Skip to content

UBSan: substringUTF8: negation of -9223372036854775808 cannot be represented in type 'DB::Int64' #19287

@akuzm

Description

@akuzm
SELECT substringUTF8('hello, п�иве�', -9223372036854775808, number) FROM numbers(16)

../src/Functions/GatherUtils/Algorithms.h:386:47: runtime error: negation of -9223372036854775808 cannot be represented in type 'DB::Int64' (aka 'long'); cast to an unsigned type to negate this value to itself
    #0 0x1602f0ab in void DB::GatherUtils::sliceDynamicOffsetBounded<DB::GatherUtils::ConstSource<DB::GatherUtils::UTF8StringSource>&, DB::GatherUtils::StringSink>(DB::GatherUtils::ConstSource<DB::GatherUtils::UTF8StringSource>&, DB::GatherUtils::StringSink&&, DB::IColumn const&, DB::IColumn const&) (/workspace/clickhouse+0x1602f0ab)
    #1 0x16022971 in DB::(anonymous namespace)::FunctionSubstring<true>::executeImpl(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x16022971)
    #2 0x117d2796 in DB::DefaultExecutable::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const (/workspace/clickhouse+0x117d2796)
    #3 0x121a99cb in DB::ExecutableFunctionAdaptor::executeWithoutLowCardinalityColumns(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x121a99cb)
    #4 0x121aa8ed in DB::ExecutableFunctionAdaptor::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const (/workspace/clickhouse+0x121aa8ed)
    #5 0x1987b6d3 in DB::executeAction(DB::ExpressionActions::Action const&, DB::(anonymous namespace)::ExecutionContext&, bool) obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:333:56
    #6 0x1987acbf in DB::ExpressionActions::execute(DB::Block&, unsigned long&, bool) const obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:449:13
    #7 0x1ae1782d in DB::ExpressionTransform::transform(DB::Chunk&) obj-x86_64-linux-gnu/../src/Processors/Transforms/ExpressionTransform.cpp:25:17
    #8 0x1a4d01d1 in DB::ISimpleTransform::transform(DB::Chunk&, DB::Chunk&) obj-x86_64-linux-gnu/../src/Processors/ISimpleTransform.h:42:9
    #9 0x1ac0095f in DB::ISimpleTransform::work() obj-x86_64-linux-gnu/../src/Processors/ISimpleTransform.cpp:89:9
    #10 0x1ac50298 in DB::executeJob(DB::IProcessor*) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:79:20
    #11 0x1ac50186 in DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0::operator()() const obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:96:13
    #12 0x1ac50186 in decltype(std::__1::forward<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(fp)()) std::__1::__invoke<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
    #13 0x1ac4eb93 in std::__1::__function::__policy_func<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2221:16
    #14 0x1ac4eb93 in std::__1::function<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560:12
    #15 0x1ac4eb93 in DB::PipelineExecutor::executeStepImpl(unsigned long, unsigned long, std::__1::atomic<bool>*) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:580:17
    #16 0x1ac4d469 in DB::PipelineExecutor::executeSingleThread(unsigned long, unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:473:5
    #17 0x1ac4d469 in DB::PipelineExecutor::executeImpl(unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:807:9
    #18 0x1ac4cf2a in DB::PipelineExecutor::execute(unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:395:9
    #19 0x1ac5f91b in DB::threadFunction(DB::PullingAsyncPipelineExecutor::Data&, std::__1::shared_ptr<DB::ThreadGroupStatus>, unsigned long) obj-x86_64-linux-gnu/../src/Processors/Executors/PullingAsyncPipelineExecutor.cpp:79:24
    #20 0x1ac5f876 in DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0::operator()() const obj-x86_64-linux-gnu/../src/Processors/Executors/PullingAsyncPipelineExecutor.cpp:101:13
    #21 0x1ac5f876 in decltype(std::__1::forward<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&>(fp)()) std::__1::__invoke_constexpr<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3682:1
    #22 0x1ac5f731 in decltype(auto) std::__1::__apply_tuple_impl<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&, std::__1::__tuple_indices<>) obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:1415:1
    #23 0x1ac5f731 in decltype(auto) std::__1::apply<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&) obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:1424:1
    #24 0x1ac5f731 in ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&)::'lambda'()::operator()() obj-x86_64-linux-gnu/../src/Common/ThreadPool.h:178:13
    #25 0x1ac5f731 in decltype(std::__1::forward<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(fp)()) std::__1::__invoke<ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&)::'lambda'()&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
    #26 0xe01223e in std::__1::function<void ()>::operator()() const obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560:12
    #27 0xe01223e in ThreadPoolImpl<std::__1::thread>::worker(std::__1::__list_iterator<std::__1::thread, void*>) obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:247:17
    #28 0xe015f05 in void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()::operator()() const obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:124:73
    #29 0xe015f05 in decltype(std::__1::forward<void>(fp)(std::__1::forward<void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>(fp0)...)) std::__1::__invoke<void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>(void&&, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()&&...) obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676:1
    #30 0xe015f05 in void std::__1::__thread_execute<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>(std::__1::tuple<void, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()>&, std::__1::__tuple_indices<>) obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:280:5
    #31 0xe015f05 in void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()> >(void*) obj-x86_64-linux-gnu/../contrib/libcxx/include/thread:291:5
    #32 0x7f115b667608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477:8
    #33 0x7f115b58e292 in clone /build/glibc-ZN95T4/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../src/Functions/GatherUtils/Algorithms.h:386:47 in 
2021.01.19 01:40:05.367140 [ 62 ] {} <Trace> BaseDaemon: Received signal -3
2021.01.19 01:40:05.367495 [ 180 ] {} <Fatal> BaseDaemon: ########################################
2021.01.19 01:40:05.367615 [ 180 ] {} <Fatal> BaseDaemon: (version 21.1.1.5720, build id: D54409F4BB1DB2D93AA57EB485B96BDD416700B4) (from thread 167) (query_id: 1dd2de98-f1b6-43bd-be29-374c9bf3f354) Received signal Unknown signal (-3)
2021.01.19 01:40:05.367658 [ 180 ] {} <Fatal> BaseDaemon: Sanitizer trap.
2021.01.19 01:40:05.367738 [ 180 ] {} <Fatal> BaseDaemon: Stack trace: 0xdfe6135 0xe20fc96 0xdfaa156 0xdfb67ff 0x1602f0ac 0x16022972 0x117d2797 0x121a99cc 0x121aa8ee 0x1987b6d4 0x1987acc0 0x1ae1782e 0x1a4d01d2 0x1ac00960 0x1ac50299 0x1ac50187 0x1ac4eb94 0x1ac4d46a 0x1ac4cf2b 0x1ac5f91c 0x1ac5f877 0x1ac5f732 0xe01223f 0xe015f06 0x7f115b667609 0x7f115b58e293
2021.01.19 01:40:05.367901 [ 180 ] {} <Fatal> BaseDaemon: 0. ./obj-x86_64-linux-gnu/../src/Common/StackTrace.cpp:293: StackTrace::StackTrace() @ 0xdfe6135 in /workspace/clickhouse
2021.01.19 01:40:05.368248 [ 180 ] {} <Fatal> BaseDaemon: 1. ./obj-x86_64-linux-gnu/../base/daemon/BaseDaemon.cpp:380: sanitizerDeathCallback() @ 0xe20fc96 in /workspace/clickhouse
2021.01.19 01:40:05.372940 [ 180 ] {} <Fatal> BaseDaemon: 2. __sanitizer::Die() @ 0xdfaa156 in /workspace/clickhouse
2021.01.19 01:40:05.377341 [ 180 ] {} <Fatal> BaseDaemon: 3. ? @ 0xdfb67ff in /workspace/clickhouse
2021.01.19 01:40:05.381653 [ 180 ] {} <Fatal> BaseDaemon: 4. void DB::GatherUtils::sliceDynamicOffsetBounded<DB::GatherUtils::ConstSource<DB::GatherUtils::UTF8StringSource>&, DB::GatherUtils::StringSink>(DB::GatherUtils::ConstSource<DB::GatherUtils::UTF8StringSource>&, DB::GatherUtils::StringSink&&, DB::IColumn const&, DB::IColumn const&) @ 0x1602f0ac in /workspace/clickhouse
2021.01.19 01:40:05.385990 [ 180 ] {} <Fatal> BaseDaemon: 5. DB::(anonymous namespace)::FunctionSubstring<true>::executeImpl(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x16022972 in /workspace/clickhouse
2021.01.19 01:40:05.390392 [ 180 ] {} <Fatal> BaseDaemon: 6. DB::DefaultExecutable::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x117d2797 in /workspace/clickhouse
2021.01.19 01:40:05.394730 [ 180 ] {} <Fatal> BaseDaemon: 7. DB::ExecutableFunctionAdaptor::executeWithoutLowCardinalityColumns(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x121a99cc in /workspace/clickhouse
2021.01.19 01:40:05.399093 [ 180 ] {} <Fatal> BaseDaemon: 8. DB::ExecutableFunctionAdaptor::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x121aa8ee in /workspace/clickhouse
2021.01.19 01:40:05.401223 [ 180 ] {} <Fatal> BaseDaemon: 9. ./obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:0: DB::executeAction(DB::ExpressionActions::Action const&, DB::(anonymous namespace)::ExecutionContext&, bool) @ 0x1987b6d4 in /workspace/clickhouse
2021.01.19 01:40:05.403320 [ 180 ] {} <Fatal> BaseDaemon: 10. ./obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:0: DB::ExpressionActions::execute(DB::Block&, unsigned long&, bool) const @ 0x1987acc0 in /workspace/clickhouse
2021.01.19 01:40:05.406530 [ 180 ] {} <Fatal> BaseDaemon: 11. ./obj-x86_64-linux-gnu/../src/Processors/Transforms/ExpressionTransform.cpp:0: DB::ExpressionTransform::transform(DB::Chunk&) @ 0x1ae1782e in /workspace/clickhouse
2021.01.19 01:40:05.410404 [ 180 ] {} <Fatal> BaseDaemon: 12. ./obj-x86_64-linux-gnu/../src/Processors/ISimpleTransform.h:43: DB::ISimpleTransform::transform(DB::Chunk&, DB::Chunk&) @ 0x1a4d01d2 in /workspace/clickhouse
2021.01.19 01:40:05.413481 [ 180 ] {} <Fatal> BaseDaemon: 13. ./obj-x86_64-linux-gnu/../src/Processors/ISimpleTransform.cpp:99: DB::ISimpleTransform::work() @ 0x1ac00960 in /workspace/clickhouse
2021.01.19 01:40:05.416661 [ 180 ] {} <Fatal> BaseDaemon: 14. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:87: DB::executeJob(DB::IProcessor*) @ 0x1ac50299 in /workspace/clickhouse
2021.01.19 01:40:05.419907 [ 180 ] {} <Fatal> BaseDaemon: 15. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:99: decltype(std::__1::forward<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(fp)()) std::__1::__invoke<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&) @ 0x1ac50187 in /workspace/clickhouse
2021.01.19 01:40:05.423121 [ 180 ] {} <Fatal> BaseDaemon: 16. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:0: DB::PipelineExecutor::executeStepImpl(unsigned long, unsigned long, std::__1::atomic<bool>*) @ 0x1ac4eb94 in /workspace/clickhouse
2021.01.19 01:40:05.426306 [ 180 ] {} <Fatal> BaseDaemon: 17. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:0: DB::PipelineExecutor::executeImpl(unsigned long) @ 0x1ac4d46a in /workspace/clickhouse
2021.01.19 01:40:05.429456 [ 180 ] {} <Fatal> BaseDaemon: 18. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:398: DB::PipelineExecutor::execute(unsigned long) @ 0x1ac4cf2b in /workspace/clickhouse
2021.01.19 01:40:05.432593 [ 180 ] {} <Fatal> BaseDaemon: 19. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PullingAsyncPipelineExecutor.cpp:74: DB::threadFunction(DB::PullingAsyncPipelineExecutor::Data&, std::__1::shared_ptr<DB::ThreadGroupStatus>, unsigned long) @ 0x1ac5f91c in /workspace/clickhouse
2021.01.19 01:40:05.435785 [ 180 ] {} <Fatal> BaseDaemon: 20. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3682: decltype(std::__1::forward<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&>(fp)()) std::__1::__invoke_constexpr<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&) @ 0x1ac5f877 in /workspace/clickhouse
2021.01.19 01:40:05.438912 [ 180 ] {} <Fatal> BaseDaemon: 21. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:0: decltype(std::__1::forward<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(fp)()) std::__1::__invoke<ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&)::'lambda'()&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&) @ 0x1ac5f732 in /workspace/clickhouse
2021.01.19 01:40:05.439030 [ 180 ] {} <Fatal> BaseDaemon: 22. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2533: ThreadPoolImpl<std::__1::thread>::worker(std::__1::__list_iterator<std::__1::thread, void*>) @ 0xe01223f in /workspace/clickhouse
2021.01.19 01:40:05.439259 [ 180 ] {} <Fatal> BaseDaemon: 23. ./obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:0: void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda1'()> >(void*) @ 0xe015f06 in /workspace/clickhouse
2021.01.19 01:40:05.439324 [ 180 ] {} <Fatal> BaseDaemon: 24. start_thread @ 0x9609 in /usr/lib/x86_64-linux-gnu/libpthread-2.31.so
2021.01.19 01:40:05.439388 [ 180 ] {} <Fatal> BaseDaemon: 25. __clone @ 0x122293 in /usr/lib/x86_64-linux-gnu/libc-2.31.so

Metadata

Metadata

Labels

fuzzProblem found by one of the fuzzersminorPriority: minor

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions