[zvonand]

Changelog category (leave one):

• Critical Bug Fix (crash, data loss, RBAC) or LOGICAL_ERROR

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

The usage of ngram_bf index on a non-UTF-8 data led to an uninitialized memory read, with values that could reside in the resulting index structure. Closes ClickHouse#92576. (ClickHouse#93663 by @alexey-milovidov)

Documentation entry for user-facing changes

...

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Unit tests
• Performance tests
• Aarch64 tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• CAS (content-addressed storage; Antalya only)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• OAuth (5m)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[zvonand]

Backporter: cherry-pick conflicts resolved by AI

Conflicted files:

• src/Interpreters/ITokenExtractor.cpp (both modified)

Commits:

• 8d261e6: cherry-pick with the conflicts committed as-is

• 8148987: resolution

• NgramTokenExtractor::nextInString: kept the upstream std::min cap that stops the token running past the end of the buffer, rewritten as *token_length = std::min(*token_length, length - *token_start);.

• NgramTokenExtractor::nextInStringLike: kept upstream's split of pos = ++i into ++i; *pos = i;. The i + j < length loop bound applied cleanly.

• DefaultTokenExtractor::nextInStringLike (upstream's SplitByNonAlphaTokenExtractor): added the *pos < length bound to the UTF-8 copy loop.

• NoOpTokenExtractor::nextInStringLike: the conflict block pulled in upstream's whole SparseGramsTokenExtractor, which stable-25.8 doesn't have. I kept the branch's existing code and left that class out, so its one-line fix doesn't apply here.

[github-actions]

Workflow [PR], commit [d61cdda]

[zvonand]

Backporter: CI failures at 8148987

Failed checks:

• Fast test

Needs a human: The conflict-resolution commit moved 58 contrib submodules to upstream versions, which breaks CMake; reverting them needs git restore --staged, which was denied here.

• Fast test (Cmake configuration): caused by the PR. Commit 8148987 moved 58 contrib/* submodule pointers (abseil-cpp, boost, jemalloc, llvm-project, …) to versions that stable-25.8's CMake files don't match, so source files are missing.
• The real backport is only src/Interpreters/ITokenExtractor.cpp and the 03784_msan_token_iterator test files; the submodule changes are an accident of the conflict resolution.
• Fix needed: run git restore --source=016152dca966f0d2fe28fc635e31a7531471ff2b --staged on all 58 changed contrib/* paths, then amend or commit. This was denied in this session, so nothing is staged.

[zvonand]

@blau-ai

[blau-ai]

CI triage for d61cddac

3 red checks, none caused by the code change: 1 known-flaky test, 1 DCO sign-off issue, and the PR gate, which is just the roll-up of the other two.

Check	Verdict
Stateless tests (amd_binary, old analyzer, s3 storage, DatabaseReplicated, sequential): 1 failed / 579 passed	Flaky, not caused by this PR
DCO	Process issue: the commits have no Signed-off-by
PR (gate)	Roll-up of the above

All other suites passed, including the new test 03784_msan_token_iterator everywhere it ran.

---

1. 01079_parallel_alter_detach_table_zookeeper (DatabaseReplicated, sequential)

The final cleanup DROP timed out on one of the 3 replicas:

Code: 159. DB::Exception: ReplicatedDatabase DDL task /test/clickhouse/db/test_qycfap0o/log/query-0000000020 is not finished on 1 of 3 hosts
(0 of them are currently executing the task, 0 are inactive). ... Was waiting for 120.615864638 seconds, which is longer than
distributed_ddl_task_timeout. (TIMEOUT_EXCEEDED) (query: DROP TABLE IF EXISTS concurrent_alter_detach_1)

The test's own stdout (1725 ×3, Starting/Finishing alters, 1/0 ×3) is correct. Only the timed-out DROP made it fail.

Why it's not this PR:

• The PR only touches src/Interpreters/ITokenExtractor.cpp (token iteration used by text/bloom-filter indexes) and adds one new test. Neither has anything to do with ReplicatedDatabase DDL, ZooKeeper, or ALTER/DETACH.
• This is a known upstream flaky test with the same failure mode (DROP TABLE IF EXISTS concurrent_alter_detach_N failing in the same DatabaseReplicated job): Test 01079_parallel_alter_detach_table_zookeeper is flaky ClickHouse/ClickHouse#91413 and Flaky test: 01079_parallel_alter_detach_table_zookeeper ClickHouse/ClickHouse#97358.
• Upstream fixed it in Fix flaky test 01079_parallel_alter_detach_table_zookeeper ClickHouse/ClickHouse#96888 and Fix flaky test 01079_parallel_alter_detach_table_zookeeper ClickHouse/ClickHouse#97681 (26.2 timeframe). Neither is on stable-25.8; the last change to the test on this branch is Fix flaky test 03364_estimate_compression_ratio ClickHouse/ClickHouse#86003.

Next step: safe to re-run the job. If it keeps hitting stable-25.8 backports, backporting the test-only fixes ClickHouse#96888 and ClickHouse#97681 would stop it. That would be a separate PR, not this one.

2. DCO

Neither of the two commits added on top of the upstream merge has a Signed-off-by: trailer:

• 60fc76c7 "Resolve conflicts in backport of Fix trash in TokenExtractor ClickHouse/ClickHouse#93663"
• d61cddac "Fix CI failures (Fast test)"

The recently merged stable-25.8 backports I checked (#2694, #2692, #2639) don't report a DCO check at all, so it may not be enforced here. If it does have to be green, you'd need to sign off those commits, which means rewriting history and force-pushing. That's outside what I'm allowed to do, so it's up to you. Otherwise a maintainer can mark DCO as passed in the app.

---

Overall: no code fix is needed for this PR. Re-run the DatabaseReplicated stateless job and decide how to handle DCO.