Skip to content

[engine] Parallel scan workers concurrently mutate a shared non-thread-safe BasicCommandContext HashMap #4949

Description

@lvca

Severity: HIGH (data race, corrupted $current/$parent semantics)

Location: query/sql/executor/FetchFromClusterExecutionStep.java:120 (context.setVariable("current", result) inside each workers rs.next()), FetchFromTypeExecutionStep.java:331, BasicCommandContext (variablesis a plainHashMap, lazily created in init()`).

In the parallel path up to bucketCount pool workers call rs.next() concurrently on the same CommandContext, each doing variables.put("current", ...) into an unsynchronized HashMap - racing each other and the consumer. Under load: lost entries, corrupted table during resize, and the classic HashMap infinite-loop/corruption outcomes. It also silently breaks \$current/\$parent for downstream expressions. (Profiling counters are also updated racily - benign.)

Fix: give each scan task its own child context (context.copy() per worker) and set current only on the consumer; a ConcurrentHashMap for variables is a weaker fallback that still leaves the semantic breakage.


Filed from an internal engine deep-audit (2026-07). Traced to source; verify against current main before fixing and add a regression test.

Metadata

Metadata

Assignees

No one assigned

    Labels

    auditFindings from the 2026-07 engine deep auditbugconcurrencyThreading / concurrency / MVCCsql

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions