You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@datafusion.apache.org by "thinkharderdev (via GitHub)" <gi...@apache.org> on 2025/05/06 19:52:06 UTC
[PR] Segfaul in ByteGroupValueBuilder [datafusion]
thinkharderdev opened a new pull request, #15968:
URL: https://github.com/apache/datafusion/pull/15968
## Which issue does this PR close?
<!--
We generally require a GitHub issue to be filed for all bug fixes and enhancements and this helps us generate change logs for our releases. You can link an issue to this PR using the GitHub syntax. For example `Closes #123` indicates that this PR will close issue #123.
-->
- Closes #15967.
## Rationale for this change
<!--
Why are you proposing this change? If this is already explained clearly in the issue then this section is not needed.
Explaining clearly why changes are proposed helps reviewers understand your changes and offer better suggestions for fixes.
-->
See issue description
## What changes are included in this PR?
<!--
There is no need to duplicate the description in the issue here but it is sometimes worth providing a summary of the individual changes in this PR.
-->
When appending values in `ByteGroupValueBuilder` we check for overflows of the underlying `OffsetSizeTrait` type
## Are these changes tested?
<!--
We typically require tests for all PRs in order to:
1. Prevent the code from being accidentally broken by subsequent changes
2. Serve as another way to document the expected behavior of the code
If tests are not included in your PR, please explain why (for example, are they covered by existing tests)?
-->
There is a test which reproduces the segfault without this fix
## Are there any user-facing changes?
<!--
If there are user-facing changes then we may require documentation to be updated before approving the PR.
-->
No
<!--
If there are any breaking changes to public APIs, please add the `api change` label.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] Segfault in ByteGroupValueBuilder [datafusion]
Posted by "thinkharderdev (via GitHub)" <gi...@apache.org>.
thinkharderdev commented on code in PR #15968:
URL: https://github.com/apache/datafusion/pull/15968#discussion_r2076322499
##########
datafusion/physical-plan/src/aggregates/group_values/multi_group_by/bytes.rs:
##########
@@ -187,6 +194,13 @@ where
{
let value: &[u8] = array.value(row).as_ref();
self.buffer.append_slice(value);
+
+ assert!(
Review Comment:
Yeah I think in general it would be better. Panicking due to offset overflow is common in other places though so it's not that jarring :)
##########
datafusion/physical-plan/src/aggregates/group_values/multi_group_by/bytes.rs:
##########
@@ -62,6 +64,11 @@ where
buffer: BufferBuilder::new(INITIAL_BUFFER_CAPACITY),
offsets: vec![O::default()],
nulls: MaybeNullBufferBuilder::new(),
+ max_buffer_size: if O::IS_LARGE {
Review Comment:
Agreed: https://github.com/apache/arrow-rs/issues/7474
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] Segfault in ByteGroupValueBuilder [datafusion]
Posted by "Dandandan (via GitHub)" <gi...@apache.org>.
Dandandan commented on PR #15968:
URL: https://github.com/apache/datafusion/pull/15968#issuecomment-2857511710
Thanks all!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] Segfault in ByteGroupValueBuilder [datafusion]
Posted by "Dandandan (via GitHub)" <gi...@apache.org>.
Dandandan commented on code in PR #15968:
URL: https://github.com/apache/datafusion/pull/15968#discussion_r2077044043
##########
datafusion/physical-plan/src/aggregates/group_values/multi_group_by/bytes.rs:
##########
@@ -62,6 +64,11 @@ where
buffer: BufferBuilder::new(INITIAL_BUFFER_CAPACITY),
offsets: vec![O::default()],
nulls: MaybeNullBufferBuilder::new(),
+ max_buffer_size: if O::IS_LARGE {
Review Comment:
๐
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] Segfault in ByteGroupValueBuilder [datafusion]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on PR #15968:
URL: https://github.com/apache/datafusion/pull/15968#issuecomment-2855897670
๐ค `./gh_compare_branch.sh` [Benchmark Script](https://github.com/alamb/datafusion-benchmarking/blob/main/gh_compare_branch.sh) Running
Linux aal-dev 6.11.0-1013-gcp #13~24.04.1-Ubuntu SMP Wed Apr 2 16:34:16 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
Comparing offset-overflow (e3fcaf2efe14fbe947ceae4c0b7898b48472cf86) to 09a7a2a729c1c3a7e3ed1311462e6dcb389821cb [diff](https://github.com/apache/datafusion/compare/09a7a2a729c1c3a7e3ed1311462e6dcb389821cb..e3fcaf2efe14fbe947ceae4c0b7898b48472cf86)
Benchmarks: tpch_mem clickbench_partitioned clickbench_extended
Results will be posted here when complete
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] Segfault in ByteGroupValueBuilder [datafusion]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on code in PR #15968:
URL: https://github.com/apache/datafusion/pull/15968#discussion_r2076234728
##########
datafusion/physical-plan/src/aggregates/group_values/multi_group_by/bytes.rs:
##########
@@ -62,6 +64,11 @@ where
buffer: BufferBuilder::new(INITIAL_BUFFER_CAPACITY),
offsets: vec![O::default()],
nulls: MaybeNullBufferBuilder::new(),
+ max_buffer_size: if O::IS_LARGE {
Review Comment:
I couldn't find any other way to get the max value of the offset size, which is weird. Maybe it would be a nice addition to arrow-rs
##########
datafusion/physical-plan/src/aggregates/group_values/multi_group_by/bytes.rs:
##########
@@ -187,6 +194,13 @@ where
{
let value: &[u8] = array.value(row).as_ref();
self.buffer.append_slice(value);
+
+ assert!(
Review Comment:
would it be better to return an error here to the user instead of a panic? I realize that would require some additional plumbing.
However, a panic is certainly better than SEGFAULT ๐
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] Segfault in ByteGroupValueBuilder [datafusion]
Posted by "Dandandan (via GitHub)" <gi...@apache.org>.
Dandandan merged PR #15968:
URL: https://github.com/apache/datafusion/pull/15968
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] Segfault in ByteGroupValueBuilder [datafusion]
Posted by "Dandandan (via GitHub)" <gi...@apache.org>.
Dandandan commented on code in PR #15968:
URL: https://github.com/apache/datafusion/pull/15968#discussion_r2077043522
##########
datafusion/physical-plan/src/aggregates/group_values/multi_group_by/bytes.rs:
##########
@@ -187,6 +194,13 @@ where
{
let value: &[u8] = array.value(row).as_ref();
self.buffer.append_slice(value);
+
+ assert!(
Review Comment:
https://github.com/apache/datafusion/issues/15969
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org
Re: [PR] Segfault in ByteGroupValueBuilder [datafusion]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on PR #15968:
URL: https://github.com/apache/datafusion/pull/15968#issuecomment-2856006114
๐ค: Benchmark completed
<details><summary>Details</summary>
<p>
```
Comparing HEAD and offset-overflow
--------------------
Benchmark clickbench_extended.json
--------------------
โโโโโโโโโโโโโโโโณโโโโโโโโโโโโโณโโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโโโโ
โ Query โ HEAD โ offset-overflow โ Change โ
โกโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฉ
โ QQuery 0 โ 1986.43ms โ 1868.86ms โ +1.06x faster โ
โ QQuery 1 โ 704.83ms โ 720.83ms โ no change โ
โ QQuery 2 โ 1476.92ms โ 1460.99ms โ no change โ
โ QQuery 3 โ 709.70ms โ 707.18ms โ no change โ
โ QQuery 4 โ 1453.93ms โ 1462.20ms โ no change โ
โ QQuery 5 โ 15346.57ms โ 15058.53ms โ no change โ
โ QQuery 6 โ 2085.02ms โ 2094.70ms โ no change โ
โ QQuery 7 โ 2061.65ms โ 2032.67ms โ no change โ
โโโโโโโโโโโโโโโโดโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโ
โ Benchmark Summary โ โ
โกโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฉ
โ Total Time (HEAD) โ 25825.05ms โ
โ Total Time (offset-overflow) โ 25405.95ms โ
โ Average Time (HEAD) โ 3228.13ms โ
โ Average Time (offset-overflow) โ 3175.74ms โ
โ Queries Faster โ 1 โ
โ Queries Slower โ 0 โ
โ Queries with No Change โ 7 โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโ
--------------------
Benchmark clickbench_partitioned.json
--------------------
โโโโโโโโโโโโโโโโณโโโโโโโโโโโโโณโโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโโโ
โ Query โ HEAD โ offset-overflow โ Change โ
โกโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฉ
โ QQuery 0 โ 2.22ms โ 2.18ms โ no change โ
โ QQuery 1 โ 39.68ms โ 38.19ms โ no change โ
โ QQuery 2 โ 94.14ms โ 91.56ms โ no change โ
โ QQuery 3 โ 95.85ms โ 99.12ms โ no change โ
โ QQuery 4 โ 620.41ms โ 629.68ms โ no change โ
โ QQuery 5 โ 864.93ms โ 889.61ms โ no change โ
โ QQuery 6 โ 2.16ms โ 2.41ms โ 1.12x slower โ
โ QQuery 7 โ 44.57ms โ 45.35ms โ no change โ
โ QQuery 8 โ 889.87ms โ 916.62ms โ no change โ
โ QQuery 9 โ 1228.70ms โ 1214.68ms โ no change โ
โ QQuery 10 โ 265.13ms โ 268.80ms โ no change โ
โ QQuery 11 โ 307.84ms โ 312.65ms โ no change โ
โ QQuery 12 โ 927.03ms โ 928.29ms โ no change โ
โ QQuery 13 โ 1390.15ms โ 1374.36ms โ no change โ
โ QQuery 14 โ 850.50ms โ 869.04ms โ no change โ
โ QQuery 15 โ 822.92ms โ 827.88ms โ no change โ
โ QQuery 16 โ 1735.93ms โ 1755.19ms โ no change โ
โ QQuery 17 โ 1602.91ms โ 1630.27ms โ no change โ
โ QQuery 18 โ 3032.28ms โ 3107.68ms โ no change โ
โ QQuery 19 โ 85.76ms โ 85.26ms โ no change โ
โ QQuery 20 โ 1163.47ms โ 1159.24ms โ no change โ
โ QQuery 21 โ 1353.11ms โ 1348.19ms โ no change โ
โ QQuery 22 โ 2222.53ms โ 2219.31ms โ no change โ
โ QQuery 23 โ 8392.20ms โ 8530.03ms โ no change โ
โ QQuery 24 โ 472.88ms โ 476.06ms โ no change โ
โ QQuery 25 โ 400.35ms โ 409.19ms โ no change โ
โ QQuery 26 โ 546.73ms โ 536.40ms โ no change โ
โ QQuery 27 โ 1603.72ms โ 1612.58ms โ no change โ
โ QQuery 28 โ 12823.03ms โ 12680.22ms โ no change โ
โ QQuery 29 โ 547.10ms โ 540.02ms โ no change โ
โ QQuery 30 โ 830.46ms โ 837.03ms โ no change โ
โ QQuery 31 โ 869.77ms โ 868.16ms โ no change โ
โ QQuery 32 โ 2610.03ms โ 2658.05ms โ no change โ
โ QQuery 33 โ 3370.83ms โ 3400.91ms โ no change โ
โ QQuery 34 โ 3375.37ms โ 3379.85ms โ no change โ
โ QQuery 35 โ 1273.19ms โ 1281.03ms โ no change โ
โ QQuery 36 โ 127.43ms โ 130.76ms โ no change โ
โ QQuery 37 โ 57.69ms โ 58.30ms โ no change โ
โ QQuery 38 โ 127.51ms โ 128.13ms โ no change โ
โ QQuery 39 โ 208.11ms โ 199.74ms โ no change โ
โ QQuery 40 โ 48.72ms โ 52.45ms โ 1.08x slower โ
โ QQuery 41 โ 48.51ms โ 49.08ms โ no change โ
โ QQuery 42 โ 40.57ms โ 39.30ms โ no change โ
โโโโโโโโโโโโโโโโดโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโ
โ Benchmark Summary โ โ
โกโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฉ
โ Total Time (HEAD) โ 57416.25ms โ
โ Total Time (offset-overflow) โ 57682.88ms โ
โ Average Time (HEAD) โ 1335.26ms โ
โ Average Time (offset-overflow) โ 1341.46ms โ
โ Queries Faster โ 0 โ
โ Queries Slower โ 2 โ
โ Queries with No Change โ 41 โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโ
--------------------
Benchmark tpch_mem_sf1.json
--------------------
โโโโโโโโโโโโโโโโณโโโโโโโโโโโณโโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโโโ
โ Query โ HEAD โ offset-overflow โ Change โ
โกโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฉ
โ QQuery 1 โ 124.93ms โ 120.60ms โ no change โ
โ QQuery 2 โ 23.44ms โ 24.16ms โ no change โ
โ QQuery 3 โ 34.53ms โ 35.05ms โ no change โ
โ QQuery 4 โ 19.97ms โ 21.06ms โ 1.05x slower โ
โ QQuery 5 โ 55.80ms โ 55.33ms โ no change โ
โ QQuery 6 โ 12.15ms โ 11.93ms โ no change โ
โ QQuery 7 โ 102.40ms โ 104.75ms โ no change โ
โ QQuery 8 โ 25.48ms โ 26.70ms โ no change โ
โ QQuery 9 โ 61.36ms โ 65.87ms โ 1.07x slower โ
โ QQuery 10 โ 57.25ms โ 58.77ms โ no change โ
โ QQuery 11 โ 12.70ms โ 13.03ms โ no change โ
โ QQuery 12 โ 44.67ms โ 45.08ms โ no change โ
โ QQuery 13 โ 29.08ms โ 30.26ms โ no change โ
โ QQuery 14 โ 9.97ms โ 10.20ms โ no change โ
โ QQuery 15 โ 24.46ms โ 25.04ms โ no change โ
โ QQuery 16 โ 22.54ms โ 23.57ms โ no change โ
โ QQuery 17 โ 99.37ms โ 101.65ms โ no change โ
โ QQuery 18 โ 242.76ms โ 241.30ms โ no change โ
โ QQuery 19 โ 26.53ms โ 27.01ms โ no change โ
โ QQuery 20 โ 38.79ms โ 41.15ms โ 1.06x slower โ
โ QQuery 21 โ 167.04ms โ 170.63ms โ no change โ
โ QQuery 22 โ 16.74ms โ 17.56ms โ no change โ
โโโโโโโโโโโโโโโโดโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโ
โ Benchmark Summary โ โ
โกโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฉ
โ Total Time (HEAD) โ 1251.98ms โ
โ Total Time (offset-overflow) โ 1270.69ms โ
โ Average Time (HEAD) โ 56.91ms โ
โ Average Time (offset-overflow) โ 57.76ms โ
โ Queries Faster โ 0 โ
โ Queries Slower โ 3 โ
โ Queries with No Change โ 19 โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโ
```
</p>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org