Skip to content

ANY LEFT JOIN SEGV #90979

@PedroTadim

Description

@PedroTadim

Describe the bug

Seen here: https://s3.amazonaws.com/clickhouse-test-reports/json.html?REF=master&sha=0b666c77b32580b79ba8722067c9e2d05fe7b989&name_0=MasterCI&name_1=AST+fuzzer+%28amd_msan%29 This one happens since v25.9

How to reproduce

Run Fiddle: https://fiddle.clickhouse.com/b53a993c-f710-4f34-ab8f-be910f2e459c

Error message and/or stacktrace

Stack trace:

2025.11.27 14:01:50.777226 [ 29662 ] {} <Fatal> BaseDaemon: ########## Short fault info ############
2025.11.27 14:01:50.777281 [ 29662 ] {} <Fatal> BaseDaemon: (version 25.12.1.186 (official build), build id: AEE49331F76A6865F8744938E1E59CD293508E89, git hash: b90137d77c0f2fee8f97c15f555364ebf7e6defe, architecture: x86_64) (from thread 29664) Received signal 11
2025.11.27 14:01:50.777284 [ 29662 ] {} <Fatal> BaseDaemon: Signal description: Segmentation fault
2025.11.27 14:01:50.777290 [ 29662 ] {} <Fatal> BaseDaemon: Address: 0x5f99b61bf660. Access: write. Attempted access has violated the permissions assigned to the memory area.
2025.11.27 14:01:50.777342 [ 29662 ] {} <Fatal> BaseDaemon: Stack trace: 0x00005f99c2231aa4 0x00005f99c222dc80 0x00005f99c221398f 0x00005f99c22100b7 0x00005f99bfef4cca 0x00005f99cbd7cfba 0x00005f99cbd766b1 0x00005f99cbd77cd9 0x00005f99cbd78e82 0x00005f99cbd7891a 0x00005f99cd65a08c 0x00005f99cd658d1a 0x00005f99d2280eb1 0x00005f99d227e3d7 0x00005f99d221422a 0x00005f99d213438a 0x00005f99d2133cc0 0x00005f99ce291b25 0x00005f99ce29181c 0x00005f99ce5d426d 0x00005f99ce5ced92 0x00005f99d1adc92a 0x00005f99d1af75a4 0x00005f99d7f48607 0x00005f99d7f48be5 0x00005f99d7ee62bf 0x00005f99d7ee3a51 0x00007fd4f80a3d64 0x00007fd4f81373bc
2025.11.27 14:01:50.777353 [ 29662 ] {} <Fatal> BaseDaemon: ########################################
2025.11.27 14:01:50.777422 [ 29662 ] {} <Fatal> BaseDaemon: (version 25.12.1.186 (official build), build id: AEE49331F76A6865F8744938E1E59CD293508E89, git hash: b90137d77c0f2fee8f97c15f555364ebf7e6defe) (from thread 29664) (query_id: 06ef0377-1085-4e15-94e1-a3114f6aa38b) (query: SELECT 1 FROM (SELECT 1) tx JOIN (SELECT 1) ty ON TRUE ANY LEFT JOIN (SELECT 1 c0) tz ON TRUE WHERE tz.c0 = materialize(1);) Received signal Segmentation fault (11)
2025.11.27 14:01:50.777446 [ 29662 ] {} <Fatal> BaseDaemon: Address: 0x5f99b61bf660. Access: write. Attempted access has violated the permissions assigned to the memory area.
2025.11.27 14:01:50.777475 [ 29662 ] {} <Fatal> BaseDaemon: Stack trace: 0x00005f99c2231aa4 0x00005f99c222dc80 0x00005f99c221398f 0x00005f99c22100b7 0x00005f99bfef4cca 0x00005f99cbd7cfba 0x00005f99cbd766b1 0x00005f99cbd77cd9 0x00005f99cbd78e82 0x00005f99cbd7891a 0x00005f99cd65a08c 0x00005f99cd658d1a 0x00005f99d2280eb1 0x00005f99d227e3d7 0x00005f99d221422a 0x00005f99d213438a 0x00005f99d2133cc0 0x00005f99ce291b25 0x00005f99ce29181c 0x00005f99ce5d426d 0x00005f99ce5ced92 0x00005f99d1adc92a 0x00005f99d1af75a4 0x00005f99d7f48607 0x00005f99d7f48be5 0x00005f99d7ee62bf 0x00005f99d7ee3a51 0x00007fd4f80a3d64 0x00007fd4f81373bc
2025.11.27 14:01:50.900190 [ 29662 ] {} <Fatal> BaseDaemon: 3. src/Functions/FunctionsComparison.h:209: DB::NumComparisonImpl<char8_t, char8_t, DB::EqualsOp<char8_t, char8_t>>::vectorConstantImplAVX512BW(DB::PODArray<char8_t, 4096ul, Allocator<false, false>, 63ul, 64ul> const&, char8_t, DB::PODArray<char8_t, 4096ul, Allocator<false, false>, 63ul, 64ul>&) @ 0x000000000fcc4aa4
2025.11.27 14:01:50.962971 [ 29662 ] {} <Fatal> BaseDaemon: 4.0. inlined from src/Functions/FunctionsComparison.h:259: DB::NumComparisonImpl<char8_t, char8_t, DB::EqualsOp<char8_t, char8_t>>::constantVector(char8_t, DB::PODArray<char8_t, 4096ul, Allocator<false, false>, 63ul, 64ul> const&, DB::PODArray<char8_t, 4096ul, Allocator<false, false>, 63ul, 64ul>&)
2025.11.27 14:01:50.963008 [ 29662 ] {} <Fatal> BaseDaemon: 4. src/Functions/FunctionsComparison.h:718: COW<DB::IColumn>::immutable_ptr<DB::IColumn> DB::FunctionComparison<DB::EqualsOp, DB::NameEquals, false>::executeNumConstRightType<char8_t, char8_t>(DB::ColumnConst const*, DB::IColumn const*) const @ 0x000000000fcc0c80
2025.11.27 14:01:51.020179 [ 29662 ] {} <Fatal> BaseDaemon: 5. src/Functions/FunctionsComparison.h:761: COW<DB::IColumn>::immutable_ptr<DB::IColumn> DB::FunctionComparison<DB::EqualsOp, DB::NameEquals, false>::executeNumLeftType<char8_t>(DB::IColumn const*, DB::IColumn const*) const @ 0x000000000fca698f
2025.11.27 14:01:51.076906 [ 29662 ] {} <Fatal> BaseDaemon: 6. src/Functions/FunctionsComparison.h:1355: DB::FunctionComparison<DB::EqualsOp, DB::NameEquals, false>::executeImpl(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x000000000fca30b7
2025.11.27 14:01:51.088603 [ 29662 ] {} <Fatal> BaseDaemon: 7. src/Functions/IFunction.h:445: DB::IFunction::executeImplDryRun(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x000000000d987cca
2025.11.27 14:01:51.091354 [ 29662 ] {} <Fatal> BaseDaemon: 8. src/Functions/IFunctionAdaptors.cpp:16: DB::FunctionToExecutableFunctionAdaptor::executeDryRunImpl(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x000000001980ffba
2025.11.27 14:01:51.103059 [ 29662 ] {} <Fatal> BaseDaemon: 9. src/Functions/IFunction.cpp:351: DB::IExecutableFunction::executeWithoutLowCardinalityColumns(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x00000000198096b1
2025.11.27 14:01:51.115399 [ 29662 ] {} <Fatal> BaseDaemon: 10. src/Functions/IFunction.cpp:426: DB::IExecutableFunction::executeWithoutSparseColumns(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x000000001980acd9
2025.11.27 14:01:51.127956 [ 29662 ] {} <Fatal> BaseDaemon: 11. src/Functions/IFunction.cpp:565: DB::IExecutableFunction::executeWithoutReplicatedColumns(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x000000001980be82
2025.11.27 14:01:51.140334 [ 29662 ] {} <Fatal> BaseDaemon: 12. src/Functions/IFunction.cpp:474: DB::IExecutableFunction::execute(std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>> const&, std::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x000000001980b91a
2025.11.27 14:01:51.237728 [ 29662 ] {} <Fatal> BaseDaemon: 13. src/Interpreters/ActionsDAG.cpp:894: DB::executeActionForPartialResult(DB::ActionsDAG::Node const*, std::vector<DB::ColumnWithTypeAndName, std::allocator<DB::ColumnWithTypeAndName>>, unsigned long, bool) @ 0x000000001b0ed08c
2025.11.27 14:01:51.286983 [ 29662 ] {} <Fatal> BaseDaemon: 14. src/Interpreters/ActionsDAG.cpp:1102: DB::ActionsDAG::evaluatePartialResult(std::unordered_map<DB::ActionsDAG::Node const*, DB::ColumnWithTypeAndName, std::hash<DB::ActionsDAG::Node const*>, std::equal_to<DB::ActionsDAG::Node const*>, std::allocator<std::pair<DB::ActionsDAG::Node const* const, DB::ColumnWithTypeAndName>>>&, std::vector<DB::ActionsDAG::Node const*, std::allocator<DB::ActionsDAG::Node const*>> const&, unsigned long, DB::PartialEvaluationParameters) @ 0x000000001b0ebd1a
2025.11.27 14:01:51.297181 [ 29662 ] {} <Fatal> BaseDaemon: 15. src/Processors/QueryPlan/Optimizations/convertAnyJoinToSemiOrAntiJoin.cpp:29: DB::QueryPlanOptimizations::(anonymous namespace)::filterResultForMatchedRows(DB::ActionsDAG, DB::ActionsDAG const&, String const&) @ 0x000000001fd13eb1
2025.11.27 14:01:51.305988 [ 29662 ] {} <Fatal> BaseDaemon: 16. src/Processors/QueryPlan/Optimizations/convertAnyJoinToSemiOrAntiJoin.cpp:137: DB::QueryPlanOptimizations::tryConvertAnyJoinToSemiOrAntiJoin(DB::QueryPlan::Node*, std::list<DB::QueryPlan::Node, std::allocator<DB::QueryPlan::Node>>&, DB::QueryPlanOptimizations::Optimization::ExtraSettings const&) @ 0x000000001fd113d7
2025.11.27 14:01:51.316787 [ 29662 ] {} <Fatal> BaseDaemon: 17. src/Processors/QueryPlan/Optimizations/optimizeTree.cpp:122: DB::QueryPlanOptimizations::optimizeTreeFirstPass(DB::QueryPlanOptimizationSettings const&, DB::QueryPlan::Node&, std::list<DB::QueryPlan::Node, std::allocator<DB::QueryPlan::Node>>&) @ 0x000000001fca722a
2025.11.27 14:01:51.339683 [ 29662 ] {} <Fatal> BaseDaemon: 18. src/Processors/QueryPlan/QueryPlan.cpp:576: DB::QueryPlan::optimize(DB::QueryPlanOptimizationSettings const&) @ 0x000000001fbc738a
2025.11.27 14:01:51.357076 [ 29662 ] {} <Fatal> BaseDaemon: 19. src/Processors/QueryPlan/QueryPlan.cpp:180: DB::QueryPlan::buildQueryPipeline(DB::QueryPlanOptimizationSettings const&, DB::BuildQueryPipelineSettings const&, bool) @ 0x000000001fbc6cc0
2025.11.27 14:01:51.374310 [ 29662 ] {} <Fatal> BaseDaemon: 20. src/Interpreters/InterpreterSelectQueryAnalyzer.cpp:289: DB::InterpreterSelectQueryAnalyzer::buildQueryPipeline() @ 0x000000001bd24b25
2025.11.27 14:01:51.391145 [ 29662 ] {} <Fatal> BaseDaemon: 21. src/Interpreters/InterpreterSelectQueryAnalyzer.cpp:256: DB::InterpreterSelectQueryAnalyzer::execute() @ 0x000000001bd2481c
2025.11.27 14:01:51.431310 [ 29662 ] {} <Fatal> BaseDaemon: 22. src/Interpreters/executeQuery.cpp:1700: DB::executeQueryImpl(char const*, char const*, std::shared_ptr<DB::Context>, DB::QueryFlags, DB::QueryProcessingStage::Enum, std::unique_ptr<DB::ReadBuffer, std::default_delete<DB::ReadBuffer>>&, std::shared_ptr<DB::IAST>&, std::shared_ptr<DB::ImplicitTransactionControlExecutor>, std::function<void ()>, DB::QueryResultDetails&) @ 0x000000001c06726d
2025.11.27 14:01:51.479129 [ 29662 ] {} <Fatal> BaseDaemon: 23. src/Interpreters/executeQuery.cpp:1921: DB::executeQuery(String const&, std::shared_ptr<DB::Context>, DB::QueryFlags, DB::QueryProcessingStage::Enum) @ 0x000000001c061d92
2025.11.27 14:01:51.511040 [ 29662 ] {} <Fatal> BaseDaemon: 24. src/Server/TCPHandler.cpp:765: DB::TCPHandler::runImpl() @ 0x000000001f56f92a
2025.11.27 14:01:51.563285 [ 29662 ] {} <Fatal> BaseDaemon: 25. src/Server/TCPHandler.cpp:2861: DB::TCPHandler::run() @ 0x000000001f58a5a4
2025.11.27 14:01:51.566707 [ 29662 ] {} <Fatal> BaseDaemon: 26. base/poco/Net/src/TCPServerConnection.cpp:40: Poco::Net::TCPServerConnection::start() @ 0x00000000259db607
2025.11.27 14:01:51.570669 [ 29662 ] {} <Fatal> BaseDaemon: 27. base/poco/Net/src/TCPServerDispatcher.cpp:115: Poco::Net::TCPServerDispatcher::run() @ 0x00000000259dbbe5
2025.11.27 14:01:51.574568 [ 29662 ] {} <Fatal> BaseDaemon: 28. base/poco/Foundation/src/ThreadPool.cpp:205: Poco::PooledThread::run() @ 0x00000000259792bf
2025.11.27 14:01:51.578535 [ 29662 ] {} <Fatal> BaseDaemon: 29. base/poco/Foundation/src/Thread_POSIX.cpp:341: Poco::ThreadImpl::runnableEntry(void*) @ 0x0000000025976a51
2025.11.27 14:01:51.578577 [ 29662 ] {} <Fatal> BaseDaemon: 30. ? @ 0x00000000000a3d64
2025.11.27 14:01:51.578602 [ 29662 ] {} <Fatal> BaseDaemon: 31. __clone3 @ 0x00000000001373bc
2025.11.27 14:01:51.804843 [ 29662 ] {} <Fatal> BaseDaemon: Integrity check of the executable successfully passed (checksum: 1E8AAABBA99162D09582D0F917730480)
2025.11.27 14:01:51.804995 [ 29662 ] {} <Fatal> BaseDaemon: Report this error to https://github.com/ClickHouse/ClickHouse/issues
2025.11.27 14:01:51.805218 [ 29662 ] {} <Fatal> BaseDaemon: Changed settings: s3_truncate_on_insert = true, azure_truncate_on_insert = true, allow_suspicious_low_cardinality_types = true, allow_suspicious_fixed_string_types = true, allow_suspicious_indices = true, allow_suspicious_ttl_expressions = true, allow_suspicious_variant_types = true, allow_suspicious_primary_key = true, allow_suspicious_types_in_group_by = true, allow_suspicious_types_in_order_by = true, allow_not_comparable_types_in_order_by = true, allow_not_comparable_types_in_comparison_functions = true, enable_positional_arguments = true, allow_nonconst_timezone_arguments = true, enable_time_time64_type = true, allow_nondeterministic_optimize_skip_unused_shards = true, use_skip_indexes = true, use_skip_indexes_on_data_read = true, allow_distributed_ddl = true, allow_suspicious_codecs = true, enable_zstd_qat_codec = true, enable_deflate_qpl_codec = true, max_execution_time = 60., allow_custom_error_code_in_throwif = true, allow_ddl = true, allow_introspection_functions = true, allow_drop_detached = true, enable_lightweight_delete = true, allow_materialized_view_with_bad_select = true, allow_settings_after_format_in_insert = true, allow_nondeterministic_mutations = true, allow_non_metadata_alters = true, optimize_use_projections = true, optimize_use_projection_filtering = true, enable_lightweight_update = true, use_query_condition_cache = false, allow_experimental_kafka_offsets_storage_in_keeper = true, engine_file_truncate_on_insert = true, database_replicated_allow_replicated_engine_arguments = 1, allow_experimental_correlated_subqueries = true, query_plan_optimize_lazy_materialization = true, query_plan_max_limit_for_lazy_materialization = 0, keeper_max_retries = 15, enable_order_by_all = true, allow_named_collection_override_by_default = true, allow_experimental_delta_lake_writes = true, cluster_for_parallel_replicas = 'cluster0', parallel_replicas_for_non_replicated_merge_tree = true, parallel_replicas_for_cluster_engines = false, allow_experimental_database_iceberg = true, allow_experimental_database_unity_catalog = true, allow_experimental_database_glue_catalog = true, allow_experimental_analyzer = true, allow_experimental_materialized_postgresql_table = true, allow_experimental_funnel_functions = true, allow_experimental_nlp_functions = true, allow_experimental_hash_functions = true, allow_experimental_time_series_table = true, allow_experimental_codecs = true, allow_experimental_join_right_table_sorting = true, allow_experimental_statistics = true, allow_experimental_full_text_index = true, allow_experimental_database_materialized_postgresql = true, allow_experimental_qbit_type = true, allow_experimental_database_hms_catalog = true, allow_experimental_insert_into_iceberg = true, allow_experimental_iceberg_compaction = true, allow_experimental_bfloat16_type = true, allow_experimental_inverted_index = true, allow_experimental_vector_similarity_index = true, allow_experimental_join_condition = true, allow_experimental_variant_type = true, allow_experimental_dynamic_type = true, allow_experimental_json_type = true, allow_experimental_live_view = true, allow_experimental_shared_set_join = true, allow_experimental_object_type = true, type_json_skip_duplicated_paths = true, input_format_parquet_allow_geoparquet_parser = true

Metadata

Metadata

Assignees

Labels

bugConfirmed user-visible misbehaviour in official releasecomp-joinsJOINs end-to-end (planning hooks + runtime join operators/algorithms). Single bucket to avoid pla...crashCrash / segfault / abortfuzzProblem found by one of the fuzzers

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions