Message-ID: <09fec706-0691-a131-5c6c-3e64ecc134fc@gmail.com>
Date: Sun, 13 Aug 2023 21:00:01 +0300
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.4.2
Subject: Re: BUG #17950: Incorrect memory access in gtsvector_picksplit()
Content-Language: en-US
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-bugs@lists.postgresql.org
References: <17950-6c80a8d2b94ec695@postgresql.org>
 <da453149-fa9e-67fc-fbce-80cca399bce5@gmail.com>
 <e2f36991-0519-bfcf-1da9-c31ca645b4ec@gmail.com>
 <665394.1691937343@sss.pgh.pa.us>
From: Alexander Lakhin <exclusion@gmail.com>
In-Reply-To: <665394.1691937343@sss.pgh.pa.us>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/09fec706-0691-a131-5c6c-3e64ecc134fc%40gmail.com>
Precedence: bulk

Hello Tom,

13.08.2023 17:35, Tom Lane wrote:
> Alexander Lakhin <exclusion@gmail.com> writes:
>> I can also propose a regression test addition that demonstrates the valgrind
>> complaint and also the output of gtsvectorout() for the case ISALLTRUE and
>> the opposite.
> OK, but ...
>
>> This addition increases the duration of `make check -C contrib/pageinspect`
>> under valgrind by 7-8 seconds for me:
> [ ie, more than triple its previous runtime ]

Yes, unfortunately.

> ... that seems completely unacceptable cost-wise.  I'd be inclined
> to commit the fix without a supporting test case, instead of that.

I've tried to make that addition as valuable as possible in the context of
this issue, but as it is too expensive (to be honest, I was bolstered by
the gin test duration (~10 secs too)), then let's leave it aside.

> Given that the misapplication of GETSIGN is causing an incorrect
> pointer to be passed to sizebitvec(), how come the error is not
> leading to outright wrong answers?  I guess because it's in
> picksplit, the worst outcome normally is a poor choice of split,
> so maybe exhibiting wrong behavior in a detectable way is hard.

(In fact, I stopped my previous research when I had come to the conclusion
that generating data pattern needed to demonstrate wrong answers or at least
an inefficient split require many more data rows than we can afford in a
regression test.)

>> In absence of any objections or other propositions, I'm inclined to register
>> this bugfix on the commitfest.
> Please do that in any case, so we don't forget about it.

Thank you!
Done:
https://commitfest.postgresql.org/44/4498/

Best regards,
Alexander