geoHeil opened a new issue, #27315:
URL: https://github.com/apache/datafusion/issues/27315
### Describe the bug
`WindowAggExec::try_new` and `BoundedWindowAggExec::try_new` index
`window_expr[0]` when the list is empty. Both constructors return `Result`, but
this input panics instead of returning an error.
The physical plan decoder reaches these constructors when a
`WindowAggExecNode` contains a valid child and no `window_expr` entries. With
`panic = "abort"`, decoding that node stops the process.
### To reproduce
```rust
use std::sync::Arc;
use arrow::datatypes::Schema;
use datafusion_physical_plan::empty::EmptyExec;
use datafusion_physical_plan::windows::{BoundedWindowAggExec, WindowAggExec};
use datafusion_physical_plan::InputOrderMode;
let input = Arc::new(EmptyExec::new(Arc::new(Schema::empty())));
WindowAggExec::try_new(vec![], input.clone(), false); // panics
BoundedWindowAggExec::try_new(vec![], input, InputOrderMode::Linear, false);
// panics
```
The first panic was found in a peer-plan fuzz run using DataFusion 55.1.0:
https://github.com/telekom/sutura/actions/runs/42873920210/job/130032073633
The unchanged input is 21 bytes, base64 `ehMKBhoECgAQARoEEgKgARgUUIBA`. The
failure is `index out of bounds: the len is 0 but the index is 0` in
`windows/window_agg_exec.rs`. The current upstream source also has the
unchecked first-element reads in both constructors; I have not run the
reproducer on upstream main.
### Expected behavior
Return `DataFusionError::Plan` when there is no window expression, before
deriving the schema or partition properties. Nonempty window plans keep their
current behavior.
### Additional context
We are preparing a small vendored fix and worker-decode regression tests in
sutura. This report is limited to the empty expression list. It does not
establish that every malformed physical plan is refused.
AI assistance was used to investigate and draft this report.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
