElement&) @ 0x000000001e063725 in /workspace/clickhouse
2023.09.12 05:05:00.585561 [ 706 ] {} BaseDaemon: 16. /build/contrib/llvm-project/libcxx/include/__functional/invoke.h:470: bool std::__invoke_void_return_wrapper<bool, false>::__call<DB::MergeTreeConditionFullText::MergeTreeConditionFullText(DB::SelectQueryInfo const&, std::shared_ptr<DB::Context const>, DB::Block const&, DB::BloomFilterParameters const&, DB::ITokenExtractor const*)::$_1&, DB::RPNBuilderTreeNode const&, DB::MergeTreeConditionFullText::RPNElement&>(DB::MergeTreeConditionFullText::MergeTreeConditionFullText(DB::SelectQueryInfo const&, std::shared_ptr<DB::Context const>, DB::Block const&, DB::BloomFilterParameters const&, DB::ITokenExtractor const*)::$_1&, DB::RPNBuilderTreeNode const&, DB::MergeTreeConditionFullText::RPNElement&) @ 0x000000001e0636e5 in /workspace/clickhouse
2023.09.12 05:05:00.802780 [ 706 ] {} BaseDaemon: 17. /build/contrib/llvm-project/libcxx/include/__functional/function.h:235: std::__function::__default_alloc_func<DB::MergeTreeConditionFullText::MergeTreeConditionFullText(DB::SelectQueryInfo const&, std::shared_ptr<DB::Context const>, DB::Block const&, DB::BloomFilterParameters const&, DB::ITokenExtractor const*)::$_1, bool (DB::RPNBuilderTreeNode const&, DB::MergeTreeConditionFullText::RPNElement&)>::operator()[abi:v15000](DB::RPNBuilderTreeNode const&, DB::MergeTreeConditionFullText::RPNElement&) @ 0x000000001e0636a5 in /workspace/clickhouse
2023.09.12 05:05:01.019826 [ 706 ] {} BaseDaemon: 18. /build/contrib/llvm-project/libcxx/include/__functional/function.h:716: bool std::__function::__policy_invoker<bool (DB::RPNBuilderTreeNode const&, DB::MergeTreeConditionFullText::RPNElement&)>::__call_impl<std::__function::__default_alloc_func<DB::MergeTreeConditionFullText::MergeTreeConditionFullText(DB::SelectQueryInfo const&, std::shared_ptr<DB::Context const>, DB::Block const&, DB::BloomFilterParameters const&, DB::ITokenExtractor const*)::$_1, bool (DB::RPNBuilderTreeNode const&, DB::MergeTreeConditionFullText::RPNElement&)>>(std::__function::__policy_storage const*, DB::RPNBuilderTreeNode const&, DB::MergeTreeConditionFullText::RPNElement&) @ 0x000000001e06366d in /workspace/clickhouse
2023.09.12 05:05:01.237288 [ 706 ] {} BaseDaemon: 19. /build/contrib/llvm-project/libcxx/include/__functional/function.h:848: std::__function::__policy_func<bool (DB::RPNBuilderTreeNode const&, DB::MergeTreeConditionFullText::RPNElement&)>::operator()[abi:v15000](DB::RPNBuilderTreeNode const&, DB::MergeTreeConditionFullText::RPNElement&) const @ 0x000000001e06e646 in /workspace/clickhouse
2023.09.12 05:05:01.454314 [ 706 ] {} BaseDaemon: 20. /build/contrib/llvm-project/libcxx/include/__functional/function.h:1187: std::function<bool (DB::RPNBuilderTreeNode const&, DB::MergeTreeConditionFullText::RPNElement&)>::operator()(DB::RPNBuilderTreeNode const&, DB::MergeTreeConditionFullText::RPNElement&) const @ 0x000000001e06e485 in /workspace/clickhouse
2023.09.12 05:05:01.673043 [ 706 ] {} BaseDaemon: 21. /build/src/Storages/MergeTree/RPNBuilder.h:252: DB::RPNBuilderDB::MergeTreeConditionFullText::RPNElement::traverseTree(DB::RPNBuilderTreeNode const&) @ 0x000000001e06e211 in /workspace/clickhouse
2023.09.12 05:05:01.890542 [ 706 ] {} BaseDaemon: 22. /build/src/Storages/MergeTree/RPNBuilder.h:239: DB::RPNBuilderDB::MergeTreeConditionFullText::RPNElement::traverseTree(DB::RPNBuilderTreeNode const&) @ 0x000000001e06e151 in /workspace/clickhouse
2023.09.12 05:05:02.108198 [ 706 ] {} BaseDaemon: 23. /build/src/Storages/MergeTree/RPNBuilder.h:239: DB::RPNBuilderDB::MergeTreeConditionFullText::RPNElement::traverseTree(DB::RPNBuilderTreeNode const&) @ 0x000000001e06e151 in /workspace/clickhouse
2023.09.12 05:05:02.293752 [ 706 ] {} BaseDaemon: 24. /build/src/Storages/MergeTree/RPNBuilder.h:218: DB::RPNBuilderDB::MergeTreeConditionFullText::RPNElement::RPNBuilder(std::shared_ptrDB::IAST const&, std::shared_ptr<DB::Context const>, DB::Block, std::shared_ptrDB::PreparedSets, std::function<bool (DB::RPNBuilderTreeNode const&, DB::MergeTreeConditionFullText::RPNElement&)> const&) @ 0x000000001e064287 in /workspace/clickhouse
2023.09.12 05:05:02.460137 [ 706 ] {} BaseDaemon: 25. /build/src/Storages/MergeTree/MergeTreeIndexFullText.cpp:176: DB::MergeTreeConditionFullText::MergeTreeConditionFullText(DB::SelectQueryInfo const&, std::shared_ptr<DB::Context const>, DB::Block const&, DB::BloomFilterParameters const&, DB::ITokenExtractor const*) @ 0x000000001e05df1f in /workspace/clickhouse