From: Tom Lane <tgl@sss.pgh.pa.us>
To: pgsql-bugs@lists.postgresql.org
cc: Richard Guo <guofenglinux@gmail.com>, francois.jehl@pigment.com,
        Robert Haas <robertmhaas@gmail.com>
Subject: Re: BUG #19460: FULL JOIN rewriting issue on empty queries
In-reply-to: <420865.1776712988@sss.pgh.pa.us>
References: <19460-5625143cef66012f@postgresql.org> <53936.1776633020@sss.pgh.pa.us> <CAMbWs48E2qqd4B6AdvJDyPBi685-_bDEvoe0aJnYzAPL1v30zg@mail.gmail.com> <81857.1776648374@sss.pgh.pa.us> <CAMbWs49PPxhrqBjHj3Wy4hK4=_DoHkJdAHL_q1mqpyyCk5MdMw@mail.gmail.com> <88899.1776652344@sss.pgh.pa.us> <CAMbWs4_nNfYktwQu4vNbienz+6oKXeE1Vzq9K_qH9F19MaJoMQ@mail.gmail.com> <418974.1776711680@sss.pgh.pa.us> <420865.1776712988@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Mon, 20 Apr 2026 15:23:08 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <458728.1776724816.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Mon, 20 Apr 2026 18:40:16 -0400
Message-ID: <458729.1776724816@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/458729.1776724816%40sss.pgh.pa.us>
Precedence: bulk

I wrote:
>> Pushed at cfcd57111 et al.  Thanks again for the report!

> Hmm, skink seems unhappy with this.  Looking...

Ah: equivclass.c doesn't mind letting em->em_relids be an alias
for the left_relids or right_relids of some source RestrictInfo.
That's not problematic as long as those are all constants after
construction of the EquivalenceClass, but when remove_rel_from_eclass
is trying to change things, it's a big problem.

This seems to do the trick to fix it, although I'm going to wait
for a valgrind regression run to finish before deciding this
is enough:

diff --git a/src/backend/optimizer/plan/analyzejoins.c b/src/backend/optim=
izer/plan/analyzejoins.c
index bfb1af614c2..03056bdf3e0 100644
--- a/src/backend/optimizer/plan/analyzejoins.c
+++ b/src/backend/optimizer/plan/analyzejoins.c
@@ -783,6 +783,8 @@ remove_rel_from_eclass(EquivalenceClass *ec, int relid=
, int ojrelid)
 			bms_is_member(ojrelid, cur_em->em_relids))
 		{
 			Assert(!cur_em->em_is_const);
+			/* em_relids is likely to be shared with some RestrictInfo */
+			cur_em->em_relids =3D bms_copy(cur_em->em_relids);
 			cur_em->em_relids =3D bms_del_member(cur_em->em_relids, relid);
 			cur_em->em_relids =3D bms_del_member(cur_em->em_relids, ojrelid);
 			if (bms_is_empty(cur_em->em_relids))


This discovery may help explain why we'd seen so few trouble
reports up to now.  At least some RestrictInfos' left/right_relids
would have indirectly gotten "fixed" by the above.

BTW, the case that is crashing the regression tests is where the above
bit reduces em_relids to empty, allowing bms_del_member to pfree it.
Now, the source RestrictInfo's left/right_relids is pointing at
garbage.  The reason this didn't cause trouble before is that if
em_relids becomes empty, we remove that EquivalenceMember altogether,
and apparently that's enough to keep us from consulting the source
RestrictInfo anymore.  But the loop over ec_sources just below does
see it, and now it is needing the left/right_relids to be valid.

			regards, tom lane