Date: Tue, 19 Nov 2019 20:40:56 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Tomas Vondra <tomas.vondra@2ndquadrant.com>
Cc: Adam Scott <adam.c.scott@gmail.com>, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #16122: segfault pg_detoast_datum (datum=0x0) at fmgr.c:1833
 numrange query
Message-ID: <20191119114056.GA516103@paquier.xyz>
References: <16122-eb35bc248c806c15@postgresql.org>
 <20191118120312.cblcswef6vuqbijq@development>
 <CA+s62-Mnj-x8_ZXh7tBVU3WJ3cKUsUL2HAp2YaJSXQPw1iypFw@mail.gmail.com>
 <20191119014827.GC1614@paquier.xyz>
 <20191119103813.xnsloisoxkwrxoim@development>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="RnlQjJ0d97Da+TV1"
Content-Disposition: inline
In-Reply-To: <20191119103813.xnsloisoxkwrxoim@development>
Precedence: bulk


--RnlQjJ0d97Da+TV1
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Nov 19, 2019 at 11:38:13AM +0100, Tomas Vondra wrote:
> FWIW I've managed to reproduce this on 10, but I had to build without
> --enable-cassert. So this does trigger the issue:
>=20
> Haven't investigated further yet.

If you add an ANALYZE on the table natica_hdu_test after restoring, I
am rather sure that you would reproduce the crash more quickly because
the handling around the stats of the column are busted here.  Anyway,
taking my example of upthread, I have been also able to reproduce the
problem on REL_10_STABLE even with assertions enabled: the trick is
that you need to leave once the session after the analyze on the
table.  Then a SELECT within a new session is enough to crash the
server.

The change with stdbool.h actually makes the crash easier to reproduce
as there is no need to leave the session.  I am not sure how it
mattered..

[ ... And one bisect later ... ]

This looks more correct as culprit than the precedent because it
touches the area of the crash:
commit: 9aab83fc5039d83e84144b7bed3fb1d62a74ae78
author: Tom Lane <tgl@sss.pgh.pa.us>
date: Sat, 13 May 2017 15:14:39 -0400
Redesign get_attstatsslot()/free_attstatsslot() for more safety and speed.

It seems to me that that we are simply free'ing an area which still
needs to be accessed for the stat estimations.
--
Michael

--RnlQjJ0d97Da+TV1
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAl3T1MgACgkQnvQgOdby
QH09hRAAosfsA+Tno01tbBOq2fxvVgJikhim3pYfnuALBn+jtoR2WxagmXKti0Z2
K4QBY8nKQH4JlG0ZsyFeV1aK4faSIl6kHcajg6NRQVLYwAdokHO/GpFBQUyhJgEV
OA1rSRmwf66B7R2w4uZ6SW4J+saSfGbRk8OMh0vMurlJlkNvLVlwHUCkmFR1drkL
asNJOfmem+Guy2+2PBInZ36iqwpM5zSzkABuXHSUkJhNGHYnjQGVZjK/+sjKAEsB
RiXTB8il05HugOG+OLMP7x2D4MBd1D0hV37fE1p3f0m8e4xiczsgBn6Q5HfxuoxL
bKQXWW6T17aPoHIDpNRpyJCKI86vM0DLg8+SNn2Tw1cs1g0Dhkqww/pMOyAYDd7d
aNkehsTPSHDDf9dzYlYlaBpzagsn+YTbXDoq1+WyK9utNBd/piVdmJiRwBAmFVFg
n/YAR0H7aOs1y3rvIavgizYj7p71V/FIlHu9b2sl2qMAOhIDNrPiI/cNlO+kU7wS
W+Pyc4ogFkZZ1FLeZrb+gsINksBsEIwYejJ0mJ+rszaLBlQPBErsJJ2wXOBBiy+H
dbQmCghsRO5eLe3KYzxB8bI9JnJFfmj/iuEw9p26QRmBHGYRyTssG/gXQ7oZoj2o
Xye1g1Copm8zUsawwL+5egJi8pNYqHLle2kRG3KIY+csPZhYdEc=
=si63
-----END PGP SIGNATURE-----

--RnlQjJ0d97Da+TV1--