You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudberry.apache.org by "Alena0704 (via GitHub)" <gi...@apache.org> on 2026/08/27 15:48:33 UTC
[PR] Fix two crashes/wrong-answer bugs in the gp_percentile_* transition functions (in REL_2_STABLE) [cloudberry]
Alena0704 opened a new pull request, #1935:
URL: https://github.com/apache/cloudberry/pull/1935
gp_percentile_cont() / gp_percentile_disc() are the split ordered-set aggregates ORCA rewrites percentile_cont(), percentile_disc() and median() into. Two bugs in their transition functions, both ORCA-only; the Postgres planner path is unaffected.
1. Direct SQL calls read past the end of the argument array (2f409c8)
The transition functions read five arguments in C (state + the four aggregate arguments), but pg_proc.dat declares four. As transition functions they are called correctly; a direct SQL call makes PG_GETARG_INT64(4) pick up garbage - wrong results, an assertion on pfree(NULL), or a segfault.
Fixing the declaration would force an initdb, which is not acceptable on a stable branch, so the argument count is checked and a plain error is raised. Direct calls were never useful, and percentile_* WITHIN GROUP is unaffected either way. Ported from Greengage/open-gpdb 5cdf21a (ADBDEV-7771); on main the declaration is fixed instead.
2. The isnull flag is lost when the previous state is returned (8251c47)
When the current row isn't one the percentile is computed from, the previous state is handed back untouched. On the first call that state is NULL, and returning a bare Datum(0) with isnull false drops the flag: 0 instead of NULL for by-value types, a NULL pointer dereference for by-reference ones — an empty input set crashed the backend for interval, timestamp and timestamptz.
6c289ad fixed only _disc, and did it by comparing the returned Datum against the previous state — which misfires whenever the selected value's Datum is 0 (float8 0.0, int 0, false). Hence percentile_disc(0) WITHIN GROUP (ORDER BY b) returning NULL under ORCA when the minimum is 0. The flag is now restored from PG_ARGISNULL(0) on the fall-through branch, in both _cont and _disc. Ported from 477b04a (ADBDEV-7770).
The bug reproduction:
```
-- Bug 2: by-value — silently wrong answer
select gp_percentile_cont(0::float8, 0, 0, 0); -- 0, expecting NULL
-- Bug 2: by-reference — backend crash
select gp_percentile_cont('0 hour'::interval, 0, 0, 0); -- server closed the connection
-- Bug 3: a selected value whose Datum is 0 turns into NULL
select gp_percentile_disc(0::float8, 0, 1, 1); -- NULL, expecting 0
select gp_percentile_disc(0::int, 0, 1, 1); -- NULL, expecting 0
-- Bug 1: a direct call to the transition function reads args[4], which isn't there
select gp_percentile_disc_transition(NULL::numeric, 1, 1, 1);
```
Bug 1 crashes the server on rel2; on main, with the catalog fixed, the call resolves with five arguments and works.
The most telling one is bug 3 end-to-end — ORCA and the planner disagree on the same query:
```
create table perczero (a int, b float8) distributed by (a);
insert into perczero select i, (i - 1)::float8 from generate_series(1, 10) i;
select percentile_disc(0) within group (order by b) from perczero; -- NULL
set optimizer = off;
select percentile_disc(0) within group (order by b) from perczero; -- 0
```
### Type of Change
- [ ] Bug fix (non-breaking change)
- [ ] New feature (non-breaking change)
- [ ] Breaking change (fix or feature with breaking changes)
- [ ] Documentation update
### Breaking Changes
<!-- Remove if not applicable. If yes, explain impact and migration path -->
### Test Plan
<!-- How did you test these changes? -->
- [x] Unit tests added/updated
- [ ] Integration tests added/updated
- [ ] Passed `make installcheck`
- [ ] Passed `make -C src/test installcheck-cbdb-parallel`
### Impact
<!-- Remove sections that don't apply -->
**Performance:**
<!-- Any performance implications? -->
**User-facing changes:**
<!-- Any changes visible to users? -->
**Dependencies:**
<!-- New dependencies or version changes? -->
### Checklist
- [x] Followed [contribution guide](https://cloudberry.apache.org/contribute/code)
- [ ] Added/updated documentation
- [ ] Reviewed code for security implications
- [ ] This PR contains AI-assisted code generation
- [x] Requested review from [cloudberry committers](https://github.com/orgs/apache/teams/cloudberry-committers)
### Additional Context
<!-- Any other information that would help reviewers? Remove if none -->
### CI Skip Instructions
<!--
To skip CI builds, add the appropriate CI skip identifier to your PR title.
The identifier must:
- Be in square brackets []
- Include the word "ci" and either "skip" or "no"
- Only use for documentation-only changes or when absolutely necessary
-->
---
<!-- Join our community:
- Mailing list: [dev@cloudberry.apache.org](https://lists.apache.org/list.html?dev@cloudberry.apache.org) (subscribe: dev-subscribe@cloudberry.apache.org)
- Discussions: https://github.com/apache/cloudberry/discussions -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For additional commands, e-mail: commits-help@cloudberry.apache.org
Re: [PR] Fix two crashes/wrong-answer bugs in the gp_percentile_* transition functions (in REL_2_STABLE) [cloudberry]
Posted by "leborchuk (via GitHub)" <gi...@apache.org>.
leborchuk merged PR #1935:
URL: https://github.com/apache/cloudberry/pull/1935
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For additional commands, e-mail: commits-help@cloudberry.apache.org
Re: [PR] Fix two crashes/wrong-answer bugs in the gp_percentile_* transition functions (in REL_2_STABLE) [cloudberry]
Posted by "Alena0704 (via GitHub)" <gi...@apache.org>.
Alena0704 commented on PR #1935:
URL: https://github.com/apache/cloudberry/pull/1935#issuecomment-5451709114
Fixed vomit messages a bit.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For additional commands, e-mail: commits-help@cloudberry.apache.org