mbutrovich commented on code in PR #2398:
URL: https://github.com/apache/iceberg-rust/pull/2398#discussion_r3972415999


##########
crates/iceberg/src/expr/visitors/bloom_filter_evaluator.rs:
##########
@@ -0,0 +1,1325 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//! Evaluates predicates against Parquet bloom filters to determine whether
+//! a row group can be skipped.
+
+use std::collections::{HashMap, HashSet};
+
+use fnv::FnvHashSet;
+use parquet::basic::Type as PhysicalType;
+use parquet::bloom_filter::Sbbf;
+use parquet::data_type::ByteArray;
+
+use crate::Result;
+use crate::expr::visitors::bound_predicate_visitor::{BoundPredicateVisitor, 
visit};
+use crate::expr::{BoundPredicate, BoundReference};
+use crate::spec::decimal_utils::decimal_to_fixed_length_bytes_exact;
+use crate::spec::{Datum, PrimitiveLiteral};
+
+const ROW_GROUP_MIGHT_MATCH: Result<bool> = Ok(true);
+const ROW_GROUP_CANT_MATCH: Result<bool> = Ok(false);
+
+/// A column's bloom filter for one row group, together with the file's 
physical
+/// encoding of that column. A probe must be encoded the way the writer encoded
+/// the values it inserted, so the encoding travels with the filter.
+pub(crate) struct ColumnBloomFilter {
+    sbbf: Sbbf,
+    physical_type: PhysicalType,
+    /// `type_length` from the file's column descriptor. Only meaningful for
+    /// `FIXED_LEN_BYTE_ARRAY`.
+    type_length: i32,
+}
+
+impl ColumnBloomFilter {
+    pub(crate) fn new(sbbf: Sbbf, physical_type: PhysicalType, type_length: 
i32) -> Self {
+        Self {
+            sbbf,
+            physical_type,
+            type_length,
+        }
+    }
+}
+
+pub(crate) struct BloomFilterEvaluator<'a> {
+    /// Maps Iceberg field_id -> bloom filter for this row group
+    bloom_filters: &'a HashMap<i32, ColumnBloomFilter>,
+}
+
+impl<'a> BloomFilterEvaluator<'a> {
+    /// Evaluate the predicate against the provided bloom filters.
+    /// Returns `false` if the row group definitely does not match,
+    /// `true` if it might match.
+    pub(crate) fn eval(
+        filter: &BoundPredicate,
+        bloom_filters: &HashMap<i32, ColumnBloomFilter>,
+    ) -> Result<bool> {
+        if bloom_filters.is_empty() {
+            return ROW_GROUP_MIGHT_MATCH;
+        }
+
+        let mut evaluator = BloomFilterEvaluator { bloom_filters };
+        visit(&mut evaluator, filter)
+    }
+
+    fn check_datum(&self, reference: &BoundReference, datum: &Datum) -> bool {
+        let field_id = reference.field().id;
+        let Some(column) = self.bloom_filters.get(&field_id) else {
+            // No bloom filter for this column — conservatively might match
+            return true;
+        };
+
+        check_in_bloom_filter(column, datum)
+    }
+}
+
+/// Collects field IDs that appear in `eq` or `in` predicates — the only
+/// predicate types that benefit from bloom filter checks.
+pub(crate) fn collect_bloom_filter_field_ids(predicate: &BoundPredicate) -> 
Result<HashSet<i32>> {
+    let mut visitor = BloomFilterFieldIdCollector {
+        field_ids: HashSet::new(),
+    };
+    visit(&mut visitor, predicate)?;
+    Ok(visitor.field_ids)
+}
+
+struct BloomFilterFieldIdCollector {
+    field_ids: HashSet<i32>,
+}
+
+impl BoundPredicateVisitor for BloomFilterFieldIdCollector {
+    type T = ();
+
+    fn always_true(&mut self) -> Result<()> {
+        Ok(())
+    }
+
+    fn always_false(&mut self) -> Result<()> {
+        Ok(())
+    }
+
+    fn and(&mut self, _lhs: (), _rhs: ()) -> Result<()> {
+        Ok(())
+    }
+
+    fn or(&mut self, _lhs: (), _rhs: ()) -> Result<()> {
+        Ok(())
+    }
+
+    fn not(&mut self, _inner: ()) -> Result<()> {

Review Comment:
   `not()` is a pass-through here, so `eq` and `in` sitting under a `NOT` still 
register their field ids. But the evaluator's `not()` at L316 always returns 
might-match, so those filters can never prune anything. Does that mean a bloom 
filter gets fetched per such column per row group without ever being able to 
help?



##########
crates/iceberg/src/expr/visitors/bloom_filter_evaluator.rs:
##########
@@ -0,0 +1,1325 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//! Evaluates predicates against Parquet bloom filters to determine whether
+//! a row group can be skipped.
+
+use std::collections::{HashMap, HashSet};
+
+use fnv::FnvHashSet;
+use parquet::basic::Type as PhysicalType;
+use parquet::bloom_filter::Sbbf;
+use parquet::data_type::ByteArray;
+
+use crate::Result;
+use crate::expr::visitors::bound_predicate_visitor::{BoundPredicateVisitor, 
visit};
+use crate::expr::{BoundPredicate, BoundReference};
+use crate::spec::decimal_utils::decimal_to_fixed_length_bytes_exact;
+use crate::spec::{Datum, PrimitiveLiteral};
+
+const ROW_GROUP_MIGHT_MATCH: Result<bool> = Ok(true);
+const ROW_GROUP_CANT_MATCH: Result<bool> = Ok(false);
+
+/// A column's bloom filter for one row group, together with the file's 
physical
+/// encoding of that column. A probe must be encoded the way the writer encoded
+/// the values it inserted, so the encoding travels with the filter.
+pub(crate) struct ColumnBloomFilter {
+    sbbf: Sbbf,
+    physical_type: PhysicalType,
+    /// `type_length` from the file's column descriptor. Only meaningful for
+    /// `FIXED_LEN_BYTE_ARRAY`.
+    type_length: i32,
+}
+
+impl ColumnBloomFilter {
+    pub(crate) fn new(sbbf: Sbbf, physical_type: PhysicalType, type_length: 
i32) -> Self {
+        Self {
+            sbbf,
+            physical_type,
+            type_length,
+        }
+    }
+}
+
+pub(crate) struct BloomFilterEvaluator<'a> {
+    /// Maps Iceberg field_id -> bloom filter for this row group
+    bloom_filters: &'a HashMap<i32, ColumnBloomFilter>,
+}
+
+impl<'a> BloomFilterEvaluator<'a> {
+    /// Evaluate the predicate against the provided bloom filters.
+    /// Returns `false` if the row group definitely does not match,
+    /// `true` if it might match.
+    pub(crate) fn eval(
+        filter: &BoundPredicate,
+        bloom_filters: &HashMap<i32, ColumnBloomFilter>,
+    ) -> Result<bool> {
+        if bloom_filters.is_empty() {
+            return ROW_GROUP_MIGHT_MATCH;
+        }
+
+        let mut evaluator = BloomFilterEvaluator { bloom_filters };
+        visit(&mut evaluator, filter)
+    }
+
+    fn check_datum(&self, reference: &BoundReference, datum: &Datum) -> bool {
+        let field_id = reference.field().id;
+        let Some(column) = self.bloom_filters.get(&field_id) else {
+            // No bloom filter for this column — conservatively might match
+            return true;
+        };
+
+        check_in_bloom_filter(column, datum)
+    }
+}
+
+/// Collects field IDs that appear in `eq` or `in` predicates — the only
+/// predicate types that benefit from bloom filter checks.
+pub(crate) fn collect_bloom_filter_field_ids(predicate: &BoundPredicate) -> 
Result<HashSet<i32>> {
+    let mut visitor = BloomFilterFieldIdCollector {
+        field_ids: HashSet::new(),
+    };
+    visit(&mut visitor, predicate)?;
+    Ok(visitor.field_ids)
+}
+
+struct BloomFilterFieldIdCollector {
+    field_ids: HashSet<i32>,
+}
+
+impl BoundPredicateVisitor for BloomFilterFieldIdCollector {
+    type T = ();
+
+    fn always_true(&mut self) -> Result<()> {
+        Ok(())
+    }
+
+    fn always_false(&mut self) -> Result<()> {
+        Ok(())
+    }
+
+    fn and(&mut self, _lhs: (), _rhs: ()) -> Result<()> {
+        Ok(())
+    }
+
+    fn or(&mut self, _lhs: (), _rhs: ()) -> Result<()> {
+        Ok(())
+    }
+
+    fn not(&mut self, _inner: ()) -> Result<()> {
+        Ok(())
+    }
+
+    fn is_null(&mut self, _r: &BoundReference, _p: &BoundPredicate) -> 
Result<()> {
+        Ok(())
+    }
+
+    fn not_null(&mut self, _r: &BoundReference, _p: &BoundPredicate) -> 
Result<()> {
+        Ok(())
+    }
+
+    fn is_nan(&mut self, _r: &BoundReference, _p: &BoundPredicate) -> 
Result<()> {
+        Ok(())
+    }
+
+    fn not_nan(&mut self, _r: &BoundReference, _p: &BoundPredicate) -> 
Result<()> {
+        Ok(())
+    }
+
+    fn less_than(&mut self, _r: &BoundReference, _l: &Datum, _p: 
&BoundPredicate) -> Result<()> {
+        Ok(())
+    }
+
+    fn less_than_or_eq(
+        &mut self,
+        _r: &BoundReference,
+        _l: &Datum,
+        _p: &BoundPredicate,
+    ) -> Result<()> {
+        Ok(())
+    }
+
+    fn greater_than(&mut self, _r: &BoundReference, _l: &Datum, _p: 
&BoundPredicate) -> Result<()> {
+        Ok(())
+    }
+
+    fn greater_than_or_eq(
+        &mut self,
+        _r: &BoundReference,
+        _l: &Datum,
+        _p: &BoundPredicate,
+    ) -> Result<()> {
+        Ok(())
+    }
+
+    fn eq(&mut self, r: &BoundReference, _l: &Datum, _p: &BoundPredicate) -> 
Result<()> {
+        self.field_ids.insert(r.field().id);
+        Ok(())
+    }
+
+    fn not_eq(&mut self, _r: &BoundReference, _l: &Datum, _p: &BoundPredicate) 
-> Result<()> {
+        Ok(())
+    }
+
+    fn starts_with(&mut self, _r: &BoundReference, _l: &Datum, _p: 
&BoundPredicate) -> Result<()> {
+        Ok(())
+    }
+
+    fn not_starts_with(
+        &mut self,
+        _r: &BoundReference,
+        _l: &Datum,
+        _p: &BoundPredicate,
+    ) -> Result<()> {
+        Ok(())
+    }
+
+    fn r#in(
+        &mut self,
+        r: &BoundReference,
+        _literals: &FnvHashSet<Datum>,
+        _p: &BoundPredicate,
+    ) -> Result<()> {
+        self.field_ids.insert(r.field().id);
+        Ok(())
+    }
+
+    fn not_in(
+        &mut self,
+        _r: &BoundReference,
+        _literals: &FnvHashSet<Datum>,
+        _p: &BoundPredicate,
+    ) -> Result<()> {
+        Ok(())
+    }
+}
+
+/// Check whether a datum value might be present in the bloom filter.
+///
+/// The value must be checked using the same physical encoding the Parquet
+/// writer used when inserting into the bloom filter. We use the actual
+/// physical type from the column metadata to ensure correctness regardless
+/// of which writer produced the file.
+fn check_in_bloom_filter(column: &ColumnBloomFilter, datum: &Datum) -> bool {
+    let ColumnBloomFilter {
+        sbbf,
+        physical_type,
+        type_length,
+    } = column;
+    let physical_type = *physical_type;
+
+    match datum.literal() {
+        PrimitiveLiteral::Boolean(v) => sbbf.check(v),
+        // A promoted column (int -> long, float -> double) keeps its original
+        // physical width in files written before the promotion, and the writer
+        // hashed that width, so probe at the file's width rather than the
+        // predicate's.
+        PrimitiveLiteral::Int(v) => match physical_type {
+            PhysicalType::INT32 => sbbf.check(v),
+            PhysicalType::INT64 => sbbf.check(&i64::from(*v)),
+            _ => true,
+        },
+        PrimitiveLiteral::Long(v) => match physical_type {
+            PhysicalType::INT64 => sbbf.check(v),
+            PhysicalType::INT32 => match i32::try_from(*v) {
+                Ok(narrowed) => sbbf.check(&narrowed),
+                // Out of range for the column, so it cannot be present.
+                Err(_) => true,
+            },
+            _ => true,
+        },
+        PrimitiveLiteral::Float(v) => match physical_type {
+            PhysicalType::FLOAT => sbbf.check(&v.0),
+            PhysicalType::DOUBLE => sbbf.check(&f64::from(v.0)),
+            _ => true,
+        },
+        PrimitiveLiteral::Double(v) => match physical_type {
+            PhysicalType::DOUBLE => sbbf.check(&v.0),
+            PhysicalType::FLOAT => {
+                let narrowed = v.0 as f32;
+                // Only an exactly representable value can equal a widened f32.
+                if f64::from(narrowed) == v.0 {
+                    sbbf.check(&narrowed)
+                } else {
+                    true
+                }
+            }
+            _ => true,
+        },
+        PrimitiveLiteral::String(v) => sbbf.check(v.as_str()),
+        PrimitiveLiteral::Binary(v) => sbbf.check(v.as_slice()),
+        PrimitiveLiteral::Int128(v) => {
+            // Decimal: dispatch based on the actual Parquet physical type
+            // from the file, not inferred from precision.
+            match physical_type {
+                PhysicalType::INT32 => sbbf.check(&(*v as i32)),
+                PhysicalType::INT64 => sbbf.check(&(*v as i64)),

Review Comment:
   I think these two casts can drop rows after a decimal precision widening, in 
the same way the `FIXED_LEN_BYTE_ARRAY` arm below now guards against.
   
   `*v as i32` and `*v as i64` truncate silently. Widening precision is a valid 
promotion (the Iceberg spec's [Schema 
Evolution](https://iceberg.apache.org/spec/#schema-evolution) table permits 
`decimal(P,S)` to `decimal(P',S)` when `P' > P`) and it doesn't rewrite 
existing files, so a table now at `decimal(30,2)` can still hold files written 
as `decimal(9,2)`, which the spec's [Appendix 
A](https://iceberg.apache.org/spec/#parquet) stores as `int32`. 
`Predicate::bind` coerces the literal to the current field type, so the 
mantissa arriving here can be far wider than `i32`. Truncating it produces a 
different hash, `check` returns false, and a row group that does contain the 
value gets pruned.
   
   The `Long` arm at L238 already has the shape that avoids this:
   
   ```rust
   PhysicalType::INT32 => match i32::try_from(*v) {
       Ok(narrowed) => sbbf.check(&narrowed),
       // Out of range for the column, so it cannot be present.
       Err(_) => true,
   },
   ```
   
   Would applying the same `try_from` treatment to the two decimal arms work? 
An out-of-range mantissa can't be in an `int32` or `int64` column, so returning 
might-match on `Err` looks right here too.



##########
crates/iceberg/src/expr/visitors/bloom_filter_evaluator.rs:
##########
@@ -0,0 +1,1325 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//! Evaluates predicates against Parquet bloom filters to determine whether
+//! a row group can be skipped.
+
+use std::collections::{HashMap, HashSet};
+
+use fnv::FnvHashSet;
+use parquet::basic::Type as PhysicalType;
+use parquet::bloom_filter::Sbbf;
+use parquet::data_type::ByteArray;
+
+use crate::Result;
+use crate::expr::visitors::bound_predicate_visitor::{BoundPredicateVisitor, 
visit};
+use crate::expr::{BoundPredicate, BoundReference};
+use crate::spec::decimal_utils::decimal_to_fixed_length_bytes_exact;
+use crate::spec::{Datum, PrimitiveLiteral};
+
+const ROW_GROUP_MIGHT_MATCH: Result<bool> = Ok(true);
+const ROW_GROUP_CANT_MATCH: Result<bool> = Ok(false);
+
+/// A column's bloom filter for one row group, together with the file's 
physical
+/// encoding of that column. A probe must be encoded the way the writer encoded
+/// the values it inserted, so the encoding travels with the filter.
+pub(crate) struct ColumnBloomFilter {
+    sbbf: Sbbf,
+    physical_type: PhysicalType,
+    /// `type_length` from the file's column descriptor. Only meaningful for
+    /// `FIXED_LEN_BYTE_ARRAY`.
+    type_length: i32,
+}
+
+impl ColumnBloomFilter {
+    pub(crate) fn new(sbbf: Sbbf, physical_type: PhysicalType, type_length: 
i32) -> Self {
+        Self {
+            sbbf,
+            physical_type,
+            type_length,
+        }
+    }
+}
+
+pub(crate) struct BloomFilterEvaluator<'a> {
+    /// Maps Iceberg field_id -> bloom filter for this row group
+    bloom_filters: &'a HashMap<i32, ColumnBloomFilter>,
+}
+
+impl<'a> BloomFilterEvaluator<'a> {

Review Comment:
   `impl<'a> BloomFilterEvaluator<'a>` could be `impl 
BloomFilterEvaluator<'_>`. Same for the `BoundPredicateVisitor` impl at L297.



##########
crates/iceberg/src/expr/visitors/bloom_filter_evaluator.rs:
##########
@@ -0,0 +1,1325 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//! Evaluates predicates against Parquet bloom filters to determine whether
+//! a row group can be skipped.
+
+use std::collections::{HashMap, HashSet};
+
+use fnv::FnvHashSet;
+use parquet::basic::Type as PhysicalType;
+use parquet::bloom_filter::Sbbf;
+use parquet::data_type::ByteArray;
+
+use crate::Result;
+use crate::expr::visitors::bound_predicate_visitor::{BoundPredicateVisitor, 
visit};
+use crate::expr::{BoundPredicate, BoundReference};
+use crate::spec::decimal_utils::decimal_to_fixed_length_bytes_exact;
+use crate::spec::{Datum, PrimitiveLiteral};
+
+const ROW_GROUP_MIGHT_MATCH: Result<bool> = Ok(true);
+const ROW_GROUP_CANT_MATCH: Result<bool> = Ok(false);
+
+/// A column's bloom filter for one row group, together with the file's 
physical
+/// encoding of that column. A probe must be encoded the way the writer encoded
+/// the values it inserted, so the encoding travels with the filter.
+pub(crate) struct ColumnBloomFilter {
+    sbbf: Sbbf,
+    physical_type: PhysicalType,
+    /// `type_length` from the file's column descriptor. Only meaningful for
+    /// `FIXED_LEN_BYTE_ARRAY`.
+    type_length: i32,
+}
+
+impl ColumnBloomFilter {
+    pub(crate) fn new(sbbf: Sbbf, physical_type: PhysicalType, type_length: 
i32) -> Self {
+        Self {
+            sbbf,
+            physical_type,
+            type_length,
+        }
+    }
+}
+
+pub(crate) struct BloomFilterEvaluator<'a> {
+    /// Maps Iceberg field_id -> bloom filter for this row group
+    bloom_filters: &'a HashMap<i32, ColumnBloomFilter>,
+}
+
+impl<'a> BloomFilterEvaluator<'a> {
+    /// Evaluate the predicate against the provided bloom filters.
+    /// Returns `false` if the row group definitely does not match,
+    /// `true` if it might match.
+    pub(crate) fn eval(
+        filter: &BoundPredicate,
+        bloom_filters: &HashMap<i32, ColumnBloomFilter>,
+    ) -> Result<bool> {
+        if bloom_filters.is_empty() {
+            return ROW_GROUP_MIGHT_MATCH;
+        }
+
+        let mut evaluator = BloomFilterEvaluator { bloom_filters };
+        visit(&mut evaluator, filter)
+    }
+
+    fn check_datum(&self, reference: &BoundReference, datum: &Datum) -> bool {
+        let field_id = reference.field().id;
+        let Some(column) = self.bloom_filters.get(&field_id) else {
+            // No bloom filter for this column — conservatively might match
+            return true;
+        };
+
+        check_in_bloom_filter(column, datum)
+    }
+}
+
+/// Collects field IDs that appear in `eq` or `in` predicates — the only
+/// predicate types that benefit from bloom filter checks.
+pub(crate) fn collect_bloom_filter_field_ids(predicate: &BoundPredicate) -> 
Result<HashSet<i32>> {
+    let mut visitor = BloomFilterFieldIdCollector {
+        field_ids: HashSet::new(),
+    };
+    visit(&mut visitor, predicate)?;
+    Ok(visitor.field_ids)
+}
+
+struct BloomFilterFieldIdCollector {
+    field_ids: HashSet<i32>,
+}
+
+impl BoundPredicateVisitor for BloomFilterFieldIdCollector {
+    type T = ();
+
+    fn always_true(&mut self) -> Result<()> {
+        Ok(())
+    }
+
+    fn always_false(&mut self) -> Result<()> {
+        Ok(())
+    }
+
+    fn and(&mut self, _lhs: (), _rhs: ()) -> Result<()> {
+        Ok(())
+    }
+
+    fn or(&mut self, _lhs: (), _rhs: ()) -> Result<()> {
+        Ok(())
+    }
+
+    fn not(&mut self, _inner: ()) -> Result<()> {
+        Ok(())
+    }
+
+    fn is_null(&mut self, _r: &BoundReference, _p: &BoundPredicate) -> 
Result<()> {
+        Ok(())
+    }
+
+    fn not_null(&mut self, _r: &BoundReference, _p: &BoundPredicate) -> 
Result<()> {
+        Ok(())
+    }
+
+    fn is_nan(&mut self, _r: &BoundReference, _p: &BoundPredicate) -> 
Result<()> {
+        Ok(())
+    }
+
+    fn not_nan(&mut self, _r: &BoundReference, _p: &BoundPredicate) -> 
Result<()> {
+        Ok(())
+    }
+
+    fn less_than(&mut self, _r: &BoundReference, _l: &Datum, _p: 
&BoundPredicate) -> Result<()> {
+        Ok(())
+    }
+
+    fn less_than_or_eq(
+        &mut self,
+        _r: &BoundReference,
+        _l: &Datum,
+        _p: &BoundPredicate,
+    ) -> Result<()> {
+        Ok(())
+    }
+
+    fn greater_than(&mut self, _r: &BoundReference, _l: &Datum, _p: 
&BoundPredicate) -> Result<()> {
+        Ok(())
+    }
+
+    fn greater_than_or_eq(
+        &mut self,
+        _r: &BoundReference,
+        _l: &Datum,
+        _p: &BoundPredicate,
+    ) -> Result<()> {
+        Ok(())
+    }
+
+    fn eq(&mut self, r: &BoundReference, _l: &Datum, _p: &BoundPredicate) -> 
Result<()> {
+        self.field_ids.insert(r.field().id);
+        Ok(())
+    }
+
+    fn not_eq(&mut self, _r: &BoundReference, _l: &Datum, _p: &BoundPredicate) 
-> Result<()> {
+        Ok(())
+    }
+
+    fn starts_with(&mut self, _r: &BoundReference, _l: &Datum, _p: 
&BoundPredicate) -> Result<()> {
+        Ok(())
+    }
+
+    fn not_starts_with(
+        &mut self,
+        _r: &BoundReference,
+        _l: &Datum,
+        _p: &BoundPredicate,
+    ) -> Result<()> {
+        Ok(())
+    }
+
+    fn r#in(
+        &mut self,
+        r: &BoundReference,
+        _literals: &FnvHashSet<Datum>,
+        _p: &BoundPredicate,
+    ) -> Result<()> {
+        self.field_ids.insert(r.field().id);
+        Ok(())
+    }
+
+    fn not_in(
+        &mut self,
+        _r: &BoundReference,
+        _literals: &FnvHashSet<Datum>,
+        _p: &BoundPredicate,
+    ) -> Result<()> {
+        Ok(())
+    }
+}
+
+/// Check whether a datum value might be present in the bloom filter.
+///
+/// The value must be checked using the same physical encoding the Parquet
+/// writer used when inserting into the bloom filter. We use the actual
+/// physical type from the column metadata to ensure correctness regardless
+/// of which writer produced the file.
+fn check_in_bloom_filter(column: &ColumnBloomFilter, datum: &Datum) -> bool {
+    let ColumnBloomFilter {
+        sbbf,
+        physical_type,
+        type_length,
+    } = column;
+    let physical_type = *physical_type;
+
+    match datum.literal() {
+        PrimitiveLiteral::Boolean(v) => sbbf.check(v),
+        // A promoted column (int -> long, float -> double) keeps its original
+        // physical width in files written before the promotion, and the writer
+        // hashed that width, so probe at the file's width rather than the
+        // predicate's.
+        PrimitiveLiteral::Int(v) => match physical_type {
+            PhysicalType::INT32 => sbbf.check(v),
+            PhysicalType::INT64 => sbbf.check(&i64::from(*v)),
+            _ => true,
+        },
+        PrimitiveLiteral::Long(v) => match physical_type {
+            PhysicalType::INT64 => sbbf.check(v),
+            PhysicalType::INT32 => match i32::try_from(*v) {
+                Ok(narrowed) => sbbf.check(&narrowed),
+                // Out of range for the column, so it cannot be present.
+                Err(_) => true,
+            },
+            _ => true,
+        },
+        PrimitiveLiteral::Float(v) => match physical_type {

Review Comment:
   Not a bug, but worth a test, for a non-obvious reason.
   
   `sbbf.check(&v.0)` hashes raw IEEE bytes, so it treats `-0.0` and `+0.0` as 
distinct. That matches the reader today, but only because `arrow_ord::cmp::eq`, 
which the row filter uses, also treats them as distinct. That is not IEEE 
behavior:
   
   ```
   arrow eq([-0.0, 0.0, 1.0], 0.0) = [false, true, false]
   raw rust: -0.0f32 == 0.0f32     -> true
   ```
   
   So this bloom check and the row filter agree that a query for `0.0` 
shouldn't match a stored `-0.0`, which also lines up with the Iceberg spec: its 
[Sorting](https://iceberg.apache.org/spec/#sorting) section puts `-0` strictly 
before `0` ("`-NaN` < `-Infinity` < `-value` < `-0` < `0` < `value` < 
`Infinity` < `NaN`", aligned with Java's float comparison).
   
   But they agree for unrelated reasons, and one of them is an upstream 
implementation detail rather than anything this repo controls. If arrow-rs ever 
made that kernel IEEE-conformant, the row filter would start matching `-0.0` 
while this bloom check kept pruning it, and results would diverge silently. A 
case covering float positive and negative zero, asserting the same rows come 
back with `with_bloom_filter_enabled(true)` and `(false)`, seems worth pinning 
down.



##########
crates/iceberg/src/expr/visitors/bloom_filter_evaluator.rs:
##########
@@ -0,0 +1,1325 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//! Evaluates predicates against Parquet bloom filters to determine whether
+//! a row group can be skipped.
+
+use std::collections::{HashMap, HashSet};
+
+use fnv::FnvHashSet;
+use parquet::basic::Type as PhysicalType;
+use parquet::bloom_filter::Sbbf;
+use parquet::data_type::ByteArray;
+
+use crate::Result;
+use crate::expr::visitors::bound_predicate_visitor::{BoundPredicateVisitor, 
visit};
+use crate::expr::{BoundPredicate, BoundReference};
+use crate::spec::decimal_utils::decimal_to_fixed_length_bytes_exact;
+use crate::spec::{Datum, PrimitiveLiteral};
+
+const ROW_GROUP_MIGHT_MATCH: Result<bool> = Ok(true);
+const ROW_GROUP_CANT_MATCH: Result<bool> = Ok(false);
+
+/// A column's bloom filter for one row group, together with the file's 
physical
+/// encoding of that column. A probe must be encoded the way the writer encoded
+/// the values it inserted, so the encoding travels with the filter.
+pub(crate) struct ColumnBloomFilter {
+    sbbf: Sbbf,
+    physical_type: PhysicalType,
+    /// `type_length` from the file's column descriptor. Only meaningful for
+    /// `FIXED_LEN_BYTE_ARRAY`.
+    type_length: i32,
+}
+
+impl ColumnBloomFilter {
+    pub(crate) fn new(sbbf: Sbbf, physical_type: PhysicalType, type_length: 
i32) -> Self {
+        Self {
+            sbbf,
+            physical_type,
+            type_length,
+        }
+    }
+}
+
+pub(crate) struct BloomFilterEvaluator<'a> {
+    /// Maps Iceberg field_id -> bloom filter for this row group
+    bloom_filters: &'a HashMap<i32, ColumnBloomFilter>,
+}
+
+impl<'a> BloomFilterEvaluator<'a> {
+    /// Evaluate the predicate against the provided bloom filters.
+    /// Returns `false` if the row group definitely does not match,
+    /// `true` if it might match.
+    pub(crate) fn eval(
+        filter: &BoundPredicate,
+        bloom_filters: &HashMap<i32, ColumnBloomFilter>,
+    ) -> Result<bool> {
+        if bloom_filters.is_empty() {
+            return ROW_GROUP_MIGHT_MATCH;
+        }
+
+        let mut evaluator = BloomFilterEvaluator { bloom_filters };
+        visit(&mut evaluator, filter)
+    }
+
+    fn check_datum(&self, reference: &BoundReference, datum: &Datum) -> bool {
+        let field_id = reference.field().id;
+        let Some(column) = self.bloom_filters.get(&field_id) else {
+            // No bloom filter for this column — conservatively might match
+            return true;
+        };
+
+        check_in_bloom_filter(column, datum)
+    }
+}
+
+/// Collects field IDs that appear in `eq` or `in` predicates — the only
+/// predicate types that benefit from bloom filter checks.
+pub(crate) fn collect_bloom_filter_field_ids(predicate: &BoundPredicate) -> 
Result<HashSet<i32>> {
+    let mut visitor = BloomFilterFieldIdCollector {
+        field_ids: HashSet::new(),
+    };
+    visit(&mut visitor, predicate)?;
+    Ok(visitor.field_ids)
+}
+
+struct BloomFilterFieldIdCollector {
+    field_ids: HashSet<i32>,
+}
+
+impl BoundPredicateVisitor for BloomFilterFieldIdCollector {

Review Comment:
   These no-op methods overlap a fair bit with `CollectFieldIdVisitor` in 
`arrow/reader/projection.rs`. Would parameterizing that one (collect-all vs 
eq/in-only) be preferable to a second visitor, or is the trait boilerplate 
unavoidable enough that it isn't worth it?



##########
crates/iceberg/src/expr/visitors/bloom_filter_evaluator.rs:
##########
@@ -0,0 +1,1325 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//! Evaluates predicates against Parquet bloom filters to determine whether
+//! a row group can be skipped.
+
+use std::collections::{HashMap, HashSet};
+
+use fnv::FnvHashSet;
+use parquet::basic::Type as PhysicalType;
+use parquet::bloom_filter::Sbbf;
+use parquet::data_type::ByteArray;
+
+use crate::Result;
+use crate::expr::visitors::bound_predicate_visitor::{BoundPredicateVisitor, 
visit};
+use crate::expr::{BoundPredicate, BoundReference};
+use crate::spec::decimal_utils::decimal_to_fixed_length_bytes_exact;
+use crate::spec::{Datum, PrimitiveLiteral};
+
+const ROW_GROUP_MIGHT_MATCH: Result<bool> = Ok(true);
+const ROW_GROUP_CANT_MATCH: Result<bool> = Ok(false);
+
+/// A column's bloom filter for one row group, together with the file's 
physical
+/// encoding of that column. A probe must be encoded the way the writer encoded
+/// the values it inserted, so the encoding travels with the filter.
+pub(crate) struct ColumnBloomFilter {
+    sbbf: Sbbf,
+    physical_type: PhysicalType,
+    /// `type_length` from the file's column descriptor. Only meaningful for
+    /// `FIXED_LEN_BYTE_ARRAY`.
+    type_length: i32,
+}
+
+impl ColumnBloomFilter {
+    pub(crate) fn new(sbbf: Sbbf, physical_type: PhysicalType, type_length: 
i32) -> Self {
+        Self {
+            sbbf,
+            physical_type,
+            type_length,
+        }
+    }
+}
+
+pub(crate) struct BloomFilterEvaluator<'a> {
+    /// Maps Iceberg field_id -> bloom filter for this row group
+    bloom_filters: &'a HashMap<i32, ColumnBloomFilter>,
+}
+
+impl<'a> BloomFilterEvaluator<'a> {
+    /// Evaluate the predicate against the provided bloom filters.
+    /// Returns `false` if the row group definitely does not match,
+    /// `true` if it might match.
+    pub(crate) fn eval(
+        filter: &BoundPredicate,
+        bloom_filters: &HashMap<i32, ColumnBloomFilter>,
+    ) -> Result<bool> {
+        if bloom_filters.is_empty() {
+            return ROW_GROUP_MIGHT_MATCH;
+        }
+
+        let mut evaluator = BloomFilterEvaluator { bloom_filters };
+        visit(&mut evaluator, filter)
+    }
+
+    fn check_datum(&self, reference: &BoundReference, datum: &Datum) -> bool {
+        let field_id = reference.field().id;
+        let Some(column) = self.bloom_filters.get(&field_id) else {
+            // No bloom filter for this column — conservatively might match
+            return true;
+        };
+
+        check_in_bloom_filter(column, datum)
+    }
+}
+
+/// Collects field IDs that appear in `eq` or `in` predicates — the only
+/// predicate types that benefit from bloom filter checks.
+pub(crate) fn collect_bloom_filter_field_ids(predicate: &BoundPredicate) -> 
Result<HashSet<i32>> {
+    let mut visitor = BloomFilterFieldIdCollector {
+        field_ids: HashSet::new(),
+    };
+    visit(&mut visitor, predicate)?;
+    Ok(visitor.field_ids)
+}
+
+struct BloomFilterFieldIdCollector {
+    field_ids: HashSet<i32>,
+}
+
+impl BoundPredicateVisitor for BloomFilterFieldIdCollector {
+    type T = ();
+
+    fn always_true(&mut self) -> Result<()> {
+        Ok(())
+    }
+
+    fn always_false(&mut self) -> Result<()> {
+        Ok(())
+    }
+
+    fn and(&mut self, _lhs: (), _rhs: ()) -> Result<()> {
+        Ok(())
+    }
+
+    fn or(&mut self, _lhs: (), _rhs: ()) -> Result<()> {
+        Ok(())
+    }
+
+    fn not(&mut self, _inner: ()) -> Result<()> {
+        Ok(())
+    }
+
+    fn is_null(&mut self, _r: &BoundReference, _p: &BoundPredicate) -> 
Result<()> {
+        Ok(())
+    }
+
+    fn not_null(&mut self, _r: &BoundReference, _p: &BoundPredicate) -> 
Result<()> {
+        Ok(())
+    }
+
+    fn is_nan(&mut self, _r: &BoundReference, _p: &BoundPredicate) -> 
Result<()> {
+        Ok(())
+    }
+
+    fn not_nan(&mut self, _r: &BoundReference, _p: &BoundPredicate) -> 
Result<()> {
+        Ok(())
+    }
+
+    fn less_than(&mut self, _r: &BoundReference, _l: &Datum, _p: 
&BoundPredicate) -> Result<()> {
+        Ok(())
+    }
+
+    fn less_than_or_eq(
+        &mut self,
+        _r: &BoundReference,
+        _l: &Datum,
+        _p: &BoundPredicate,
+    ) -> Result<()> {
+        Ok(())
+    }
+
+    fn greater_than(&mut self, _r: &BoundReference, _l: &Datum, _p: 
&BoundPredicate) -> Result<()> {
+        Ok(())
+    }
+
+    fn greater_than_or_eq(
+        &mut self,
+        _r: &BoundReference,
+        _l: &Datum,
+        _p: &BoundPredicate,
+    ) -> Result<()> {
+        Ok(())
+    }
+
+    fn eq(&mut self, r: &BoundReference, _l: &Datum, _p: &BoundPredicate) -> 
Result<()> {
+        self.field_ids.insert(r.field().id);
+        Ok(())
+    }
+
+    fn not_eq(&mut self, _r: &BoundReference, _l: &Datum, _p: &BoundPredicate) 
-> Result<()> {
+        Ok(())
+    }
+
+    fn starts_with(&mut self, _r: &BoundReference, _l: &Datum, _p: 
&BoundPredicate) -> Result<()> {
+        Ok(())
+    }
+
+    fn not_starts_with(
+        &mut self,
+        _r: &BoundReference,
+        _l: &Datum,
+        _p: &BoundPredicate,
+    ) -> Result<()> {
+        Ok(())
+    }
+
+    fn r#in(
+        &mut self,
+        r: &BoundReference,
+        _literals: &FnvHashSet<Datum>,
+        _p: &BoundPredicate,
+    ) -> Result<()> {
+        self.field_ids.insert(r.field().id);
+        Ok(())
+    }
+
+    fn not_in(
+        &mut self,
+        _r: &BoundReference,
+        _literals: &FnvHashSet<Datum>,
+        _p: &BoundPredicate,
+    ) -> Result<()> {
+        Ok(())
+    }
+}
+
+/// Check whether a datum value might be present in the bloom filter.
+///
+/// The value must be checked using the same physical encoding the Parquet
+/// writer used when inserting into the bloom filter. We use the actual
+/// physical type from the column metadata to ensure correctness regardless
+/// of which writer produced the file.
+fn check_in_bloom_filter(column: &ColumnBloomFilter, datum: &Datum) -> bool {
+    let ColumnBloomFilter {
+        sbbf,
+        physical_type,
+        type_length,
+    } = column;
+    let physical_type = *physical_type;
+
+    match datum.literal() {
+        PrimitiveLiteral::Boolean(v) => sbbf.check(v),
+        // A promoted column (int -> long, float -> double) keeps its original
+        // physical width in files written before the promotion, and the writer
+        // hashed that width, so probe at the file's width rather than the
+        // predicate's.
+        PrimitiveLiteral::Int(v) => match physical_type {
+            PhysicalType::INT32 => sbbf.check(v),
+            PhysicalType::INT64 => sbbf.check(&i64::from(*v)),
+            _ => true,
+        },
+        PrimitiveLiteral::Long(v) => match physical_type {
+            PhysicalType::INT64 => sbbf.check(v),
+            PhysicalType::INT32 => match i32::try_from(*v) {
+                Ok(narrowed) => sbbf.check(&narrowed),
+                // Out of range for the column, so it cannot be present.
+                Err(_) => true,
+            },
+            _ => true,
+        },
+        PrimitiveLiteral::Float(v) => match physical_type {
+            PhysicalType::FLOAT => sbbf.check(&v.0),
+            PhysicalType::DOUBLE => sbbf.check(&f64::from(v.0)),
+            _ => true,
+        },
+        PrimitiveLiteral::Double(v) => match physical_type {
+            PhysicalType::DOUBLE => sbbf.check(&v.0),
+            PhysicalType::FLOAT => {
+                let narrowed = v.0 as f32;
+                // Only an exactly representable value can equal a widened f32.
+                if f64::from(narrowed) == v.0 {
+                    sbbf.check(&narrowed)
+                } else {
+                    true
+                }
+            }
+            _ => true,
+        },
+        PrimitiveLiteral::String(v) => sbbf.check(v.as_str()),
+        PrimitiveLiteral::Binary(v) => sbbf.check(v.as_slice()),
+        PrimitiveLiteral::Int128(v) => {
+            // Decimal: dispatch based on the actual Parquet physical type
+            // from the file, not inferred from precision.
+            match physical_type {
+                PhysicalType::INT32 => sbbf.check(&(*v as i32)),
+                PhysicalType::INT64 => sbbf.check(&(*v as i64)),
+                PhysicalType::FIXED_LEN_BYTE_ARRAY => {
+                    // Encode to the file's declared length, not one derived 
from
+                    // the Iceberg precision: a widened precision would change 
the
+                    // length and miss every entry the writer inserted.
+                    match usize::try_from(*type_length)
+                        .ok()
+                        .and_then(|len| 
decimal_to_fixed_length_bytes_exact(*v, len))
+                    {
+                        Some(bytes) => sbbf.check(&ByteArray::from(bytes)),
+                        // Unusable length, or a value too large for the 
column to
+                        // hold — conservatively might match.
+                        None => true,
+                    }
+                }
+                _ => true, // Unexpected physical type — conservatively might 
match

Review Comment:
   This `_ => true` covers a physical type that the Iceberg spec's [Appendix 
A](https://iceberg.apache.org/spec/#parquet) doesn't allow for decimal, since 
it permits only `int32`, `int64`, or `fixed`. Being lenient on read seems 
right, so an error isn't obviously called for, but the row group then silently 
stops being prunable with no way to tell that from "the filter said might 
match".
   
   Would a `tracing::debug!` naming the field and the physical type be worth 
adding, here and on the `None => true` at L282? `row_filter.rs:109` logs an 
analogous absent-index case the same way.



##########
crates/iceberg/src/arrow/reader/pipeline.rs:
##########
@@ -692,6 +721,69 @@ impl FileScanTaskReader {
 
         Ok(Box::pin(record_batch_stream) as ArrowRecordBatchStream)
     }
+
+    /// Reads bloom filters for relevant columns and evaluates the predicate
+    /// against them to filter out row groups that definitely don't match.
+    async fn filter_row_groups_by_bloom_filter(
+        predicate: &crate::expr::BoundPredicate,

Review Comment:
   `predicate: &crate::expr::BoundPredicate` is fully qualified here while the 
rest of the signature uses imported names. Worth importing `BoundPredicate` at 
the top of the file for consistency?



##########
crates/iceberg/src/arrow/reader/pipeline.rs:
##########
@@ -692,6 +721,69 @@ impl FileScanTaskReader {
 
         Ok(Box::pin(record_batch_stream) as ArrowRecordBatchStream)
     }
+
+    /// Reads bloom filters for relevant columns and evaluates the predicate
+    /// against them to filter out row groups that definitely don't match.
+    async fn filter_row_groups_by_bloom_filter(
+        predicate: &crate::expr::BoundPredicate,
+        builder: &mut ParquetRecordBatchStreamBuilder<ArrowFileReader>,
+        candidate_row_groups: &[usize],
+        field_id_map: &HashMap<i32, usize>,
+    ) -> Result<Vec<usize>> {
+        // Only collect field IDs from eq/in predicates — the only types
+        // bloom filters can help with. Skip columns not in the parquet schema.
+        let bloom_filter_field_ids: Vec<i32> = 
collect_bloom_filter_field_ids(predicate)?
+            .into_iter()
+            .filter(|id| field_id_map.contains_key(id))
+            .collect();
+
+        if bloom_filter_field_ids.is_empty() {
+            return Ok(candidate_row_groups.to_vec());
+        }
+
+        let mut result = Vec::with_capacity(candidate_row_groups.len());
+
+        for &rg_idx in candidate_row_groups {
+            let mut bloom_filters: HashMap<i32, ColumnBloomFilter> = 
HashMap::new();
+
+            for &field_id in &bloom_filter_field_ids {
+                let col_idx = field_id_map[&field_id];
+                let col_meta = 
builder.metadata().row_group(rg_idx).column(col_idx);
+
+                // Only attempt to load if this column chunk actually has a 
bloom filter
+                if col_meta.bloom_filter_offset().is_none() {
+                    continue;
+                }
+
+                let physical_type = col_meta.column_type();
+                let type_length = col_meta.column_descr().type_length();
+
+                match builder
+                    .get_row_group_column_bloom_filter(rg_idx, col_idx)
+                    .await
+                {
+                    Ok(Some(sbbf)) => {
+                        bloom_filters.insert(
+                            field_id,
+                            ColumnBloomFilter::new(sbbf, physical_type, 
type_length),
+                        );
+                    }
+                    Ok(None) => {}
+                    Err(_) => {

Review Comment:
   This and the `Err(_)` at L781 discard the error entirely. Fail-open seems 
right, but if reads were failing systematically there'd be no signal and 
nothing to diagnose from. `row_filter.rs:109` logs the analogous absent-index 
case with `tracing::debug!`, so something like this would match:
   
   ```rust
   Err(e) => tracing::debug!("Bloom filter for field {field_id} could not be 
read: {e}"),
   ```



##########
crates/iceberg/src/arrow/reader/pipeline.rs:
##########
@@ -692,6 +721,69 @@ impl FileScanTaskReader {
 
         Ok(Box::pin(record_batch_stream) as ArrowRecordBatchStream)
     }
+
+    /// Reads bloom filters for relevant columns and evaluates the predicate
+    /// against them to filter out row groups that definitely don't match.
+    async fn filter_row_groups_by_bloom_filter(
+        predicate: &crate::expr::BoundPredicate,
+        builder: &mut ParquetRecordBatchStreamBuilder<ArrowFileReader>,
+        candidate_row_groups: &[usize],
+        field_id_map: &HashMap<i32, usize>,
+    ) -> Result<Vec<usize>> {
+        // Only collect field IDs from eq/in predicates — the only types
+        // bloom filters can help with. Skip columns not in the parquet schema.
+        let bloom_filter_field_ids: Vec<i32> = 
collect_bloom_filter_field_ids(predicate)?
+            .into_iter()
+            .filter(|id| field_id_map.contains_key(id))
+            .collect();
+
+        if bloom_filter_field_ids.is_empty() {
+            return Ok(candidate_row_groups.to_vec());
+        }
+
+        let mut result = Vec::with_capacity(candidate_row_groups.len());
+
+        for &rg_idx in candidate_row_groups {
+            let mut bloom_filters: HashMap<i32, ColumnBloomFilter> = 
HashMap::new();
+
+            for &field_id in &bloom_filter_field_ids {
+                let col_idx = field_id_map[&field_id];
+                let col_meta = 
builder.metadata().row_group(rg_idx).column(col_idx);
+
+                // Only attempt to load if this column chunk actually has a 
bloom filter
+                if col_meta.bloom_filter_offset().is_none() {

Review Comment:
   Is this `bloom_filter_offset().is_none()` pre-check needed? 
`get_row_group_column_bloom_filter` appears to make the same check and return 
`Ok(None)` before any I/O, which the `Ok(None)` arm at L771 already handles.



##########
crates/iceberg/src/arrow/reader/pipeline.rs:
##########
@@ -692,6 +721,69 @@ impl FileScanTaskReader {
 
         Ok(Box::pin(record_batch_stream) as ArrowRecordBatchStream)
     }
+
+    /// Reads bloom filters for relevant columns and evaluates the predicate
+    /// against them to filter out row groups that definitely don't match.
+    async fn filter_row_groups_by_bloom_filter(
+        predicate: &crate::expr::BoundPredicate,
+        builder: &mut ParquetRecordBatchStreamBuilder<ArrowFileReader>,
+        candidate_row_groups: &[usize],
+        field_id_map: &HashMap<i32, usize>,
+    ) -> Result<Vec<usize>> {
+        // Only collect field IDs from eq/in predicates — the only types
+        // bloom filters can help with. Skip columns not in the parquet schema.
+        let bloom_filter_field_ids: Vec<i32> = 
collect_bloom_filter_field_ids(predicate)?
+            .into_iter()
+            .filter(|id| field_id_map.contains_key(id))
+            .collect();
+
+        if bloom_filter_field_ids.is_empty() {
+            return Ok(candidate_row_groups.to_vec());
+        }
+
+        let mut result = Vec::with_capacity(candidate_row_groups.len());
+
+        for &rg_idx in candidate_row_groups {
+            let mut bloom_filters: HashMap<i32, ColumnBloomFilter> = 
HashMap::new();
+
+            for &field_id in &bloom_filter_field_ids {
+                let col_idx = field_id_map[&field_id];
+                let col_meta = 
builder.metadata().row_group(rg_idx).column(col_idx);
+
+                // Only attempt to load if this column chunk actually has a 
bloom filter
+                if col_meta.bloom_filter_offset().is_none() {
+                    continue;
+                }
+
+                let physical_type = col_meta.column_type();
+                let type_length = col_meta.column_descr().type_length();
+
+                match builder
+                    .get_row_group_column_bloom_filter(rg_idx, col_idx)

Review Comment:
   These fetches look sequential, one awaited 
`get_row_group_column_bloom_filter` at a time, nested inside the per-row-group 
loop. A file with 100 row groups and 3 predicate columns would be up to 300 
serialized round trips. On high-latency object storage, could that cost more 
than the pruning saves? `try_buffer_unordered` against a concurrency limit is 
used in this file at L100.
   
   Separately, is there a way for a user to tell whether the option helped? 
Nothing appears to record row groups pruned, and `ScanMetrics` only exposes 
`bytes_read`, so that may be better as a follow-up than something for this PR.



##########
crates/iceberg/src/arrow/reader/pipeline.rs:
##########
@@ -632,6 +637,30 @@ impl FileScanTaskReader {
                 };
             }
 
+            if self.bloom_filter_enabled {
+                let all_rgs;
+                let candidate_rgs = match &selected_row_group_indices {
+                    Some(indices) => indices.as_slice(),
+                    None => {
+                        all_rgs = 
(0..record_batch_stream_builder.metadata().num_row_groups())
+                            .collect::<Vec<_>>();
+                        &all_rgs
+                    }
+                };
+
+                let bloom_filtered = Self::filter_row_groups_by_bloom_filter(
+                    &predicate,
+                    &mut record_batch_stream_builder,
+                    candidate_rgs,
+                    &field_id_map,
+                )
+                .await?;
+
+                if bloom_filtered.len() < candidate_rgs.len() {

Review Comment:
   Since `bloom_filtered` is an order-preserving subset of `candidate_rgs`, is 
`bloom_filtered.len() < candidate_rgs.len()` ever false when the contents 
differ? Wondering whether the guard is needed.



##########
crates/iceberg/src/arrow/reader/row_filter.rs:
##########
@@ -1280,4 +1280,175 @@ mod tests {
             "positional deletes must be applied correctly even when page 
indexes are absent"
         );
     }
+
+    /// Tests that bloom filter pushdown correctly prunes row groups.
+    #[tokio::test]
+    async fn test_bloom_filter_pushdown_prunes_row_groups() {

Review Comment:
   This test passes with pushdown disabled, so it doesn't demonstrate pruning. 
Running the same case both ways:
   
   ```
   int32 id=150: bloom_on=1 bloom_off=1
   ```
   
   The assertion at L1366 holds either way, since the row filter alone produces 
one row with `id == 150`. Would asserting on `ScanResult::metrics()`, checking 
bytes read is lower with pushdown on, test the pruning more directly? The same 
applies to `test_bloom_filter_pushdown_value_absent` at L1376, where a zero-row 
result is also what plain filtering gives.
   
   More broadly, I think there's a gap here that no single test covers: nothing 
asserts that results are identical with the option on and off. That property is 
what catches encoding bugs in the bloom path, since those show up as rows that 
pushdown drops and the row filter keeps, which is exactly the failure mode the 
decimal arms are guarding against. A helper that reads a file both ways and 
asserts the batches match, plus one `#[tokio::test]` per case, would cover a 
lot cheaply: Int32 eq, Int32 in, string eq, decimal at each physical width 
including a widened-precision file, float positive and negative zero, and a 
file with no bloom filters. Coverage here is currently Int32-only.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to