PAX: fix SIGSEGV in SUM stats merge during DELETE on minmax columns - #1864
Open
gongxun0928 wants to merge 1 commit into
Open
PAX: fix SIGSEGV in SUM stats merge during DELETE on minmax columns#1864gongxun0928 wants to merge 1 commit into
gongxun0928 wants to merge 1 commit into
Conversation
gongxun0928
force-pushed
the
fix/issue-1767-pax-sum-stats
branch
from
July 27, 2026 06:01
500a934 to
e391d18
Compare
When a PAX table has minmax_columns that also support SUM statistics (e.g. int, bigint, numeric), repeated DELETE operations can crash a segment with SIGSEGV inside datumCopy() during the visibility-map statistics refresh path. Two bugs were identified in MicroPartitionStats::MergeRawInfo() and MergeTo(): 1. Wrong type metadata in FromValue(): The serialized SUM value was deserialized using the column physical type (typlen/typbyval) instead of the SUM aggregate return type (rettyplen/rettypbyval). For example, sum(bigint) returns numeric, so the stored SUM datum must be interpreted as numeric, not as int8. Using the wrong type metadata produces an invalid Datum that may crash in datumCopy(). 2. Swapped arguments in datumCopy(): The call passed (value, typlen, typbyval) but the wrapper signature is datumCopy(value, typByVal, typLen). This caused pass-by-value vs pass-by-reference confusion, leading to memory corruption. Add regression test (delete_sum_stats) covering DELETE + INSERT + DELETE on int, bigint, and numeric columns with minmax_columns enabled. Fixes apache#1767
gongxun0928
force-pushed
the
fix/issue-1767-pax-sum-stats
branch
from
July 27, 2026 11:22
4d8c366 to
afd65ab
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1767
What does this PR do?
Fixes a segment crash (SIGSEGV) that occurs when PAX tables with
minmax_columnscontaining numeric types (int, bigint, numeric) undergo repeated DELETE operations. The crash happens indatumCopy()during the visibility-map statistics refresh path (MicroPartitionStats::MergeRawInfo()).Two bugs are fixed in
contrib/pax_storage/src/cpp/storage/micro_partition_stats.cc:Wrong type metadata in
FromValue(): The serialized SUM value was deserialized using the column's physical type (typlen/typbyval) instead of the SUM aggregate's return type (rettyplen/rettypbyval). For example,sum(bigint)returnsnumeric, so the stored SUM datum must be interpreted asnumeric, not asint8. This mismatch produced an invalidDatumthat crashed indatumCopy().Swapped arguments in
datumCopy(): The call passed(value, typlen, typbyval)but the wrapper signature isdatumCopy(value, typByVal, typLen). This swapped pass-by-value/pass-by-reference flags, leading to memory corruption.Type of Change
Breaking Changes
None.
Test Plan
delete_sum_statscovering DELETE + INSERT + DELETE on int, bigint, and numeric columns withminmax_columnsenabledmake installcheckmake -C src/test installcheck-cbdb-parallelImpact
Performance:
None — fix only affects correctness of stats merging, not the hot path.
User-facing changes:
Fixes a crash that users could hit with DELETE on PAX tables with minmax_columns.
Dependencies:
None.
Checklist
Additional Context
Root cause analysis and reproduction steps are documented in issue #1767. The crash stack trace shows the failure path: