You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@datafusion.apache.org by "tobixdev (via GitHub)" <gi...@apache.org> on 2025/11/21 11:09:06 UTC

[I] Panic in NestedLoopJoin with Nullable FixedSizeBinary Arrays [datafusion]

tobixdev opened a new issue, #18870:
URL: https://github.com/apache/datafusion/issues/18870

   ### Describe the bug
   
   Executing the query plan from below causes the following crash:
   
   ```
   thread 'test::test_nested_join_fixed_size_binary' (33301) panicked at /home/tschwarzinger/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/arrow-buffer-57.0.0/src/buffer/immutable.rs:300:9:
   the offset of the new Buffer cannot exceed the existing length: slice offset=0 length=8 selflen=0
   ```
   
   Interestingly, the crash does not occur if we remove the [`None`] values from the reproducer. I.e., using
   
   ```
   ctx.register_table("t1", fsb_table("left", vec![Some(b"0001")]))?;
   ctx.register_table("t2", fsb_table("right", vec![Some(b"0001")]))?;
   ```
   
   does not crash.
   
   ### To Reproduce
   
   ```rust
   use anyhow::Result;
   use datafusion::arrow::array::{ArrayRef, FixedSizeBinaryArray, RecordBatch};
   use datafusion::arrow::datatypes::{DataType, Field, Schema};
   use datafusion::datasource::MemTable;
   use datafusion::execution::context::SessionContext;
   use datafusion::prelude::*;
   use std::sync::Arc;
   
   /// Build a FixedSizeBinary(4) array from byte slices.
   fn fsb(values: &[Option<&[u8; 4]>]) -> ArrayRef {
       let arr = FixedSizeBinaryArray::from(
           values
               .iter()
               .map(|o| o.map(|x| x.as_slice()))
               .collect::<Vec<_>>(),
       );
       Arc::new(arr)
   }
   
   /// Create a MemTable with a single FixedSizeBinary(4) column
   fn fsb_table(col_name: &str, data: Vec<Option<&[u8; 4]>>) -> Arc<MemTable> {
       let schema = Arc::new(Schema::new(vec![Field::new(
           col_name,
           DataType::FixedSizeBinary(4),
           true,
       )]));
   
       let batch = RecordBatch::try_new(schema.clone(), vec![fsb(&data)]).unwrap();
   
       Arc::new(MemTable::try_new(schema, vec![vec![batch]]).unwrap())
   }
   
   #[tokio::test]
   async fn test_nested_join_fixed_size_binary() -> Result<()> {
       let ctx = SessionContext::new();
   
       ctx.register_table("t1", fsb_table("left", vec![Some(b"0001"), None]))?;
       ctx.register_table("t2", fsb_table("right", vec![Some(b"0001"), None]))?;
   
       let df = ctx.table("t1").await?.join(
           ctx.table("t2").await?,
           JoinType::Left,
           &[],
           &[],
           Some(lit(true)),
       )?;
   
       assert_eq!(
           df.to_string().await.unwrap(),
           "Join: left join (t1#0 = t2#0)"
       );
   
       Ok(())
   }
   ```
   
   ### Expected behavior
   
   Not crashing and producing a result.
   
   ### Additional context
   
   The Query Plan:
   
   ```
   +---------------+-----------------------------------------------------+
   | plan_type     | plan                                                |
   +---------------+-----------------------------------------------------+
   | logical_plan  | Left Join:                                          |
   |               |   TableScan: t1 projection=[left]                   |
   |               |   TableScan: t2 projection=[right]                  |
   | physical_plan | NestedLoopJoinExec: join_type=Left                  |
   |               |   DataSourceExec: partitions=1, partition_sizes=[1] |
   |               |   DataSourceExec: partitions=1, partition_sizes=[1] |
   |               |                                                     |
   +---------------+-----------------------------------------------------+
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org


Re: [I] `ScalarValue::to_array_of_size` Does Not Correctly Allocate a Values Buffer for `ScalarValue::FixedSizeBinary` [datafusion]

Posted by "tobixdev (via GitHub)" <gi...@apache.org>.
tobixdev commented on issue #18870:
URL: https://github.com/apache/datafusion/issues/18870#issuecomment-3569494645

   > We can potentially consider backporting https://github.com/apache/datafusion/pull/17562 to the 51.1.0 patch
   
   I am not sure whether this is necessary, as the bug is just hidden in a few cases. I've created a PR for a temporary fix in `to_array_of_size` that we could backport. 
   
   https://github.com/apache/datafusion/pull/18903
   
   I am also fine with waiting for a new arrow-rs release though. In that case we can close the PR above.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org


Re: [I] Panic in NestedLoopJoin with Nullable FixedSizeBinary Arrays [datafusion]

Posted by "tobixdev (via GitHub)" <gi...@apache.org>.
tobixdev commented on issue #18870:
URL: https://github.com/apache/datafusion/issues/18870#issuecomment-3563111499

   I think I found the root cause. `FixedSizeBinaryArray::new_null` [does not correctly set the length of the values buffer](https://github.com/apache/arrow-rs/issues/8900).
   
   The NL-Join implementation creates a scalar from the left-side of the join and then calls `to_array_of_size` (`datafusion/physical-plan/src/joins/nested_loop_join.rs:1953`), which in turn calls `FixedSizeBinaryArray::new_null`:
   
   ```rust
     // ScalarValue::to_array_of_size for FixedSizeBinaryArray
     ScalarValue::FixedSizeBinary(s, e) => match e {
         Some(value) => Arc::new(
             FixedSizeBinaryArray::try_from_sparse_iter_with_size(
                 repeat_n(Some(value.as_slice()), size),
                 *s,
             )
             .unwrap(),
         ),
         None => Arc::new(FixedSizeBinaryArray::new_null(*s, size)), // <---- The call
     },
   ```
   
   As the value buffer was not as long as expected, the slice operations panic during the execution of the join. This happens when the `ScalarValue` that get's extracted from the left join side is `None`.
   
   I've compiled the [51.1 patch](https://github.com/apache/datafusion/pull/18820) against my fix in https://github.com/apache/arrow-rs/pull/8901 and it seems like this resolves our problems.
   
   @2010YOUY01 maybe you could quickly check if this explanation makes sense, as you're familar with the NL Join. 🙏 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org


Re: [I] Panic in NestedLoopJoin with Nullable FixedSizeBinary Arrays [datafusion]

Posted by "tobixdev (via GitHub)" <gi...@apache.org>.
tobixdev commented on issue #18870:
URL: https://github.com/apache/datafusion/issues/18870#issuecomment-3562992928

   So I am further going down some rabbit holes. I think the issue is not really with DataFusion but it's something in arrow-rs. I'll write down my findings and link an issue.
   
   And thanks! @Jefffrey 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org


Re: [I] Panic in NestedLoopJoin with Nullable FixedSizeBinary Arrays [datafusion]

Posted by "2010YOUY01 (via GitHub)" <gi...@apache.org>.
2010YOUY01 commented on issue #18870:
URL: https://github.com/apache/datafusion/issues/18870#issuecomment-3565683568

   > I think I found the root cause. `FixedSizeBinaryArray::new_null` [does not correctly set the length of the values buffer](https://github.com/apache/arrow-rs/issues/8900).
   > 
   > The NL-Join implementation creates a scalar from the left-side of the join and then calls `to_array_of_size` (`datafusion/physical-plan/src/joins/nested_loop_join.rs:1953`), which in turn calls `FixedSizeBinaryArray::new_null`:
   > 
   >   // ScalarValue::to_array_of_size for FixedSizeBinaryArray
   >   ScalarValue::FixedSizeBinary(s, e) => match e {
   >       Some(value) => Arc::new(
   >           FixedSizeBinaryArray::try_from_sparse_iter_with_size(
   >               repeat_n(Some(value.as_slice()), size),
   >               *s,
   >           )
   >           .unwrap(),
   >       ),
   >       None => Arc::new(FixedSizeBinaryArray::new_null(*s, size)), // <---- The call
   >   },
   > As the value buffer was not as long as expected, the slice operations panic during the execution of the join. This happens when the `ScalarValue` that get's extracted from the left join side is `None`.
   > 
   > I've compiled the [51.1 patch](https://github.com/apache/datafusion/pull/18820) against my fix in [apache/arrow-rs#8901](https://github.com/apache/arrow-rs/pull/8901) and it seems like this resolves our problems.
   > 
   > [@2010YOUY01](https://github.com/2010YOUY01) maybe you could quickly check if this explanation makes sense, as you're familar with the NL Join. 🙏
   
   Yes, that makes sense. Thank you for the careful investigations and the fix.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org


Re: [I] Panic in NestedLoopJoin with Nullable FixedSizeBinary Arrays [datafusion]

Posted by "tobixdev (via GitHub)" <gi...@apache.org>.
tobixdev closed issue #18870: Panic in NestedLoopJoin with Nullable FixedSizeBinary Arrays
URL: https://github.com/apache/datafusion/issues/18870


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org


Re: [I] Panic in NestedLoopJoin with Nullable FixedSizeBinary Arrays [datafusion]

Posted by "tobixdev (via GitHub)" <gi...@apache.org>.
tobixdev commented on issue #18870:
URL: https://github.com/apache/datafusion/issues/18870#issuecomment-3562808534

   Ok I've looked a bit into the PR and it seems like we just hit the fast path that was added in the PR and therefore the bug was not exercised.
   
   I've update the reproducer such that it also crashed on the newest main.  
   
   The difference is that we now create a large enough right-hand-side such that the fast path isn't exercised.
   
   @alamb Sorry for prematurely closing the ticket. Could you please re-open it?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org


Re: [I] Panic in NestedLoopJoin with Nullable FixedSizeBinary Arrays [datafusion]

Posted by "tobixdev (via GitHub)" <gi...@apache.org>.
tobixdev commented on issue #18870:
URL: https://github.com/apache/datafusion/issues/18870#issuecomment-3562766099

   Fixed in #17562 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org


Re: [I] Panic in NestedLoopJoin with Nullable FixedSizeBinary Arrays [datafusion]

Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on issue #18870:
URL: https://github.com/apache/datafusion/issues/18870#issuecomment-3563292490

   We can potentially consider backporting https://github.com/apache/datafusion/pull/17562 to the 51.1.0 patch
   - #18843 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org


Re: [I] `ScalarValue::to_array_of_size` Does Not Correctly Allocate a Values Buffer for `ScalarValue::FixedSizeBinary` [datafusion]

Posted by "Jefffrey (via GitHub)" <gi...@apache.org>.
Jefffrey closed issue #18870: `ScalarValue::to_array_of_size` Does Not Correctly Allocate a Values Buffer for `ScalarValue::FixedSizeBinary`
URL: https://github.com/apache/datafusion/issues/18870


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: github-unsubscribe@datafusion.apache.org
For additional commands, e-mail: github-help@datafusion.apache.org