Skip to content

PAX: fix SIGSEGV in SUM stats merge during DELETE on minmax columns - #1864

Open
gongxun0928 wants to merge 1 commit into
apache:mainfrom
gongxun0928:fix/issue-1767-pax-sum-stats
Open

PAX: fix SIGSEGV in SUM stats merge during DELETE on minmax columns#1864
gongxun0928 wants to merge 1 commit into
apache:mainfrom
gongxun0928:fix/issue-1767-pax-sum-stats

Conversation

@gongxun0928

Copy link
Copy Markdown
Contributor

Fixes #1767

What does this PR do?

Fixes a segment crash (SIGSEGV) that occurs when PAX tables with minmax_columns containing numeric types (int, bigint, numeric) undergo repeated DELETE operations. The crash happens in datumCopy() during the visibility-map statistics refresh path (MicroPartitionStats::MergeRawInfo()).

Two bugs are fixed in contrib/pax_storage/src/cpp/storage/micro_partition_stats.cc:

  1. Wrong type metadata in FromValue(): The serialized SUM value was deserialized using the column's physical type (typlen/typbyval) instead of the SUM aggregate's return type (rettyplen/rettypbyval). For example, sum(bigint) returns numeric, so the stored SUM datum must be interpreted as numeric, not as int8. This mismatch produced an invalid Datum that crashed in datumCopy().

  2. Swapped arguments in datumCopy(): The call passed (value, typlen, typbyval) but the wrapper signature is datumCopy(value, typByVal, typLen). This swapped pass-by-value/pass-by-reference flags, leading to memory corruption.

Type of Change

  • Bug fix (non-breaking change)

Breaking Changes

None.

Test Plan

  • Unit tests added/updated — new regression test delete_sum_stats covering DELETE + INSERT + DELETE on int, bigint, and numeric columns with minmax_columns enabled
  • Passed make installcheck
  • Passed make -C src/test installcheck-cbdb-parallel

Impact

Performance:
None — fix only affects correctness of stats merging, not the hot path.

User-facing changes:
Fixes a crash that users could hit with DELETE on PAX tables with minmax_columns.

Dependencies:
None.

Checklist

Additional Context

Root cause analysis and reproduction steps are documented in issue #1767. The crash stack trace shows the failure path:

libpostgres.so datumCopy
pax.so cbdb::datumCopy
pax.so pax::MicroPartitionStats::MergeRawInfo
pax.so pax::MicroPartitionStatsUpdater::Update
pax.so pax::TableDeleter::UpdateStatsInAuxTable
pax.so pax::TableDeleter::DeleteWithVisibilityMap

@gongxun0928
gongxun0928 force-pushed the fix/issue-1767-pax-sum-stats branch from 500a934 to e391d18 Compare July 27, 2026 06:01
When a PAX table has minmax_columns that also support SUM statistics
(e.g. int, bigint, numeric), repeated DELETE operations can crash a
segment with SIGSEGV inside datumCopy() during the visibility-map
statistics refresh path.

Two bugs were identified in MicroPartitionStats::MergeRawInfo() and
MergeTo():

1. Wrong type metadata in FromValue(): The serialized SUM value was
   deserialized using the column physical type (typlen/typbyval)
   instead of the SUM aggregate return type (rettyplen/rettypbyval).
   For example, sum(bigint) returns numeric, so the stored SUM datum
   must be interpreted as numeric, not as int8. Using the wrong type
   metadata produces an invalid Datum that may crash in datumCopy().

2. Swapped arguments in datumCopy(): The call passed (value, typlen,
   typbyval) but the wrapper signature is datumCopy(value, typByVal,
   typLen). This caused pass-by-value vs pass-by-reference confusion,
   leading to memory corruption.

Add regression test (delete_sum_stats) covering DELETE + INSERT +
DELETE on int, bigint, and numeric columns with minmax_columns enabled.

Fixes apache#1767
@gongxun0928
gongxun0928 force-pushed the fix/issue-1767-pax-sum-stats branch from 4d8c366 to afd65ab Compare July 27, 2026 11:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] PAX DELETE may crash in MergeRawInfo when merging SUM stats for minmax_columns

1 participant