Skip to content

fix: reject negative INTERVAL offsets in RANGE window frames - #24903

Open
edubraqd wants to merge 1 commit into
apache:mainfrom
edubraqd:fix/range-frame-negative-offset
Open

fix: reject negative INTERVAL offsets in RANGE window frames#24903
edubraqd wants to merge 1 commit into
apache:mainfrom
edubraqd:fix/range-frame-negative-offset

Conversation

@edubraqd

@edubraqd edubraqd commented Sep 3, 2026

Copy link
Copy Markdown

Which issue does this PR close?

Rationale for this change

ROWS and GROUPS frame offsets are parsed as UInt64, so a negative offset is a planning error. RANGE offsets are only typed once the ORDER BY type is known, and an interval literal such as INTERVAL '-1 day' carries its sign inside the string, so it was accepted. The resulting frame starts after it ends, which the execution code does not expect: it panics with "attempt to subtract with overflow" in debug builds (sliding_aggregate.rs, window_state.rs) and returns wrong results in release builds.

What changes are included in this PR?

After the RANGE offsets have been coerced in coerce_window_frame, compare each finite offset with the zero of its type and reject negative ones with a planning error, matching what ROWS / GROUPS already do at parse time (and what PostgreSQL does).

Are these changes tested?

Yes. window.slt gains three negative-offset cases (PRECEDING, FOLLOWING, both) that now fail at planning, plus a non-negative interval offset that still runs.

Are there any user-facing changes?

Queries with a negative interval offset in a RANGE frame now fail at planning instead of panicking or returning wrong results.

ROWS and GROUPS frame offsets are parsed as `UInt64`, so a negative offset is
a planning error. RANGE offsets are only typed once the ORDER BY type is known,
and an interval literal such as `INTERVAL '-1 day'` carries its sign inside the
string, so it was accepted. The resulting frame starts after it ends, which the
execution code does not expect:

    SELECT count(*) OVER (ORDER BY x RANGE BETWEEN INTERVAL '-1 month' PRECEDING
                          AND CURRENT ROW) FROM ...
    sliding_aggregate.rs:216: attempt to subtract with overflow

    ... RANGE BETWEEN INTERVAL '-1 day' PRECEDING AND INTERVAL '-1 day' FOLLOWING
    window_state.rs:65: attempt to subtract with overflow

Release builds do not panic but return wrong results instead. Check the
coerced RANGE offsets in `coerce_window_frame` and reject negative ones with
the same kind of planning error ROWS / GROUPS already produce.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@github-actions github-actions Bot added optimizer Optimizer rules sqllogictest SQL Logic Tests (.slt) labels Sep 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

optimizer Optimizer rules sqllogictest SQL Logic Tests (.slt)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Negative INTERVAL offsets in RANGE window frames are accepted and panic at execution

1 participant