From: Tom Lane <tgl@sss.pgh.pa.us>
To: Alexander Lakhin <exclusion@gmail.com>
cc: pgsql-bugs@lists.postgresql.org,
        Aleksander Alekseev <aleksander@timescale.com>, dhyan@nataraj.su
Subject: Re: BUG #18708: regex problem: (?:[^\d\D]){0} asserts with "lp->nouts
 == 0 && rp->nins == 0"
In-reply-to: <2958975.1731817729@sss.pgh.pa.us>
References: <18708-f94f2599c9d2c005@postgresql.org>
 <CAJ7c6TMPSrcbzkX0ePnNTbh7M22hRiPfD0KOcW4L9YjdbnF0Ug@mail.gmail.com>
 <2242483.1731627374@sss.pgh.pa.us> <2344149.1731636867@sss.pgh.pa.us>
 <CAJ7c6TMXLaoBB6GmgkkSRH_WoLxqSU_K6ORnw9rP+3JexuKSMQ@mail.gmail.com>
 <CAJ7c6TP+0MHu7t3QDdXHMf1DW9r56qnyr_7NsTQOB5+pKQEkcg@mail.gmail.com>
 <2631851.1731715737@sss.pgh.pa.us>
 <661fd81b-f069-8f30-1a41-e195c57449b4@gmail.com>
 <2745175.1731772978@sss.pgh.pa.us>
 <7dd96d86-bac0-4879-2555-276d2ef4a8db@gmail.com>
 <2958975.1731817729@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Sat, 16 Nov 2024 23:28:49 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2988927.1731824798.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Sun, 17 Nov 2024 01:26:38 -0500
Message-ID: <2988928.1731824798@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/2988928.1731824798%40sss.pgh.pa.us>
Precedence: bulk

I wrote:
> Alexander Lakhin <exclusion@gmail.com> writes:
>> (Un)fortunately, tern (which is also a ppc animal) has produced the sam=
e
>> failure:
>> https://buildfarm.postgresql.org/cgi-bin/show_log.pl?nm=3Dtern&dt=3D202=
4-11-16%2022%3A00%3A12

> Yeah, I saw that.  Even more confused now about what it could be.

After testing on hornet's host, it seems that this is a pre-existing
issue that we didn't happen to hit before.  Since the regex
'[^\d\D]' is unsatisfiable, it collapses to nothing (start state,
end state, and no arcs) in the first cleanup() call in optimize().
Then fixempties() counts the number of in-arcs and gets zero,
and then it does

	arcarray =3D (struct arc **) MALLOC(totalinarcs * sizeof(struct arc *));
	if (arcarray =3D=3D NULL)
	{
		NERR(REG_ESPACE);
		...

On a machine where malloc(0) returns NULL, this mistakenly
thinks that's an error.

I verified that

-	if (arcarray =3D=3D NULL)
+	if (arcarray =3D=3D NULL && totalinarcs !=3D 0)

makes the failure go away, but I wonder if any other places in
backend/regex/ are at the same hazard.  Maybe the smartest fix
would be to put in a wrapper layer that does what pg_malloc
does:

	/* Avoid unportable behavior of malloc(0) */
	if (size =3D=3D 0)
		size =3D 1;

One other point is that this theory fails to explain why
hornet didn't fail in the v16 branch ... oh, wait:
v15 has =


#define MALLOC(n)		malloc(n)

where later branches have

#define MALLOC(n)		palloc_extended((n), MCXT_ALLOC_NO_OOM)

So the right answer seems to be to figure out why we didn't
back-patch that change.

			regards, tom lane