realAaronWu commented on issue #435: URL: https://github.com/apache/paimon-cpp/issues/435#issuecomment-6294611295
We are discontinuing the expanded implementation in #440; this issue remains open. Existing whole-call waiting can suppress a late result, but does not provide in-call cancellation or pre-materialization planning-memory admission. Two narrower native safety requirements also remain, independently of a cancellation API. The examples below were source-reviewed at `dddfda5ed35792035c3cd14fd19663dc3d298253`; runtime fault injection has **not** been performed: - **Drain accepted work on failure.** [`CollectAll`](https://github.com/apache/paimon-cpp/blob/dddfda5ed35792035c3cd14fd19663dc3d298253/src/paimon/common/utils/future.h#L100) can unwind on allocation or a throwing `get()` before later accepted work is collected. Planner submissions borrow scan/snapshot state. [`SnapshotFileCollector::ReadManifests`](https://github.com/apache/paimon-cpp/blob/dddfda5ed35792035c3cd14fd19663dc3d298253/src/paimon/core/operation/snapshot_file_scan.cpp#L179) also has a later-manifest Status return after earlier work may have been submitted. The accepted work must not outlive borrowed planner/collector state. Test the actual planning/ListFiles entry points with one accepted task gated, a later Status/exception/submission failure, and release/drain assertions before return or unwinding. Preserve the first failure; do not return a partial successful plan/file list. Include nested single-worker progress separately from startup acceptance fixed in #436. - **Keep exported Arrow roots owned if lifetime-holder allocation throws.** [`AddArrowArrayLifetime`](https://github.com/apache/paimon-cpp/blob/dddfda5ed35792035c3cd14fd19663dc3d298253/src/paimon/common/utils/arrow/mem_utils.cpp#L151) allocates its holder after export. Callers such as [`ManifestMetaReader::NextBatch`](https://github.com/apache/paimon-cpp/blob/dddfda5ed35792035c3cd14fd19663dc3d298253/src/paimon/manifest/manifest_meta_reader.cpp#L60) hold ordinary C-struct shells, whose deletion does not invoke the C release callbacks. Inject that exact post-export allocation failure and verify both callbacks exactly once, original error identity and actual affected reader paths. This is distinct from the retained-batch lifetime work in #259/#260 and from rejecting an empty lifetime argument; it does not require a new cancellation framework or converting every OOM into an allocating Status. These are source-confirmed failure-path gaps, not claims of reproduced crashes or completed fixes. Planning admission/bounded retained containers, accepted-work draining/progress and any future agreed cancellation responsiveness remain separate acceptance requirements. Closing #440 must not mark them complete. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
