pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #17067: FailedAssertion at castNodeImpl
8+ messages / 4 participants
[nested] [flat]
* BUG #17067: FailedAssertion at castNodeImpl
@ 2021-06-21 03:11 PG Bug reporting form <noreply@postgresql.org>
0 siblings, 1 reply; 8+ messages in thread
From: PG Bug reporting form @ 2021-06-21 03:11 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: cyg0810@gmail.com
The following bug has been logged on the website:
Bug reference: 17067
Logged by: yaoguang chen
Email address: cyg0810@gmail.com
PostgreSQL version: 14beta1
Operating system: Linux supersix 5.4.0-39-generic #43-Ubuntu SMP Fri
Description:
run the following sql command through client and the PostgreSQL database
process will crash:
CREATE TABLE v0 ( v1 FLOAT NOT NULL PRIMARY KEY ) ;
WITH v1 AS ( DELETE FROM v0 WHERE v1 <= - - - 9 RETURNING * ) INSERT INTO v0
VALUES ( - - - - - - 95 ) ;
SELECT v1 FROM ( SELECT * FROM v0 UNION ALL SELECT * FROM v0 GROUP BY
DISTINCT ROLLUP ( v1 , v1 ) , ROLLUP ( v1 , USER ) , GROUPING SETS ( ROW ( )
, ( v1 ) ) , ROLLUP ( v1 < - - 61 AND v1 IN ( -2147483648 , - 94 ) , v1 ) )
v1 ORDER BY ( v1 + - - -1 ) , ( v1 + - - v1 IN ( SELECT v1 FALSE FROM (
SELECT FROM v0 GROUP BY v1 ) PRECISION ) ) ;
log detail:
2021-06-21 10:45:03.577 CST [2780861] HINT: Future log output will go to
log destination "csvlog".
TRAP: FailedAssertion("ptr == NULL || nodeTag(ptr) == type", File:
"/home/supersix/fuzz/security/PostgreSQL/postgres/build/../src/include/nodes/nodes.h",
Line: 603, PID: 2780889)
postgres: supersix template1 [local]
SELECT(ExceptionalCondition+0xbb)[0x560474d5104b]
postgres: supersix template1 [local] SELECT(+0x2e5bfb)[0x5604746acbfb]
postgres: supersix template1 [local]
SELECT(parseCheckAggregates+0xae)[0x5604746aeaae]
postgres: supersix template1 [local] SELECT(+0x2be52d)[0x56047468552d]
postgres: supersix template1 [local]
SELECT(transformStmt+0x1ab3)[0x560474687163]
postgres: supersix template1 [local] SELECT(+0x2c2f59)[0x560474689f59]
postgres: supersix template1 [local] SELECT(+0x2c326f)[0x56047468a26f]
postgres: supersix template1 [local]
SELECT(transformStmt+0x1cc3)[0x560474687373]
postgres: supersix template1 [local]
SELECT(parse_sub_analyze+0x3f)[0x56047468880f]
postgres: supersix template1 [local] SELECT(+0x2eb7d7)[0x5604746b27d7]
postgres: supersix template1 [local]
SELECT(transformFromClause+0x8d)[0x5604746b4f6d]
postgres: supersix template1 [local] SELECT(+0x2be27d)[0x56047468527d]
postgres: supersix template1 [local]
SELECT(transformStmt+0x1ab3)[0x560474687163]
postgres: supersix template1 [local]
SELECT(parse_analyze+0x7c)[0x560474688a0c]
postgres: supersix template1 [local] SELECT(+0x735a0d)[0x560474afca0d]
postgres: supersix template1 [local]
SELECT(PostgresMain+0x1ae7)[0x560474afeda7]
postgres: supersix template1 [local] SELECT(+0x61676f)[0x5604749dd76f]
postgres: supersix template1 [local]
SELECT(PostmasterMain+0x1182)[0x5604749e06c2]
postgres: supersix template1 [local] SELECT(main+0x533)[0x560474490133]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf3)[0x7ffb088d00b3]
postgres: supersix template1 [local] SELECT(_start+0x2e)[0x56047449028e]
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: BUG #17067: FailedAssertion at castNodeImpl
@ 2021-06-21 09:47 David Rowley <dgrowleyml@gmail.com>
parent: PG Bug reporting form <noreply@postgresql.org>
0 siblings, 3 replies; 8+ messages in thread
From: David Rowley @ 2021-06-21 09:47 UTC (permalink / raw)
To: cyg0810@gmail.com, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
On Mon, 21 Jun 2021 at 20:15, PG Bug reporting form
<noreply@postgresql.org> wrote:
> run the following sql command through client and the PostgreSQL database
> process will crash:
>
> CREATE TABLE v0 ( v1 FLOAT NOT NULL PRIMARY KEY ) ;
> WITH v1 AS ( DELETE FROM v0 WHERE v1 <= - - - 9 RETURNING * ) INSERT INTO v0
> VALUES ( - - - - - - 95 ) ;
> SELECT v1 FROM ( SELECT * FROM v0 UNION ALL SELECT * FROM v0 GROUP BY
> DISTINCT ROLLUP ( v1 , v1 ) , ROLLUP ( v1 , USER ) , GROUPING SETS ( ROW ( )
> , ( v1 ) ) , ROLLUP ( v1 < - - 61 AND v1 IN ( -2147483648 , - 94 ) , v1 ) )
> v1 ORDER BY ( v1 + - - -1 ) , ( v1 + - - v1 IN ( SELECT v1 FALSE FROM (
> SELECT FROM v0 GROUP BY v1 ) PRECISION ) ) ;
Thanks for the report. It looks like a thinko in 1d581ce71. Code
was added there which insists the initial list element is a List, but
it's an IntList. I think the code should just use linitial instead of
linitial_node.
I'm quite surprised that we don't have a test that picks this up.
David
Attachments:
[application/octet-stream] fixbug17067.patch (509B, ../../CAApHDvppyj_WrraCrSgQvDd_NGJp87S6ht6OzjytomMNqa_rxw@mail.gmail.com/2-fixbug17067.patch)
download | inline diff:
diff --git a/src/backend/parser/parse_agg.c b/src/backend/parser/parse_agg.c
index 9562ffcf3e..a25f8d5b98 100644
--- a/src/backend/parser/parse_agg.c
+++ b/src/backend/parser/parse_agg.c
@@ -1855,7 +1855,7 @@ expand_grouping_sets(List *groupingSets, bool groupDistinct, int limit)
list_sort(result, cmp_list_len_contents_asc);
/* Finally, remove duplicates */
- prev = linitial_node(List, result);
+ prev = linitial(result);
for_each_from(cell, result, 1)
{
if (equal(lfirst(cell), prev))
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: BUG #17067: FailedAssertion at castNodeImpl
@ 2021-06-21 10:09 David Rowley <dgrowleyml@gmail.com>
parent: David Rowley <dgrowleyml@gmail.com>
2 siblings, 0 replies; 8+ messages in thread
From: David Rowley @ 2021-06-21 10:09 UTC (permalink / raw)
To: cyg0810@gmail.com, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
On Mon, 21 Jun 2021 at 21:47, David Rowley <dgrowleyml@gmail.com> wrote:
> I'm quite surprised that we don't have a test that picks this up.
I was just looking at [1], line 1858. I see there is a test that runs
through that code, it's just that because the previous step sorts the
List of IntLists by the length of the IntList, that the IntList with 0
items is the initial list. linitial_node() does allow NULL, so no
failure.
The test in question is this one in groupingsets.sql
select a, b, c
from (values (1, 2, 3), (4, null, 6), (7, 8, 9)) as t (a, b, c)
group by distinct rollup(a, b), rollup(a, c)
order by a, b, c;
Changing it to the following triggers the failure.
select a, b, c
from (values (1, 2, 3), (4, null, 6), (7, 8, 9)) as t (a, b, c)
group by distinct rollup(a, b), rollup(a, c), grouping sets (a)
order by a, b, c;
David
[1] https://coverage.postgresql.org/src/backend/parser/parse_agg.c.gcov.html
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: BUG #17067: FailedAssertion at castNodeImpl
@ 2021-06-21 10:09 Richard Guo <guofenglinux@gmail.com>
parent: David Rowley <dgrowleyml@gmail.com>
2 siblings, 1 reply; 8+ messages in thread
From: Richard Guo @ 2021-06-21 10:09 UTC (permalink / raw)
To: David Rowley <dgrowleyml@gmail.com>; +Cc: cyg0810@gmail.com, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
On Mon, Jun 21, 2021 at 5:48 PM David Rowley <dgrowleyml@gmail.com> wrote:
> On Mon, 21 Jun 2021 at 20:15, PG Bug reporting form
> <noreply@postgresql.org> wrote:
> > run the following sql command through client and the PostgreSQL database
> > process will crash:
> >
> > CREATE TABLE v0 ( v1 FLOAT NOT NULL PRIMARY KEY ) ;
> > WITH v1 AS ( DELETE FROM v0 WHERE v1 <= - - - 9 RETURNING * ) INSERT
> INTO v0
> > VALUES ( - - - - - - 95 ) ;
> > SELECT v1 FROM ( SELECT * FROM v0 UNION ALL SELECT * FROM v0 GROUP BY
> > DISTINCT ROLLUP ( v1 , v1 ) , ROLLUP ( v1 , USER ) , GROUPING SETS ( ROW
> ( )
> > , ( v1 ) ) , ROLLUP ( v1 < - - 61 AND v1 IN ( -2147483648 , - 94 ) , v1
> ) )
> > v1 ORDER BY ( v1 + - - -1 ) , ( v1 + - - v1 IN ( SELECT v1 FALSE FROM (
> > SELECT FROM v0 GROUP BY v1 ) PRECISION ) ) ;
>
> Thanks for the report. It looks like a thinko in 1d581ce71. Code
> was added there which insists the initial list element is a List, but
> it's an IntList. I think the code should just use linitial instead of
> linitial_node.
>
> I'm quite surprised that we don't have a test that picks this up.
>
A distinct group by clause would help to reveal this issue as:
explain select * from t GROUP BY distinct a, rollup(b);
Maybe we can add a test case to cover it.
Thanks
Richard
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: BUG #17067: FailedAssertion at castNodeImpl
@ 2021-06-21 11:13 David Rowley <dgrowleyml@gmail.com>
parent: Richard Guo <guofenglinux@gmail.com>
0 siblings, 0 replies; 8+ messages in thread
From: David Rowley @ 2021-06-21 11:13 UTC (permalink / raw)
To: Richard Guo <guofenglinux@gmail.com>; +Cc: cyg0810@gmail.com, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
On Mon, 21 Jun 2021 at 22:10, Richard Guo <guofenglinux@gmail.com> wrote:
> On Mon, Jun 21, 2021 at 5:48 PM David Rowley <dgrowleyml@gmail.com> wrote:
>> I'm quite surprised that we don't have a test that picks this up.
>
>
> A distinct group by clause would help to reveal this issue as:
>
> explain select * from t GROUP BY distinct a, rollup(b);
>
> Maybe we can add a test case to cover it.
Since beta2 deadline is looming, I pushed the simple fix for now. I'll
start a thread on hackers to ask the authors of the patch about
additional testing.
Yaoguang, the fix went in as of [1]. Thanks again for the report.
David
[1] https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=8d29d45d9b3cab95a866efbcdd9138b3d7674...
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: BUG #17067: FailedAssertion at castNodeImpl
@ 2021-06-21 13:33 Tom Lane <tgl@sss.pgh.pa.us>
parent: David Rowley <dgrowleyml@gmail.com>
2 siblings, 1 reply; 8+ messages in thread
From: Tom Lane @ 2021-06-21 13:33 UTC (permalink / raw)
To: David Rowley <dgrowleyml@gmail.com>; +Cc: cyg0810@gmail.com, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
David Rowley <dgrowleyml@gmail.com> writes:
> On Mon, 21 Jun 2021 at 20:15, PG Bug reporting form
> <noreply@postgresql.org> wrote:
>> run the following sql command through client and the PostgreSQL database
>> process will crash:
> Thanks for the report. It looks like a thinko in 1d581ce71. Code
> was added there which insists the initial list element is a List, but
> it's an IntList. I think the code should just use linitial instead of
> linitial_node.
Hmm, if it's an int-list then the subsequent dup-elimination loop is
also wrong, and for that matter I don't think the preceding lines
would have worked.
> I'm quite surprised that we don't have a test that picks this up.
The code coverage report shows that we *do* have tests that run
through this code, so the existing typing is okay in the test cases
we have. I'm guessing the real problem is that something upstream is
generating the wrong type of list in this example.
regards, tom lane
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: BUG #17067: FailedAssertion at castNodeImpl
@ 2021-06-21 14:18 David Rowley <dgrowleyml@gmail.com>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 8+ messages in thread
From: David Rowley @ 2021-06-21 14:18 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: cyg0810@gmail.com, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
On Tue, 22 Jun 2021 at 01:33, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> David Rowley <dgrowleyml@gmail.com> writes:
> > I'm quite surprised that we don't have a test that picks this up.
>
> The code coverage report shows that we *do* have tests that run
> through this code, so the existing typing is okay in the test cases
> we have. I'm guessing the real problem is that something upstream is
> generating the wrong type of list in this example.
My analysis into why that test passes is in [1]. Did you miss that or
did you have another idea?
David
[1] https://www.postgresql.org/message-id/CAApHDvq0sqRfWCGj2JfZDs9DEiDfaBs=067Err3=EK09ct8bjg@mail.gmail...
^ permalink raw reply [nested|flat] 8+ messages in thread
* Re: BUG #17067: FailedAssertion at castNodeImpl
@ 2021-06-21 14:24 Tom Lane <tgl@sss.pgh.pa.us>
parent: David Rowley <dgrowleyml@gmail.com>
0 siblings, 0 replies; 8+ messages in thread
From: Tom Lane @ 2021-06-21 14:24 UTC (permalink / raw)
To: David Rowley <dgrowleyml@gmail.com>; +Cc: cyg0810@gmail.com, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
David Rowley <dgrowleyml@gmail.com> writes:
> On Tue, 22 Jun 2021 at 01:33, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> I'm guessing the real problem is that something upstream is
>> generating the wrong type of list in this example.
> My analysis into why that test passes is in [1]. Did you miss that or
> did you have another idea?
Yeah, I hadn't gotten to that yet :-(. Never mind ...
regards, tom lane
^ permalink raw reply [nested|flat] 8+ messages in thread
end of thread, other threads:[~2021-06-21 14:24 UTC | newest]
Thread overview: 8+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2021-06-21 03:11 BUG #17067: FailedAssertion at castNodeImpl PG Bug reporting form <noreply@postgresql.org>
2021-06-21 09:47 ` David Rowley <dgrowleyml@gmail.com>
2021-06-21 10:09 ` David Rowley <dgrowleyml@gmail.com>
2021-06-21 10:09 ` Richard Guo <guofenglinux@gmail.com>
2021-06-21 11:13 ` David Rowley <dgrowleyml@gmail.com>
2021-06-21 13:33 ` Tom Lane <tgl@sss.pgh.pa.us>
2021-06-21 14:18 ` David Rowley <dgrowleyml@gmail.com>
2021-06-21 14:24 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox