apache / datafusion

Apache DataFusion SQL Query Engine
https://datafusion.apache.org/
Apache License 2.0
5.52k stars 1.03k forks source link

`bitwise*` operators won't check arguments type when short circuited (Found by SQLancer-NoREC) #11260

Open 2010YOUY01 opened 4 days ago

2010YOUY01 commented 4 days ago

Describe the bug

All bitwise operators https://datafusion.apache.org/user-guide/sql/operators.html#op-bit-and don't allow two arguments both to be Double type, but if the bitwise expression is short-circuited, then type check won't be performed. This bug can be reproduced with any bitwise operator

> select 3.1<<3.2;
Internal error: Data type Float64 not supported for binary operation 'bitwise_shift_left' on dyn arrays.
This was likely caused by a bug in DataFusion's code and we would welcome that you file an bug report in our issue tracker
> select (false and (3.1<<3.2) > 0);
+------------------------------------------------------------+
| Boolean(false) AND Float64(3.1) << Float64(3.2) > Int64(0) |
+------------------------------------------------------------+
| false                                                      |
+------------------------------------------------------------+
1 row(s) fetched.
Elapsed 0.003 seconds.

It's better to return a planning error, because strictly (3.1<<3.2) should be an invalid expression like the following one, and can't be short-circuited

> select (false and (1 + 'foo'));
Error during planning: Cannot coerce arithmetic expression Int64 + Utf8 to valid types

To Reproduce

No response

Expected behavior

No response

Additional context

Found by SQLancer https://github.com/apache/datafusion/issues/11030

dharanad commented 4 days ago

take

dharanad commented 4 days ago

I plan to close this issue by 7/20. Can unassign myseld if this is a priority

2010YOUY01 commented 4 days ago

I plan to close this issue by 7/20. Can unassign myseld if this is a priority

I don't think this one is urgent, thank you so much!