[IMPALA-2319] Crash with nested loop join + limit

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: Impala 2.2
• Fix Version/s: Impala 2.3.0
• Target Version: Impala 2.3.0
• Assignee: Tim Armstrong
• Reporter: Tim Armstrong
• Created: 10/Sep/15 23:01
• Updated: 11/Sep/15 22:48
• Resolved: 11/Sep/15 22:48

Description

[tarmstrong-box.ca.cloudera.com:21000] > select * from functional.alltypes t1 cross join functional.alltypes t2 limit 1;
Query: select * from functional.alltypes t1 cross join functional.alltypes t2 limit 1
Error communicating with impalad: TSocket read 0 bytes

Tracing the cause back leads to RowBatch::set_num_rows() being called with a negative row count (I verified this with a DCHECK). This causes an overflow when resizing a vector.

I think the root cause is that eos_ is not always set in GetNext() when the limit is hit, so the below code is run on the next subsequent call to GetNext(), when output_batch is empty.

      output_batch->set_num_rows(
          output_batch->num_rows() - (num_rows_returned_ - limit_));

I saw some other cases where it didn't crash but returned too many rows, which is probably the same bug.