Subject: BUG #19496: Assert("ItemPointerIsValid(pointer)") when using pageinspect

From: PG Bug reporting form <[email-masked]>
Date: Wed, 27 May 2026 05:24:37 +0000

The following bug has been logged on the website:

Bug reference:      19496
Logged by:          Sergey Lyubimov
Email address:      [email-masked]
PostgreSQL version: 18.4
Operating system:   Ubuntu 24.04
Description:        

Hi,
I found an assertion failure in pageinspect.

SQL:
CREATE EXTENSION IF NOT EXISTS pageinspect;
WITH page AS (
    SELECT set_byte(
             set_byte(
               set_byte(
                 set_byte(
                   set_byte(
                     set_byte(
                       set_byte(
                         set_byte(decode(repeat('00', 8192), 'hex'),
                                  12, 40),
                         14, 248),
                       15, 31),
                     16, 248),
                   17, 31),
                 18, 4),
               19, 32),
             8190, 131) AS p
  )
  SELECT * FROM gin_leafpage_items((SELECT p FROM page));

Backtrace:
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized
out>) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=<optimized out>) at
./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at
./nptl/pthread_kill.c:89
#3  0x000076adb2a4527e in __GI_raise (sig=sig@entry=6) at
../sysdeps/posix/raise.c:26
#4  0x000076adb2a288ff in __GI_abort () at ./stdlib/abort.c:79
#5  0x00005e7e26d0ccac in ExceptionalCondition
(conditionName=conditionName@entry=0x5e7e26d76143
"ItemPointerIsValid(pointer)", fileName=fileName@entry=0x5e7e26db1c58
"../../../../src/include/storage/itemptr.h",
lineNumber=lineNumber@entry=126) at assert.c:65
#6  0x00005e7e267a0dd8 in ItemPointerGetOffsetNumber
(pointer=0x5e7e377646b8) at ../../../../src/include/storage/itemptr.h:126
#7  ItemPointerGetOffsetNumber (pointer=0x5e7e377646b8) at
../../../../src/include/storage/itemptr.h:124
#8  ginPostingListDecodeAllSegments (segment=<optimized out>,
segment@entry=0x5e7e377646b8, len=<optimized out>,
ndecoded_out=ndecoded_out@entry=0x7ffd3fe41100) at ginpostinglist.c:324
#9  0x00005e7e267a100b in ginPostingListDecode
(plist=plist@entry=0x5e7e377646b8,
ndecoded_out=ndecoded_out@entry=0x7ffd3fe41100) at ginpostinglist.c:286
#10 0x000076adb35630ed in gin_leafpage_items (fcinfo=0x5e7e3775e6c0) at
ginfuncs.c:264
#11 0x00005e7e2699309d in ExecMakeTableFunctionResult
(setexpr=0x5e7e3772e7f0, econtext=0x5e7e3772e690, argContext=<optimized
out>, expectedDesc=0x5e7e3772f240, randomAccess=false) at execSRF.c:235
#12 0x00005e7e269a7d7d in FunctionNext (node=0x5e7e3772e480) at
nodeFunctionscan.c:95
#13 0x00005e7e26987a2b in ExecProcNode (node=0x5e7e3772e480) at
../../../src/include/executor/executor.h:327
#14 ExecutePlan (queryDesc=0x5e7e3762f480, operation=CMD_SELECT,
sendTuples=true, numberTuples=0, direction=<optimized out>,
dest=0x5e7e3775b778) at execMain.c:1736
#15 standard_ExecutorRun (queryDesc=0x5e7e3762f480, direction=<optimized
out>, count=0) at execMain.c:377
#16 0x00005e7e26ba1c58 in PortalRunSelect
(portal=portal@entry=0x5e7e376a55f0, forward=forward@entry=true, count=0,
count@entry=9223372036854775807, dest=dest@entry=0x5e7e3775b778) at
pquery.c:917
#17 0x00005e7e26ba3316 in PortalRun (portal=portal@entry=0x5e7e376a55f0,
count=count@entry=9223372036854775807, isTopLevel=isTopLevel@entry=true,
dest=dest@entry=0x5e7e3775b778, altdest=altdest@entry=0x5e7e3775b778,
qc=qc@entry=0x7ffd3fe41500) at pquery.c:761
#18 0x00005e7e26b9eeaa in exec_simple_query (
    query_string=0x5e7e37602450 "WITH page AS (\n    SELECT set_byte(\n", '
' <repeats 13 times>, "set_byte(\n", ' ' <repeats 15 times>, "set_byte(\n",
' ' <repeats 17 times>, "set_byte(\n", ' ' <repeats 19 times>,
"set_byte(\n", ' ' <repeats 21 times>, "set_byte(\n", ' ' <repeats 23
times>, "set_by"...) at postgres.c:1290
#19 0x00005e7e26ba0aa4 in PostgresMain (dbname=<optimized out>,
username=<optimized out>) at postgres.c:4856
#20 0x00005e7e26b9aa53 in BackendMain (startup_data=<optimized out>,
startup_data_len=<optimized out>) at backend_startup.c:124
#21 0x00005e7e26ad6371 in postmaster_child_launch (child_type=<optimized
out>, child_slot=1, startup_data=startup_data@entry=0x7ffd3fe419b0,
startup_data_len=startup_data_len@entry=24,
client_sock=client_sock@entry=0x7ffd3fe419d0) at launch_backend.c:268
#22 0x00005e7e26ada052 in BackendStartup (client_sock=0x7ffd3fe419d0) at
postmaster.c:3627
#23 ServerLoop () at postmaster.c:1728
#24 0x00005e7e26adbbc2 in PostmasterMain (argc=argc@entry=3,
argv=argv@entry=0x5e7e375fc0b0) at postmaster.c:1415
#25 0x00005e7e2677232e in main (argc=3, argv=0x5e7e375fc0b0) at main.c:231

logfile:
TRAP: failed Assert("ItemPointerIsValid(pointer)"), File:
"../../../../src/include/storage/itemptr.h", Line: 126, PID: 1668693
postgres: packer postgres [local]
SELECT(ExceptionalCondition+0x6d)[0x5d3ea15c813d]
postgres: packer postgres [local]
SELECT(ginPostingListDecodeAllSegments+0x1d8)[0x5d3ea10ac398]

Branch: REL_18_STABLE (commit: 196b4b5)
GCC version: 14.2.0

CONFIGURE =  '--enable-debug' '--enable-cassert'

postgres=# SELECT version();
                                                  version
------------------------------------------------------------------------------------------------------------
 PostgreSQL 18.4 on x86_64-pc-linux-gnu, compiled by gcc-14 (Ubuntu
14.2.0-4ubuntu2~24.04.1) 14.2.0, 64-bit

---

From: Tom Lane <[email-masked]>
Date: Wed, 27 May 2026 09:57:37 -0400

>   SELECT * FROM gin_leafpage_items((SELECT p FROM page));

Does that WITH actually construct a valid GIN page image?
I don't think we make any guarantee that pageinspect
won't crash on bad data.

			regards, tom lane