Workflow [PR], commit [c02a6b4]

Summary: ⏳

AI Review

Summary

This PR rejects query-parameter identifiers in ParserFunctionName before getFunctionLayer, so {f:Identifier}(...) and the reported parameterized COLUMNS fuzzer case become syntax errors instead of producing an empty-name ASTFunction that trips the debug Inconsistent AST formatting check. I did not find any changed-line issues that need inline review comments.

Missing context / blind spots

• ⚠️ I could not run 04319_query_parameter_as_function_name locally because this checkout has no build* directory or clickhouse binary. The Praktika PR report currently has no test results for this SHA, so a normal stateless CI run would close this gap.

Final Verdict

Status: ✅ Approve

LLVM Coverage Report

Changed lines: Changed C/C++ lines covered by tests: 11/11 (100.00%) | Lost baseline coverage: none · Uncovered code

Full report · Diff report

@groeneai Investigate the test failure and provide a fix.

@nikitamikhaylov investigated. The AST fuzzer hit on arm_asan_ubsan is a pre-existing chronic trunk bug, not caused by this PR.

Failure: Logical error: 'Bad cast from type DB::ColumnNothing to DB::ColumnVector<char8_t>'. (STID 1499-483b, c02a6b4, 2026-06-06).

Failing query (full stack in the CI report):

SELECT DISTINCT toNullable('2')
GROUP BY toString(
    isZeroOrNull(toUInt64OrDefault(9223372036854775807)),
    multiIf(
        arrayReverseSort(isZeroOrNull, [])[toNullable(65535)],
        arrayReverseSort(['00:00:00.000000000'], isZeroOrNull(-9223372036854775808), (SELECT toString(NULL))),
        '2020-02-29'
    ),
    NULL
) LIMIT -2147483647

The query uses no query parameters and no function-name parsing tricks. The crash site is src/Functions/if.cpp:1021 in FunctionIf::executeForConstAndNullableCondition:

cond_is_true = !cond_is_null && checkAndGetColumn<ColumnUInt8>(*data_column).getBool(0);

The condition column is ColumnConst(ColumnNothing). ColumnConst::onlyNull returns data->isNullAt(0), but ColumnNothing does not override isNullAt so it returns false, leaving cond_is_null = false. The code then checkAndGetColumn<ColumnUInt8> on the inner ColumnNothing and typeid_cast throws. An empty-array element access (arrayReverseSort(..., [])[...]) is the typical way the planner produces a Const(Nothing) condition reaching if/multiIf.

Cross-PR + master history (CIDB, 180d): the same crash signature (ColumnNothing to ColumnVector inside FunctionIf::executeImpl reached via executeForConstAndNullableCondition) appears on two unrelated PRs, both AST-fuzzer one-offs:

PR #104591 is purely a setting-handling change; it has zero code path overlap with if.cpp. Same exact failure shape there: multiIf(... arrayMin([]) ...) producing a Const(Nothing) condition. Both fuzzer queries follow the same pattern.

This PR's diff is parser-only (ParserFunctionNameWithLambdaArgs in src/Parsers/ExpressionListParsers.cpp plus a regression test). It cannot affect runtime evaluation of multiIf/if. The crash query parses fine without the parser change, and the symbol the failure exercises (FunctionIf::executeForConstAndNullableCondition) is unrelated to function-name parsing.

Recommendation: treat this AST fuzzer hit as a flaky/chronic finding on this PR's CI, unblock the merge, and track the underlying if.cpp bug separately. The fix is to recognize ColumnNothing (or data_column->isDummy) inside the ColumnConst unwrap branch and treat it as cond_is_null, similar to how the explicit nullable path is handled.

I will open a separate fix PR for the if.cpp executeForConstAndNullableCondition bug and reference this one.

cc @nikitamikhaylov

session: cron:clickhouse-ci-task-worker:20260607-131300

@groeneai We will wait for you fixing the problem first.

The follow-up fix PR is open: #106678

Root cause was in ColumnConst::onlyNull (returned false for Const(Nullable(Nothing)) because it forwarded only to data->isNullAt(0), which reads the inner null-map and was 0 for the constant-folded subscript), combined with FunctionIf::executeForConstAndNullableCondition overwriting cond_is_null with the same inner null_map[0], then doing checkAndGetColumn<ColumnUInt8> on the inner ColumnNothing. Two-line fix: ColumnConst::onlyNull now delegates to data->onlyNull (matching ColumnNullable::onlyNull's isDummy semantics), and the if.cpp branch ORs the bit instead of overwriting. Regression test added covering 6 shapes (if/multiIf + arraySort/arrayMap/arrayFilter-empty + CAST(NULL,'Nullable(Nothing)')); 50/50 stable locally.

Your PR #106635 is parser-only and is not the cause; the AST fuzzer hit on arm_asan_ubsan is unrelated and can be unblocked.