From: Tom Lane <tgl@sss.pgh.pa.us>
To: Alvaro Herrera <alvherre@alvh.no-ip.org>
cc: bernddorn@gmail.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17227: segmentation fault with jsonb_to_recordset
In-reply-to: <649678.1634135335@sss.pgh.pa.us>
References: <202110131359.a6m35hpudkg7@alvherre.pgsql>
 <649678.1634135335@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Wed, 13 Oct 2021 10:28:55 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <675395.1634157283.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Wed, 13 Oct 2021 16:34:43 -0400
Message-ID: <675396.1634157283@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/675396.1634157283%40sss.pgh.pa.us>
Precedence: bulk

I wrote:
> Huh?  It's a self-contained example.  I'm seeing this back-trace
> on HEAD:

Digging deeper, it seems jsonb_path_query_array_internal is being
called with just two arguments:

Breakpoint 1, jsonb_path_query_array_internal (fcinfo=3D0x2e6a4e8, tz=3Dfa=
lse)
    at jsonpath_exec.c:460
460             Jsonb      *jb =3D PG_GETARG_JSONB_P(0);
(gdb) p *fcinfo
$1 =3D {flinfo =3D 0x2e6a490, context =3D 0x0, resultinfo =3D 0x0, fncolla=
tion =3D 0, =

  isnull =3D false, nargs =3D 2, args =3D 0x2e6a508}

It's expecting four arguments, and naturally goes off the deep end
when the last two aren't there.  Evidently the planner has failed
to perform default-argument insertion on this particular function
call.

EXPLAIN VERBOSE shows the query plan as

 Nested Loop  (cost=3D0.01..2.52 rows=3D100 width=3D64)
   Output: jsonb_path_query_array((unnested_modules.module -> 'lectures'::=
text), '$[*]'::jsonpath, '{}'::jsonb, false), jsonb_to_recordset.id
   ->  Function Scan on pg_catalog.unnest unnested_modules  (cost=3D0.00..=
0.01 rows=3D1 width=3D32)
         Output: unnested_modules.module
         Function Call: unnest('{"{\"lectures\": [{\"id\": \"1\"}]}"}'::js=
onb[])
   ->  Function Scan on pg_catalog.jsonb_to_recordset  (cost=3D0.01..1.01 =
rows=3D100 width=3D32)
         Output: jsonb_to_recordset.id
         Function Call: jsonb_to_recordset(jsonb_path_query_array((unneste=
d_modules.module -> 'lectures'::text), '$[*]'::jsonpath))

so it looks like we have flattened the "as l" sub-select into the parent
query and missed performing expression pre-processing on the expressions
that were pulled up ... but only in the FunctionScan node.  The call
appearing in the output tlist has the default arguments in the right
places.

This works OK in v12, so somebody broke it between v12 and v13.
More to follow ...

			regards, tom lane