Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

index out of range [0] with length 0 in AppendMyDecimal, AppendPartialRow, AppendInt64, AppendFloat64, AppendUint64 #52980

Closed
GaranR opened this issue Apr 29, 2024 · 10 comments
Closed

index out of range [0] with length 0 in AppendMyDecimal, AppendPartialRow, AppendInt64, AppendFloat64, AppendUint64 #52980

GaranR opened this issue Apr 29, 2024 · 10 comments
Labels
affects-5.4 This bug affects 5.4.x versions. affects-6.1 affects-6.5 affects-7.1 affects-7.5 affects-8.1 severity/major sig/execution SIG execution type/bug The issue is confirmed as a bug.

Comments

@GaranR
Copy link

GaranR commented Apr 29, 2024

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. Minimal reproduce step (Required)

First execute the following valid.sql
valid.txt

Then a crash occurs when executing the error.sql below
error.txt

Additionally, here are some similar bugs, where AppendMyDecimal is replaced by AppendPartialRow, AppendInt64, AppendFloat64, AppendUint64 in the call stack. These can be reproduced with the following PoC.
Append_bugs.zip

2. What did you expect to see? (Required)

Expect no crashes

3. What did you see instead (Required)

runtime error: index out of range [0] with length 0

tidb.log:

[2024/04/17 11:57:27.233 +00:00] [ERROR] [shuffle.go:259] ["shuffle panicked"] [error="runtime error: index out of range [0] with length 0"] [stack="github.com/pingcap/tidb/pkg/executor.recoveryShuffleExec
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:259
github.com/pingcap/tidb/pkg/executor.(*shuffleWorker).run.func1
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:388
runtime.gopanic
	/usr/local/go/src/runtime/panic.go:914
runtime.goPanicIndex
	/usr/local/go/src/runtime/panic.go:114
github.com/pingcap/tidb/pkg/util/chunk.(*Column).AppendMyDecimal
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/util/chunk/column.go:36
github.com/pingcap/tidb/pkg/util/chunk.(*Chunk).AppendMyDecimal
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/util/chunk/chunk.go:538
github.com/pingcap/tidb/pkg/executor/aggfuncs.(*sum4Decimal).AppendFinalResult2Chunk
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/aggfuncs/func_sum.go:185
github.com/pingcap/tidb/pkg/executor.(*PipelinedWindowExec).produce
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/pipelined_window.go:404
github.com/pingcap/tidb/pkg/executor.(*PipelinedWindowExec).Next
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/pipelined_window.go:155
github.com/pingcap/tidb/pkg/executor/internal/exec.Next
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/internal/exec/executor.go:283
github.com/pingcap/tidb/pkg/executor.(*shuffleWorker).run
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:398"]
[2024/04/17 11:57:27.233 +00:00] [ERROR] [shuffle.go:259] ["shuffle panicked"] [error="runtime error: index out of range [0] with length 0"] [stack="github.com/pingcap/tidb/pkg/executor.recoveryShuffleExec
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:259
github.com/pingcap/tidb/pkg/executor.(*shuffleWorker).run.func1
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:388
runtime.gopanic
	/usr/local/go/src/runtime/panic.go:914
runtime.goPanicIndex
	/usr/local/go/src/runtime/panic.go:114
github.com/pingcap/tidb/pkg/util/chunk.(*Column).AppendMyDecimal
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/util/chunk/column.go:36
github.com/pingcap/tidb/pkg/util/chunk.(*Chunk).AppendMyDecimal
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/util/chunk/chunk.go:538
github.com/pingcap/tidb/pkg/executor/aggfuncs.(*sum4Decimal).AppendFinalResult2Chunk
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/aggfuncs/func_sum.go:185
github.com/pingcap/tidb/pkg/executor.(*PipelinedWindowExec).produce
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/pipelined_window.go:404
github.com/pingcap/tidb/pkg/executor.(*PipelinedWindowExec).Next
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/pipelined_window.go:155
github.com/pingcap/tidb/pkg/executor/internal/exec.Next
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/internal/exec/executor.go:283
github.com/pingcap/tidb/pkg/executor.(*shuffleWorker).run
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:398"]
[2024/04/17 11:57:27.233 +00:00] [ERROR] [shuffle.go:259] ["shuffle panicked"] [error="runtime error: index out of range [0] with length 0"] [stack="github.com/pingcap/tidb/pkg/executor.recoveryShuffleExec
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:259
github.com/pingcap/tidb/pkg/executor.(*shuffleWorker).run.func1
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:388
runtime.gopanic
	/usr/local/go/src/runtime/panic.go:914
runtime.goPanicIndex
	/usr/local/go/src/runtime/panic.go:114
github.com/pingcap/tidb/pkg/util/chunk.(*Column).AppendMyDecimal
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/util/chunk/column.go:36
github.com/pingcap/tidb/pkg/util/chunk.(*Chunk).AppendMyDecimal
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/util/chunk/chunk.go:538
github.com/pingcap/tidb/pkg/executor/aggfuncs.(*sum4Decimal).AppendFinalResult2Chunk
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/aggfuncs/func_sum.go:185
github.com/pingcap/tidb/pkg/executor.(*PipelinedWindowExec).produce
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/pipelined_window.go:404
github.com/pingcap/tidb/pkg/executor.(*PipelinedWindowExec).Next
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/pipelined_window.go:155
github.com/pingcap/tidb/pkg/executor/internal/exec.Next
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/internal/exec/executor.go:283
github.com/pingcap/tidb/pkg/executor.(*shuffleWorker).run
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:398"]
[2024/04/17 11:57:27.233 +00:00] [ERROR] [shuffle.go:259] ["shuffle panicked"] [error="runtime error: index out of range [0] with length 0"] [stack="github.com/pingcap/tidb/pkg/executor.recoveryShuffleExec
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:259
github.com/pingcap/tidb/pkg/executor.(*shuffleWorker).run.func1
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:388
runtime.gopanic
	/usr/local/go/src/runtime/panic.go:914
runtime.goPanicIndex
	/usr/local/go/src/runtime/panic.go:114
github.com/pingcap/tidb/pkg/util/chunk.(*Column).AppendMyDecimal
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/util/chunk/column.go:36
github.com/pingcap/tidb/pkg/util/chunk.(*Chunk).AppendMyDecimal
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/util/chunk/chunk.go:538
github.com/pingcap/tidb/pkg/executor/aggfuncs.(*sum4Decimal).AppendFinalResult2Chunk
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/aggfuncs/func_sum.go:185
github.com/pingcap/tidb/pkg/executor.(*PipelinedWindowExec).produce
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/pipelined_window.go:404
github.com/pingcap/tidb/pkg/executor.(*PipelinedWindowExec).Next
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/pipelined_window.go:155
github.com/pingcap/tidb/pkg/executor/internal/exec.Next
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/internal/exec/executor.go:283
github.com/pingcap/tidb/pkg/executor.(*shuffleWorker).run
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:398"]
[2024/04/17 11:57:27.233 +00:00] [ERROR] [shuffle.go:259] ["shuffle panicked"] [error="runtime error: index out of range [0] with length 0"] [stack="github.com/pingcap/tidb/pkg/executor.recoveryShuffleExec
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:259
github.com/pingcap/tidb/pkg/executor.(*shuffleWorker).run.func1
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:388
runtime.gopanic
	/usr/local/go/src/runtime/panic.go:914
runtime.goPanicIndex
	/usr/local/go/src/runtime/panic.go:114
github.com/pingcap/tidb/pkg/util/chunk.(*Column).AppendMyDecimal
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/util/chunk/column.go:36
github.com/pingcap/tidb/pkg/util/chunk.(*Chunk).AppendMyDecimal
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/util/chunk/chunk.go:538
github.com/pingcap/tidb/pkg/executor/aggfuncs.(*sum4Decimal).AppendFinalResult2Chunk
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/aggfuncs/func_sum.go:185
github.com/pingcap/tidb/pkg/executor.(*PipelinedWindowExec).produce
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/pipelined_window.go:404
github.com/pingcap/tidb/pkg/executor.(*PipelinedWindowExec).Next
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/pipelined_window.go:155
github.com/pingcap/tidb/pkg/executor/internal/exec.Next
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/internal/exec/executor.go:283
github.com/pingcap/tidb/pkg/executor.(*shuffleWorker).run
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:398"]
[2024/04/17 11:57:27.234 +00:00] [WARN] [session.go:2245] ["compile SQL failed"] [conn=408946074] [session_alias=] [error="runtime error: index out of range [0] with length 0"] [SQL="(check error.sql above)"]
[2024/04/17 11:57:27.234 +00:00] [INFO] [conn.go:1124] ["command dispatched failed"] [conn=408946074] [session_alias=] [connInfo="id:408946074, addr:10.0.2.1:49770 status:10, collation:utf8mb4_0900_ai_ci, user:root"] [command=Query] [status="inTxn:0, autocommit:1"] [sql="(check error.sql above)"] [txn_mode=PESSIMISTIC] [timestamp=449145745486905355] [err="runtime error: index out of range [0] with length 0
github.com/pingcap/tidb/pkg/executor.recoveryShuffleExec
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:258
github.com/pingcap/tidb/pkg/executor.(*shuffleWorker).run.func1
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:388
runtime.gopanic
	/usr/local/go/src/runtime/panic.go:914
runtime.goPanicIndex
	/usr/local/go/src/runtime/panic.go:114
github.com/pingcap/tidb/pkg/util/chunk.(*Column).AppendMyDecimal
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/util/chunk/column.go:36
github.com/pingcap/tidb/pkg/util/chunk.(*Chunk).AppendMyDecimal
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/util/chunk/chunk.go:538
github.com/pingcap/tidb/pkg/executor/aggfuncs.(*sum4Decimal).AppendFinalResult2Chunk
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/aggfuncs/func_sum.go:185
github.com/pingcap/tidb/pkg/executor.(*PipelinedWindowExec).produce
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/pipelined_window.go:404
github.com/pingcap/tidb/pkg/executor.(*PipelinedWindowExec).Next
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/pipelined_window.go:155
github.com/pingcap/tidb/pkg/executor/internal/exec.Next
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/internal/exec/executor.go:283
github.com/pingcap/tidb/pkg/executor.(*shuffleWorker).run
	/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/pkg/executor/shuffle.go:398
runtime.goexit
	/usr/local/go/src/runtime/asm_amd64.s:1650"]

4. What is your TiDB version? (Required)

+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| tidb_version()                                                                                                                                                                                                                                                 |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Release Version: v7.5.1
Edition: Community
Git Commit Hash: 7d16cc79e81bbf573124df3fd9351c26963f3e70
Git Branch: heads/refs/tags/v7.5.1
UTC Build Time: 2024-02-27 14:28:32
GoVersion: go1.21.6
Race Enabled: false
Check Table Before Drop: false
Store: tikv |
+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

We are the BASS team from the School of Cyber Science and Technology at Beihang University. Our main focus is on system software security, operating systems, and program analysis research, as well as the development of automated program testing frameworks for detecting software defects. Using our self-developed database vulnerability testing tool, we have identified the above-mentioned vulnerabilities in TiDB that may lead to database crashes.
@GaranR GaranR added the type/bug The issue is confirmed as a bug. label Apr 29, 2024
@yibin87
Copy link
Contributor

yibin87 commented May 6, 2024

/label affects-5.4

@ti-chi-bot ti-chi-bot bot added affects-5.4 This bug affects 5.4.x versions. and removed may-affects-5.4 This bug maybe affects 5.4.x versions. labels May 6, 2024
@yibin87
Copy link
Contributor

yibin87 commented May 6, 2024

/label affects-8.1

@yibin87
Copy link
Contributor

yibin87 commented May 6, 2024

/label affects-6.1

@yibin87
Copy link
Contributor

yibin87 commented May 6, 2024

/label affects-6.5

@yibin87
Copy link
Contributor

yibin87 commented May 6, 2024

/label affects-7.1

@yibin87
Copy link
Contributor

yibin87 commented May 6, 2024

/label affects-7.5

@yibin87
Copy link
Contributor

yibin87 commented May 6, 2024

Reproduced with tidb_version:
| Release Version: v8.2.0-alpha-6-g8f138d5113
Edition: Community
Git Commit Hash: 8f138d5
Git Branch: HEAD
UTC Build Time: 2024-04-22 08:00:01
GoVersion: go1.21.6
Race Enabled: false
Check Table Before Drop: false
Store: tikv |

@yibin87 yibin87 mentioned this issue May 6, 2024
Closed
@yibin87
Copy link
Contributor

yibin87 commented May 6, 2024

Duplicated with #52768 , close it.

@yibin87
Copy link
Contributor

yibin87 commented May 6, 2024

/close

@ti-chi-bot ti-chi-bot bot closed this as completed May 6, 2024
@ti-chi-bot ti-chi-bot
Copy link

ti-chi-bot bot commented May 6, 2024

@yibin87: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
affects-5.4 This bug affects 5.4.x versions. affects-6.1 affects-6.5 affects-7.1 affects-7.5 affects-8.1 severity/major sig/execution SIG execution type/bug The issue is confirmed as a bug.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@jebter @yibin87 @GaranR