fix(group): table distinct declared zero-length agg VLAs on the hash path (#515) - #516
Merged
Merged
Conversation
… (n_aggs == 0) is not UB A table `distinct` is executed as a grouped plan with no aggregates. Once the input is large enough to take the hash group path, exec_group_run declared `agg_outs[n_aggs]` / `agg_cols[n_aggs]` with n_aggs == 0. A zero-length VLA is undefined behaviour; the release build tolerated it and answered correctly, the default sanitized debug build aborted with "variable length array bound evaluates to non-positive value 0". Size both VLAs by the existing vla_aggs (= max(n_aggs, 1)) guard that the function already uses for its other agg scratch. Every loop over them is bounded by n_aggs, so behaviour is unchanged. Adds a regression .rfl with the reported STR-key shape plus SYM and two-column keys. Closes #515 Claude-Session: https://claude.ai/code/session_01UQRURGab9d9Fjma6uekEzY
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
A table
distinctis executed as a grouped plan with no aggregates. Once the input is large enough to take the hash group path,exec_group_rundeclaredagg_outs[n_aggs]/agg_cols[n_aggs]withn_aggs == 0. A zero-length VLA is undefined behaviour (C17 6.7.6.2p5); the release build tolerated it and answered correctly, but the default sanitized debug build aborted withvariable length array bound evaluates to non-positive value 0.The function already carries a
vla_aggs(= max(n_aggs, 1)) guard for its other aggregate scratch. This sizes both VLAs by that guard. Every loop over them is bounded byn_aggs, so behaviour is unchanged for real aggregates. The other variable-bound VLAs ingroup.cwere checked: key-sized ones usevla_keys, and the expression-input scratch sits behind an early return that fires when there are no aggregates.Adds
test/rfl/group/distinct_zero_agg_vla.rflwith the reported STR-key shape (100k rows / 9k distinct) plus SYM and two-column keys. Before the fix the sanitized test binary aborts on it; after, it passes and the full suite reports 3777/3777 with no UBSan runtime errors.Closes #515
Checklist
dev(notmaster)feat:/fix:/perf:/docs:/ …)makebuilds cleanly (no new warnings)make testpasses; tests added/updated for behaviour changeshttps://claude.ai/code/session_01UQRURGab9d9Fjma6uekEzY