Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Subject: BUG #19632: RULE rewriting crashes with XX000 when RETURNING old/new
 references a system column
To: pgsql-bugs@lists.postgresql.org
From: PG Bug reporting form <noreply@postgresql.org>
Cc: hackerzheng666@gmail.com
Reply-To: hackerzheng666@gmail.com, pgsql-bugs@lists.postgresql.org
Date: Wed, 19 Aug 2026 03:52:11 +0000
Message-ID: <19632-9155d9baec763c8c@postgresql.org>
Auto-Submitted: auto-generated
Archived-At: 
 <https://www.postgresql.org/message-id/19632-9155d9baec763c8c%40postgresql.org>
Precedence: bulk

The following bug has been logged on the website:

Bug reference:      19632
Logged by:          Zheng Hacker
Email address:      hackerzheng666@gmail.com
PostgreSQL version: 19beta3
Operating system:   Linux x86_64
Description:       =20

PostgreSQL version: 20devel (commit bdbf662, 2026-08-19)
  OS: Linux x86_64
 =20
  When a DML query with RETURNING old.<system_column> or
  RETURNING new.<system_column> (PG 20 new syntax) is rewritten
  through a RULE, the query rewriter cannot find replacement
  targetlist entries for system columns, hitting elog(ERROR) in
  rewriteManip.c.
 =20
  Reproducer:
 =20
  CREATE TABLE t (a int);
  INSERT INTO t VALUES (1);
  CREATE RULE t_del AS ON DELETE TO t
    DO INSTEAD UPDATE t SET a =3D -1 WHERE a =3D OLD.a RETURNING *;
   =20
  -- All of these crash with XX000:
  DELETE FROM t WHERE a =3D 1 RETURNING old.tableoid;
  -- ERROR: XX000: could not find replacement targetlist entry for attno -6
  -- LOCATION: ReplaceVarFromTargetList, rewriteManip.c:1884
 =20
  DELETE FROM t WHERE a =3D 1 RETURNING old.ctid;     -- attno -1
  DELETE FROM t WHERE a =3D 1 RETURNING new.tableoid;  -- attno -6
 =20
  -- Without the RULE, the same RETURNING clause works correctly:
  DROP RULE t_del ON t;
  DELETE FROM t WHERE a =3D 1 RETURNING old.tableoid;  -- works fine
 =20
  Root cause: src/backend/rewrite/rewriteManip.c, function
  ReplaceVarFromTargetList (line 1884). When the rewriter processes
  the RULE's action to replace Vars, it iterates over the action's
  target list looking for an entry with matching resno. System
  columns have negative attribute numbers (e.g. tableoid =3D -6), but
  the RULE's RETURNING target list only contains user-defined columns
  (with positive resnos), so no match is found.
 =20
  The PG 20 old/new RETURNING syntax (var->varreturningtype !=3D
  VAR_RETURNING_DEFAULT) is handled AFTER the targetlist entry lookup
  succeeds (lines 1894-1910), so the code never reaches that logic
  for system columns.
 =20
  Affects all system columns (tableoid, ctid, xmin, cmin, xmax)
  through any RULE that uses DO INSTEAD.

  Found by automated SQL fuzzing.
  Credit: Zheng Wang, Yanjie Zhao, Yiyang Liu