Skip to content

panic: array_repeat capacity overflow on constant scalar with large count #22228

Closed

Description

@Dandandan

Describe the bug

array_repeat(<scalar_const>, <large_const>) — the simplest all-constant form — panics with capacity overflow from raw_vec::reserve, distinct from the previously-filed array_repeat overflows:

This issue is the constant-scalar / single-row path: nothing is summed across rows and nothing is a list, but the final Vec-reserve for the repeated values still requests more than isize::MAX bytes and panics in raw_vec.

To Reproduce

cargo run -p datafusion-cli -- -c "SELECT array_repeat(1, 9223372036854775807)"

Actual behavior

DataFusion CLI v53.1.0

thread 'main' panicked at .../library/alloc/src/raw_vec/mod.rs:28:5:
capacity overflow
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Expected behavior

Return an execution error like "array_repeat: requested length exceeds maximum array size" rather than panicking.

Environment

  • DataFusion CLI v53.1.0 (from main at commit 8741a77)

Additional context

Same family of missing-bounds-check panics as #22188, #22217, #22218, #22219 — but a third panic site (raw_vec capacity rather than accum::Sum or repeat::mul). A fix at the public array_repeat entry point that bounds count against isize::MAX / size_of::<element>() should close all three array_repeat variants at once; filing separately so each panic site is tracked.

Activity

  1. xiedeyantu commented on May 16, 2026

    @xiedeyantu
    Member

    take

  2. added a commit that references this issue on May 24, 2026
    7ad8e2c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions