yjhjstz opened a new pull request, #1619:
URL: https://github.com/apache/cloudberry/pull/1619

   ## Summary
   
   - Fix use-after-free in `flatten_join_alias_var_optimizer` where 
unconditional `pfree`/`list_free` freed live nodes when 
`flatten_join_alias_vars` returned the same pointer unchanged
   - Fix ORCA incorrectly decorrelating `GROUP BY () HAVING <outer_ref>` 
subqueries, which returned `0` instead of `NULL` when the HAVING condition was 
false
   
   ## Root Cause
   
   **use-after-free (`clauses.c`):** `pfree(havingQual)` freed the `v.c` Var 
node unconditionally. The freed memory was reused by `palloc` for a `T_List` 
(nodeTag=596). When `copyObjectImpl` later read `havingQual`, it copied the 
wrong node type, causing ORCA to encounter an unexpected `RangeTblEntry` and 
fall back to the Postgres planner — which masked the second bug.
   
   **ORCA decorrelation (`CSubqueryHandler.cpp`):** After fixing the 
use-after-free, ORCA no longer fell back and attempted to decorrelate the 
subquery. It converted `GROUP BY () HAVING <outer_ref>` into `Left Outer Join + 
COALESCE(count(*), 0)`, incorrectly returning `0` instead of `NULL` when the 
HAVING condition was false.
   
   ## Fix
   
   1. Guard all `pfree`/`list_free` calls in `flatten_join_alias_var_optimizer` 
with pointer-equality checks
   2. Detect correlated `CLogicalSelect` above `CLogicalGbAgg[GROUP BY()]` in 
`Psd()` and force `m_fCorrelatedExecution = true` to use SubPlan instead of 
decorrelation
   3. Update `groupingsets_optimizer.out` expected output for the new ORCA 
SubPlan format
   
   ## Test plan
   
   - [x] `groupingsets` test passes with correct result (`f | NULL`, `t | 9`)
   - [x] `parallel_schedule` passes (228 tests, `groupingsets` ok; 6 
pre-existing failures unrelated)
   - [x] EXPLAIN confirms ORCA SubPlan execution instead of Postgres planner 
fallback
   
   Fixes https://github.com/apache/cloudberry/issues/1618


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to