(0 vs. 0) Dictionary index must be less than base vector's size #3216
Assignees
Labels
Comments
|
Here is what happens: When the Next, |
kagamiori
added a commit
to kagamiori/velox
that referenced
this issue
Nov 17, 2022
Summary: Expression fuzzer found a bug in element_at() and subscript() functions when the input vector has a 0-length element vector and there are unselected rows of this evaluation: facebookincubator#3216. In this situation, SubscriptImpl builds up an `indices` where unselected rows point to 0 (i.e., default value) and use it to wrap the 0-length element vector via BaseVector::wrapInDictionary. DictionaryVector<T>::setInternalState() checks that the index pointed to by `indices` is less than the length of the vector being wrapped, which are both 0 in this case. Hence the error happens. This diff fixes this bug by directly creating a null vector when the input element vector has 0 length, instead of wrapping it in a dictionary. Differential Revision: D41357753 fbshipit-source-id: 1025c6c40058103e8bd21e00b3dcff93453cf3e5
kagamiori
added a commit
to kagamiori/velox
that referenced
this issue
Nov 21, 2022
…facebookincubator#3284) Summary: Pull Request resolved: facebookincubator#3284 Expression fuzzer found a bug in element_at() and subscript() functions when the input vector has a 0-length element vector and there are unselected rows of this evaluation: facebookincubator#3216. In this situation, SubscriptImpl builds up an `indices` where unselected rows point to 0 (i.e., default value) and use it to wrap the 0-length element vector via BaseVector::wrapInDictionary. DictionaryVector<T>::setInternalState() checks that the index pointed to by `indices` is less than the length of the vector being wrapped, which are both 0 in this case. Hence the error happens. This diff fixes this bug by directly creating a null vector when the input element vector has 0 length, instead of wrapping it in a dictionary. Differential Revision: D41357753 fbshipit-source-id: e7c8d11b0cf84d7b3a72ccc79ec4234908a6b2ce
kagamiori
added a commit
to kagamiori/velox
that referenced
this issue
Dec 2, 2022
…facebookincubator#3284) Summary: Pull Request resolved: facebookincubator#3284 Expression fuzzer found a bug in element_at() and subscript() functions when the input vector has a 0-length element vector and there are unselected rows of this evaluation: facebookincubator#3216. In this situation, SubscriptImpl builds up an `indices` where unselected rows point to 0 (i.e., default value) and use it to wrap the 0-length element vector via BaseVector::wrapInDictionary. DictionaryVector<T>::setInternalState() checks that the index pointed to by `indices` is less than the length of the vector being wrapped, which are both 0 in this case. Hence the error happens. This diff fixes this bug by directly creating a null vector when the input element vector has 0 length, instead of wrapping it in a dictionary. Reviewed By: bikramSingh91 Differential Revision: D41357753 fbshipit-source-id: aa84b67dfbcace5a12e97fc61163e92ec7f21663
facebook-github-bot
pushed a commit
that referenced
this issue
Dec 2, 2022
…#3284) Summary: Pull Request resolved: #3284 Expression fuzzer found a bug in element_at() and subscript() functions when the input vector has a 0-length element vector and there are unselected rows of this evaluation: #3216. In this situation, SubscriptImpl builds up an `indices` where unselected rows point to 0 (i.e., default value) and use it to wrap the 0-length element vector via BaseVector::wrapInDictionary. DictionaryVector<T>::setInternalState() checks that the index pointed to by `indices` is less than the length of the vector being wrapped, which are both 0 in this case. Hence the error happens. This diff fixes this bug by directly creating a null vector when the input element vector has 0 length, instead of wrapping it in a dictionary. Reviewed By: bikramSingh91 Differential Revision: D41357753 fbshipit-source-id: 71d217f73733cb12914879b27b0b61ead7c8bf34
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This bug can be reproduced by the following command:
velox/expression/tests/velox_expression_fuzzer_test --velox_fuzzer_enable_complex_types --velox_fuzzer_max_level_of_nesting 3 --only "array_min,reverse,slice,array_constructor,map_concat,map,pow,round,power,subscript,codepoint,quarter" --seed 2575563250.The text was updated successfully, but these errors were encountered: