From: Tom Lane <tgl@sss.pgh.pa.us>
To: Andres Freund <andres@anarazel.de>
cc: David Rowley <dgrowleyml@gmail.com>, redraiment@gmail.com,
        pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19370: PG18 returns incorrect array slice results when slice
 bounds depend on another array expression
In-reply-to: <1588384.1767715181@sss.pgh.pa.us>
References: <19370-7fb7a5854b7618f1@postgresql.org>
 <CAApHDvpVwUTNEQKkBVD9CQCq6N+YW7hpH6C3ZtKJQnGX4XAtpA@mail.gmail.com>
 <1588384.1767715181@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Tue, 06 Jan 2026 10:59:41 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1593904.1767717601.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Tue, 06 Jan 2026 11:40:01 -0500
Message-ID: <1593905.1767717601@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1593905.1767717601%40sss.pgh.pa.us>
Precedence: bulk

I wrote:
> After re-reading that patch, I suspect an aliasing problem,
> specifically from this bit in ExecInitSubPlanExpr:

>      * ... No
>      * danger of conflicts with other uses of resvalue/resnull as storin=
g and
>      * using the value always is in subsequent steps.

>         ExecInitExprRec(arg, state,
>                         &state->resvalue, &state->resnull);

Yup, that's it.  The problem occurs when a SubPlan is in the
subscripts of an array reference.  In that case,
ExecInitSubscriptingRef has already emitted code to load the source
array into its target resv/resnull, which might well be the
ExprState's resvalue/resnull.  So it's not okay for the array
subscript calculation steps to overwrite the ExprState's
resvalue/resnull, but ExecInitSubPlanExpr thinks it can.

We *could* safely use ExecInitSubPlanExpr's target resv/resnull,
but that doesn't line up with EEOP_PARAM_SET's definition:
ExecEvalParamSet is hard-wired to store from state->resvalue/resnull.
I thought all along that that was probably too simplistic.

We could either generalize EEOP_PARAM_SET to include an explicit
specification of the source value's address, or insert some kind
of LOAD operation to copy the computed value into
state->resvalue/resnull.  I don't see anything that looks like
that today, though.

			regards, tom lane