Skip to content

fix(scan): do not crash on a NULL query vector - #378

Draft
pavanmanishd wants to merge 1 commit into
timescale:mainfrom
pavanmanishd:bugfix/null-query-vector
Draft

pavanmanishd wants to merge 1 commit into
timescale:mainfrom
pavanmanishd:bugfix/null-query-vector

Conversation

@pavanmanishd

@pavanmanishd pavanmanishd commented Oct 18, 2026 •

Copy link
Copy Markdown
Contributor

Fixes #377.

An ORDER BY argument that evaluates to NULL — a subquery that matched no row, a parameter a client bound — reached the distance code as a NULL datum and segfaulted the backend in pg_detoast_datum. Every row compares equal to a NULL, so any order satisfies the query: the scan now searches with a fixed unit vector and returns arbitrary rows, which is what a sequential scan does with the same expression.

Two details worth knowing. The substitute is built as float32 directly rather than through the opclass input type, so a vec16 index gets the same vector instead of a float32 buffer read as half-floats, and it is cached in the scan context so a rescan does not rebuild it. And one difference from a sequential scan remains, inherent to an approximate index: rows whose indexed column is NULL are not in the index, so a NULL-argument scan returns fewer rows than the sequential scan would whenever the query wants more rows than the indexed ones provide.

The regression test pins the plan and executes the statement through generic prepared plans for both the L2 and cosine opclasses, and a LATERAL top-k covers the rescan path.

@pavanmanishd
pavanmanishd force-pushed the bugfix/null-query-vector branch 3 times, most recently from 5083fac to 0502a9f Compare October 18, 2026 22:38
An ORDER BY argument that evaluates to NULL, such as a subquery that matched
no row, reached the distance code as a NULL datum and segfaulted the backend
in pg_detoast_datum. Every row compares equal to a NULL, so any order
satisfies the query; search with a fixed unit vector instead and return
arbitrary rows, which is what a sequential scan does with the same
expression.

One difference from a sequential scan remains, and is inherent to an
approximate index: rows whose indexed column is NULL are not in the index,
so a NULL-argument scan returns fewer rows than the sequential scan would
whenever the query wants more rows than the indexed ones provide.

The unit vector is built as float32 directly rather than through the opclass
input type, so a vec16 index gets the same vector instead of a float32
buffer read as half-floats, and it is cached in the scan context so a rescan
does not rebuild it. Adds regression coverage: the plan is pinned and the
statement executed through generic prepared plans for both the L2 and cosine
opclasses, and a LATERAL top-k covers the rescan path.
@pavanmanishd
pavanmanishd force-pushed the bugfix/null-query-vector branch from 0502a9f to 3922b84 Compare October 19, 2026 10:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Scan crashes on a NULL query vector

1 participant