Cap arrayResize size argument in functions stress test#104254
Conversation
The fuzzer can pick a large random integer as the second argument of `arrayResize` (anything below `MAX_ARRAY_SIZE = 1 << 30`), which makes the function spend many seconds filling the result. If a thread happens to start such a call near the end of the run, the unit test trips its 30s shutdown timeout and reports a stuck thread. Add `arrayResize` to `function_arg_constraints` so its size argument is capped, mirroring the existing caps on `randomStringUTF8` and `arrayWithConstant`. Report: https://s3.amazonaws.com/clickhouse-test-reports/json.html?PR=104136&sha=latest&name_0=PR&name_1=Unit+tests+%28asan_ubsan%2C+function_prop_fuzzer%29 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Ok. However, it will be a problem for general-purpose coverage-guided fuzzers, as well as for multi-tenant ClickHouse installations. The function should respect the timeout or make heavy calculations impossible. We should implement the fix in a separate PR. |
Makes sense. AFAICS we haven't hooked the function fuzzer to query limits (memory, timeout, query killed) so it's not detecting those problems, just functions taking too long. We should do it if not and treat them as failures too |
LLVM Coverage Report
Changed lines: N/A (no coverable changed lines) · Uncovered code |
robot-clickhouse-ci-1
added
the
pr-synced-to-cloud
3 participants
The fuzzer can pick a large random integer as the second argument of
arrayResize(anything belowMAX_ARRAY_SIZE = 1 << 30), which makes the function spend many seconds filling the result. If a thread happens to start such a call near the end of the run, the unit test trips its 30s shutdown timeout and reports a stuck thread.Add
arrayResizetofunction_arg_constraintsso its size argument is capped, mirroring the existing caps onrandomStringUTF8andarrayWithConstant.CI report: https://s3.amazonaws.com/clickhouse-test-reports/json.html?PR=104136&sha=latest&name_0=PR&name_1=Unit+tests+%28asan_ubsan%2C+function_prop_fuzzer%29
Changelog category (leave one):
Changelog entry (a user-readable short description of the changes that goes into CHANGELOG.md):
...
Documentation entry for user-facing changes
Version info
26.5.1.360