[
https://issues.apache.org/jira/browse/ARROW-13639?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Antoine Pitrou resolved ARROW-13639.
------------------------------------
Resolution: Fixed
Issue resolved by pull request 10946
[https://github.com/apache/arrow/pull/10946]
> [C++] Concatenate with an empty dictionary segfaults (ASan failure in
> TestFilterKernelWithString/0.FilterDictionary)
> --------------------------------------------------------------------------------------------------------------------
>
> Key: ARROW-13639
> URL: https://issues.apache.org/jira/browse/ARROW-13639
> Project: Apache Arrow
> Issue Type: Bug
> Components: C++
> Reporter: David Li
> Assignee: David Li
> Priority: Major
> Labels: pull-request-available
> Fix For: 6.0.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> {noformat}
> [ RUN ] TestFilterKernelWithString/0.FilterDictionary
> =================================================================
> ==31836==ERROR: AddressSanitizer: global-buffer-overflow on address
> 0x7f3788bac6c0 at pc 0x7f377c13382b bp 0x7ffe135dddb0 sp 0x7ffe135ddda8
> READ of size 4 at 0x7f3788bac6c0 thread T0
> #0 0x7f377c13382a in void arrow::internal::TransposeInts<signed char,
> signed char>(signed char const*, signed char*, long, int const*)
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/util/int_util.cc:434
> #1 0x7f377c1243f2 in Visit<arrow::Int8Type>
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/util/int_util.cc:482
> #2 0x7f377c11a5f9 in VisitTypeInline<arrow::internal::(anonymous
> namespace)::TransposeIntsDest<signed char> >
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/visitor_inline.h:89
> #3 0x7f377c119b51 in operator()
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/util/int_util.cc:491
> #4 0x7f377c102ac9 in Visit<arrow::Int8Type>
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/util/int_util.cc:508
> #5 0x7f377c0f7c88 in VisitTypeInline<arrow::internal::(anonymous
> namespace)::TransposeIntsSrc>
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/visitor_inline.h:89
> #6 0x7f377c0f479d in operator()
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/util/int_util.cc:515
> #7 0x7f377c0f49f3 in arrow::internal::TransposeInts(arrow::DataType
> const&, arrow::DataType const&, unsigned char const*, unsigned char*, long,
> long, long, int const*)
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/util/int_util.cc:525
> #8 0x7f377b6e72fd in ConcatenateDictionaryIndices
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/array/concatenate.cc:289
> #9 0x7f377b6e85f0 in Visit
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/array/concatenate.cc:320
> #10 0x7f377b6ef4cf in VisitTypeInline<arrow::(anonymous
> namespace)::ConcatenateImpl>
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/visitor_inline.h:89
> #11 0x7f377b6e11a2 in Concatenate
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/array/concatenate.cc:193
> #12 0x7f377b6ed681 in
> arrow::Concatenate(std::vector<std::shared_ptr<arrow::Array>,
> std::allocator<std::shared_ptr<arrow::Array> > > const&, arrow::MemoryPool*)
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/array/concatenate.cc:481
> #13 0x55adf99765b9 in
> arrow::compute::TestFilterKernel::AssertFilter(std::shared_ptr<arrow::Array>
> const&, std::shared_ptr<arrow::Array> const&, std::shared_ptr<arrow::Array>
> const&)
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/compute/kernels/vector_selection_test.cc:221
> #14 0x55adf9c12be2 in
> arrow::compute::TestFilterKernelWithString<arrow::BinaryType>::AssertFilterDictionary(std::__cxx11::basic_string<char,
> std::char_traits<char>, std::allocator<char> > const&,
> std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>
> > const&, std::__cxx11::basic_string<char, std::char_traits<char>,
> std::allocator<char> > const&, std::__cxx11::basic_string<char,
> std::char_traits<char>, std::allocator<char> > const&)
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/compute/kernels/vector_selection_test.cc:517
> #15 0x55adf9bb251d in
> arrow::compute::TestFilterKernelWithString_FilterDictionary_Test<arrow::BinaryType>::TestBody()
>
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/compute/kernels/vector_selection_test.cc:531
> #16 0x7f378ac3698d in void
> testing::internal::HandleExceptionsInMethodIfSupported<testing::Test,
> void>(testing::Test*, void (testing::Test::*)(), char const*)
> (/home/lidavidm/miniconda3/envs/arrow4/lib/libgtest.so+0x4c98d)
> #17 0x7f378ac36be0 in testing::Test::Run()
> (/home/lidavidm/miniconda3/envs/arrow4/lib/libgtest.so+0x4cbe0)
> #18 0x7f378ac36f0e in testing::TestInfo::Run()
> (/home/lidavidm/miniconda3/envs/arrow4/lib/libgtest.so+0x4cf0e)
> #19 0x7f378ac37035 in testing::TestSuite::Run()
> (/home/lidavidm/miniconda3/envs/arrow4/lib/libgtest.so+0x4d035)
> #20 0x7f378ac375eb in testing::internal::UnitTestImpl::RunAllTests()
> (/home/lidavidm/miniconda3/envs/arrow4/lib/libgtest.so+0x4d5eb)
> #21 0x7f378ac37858 in testing::UnitTest::Run()
> (/home/lidavidm/miniconda3/envs/arrow4/lib/libgtest.so+0x4d858)
> #22 0x7f378ac9707e in main
> (/home/lidavidm/miniconda3/envs/arrow4/lib/libgtest_main.so+0x107e)
> #23 0x7f377180cbf6 in __libc_start_main
> (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
> #24 0x55adf9431658
> (/home/lidavidm/Code/upstream/merging/build/debug/arrow-compute-vector-test+0xbaa658)0x7f3788bac6c1
> is located 0 bytes to the right of global variable 'zero_size_area' defined
> in '/home/lidavidm/Code/upstream/merging/cpp/src/arrow/memory_pool.cc:188:36'
> (0x7f3788bac6c0) of size 1
> 'zero_size_area' is ascii string ''
> SUMMARY: AddressSanitizer: global-buffer-overflow
> /home/lidavidm/Code/upstream/merging/cpp/src/arrow/util/int_util.cc:434 in
> void arrow::internal::TransposeInts<signed char, signed char>(signed char
> const*, signed char*, long, int const*)
> Shadow bytes around the buggy address:
> 0x0fe77116d880: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9
> 0x0fe77116d890: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9
> 0x0fe77116d8a0: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
> 0x0fe77116d8b0: 01 f9 f9 f9 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9
> 0x0fe77116d8c0: 00 f9 f9 f9 f9 f9 f9 f9 02 f9 f9 f9 f9 f9 f9 f9
> =>0x0fe77116d8d0: 00 f9 f9 f9 f9 f9 f9 f9[01]f9 f9 f9 f9 f9 f9 f9
> 0x0fe77116d8e0: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 00 00 00
> 0x0fe77116d8f0: 01 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
> 0x0fe77116d900: 00 00 00 00 00 00 00 00 00 00 00 00 01 f9 f9 f9
> 0x0fe77116d910: f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9
> 0x0fe77116d920: f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9
> Shadow byte legend (one shadow byte represents 8 application bytes):
> Addressable: 00
> Partially addressable: 01 02 03 04 05 06 07
> Heap left redzone: fa
> Freed heap region: fd
> Stack left redzone: f1
> Stack mid redzone: f2
> Stack right redzone: f3
> Stack after return: f5
> Stack use after scope: f8
> Global redzone: f9
> Global init order: f6
> Poisoned by user: f7
> Container overflow: fc
> Array cookie: ac
> Intra object redzone: bb
> ASan internal: fe
> Left alloca redzone: ca
> Right alloca redzone: cb
> Shadow gap: cc
> ==31836==ABORTING
> fish: Job 1, './debug/arrow-compute-vector-te…' terminated by signal SIGABRT
> (Abort) {noformat}
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
