kszucs commented on PR #45001: URL: https://github.com/apache/arrow/pull/45001#issuecomment-5664317848
Picking up the two suppressed comments from the [last review](https://github.com/apache/arrow/pull/45001#pullrequestreview-5179865073) — the second is a real bug, fixed in 7b1d5569a7. **`fixed_size_binary` null scalar** — not reachable. `MakeNullScalar(fixed_size_binary(4))` carries a non-null `value`, and a null-valued one cannot be constructed at all: `FixedSizeBinaryScalar`'s constructor dereferences `this->value->size()` unguarded, so it segfaults there, before any kernel runs. **`fixed_size_list` null scalar** — real, though not via the suggested repro (`MakeNullScalar(fixed_size_list(int32(), 8))` also carries a properly sized child). `FixedSizeListScalar(nullptr, type, /*is_valid=*/false)` is legal — it and `BaseListScalar` both guard their invariant checks on `if (this->value)`, and `FillFromScalar`'s comment reads "when the scalar is null, scalar.value can also be null". `FillFromScalar` then substitutes a zero-length child via `FillZeroLengthArray`, whose buffers point at a static 16-byte `kZeros` with `size == 0`, while `HashListArray` still derives its range from `list_size`. Instrumented, that asked for `8 elems of child length 0 (child buf1 size=0)`; the new test segfaults without the fix. Fixed by clamping the range to what the child actually holds, in the fold as well as in the `HashChild` call. To confirm the clamp can't bite on real data I instrumented it to report every time it changes the range and ran the full suite: it fires only on `child.length == 0`, never once on a real array across all 66 suites (Acero included), all green. `NullFixedSizeListScalarWithoutChild` covers `int32`/`int64`/`utf8`/`fixed_size_binary(3)` children at list sizes 0/1/8/33, a nested-in-struct case, and the sibling list/large_list/map/list-of-fsl scalars — those take their range from offsets, which a null scalar fills with `{0, 0}`, so they were already safe. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
