[BugFix] Fix type mismatch in map literal when explicit key/value types are declared

[trueeyu]

Why I'm doing:

Fix https://github.com/StarRocks/StarRocksTest/issues/11202

When a map literal is written with an explicit type annotation (e.g., map<smallint, smallint>{1: 2, 3: 4}), the FE analyzer failed to cast the child expressions (key/value literals) to the declared key and value types.
Integer literals like 1, 2, 3, 4 are inferred as TINYINT by default. Because visitMapExpr only handled the implicit-type case (AnyMapType.ANY_MAP) and had no logic for the explicit-type case, the children retained their inferred TINYINT types. These mistyped expressions were then serialized and sent to the BE.
On the BE side, MapExpr::evaluate_checked cloned the key column as a FixedLengthColumn<int8_t> (1 byte), but later attempted to append it into a FixedLengthColumnBase<int16_t> (2 bytes), causing a heap-buffer-overflow detected by
AddressSanitizer.

A typical reproducer:

  ALTER TABLE t ADD COLUMN c MAP<SMALLINT, SMALLINT>
  DEFAULT map<smallint, smallint>{1: 2, 3: 4};                                                                                                                                                                                          
                                              
  SELECT id, c FROM t ORDER BY id;  -- crashes BE       

Root Cause

In ExpressionAnalyzer.visitMapExpr, when the map has an explicit MapType (not AnyMapType.ANY_MAP), no casting was applied to the child expressions. The declared key/value types were simply ignored, and children kept their own inferred types.

The same issue did not exist for ArrayExpr — visitArrayExpr already correctly casts children to the declared item type when an explicit array type is present.

Fix

When the map literal has an explicit type, extract the declared keyType and valueType from the MapType and cast each key/value child expression to the corresponding type if it doesn't already match — exactly mirroring the existing pattern in visitArrayExpr.

What I'm doing:

Fix type mismatch in map literal when explicit key/value types are declared

What type of PR is this:

• BugFix
• Feature
• Enhancement
• Refactor
• UT
• Doc
• Tool

Does this PR entail a change in behavior?

• Yes, this PR will result in a change in behavior.
• No, this PR will not result in a change in behavior.

If yes, please specify the type of change:

• Interface/UI changes: syntax, type conversion, expression evaluation, display information
• Parameter changes: default values, similar parameters but with different default values
• Policy changes: use new policy to replace old one, functionality automatically enabled
• Feature removed
• Miscellaneous: upgrade & downgrade compatibility, etc.

Checklist:

• I have added test cases for my bug fix or my new feature
• This pr needs user documentation (for new or modified features or behaviors)
  • I have added documentation for my new feature or new function
  • This pr needs auto generate documentation
• This is a backport pr

Bugfix cherry-pick branch check:

• I have checked the version labels which the pr will be auto-backported to the target branch
  • 4.1
  • 4.0
  • 3.5
  • 3.4

[CelerData-Reviewer]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2ef6bb13e3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

This PR fixes a FE analysis bug where map literals with an explicit MAP<k,v> type annotation did not cast their key/value child expressions to the declared types, which could lead to a BE heap-buffer-overflow due to mismatched serialized types.

Changes:

• Update ExpressionAnalyzer.visitMapExpr to cast map literal children to the inferred/common types (implicit) or declared key/value types (explicit).
• Add a regression unit test covering map<smallint, smallint>{1: 2, 3: 4} analysis behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
fe/fe-core/src/main/java/com/starrocks/sql/analyzer/ExpressionAnalyzer.java	Cast map-literal children to key/value target types (handles explicit MapType as well as AnyMapType.ANY_MAP).
fe/fe-core/src/test/java/com/starrocks/sql/analyzer/ExpressionAnalyzerTest.java	Adds regression test to ensure map literal children are analyzed with the expected target types.

[alvin-celerdata]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 943ca1b270

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

[Java-Extensions Incremental Coverage Report]

✅ pass : 0 / 0 (0%)

[github-actions]

[FE Incremental Coverage Report]

✅ pass : 18 / 18 (100.00%)

file detail

	path	covered_line	new_line	coverage	not_covered_line_detail
🔵	com/starrocks/sql/analyzer/ExpressionAnalyzer.java	18	18	100.00%	[]

[github-actions]

[BE Incremental Coverage Report]

✅ pass : 0 / 0 (0%)

[github-actions]

@Mergifyio backport branch-4.1

[mergify]

backport branch-4.1

✅ Backports have been created

Details

• #71345 [BugFix] Fix type mismatch in map literal when explicit key/value types are declared (backport #71316) has been created for branch branch-4.1 but encountered conflicts

Cherry-pick of fdc3329 has failed:

On branch mergify/bp/branch-4.1/pr-71316
Your branch is up to date with 'origin/branch-4.1'.

You are currently cherry-picking commit fdc3329597.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   fe/fe-core/src/main/java/com/starrocks/sql/analyzer/ExpressionAnalyzer.java
	modified:   fe/fe-core/src/test/java/com/starrocks/sql/analyzer/AnalyzeExprTest.java
	modified:   test/sql/test_default_value/R/test_complex_default_all_paths.sql
	modified:   test/sql/test_default_value/T/test_complex_default_all_paths.sql

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   fe/fe-core/src/test/java/com/starrocks/sql/analyzer/ExpressionAnalyzerTest.java
	both modified:   test/sql/test_map/R/test_map

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally