Skip to content

Split actions dag#19253

Merged
KochetovNicolai merged 27 commits intomasterfrom
split-actions-dag
Jan 25, 2021
Merged

Split actions dag#19253
KochetovNicolai merged 27 commits intomasterfrom
split-actions-dag

Conversation

@KochetovNicolai
Copy link
Copy Markdown
Member

@KochetovNicolai KochetovNicolai commented Jan 18, 2021

I hereby agree to the terms of the CLA available at: https://yandex.ru/legal/cla/?lang=en

Changelog category (leave one):

  • Performance Improvement

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):
Support splitting Filter step of query plan into Expression + Filter pair. Together with Expression + Expression merging optimization (#17458) it may delay execution for some expressions after Filter step.

Example:

EXPLAIN actions = 1
SELECT
    x,
    y
FROM 
(
    SELECT
        sipHash64(number) AS x,
        bitAnd(number, 1024) AS y
    FROM numbers_mt(1000000000)
    LIMIT 1000000000
)
WHERE y = 0
FORMAT TSV

Before (sipHash64 is calculated before Filter):

Expression (Projection + Before ORDER BY)
Actions: INPUT :: 0 -> x UInt64 : 0
         INPUT :: 1 -> y UInt64 : 1
Positions: 0 1
  Filter (WHERE + Projection)
  Filter column: equals(y, 0)
  Actions: INPUT : 0 -> sipHash64(number) UInt64 : 0
           INPUT : 1 -> bitAnd(number, 1024) UInt64 : 1
           COLUMN Const(UInt8) -> 0 UInt8 : 2
           ALIAS sipHash64(number) :: 0 -> x UInt64 : 3
           ALIAS bitAnd(number, 1024) :: 1 -> y UInt64 : 0
           FUNCTION equals(y : 0, 0 :: 2) -> equals(y, 0) UInt8 : 1
    Expression (Before ORDER BY)
    Actions: INPUT : 0 -> number UInt64 : 0
             COLUMN Const(UInt16) -> 1024 UInt16 : 1
             FUNCTION sipHash64(number : 0) -> sipHash64(number) UInt64 : 2
             FUNCTION bitAnd(number :: 0, 1024 :: 1) -> bitAnd(number, 1024) UInt64 : 3
    Positions: 2 3
      SettingQuotaAndLimits (Set limits and quota after reading from storage)
        Limit (preliminary LIMIT)
        Limit 1000000000
        Offset 0
          ReadFromStorage (SystemNumbers)

After (sipHash64 is calculated after Filter):

Expression (((Projection + Before ORDER BY) + ((WHERE + Projection) + ((((WHERE + Projection))[split] + Before ORDER BY)))
Actions: INPUT : 0 -> number UInt64 : 0
         INPUT :: 1 -> y UInt64 : 1
         FUNCTION sipHash64(number :: 0) -> sipHash64(number) UInt64 : 2
         ALIAS sipHash64(number) :: 2 -> x UInt64 : 0
Positions: 0 1
  Filter (((((WHERE + Projection))[split] + Before ORDER BY))[split])
  Filter column: equals(y, 0) (removed)
  Actions: INPUT : 0 -> number UInt64 : 0
           COLUMN Const(UInt16) -> 1024 UInt16 : 1
           COLUMN Const(UInt8) -> 0 UInt8 : 2
           FUNCTION bitAnd(number : 0, 1024 :: 1) -> bitAnd(number, 1024) UInt64 : 3
           ALIAS bitAnd(number, 1024) :: 3 -> y UInt64 : 1
           FUNCTION equals(y : 1, 0 :: 2) -> equals(y, 0) UInt8 : 3
  Positions: 0 1 3
    SettingQuotaAndLimits (Set limits and quota after reading from storage)
      Limit (preliminary LIMIT)
      Limit 1000000000
      Offset 0
        ReadFromStorage (SystemNumbers)

@robot-clickhouse robot-clickhouse added the pr-not-for-changelog This PR should not be mentioned in the changelog label Jan 18, 2021
@robot-clickhouse robot-clickhouse added pr-performance Pull request with some performance improvements and removed pr-not-for-changelog This PR should not be mentioned in the changelog labels Jan 19, 2021
@KochetovNicolai KochetovNicolai marked this pull request as ready for review January 19, 2021 14:04
while (tryMergeExpressions(frame.node, frame.node->children.front()));

if (frame.node->children.size() == 1)
tryLiftUpArrayJoin(frame.node, frame.node->children.front(), nodes);
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently, it's unclear to me why this tree traversal is correct. Mostly because of changes in tree during traverse:
we add children to the traverse stack, after that change children for some nodes and continue.
I'm sure that everything works well, but maybe we can clarify this a little bit?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stack contains info for every nodes in the path from tree root to the current node.
Every optimization changes only current node and it's children.
So, optimization does not change any node in stack (except maybe current).
Also, optimization may change query plan step, but not query plan node (only add a new one). So, node.children will be always valid.

Also, this code is not the best one. I will try to update it later.

{
auto & child_data = data[child];

/// If children is not created, int may be from split part.
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

int -> it

@@ -0,0 +1,4 @@
<test>
<query>select sum(x), sum(y) from (select sipHash64(number) as x, bitAnd(number, 1024) as y from numbers_mt(200000000)) where y = 0 settings enable_optimize_predicate_expression=0</query>
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bitAnd(number, 1024) quite strange condition.

@alesapin
Copy link
Copy Markdown
Member

ANTLR failure should be investigated.

@alesapin alesapin self-assigned this Jan 22, 2021
@KochetovNicolai
Copy link
Copy Markdown
Member Author

  1. Msan fuzzer (fails under asan also)
select sumIf(NULL, (number % 2) > -9223372036854775808) from numbers(1)
2021.01.25 17:29:53.575204 [ 24642 ] {} <Fatal> BaseDaemon: ########################################
2021.01.25 17:29:53.575571 [ 24642 ] {} <Fatal> BaseDaemon: (version 21.2.1.1, build id: 9C64DB91C2BE13300F2AFFD7B68C3A6AB09A76F3) (from thread 23739) (query_id: c39c8f25-b58c-4645-9e44-27778f336bb4) Received signal Aborted (6)
2021.01.25 17:29:53.575904 [ 24642 ] {} <Fatal> BaseDaemon: 
2021.01.25 17:29:53.576211 [ 24642 ] {} <Fatal> BaseDaemon: Stack trace: 0x7fda60babf47 0x7fda60bad8b1 0x15d9f4c7 0x15d9f74d 0x15e02f9b 0x15e0391d 0x15e019fd 0x2ecff3d7 0x2ecff011 0x2ece0a64 0x2ece0f16 0x2ece0a26 0x2ece0f16 0x2ece0a26 0x2ecce782 0x2eccc366 0x2eca0020 0x2e0fb95f 0x2e0f7373 0x2e0f4a7d 0x2e811926 0x2e80a113 0x2e80910c 0x2dfc3bcb 0x2dfc08fa 0x2edc63c0 0x2edc3029 0x306fb7d6
2021.01.25 17:29:53.580185 [ 24642 ] {} <Fatal> BaseDaemon: 4. /build/glibc-2ORdQG/glibc-2.27/signal/../sysdeps/unix/sysv/linux/raise.c:51: raise @ 0x3ef47 in /usr/lib/debug/lib/x86_64-linux-gnu/libc-2.27.so
2021.01.25 17:29:53.581498 [ 24642 ] {} <Fatal> BaseDaemon: 5. /build/glibc-2ORdQG/glibc-2.27/stdlib/abort.c:81: abort @ 0x408b1 in /usr/lib/debug/lib/x86_64-linux-gnu/libc-2.27.so
2021.01.25 17:29:53.591865 [ 24642 ] {} <Fatal> BaseDaemon: 6. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Common/Exception.cpp:46: DB::handle_error_code(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, int) @ 0x15d9f4c7 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:53.593325 [ 24642 ] {} <Fatal> BaseDaemon: 7. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Common/Exception.cpp:57: DB::Exception::Exception(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, int, bool) @ 0x15d9f74d in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:53.599166 [ 24642 ] {} <Fatal> BaseDaemon: 8. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Common/Exception.h:38: DB::Exception::Exception<char const*, char const*>(int, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, char const*&&, char const*&&) @ 0x15e02f9b in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:53.601412 [ 24642 ] {} <Fatal> BaseDaemon: 9. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Core/Field.h:790: unsigned long& DB::Field::get<unsigned long>() @ 0x15e0391d in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:53.603510 [ 24642 ] {} <Fatal> BaseDaemon: 10. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Core/Field.h:408: unsigned long const& DB::Field::get<unsigned long>() const @ 0x15e019fd in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:53.759382 [ 24642 ] {} <Fatal> BaseDaemon: 11. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/RewriteSumIfFunctionVisitor.cpp:44: DB::RewriteSumIfFunctionMatcher::visit(DB::ASTFunction const&, std::__1::shared_ptr<DB::IAST>&, DB::RewriteSumIfFunctionMatcher::Data&) @ 0x2ecff3d7 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:53.880742 [ 24642 ] {} <Fatal> BaseDaemon: 12. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/RewriteSumIfFunctionVisitor.cpp:14: DB::RewriteSumIfFunctionMatcher::visit(std::__1::shared_ptr<DB::IAST>&, DB::RewriteSumIfFunctionMatcher::Data&) @ 0x2ecff011 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:54.007584 [ 24642 ] {} <Fatal> BaseDaemon: 13. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/InDepthNodeVisitor.h:34: DB::InDepthNodeVisitor<DB::RewriteSumIfFunctionMatcher, false, std::__1::shared_ptr<DB::IAST> >::visit(std::__1::shared_ptr<DB::IAST>&) @ 0x2ece0a64 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:54.132408 [ 24642 ] {} <Fatal> BaseDaemon: 14. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/InDepthNodeVisitor.h:0: DB::InDepthNodeVisitor<DB::RewriteSumIfFunctionMatcher, false, std::__1::shared_ptr<DB::IAST> >::visitChildren(std::__1::shared_ptr<DB::IAST>&) @ 0x2ece0f16 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:54.240515 [ 24642 ] {} <Fatal> BaseDaemon: 15. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/InDepthNodeVisitor.h:30: DB::InDepthNodeVisitor<DB::RewriteSumIfFunctionMatcher, false, std::__1::shared_ptr<DB::IAST> >::visit(std::__1::shared_ptr<DB::IAST>&) @ 0x2ece0a26 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:54.353498 [ 24642 ] {} <Fatal> BaseDaemon: 16. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/InDepthNodeVisitor.h:0: DB::InDepthNodeVisitor<DB::RewriteSumIfFunctionMatcher, false, std::__1::shared_ptr<DB::IAST> >::visitChildren(std::__1::shared_ptr<DB::IAST>&) @ 0x2ece0f16 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:54.462867 [ 24642 ] {} <Fatal> BaseDaemon: 17. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/InDepthNodeVisitor.h:30: DB::InDepthNodeVisitor<DB::RewriteSumIfFunctionMatcher, false, std::__1::shared_ptr<DB::IAST> >::visit(std::__1::shared_ptr<DB::IAST>&) @ 0x2ece0a26 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:54.571034 [ 24642 ] {} <Fatal> BaseDaemon: 18. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/TreeOptimizer.cpp:555: DB::(anonymous namespace)::optimizeSumIfFunctions(std::__1::shared_ptr<DB::IAST>&) @ 0x2ecce782 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:54.676499 [ 24642 ] {} <Fatal> BaseDaemon: 19. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/TreeOptimizer.cpp:623: DB::TreeOptimizer::apply(std::__1::shared_ptr<DB::IAST>&, std::__1::unordered_map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::shared_ptr<DB::IAST>, std::__1::hash<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::equal_to<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const, std::__1::shared_ptr<DB::IAST> > > >&, std::__1::unordered_set<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::hash<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::equal_to<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&, std::__1::vector<DB::TableWithColumnNamesAndTypes, std::__1::allocator<DB::TableWithColumnNamesAndTypes> > const&, DB::Context const&, std::__1::shared_ptr<DB::StorageInMemoryMetadata const> const&, bool&) @ 0x2eccc366 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:54.785208 [ 24642 ] {} <Fatal> BaseDaemon: 20. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/TreeRewriter.cpp:794: DB::TreeRewriter::analyzeSelect(std::__1::shared_ptr<DB::IAST>&, DB::TreeRewriterResult&&, DB::SelectQueryOptions const&, std::__1::vector<DB::TableWithColumnNamesAndTypes, std::__1::allocator<DB::TableWithColumnNamesAndTypes> > const&, std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&, std::__1::shared_ptr<DB::TableJoin>) const @ 0x2eca0020 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:54.944705 [ 24642 ] {} <Fatal> BaseDaemon: 21. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/InterpreterSelectQuery.cpp:369: DB::InterpreterSelectQuery::InterpreterSelectQuery(std::__1::shared_ptr<DB::IAST> const&, DB::Context const&, std::__1::shared_ptr<DB::IBlockInputStream> const&, std::__1::optional<DB::Pipe>, std::__1::shared_ptr<DB::IStorage> const&, DB::SelectQueryOptions const&, std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&, std::__1::shared_ptr<DB::StorageInMemoryMetadata const> const&)::$_2::operator()(bool) const @ 0x2e0fb95f in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:55.121011 [ 24642 ] {} <Fatal> BaseDaemon: 22. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/InterpreterSelectQuery.cpp:460: DB::InterpreterSelectQuery::InterpreterSelectQuery(std::__1::shared_ptr<DB::IAST> const&, DB::Context const&, std::__1::shared_ptr<DB::IBlockInputStream> const&, std::__1::optional<DB::Pipe>, std::__1::shared_ptr<DB::IStorage> const&, DB::SelectQueryOptions const&, std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&, std::__1::shared_ptr<DB::StorageInMemoryMetadata const> const&) @ 0x2e0f7373 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:55.293425 [ 24642 ] {} <Fatal> BaseDaemon: 23. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/InterpreterSelectQuery.cpp:154: DB::InterpreterSelectQuery::InterpreterSelectQuery(std::__1::shared_ptr<DB::IAST> const&, DB::Context const&, DB::SelectQueryOptions const&, std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) @ 0x2e0f4a7d in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:55.413561 [ 24642 ] {} <Fatal> BaseDaemon: 24. /home/nik-kochetov/dev/ClickHouse/build-asan/../contrib/libcxx/include/memory:2068: std::__1::__unique_if<DB::InterpreterSelectQuery>::__unique_single std::__1::make_unique<DB::InterpreterSelectQuery, std::__1::shared_ptr<DB::IAST> const&, DB::Context&, DB::SelectQueryOptions&, std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&>(std::__1::shared_ptr<DB::IAST> const&, DB::Context&, DB::SelectQueryOptions&, std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) @ 0x2e811926 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:55.587838 [ 24642 ] {} <Fatal> BaseDaemon: 25. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/InterpreterSelectWithUnionQuery.cpp:327: DB::InterpreterSelectWithUnionQuery::buildCurrentChildInterpreter(std::__1::shared_ptr<DB::IAST> const&, std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) @ 0x2e80a113 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:55.750798 [ 24642 ] {} <Fatal> BaseDaemon: 26. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/InterpreterSelectWithUnionQuery.cpp:249: DB::InterpreterSelectWithUnionQuery::InterpreterSelectWithUnionQuery(std::__1::shared_ptr<DB::IAST> const&, DB::Context const&, DB::SelectQueryOptions const&, std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) @ 0x2e80910c in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:55.886832 [ 24642 ] {} <Fatal> BaseDaemon: 27. /home/nik-kochetov/dev/ClickHouse/build-asan/../contrib/libcxx/include/memory:2068: std::__1::__unique_if<DB::InterpreterSelectWithUnionQuery>::__unique_single std::__1::make_unique<DB::InterpreterSelectWithUnionQuery, std::__1::shared_ptr<DB::IAST>&, DB::Context&, DB::SelectQueryOptions const&>(std::__1::shared_ptr<DB::IAST>&, DB::Context&, DB::SelectQueryOptions const&) @ 0x2dfc3bcb in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:55.996084 [ 24642 ] {} <Fatal> BaseDaemon: 28. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/InterpreterFactory.cpp:110: DB::InterpreterFactory::get(std::__1::shared_ptr<DB::IAST>&, DB::Context&, DB::SelectQueryOptions const&) @ 0x2dfc08fa in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:56.114225 [ 24642 ] {} <Fatal> BaseDaemon: 29. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/executeQuery.cpp:503: DB::executeQueryImpl(char const*, char const*, DB::Context&, bool, DB::QueryProcessingStage::Enum, bool, DB::ReadBuffer*) @ 0x2edc63c0 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:56.231825 [ 24642 ] {} <Fatal> BaseDaemon: 30. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Interpreters/executeQuery.cpp:868: DB::executeQuery(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, DB::Context&, bool, DB::QueryProcessingStage::Enum, bool) @ 0x2edc3029 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
2021.01.25 17:29:56.568343 [ 24642 ] {} <Fatal> BaseDaemon: 31. /home/nik-kochetov/dev/ClickHouse/build-asan/../src/Server/TCPHandler.cpp:260: DB::TCPHandler::runImpl() @ 0x306fb7d6 in /home/nik-kochetov/dev/ClickHouse/build-asan/programs/clickhouse
  1. asan
SELECT today() - 65535, sumIf(1., (number % -1) > 1048575) FROM numbers(1048576)

same stack

  1. tsan - 2021.01.22 20:15:57.105624 [ 82 ] {} <Fatal> Application: Child process was terminated by signal 9 (KILL). If it is not done by 'forcestop' command or manually, the possible cause is OOM Killer (see 'dmesg' and look at the '/var/log/kern.log' for the details).

  2. ubsan

SELECT tuple(toDateTime(number) + 9223372036854775807) FROM numbers(1023)
../src/Functions/FunctionDateOrDateTimeAddInterval.h:73:18: runtime error: signed integer overflow: 1 + 9223372036854775807 cannot be represented in type 'long'
    #0 0x16301fd9 in void DB::Adder<DB::AddSecondsImpl>::vectorConstant<DB::PODArray<unsigned int, 4096ul, Allocator<false, false>, 15ul, 16ul>, DB::PODArray<unsigned int, 4096ul, Allocator<false, false>, 15ul, 16ul> >(DB::PODArray<unsigned int, 4096ul, Allocator<false, false>, 15ul, 16ul> const&, DB::PODArray<unsigned int, 4096ul, Allocator<false, false>, 15ul, 16ul>&, long, DateLUTImpl const&) const (/workspace/clickhouse+0x16301fd9)
    #1 0x162fe96b in DB::DateTimeAddIntervalImpl<DB::DataTypeDateTime, DB::DataTypeDateTime, DB::AddSecondsImpl>::execute(DB::AddSecondsImpl, std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&) (/workspace/clickhouse+0x162fe96b)
    #2 0x162fd0ad in DB::FunctionDateOrDateTimeAddInterval<DB::AddSecondsImpl>::executeImpl(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x162fd0ad)
    #3 0x11f41cc6 in DB::DefaultExecutable::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x11f41cc6)
    #4 0x129f3e1b in DB::ExecutableFunctionAdaptor::executeWithoutLowCardinalityColumns(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x129f3e1b)
    #5 0x129f4d3d in DB::ExecutableFunctionAdaptor::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x129f4d3d)
    #6 0x127e59b4 in DB::IFunctionBase::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x127e59b4)
    #7 0x12eb3155 in DB::FunctionBinaryArithmetic<DB::PlusImpl, DB::NamePlus, true>::executeDateTimeIntervalPlusMinus(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, std::__1::shared_ptr<DB::IFunctionOverloadResolver> const&) const (/workspace/clickhouse+0x12eb3155)
    #8 0x12eb1f83 in DB::FunctionBinaryArithmetic<DB::PlusImpl, DB::NamePlus, true>::executeImpl(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x12eb1f83)
    #9 0x12eb149b in DB::FunctionBinaryArithmeticWithConstants<DB::PlusImpl, DB::NamePlus, true>::executeImpl(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x12eb149b)
    #10 0x11f41cc6 in DB::DefaultExecutable::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x11f41cc6)
    #11 0x129f3e1b in DB::ExecutableFunctionAdaptor::executeWithoutLowCardinalityColumns(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x129f3e1b)
    #12 0x129f4d3d in DB::ExecutableFunctionAdaptor::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x129f4d3d)
    #13 0x1a01f303 in DB::executeAction(DB::ExpressionActions::Action const&, DB::(anonymous namespace)::ExecutionContext&, bool) obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:333:56
    #14 0x1a01e81f in DB::ExpressionActions::execute(DB::Block&, unsigned long&, bool) const obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:449:13
    #15 0x1b5bbd3d in DB::ExpressionTransform::transform(DB::Chunk&) obj-x86_64-linux-gnu/../src/Processors/Transforms/ExpressionTransform.cpp:25:17
    #16 0x1ac783b1 in DB::ISimpleTransform::transform(DB::Chunk&, DB::Chunk&) obj-x86_64-linux-gnu/../src/Processors/ISimpleTransform.h:42:9
    #17 0x1b3a4c8f in DB::ISimpleTransform::work() obj-x86_64-linux-gnu/../src/Processors/ISimpleTransform.cpp:89:9
    #18 0x1b3f4758 in DB::executeJob(DB::IProcessor*) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:79:20
    #19 0x1b3f4646 in DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0::operator()() const obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:96:13
    #20 0x1b3f4646 in decltype(std::__1::forward<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(fp)()) std::__1::__invoke<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
    #21 0x1b3f3053 in std::__1::__function::__policy_func<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2221:16
    #22 0x1b3f3053 in std::__1::function<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560:12
    #23 0x1b3f3053 in DB::PipelineExecutor::executeStepImpl(unsigned long, unsigned long, std::__1::atomic<bool>*) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:580:17
    #24 0x1b3f1929 in DB::PipelineExecutor::executeSingleThread(unsigned long, unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:473:5
    #25 0x1b3f1929 in DB::PipelineExecutor::executeImpl(unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:807:9
    #26 0x1b3f13ea in DB::PipelineExecutor::execute(unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:395:9
    #27 0x1b403deb in DB::threadFunction(DB::PullingAsyncPipelineExecutor::Data&, std::__1::shared_ptr<DB::ThreadGroupStatus>, unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PullingAsyncPipelineExecutor.cpp:79:24
    #28 0x1b403d46 in DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0::operator()() const obj-x86_64-linux-gnu/../src/Processors/Executors/PullingAsyncPipelineExecutor.cpp:101:13
    #29 0x1b403d46 in decltype(std::__1::forward<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&>(fp)()) std::__1::__invoke_constexpr<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3682:1
    #30 0x1b403c01 in decltype(auto) std::__1::__apply_tuple_impl<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&, std::__1::__tuple_indices<>) obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:1415:1
    #31 0x1b403c01 in decltype(auto) std::__1::apply<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&) obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:1424:1
    #32 0x1b403c01 in ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&)::'lambda'()::operator()() obj-x86_64-linux-gnu/../src/Common/ThreadPool.h:178:13
    #33 0x1b403c01 in decltype(std::__1::forward<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(fp)()) std::__1::__invoke<ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&)::'lambda'()&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
    #34 0xe3f974e in std::__1::function<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560:12
    #35 0xe3f974e in ThreadPoolImpl<std::__1::thread>::worker(std::__1::__list_iterator<std::__1::thread, void*>) obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:247:17
    #36 0xe3fd425 in void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()::operator()() const obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:124:73
    #37 0xe3fd425 in decltype(std::__1::forward<void>(fp)(std::__1::forward<void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>(fp0)...)) std::__1::__invoke<void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>(void&&, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()&&...) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
    #38 0xe3fd425 in void std::__1::__thread_execute<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>(std::__1::tuple<void, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>&, std::__1::__tuple_indices<>) obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:280:5
    #39 0xe3fd425 in void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()> >(void*) obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:291:5
    #40 0x7f3ba325e608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477:8
    #41 0x7f3ba3185292 in clone /build/glibc-ZN95T4/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

@KochetovNicolai KochetovNicolai merged commit a6f787f into master Jan 25, 2021
@KochetovNicolai KochetovNicolai deleted the split-actions-dag branch January 25, 2021 15:13
@azat
Copy link
Copy Markdown
Member

azat commented Jan 26, 2021

@KochetovNicolai This patches introduce one UAF:

https://clickhouse-test-reports.s3.yandex.net/19584/5f494c898af82cd46d68411696fa2d2ca0ef6184/fuzzer_tsan/report.html#fail1

SELECT [NULL, '25.6', '-0.02', NULL], [NULL], 1024, [NULL, '10485.76', NULL, NULL], [NULL, '-922337203.6854775808', toNullable(NULL)], [NULL] FROM (SELECT [multiIf((number % 1023) = -inf, toString(number), NULL)], NULL, '-1', multiIf((number % NULL)  NULL, toString(number), ''), [NULL, NULL], multiIf((number % NULL) = 65536, toString(number), '') AS s FROM system.numbers) LIMIT 1024
==================
WARNING: ThreadSanitizer: heap-use-after-free (pid=86)
  Read of size 1 at 0x7b28000a9ef0 by thread T3:
    ...
    8 DB::ActionsDAG::Index::prepend(DB::ActionsDAG::Node*) obj-x86_64-linux-gnu/../src/Interpreters/ActionsDAG.h:124:37 (clickhouse+0x124ca469)
    9 DB::ActionsDAG::merge(DB::ActionsDAG&&, DB::ActionsDAG&&) obj-x86_64-linux-gnu/../src/Interpreters/ActionsDAG.cpp:818:25 (clickhouse+0x124ca469)
    10 DB::tryMergeExpressions(DB::QueryPlan::Node*, DB::QueryPlan::Node*) obj-x86_64-linux-gnu/../src/Processors/QueryPlan/QueryPlan.cpp:529:23 (clickhouse+0x137e4dd1)
    11 DB::QueryPlan::optimize() obj-x86_64-linux-gnu/../src/Processors/QueryPlan/QueryPlan.cpp:646:24 (clickhouse+0x137dd41f)
    12 DB::QueryPlan::buildQueryPipeline() obj-x86_64-linux-gnu/../src/Processors/QueryPlan/QueryPlan.cpp:144:5 (clickhouse+0x137dbe4f)
    13 DB::InterpreterSelectWithUnionQuery::execute() obj-x86_64-linux-gnu/../src/Interpreters/InterpreterSelectWithUnionQuery.cpp:412:32 (clickhouse+0x12b448f7)
    14 DB::executeQueryImpl(char const*, char const*, DB::Context&, bool, DB::QueryProcessingStage::Enum, bool, DB::ReadBuffer*) obj-x86_64-linux-gnu/../src/Interpreters/executeQuery.cpp:524:32 (clickhouse+0x12cf7c87)
    15 DB::executeQuery(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, DB::Context&, bool, DB::QueryProcessingStage::Enum, bool) obj-x86_64-linux-gnu/../src/Interpreters/executeQuery.cpp:878:30 (clickhouse+0x12cf65e8)
    16 DB::TCPHandler::runImpl() obj-x86_64-linux-gnu/../src/Server/TCPHandler.cpp:260:24 (clickhouse+0x1352e87e)
    17 DB::TCPHandler::run() obj-x86_64-linux-gnu/../src/Server/TCPHandler.cpp:1417:9 (clickhouse+0x1353b727)
    18 Poco::Net::TCPServerConnection::start() obj-x86_64-linux-gnu/../contrib/poco/Net/src/TCPServerConnection.cpp:43:3 (clickhouse+0x16000622)
    19 Poco::Net::TCPServerDispatcher::run() obj-x86_64-linux-gnu/../contrib/poco/Net/src/TCPServerDispatcher.cpp:112:19 (clickhouse+0x16000d4e)
    20 Poco::PooledThread::run() obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/ThreadPool.cpp:199:14 (clickhouse+0x16169531)
    21 Poco::(anonymous namespace)::RunnableHolder::run() obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Thread.cpp:55:11 (clickhouse+0x16167acf)
    22 Poco::ThreadImpl::runnableEntry(void*) obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Thread_POSIX.cpp:345:27 (clickhouse+0x161662d7)

  Previous write of size 8 at 0x7b28000a9ef0 by thread T3:
    0 operator delete(void*, unsigned long) <null> (clickhouse+0x8c1e79e)
    ...
    7 std::__1::__list_imp<DB::ActionsDAG::Node, std::__1::allocator<DB::ActionsDAG::Node> >::~__list_imp() obj-x86_64-linux-gnu/../contrib/libcxx/include/list:743:3 (clickhouse+0x124d6782)
    8 DB::ActionsDAG::~ActionsDAG() obj-x86_64-linux-gnu/../src/Interpreters/ActionsDAG.h:41:7 (clickhouse+0x124d6782)
    ...
    16 DB::ExpressionActions::~ExpressionActions() obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:45:39 (clickhouse+0x12580476)
    17 std::__1::allocator<DB::ExpressionActions>::destroy(DB::ExpressionActions*) obj-x86_64-linux-gnu/../contrib/libcxx/include/memory:891:15 (clickhouse+0x124bec7d)
    ...
    23 std::__1::shared_ptr<DB::ExpressionActions>::~shared_ptr() obj-x86_64-linux-gnu/../contrib/libcxx/include/memory:3212:19 (clickhouse+0x137add84)
    24 DB::ExpressionStep::ExpressionStep(DB::DataStream const&, std::__1::shared_ptr<DB::ActionsDAG>) obj-x86_64-linux-gnu/../src/Processors/QueryPlan/ExpressionStep.cpp:44:7 (clickhouse+0x137add84)
    25 std::__1::__unique_if<DB::ExpressionStep>::__unique_single std::__1::make_unique<DB::ExpressionStep, DB::DataStream const&, std::__1::shared_ptr<DB::ActionsDAG>&>(DB::DataStream const&, std::__1::shared_ptr<DB::ActionsDAG>&) obj-x86_64-linux-gnu/../contrib/libcxx/include/memory:2068:32 (clickhouse+0x137e4e28)
    26 DB::tryMergeExpressions(DB::QueryPlan::Node*, DB::QueryPlan::Node*) obj-x86_64-linux-gnu/../src/Processors/QueryPlan/QueryPlan.cpp:531:21 (clickhouse+0x137e4e28)
    27 DB::QueryPlan::optimize() obj-x86_64-linux-gnu/../src/Processors/QueryPlan/QueryPlan.cpp:646:24 (clickhouse+0x137dd41f)
    28 DB::QueryPlan::buildQueryPipeline() obj-x86_64-linux-gnu/../src/Processors/QueryPlan/QueryPlan.cpp:144:5 (clickhouse+0x137dbe4f)
    29 DB::InterpreterSelectWithUnionQuery::execute() obj-x86_64-linux-gnu/../src/Interpreters/InterpreterSelectWithUnionQuery.cpp:412:32 (clickhouse+0x12b448f7)
    30 DB::executeQueryImpl(char const*, char const*, DB::Context&, bool, DB::QueryProcessingStage::Enum, bool, DB::ReadBuffer*) obj-x86_64-linux-gnu/../src/Interpreters/executeQuery.cpp:524:32 (clickhouse+0x12cf7c87)
    31 DB::executeQuery(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, DB::Context&, bool, DB::QueryProcessingStage::Enum, bool) obj-x86_64-linux-gnu/../src/Interpreters/executeQuery.cpp:878:30 (clickhouse+0x12cf65e8)
    32 DB::TCPHandler::runImpl() obj-x86_64-linux-gnu/../src/Server/TCPHandler.cpp:260:24 (clickhouse+0x1352e87e)
    33 DB::TCPHandler::run() obj-x86_64-linux-gnu/../src/Server/TCPHandler.cpp:1417:9 (clickhouse+0x1353b727)

SUMMARY: ThreadSanitizer: heap-use-after-free (/workspace/clickhouse+0x8b9920e) in bcmp
==================
2021.01.26 01:25:38.920074 [ 89 ] {} <Trace> BaseDaemon: Received signal -3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

pr-performance Pull request with some performance improvements

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants