Fix LOGICAL_ERROR exceptions from recursive convertToFullIfNeeded with LowCardinality inside compound types#97831
Merged
Algunenano merged 6 commits intoClickHouse:masterfrom Feb 25, 2026
Conversation
…ntaining `LowCardinality` Same bug as fixed for `concat` in ClickHouse#97654: `convertToFullIfNeeded` recursively strips `LowCardinality` from inside compound column types like `Variant`, but the argument type is not updated to match, so `SerializationLowCardinality` tries to cast a non-LC column, triggering a LOGICAL_ERROR exception in debug builds. Fix by using only top-level column conversions (Const, Sparse, LowCardinality) instead of the recursive `convertToFullIfNeeded`. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
Member
Author
|
The fuzzer detected yet another issue introduced in #97493 |
nihalzp
approved these changes
Feb 24, 2026
…ke `Tuple` `convertToFullIfNeeded` (made recursive in ClickHouse#97493) strips `LowCardinality` from inner subcolumns of compound types (Tuple, Array, etc.) in `Set::insertFromColumns`, but `set_elements_types` in `Set::setHeader` only stripped top-level `LowCardinality`. This created a column/type mismatch: `ColumnVector<Int8>` in the column vs `LowCardinality(Int8)` in the type. When `KeyCondition::tryPrepareSetColumnsForIndex` unpacked the tuple to build index conditions for `IN` subqueries, `castColumn` tried to interpret the plain column as `ColumnLowCardinality`, causing a LOGICAL_ERROR exception in debug builds. Fix by using `recursiveRemoveLowCardinality` for `set_elements_types` in both `Set::setHeader` and the static `Set::getElementTypes`, matching what `convertToFullIfNeeded` does to columns. https://s3.amazonaws.com/clickhouse-test-reports/json.html?PR=97831&sha=6f56284303c16ecc5f5a437491c661d5019f2977&name_0=PR&name_1=AST%20fuzzer%20%28amd_debug%29 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
azat
reviewed
Feb 24, 2026
…variant Regression test for ClickHouse#97847: `Dynamic` column with `LowCardinality` variant and `enable_join_runtime_filters` caused LOGICAL_ERROR "Bad cast from type DB::ColumnVector<int> to DB::ColumnLowCardinality" because `Set` stored columns with inner `LowCardinality` stripped but `set_elements_types` still contained it inside the `Dynamic` type. Already fixed by the previous commit. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…al corruption `convertToFullIfNeeded` recursively strips `LowCardinality` from subcolumns, including variant columns inside `ColumnDynamic`. But it cannot update `ColumnDynamic::variant_info` type metadata, creating a mismatch: variant columns have LC stripped from data while `variant_info` still references LC types. This caused LOGICAL_ERROR in `Set::appendSetElements` when `ColumnDynamic::insertRangeFrom` tried to serialize values using LC serialization against non-LC column data. Fix: override `convertToFullIfNeeded` in `ColumnDynamic` to return itself without recursing into subcolumns. Dynamic is a self-contained typed container that manages its own variant types. Also add `max_threads=1` to the test for issue ClickHouse#97847 to reliably trigger the runtime filter code path that exercises this bug. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…/type mismatches Same issue as `ColumnDynamic`: `convertToFullIfNeeded` recursively strips `LowCardinality` from `ColumnVariant`'s internal variant sub-columns, but cannot update the corresponding `DataTypeVariant` (which sorts variants by name). This creates column/type position mismatches that cause LOGICAL_ERROR in `KeyCondition::tryPrepareSetColumnsForIndex` when casting set elements for index conditions. Fix: override `convertToFullIfNeeded` in `ColumnVariant` to return itself without recursing into sub-columns, matching the approach for `ColumnDynamic`. Closes ClickHouse#97854 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
convertToFullIfNeeded with LowCardinality inside compound types
Merged
via the queue into
ClickHouse:master
with commit Feb 25, 2026
7ad028f
291 of 292 checks passed
This was referenced Feb 25, 2026
robot-ch-test-poll
added a commit
that referenced
this pull request
Feb 25, 2026
Cherry pick #97831 to 25.11: Fix LOGICAL_ERROR exceptions from recursive `convertToFullIfNeeded` with `LowCardinality` inside compound types
robot-clickhouse
added a commit
that referenced
this pull request
Feb 25, 2026
… `convertToFullIfNeeded` with `LowCardinality` inside compound types
This was referenced Feb 25, 2026
robot-ch-test-poll
added a commit
that referenced
this pull request
Feb 25, 2026
Cherry pick #97831 to 25.12: Fix LOGICAL_ERROR exceptions from recursive `convertToFullIfNeeded` with `LowCardinality` inside compound types
robot-clickhouse
added a commit
that referenced
this pull request
Feb 25, 2026
… `convertToFullIfNeeded` with `LowCardinality` inside compound types
This was referenced Feb 25, 2026
robot-ch-test-poll
added a commit
that referenced
this pull request
Feb 25, 2026
Cherry pick #97831 to 26.1: Fix LOGICAL_ERROR exceptions from recursive `convertToFullIfNeeded` with `LowCardinality` inside compound types
robot-clickhouse
added a commit
that referenced
this pull request
Feb 25, 2026
…`convertToFullIfNeeded` with `LowCardinality` inside compound types
This was referenced Feb 25, 2026
robot-ch-test-poll
added a commit
that referenced
this pull request
Feb 25, 2026
Cherry pick #97831 to 26.2: Fix LOGICAL_ERROR exceptions from recursive `convertToFullIfNeeded` with `LowCardinality` inside compound types
robot-clickhouse
added a commit
that referenced
this pull request
Feb 25, 2026
…`convertToFullIfNeeded` with `LowCardinality` inside compound types
clickhouse-gh bot
added a commit
that referenced
this pull request
Feb 25, 2026
Backport #97831 to 26.1: Fix LOGICAL_ERROR exceptions from recursive `convertToFullIfNeeded` with `LowCardinality` inside compound types
Algunenano
added a commit
that referenced
this pull request
Feb 26, 2026
Backport #97831 to 26.2: Fix LOGICAL_ERROR exceptions from recursive `convertToFullIfNeeded` with `LowCardinality` inside compound types
Algunenano
added a commit
that referenced
this pull request
Feb 27, 2026
…cursive `convertToFullIfNeeded` with `LowCardinality` inside compound types"
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #97654 which fixed the same bug only in
concatbut missed other callers.convertToFullIfNeeded(made recursive in #97493) stripsLowCardinalityfrom inside compound column types likeVariant,Dynamic, andTuple, but the corresponding types are not updated to match. This creates column/type mismatches that trigger LOGICAL_ERROR exceptions in debug/sanitizer builds.Fixes
1.
concatWithSeparatorandformatfunctions — same asconcatfix in #97654: use only top-level column conversions (Const, Sparse, LowCardinality) instead of the recursiveconvertToFullIfNeeded, since the type is not updated.CI report: https://s3.amazonaws.com/clickhouse-test-reports/json.html?PR=97431&sha=6fe0e8c44dd5c6a12583390b4f8fc45e226a3cb4&name_0=PR&name_1=Stateless%20tests%20%28arm_asan%2C%20azure%2C%20parallel%29
2.
Set(affectsINsubqueries withLowCardinalityinsideTuple) —Set::insertFromColumnscallsconvertToFullIfNeededwhich recursively strips LC from inner subcolumns, butSet::setHeaderonly stripped top-level LC fromset_elements_types. WhenKeyCondition::tryPrepareSetColumnsForIndexunpacked the tuple to build index conditions,castColumntried to interpret aColumnVector<Int8>asColumnLowCardinality, causing the exception.Fix: use
recursiveRemoveLowCardinalityforset_elements_typesin bothSet::setHeaderand the staticSet::getElementTypes, matching whatconvertToFullIfNeededdoes to columns.CI report: https://s3.amazonaws.com/clickhouse-test-reports/json.html?PR=97831&sha=6f56284303c16ecc5f5a437491c661d5019f2977&name_0=PR&name_1=AST%20fuzzer%20%28amd_debug%29
3.
ColumnDynamic— overrideconvertToFullIfNeededto skip recursion into variant sub-columns.ColumnDynamicmanages its ownvariant_infotype metadata; stripping LC from variant columns without updating this metadata causes column/type mismatches inSet::appendSetElements→ColumnDynamic::serializeValueIntoSharedVariant.4.
ColumnVariant— overrideconvertToFullIfNeededto skip recursion into variant sub-columns.DataTypeVariantsorts variants by name, so stripping LC from sub-columns (changing type names) creates position mismatches between the column data and the type. This caused LOGICAL_ERROR inKeyCondition::tryPrepareSetColumnsForIndexwhen casting set elements viaFunctionCast::createVariantToColumnWrapper.CI report: https://s3.amazonaws.com/clickhouse-test-reports/json.html?PR=96251&sha=e2eba2cbc9d1c15abe066a7a18da15abf93f68ca&name_0=PR&name_1=AST%20fuzzer%20%28amd_debug%29
All other
convertToFullIfNeededcall sites were audited — none have the same vulnerability (they either work with scalar types, don't use the type after conversion, or already handle LC stripping properly).Closes #97701
Closes #97847
Closes #97854
Changelog category (leave one):
Changelog entry (a user-readable short description of the changes that goes into CHANGELOG.md):
Fix LOGICAL_ERROR exceptions caused by
LowCardinalityinside compound types (Variant,Dynamic,Tuple) inconcatWithSeparator,format,INsubqueries,GLOBAL IN, and joins with runtime filters.Documentation entry for user-facing changes
🤖 Generated with Claude Code