Skip to content

executeQueryImpl_aborted #100320

Open
#100376
Open
executeQueryImpl_aborted#100320
#100376
Labels
fuzzProblem found by one of the fuzzers
@AnotherYx

Description

@AnotherYx
AnotherYx
opened on Mar 22, 2026

Describe the bug

This bug causes ClickHouse server to abort in a debug build.
Affect Version:
Release v24.12.2.29-stable
git hash: e067436
Build Command:
CC=clang-18 CXX=clang++-18 cmake -S . -B build -DCHECK_LARGE_OBJECT_SIZES=0 -DCMAKE_BUILD_TYPE=Debug

Release v26.2.5.45-stable
git hash: 9ca62f3
Build Command:
CC=clang-21 CXX=clang++-21 cmake -S . -B build -DCHECK_LARGE_OBJECT_SIZES=0 -DCMAKE_BUILD_TYPE=Debug

How to reproduce

for Release v24.12.2.29-stable:

KILL MUTATION WHERE INTERVAL t0 . * . 1 HOUR TEST;

for Release v26.2.5.45-stable:

CREATE TABLE t0 (v1 Nullable(Enum8('C' = 1, 'A' = 2, 'E' = 3, 'D' = 4)), v2 Decimal(18,4), v3 String) ENGINE = Log;
SELECT t0.* FROM t0 GROUP BY CUBE (v1, v2, v3) WITH ROLLUP;

Error message and/or stacktrace

for Release v24.12.2.29-stable:

[b3ea05351c88] 2026.03.22 07:28:48.205211 [ 716767 ] {b28afaa5-c9a2-40b8-af16-85fa98c88eed} : Logical error: 'Inconsistent AST formatting: the query:
KILL MUTATION WHERE toIntervalHour(t0.*.1) TEST
cannot parse query back from KILL MUTATION WHERE INTERVAL t0 . * . 1 HOUR TEST;'.
[b3ea05351c88] 2026.03.22 07:28:48.222505 [ 716767 ] {b28afaa5-c9a2-40b8-af16-85fa98c88eed} : Stack trace (when copying this message, always include the lines below):

  1. /home/fuzzer/ClickHouse/contrib/llvm-project/libcxx/include/exception:141: Poco::Exception::Exception(String const&, int) @ 0x0000000016ab20f2
  2. /home/fuzzer/ClickHouse/src/Common/Exception.cpp:105: DB::Exception::Exception(DB::Exception::MessageMasked&&, int, bool) @ 0x000000000c998199
  3. /home/fuzzer/ClickHouse/src/Common/Exception.h:105: DB::Exception::Exception(PreformattedMessage&&, int) @ 0x000000000719252c
  4. /home/fuzzer/ClickHouse/src/Common/Exception.h:123: DB::Exception::Exception<String&, std::basic_string_view<char, std::char_traits>>(int, FormatStringHelperImpl<std::type_identity<String&>::type, std::type_identity<std::basic_string_view<char, std::char_traits>>::type>, String&, std::basic_string_view<char, std::char_traits>&&) @ 0x00000000127d726b
  5. /home/fuzzer/ClickHouse/src/Interpreters/executeQuery.cpp:910: DB::executeQueryImpl(char const*, char const*, std::shared_ptrDB::Context, DB::QueryFlags, DB::QueryProcessingStage::Enum, DB::ReadBuffer*) @ 0x00000000127d143d
  6. /home/fuzzer/ClickHouse/src/Interpreters/executeQuery.cpp:1535: DB::executeQuery(String const&, std::shared_ptrDB::Context, DB::QueryFlags, DB::QueryProcessingStage::Enum) @ 0x00000000127ca201
  7. /home/fuzzer/ClickHouse/src/Server/TCPHandler.cpp:656: DB::TCPHandler::runImpl() @ 0x0000000013f3a8a6
  8. /home/fuzzer/ClickHouse/src/Server/TCPHandler.cpp:2603: DB::TCPHandler::run() @ 0x0000000013f517f9
  9. /home/fuzzer/ClickHouse/base/poco/Net/src/TCPServerConnection.cpp:40: Poco::Net::TCPServerConnection::start() @ 0x0000000016b57807
  10. /home/fuzzer/ClickHouse/base/poco/Net/src/TCPServerDispatcher.cpp:115: Poco::Net::TCPServerDispatcher::run() @ 0x0000000016b57cde
  11. /home/fuzzer/ClickHouse/base/poco/Foundation/src/ThreadPool.cpp:205: Poco::PooledThread::run() @ 0x0000000016b04192
  12. /home/fuzzer/ClickHouse/base/poco/Foundation/src/Thread_POSIX.cpp:335: Poco::ThreadImpl::runnableEntry(void*) @ 0x0000000016b01ea3
  13. ? @ 0x00007ffff7f9b609
  14. ? @ 0x00007ffff7ec0353

[b3ea05351c88] 2026.03.22 07:28:48.223319 [ 717463 ] BaseDaemon: ########################################
[b3ea05351c88] 2026.03.22 07:28:48.223408 [ 717463 ] BaseDaemon: (version 24.12.2.1, build id: 60C09187FA5378AE17C5610B5842E0433D3A7D19, git hash: e067436) (from thread 716767) (query_id: b28afaa5-c9a2-40b8-af16-85fa98c88eed) (query: ) Received signal Aborted (6)
[b3ea05351c88] 2026.03.22 07:28:48.223437 [ 717463 ] BaseDaemon:
[b3ea05351c88] 2026.03.22 07:28:48.223460 [ 717463 ] BaseDaemon: Stack trace: 0x000000000c9c9488 0x000000000cc5b084 0x00007ffff7fa7420 0x00007ffff7de400c 0x00007ffff7dc3859 0x000000000c997ad9 0x000000000c998349 0x000000000719252c 0x00000000127d726b 0x00000000127d143d 0x00000000127ca201 0x0000000013f3a8a6 0x0000000013f517f9 0x0000000016b57807 0x0000000016b57cde 0x0000000016b04192 0x0000000016b01ea3 0x00007ffff7f9b609 0x00007ffff7ec0353
[b3ea05351c88] 2026.03.22 07:28:48.238660 [ 717463 ] BaseDaemon: 0.0. inlined from /home/fuzzer/ClickHouse/src/Common/StackTrace.cpp:381: StackTrace::tryCapture()
[b3ea05351c88] 2026.03.22 07:28:48.238692 [ 717463 ] BaseDaemon: 0. /home/fuzzer/ClickHouse/src/Common/StackTrace.cpp:350: StackTrace::StackTrace(ucontext_t const&) @ 0x000000000c9c9488
[b3ea05351c88] 2026.03.22 07:28:48.255524 [ 717463 ] BaseDaemon: 1. /home/fuzzer/ClickHouse/src/Common/SignalHandlers.cpp:102: signalHandler(int, siginfo_t*, void*) @ 0x000000000cc5b084
[b3ea05351c88] 2026.03.22 07:28:48.255555 [ 717463 ] BaseDaemon: 2. ? @ 0x00007ffff7fa7420
[b3ea05351c88] 2026.03.22 07:28:48.255581 [ 717463 ] BaseDaemon: 3. ? @ 0x00007ffff7de400c
[b3ea05351c88] 2026.03.22 07:28:48.255608 [ 717463 ] BaseDaemon: 4. ? @ 0x00007ffff7dc3859
[b3ea05351c88] 2026.03.22 07:28:48.283156 [ 717463 ] BaseDaemon: 5. /home/fuzzer/ClickHouse/src/Common/Exception.cpp:48: DB::abortOnFailedAssertion(String const&, void* const*, unsigned long, unsigned long) @ 0x000000000c997ad9
[b3ea05351c88] 2026.03.22 07:28:48.309653 [ 717463 ] BaseDaemon: 6.0. inlined from /home/fuzzer/ClickHouse/src/Common/Exception.cpp:70: DB::handle_error_code(String const&, int, bool, std::vector<void*, std::allocator<void*>> const&)
[b3ea05351c88] 2026.03.22 07:28:48.309692 [ 717463 ] BaseDaemon: 6. /home/fuzzer/ClickHouse/src/Common/Exception.cpp:111: DB::Exception::Exception(DB::Exception::MessageMasked&&, int, bool) @ 0x000000000c998349
[b3ea05351c88] 2026.03.22 07:28:48.322890 [ 717463 ] BaseDaemon: 7.0. inlined from /home/fuzzer/ClickHouse/src/Common/Exception.h:105: Exception
[b3ea05351c88] 2026.03.22 07:28:48.322907 [ 717463 ] BaseDaemon: 7. /home/fuzzer/ClickHouse/src/Common/Exception.h:58: DB::Exception::Exception(PreformattedMessage&&, int) @ 0x000000000719252c
[b3ea05351c88] 2026.03.22 07:28:48.388845 [ 717463 ] BaseDaemon: 8. /home/fuzzer/ClickHouse/src/Common/Exception.h:123: DB::Exception::Exception<String&, std::basic_string_view<char, std::char_traits>>(int, FormatStringHelperImpl<std::type_identity<String&>::type, std::type_identity<std::basic_string_view<char, std::char_traits>>::type>, String&, std::basic_string_view<char, std::char_traits>&&) @ 0x00000000127d726b
[b3ea05351c88] 2026.03.22 07:28:48.448133 [ 717463 ] BaseDaemon: 9. /home/fuzzer/ClickHouse/src/Interpreters/executeQuery.cpp:910: DB::executeQueryImpl(char const*, char const*, std::shared_ptrDB::Context, DB::QueryFlags, DB::QueryProcessingStage::Enum, DB::ReadBuffer*) @ 0x00000000127d143d
[b3ea05351c88] 2026.03.22 07:28:48.515599 [ 717463 ] BaseDaemon: 10. /home/fuzzer/ClickHouse/src/Interpreters/executeQuery.cpp:1535: DB::executeQuery(String const&, std::shared_ptrDB::Context, DB::QueryFlags, DB::QueryProcessingStage::Enum) @ 0x00000000127ca201
[b3ea05351c88] 2026.03.22 07:28:48.559416 [ 717463 ] BaseDaemon: 11. /home/fuzzer/ClickHouse/src/Server/TCPHandler.cpp:656: DB::TCPHandler::runImpl() @ 0x0000000013f3a8a6
[b3ea05351c88] 2026.03.22 07:28:48.627926 [ 717463 ] BaseDaemon: 12. /home/fuzzer/ClickHouse/src/Server/TCPHandler.cpp:2603: DB::TCPHandler::run() @ 0x0000000013f517f9
[b3ea05351c88] 2026.03.22 07:28:48.630402 [ 717463 ] BaseDaemon: 13. /home/fuzzer/ClickHouse/base/poco/Net/src/TCPServerConnection.cpp:40: Poco::Net::TCPServerConnection::start() @ 0x0000000016b57807
[b3ea05351c88] 2026.03.22 07:28:48.634238 [ 717463 ] BaseDaemon: 14. /home/fuzzer/ClickHouse/base/poco/Net/src/TCPServerDispatcher.cpp:115: Poco::Net::TCPServerDispatcher::run() @ 0x0000000016b57cde
[b3ea05351c88] 2026.03.22 07:28:48.638454 [ 717463 ] BaseDaemon: 15. /home/fuzzer/ClickHouse/base/poco/Foundation/src/ThreadPool.cpp:205: Poco::PooledThread::run() @ 0x0000000016b04192
[b3ea05351c88] 2026.03.22 07:28:48.642524 [ 717463 ] BaseDaemon: 16. /home/fuzzer/ClickHouse/base/poco/Foundation/src/Thread_POSIX.cpp:335: Poco::ThreadImpl::runnableEntry(void*) @ 0x0000000016b01ea3
[b3ea05351c88] 2026.03.22 07:28:48.642543 [ 717463 ] BaseDaemon: 17. ? @ 0x00007ffff7f9b609
[b3ea05351c88] 2026.03.22 07:28:48.642555 [ 717463 ] BaseDaemon: 18. ? @ 0x00007ffff7ec0353
[b3ea05351c88] 2026.03.22 07:28:48.642580 [ 717463 ] BaseDaemon: Integrity check of the executable skipped because the reference checksum could not be read.
[b3ea05351c88] 2026.03.22 07:28:48.642625 [ 717463 ] BaseDaemon: This ClickHouse version is not official and should be upgraded to the official build.
[b3ea05351c88] 2026.03.22 07:28:48.642769 [ 717463 ] BaseDaemon: No settings were changed
Error on processing query: Code: 32. DB::Exception: Attempt to read after eof: while receiving packet from localhost:9000. (ATTEMPT_TO_READ_AFTER_EOF) (version 24.12.2.1)
(query: KILL MUTATION WHERE INTERVAL t0 . * . 1 HOUR TEST;)

for Release v26.2.5.45-stable:

[2758b991c019] 2026.03.22 07:27:18.057910 [ 975330 ] {c7444ab8-d677-4b18-9c1c-9cf50144d1af} : Logical error: 'Inconsistent AST formatting: the query:
SELECT t0.* FROM t0 GROUP BY v1, v2, v3 WITH ROLLUP WITH CUBE
cannot parse query back from SELECT t0.* FROM t0 GROUP BY CUBE (v1, v2, v3) WITH ROLLUP;'.
[2758b991c019] 2026.03.22 07:27:18.057981 [ 975330 ] {c7444ab8-d677-4b18-9c1c-9cf50144d1af} : Format string: 'Inconsistent AST formatting: the query:
{}
cannot parse query back from {}'.
[2758b991c019] 2026.03.22 07:27:18.079543 [ 975330 ] {c7444ab8-d677-4b18-9c1c-9cf50144d1af} : Stack trace (when copying this message, always include the lines below):

  1. /home/fuzzer/ClickHouse/contrib/llvm-project/libcxx/include/__exception/exception.h:113:14: Poco::Exception::Exception(String const&, int) @ 0x00000000261ef172
  2. /home/fuzzer/ClickHouse/src/Common/Exception.cpp:139:7: DB::Exception::Exception(DB::Exception::MessageMasked&&, int, bool) @ 0x000000001606ec29
  3. /home/fuzzer/ClickHouse/src/Common/Exception.h:171:100: DB::Exception::Exception(String&&, int, String, bool) @ 0x000000000da28754
  4. /home/fuzzer/ClickHouse/src/Common/Exception.h:57:54: DB::Exception::Exception(PreformattedMessage&&, int) @ 0x000000000da28251
  5. /home/fuzzer/ClickHouse/src/Common/Exception.h:189:77: DB::Exception::Exception<String&, std::basic_string_view<char, std::char_traits>&>(int, FormatStringHelperImpl<std::type_identity<String&>::type, std::type_identity<std::basic_string_view<char, std::char_traits>&>::type>, String&, std::basic_string_view<char, std::char_traits>&) @ 0x000000001c4ff346
  6. /home/fuzzer/ClickHouse/src/Interpreters/executeQuery.cpp:1220:31: DB::executeQueryImpl(char const*, char const*, std::shared_ptrDB::Context, DB::QueryFlags, DB::QueryProcessingStage::Enum, std::unique_ptr<DB::ReadBuffer, std::default_deleteDB::ReadBuffer>&, boost::intrusive_ptrDB::IAST&, std::shared_ptrDB::ImplicitTransactionControlExecutor, std::function<void ()>, DB::QueryResultDetails&) @ 0x000000001c4f3844
  7. /home/fuzzer/ClickHouse/src/Interpreters/executeQuery.cpp:2076:11: DB::executeQuery(String const&, std::shared_ptrDB::Context, DB::QueryFlags, DB::QueryProcessingStage::Enum) @ 0x000000001c4e98e3
  8. /home/fuzzer/ClickHouse/src/Server/TCPHandler.cpp:788:68: DB::TCPHandler::runImpl() @ 0x000000001fc34db8
  9. /home/fuzzer/ClickHouse/src/Server/TCPHandler.cpp:2912:9: DB::TCPHandler::run() @ 0x000000001fc50aa4
  10. /home/fuzzer/ClickHouse/base/poco/Net/src/TCPServerConnection.cpp:40:3: Poco::Net::TCPServerConnection::start() @ 0x00000000262a5a4e
  11. /home/fuzzer/ClickHouse/base/poco/Net/src/TCPServerDispatcher.cpp:115:42: Poco::Net::TCPServerDispatcher::run() @ 0x00000000262a6092
  12. /home/fuzzer/ClickHouse/base/poco/Foundation/src/ThreadPool.cpp:205:14: Poco::PooledThread::run() @ 0x0000000026245d3f
  13. /home/fuzzer/ClickHouse/base/poco/Foundation/src/Thread_POSIX.cpp:341:27: Poco::ThreadImpl::runnableEntry(void*) @ 0x00000000262433cf
  14. start_thread @ 0x0000000000094ac3
  15. __clone @ 0x0000000000125a84

[2758b991c019] 2026.03.22 07:27:18.079823 [ 975329 ] BaseDaemon: ########################################
[2758b991c019] 2026.03.22 07:27:18.079888 [ 975329 ] BaseDaemon: (version 26.2.5.1, build id: 628C4A8B0452171166DA1B1C4BB1B1F99854A01A, git hash: 9ca62f3) (from thread 975330) (query_id: c7444ab8-d677-4b18-9c1c-9cf50144d1af) (query: ) Received signal Aborted (6)
[2758b991c019] 2026.03.22 07:27:18.079917 [ 975329 ] BaseDaemon: Sent by tkill.
[2758b991c019] 2026.03.22 07:27:18.079940 [ 975329 ] BaseDaemon: Stack trace: 0x00007ffff7e149fd 0x00007ffff7dc0476 0x00007ffff7da67f3 0x000055556b5c16fc 0x000055556b5c2acd 0x000055556b5c2db9 0x0000555562f7c754 0x0000555562f7c251 0x0000555571a53346 0x0000555571a47844 0x0000555571a3d8e3 0x0000555575188db8 0x00005555751a4aa4 0x000055557b7f9a4e 0x000055557b7fa092 0x000055557b799d3f 0x000055557b7973cf 0x00007ffff7e12ac3 0x00007ffff7ea3a84
[2758b991c019] 2026.03.22 07:27:18.080014 [ 975329 ] BaseDaemon: 3. pthread_kill @ 0x00000000000969fd
[2758b991c019] 2026.03.22 07:27:18.080047 [ 975329 ] BaseDaemon: 4. raise @ 0x0000000000042476
[2758b991c019] 2026.03.22 07:27:18.080073 [ 975329 ] BaseDaemon: 5. __lgamma_r_finite @ 0x00000000000287f3
[2758b991c019] 2026.03.22 07:27:18.095655 [ 975329 ] BaseDaemon: 6. /home/fuzzer/ClickHouse/src/Common/Exception.cpp:60:5: DB::abortOnFailedAssertion(String const&, std::basic_string_view<char, std::char_traits>, void* const*, unsigned long, unsigned long) @ 0x000000001606d6fc
[2758b991c019] 2026.03.22 07:27:18.110009 [ 975329 ] BaseDaemon: 7. /home/fuzzer/ClickHouse/src/Common/Exception.cpp:93:13: DB::handle_error_code(String const&, std::basic_string_view<char, std::char_traits>, int, bool, std::vector<void*, std::allocator<void*>> const&) @ 0x000000001606eacd
[2758b991c019] 2026.03.22 07:27:18.125694 [ 975329 ] BaseDaemon: 8. /home/fuzzer/ClickHouse/src/Common/Exception.cpp:146:19: DB::Exception::Exception(DB::Exception::MessageMasked&&, int, bool) @ 0x000000001606edb9
[2758b991c019] 2026.03.22 07:27:18.142000 [ 975329 ] BaseDaemon: 9. /home/fuzzer/ClickHouse/src/Common/Exception.h:171:100: DB::Exception::Exception(String&&, int, String, bool) @ 0x000000000da28754
[2758b991c019] 2026.03.22 07:27:18.157241 [ 975329 ] BaseDaemon: 10. /home/fuzzer/ClickHouse/src/Common/Exception.h:57:54: DB::Exception::Exception(PreformattedMessage&&, int) @ 0x000000000da28251
[2758b991c019] 2026.03.22 07:27:18.226533 [ 975329 ] BaseDaemon: 11. /home/fuzzer/ClickHouse/src/Common/Exception.h:189:77: DB::Exception::Exception<String&, std::basic_string_view<char, std::char_traits>&>(int, FormatStringHelperImpl<std::type_identity<String&>::type, std::type_identity<std::basic_string_view<char, std::char_traits>&>::type>, String&, std::basic_string_view<char, std::char_traits>&) @ 0x000000001c4ff346
[2758b991c019] 2026.03.22 07:27:18.282897 [ 975329 ] BaseDaemon: 12. /home/fuzzer/ClickHouse/src/Interpreters/executeQuery.cpp:1220:31: DB::executeQueryImpl(char const*, char const*, std::shared_ptrDB::Context, DB::QueryFlags, DB::QueryProcessingStage::Enum, std::unique_ptr<DB::ReadBuffer, std::default_deleteDB::ReadBuffer>&, boost::intrusive_ptrDB::IAST&, std::shared_ptrDB::ImplicitTransactionControlExecutor, std::function<void ()>, DB::QueryResultDetails&) @ 0x000000001c4f3844
[2758b991c019] 2026.03.22 07:27:18.341837 [ 975329 ] BaseDaemon: 13. /home/fuzzer/ClickHouse/src/Interpreters/executeQuery.cpp:2076:11: DB::executeQuery(String const&, std::shared_ptrDB::Context, DB::QueryFlags, DB::QueryProcessingStage::Enum) @ 0x000000001c4e98e3
[2758b991c019] 2026.03.22 07:27:18.385516 [ 975329 ] BaseDaemon: 14. /home/fuzzer/ClickHouse/src/Server/TCPHandler.cpp:788:68: DB::TCPHandler::runImpl() @ 0x000000001fc34db8
[2758b991c019] 2026.03.22 07:27:18.453671 [ 975329 ] BaseDaemon: 15. /home/fuzzer/ClickHouse/src/Server/TCPHandler.cpp:2912:9: DB::TCPHandler::run() @ 0x000000001fc50aa4
[2758b991c019] 2026.03.22 07:27:18.457095 [ 975329 ] BaseDaemon: 16. /home/fuzzer/ClickHouse/base/poco/Net/src/TCPServerConnection.cpp:40:3: Poco::Net::TCPServerConnection::start() @ 0x00000000262a5a4e
[2758b991c019] 2026.03.22 07:27:18.461920 [ 975329 ] BaseDaemon: 17. /home/fuzzer/ClickHouse/base/poco/Net/src/TCPServerDispatcher.cpp:115:42: Poco::Net::TCPServerDispatcher::run() @ 0x00000000262a6092
[2758b991c019] 2026.03.22 07:27:18.466987 [ 975329 ] BaseDaemon: 18. /home/fuzzer/ClickHouse/base/poco/Foundation/src/ThreadPool.cpp:205:14: Poco::PooledThread::run() @ 0x0000000026245d3f
[2758b991c019] 2026.03.22 07:27:18.472169 [ 975329 ] BaseDaemon: 19. /home/fuzzer/ClickHouse/base/poco/Foundation/src/Thread_POSIX.cpp:341:27: Poco::ThreadImpl::runnableEntry(void*) @ 0x00000000262433cf
[2758b991c019] 2026.03.22 07:27:18.472211 [ 975329 ] BaseDaemon: 20. start_thread @ 0x0000000000094ac3
[2758b991c019] 2026.03.22 07:27:18.472232 [ 975329 ] BaseDaemon: 21. __clone @ 0x0000000000125a84
[2758b991c019] 2026.03.22 07:27:18.472256 [ 975329 ] BaseDaemon: Integrity check of the executable skipped because the reference checksum could not be read.
[2758b991c019] 2026.03.22 07:27:18.472365 [ 975329 ] BaseDaemon: No settings were changed
Error on processing query: Code: 32. DB::Exception: Attempt to read after eof: while receiving packet from localhost:9000, 127.0.0.1, local address: 127.0.0.1:49678. (ATTEMPT_TO_READ_AFTER_EOF) (version 26.2.5.1)
(query: SELECT t0.* FROM t0 GROUP BY CUBE (v1, v2, v3) WITH ROLLUP;)

Metadata

Metadata

Assignees

No one assigned

    Labels

    fuzzProblem found by one of the fuzzers

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions