`repeat` on `LargeUtf8` aborts the process on a result size no allocation can satisfy

Open Beginner friendly
  • Is something wrong?
#26,948 1 comment 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@huong8373tt-beep is already working on this.

Since Nov 2, 2026.

  • #26957 by @shahwazreza — open
  • #27010 by @huong8373tt-beep — closed without merging

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
rust
Domain
backend

Research direction

Start in datafusion/functions/src/string/repeat.rs, comparing the LargeUtf8 cap in the scalar path near lines 127-128 with the array path near lines 227-228. Read test_repeat_string_array_overflow and the reproduction snippet, then choose the fixed-cap or try_reserve approach and make both paths return an error for a count of 1 << 60. Add a regression test covering scalar LargeUtf8 and the array builder, and run the repeat tests.

Written by the indexing model from the issue text.

Description

bug good first issue

repeat on LargeUtf8 aborts the process on a result size no allocation can satisfy

Describe the bug

repeat caps the result at i32::MAX bytes for Utf8 and Utf8View, and returns an error above that. For LargeUtf8 the cap is i64::MAX, in both the scalar path and the array path. That cap admits sizes no allocation can satisfy. A result of 2^60 bytes (1 EiB) is larger than the virtual address space of x86_64 (48 or 57 bits) and aarch64 (at most 52 bits), so the allocator refuses it at once, whatever memory the machine has:

  • With both arguments scalar, s.repeat(count) cannot fail gracefully, so the refused allocation aborts the process: memory allocation of 1152921504606846976 bytes failed.
  • With an array of strings, the builder panics: failed to allocate memory for layout Layout { size: 1152921504606846976, align: 64 (1 << 6) }.

The existing test_repeat_string_array_overflow uses a count of i64::MAX, which the overflow check catches before any allocation.

To Reproduce

On main at 926901f90:

use std::sync::Arc;

use arrow::datatypes::Field;
use datafusion_common::ScalarValue;
use datafusion_common::config::ConfigOptions;
use datafusion_expr::{ColumnarValue, ReturnFieldArgs, ScalarFunctionArgs};
use datafusion_functions::string::repeat;

let udf = repeat();
let s = ScalarValue::LargeUtf8(Some("a".to_string()));
// With ScalarValue::Utf8: Err(Execution("string size overflow on repeat, max size is 2147483647, but got 1152921504606846976"))
let n = ScalarValue::Int64(Some(1 << 60));
let arg_fields = vec![
    Arc::new(Field::new("s", s.data_type(), true)),
    Arc::new(Field::new("n", n.data_type(), true)),
];
let return_field = udf
    .return_field_from_args(ReturnFieldArgs {
        arg_fields: &arg_fields,
        scalar_arguments: &[Some(&s), Some(&n)],
    })
    .unwrap();
let result = udf.invoke_with_args(ScalarFunctionArgs {
    args: vec![ColumnarValue::Scalar(s), ColumnarValue::Scalar(n)],
    arg_fields,
    number_rows: 1,
    return_field,
    config_options: Arc::new(ConfigOptions::default()),
});
// aborts: memory allocation of 1152921504606846976 bytes failed
Expected behavior

An error, as for Utf8, instead of an abort. Two fixes seem possible:

  • A fixed cap for LargeUtf8. PostgreSQL's repeat returns "requested length too large" above MaxAllocSize, 1 GB minus 1 (oracle_compat.c). DuckDB's strings are limited to u32::MAX bytes (MAX_STRING_SIZE).
  • Fallible allocation, such as try_reserve, so that a refused allocation becomes an error.

Which one should repeat use? Neither guards against an allocation that succeeds under overcommit and fails later when the pages are touched. Both turn this case, where the allocator refuses up front, into an error. #22688 tracks checked size accounting for string builders in general.

Additional context

Found by property-based tests that call each function with generated arguments, including large counts.

Willingness to contribute

I cannot contribute a fix for this bug at this time

Dominant language
Rust
Stars
9.6k
Forks
2.6k
Avg merge
3d 22h
Merged PRs (30d)
331

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/datafusion

All issues in apache/datafusion

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.