Describe the bug
array_repeat(<scalar_const>, <large_const>) — the simplest all-constant form — panics with capacity overflow from raw_vec::reserve, distinct from the previously-filed array_repeat overflows:
This issue is the constant-scalar / single-row path: nothing is summed across rows and nothing is a list, but the final Vec-reserve for the repeated values still requests more than isize::MAX bytes and panics in raw_vec.
To Reproduce
cargo run -p datafusion-cli -- -c "SELECT array_repeat(1, 9223372036854775807)"
Actual behavior
DataFusion CLI v53.1.0
thread 'main' panicked at .../library/alloc/src/raw_vec/mod.rs:28:5:
capacity overflow
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Expected behavior
Return an execution error like "array_repeat: requested length exceeds maximum array size" rather than panicking.
Environment
- DataFusion CLI v53.1.0 (from
main at commit 8741a77)
Additional context
Same family of missing-bounds-check panics as #22188, #22217, #22218, #22219 — but a third panic site (raw_vec capacity rather than accum::Sum or repeat::mul). A fix at the public array_repeat entry point that bounds count against isize::MAX / size_of::<element>() should close all three array_repeat variants at once; filing separately so each panic site is tracked.
Describe the bug
array_repeat(<scalar_const>, <large_const>)— the simplest all-constant form — panics withcapacity overflowfromraw_vec::reserve, distinct from the previously-filedarray_repeatoverflows:cofi64::MAXand panics inaccum.rs(attempt to add with overflow) while summing per-row counts.repeat.rs(attempt to multiply with overflow) onlen * count.This issue is the constant-scalar / single-row path: nothing is summed across rows and nothing is a list, but the final
Vec-reserve for the repeated values still requests more thanisize::MAXbytes and panics inraw_vec.To Reproduce
cargo run -p datafusion-cli -- -c "SELECT array_repeat(1, 9223372036854775807)"Actual behavior
Expected behavior
Return an execution error like
"array_repeat: requested length exceeds maximum array size"rather than panicking.Environment
mainat commit 8741a77)Additional context
Same family of missing-bounds-check panics as #22188, #22217, #22218, #22219 — but a third panic site (
raw_veccapacity rather thanaccum::Sumorrepeat::mul). A fix at the publicarray_repeatentry point that boundscountagainstisize::MAX / size_of::<element>()should close all three array_repeat variants at once; filing separately so each panic site is tracked.