Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

[Bug] GPORCA crashes the coordinator with dependencies extended statistics

未关闭
  • 哪里不对？
#2,135 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 3 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
30/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
c, cpp, postgresql, sql
领域
databases

调研方向

Start by running the reproduction SQL with optimizer = on to confirm the SIGSEGV and capture a backtrace. The payload points to CExtendedStatsProcessor.cpp, where colid_to_attno_mapping->Find(&colid) is dereferenced without a null check around lines 279 and 355/365, while the check near line 431 does test for null. Done means the query returns one row (NULL | NULL | f) with optimizer on and the crash no longer occurs, with a regression test added.

由索引模型根据 Issue 内容生成。

描述

type: Bug
Apache Cloudberry version

No response

What happened

Reproduce:

CREATE TABLE t1 (c0 name, c1 numeric, c2 boolean) DISTRIBUTED BY (c2);
INSERT INTO t1 VALUES ('a', 0.9, false), (NULL, NULL, false), ('', 0.1, false), ('1', 0.7, true), ('b', 0.5, NULL), ('', NULL, NULL), ('c', NULL, NULL);
CREATE STATISTICS s1 ON c0, c2 FROM t1;
CREATE STATISTICS s2 ON c1, c2 FROM t1;
ANALYZE t1;

SET optimizer = on;

SELECT * FROM (SELECT c0 AS a, c1 AS b, c2 AS c FROM t1 WHERE c2 IS FALSE) AS r WHERE r.a IS NULL AND r.b IS NULL AND r.c = FALSE;
  -- server closed the connection unexpectedly

Expected: one row, NULL | NULL | f. That's what you get with optimizer = off, or with optimizer = on after dropping s1 and s2.

  Actual: the coordinator backend crashes, and all other sessions are reset while the cluster recovers:
  PANIC: Unexpected internal error: Master process received signal SIGSEGV
  server process (PID ...) was terminated by signal 11: Segmentation fault

  Stack (top frames):
  gpnaucrates::CFilterStatsProcessor::MakeHistHashMapConjFilter
  gpnaucrates::CFilterStatsProcessor::MakeStatsFilter
  gpnaucrates::CFilterStatsProcessor::MakeStatsFilterForScalarExpr
  gpopt::CLogicalSelect::PstatsDerive
  gpopt::CExpressionHandle::DeriveRootStats
  ...
  gpopt::CEngine::FinalizeExploration

Possible cause: MakeHistHashMapConjFilter calls CExtendedStatsProcessor::ApplyCorrelatedStatsToScaleFactorFilterCalculation. In that function, the result of colid_to_attno_mapping->Find(&colid) is dereferenced
without a null check (CExtendedStatsProcessor.cpp, around lines 279 and 355/365), while another call site (around line 431) does check for null. The filter here sits above a subquery and spans columns from two
different dependency statistics objects, which may produce a column ID with no mapping. I haven't confirmed this in a debugger.

What you think should happen instead

No response

How to reproduce
CREATE TABLE t1 (c0 name, c1 numeric, c2 boolean) DISTRIBUTED BY (c2);
INSERT INTO t1 VALUES ('a', 0.9, false), (NULL, NULL, false), ('', 0.1, false), ('1', 0.7, true), ('b', 0.5, NULL), ('', NULL, NULL), ('c', NULL, NULL);
CREATE STATISTICS s1 ON c0, c2 FROM t1;
CREATE STATISTICS s2 ON c1, c2 FROM t1;
ANALYZE t1;

SET optimizer = on;

SELECT * FROM (SELECT c0 AS a, c1 AS b, c2 AS c FROM t1 WHERE c2 IS FALSE) AS r WHERE r.a IS NULL AND r.b IS NULL AND r.c = FALSE;
  -- server closed the connection unexpectedly
Operating System

any

Anything else

No response

Are you willing to submit PR?
  • Yes, I am willing to submit a PR!
Code of Conduct
主要语言
C
星标
1.4k
派生
262
平均合并
4 天 20 小时
30 天内合并 PR
57

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

apache/cloudberry 的其他 Issue

查看 apache/cloudberry 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。