Skip to content

Window Fuzzer crashes with SIGSEGV (null pointer dereference) #16918

@mbasmanova

Description

@mbasmanova

The Window Fuzzer crashes with a segfault (SIGSEGV, null pointer dereference at address 0x0) early in the fuzzer run.

Example failure: https://github.com/facebookincubator/velox/actions/runs/23534784917/job/68510203575

Instance 1 (seed 454204341) crashed within ~5 seconds of starting. Instances 2, 3, and 4 passed.

Details

Timeline from the logs:

  1. Presto is up and running (CREATE SCHEMA succeeds)
  2. All 4 fuzzer instances start simultaneously
  3. Instance 1 hits a CURL timeout on fetchNext (PrestoQueryRunner.cpp:580) — query was submitted but fetching results timed out, likely due to resource contention from 4 concurrent instances
  4. The timeout exception is caught and handled (returned as kReferenceQueryFail)
  5. Next iteration begins — zstd compressor is initialized (during writeToFile)
  6. SIGSEGV — null pointer dereference (address not mapped to object)
E20260325 03:13:26.273557   501 Exceptions.h:87] Line: .../PrestoQueryRunner.cpp:580, Function:fetchNext,
  Expression: CURLE_OK == res (0 vs. 28) Get request failed: Timeout was reached
I0325 03:13:26.286706   501 Compression.cpp:660] Initialized zstd compressor with compression level 7
*** Signal 11 (SIGSEGV) (0x0) received by PID 501 ... (code: address not mapped to object), stack trace: ***
(error retrieving stack trace)

Stack trace was not retrievable. The crash is a real bug — regardless of what caused the CURL timeout, the code should not segfault.

Repro

# Start a local Presto server, then run:
./velox_window_fuzzer_test \
    --seed 454204341 \
    --duration_sec 10 \
    --batch_size 50 \
    --minloglevel 0 \
    --enable_window_reference_verification \
    --presto_url=http://127.0.0.1:8080

Metadata

Metadata

Assignees

No one assigned

    Labels

    fuzzerIssues related the to Velox fuzzer test components.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions