Server crashes on executing "SELECT COUNT FROM iceberg_scan(...)"

[saygoodbyye]

What happens?

duckdb/pg_duckdb#497
Server crashes when executing the script below
PostgreSQL build:

CFLAGS='-Og' ./configure --enable-tap-tests --with-openssl --enable-debug --enable-cassert --with-icu --with-lz4 --with-libxml

To Reproduce

CREATE EXTENSION pg_duckdb;
SELECT duckdb.install_extension('iceberg');
SELECT COUNT(a) FROM iceberg_scan('/home/test/pg_duckdb/test/regression/data/table.json') AS (a INT);

backtrace:

#0  0x00007ea4f151159b in duckdb::IcebergSnapshot::GetParseInfo(duckdb_yyjson::yyjson_doc&) () from /tmp/pgsql/data/duckdb_extensions/v1.1.3/linux_amd64/iceberg.duckdb_extension
#1  0x00007ea4f1511fad in duckdb::IcebergSnapshot::GetParseInfo(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, duckdb::FileSystem&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >) ()
   from /tmp/pgsql/data/duckdb_extensions/v1.1.3/linux_amd64/iceberg.duckdb_extension
#2  0x00007ea4f151231f in duckdb::IcebergSnapshot::GetLatestSnapshot(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, duckdb::FileSystem&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, bool) ()
   from /tmp/pgsql/data/duckdb_extensions/v1.1.3/linux_amd64/iceberg.duckdb_extension
#3  0x00007ea4f152bcc7 in duckdb::IcebergScanBindReplace(duckdb::ClientContext&, duckdb::TableFunctionBindInput&) () from /tmp/pgsql/data/duckdb_extensions/v1.1.3/linux_amd64/iceberg.duckdb_extension
#4  0x00007ea5016a5142 in duckdb::Binder::BindTableFunctionInternal(duckdb::TableFunction&, duckdb::TableFunctionRef const&, duckdb::vector<duckdb::Value, true>, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, duckdb::Value, duckdb::CaseInsensitiveStringHashFunction, duckdb::CaseInsensitiveStringEquality, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, duckdb::Value> > >, duckdb::vector<duckdb::LogicalType, true>, duckdb::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, true>) () from /tmp/pgsql/lib/libduckdb.so
#5  0x00007ea5016ad05b in duckdb::Binder::Bind(duckdb::TableFunctionRef&) () from /tmp/pgsql/lib/libduckdb.so
#6  0x00007ea501700375 in duckdb::Binder::Bind(duckdb::TableRef&) () from /tmp/pgsql/lib/libduckdb.so
#7  0x00007ea5016611bd in duckdb::Binder::BindNode(duckdb::SelectNode&) () from /tmp/pgsql/lib/libduckdb.so
#8  0x00007ea50170143a in duckdb::Binder::BindNode(duckdb::QueryNode&) () from /tmp/pgsql/lib/libduckdb.so
#9  0x00007ea5017015e4 in duckdb::Binder::Bind(duckdb::QueryNode&) () from /tmp/pgsql/lib/libduckdb.so
#10 0x00007ea50166c70e in duckdb::Binder::Bind(duckdb::SelectStatement&) () from /tmp/pgsql/lib/libduckdb.so
#11 0x00007ea5017013c5 in duckdb::Binder::Bind(duckdb::SQLStatement&) () from /tmp/pgsql/lib/libduckdb.so
#12 0x00007ea50170b4d9 in duckdb::Planner::CreatePlan(duckdb::SQLStatement&) () from /tmp/pgsql/lib/libduckdb.so
#13 0x00007ea50272b8c9 in duckdb::ClientContext::CreatePreparedStatementInternal(duckdb::ClientContextLock&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::optional_ptr<std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, duckdb::BoundParameterData, duckdb::CaseInsensitiveStringHashFunction, duckdb::CaseInsensitiveStringEquality, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, duckdb::BoundParameterData> > >, true>) () from /tmp/pgsql/lib/libduckdb.so
#14 0x00007ea50272c689 in duckdb::ClientContext::CreatePreparedStatement(duckdb::ClientContextLock&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::optional_ptr<std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, duckdb::BoundParameterData, duckdb::CaseInsensitiveStringHashFunction, duckdb::CaseInsensitiveStringEquality, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, duckdb::BoundParameterData> > >, true>, duckdb::PreparedStatementMode) () from /tmp/pgsql/lib/libduckdb.so
#15 0x00007ea50272c97f in std::_Function_handler<void (), duckdb::ClientContext::PrepareInternal(duckdb::ClientContextLock&, duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>)::{lambda()#1}>::_M_invoke(std::_Any_data const&) ()
   from /tmp/pgsql/lib/libduckdb.so
#16 0x00007ea5027186e5 in duckdb::ClientContext::RunFunctionInTransactionInternal(duckdb::ClientContextLock&, std::function<void ()> const&, bool) () from /tmp/pgsql/lib/libduckdb.so
#17 0x00007ea502718c39 in duckdb::ClientContext::PrepareInternal(duckdb::ClientContextLock&, duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>) () from /tmp/pgsql/lib/libduckdb.so
#18 0x00007ea5027342fa in duckdb::ClientContext::Prepare(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) () from /tmp/pgsql/lib/libduckdb.so
#19 0x00007ea50689ba08 in DuckdbPrepare (query=query@entry=0x5adcbb1eb450) at /usr/include/c++/13/bits/basic_string.tcc:242
#20 0x00007ea50689bbbe in CreatePlan (throw_error=<optimized out>, query=0x5adcbb1eb450) at src/pgduckdb_planner.cpp:61
#21 pgduckdb::__CPPFunctionGuard__<Plan* (*)(Query*, bool), CreatePlan, Query*, bool> (func_name=0x7ea5068d1ba2 "DuckdbPlanNode") at src/pgduckdb_planner.cpp:147
#22 0x00007ea50689bef6 in DuckdbPlanNode (parse=parse@entry=0x5adcbb1eb450, query_string=query_string@entry=0x5adcbb1e9ff0 "SELECT COUNT(a) FROM iceberg_scan('/home/test/pg_duckdb/test/regression/data/table.json') AS (a INT);", cursor_options=cursor_options@entry=2048,
    bound_params=bound_params@entry=0x0, throw_error=throw_error@entry=true) at src/pgduckdb_planner.cpp:147
#23 0x00007ea50689203c in DuckdbPlannerHook_Cpp (bound_params=0x0, cursor_options=2048, query_string=0x5adcbb1e9ff0 "SELECT COUNT(a) FROM iceberg_scan('/home/test/pg_duckdb/test/regression/data/table.json') AS (a INT);", parse=0x5adcbb1eb450) at src/pgduckdb_hooks.cpp:199
#24 pgduckdb::__CPPFunctionGuard__<PlannedStmt* (*)(Query*, char const*, int, ParamListInfoData*), DuckdbPlannerHook_Cpp, Query*, char const*, int, ParamListInfoData*> (func_name=0x7ea5068d1792 "DuckdbPlannerHook") at src/pgduckdb_hooks.cpp:232
#25 0x00005adcba091b6d in planner (parse=parse@entry=0x5adcbb1eb450, query_string=query_string@entry=0x5adcbb1e9ff0 "SELECT COUNT(a) FROM iceberg_scan('/home/test/pg_duckdb/test/regression/data/table.json') AS (a INT);", cursorOptions=cursorOptions@entry=2048,
    boundParams=boundParams@entry=0x0) at planner.c:280
#26 0x00005adcba17c387 in pg_plan_query (querytree=querytree@entry=0x5adcbb1eb450, query_string=query_string@entry=0x5adcbb1e9ff0 "SELECT COUNT(a) FROM iceberg_scan('/home/test/pg_duckdb/test/regression/data/table.json') AS (a INT);", cursorOptions=cursorOptions@entry=2048,
    boundParams=boundParams@entry=0x0) at postgres.c:908
#27 0x00005adcba17c43d in pg_plan_queries (querytrees=0x5adcbb33b3b8, query_string=query_string@entry=0x5adcbb1e9ff0 "SELECT COUNT(a) FROM iceberg_scan('/home/test/pg_duckdb/test/regression/data/table.json') AS (a INT);", cursorOptions=cursorOptions@entry=2048,
    boundParams=boundParams@entry=0x0) at postgres.c:1000
#28 0x00005adcba17c89f in exec_simple_query (query_string=query_string@entry=0x5adcbb1e9ff0 "SELECT COUNT(a) FROM iceberg_scan('/home/test/pg_duckdb/test/regression/data/table.json') AS (a INT);") at postgres.c:1197
#29 0x00005adcba17e8ac in PostgresMain (dbname=<optimized out>, username=<optimized out>) at postgres.c:4767
#30 0x00005adcba177ec6 in BackendMain (startup_data=<optimized out>, startup_data_len=<optimized out>) at backend_startup.c:105
#31 0x00005adcba0d2530 in postmaster_child_launch (child_type=child_type@entry=B_BACKEND, startup_data=startup_data@entry=0x7ffca9e9ab54 "", startup_data_len=startup_data_len@entry=4, client_sock=client_sock@entry=0x7ffca9e9ab90) at launch_backend.c:277
#32 0x00005adcba0d6c20 in BackendStartup (client_sock=client_sock@entry=0x7ffca9e9ab90) at postmaster.c:3592
#33 0x00005adcba0d6e9a in ServerLoop () at postmaster.c:1674
#34 0x00005adcba0d850c in PostmasterMain (argc=argc@entry=3, argv=argv@entry=0x5adcbb1a4110) at postmaster.c:1372
#35 0x00005adcb9ff990d in main (argc=3, argv=0x5adcbb1a4110) at main.c:199

OS:

Ubuntu 24.04

pg_duckdb Version (if built from source use commit hash):

4bf2a24b9470fc26b16191c8d7799f1b66ac23f2

Postgres Version (if built from source use commit hash):

ff9dc96f370aa33a5c1c578c43c598473705d82f

Hardware:

No response

Full Name:

Egor Chindyaskin

Affiliation:

Postgres Professional

[teaguesterling]

Adding a comment from duckdb/pg_duckdb#497 that this is occurring when attempting to read a random JSON file as an Iceberg catalog. Related, I've seen crashes when accidentally attempting to read random files as iceberg catalogs as well. However, those failed as segfaults. I'll investigate where the errors are occurring in GetParseInfo and seeing if we can add some more error handling.

This is failing attempting to load https://github.com/duckdb/pg_duckdb/blob/main/test/regression/data/table.json, which is a simple json data file like:

{"a":1,"b":"json_1","c":1.5}
{"a":2,"b":"json_2","c":2.5}
{"a":3,"b":"json_3","c":3.5}
{"a":4,"b":"json_4","c":4.5}
...