[dmitry-chirkov-dremio]

Rationale for this change

ExprValidator checks the value list of IN but not its input expression. An IF with an int32 condition is rejected alone and accepted under IN. A null input crashes Projector::Make with SIGSEGV.

What changes are included in this PR?

The PR has the tests first, then the fix in expr_validator.cc and node.h.

ValidateInExpression checks that the input and its type are not null, and visits the input. InExpressionNode::ToString() prints null for a null input, so the cache key does not crash before validation.

Are these changes tested?

Yes. The new tests cover invalid, null and untyped input for all IN value types, with Projector::Make and Filter::Make, and a valid IN. On main, one of them fails and two crash with SIGSEGV. All of them pass with the fix.

Are there any user-facing changes?

Make now returns ExpressionValidationError for an IN with an invalid or null input. Before, it accepted it or crashed.

This PR contains a "Critical Fix". It fixes a crash. Projector::Make and Filter::Make die with SIGSEGV (exit code 139) when the input expression of an IN node is null. The null pointer is dereferenced in InExpressionNode::ToString(), which the cache key calls before the validator runs. Both Make calls now return ExpressionValidationError.

Was AI used for this PR?

AI tools helped investigate the bug and write the fix, tests, and description.

PR code and description written by:

• Human
• AI

Reviewed before submission by:

• Human
• AI
• Not reviewed

• GitHub Issue: [C++][Gandiva] ExprValidator does not validate the input expression of IN #55615

[github-actions]

Thanks for opening a pull request!

This pull request has been automatically converted to a draft because its title doesn't match Arrow's required format.

If this is not a minor PR, could you open an issue for this pull request on GitHub? https://github.com/apache/arrow/issues/new/choose

Opening GitHub issues ahead of time contributes to the Openness of the Apache Arrow project.

Then could you also rename the pull request title in the following format?

GH-${GITHUB_ISSUE_ID}: [${COMPONENT}] ${SUMMARY}

or

MINOR: [${COMPONENT}] ${SUMMARY}

After updating the title, you can mark the pull request as ready for review.

See also:

• Other pull requests
• Contribution Guidelines - Contributing Overview

[dmitry-chirkov-dremio]

CI results for the new tests.

Tests-only commit, before the fix: gandiva-projector-test fails on all four C++ platforms, as predicted (ARM64 Ubuntu 22.04 LLVM 18.1.8, AMD64 Ubuntu 24.04 ASAN UBSAN LLVM 18.1.3, AMD64 macOS 15-intel LLVM 18.1.8, ARM64 macOS 26 LLVM 23.1.4). The sequence is the same everywhere:

1. ValidationTestProjector.TestInExpressionValidatesEvalExpression fails. Make accepts an IF with an int32 condition when it is wrapped in IN.
2. ValidationTestProjector.TestInExpressionNullEvalExpression crashes the test binary.

The crash is in InExpressionNode<int>::ToString(), node.h:254. The cache key calls it before the validator runs. The ASAN job reports member call on null pointer of type 'gandiva::Node' at the same line.

Different from what I predicted: the crash stops the binary, so TestInExpressionUntypedEvalExpression and TestInExpressionValid never ran in CI.

With the fix commit, gandiva-projector-test passes on all four platforms.

A few known failures seen previously also appeared. They are not related to this PR.

[github-actions]

⚠️ GitHub issue #55615 has been automatically assigned in GitHub to PR creator.