postgres.git / summary / log / commit / refs

commit    717e8a1e5256fd01ed5b4cd60f2aac97dceb00bd
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Sat Apr 05 16:13:35 2025 +0000

    Avoid double transformation of json_array()'s subquery.
    
    transformJsonArrayQueryConstructor() applied transformStmt() to
    the same subquery tree twice.  While this causes no issue in many
    cases, there are some where it causes a coredump, thanks to the
    parser's habit of scribbling on its input.
    
    Fix by making a copy before the first transformation (compare
    0f43083d1).  This is quite brute-force, but then so is the
    whole business of transforming the input twice.  Per discussion
    in the bug thread, this implementation of json_array() parsing
    should be replaced completely.  But that will take some work
    and will surely not be back-patchable, so for the moment let's
    take the easy way out.
    
    Oversight in 7081ac46a.  Back-patch to v16 where that came in.
    
    Bug: #18877
    Reported-by: Yu Liang <luy70@psu.edu>
    Author: Tom Lane <tgl@sss.pgh.pa.us>
    Discussion: https://postgr.es/m/18877-c3c3ad75845833bb@postgresql.org
    Backpatch-through: 16


 src/backend/parser/parse_expr.c       | 2 +-
 src/test/regress/expected/sqljson.out | 6 ++++++
 src/test/regress/sql/sqljson.sql      | 2 ++
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/backend/parser/parse_expr.c b/src/backend/parser/parse_expr.c
index 2258701f301..8423542021f 100644
--- a/src/backend/parser/parse_expr.c
+++ b/src/backend/parser/parse_expr.c
@@ -3764,7 +3764,7 @@ transformJsonArrayQueryConstructor(ParseState *pstate,
 	/* Transform query only for counting target list entries. */
 	qpstate = make_parsestate(pstate);
 
-	query = transformStmt(qpstate, ctor->query);
+	query = transformStmt(qpstate, copyObject(ctor->query));
 
 	if (count_nonjunk_tlist_entries(query->targetList) != 1)
 		ereport(ERROR,
diff --git a/src/test/regress/expected/sqljson.out b/src/test/regress/expected/sqljson.out
index 17a889eb8ef..67b68dfc232 100644
--- a/src/test/regress/expected/sqljson.out
+++ b/src/test/regress/expected/sqljson.out
@@ -747,6 +747,12 @@ SELECT JSON_ARRAY(SELECT i FROM (VALUES (3), (1), (NULL), (2)) foo(i) ORDER BY i
  [1, 2, 3]
 (1 row)
 
+SELECT JSON_ARRAY(WITH x AS (SELECT 1) VALUES (TRUE));
+ json_array 
+------------
+ [true]
+(1 row)
+
 -- Should fail
 SELECT JSON_ARRAY(SELECT FROM (VALUES (1)) foo(i));
 ERROR:  subquery must return only one column
diff --git a/src/test/regress/sql/sqljson.sql b/src/test/regress/sql/sqljson.sql
index 3fd6ac260b8..343d344d270 100644
--- a/src/test/regress/sql/sqljson.sql
+++ b/src/test/regress/sql/sqljson.sql
@@ -199,6 +199,8 @@ SELECT JSON_ARRAY(SELECT i FROM (VALUES (NULL::int[]), ('{1,2}'), (NULL), (NULL)
 --SELECT JSON_ARRAY(SELECT i FROM (VALUES (NULL::int[]), ('{1,2}'), (NULL), (NULL), ('{3,4}'), (NULL)) foo(i) NULL ON NULL);
 --SELECT JSON_ARRAY(SELECT i FROM (VALUES (NULL::int[]), ('{1,2}'), (NULL), (NULL), ('{3,4}'), (NULL)) foo(i) NULL ON NULL RETURNING jsonb);
 SELECT JSON_ARRAY(SELECT i FROM (VALUES (3), (1), (NULL), (2)) foo(i) ORDER BY i);
+SELECT JSON_ARRAY(WITH x AS (SELECT 1) VALUES (TRUE));
+
 -- Should fail
 SELECT JSON_ARRAY(SELECT FROM (VALUES (1)) foo(i));
 SELECT JSON_ARRAY(SELECT i, i FROM (VALUES (1)) foo(i));


[parent: 5e6e97fbf403]