github-actions[bot] commented on code in PR #68308: URL: https://github.com/apache/doris/pull/68308#discussion_r4068595593
########## regression-test/suites/query_p0/sql_functions/json_functions/test_json_extract_bool_null_payload.groovy: ########## @@ -0,0 +1,153 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +suite("test_json_extract_bool_null_payload") { + sql "DROP TABLE IF EXISTS test_json_extract_bool_null_payload" + sql """ + CREATE TABLE test_json_extract_bool_null_payload ( + id BIGINT, + j STRING, + a BIGINT, + b BIGINT + ) DUPLICATE KEY(id) + DISTRIBUTED BY HASH(id) BUCKETS 1 + PROPERTIES ("replication_num" = "1") + """ + sql """ + INSERT INTO test_json_extract_bool_null_payload + SELECT number, + CASE WHEN number % 100 = 0 + THEN '{"flag": true}' + ELSE CONCAT('{"n": ', number, '}') + END, + number + CASE number % 3 + WHEN 0 THEN 10 + WHEN 1 THEN -100 + ELSE -200000 + END, + number + FROM numbers("number" = "100000") + """ + + sql "SET enable_sql_cache = false" + sql "SET short_circuit_evaluation = false" + + order_qt_or_payload_no_short_circuit """ + SELECT v, count(*) FROM ( + SELECT JSON_EXTRACT_BOOL(JSON_PARSE_ERROR_TO_NULL(j), '\$.flag') OR (a > b) AS v + FROM test_json_extract_bool_null_payload + ) t + GROUP BY v + ORDER BY v + """ + + order_qt_and_or_payload_no_short_circuit """ + SELECT v, count(*) FROM ( + SELECT (JSON_PARSE_ERROR_TO_NULL(j) IS NOT NULL + AND JSON_EXTRACT_BOOL(JSON_PARSE_ERROR_TO_NULL(j), '\$.flag')) + OR (a > b) AS v + FROM test_json_extract_bool_null_payload + ) t + GROUP BY v + ORDER BY v + """ + + qt_case_count_no_short_circuit """ + SELECT count(*) + FROM test_json_extract_bool_null_payload + WHERE (CASE + WHEN JSON_EXTRACT_BOOL(JSON_PARSE_ERROR_TO_NULL(j), '\$.flag') OR a > b THEN b + WHEN a < b THEN a + END) IS NOT NULL + """ + + order_qt_case_branches_no_short_circuit """ Review Comment: [P1] Please cover the nullable IF consumer as part of this compatibility fix. A legacy OR can validly expose mixed condition bytes `{65,0}` (65 is SQL TRUE), and PBlock preserves them. With a nullable non-NULL THEN value and NULL ELSE, both non-short-circuit IF implementations call `apply_negated_null_map`; it computes `1 ^ 65 = 64`, so the true row becomes NULL instead of returning THEN. This is distinct from the existing regular-CASE thread: a local CASE truthiness fix leaves `FunctionIf` and `VectorizedIfExpr` wrong. Canonicalize before using Boolean bytes as null maps (or enforce the boundary earlier) and test this shape with both short-circuit settings. ########## be/src/exprs/vcompound_pred.h: ########## @@ -648,7 +649,9 @@ class VCompoundPred : public VectorizedFnCall { res_data[i] = lhs_data[i] & rhs_data[i]; } else { res_null[i] = apply_or_null(lhs_data[i], lhs_null[i], rhs_data[i], rhs_null[i]); - res_data[i] = lhs_data[i] | rhs_data[i]; + // A NULL row may carry an arbitrary nested byte. If the result remains NULL the + // byte is ignored; otherwise normalization prevents it from becoming visible. + res_data[i] = (lhs_data[i] | rhs_data[i]) != 0; Review Comment: [P1] Keep both synthesized null maps alive here. A planned `Nullable(Boolean)` child may legally return a physical non-nullable `ColumnUInt8` for an all-non-null batch (`VExpr` explicitly permits this). If both children do so with mixed values, no shortcut fires and `vector_vector_null` calls `create_null_map_column` twice through the same `temp_null_map` owner. The second assignment destroys the first zero map, leaving `lhs_null_map_tmp` dangling before `do_null_pred` reads it in this loop. Under ASAN this is a use-after-free; otherwise result nullness comes from freed memory. Please retain two owners or deliberately share one live zero map, and add a planned-nullable case with two mixed physical non-nullable children. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
