duckdb 1.5.5.0 → 1.5.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 534e22d8df0424b7551b9ca68678d4da9f2e7a8055272dabe7c31d9f63c7b5b4
-  data.tar.gz: 5a1a9289dd5b20de755dd2c5c17242a353fe695ff27e47e5c862bc62004d1875
+  metadata.gz: caab56325522ea94df9e9cdc12c54b20f2335c2a8d93df0d1fce965643e78cf0
+  data.tar.gz: a572bfa7d8f4ff0dfac85c34ace463b272446e1de7f3fad6bd790de055f25787
 SHA512:
-  metadata.gz: 5afc359f5b6f5c972a34f0662e0f94360d91a12fd6a3db3e116f54eea486436c2855e0ee8f1949d8aff42c7b171e2efbeded84989b5bf335b57c7b9e7d5ee497
-  data.tar.gz: 7f5d628c60766814253cf9971b90f3fc1911d63d376cbce414dcff92f8e550dbccc676832435349b925c26449aa18d2dff394bd0e33d300ee1e57cc8ff8f5f5f
+  metadata.gz: c150cfd69f78f5106596211b5d09432ef60678942c9fdfca4a634eff25052ec3704381ab85bbf9ae9e82dc5b177f1e226c25b95afa33e57a225e9bf4c284efad
+  data.tar.gz: 163925f3b77e0bf445b23d37a0e3e45d0aab4d981c58b73d196af7157964c8e33f20147a8d062a13d68becd71f57a4e5906fc9d1fbbbd716c1b8319aedb7ce58

data/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to this project will be documented in this file.
 
 # Unreleased
 
+# 1.5.5.1 - 2026-08-29
+- fix `DuckDB::Database#close` deadlocking when DuckDB tears down a pipeline that still owes a UDF callback, as a failed aggregate window query does on DuckDB 1.4.x. `duckdb_close` joins DuckDB's worker threads, and a worker running a callback waits for the executor thread, which waits for the GVL the closing thread was holding. The GVL is now released for the duration of `duckdb_close`.
+- fix a segfault when an aggregate UDF was used as a window function over a constant frame, such as `OVER ()` or `OVER (PARTITION BY x)` (issue #1446). DuckDB's `CAPIAggregateUpdate` does not flatten the state vector the way its combine and finalize counterparts do, so it hands the update callback a single state while reporting the partition's full row count; reading one state per row then ran off the end of the allocation. Such a chunk is now recognised and every row aggregated into the one state DuckDB supplied.
+- fix an aggregate UDF state that has lost its registry entry being passed to the user's `update`/`combine`/`finalize` proc as `nil`, indistinguishable from an `init` proc that legitimately returned `nil`. Such a state now reports an internal error instead of silently producing wrong results (issue #1445).
+- fix `DuckDB::Appender.create_query` reading past the end of its column name array when the array is shorter than the types array, and freeing a column name before DuckDB copies it when the array holds `to_str` objects. A column name array whose size differs from the types array now raises `ArgumentError` (PR #1453).
+- fix a bound or appended `VARCHAR` being silently truncated at an embedded NUL byte, so that a String validated on the Ruby side is now stored in full (PR #1451). Affects `Connection#query(sql, *args)`, `PreparedStatement#bind`/`#bind_varchar` and `Appender#append_varchar`.
+- fix an exception raised while converting a row for an aggregate UDF's update callback — including the `Timeout::Error` from wrapping a query in `Timeout.timeout` — unwinding into DuckDB instead of aborting the query, which could wedge the process for good (PR #1450).
+- fix a permanent hang when a UDF callback raised an exception whose message contained a NUL byte (or whose `#message` raised): the error reporter raised while reporting, killing the callback executor thread and stranding every later UDF callback in the process (PR #1448).
+- add `DuckDB::TableFunction::BindInfo#bind_data=` to store an arbitrary Ruby object as a custom table function's bind data.
+- add `DuckDB::TableFunction::FunctionInfo#bind_data` to retrieve, during execution, the object stored by `BindInfo#bind_data=`.
+- add `DuckDB::TableFunction::InitInfo#bind_data` to retrieve, during the init phase, the object stored by `BindInfo#bind_data=`.
+- support the statement types added in DuckDB 1.5.5: `#statement_type` now returns `:copy_database`, `:update_extensions` and `:merge_into` instead of raising `DuckDB::Error: Unknown statement type`.
+- fix a use-after-free when a function was registered through `DuckDB::InstanceCache`: two `get_or_create` calls on the same path returned separate `DuckDB::Database` objects over one shared instance, so collecting either one freed functions the other's connections could still resolve. `get_or_create` now returns the same `DuckDB::Database` for the same path.
+
 # 1.5.5.0 - 2026-07-27
 
 - bump up DuckDB 1.5.5 on CI.

data/ext/duckdb/aggregate_function.c

@@ -22,9 +22,33 @@ static VALUE g_aggregate_state_registry;
  */
 static unsigned long long g_next_state_id = 0;
 
+/*
+ * Addresses of every state buffer DuckDB has initialised and not yet
+ * destroyed, used as a set: keys are the buffer addresses, the values are
+ * unused.
+ *
+ * This exists only to make a state pointer testable without dereferencing it.
+ * DuckDB's CAPIAggregateUpdate flattens the input vectors but not the state
+ * vector, although its combine and finalize counterparts both flatten theirs.
+ * A window frame that is constant over the whole partition -- `OVER ()` --
+ * makes DuckDB pass a constant vector holding one pointer while reporting the
+ * partition's full row count, so states[1] onwards read off the end of an
+ * eight-byte allocation and yield unrelated heap bytes. Dereferencing those to
+ * reach state_id is the crash; membership here is the only test that does not.
+ * See issue #1446.
+ *
+ * Protected from GC via rb_gc_register_mark_object on init.
+ */
+static VALUE g_aggregate_state_addresses;
+
 typedef struct {
     unsigned long long state_id;
-    VALUE ruby_state;
+    /* The address this state was initialised at. DuckDB rolls partial states
+     * up by memcpy'ing the whole buffer elsewhere and destroying the copy, so
+     * the copy is the only thing that can still name the original address --
+     * and that address has to leave g_aggregate_state_addresses when the state
+     * dies, or the set grows by one entry per query. */
+    void *origin;
 } ruby_aggregate_state;
 
 static void mark(void *);
@@ -155,6 +179,23 @@ static inline void state_registry_store(ruby_aggregate_state *state, VALUE value
     rb_hash_aset(g_aggregate_state_registry, state_registry_key(state), value);
 }
 
+/*
+ * Read a state's Ruby VALUE back out of the registry.
+ *
+ * The registry is the only place the VALUE may be read from: a copy cached
+ * in the state buffer would be a raw VALUE in a C struct DuckDB allocates,
+ * which GC compaction does not update.
+ *
+ * Returns Qundef, not Qnil, when the state has no entry: nil is a legitimate
+ * state (a user's init proc may return it), so the two must not be conflated.
+ * Every live state has an entry, so Qundef means a bug in this file; callers
+ * report it through report_missing_state_to_duckdb rather than handing the
+ * user's proc a state it never returned.
+ */
+static inline VALUE state_registry_load(ruby_aggregate_state *state) {
+    return rb_hash_lookup2(g_aggregate_state_registry, state_registry_key(state), Qundef);
+}
+
 /*
  * Remove a state entry from the registry.  Safe to call even if the
  * entry was already removed (rb_hash_delete is a no-op for missing keys).
@@ -163,18 +204,81 @@ static inline void state_registry_remove(ruby_aggregate_state *state) {
     rb_hash_delete(g_aggregate_state_registry, state_registry_key(state));
 }
 
+/*
+ * Key into g_aggregate_state_addresses. Takes the bare address, so testing
+ * membership never dereferences the pointer; that is the whole point of the
+ * set.
+ */
+static inline VALUE state_address_key(const void *addr) {
+    return ULL2NUM((unsigned long long)(uintptr_t)addr);
+}
+
+static inline int state_address_is_live(ruby_aggregate_state *state) {
+    if (state == NULL) {
+        return 0;
+    }
+    return RTEST(rb_hash_lookup2(g_aggregate_state_addresses, state_address_key(state), Qfalse));
+}
+
+/*
+ * Birth and death of a state, in both maps at once.
+ *
+ * The address set is only meaningful as a dereference-free stand-in for "this
+ * state has a registry entry", so the two must never disagree. Keeping every
+ * add and remove inside this pair is what stops a later call site from
+ * updating one and forgetting the other -- which is how the address set came
+ * to leak an entry per query the first time round.
+ *
+ * (state_registry_store on its own is not a birth: the update and combine
+ * callbacks use it to replace a registered state's value, and the address is
+ * already live by then.)
+ */
+static inline void state_register(ruby_aggregate_state *state, VALUE value) {
+    state_registry_store(state, value);
+    rb_hash_aset(g_aggregate_state_addresses, state_address_key(state), Qtrue);
+}
+
+/*
+ * Idempotent, and harmless for a state that was never registered. Only safe on
+ * a pointer already known to be dereferenceable: a live state, or one from a
+ * callback whose state vector DuckDB flattened.
+ *
+ * Drops the address the state was initialised at as well as its own. DuckDB
+ * rolls partial states up by memcpy'ing the whole buffer elsewhere and
+ * destroying the copy, so the copy is the only thing left that can still name
+ * the original address.
+ */
+static inline void state_release(ruby_aggregate_state *state) {
+    state_registry_remove(state);
+    rb_hash_delete(g_aggregate_state_addresses, state_address_key(state));
+    if (state->origin != (void *)state) {
+        rb_hash_delete(g_aggregate_state_addresses, state_address_key(state->origin));
+    }
+}
+
 /*
  * Report a pending Ruby exception to DuckDB via
  * duckdb_aggregate_function_set_error and clear it from errinfo.
  * Caller must only invoke this when rb_protect reported exception_state != 0.
  */
 static void report_ruby_error_to_duckdb(duckdb_function_info info) {
-    VALUE errinfo = rb_errinfo();
-    if (errinfo != Qnil) {
-        VALUE msg = rb_funcall(errinfo, rb_intern("message"), 0);
-        duckdb_aggregate_function_set_error(info, StringValueCStr(msg));
-    }
-    rb_set_errinfo(Qnil);
+    VALUE msg = rbduckdb_pending_error_message();
+    duckdb_aggregate_function_set_error(info, StringValueCStr(msg));
+    RB_GC_GUARD(msg);
+}
+
+/*
+ * Report a state that has no registry entry.  Not reachable from Ruby code:
+ * it means a state was released while DuckDB still held it, which would
+ * otherwise pass nil to the user's proc and silently corrupt the result.
+ */
+static void report_missing_state_to_duckdb(duckdb_function_info info, ruby_aggregate_state *state) {
+    char msg[128];
+
+    snprintf(msg, sizeof(msg),
+             "aggregate state %llu has no registry entry (ruby-duckdb internal error)",
+             (unsigned long long)state->state_id);
+    duckdb_aggregate_function_set_error(info, msg);
 }
 
 /* state_size callback: constant buffer per state. */
@@ -201,9 +305,9 @@ static void execute_init_callback_protected(void *user_data) {
     int exception_state;
     VALUE result;
 
-    /* Initialise buffer to a safe value before calling Ruby. */
-    state->ruby_state = Qnil;
+    /* Assign the ID before calling Ruby: the registry entry is keyed on it. */
     state->state_id = ++g_next_state_id;
+    state->origin = state;
 
     result = rb_protect(call_init_proc, (VALUE)arg, &exception_state);
     if (exception_state) {
@@ -211,8 +315,7 @@ static void execute_init_callback_protected(void *user_data) {
         return;
     }
 
-    state->ruby_state = result;
-    state_registry_store(state, result);
+    state_register(state, result);
 }
 
 static void state_init_callback(duckdb_function_info info, duckdb_aggregate_state state_p) {
@@ -223,10 +326,13 @@ static void state_init_callback(duckdb_function_info info, duckdb_aggregate_stat
     if (ctx == NULL || ctx->init_proc == Qnil) {
         /* Defensive: maybe_set_functions only wires callbacks when init_proc
          * is set, so this branch should be unreachable in practice. Zero the
-         * buffer anyway to keep the Ruby state slot well-defined. */
+         * ID anyway, and leave the state unregistered: the callbacks then
+         * report it rather than running the user's proc on a state that was
+         * never initialised. Set origin so state_release can read it if
+         * DuckDB destroys the buffer. */
         ruby_aggregate_state *state = (ruby_aggregate_state *)state_p;
-        state->ruby_state = Qnil;
         state->state_id = 0;
+        state->origin = state;
         return;
     }
 
@@ -245,20 +351,118 @@ struct update_callback_arg {
     duckdb_aggregate_state *states;
     duckdb_vector *input_vectors;
     duckdb_logical_type *input_types;
-    VALUE *args;
     idx_t row_count;
     idx_t col_count;
+    /* Non-zero when `states` holds a single pointer shared by every row
+     * instead of one per row; set by resolve_state_layout. */
+    int constant_states;
 };
 
 struct update_one_arg {
     VALUE update_proc;
-    int argc;
-    VALUE *argv;
+    VALUE args;
 };
 
 static VALUE call_update_proc(VALUE varg) {
     struct update_one_arg *arg = (struct update_one_arg *)varg;
-    return rb_funcallv(arg->update_proc, rb_intern("call"), arg->argc, arg->argv);
+    return rb_apply(arg->update_proc, rb_intern("call"), arg->args);
+}
+
+/*
+ * DuckDB does not call the destroy callback once update has failed, so the
+ * chunk's registry entries have to be dropped here or the Ruby VALUEs leak.
+ * Rows in a chunk may share a state; state_registry_remove is idempotent.
+ *
+ * Only the states this chunk actually used are released. Under the constant
+ * layout that is states[0] alone: everything past it is adjacent heap, which
+ * was observed to hold live states belonging to *other* partitions, and
+ * releasing one of those would drop a registry entry this chunk never owned.
+ *
+ * Entries that are not live states are skipped rather than dropped, because
+ * reading state_id out of adjacent heap is the very crash this file avoids.
+ * Skipping them loses nothing: a pointer that is not a live state has no
+ * registry entry to remove.
+ */
+static void release_chunk_states(struct update_callback_arg *arg) {
+    ruby_aggregate_state **states = (ruby_aggregate_state **)arg->states;
+    idx_t count = arg->constant_states ? (idx_t)1 : arg->row_count;
+    idx_t i;
+
+    for (i = 0; i < count; i++) {
+        if (state_address_is_live(states[i])) {
+            state_release(states[i]);
+        }
+    }
+}
+
+/*
+ * Work out how `states` is laid out before anything dereferences it.
+ *
+ * DuckDB passes one of two shapes. Normally it is row-indexed: every entry is
+ * a state DuckDB has initialised, and rows may share one. When the window
+ * frame is constant over the partition, DuckDB instead builds a constant
+ * vector holding that partition's single state and forgets to flatten it into
+ * row_count copies, so only a short prefix of the array really is that state
+ * and the rest is whatever bytes follow an eight-byte allocation.
+ *
+ * A row-indexed array cannot contain an entry that is not a live state, so one
+ * dead entry is proof of the constant layout -- and proof reached without ever
+ * dereferencing the pointer, which is what the crash in issue #1446 was.
+ *
+ * Be clear about what this is: a heuristic with a known ceiling, not a fix.
+ * The real fix is one line in DuckDB, `state.Flatten(count)` in
+ * CAPIAggregateUpdate, and this whole mechanism can be deleted once a release
+ * carrying it is the oldest DuckDB supported here.
+ *
+ * Two things it does not do:
+ *
+ *   - It still reads states[i] past the end of that eight-byte allocation.
+ *     Not dereferencing the result is what stops the SIGSEGV, but the read
+ *     itself remains out of bounds and would trip a sanitiser.
+ *   - Only one direction is proof. The bytes past the constant vector are
+ *     ordinary heap and were observed to hold live state pointers belonging
+ *     to other partitions, so "every entry is live" is evidence, not proof.
+ *     That is the safe way round -- it falls back to the row-indexed reading
+ *     DuckDB intends -- but it is probability, not a guarantee.
+ *
+ * It also rests on every state reaching update having been initialised at the
+ * address it is passed at. That does not hold for states in general: DuckDB
+ * rolls partial states up by memcpy, and the destroy callback is observed
+ * receiving copies at addresses it never initialised. Those copies are made to
+ * be combined and finalized, after the rows are updated, so update should only
+ * ever see states DuckDB is still accumulating into -- but if that assumption
+ * ever broke for an entry past index 0, the chunk would be read as constant
+ * and the rows aggregated into states[0], silently. Attempts to reproduce that
+ * (400k rows, 50k groups, 8 threads, forcing hash-table repartitioning) did
+ * not manage it.
+ */
+static int resolve_state_layout(struct update_callback_arg *arg) {
+    ruby_aggregate_state **states = (ruby_aggregate_state **)arg->states;
+    idx_t i;
+
+    arg->constant_states = 0;
+
+    if (arg->row_count == 0) {
+        return 1;
+    }
+
+    if (!state_address_is_live(states[0])) {
+        /* Not even the one entry DuckDB always fills is a state of ours;
+         * there is nothing here that can be aggregated into. */
+        duckdb_aggregate_function_set_error(
+            arg->info, "aggregate update received a state array holding no live state "
+                       "(ruby-duckdb internal error)");
+        return 0;
+    }
+
+    for (i = 1; i < arg->row_count; i++) {
+        if (!state_address_is_live(states[i])) {
+            arg->constant_states = 1;
+            return 1;
+        }
+    }
+
+    return 1;
 }
 
 /*
@@ -268,19 +472,23 @@ static VALUE call_update_proc(VALUE varg) {
  * or the Ruby proc call raises, allocated buffers and logical types are
  * released on the unwind path.
  *
- * Ruby exceptions raised by the user's proc are caught inline via
- * rb_protect and reported to DuckDB as scalar errors; other Ruby
- * exceptions (e.g. from vector_value_at) propagate and are cleaned up
- * by rb_ensure.
+ * Ruby exceptions raised by the user's proc are caught inline via rb_protect
+ * and reported to DuckDB; anything else (vector_value_at, or an async
+ * exception such as Timeout::Error) unwinds to execute_update_callback_protected.
+ *
+ * arg->constant_states must already have been set by resolve_state_layout.
  */
 static VALUE update_process_rows(VALUE varg) {
     struct update_callback_arg *arg = (struct update_callback_arg *)varg;
     ruby_aggregate_state **states = (ruby_aggregate_state **)arg->states;
     idx_t i, j;
 
+    /* A Ruby Array, not a plain buffer: converting a later column can trigger
+     * a GC, and the earlier columns' objects must stay reachable. */
+    VALUE args = rb_ary_new_capa((long)arg->col_count + 1);
+
     arg->input_vectors = ALLOC_N(duckdb_vector, arg->col_count);
     arg->input_types = ALLOC_N(duckdb_logical_type, arg->col_count);
-    arg->args = ALLOC_N(VALUE, arg->col_count + 1);
 
     for (j = 0; j < arg->col_count; j++) {
         arg->input_vectors[j] = duckdb_data_chunk_get_vector(arg->input, j);
@@ -288,9 +496,10 @@ static VALUE update_process_rows(VALUE varg) {
     }
 
     for (i = 0; i < arg->row_count; i++) {
-        ruby_aggregate_state *state = states[i];
+        ruby_aggregate_state *state = arg->constant_states ? states[0] : states[i];
         struct update_one_arg one;
         int exception_state;
+        VALUE ruby_state;
         VALUE ret;
 
         /*
@@ -314,35 +523,35 @@ static VALUE update_process_rows(VALUE varg) {
             }
         }
 
-        arg->args[0] = state->ruby_state;
+        ruby_state = state_registry_load(state);
+        if (ruby_state == Qundef) {
+            report_missing_state_to_duckdb(arg->info, state);
+            release_chunk_states(arg);
+            RB_GC_GUARD(args);
+            return Qnil;
+        }
+
+        rb_ary_store(args, 0, ruby_state);
         for (j = 0; j < arg->col_count; j++) {
-            arg->args[j + 1] = rbduckdb_vector_value_at(arg->input_vectors[j], arg->input_types[j], i);
+            rb_ary_store(args, (long)j + 1, rbduckdb_vector_value_at(arg->input_vectors[j], arg->input_types[j], i));
         }
 
         one.update_proc = arg->ctx->update_proc;
-        one.argc = (int)(arg->col_count + 1);
-        one.argv = arg->args;
+        one.args = args;
 
         ret = rb_protect(call_update_proc, (VALUE)&one, &exception_state);
         if (exception_state) {
             report_ruby_error_to_duckdb(arg->info);
-            /*
-             * DuckDB does not call the destroy callback on the update error
-             * path, so we must remove reachable states from the registry
-             * ourselves to avoid leaking Ruby VALUEs.  Iterate all rows in
-             * the chunk — multiple rows may share the same state (same
-             * group), but state_registry_remove is idempotent.
-             */
-            for (j = 0; j < arg->row_count; j++) {
-                state_registry_remove(states[j]);
-            }
+            release_chunk_states(arg);
+            RB_GC_GUARD(args);
             return Qnil;
         }
 
-        state->ruby_state = ret;
         state_registry_store(state, ret);
     }
 
+    RB_GC_GUARD(args);
+
     return Qnil;
 }
 
@@ -356,9 +565,6 @@ static VALUE update_cleanup_callback(VALUE varg) {
         }
         xfree(arg->input_types);
     }
-    if (arg->args != NULL) {
-        xfree(arg->args);
-    }
     if (arg->input_vectors != NULL) {
         xfree(arg->input_vectors);
     }
@@ -366,9 +572,30 @@ static VALUE update_cleanup_callback(VALUE varg) {
     return Qnil;
 }
 
+static VALUE update_process_rows_ensured(VALUE varg) {
+    return rb_ensure(update_process_rows, varg, update_cleanup_callback, varg);
+}
+
+/*
+ * The scalar path has always protected its callback body; this one did not, so
+ * an exception from anywhere but the user's proc unwound into DuckDB's C++
+ * frames. Reachable from ordinary Ruby: Timeout.timeout around a query lands
+ * its Timeout::Error in the row loop and wedges the VM.
+ */
 static void execute_update_callback_protected(void *user_data) {
     struct update_callback_arg *arg = (struct update_callback_arg *)user_data;
-    rb_ensure(update_process_rows, (VALUE)arg, update_cleanup_callback, (VALUE)arg);
+    int exception_state;
+
+    if (!resolve_state_layout(arg)) {
+        release_chunk_states(arg);
+        return;
+    }
+
+    rb_protect(update_process_rows_ensured, (VALUE)arg, &exception_state);
+    if (exception_state) {
+        report_ruby_error_to_duckdb(arg->info);
+        release_chunk_states(arg);
+    }
 }
 
 static void update_callback(duckdb_function_info info,
@@ -395,9 +622,9 @@ static void update_callback(duckdb_function_info info,
     arg.states = states;
     arg.input_vectors = NULL;
     arg.input_types = NULL;
-    arg.args = NULL;
     arg.row_count = duckdb_data_chunk_get_size(input);
     arg.col_count = duckdb_data_chunk_get_column_count(input);
+    arg.constant_states = 0;
 
     rbduckdb_function_executor_dispatch(execute_update_callback_protected, &arg);
 }
@@ -437,8 +664,12 @@ static void execute_combine_callback_protected(void *user_data) {
         VALUE ret;
 
         one.combine_proc = arg->ctx->combine_proc;
-        one.source_state = src[i]->ruby_state;
-        one.target_state = tgt[i]->ruby_state;
+        one.source_state = state_registry_load(src[i]);
+        one.target_state = state_registry_load(tgt[i]);
+        if (one.source_state == Qundef || one.target_state == Qundef) {
+            report_missing_state_to_duckdb(arg->info, one.source_state == Qundef ? src[i] : tgt[i]);
+            return;
+        }
 
         ret = rb_protect(call_combine_proc, (VALUE)&one, &exception_state);
         if (exception_state) {
@@ -446,12 +677,13 @@ static void execute_combine_callback_protected(void *user_data) {
             return;
         }
 
-        tgt[i]->ruby_state = ret;
         state_registry_store(tgt[i], ret);
 
-        /* source state is consumed by combine; release its registry entry
-         * so the Ruby VALUE can be GC'd. */
-        state_registry_remove(src[i]);
+        /* The source entry is left in place: DuckDB reuses one source state
+         * across many combine calls (WindowSegmentTree does this for every
+         * frame), and the registry is now the only copy of the VALUE, so
+         * releasing it here would hand nil to the next combine. The entry is
+         * reclaimed by destroy_callback when DuckDB frees the state. */
     }
 }
 
@@ -529,7 +761,11 @@ static void execute_finalize_callback_protected(void *user_data) {
         VALUE ret;
 
         one.finalize_proc = arg->ctx->finalize_proc;
-        one.ruby_state = state->ruby_state;
+        one.ruby_state = state_registry_load(state);
+        if (one.ruby_state == Qundef) {
+            report_missing_state_to_duckdb(arg->info, state);
+            goto cleanup;
+        }
 
         ret = rb_protect(call_finalize_proc, (VALUE)&one, &exception_state);
         if (exception_state) {
@@ -549,14 +785,14 @@ static void execute_finalize_callback_protected(void *user_data) {
         }
 
         /* Release Ruby state from the GC registry. */
-        state_registry_remove(state);
+        state_release(state);
     }
 
 cleanup:
     /* Clean up registry entries for the current (failed) state and any
        remaining unprocessed states so we don't leak GC-registered objects. */
     for (; i < arg->count; i++) {
-        state_registry_remove(states[i]);
+        state_release(states[i]);
     }
     duckdb_destroy_logical_type(&result_type);
 }
@@ -601,7 +837,7 @@ static void execute_destroy_callback(void *data) {
     ruby_aggregate_state **s = (ruby_aggregate_state **)arg->states;
     idx_t i;
     for (i = 0; i < arg->count; i++) {
-        state_registry_remove(s[i]);
+        state_release(s[i]);
     }
 }
 
@@ -749,4 +985,6 @@ void rbduckdb_init_aggregate_function(void) {
 
     g_aggregate_state_registry = rb_hash_new();
     rb_gc_register_mark_object(g_aggregate_state_registry);
+    g_aggregate_state_addresses = rb_hash_new();
+    rb_gc_register_mark_object(g_aggregate_state_addresses);
 }

data/ext/duckdb/appender.c

@@ -94,6 +94,8 @@ static VALUE appender_s_create_query(VALUE klass, VALUE con, VALUE query, VALUE
     idx_t column_count = 0;
     duckdb_logical_type *type_array = NULL;
     VALUE appender = Qnil;
+    VALUE column_name_strings = Qnil;
+    duckdb_state state;
 
     if (!rb_obj_is_kind_of(con, cDuckDBConnection)) {
         rb_raise(rb_eTypeError, "1st argument should be instance of DackDB::Connection");
@@ -116,17 +118,29 @@ static VALUE appender_s_create_query(VALUE klass, VALUE con, VALUE query, VALUE
         if (rb_obj_is_kind_of(columns, rb_cArray) == Qfalse) {
             rb_raise(rb_eTypeError, "4th argument should be an Array or nil");
         }
-        idx_t col_count = RARRAY_LEN(columns);
-        column_names = ALLOCA_N(const char *, (size_t)col_count);
-        for (idx_t i = 0; i < col_count; i++) {
+        /* DuckDB reads column_count entries from column_names, so a shorter list
+         * makes it read uninitialized stack slots as column names. */
+        if ((idx_t)RARRAY_LEN(columns) != column_count) {
+            rb_raise(rb_eArgError, "column names size (%ld) must be the same as types size (%ld)",
+                     RARRAY_LEN(columns), RARRAY_LEN(types));
+        }
+        /* Keep the converted Strings alive: StringValue on a to_str object
+         * returns a String that nothing else references. */
+        column_name_strings = rb_ary_new_capa((long)column_count);
+        column_names = ALLOCA_N(const char *, (size_t)column_count);
+        for (idx_t i = 0; i < column_count; i++) {
             VALUE col_name_val = rb_ary_entry(columns, i);
-            column_names[i] = StringValuePtr(col_name_val);
+            StringValue(col_name_val);
+            rb_ary_push(column_name_strings, col_name_val);
+            column_names[i] = RSTRING_PTR(col_name_val);
         }
     }
     ctxcon = rbduckdb_get_struct_connection(con);
     appender = allocate(klass);
     TypedData_Get_Struct(appender, rubyDuckDBAppender, &appender_data_type, ctx);
-    if (duckdb_appender_create_query(ctxcon->con, query_str, column_count, type_array, table_name, column_names, &ctx->appender) == DuckDBError) {
+    state = duckdb_appender_create_query(ctxcon->con, query_str, column_count, type_array, table_name, column_names, &ctx->appender);
+    RB_GC_GUARD(column_name_strings);
+    if (state == DuckDBError) {
         rb_raise(eDuckDBError, "failed to create appender from query");
     }
 
@@ -333,11 +347,13 @@ static VALUE appender__append_double(VALUE self, VALUE val) {
 /* :nodoc: */
 static VALUE appender__append_varchar(VALUE self, VALUE val) {
     rubyDuckDBAppender *ctx;
+    /* Length-aware, as duckdb_append_varchar would stop at an embedded NUL. */
     char *pval = StringValuePtr(val);
+    long len = RSTRING_LEN(val);
 
     TypedData_Get_Struct(self, rubyDuckDBAppender, &appender_data_type, ctx);
 
-    return state_to_rbool(duckdb_append_varchar(ctx->appender, pval));
+    return state_to_rbool(duckdb_append_varchar_length(ctx->appender, pval, (idx_t)len));
 }
 
 /* :nodoc: */