yangzhg opened a new issue #2517: Analytic funtctions will cause intermediateTupleDesc not match URL: https://github.com/apache/incubator-doris/issues/2517 As the problem reported by isssue #2464, the real reason is that when the function of FunctionCallExpr cannot match exactly, it will find a function that can be casted or supertype. At the same time, it will add a cast expression to the children of FunctionCallExpr. When the plan node calls init or performs smap substitute The FunctionCallExpr will be re-analyzed. At this time, if this is a AnalyticFunction a problem will occur. The cast expr will be removed when an implicit cast is encountered during the replacement. At this time, the child type of the function is transformed. When the function is rematched, the return value may be different from the original function. As a result, the type of intermediateTupleDesc is different, and be is static_cast according to the type of intermediateTupleDesc and then assigned. Therefore, it may cause memory access out of bounds and generate a coredump. The core problem of the lag function is currently solved. The other functions may also have the same problem. This is a risk , for example in #2464 , `lag(date, 1, null)` the initial FunctionCallExpr children type is `[DATE, TINYINT, NULL_TYPE]` matched fn's argstype is `[INT, BIGINT, INT]`, the FunctionCallExpr children type will cast to `[cast(DATE AS INT),BIGINT, NULL_TYPE ]` (because `TINYINT 1` is a literal), the `intermediateTupleDesc` type is the fn's ret type `INT` when performs smap substitute or other ops cause re-analyze FunctionCallExpr's first child will remove cast expr (`if (isImplicitCast()) return getChild(0).substituteImpl(smap, analyzer);`) then the FunctionCallExpr children type will be`[DATE,BIGINT, NULL_TYPE ]` and matched fn's argstype is `[DATE, BIGINT, DATE]` therefor the real return type is `DATE`, `DATE` is 8 byte and `INT` is 4 byte , in be will cause memory access out of bounds
---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org With regards, Apache Git Services --------------------------------------------------------------------- To unsubscribe, e-mail: commits-unsubscr...@doris.apache.org For additional commands, e-mail: commits-h...@doris.apache.org
