{"record":{"id":"344ca069c8bd1951","repo":"databendlabs/databend","slug":"clamped-timestamp-is-inside-the-chrono-range","errorCode":null,"errorMessage":"clamped timestamp is inside the chrono range","messagePattern":"clamped timestamp is inside the chrono range","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"info","filePath":"src/query/expression/src/types/timestamp.rs","lineNumber":63,"sourceCode":"/// Converting that local date to SQL DATE must separately validate DATE_MIN/MAX.\n/// INTERVAL arithmetic reports out-of-range results; other paths retain their\n/// existing overflow policies. Display conversion clamps to these bounds.\n/// 0001-01-01 00:00:00.000000 UTC\npub const TIMESTAMP_MIN: i64 = -62_135_596_800_000_000;\n/// 9999-12-31 23:59:59.999999 UTC\npub const TIMESTAMP_MAX: i64 = 253_402_300_799_999_999;\n\npub const MICROS_PER_SEC: i64 = 1_000_000;\npub const MICROS_PER_MILLI: i64 = 1_000;\n\n/// Clamp to the SQL UTC bounds before converting for display.\n/// Chrono has room for local year 0/10000 at these boundaries.\npub fn timestamp_from_micros(micros: impl AsPrimitive<i64>, tz: &Tz) -> DateTime<Tz> {\n    let micros = micros.as_().clamp(TIMESTAMP_MIN, TIMESTAMP_MAX);\n    let seconds = micros.div_euclid(MICROS_PER_SEC);\n    let subsec = micros.rem_euclid(MICROS_PER_SEC) as u32;\n    DateTime::<Utc>::from_timestamp(seconds, subsec * 1_000)\n        .expect(\"clamped timestamp is inside the chrono range\")\n        .with_timezone(tz)\n}\n\npub const PRECISION_MICRO: u8 = 6;\npub const PRECISION_MILLI: u8 = 3;\npub const PRECISION_SEC: u8 = 0;\n\n/// Preserve the legacy conversion policy: either bound overflow maps to TIMESTAMP_MIN.\n#[inline]\npub fn clamp_timestamp(micros: &mut i64) {\n    if !(TIMESTAMP_MIN..=TIMESTAMP_MAX).contains(micros) {\n        *micros = TIMESTAMP_MIN;\n    }\n}\n\n/// Validate the final SQL instant, not its local calendar year.\n#[inline]\npub fn check_timestamp(micros: i64) -> Result<i64, String> {","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/databendlabs/databend/blob/288d84d76e20a2f8f7173bda9691eb6ece301aa9/src/query/expression/src/types/timestamp.rs#L45-L81","documentation":"timestamp_from_micros clamps the input microseconds to TIMESTAMP_MIN..TIMESTAMP_MAX, then converts to a chrono DateTime via DateTime::<Utc>::from_timestamp, expecting the clamped value to be representable. The panic fires only if the constants TIMESTAMP_MIN/TIMESTAMP_MAX themselves are outside what chrono's from_timestamp accepts — an internal invariant; the clamp is designed so this cannot trigger with correct constants.","triggerScenarios":"Practically unreachable for callers; would only fire if TIMESTAMP_MIN/TIMESTAMP_MAX constants were changed to values outside chrono's supported range (seconds beyond roughly year ±262143).","commonSituations":"Only during refactors of the timestamp range constants or a chrono major-version upgrade changing from_timestamp's accepted bounds.","solutions":["No caller action required; verify TIMESTAMP_MIN/TIMESTAMP_MAX stay within chrono's representable range after upgrades.","If seen, pin/check the chrono version compatibility of DateTime::<Utc>::from_timestamp."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Not required; the function clamps internally. No caller guard needed.\nlet dt = timestamp_from_micros(micros, tz);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["After chrono upgrades, confirm TIMESTAMP_MIN/TIMESTAMP_MAX remain representable by DateTime::<Utc>::from_timestamp."],"tags":["panic","timestamp","unreachable","chrono"],"backgroundTag":"internal-invariant-violation","analyzedSha":"288d84d76e20a2f8f7173bda9691eb6ece301aa9","analyzedAt":"2026-09-11T11:29:36.208Z","contentChangedAt":"2026-09-11T11:29:36.208Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}