You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The correct results here would have a row for each row in Left table. (since it's a JoinType.Left), so there should be {Value:20, R2 : blank }
Using DValue as a key is really just object reference equality. Since DValue doesn't define .Equals (and it shouldn't - since we certainly don't have .equals on RecordValue either). But the join impl assumes all the dvalues are unique, which is not necessarily true.
Note that this is heavily mitigated since most builtin functions use InMemoryTable, and that always allocate new DValue. See here:
But we can still workaround that (see example above) - TBD whether we could come up with more mainstream examples.
And Future optimizations could significantly widen this window. Or we could also hit this with other impls of TableValue.
The text was updated successfully, but these errors were encountered:
MikeStall
changed the title
Join bug - exploiting DValue equality.
Join bug - wrong results from exploiting DValue equality.
Dec 29, 2024
Join implementation is using DValue/RecordValue as a dictionary key. See #2788
This can be exploited to get wrong results:
The fix here is we should never use DValue as a dictionary key. (consider using indices instead?)
The correct results here would have a row for each row in Left table. (since it's a JoinType.Left), so there should be
{Value:20, R2 : blank }
Using DValue as a key is really just object reference equality. Since DValue doesn't define .Equals (and it shouldn't - since we certainly don't have .equals on RecordValue either). But the join impl assumes all the dvalues are unique, which is not necessarily true.
Note that this is heavily mitigated since most builtin functions use InMemoryTable, and that always allocate new DValue. See here:
Power-Fx/src/libraries/Microsoft.PowerFx.Core/Public/Values/InMemoryTableValue.cs
Line 43 in 8b14269
But we can still workaround that (see example above) - TBD whether we could come up with more mainstream examples.
And Future optimizations could significantly widen this window. Or we could also hit this with other impls of TableValue.
The text was updated successfully, but these errors were encountered: