4 ms·

What happened: 1. OSSFuzz reports a bug against SQLite. 2. SQLite dev tries to fix the reported problem but is unable to repro the bug on his desktop 3. S

by SQLite 6y ago

What happened: 1. OSSFuzz reports a bug against SQLite. 2. SQLite dev tries to fix the reported problem but is unable to repro the bug on his desktop 3. SQLite dev replicates the OSSFuzz build environment which uses clang-11.0.0 and is then able to repro the reported bug 4. SQLite dev finds that the bug isn't in SQLite at all, but rather in clang-11.0.0 5. SQLite dev patches SQLite to work around the clang bug, posts a brief note about this on the SQLite forum, and goes to bed. 6. The post on the SQLite forum is picked up by HN while the SQLite dev is asleep. LLVM devs read HN, isolate and fix the clang problem, all before the SQLite dev wakes up.

andrewflnr 6y ago
That's actually pretty awesome overall, besides the initial mis-attribution of the bug, which is an understandable mistake. Props to everyone involved.
jonas21 6y ago
7. SQLite dev wakes up and responds to comments on HN!!
cheez 6y ago
Hi, I love SQLite. It is the crux of a system that allows me to make a living.
throwaway_pdp09 6y ago
SQLite dev tries... / SQLite dev replicates... / SQLite dev finds... / SQLite dev patches... Now compare this with what happens when you meet an MSSQL bug.
- FridgeSeal 6y ago
  For those of us saddled with only the misfortune of having to use MSSQL and not having run into a bug yet, what's the experience?
  - throwaway_pdp09 6y ago
    MSSQL was an excellent product since version 7. Reporting bugs and getting support for MSSQL 2000 was a good and rapid experience. It's just gone downhill slowly since. The documentation at that time was first class too - it's important to remember that, docs really matter. In 2014 the small company I worked for made a release with my work in it and I was spoken to the next day because it had crashed. The boss was not pleased as it had to be down to my work, nothing else had changed. In fact it was down to geographical data in the DB being changed as well. One of the geog functions (edit: think it was STIntersects, but the next bit applies to many such functions) claimed to return a 0 or a 1 - but in fact I found, separately documented, that it could also return NULL. While spending a couple of hours digging this out, I found via a blog that geography data types used approximate algorithms (which is not surprising, and quite reasonable when you understand why, but it was not documented). These two problems caused us what could have been a serious production problem. There's lots more. I've hit too many. Just a few weeks ago I did a straightforward recursive CTE on a small data set, which took a minute to run. Eh? It was an optimiser bug. Breaking off the base query into a temp table first and it dropped to a second. I've too much of this shit, much more. MS doesn't care. BTW if you use the long-existing "update from ...join" syntax which MS released years ago as an extension, be aware it allows you to do stupid things that ansi-standard SQL does not, like repeated unpredictable updates to the same row, in the same single sql statement. I hit that last year in someone else's code. It's broken. Well, what's new.
    - throwaway_pdp09 6y ago
      Just a small one, > select isnumeric('$+.') > 1 so it thinks it's a number but obviously it isn't > select cast('$+.' as int) > Conversion failed when converting the varchar value '$+.' to data type int. This kind of thing makes data cleaning even less fun than it is. They now have TryParse(), but the above (which I'm pretty sure used to allow an even wider range of crap) is just unnecessary, and is a sign of how they view their own flagship product.
    - csharptwdec19 6y ago
      So much of microsoft's documentation is like this nowadays. There's parts of the 'What's new in C# 8.0' that aren't really there, and the provided code samples are entirely wrong (i.e. not just one issue, the language literally can't do the feature.) See also the state of most documentation for ASPNETCORE. > BTW if you use the long-existing "update from ...join" syntax which MS released years ago as an extension, be aware it allows you to do stupid things that ansi-standard SQL does not, like repeated unpredictable updates to the same row, in the same single sql statement. I hit that last year in someone else's code. It's broken. Well, what's new. I'm curious if you have an example. I know it's not ANSI standard but I've yet to run into any issues. MERGE on the other hand is a dumpster fire and everyone knows it.

by SQLite 6y ago

andrewflnr 6y ago

That's actually pretty awesome overall, besides the initial mis-attribution of the bug, which is an understandable mistake. Props to everyone involved.

jonas21 6y ago

7. SQLite dev wakes up and responds to comments on HN!!

cheez 6y ago

Hi, I love SQLite. It is the crux of a system that allows me to make a living.

throwaway_pdp09 6y ago

SQLite dev tries... / SQLite dev replicates... / SQLite dev finds... / SQLite dev patches... Now compare this with what happens when you meet an MSSQL bug.

FridgeSeal 6y ago
For those of us saddled with only the misfortune of having to use MSSQL and not having run into a bug yet, what's the experience?
- throwaway_pdp09 6y ago
  MSSQL was an excellent product since version 7. Reporting bugs and getting support for MSSQL 2000 was a good and rapid experience. It's just gone downhill slowly since. The documentation at that time was first class too - it's important to remember that, docs really matter. In 2014 the small company I worked for made a release with my work in it and I was spoken to the next day because it had crashed. The boss was not pleased as it had to be down to my work, nothing else had changed. In fact it was down to geographical data in the DB being changed as well. One of the geog functions (edit: think it was STIntersects, but the next bit applies to many such functions) claimed to return a 0 or a 1 - but in fact I found, separately documented, that it could also return NULL. While spending a couple of hours digging this out, I found via a blog that geography data types used approximate algorithms (which is not surprising, and quite reasonable when you understand why, but it was not documented). These two problems caused us what could have been a serious production problem. There's lots more. I've hit too many. Just a few weeks ago I did a straightforward recursive CTE on a small data set, which took a minute to run. Eh? It was an optimiser bug. Breaking off the base query into a temp table first and it dropped to a second. I've too much of this shit, much more. MS doesn't care. BTW if you use the long-existing "update from ...join" syntax which MS released years ago as an extension, be aware it allows you to do stupid things that ansi-standard SQL does not, like repeated unpredictable updates to the same row, in the same single sql statement. I hit that last year in someone else's code. It's broken. Well, what's new.
  - throwaway_pdp09 6y ago
    Just a small one, > select isnumeric('$+.') > 1 so it thinks it's a number but obviously it isn't > select cast('$+.' as int) > Conversion failed when converting the varchar value '$+.' to data type int. This kind of thing makes data cleaning even less fun than it is. They now have TryParse(), but the above (which I'm pretty sure used to allow an even wider range of crap) is just unnecessary, and is a sign of how they view their own flagship product.
  - csharptwdec19 6y ago
    So much of microsoft's documentation is like this nowadays. There's parts of the 'What's new in C# 8.0' that aren't really there, and the provided code samples are entirely wrong (i.e. not just one issue, the language literally can't do the feature.) See also the state of most documentation for ASPNETCORE. > BTW if you use the long-existing "update from ...join" syntax which MS released years ago as an extension, be aware it allows you to do stupid things that ansi-standard SQL does not, like repeated unpredictable updates to the same row, in the same single sql statement. I hit that last year in someone else's code. It's broken. Well, what's new. I'm curious if you have an example. I know it's not ANSI standard but I've yet to run into any issues. MERGE on the other hand is a dumpster fire and everyone knows it.