7 ms·

> No, the point here is that the fuzzer "caught" a bug in sqlite. The blog post mostly clears things up. Could you explain what you mean? What bug is there in

> No, the point here is that the fuzzer "caught" a bug in sqlite. The blog post mostly clears things up. Could you explain what you mean? What bug is there in sqlite? What blog post are you referring to? Via someone else in the thread, this was reported as a bug in LLVM, which was confirmed and is now fixed: https://bugs.llvm.org/show_bug.cgi?id=46194 https://bugs.llvm.org/show_bug.cgi?id=46194. In light of this, I wonder why you claim that this was a bug in sqlite.

iforgotpassword 6y ago
There is no bug in sqlite. That's the reason this blog post was written. And that's why it was interesting. Not because anyone claimed clang has a major fuckup.
- loeg 6y ago
  You wrote earlier: > No, the point here is that the fuzzer "caught" a bug in sqlite. Which is where the confusion stems from. Perhaps "'caught a bug' in sqlite" would have been a more clear way of writing what you intended?
  - iforgotpassword 6y ago
    Ah I see now. Yes I could have extended the quotation. I was assuming the context was given by the start of the second paragraph: > OSSFuzz has been reported bug 23003 against SQLite.
SQLite 6y ago
What happened: 1. OSSFuzz reports a bug against SQLite. 2. SQLite dev tries to fix the reported problem but is unable to repro the bug on his desktop 3. SQLite dev replicates the OSSFuzz build environment which uses clang-11.0.0 and is then able to repro the reported bug 4. SQLite dev finds that the bug isn't in SQLite at all, but rather in clang-11.0.0 5. SQLite dev patches SQLite to work around the clang bug, posts a brief note about this on the SQLite forum, and goes to bed. 6. The post on the SQLite forum is picked up by HN while the SQLite dev is asleep. LLVM devs read HN, isolate and fix the clang problem, all before the SQLite dev wakes up.
- andrewflnr 6y ago
  That's actually pretty awesome overall, besides the initial mis-attribution of the bug, which is an understandable mistake. Props to everyone involved.
- jonas21 6y ago
  7. SQLite dev wakes up and responds to comments on HN!!
- cheez 6y ago
  Hi, I love SQLite. It is the crux of a system that allows me to make a living.
- throwaway_pdp09 6y ago
  SQLite dev tries... / SQLite dev replicates... / SQLite dev finds... / SQLite dev patches... Now compare this with what happens when you meet an MSSQL bug.
  - FridgeSeal 6y ago
    For those of us saddled with only the misfortune of having to use MSSQL and not having run into a bug yet, what's the experience?
    - throwaway_pdp09 6y ago
      MSSQL was an excellent product since version 7. Reporting bugs and getting support for MSSQL 2000 was a good and rapid experience. It's just gone downhill slowly since. The documentation at that time was first class too - it's important to remember that, docs really matter. In 2014 the small company I worked for made a release with my work in it and I was spoken to the next day because it had crashed. The boss was not pleased as it had to be down to my work, nothing else had changed. In fact it was down to geographical data in the DB being changed as well. One of the geog functions (edit: think it was STIntersects, but the next bit applies to many such functions) claimed to return a 0 or a 1 - but in fact I found, separately documented, that it could also return NULL. While spending a couple of hours digging this out, I found via a blog that geography data types used approximate algorithms (which is not surprising, and quite reasonable when you understand why, but it was not documented). These two problems caused us what could have been a serious production problem. There's lots more. I've hit too many. Just a few weeks ago I did a straightforward recursive CTE on a small data set, which took a minute to run. Eh? It was an optimiser bug. Breaking off the base query into a temp table first and it dropped to a second. I've too much of this shit, much more. MS doesn't care. BTW if you use the long-existing "update from ...join" syntax which MS released years ago as an extension, be aware it allows you to do stupid things that ansi-standard SQL does not, like repeated unpredictable updates to the same row, in the same single sql statement. I hit that last year in someone else's code. It's broken. Well, what's new.

iforgotpassword 6y ago

There is no bug in sqlite. That's the reason this blog post was written. And that's why it was interesting. Not because anyone claimed clang has a major fuckup.

loeg 6y ago
You wrote earlier: > No, the point here is that the fuzzer "caught" a bug in sqlite. Which is where the confusion stems from. Perhaps "'caught a bug' in sqlite" would have been a more clear way of writing what you intended?
- iforgotpassword 6y ago
  Ah I see now. Yes I could have extended the quotation. I was assuming the context was given by the start of the second paragraph: > OSSFuzz has been reported bug 23003 against SQLite.

SQLite 6y ago

What happened: 1. OSSFuzz reports a bug against SQLite. 2. SQLite dev tries to fix the reported problem but is unable to repro the bug on his desktop 3. SQLite dev replicates the OSSFuzz build environment which uses clang-11.0.0 and is then able to repro the reported bug 4. SQLite dev finds that the bug isn't in SQLite at all, but rather in clang-11.0.0 5. SQLite dev patches SQLite to work around the clang bug, posts a brief note about this on the SQLite forum, and goes to bed. 6. The post on the SQLite forum is picked up by HN while the SQLite dev is asleep. LLVM devs read HN, isolate and fix the clang problem, all before the SQLite dev wakes up.

andrewflnr 6y ago
That's actually pretty awesome overall, besides the initial mis-attribution of the bug, which is an understandable mistake. Props to everyone involved.
jonas21 6y ago
7. SQLite dev wakes up and responds to comments on HN!!
cheez 6y ago
Hi, I love SQLite. It is the crux of a system that allows me to make a living.
throwaway_pdp09 6y ago
SQLite dev tries... / SQLite dev replicates... / SQLite dev finds... / SQLite dev patches... Now compare this with what happens when you meet an MSSQL bug.
- FridgeSeal 6y ago
  For those of us saddled with only the misfortune of having to use MSSQL and not having run into a bug yet, what's the experience?
  - throwaway_pdp09 6y ago
    MSSQL was an excellent product since version 7. Reporting bugs and getting support for MSSQL 2000 was a good and rapid experience. It's just gone downhill slowly since. The documentation at that time was first class too - it's important to remember that, docs really matter. In 2014 the small company I worked for made a release with my work in it and I was spoken to the next day because it had crashed. The boss was not pleased as it had to be down to my work, nothing else had changed. In fact it was down to geographical data in the DB being changed as well. One of the geog functions (edit: think it was STIntersects, but the next bit applies to many such functions) claimed to return a 0 or a 1 - but in fact I found, separately documented, that it could also return NULL. While spending a couple of hours digging this out, I found via a blog that geography data types used approximate algorithms (which is not surprising, and quite reasonable when you understand why, but it was not documented). These two problems caused us what could have been a serious production problem. There's lots more. I've hit too many. Just a few weeks ago I did a straightforward recursive CTE on a small data set, which took a minute to run. Eh? It was an optimiser bug. Breaking off the base query into a temp table first and it dropped to a second. I've too much of this shit, much more. MS doesn't care. BTW if you use the long-existing "update from ...join" syntax which MS released years ago as an extension, be aware it allows you to do stupid things that ansi-standard SQL does not, like repeated unpredictable updates to the same row, in the same single sql statement. I hit that last year in someone else's code. It's broken. Well, what's new.