{"record":{"id":"3dda76ba8f49c3c0","repo":"databendlabs/databend","slug":"transfer-target-state-offsets-overflow","errorCode":null,"errorMessage":"transfer target state offsets overflow","messagePattern":"transfer target state offsets overflow","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/query/expression/src/aggregate/payload.rs","lineNumber":104,"sourceCode":"                .into_iter()\n                .map(|(page_index, offset)| (payload_index, page_index, offset)),\n        );\n    }\n\n    fn commit(self, payloads: &mut [Payload]) {\n        for (payload_index, page_index, offset) in self.offsets {\n            let payload = payloads\n                .get_mut(payload_index)\n                .expect(\"transfer target payload index is out of bounds\");\n\n            let page = payload\n                .pages\n                .get_mut(page_index)\n                .expect(\"transfer target page index is out of bounds\");\n            let next_state_offsets = page\n                .state_offsets\n                .checked_add(offset)\n                .expect(\"transfer target state offsets overflow\");\n            let initialized_states = page\n                .rows\n                .checked_mul(payload.aggrs.len())\n                .expect(\"transfer target initialized states overflow\");\n\n            assert!(\n                next_state_offsets <= initialized_states,\n                \"transfer target state offsets exceed initialized aggregate states\"\n            );\n            page.state_offsets = next_state_offsets;\n        }\n    }\n}\n\nimpl<'a> PayloadTransferBatch<'a> {\n    pub(super) fn from_flush_state(flush_state: &'a PayloadFlushState) -> Self {\n        Self {\n            rows: flush_state.row_count,","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/databendlabs/databend/blob/288d84d76e20a2f8f7173bda9691eb6ece301aa9/src/query/expression/src/aggregate/payload.rs#L86-L122","documentation":"In commit(), the destination page's state_offsets is advanced via checked_add(offset). This panic fires when that addition overflows the offset integer type, meaning the accumulated state offsets in the target page exceed what the type can represent.","triggerScenarios":"commit_transferred_state_offsets with a cumulative offset so large that page.state_offsets + offset overflows (u32/u64 depending on build) — typically from an enormous number of transferred aggregate states or corrupted offset bookkeeping.","commonSituations":"Very large GROUP BY cardinality combined with heavy state transfer across payloads; accounting bugs that double-count offsets.","solutions":["Check the offset accounting for double-counting of transferred state sizes.","Reduce per-query aggregate state cardinality (fewer groups / pre-aggregation) to keep offsets within range.","Widen the state_offsets representation in the payload page if legitimately huge transfers are expected.","Report the query; overflow at this point usually signals bookkeeping corruption."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if page.state_offsets.checked_add(offset).is_none() {\n    return Err(ErrorCode::Internal(\"state offsets overflow in transfer\"));\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Audit offset accumulation for double counting","Bound group cardinality via pre-aggregation","Use a wide type for state_offsets"],"tags":["rust","panic","overflow","aggregation"],"backgroundTag":"argument-out-of-range","analyzedSha":"288d84d76e20a2f8f7173bda9691eb6ece301aa9","analyzedAt":"2026-09-11T11:29:36.208Z","contentChangedAt":"2026-09-11T11:29:36.208Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}