{"record":{"id":"c532aebd9cf53e4d","repo":"databendlabs/databend","slug":"transfer-target-initialized-states-overflow","errorCode":null,"errorMessage":"transfer target initialized states overflow","messagePattern":"transfer target initialized states overflow","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/query/expression/src/aggregate/payload.rs","lineNumber":108,"sourceCode":"\n    fn commit(self, payloads: &mut [Payload]) {\n        for (payload_index, page_index, offset) in self.offsets {\n            let payload = payloads\n                .get_mut(payload_index)\n                .expect(\"transfer target payload index is out of bounds\");\n\n            let page = payload\n                .pages\n                .get_mut(page_index)\n                .expect(\"transfer target page index is out of bounds\");\n            let next_state_offsets = page\n                .state_offsets\n                .checked_add(offset)\n                .expect(\"transfer target state offsets overflow\");\n            let initialized_states = page\n                .rows\n                .checked_mul(payload.aggrs.len())\n                .expect(\"transfer target initialized states overflow\");\n\n            assert!(\n                next_state_offsets <= initialized_states,\n                \"transfer target state offsets exceed initialized aggregate states\"\n            );\n            page.state_offsets = next_state_offsets;\n        }\n    }\n}\n\nimpl<'a> PayloadTransferBatch<'a> {\n    pub(super) fn from_flush_state(flush_state: &'a PayloadFlushState) -> Self {\n        Self {\n            rows: flush_state.row_count,\n            addresses: &flush_state.addresses,\n            partitions: &flush_state.probe_state.partition_entries,\n        }\n    }","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/databendlabs/databend/blob/288d84d76e20a2f8f7173bda9691eb6ece301aa9/src/query/expression/src/aggregate/payload.rs#L90-L126","documentation":"commit() computes the number of initialized aggregate states as page.rows.checked_mul(payload.aggrs.len()). This panic fires on multiplication overflow — the product of rows and aggregate count exceeds the integer type — during aggregation state transfer commit.","triggerScenarios":"commit_transferred_state_offsets where rows * aggrs.len() overflows the offset type: an extreme combination of page rows and aggregate functions, or corrupted rows/aggrs metadata.","commonSituations":"Queries with many aggregate functions over very wide/huge pages; metadata inconsistency in the payload arena after partial failures.","solutions":["Split the query into smaller aggregations (fewer aggregates or smaller pages) to keep rows*aggrs within range.","Verify payload.aggrs and page.rows metadata are not corrupted by prior failed transfers.","Use checked arithmetic with a wider type (u64/usize) for the initialized-state computation.","Report the query plan; user-facing trigger is extreme aggregate width."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"let initialized = page\n    .rows\n    .checked_mul(payload.aggrs.len())\n    .ok_or_else(|| ErrorCode::Internal(\"initialized states overflow\"))?;","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Limit aggregates-per-query width in extreme queries","Keep page rows bounded","Verify rows/aggrs metadata after partial failures"],"tags":["rust","panic","overflow","aggregation"],"backgroundTag":"argument-out-of-range","analyzedSha":"288d84d76e20a2f8f7173bda9691eb6ece301aa9","analyzedAt":"2026-09-11T11:29:36.208Z","contentChangedAt":"2026-09-11T11:29:36.208Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}