There is an incorrect result item length assigned when a negative repeat() counter used. Here is the assignement when we implicitly cast signed to unsigned getting overflow if count < 0. Later MDB assignes 16MB inside fix_char_length_ulonglong(). This causes a crash in CS. Here are the steps to reproduce.

create table cs1(i bigint)engine=columnstore;

insert into cs1 values (42);

select repeat(i,-1) from cs1;