Skip to content

SEGV in duckdb::EncodeStringDataPrefix #3350

@fuboat

Description

@fuboat

What happens?

SEGV in duckdb::EncodeStringDataPrefix(unsigned char*, duckdb::string_t, unsigned long) /root/duckdb/src/common/radix.cpp:162:2

To Reproduce

CREATE TABLE strings(b REAL, a INTEGER);
INSERT INTO strings VALUES
  (5, 10), (10, 20), (13, 26), (13, 26),
  (15, 30), (20, 40), (22,80), (30, 90);
CREATE TABLE id(c TEXT, strings_with_null INTEGER);
INSERT INTO id VALUES('c', NULL);
SELECT sum(a) OVER (
    PARTITION BY (
SELECT c FROM id WHERE strings_with_null=a
    ) ORDER BY a
  ) FROM strings;

Environment (please complete the following information):

  • OS: linux
  • DuckDB Version: v0.3.3-dev1395 80ae1e1
  • DuckDB Client: /usr/local/bin/duckdb

Before Submitting

  • Have you tried this on the latest master branch?
  • Python: pip install duckdb --upgrade --pre
  • R: install.packages("https://github.com/duckdb/duckdb/releases/download/master-builds/duckdb_r_src.tar.gz", repos = NULL)
  • Other Platforms: You can find binaries here or compile from source.
  • Have you tried the steps to reproduce? Do they include all relevant data and configuration? Does the issue you report still appear there?

ASAN detail

AddressSanitizer:DEADLYSIGNAL
=================================================================
==39778==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x000001ab00b2 bp 0x7fff4c997350 sp 0x7fff4c996b08 T0)
==39778==The signal is caused by a READ memory access.
==39778==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
    #0 0x1ab00b2 in __asan::QuickCheckForUnpoisonedRegion(unsigned long, unsigned long) (/root/bld_asan/duckdb+0x1ab00b2)
    #1 0x1aaff6a in __asan_memcpy (/root/bld_asan/duckdb+0x1aaff6a)
    #2 0x2a4349e in duckdb::EncodeStringDataPrefix(unsigned char*, duckdb::string_t, unsigned long) /root/duckdb/src/common/radix.cpp:162:2
    #3 0x56835b7 in duckdb::RadixScatterStringVector(duckdb::VectorData&, duckdb::SelectionVector const&, unsigned long, unsigned char**, bool, bool, bool, unsigned long, unsigned long) /root/duckdb/src/common/row_operations/row_radix_scatter.cpp:87:4
    #4 0x56877bc in duckdb::RowOperations::RadixScatter(duckdb::Vector&, unsigned long, duckdb::SelectionVector const&, unsigned long, unsigned char**, bool, bool, bool, unsigned long, unsigned long, unsigned long) /root/duckdb/src/common/row_operations/row_radix_scatter.cpp:269:3
    #5 0x57be86a in duckdb::LocalSortState::SinkChunk(duckdb::DataChunk&, duckdb::DataChunk&) /root/duckdb/src/common/sort/sort_state.cpp:165:3
    #6 0x5cbcd86 in duckdb::SortCollectionForPartition(duckdb::WindowOperatorState&, duckdb::BoundWindowExpression*, duckdb::ChunkCollection&, duckdb::ChunkCollection&, duckdb::ChunkCollection*, unsigned long, unsigned long) /root/duckdb/src/execution/operator/aggregate/physical_window.cpp:403:20
    #7 0x5cb68d4 in duckdb::GeneratePartition(duckdb::WindowOperatorState&, duckdb::WindowGlobalState&, unsigned long) /root/duckdb/src/execution/operator/aggregate/physical_window.cpp:1221:3
    #8 0x5cb5208 in duckdb::PhysicalWindow::GetData(duckdb::ExecutionContext&, duckdb::DataChunk&, duckdb::GlobalSourceState&, duckdb::LocalSourceState&) const /root/duckdb/src/execution/operator/aggregate/physical_window.cpp:1376:4
    #9 0x3826288 in duckdb::PipelineExecutor::FetchFromSource(duckdb::DataChunk&) /root/duckdb/src/parallel/pipeline_executor.cpp:316:19
    #10 0x3818efd in duckdb::PipelineExecutor::ExecutePull(duckdb::DataChunk&) /root/duckdb/src/parallel/pipeline_executor.cpp:194:5
    #11 0x3818538 in duckdb::Executor::FetchChunk() /root/duckdb/src/parallel/executor.cpp:729:18
    #12 0x3588278 in duckdb::ClientContext::FetchInternal(duckdb::ClientContextLock&, duckdb::Executor&, duckdb::BaseQueryResult&) /root/duckdb/src/main/client_context.cpp:96:25
    #13 0x3588038 in duckdb::ClientContext::Fetch(duckdb::ClientContextLock&, duckdb::StreamQueryResult&) /root/duckdb/src/main/client_context.cpp:88:9
    #14 0x35fe8a5 in duckdb::StreamQueryResult::FetchRaw() /root/duckdb/src/main/stream_query_result.cpp:47:20
    #15 0x35f44b1 in duckdb::QueryResult::Fetch() /root/duckdb/src/main/query_result.cpp:50:15
    #16 0x1c1023e in duckdb::QueryResult::TryFetch(std::unique_ptr<duckdb::DataChunk, std::default_delete<duckdb::DataChunk> >&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&) /root/duckdb/src/include/duckdb/main/query_result.hpp:85:13
    #17 0x1bf98f6 in sqlite3_step /root/duckdb/tools/sqlite3_api_wrapper/sqlite3_api_wrapper.cpp:229:23
    #18 0x1bd32da in exec_prepared_stmt_columnar /root/duckdb/tools/shell/shell.c:12710:8
    #19 0x1bd0f53 in exec_prepared_stmt /root/duckdb/tools/shell/shell.c:12886:5
    #20 0x1b396ab in shell_exec /root/duckdb/tools/shell/shell.c:13204:7
    #21 0x1bdc4ca in runOneSqlLine /root/duckdb/tools/shell/shell.c:19991:8
    #22 0x1b3c71d in process_input /root/duckdb/tools/shell/shell.c:20106:17
    #23 0x1b03651 in main /root/duckdb/tools/shell/shell.c:20908:12
    #24 0x7f387b7510b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
    #25 0x1a3597d in _start (/root/bld_asan/duckdb+0x1a3597d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/root/bld_asan/duckdb+0x1ab00b2) in __asan::QuickCheckForUnpoisonedRegion(unsigned long, unsigned long)
==39778==ABORTING

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions