Uploaded image for project: 'Apache Arrow'
  1. Apache Arrow
  2. ARROW-13639

[C++] Concatenate with an empty dictionary segfaults (ASan failure in TestFilterKernelWithString/0.FilterDictionary)

    XMLWordPrintableJSON

Details

    Description

      [ RUN      ] TestFilterKernelWithString/0.FilterDictionary
      =================================================================
      ==31836==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f3788bac6c0 at pc 0x7f377c13382b bp 0x7ffe135dddb0 sp 0x7ffe135ddda8
      READ of size 4 at 0x7f3788bac6c0 thread T0
          #0 0x7f377c13382a in void arrow::internal::TransposeInts<signed char, signed char>(signed char const*, signed char*, long, int const*) /home/lidavidm/Code/upstream/merging/cpp/src/arrow/util/int_util.cc:434
          #1 0x7f377c1243f2 in Visit<arrow::Int8Type> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/util/int_util.cc:482
          #2 0x7f377c11a5f9 in VisitTypeInline<arrow::internal::(anonymous namespace)::TransposeIntsDest<signed char> > /home/lidavidm/Code/upstream/merging/cpp/src/arrow/visitor_inline.h:89
          #3 0x7f377c119b51 in operator() /home/lidavidm/Code/upstream/merging/cpp/src/arrow/util/int_util.cc:491
          #4 0x7f377c102ac9 in Visit<arrow::Int8Type> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/util/int_util.cc:508
          #5 0x7f377c0f7c88 in VisitTypeInline<arrow::internal::(anonymous namespace)::TransposeIntsSrc> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/visitor_inline.h:89
          #6 0x7f377c0f479d in operator() /home/lidavidm/Code/upstream/merging/cpp/src/arrow/util/int_util.cc:515
          #7 0x7f377c0f49f3 in arrow::internal::TransposeInts(arrow::DataType const&, arrow::DataType const&, unsigned char const*, unsigned char*, long, long, long, int const*) /home/lidavidm/Code/upstream/merging/cpp/src/arrow/util/int_util.cc:525
          #8 0x7f377b6e72fd in ConcatenateDictionaryIndices /home/lidavidm/Code/upstream/merging/cpp/src/arrow/array/concatenate.cc:289
          #9 0x7f377b6e85f0 in Visit /home/lidavidm/Code/upstream/merging/cpp/src/arrow/array/concatenate.cc:320
          #10 0x7f377b6ef4cf in VisitTypeInline<arrow::(anonymous namespace)::ConcatenateImpl> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/visitor_inline.h:89
          #11 0x7f377b6e11a2 in Concatenate /home/lidavidm/Code/upstream/merging/cpp/src/arrow/array/concatenate.cc:193
          #12 0x7f377b6ed681 in arrow::Concatenate(std::vector<std::shared_ptr<arrow::Array>, std::allocator<std::shared_ptr<arrow::Array> > > const&, arrow::MemoryPool*) /home/lidavidm/Code/upstream/merging/cpp/src/arrow/array/concatenate.cc:481
          #13 0x55adf99765b9 in arrow::compute::TestFilterKernel::AssertFilter(std::shared_ptr<arrow::Array> const&, std::shared_ptr<arrow::Array> const&, std::shared_ptr<arrow::Array> const&) /home/lidavidm/Code/upstream/merging/cpp/src/arrow/compute/kernels/vector_selection_test.cc:221
          #14 0x55adf9c12be2 in arrow::compute::TestFilterKernelWithString<arrow::BinaryType>::AssertFilterDictionary(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/lidavidm/Code/upstream/merging/cpp/src/arrow/compute/kernels/vector_selection_test.cc:517
          #15 0x55adf9bb251d in arrow::compute::TestFilterKernelWithString_FilterDictionary_Test<arrow::BinaryType>::TestBody() /home/lidavidm/Code/upstream/merging/cpp/src/arrow/compute/kernels/vector_selection_test.cc:531
          #16 0x7f378ac3698d in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) (/home/lidavidm/miniconda3/envs/arrow4/lib/libgtest.so+0x4c98d)
          #17 0x7f378ac36be0 in testing::Test::Run() (/home/lidavidm/miniconda3/envs/arrow4/lib/libgtest.so+0x4cbe0)
          #18 0x7f378ac36f0e in testing::TestInfo::Run() (/home/lidavidm/miniconda3/envs/arrow4/lib/libgtest.so+0x4cf0e)
          #19 0x7f378ac37035 in testing::TestSuite::Run() (/home/lidavidm/miniconda3/envs/arrow4/lib/libgtest.so+0x4d035)
          #20 0x7f378ac375eb in testing::internal::UnitTestImpl::RunAllTests() (/home/lidavidm/miniconda3/envs/arrow4/lib/libgtest.so+0x4d5eb)
          #21 0x7f378ac37858 in testing::UnitTest::Run() (/home/lidavidm/miniconda3/envs/arrow4/lib/libgtest.so+0x4d858)
          #22 0x7f378ac9707e in main (/home/lidavidm/miniconda3/envs/arrow4/lib/libgtest_main.so+0x107e)
          #23 0x7f377180cbf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
          #24 0x55adf9431658  (/home/lidavidm/Code/upstream/merging/build/debug/arrow-compute-vector-test+0xbaa658)0x7f3788bac6c1 is located 0 bytes to the right of global variable 'zero_size_area' defined in '/home/lidavidm/Code/upstream/merging/cpp/src/arrow/memory_pool.cc:188:36' (0x7f3788bac6c0) of size 1
        'zero_size_area' is ascii string ''
      SUMMARY: AddressSanitizer: global-buffer-overflow /home/lidavidm/Code/upstream/merging/cpp/src/arrow/util/int_util.cc:434 in void arrow::internal::TransposeInts<signed char, signed char>(signed char const*, signed char*, long, int const*)
      Shadow bytes around the buggy address:
        0x0fe77116d880: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9
        0x0fe77116d890: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9
        0x0fe77116d8a0: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
        0x0fe77116d8b0: 01 f9 f9 f9 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9
        0x0fe77116d8c0: 00 f9 f9 f9 f9 f9 f9 f9 02 f9 f9 f9 f9 f9 f9 f9
      =>0x0fe77116d8d0: 00 f9 f9 f9 f9 f9 f9 f9[01]f9 f9 f9 f9 f9 f9 f9
        0x0fe77116d8e0: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 00 00 00
        0x0fe77116d8f0: 01 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
        0x0fe77116d900: 00 00 00 00 00 00 00 00 00 00 00 00 01 f9 f9 f9
        0x0fe77116d910: f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9
        0x0fe77116d920: f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
        Shadow gap:              cc
      ==31836==ABORTING
      fish: Job 1, './debug/arrow-compute-vector-te…' terminated by signal SIGABRT (Abort) 

      Attachments

        Issue Links

          Activity

            People

              lidavidm David Li
              lidavidm David Li
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 50m
                  50m