Fix server abort on cancelled INSERT into TimeSeries table

[tiandiwonder]

Related: #108783
Related: #57097

Problem

Inserting into a TimeSeries table runs nested INSERT pipelines inside TimeSeriesSink. When the outer query is cancelled without an exception — for example with timeout_overflow_mode = 'break', an early LIMIT, or sibling-processor teardown — the server aborts in debug and sanitizer builds:

Logical error: 'finished || std::uncaught_exceptions() || std::current_exception()'.
2. DB::PushingPipelineExecutor::~PushingPipelineExecutor()  PushingPipelineExecutor.cpp:68
3. DB::TimeSeriesSink::TargetPipeline::~TargetPipeline()    TimeSeriesSink.cpp:362
4. DB::TimeSeriesSink::~TimeSeriesSink()
... Received signal Aborted (6)

This is the same cancellation-without-exception class as AliasSink (fixed in #108783) and issue #57097, found while explaining that PR.

Root cause

TimeSeriesSink owns up to three TargetPipeline structs, each holding a PushingPipelineExecutor created and immediately started in createTargetPipeline. The sink finalized those executors only in onFinish (executor->finish()); it did not override onException or onCancel, and ~TargetPipeline was = default. On a no-exception cancel, the graph is cancelled via PipelineExecutor::cancel(CancelledByTimeout) → graph->cancel, and IProcessor::cancel only invokes the default no-op onCancel, so neither onFinish nor onException runs. The defaulted destructor then destroyed a started-but-unfinished executor with no in-flight exception, tripping ~PushingPipelineExecutor's finished || std::uncaught_exceptions() || std::current_exception() invariant. The exception path was already safe because std::uncaught_exceptions() holds during unwinding; only the no-exception cancel path was broken.

Fix

Give TargetPipeline a destructor that cancels the executor, mirroring AliasSink::~AliasSink (#108783), CreatingSetsTransform, and MaterializingCTETransform. PushingPipelineExecutor::cancel sets finished = true, satisfying the destructor invariant; on the normal path onFinish already finished the executor, so the destructor's cancel is a no-op. Regression test 04416_timeseries_insert_cancel_no_crash exercises the timeout_overflow_mode = 'break' path and asserts the server survives; it reproduces the abort on the unfixed binary and passes after the fix (verified locally in a debug build).

Changelog category (leave one):

• Bug Fix (user-visible misbehavior in an official stable release)

Changelog entry (a user-readable short description of the changes that goes into CHANGELOG.md):

Fixed a server abort (LOGICAL_ERROR / assertion in debug and sanitizer builds) when an INSERT ... SELECT into a TimeSeries table is cancelled without an exception, for example with timeout_overflow_mode = 'break'.

Documentation entry for user-facing changes

• Documentation is written (mandatory for new features)

Version info

• Merged into: 26.7.1.277 (included in 26.7 and later)

[clickhouse-gh]

Workflow [PR], commit [98a0f03]

Summary: ✅

• Performance Comparison: Performance dashboard

---

AI Review

Summary

This PR fixes cancellation teardown for TimeSeriesSink by cancelling owned inner PushingPipelineExecutors when TargetPipeline is destroyed, and adds a stateless regression that cancels INSERT ... SELECT via timeout_overflow_mode = 'break' before checking server liveness. I did not find correctness, safety, or coverage issues in the changed code.

Missing context / blind spots

• ⚠️ Full PR CI was still in progress at review time; the remaining build and functional-test jobs will close that validation gap.

Final Verdict

Status: ✅ Approve

No code-review changes required.

[clickhouse-gh]

LLVM Coverage Report

Metric	Baseline	Current	Δ
Lines	85.40%	85.40%	+0.00%
Functions	92.60%	92.60%	+0.00%
Branches	77.60%	77.60%	+0.00%

Changed lines: Changed C/C++ lines covered by tests: 5/6 (83.33%) | Lost baseline coverage: none · Uncovered code

Full report · Diff report