Content-Type: multipart/alternative;
 boundary="------------Ja7oocFGt09K2g0e0s58CnEJ"
Message-ID: <8f46de9a-f292-425a-af5e-50ae1a9979ce@gmail.com>
Date: Tue, 20 Jan 2026 16:03:50 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: BUG #19384: Server crash at textout
To: Rahila Syed <rahilasyed90@gmail.com>, dllggyx@outlook.com,
 pgsql-bugs@lists.postgresql.org
References: <19384-65ff412feef17f06@postgresql.org>
 <CAH2L28tTiH2wNq4tDLcHr2B2NG=kMunJmNfYj5L5tMhQukVnJA@mail.gmail.com>
Content-Language: en-US
From: Pierre Forstmann <pierre.forstmann@gmail.com>
In-Reply-To: <CAH2L28tTiH2wNq4tDLcHr2B2NG=kMunJmNfYj5L5tMhQukVnJA@mail.gmail.com>
Archived-At: <https://www.postgresql.org/message-id/8f46de9a-f292-425a-af5e-50ae1a9979ce%40gmail.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------Ja7oocFGt09K2g0e0s58CnEJ
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

I can also reproduce with 18.1.

But if type foo is used in a table, type foo cannot be modified:

DROP TYPE IF EXISTS foo CASCADE;
psql:bug4.sql:1: NOTICE:  drop cascades to column c of table bar
DROP TYPE
DROP TABLE if EXISTS bar CASCADE;
DROP TABLE
CREATE TYPE foo AS (a INT, b INT);
CREATE TYPE
CREATE TABLE bar(c foo);
CREATE TABLE
BEGIN;
BEGIN
INSERT into bar SELECT (i, power(2, 30))::foo FROM generate_series(1,10) i;
INSERT 0 10
ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT;
psql:bug4.sql:8: ERROR:  cannot alter type "foo" because column "bar.c" 
uses it

Should PG allow to modify a type if this type is used to cast a SELECT 
list column in the same transaction ?


Le 20/01/2026 à 12:15, Rahila Syed a écrit :
> Hi,
>
> On Tue, Jan 20, 2026 at 2:29 PM PG Bug reporting form 
> <noreply@postgresql.org> wrote:
>
>     The following bug has been logged on the website:
>
>     Bug reference:      19384
>     Logged by:          Yuxiao Guo
>     Email address: dllggyx@outlook.com
>     PostgreSQL version: 17.7
>     Operating system:   Ubuntu 20.04 x86-64, docker image postgres:17.7
>     Description:
>
>     Hi, I found a crash in PostgreSQL. Here are the details:
>
>     PoC:
>     DROP TYPE IF EXISTS foo CASCADE;
>     CREATE TYPE foo AS (a INT, b INT);
>     BEGIN;
>     DECLARE c CURSOR FOR SELECT (i, power(2, 30))::foo FROM
>     generate_series(1,10) i;
>     FETCH c;
>     ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT;
>     FETCH c;
>
>
>     Stacktrace:
>     #0 0x7ae1c818a00b (gsignal+0xcb)
>     #1 0x7ae1c8169859 (abort+0x12b)
>     #2 0x542fa7 (_ZN11__sanitizer5AbortEv+0x47)
>     #3 0x5414d1 (_ZN11__sanitizer3DieEv+0xc1)
>     #4 0x528a14 (_ZN6__asan19ScopedInErrorReportD2Ev+0x1c4)
>     #5 0x52a5da (_ZN6__asan18ReportGenericErrorEmmmmbmjb+0x5ba)
>     #6 0x523ef6 (__asan_memcpy+0x1d6)
>     #7 0x17772d5 (textout+0x1b5)
>     #8 0x1835834 (OutputFunctionCall+0x174)
>     #9 0x167a568 (record_out+0x828)
>     #10 0x1835834 (OutputFunctionCall+0x174)
>     #11 0x595848 (printtup+0x958)
>     #12 0x1336280 (RunFromStore+0x1d0)
>     #13 0x1333ec0 (PortalRunSelect+0x150)
>     #14 0x133321d (PortalRun+0x51d)
>     #15 0x132f1de (exec_simple_query+0x146e)
>     #16 0x1328627 (PostgresMain+0x2c57)
>     #17 0x13192e4 (BackendMain+0xe4)
>     #18 0x10a26c3 (postmaster_child_launch+0x193)
>     #19 0x10adb91 (ServerLoop+0x4821)
>     #20 0x10a76ec (PostmasterMain+0x241c)
>     #21 0xd5c2b8 (main+0x458)
>     #22 0x7ae1c816b083 (__libc_start_main+0xf3)
>     #23 0x4a9c6e (_start+0x2e)
>
>
>
> This problem is reproducible, also the issue seems to be linked to cursors
> since the type cast with only SELECT statements runs fine.
>
> CREATE TYPE foo AS (a INT, b INT);
> ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT;
>
> postgres=# SELECT (i, power(2, 30))::foo FROM
> generate_series(1,10) i;
>        row
> -----------------
>  (1,1073741824)
>  (2,1073741824)
>  (3,1073741824)
>  (4,1073741824)
>  (5,1073741824)
>  (6,1073741824)
>  (7,1073741824)
>  (8,1073741824)
>  (9,1073741824)
>  (10,1073741824)
> (10 rows)
>
> Also, it happens only  if ALTER TYPE to TEXT is run after DECLARING 
> the cursor.
>
> Another observation is that when I lower the exponent to 10, the crash 
> no longer occurs,
> but the output is different.
>
> CREATE TYPE foo AS (a INT, b INT);
> BEGIN;
> DECLARE c CURSOR FOR SELECT (i, power(2, 10))::foo FROM
> generate_series(1,10) i;
> DECLARE CURSOR
> FETCH c;
>    row
> ----------
>  (1,1024)
> (1 row)
>
> ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT;
> FETCH c;
>    row
> ----------
>  (2,\x10)
> (1 row)
>
> Thank you,
> Rahila Syed
>
--------------Ja7oocFGt09K2g0e0s58CnEJ
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>I can also reproduce with 18.1.</p>
    <p>But if type foo is used in a table, type foo cannot be modified:</p>
    DROP TYPE IF EXISTS foo CASCADE;<br>
    psql:bug4.sql:1: NOTICE:  drop cascades to column c of table bar<br>
    DROP TYPE<br>
    DROP TABLE if EXISTS bar CASCADE;<br>
    DROP TABLE<br>
    CREATE TYPE foo AS (a INT, b INT);<br>
    CREATE TYPE<br>
    CREATE TABLE bar(c foo);<br>
    CREATE TABLE<br>
    BEGIN;<br>
    BEGIN<br>
    INSERT into bar SELECT (i, power(2, 30))::foo FROM
    generate_series(1,10) i;<br>
    INSERT 0 10<br>
    ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT;<br>
    psql:bug4.sql:8: ERROR:  cannot alter type "foo" because column
    "bar.c" uses it<br>
    <br>
    <p>Should PG allow to modify a type if this type is used to cast a
      SELECT list column in the same transaction ?</p>
    <p><br>
    </p>
    <div class="moz-cite-prefix">Le 20/01/2026 à 12:15, Rahila Syed a
      écrit :<br>
    </div>
    <blockquote type="cite"
cite="mid:CAH2L28tTiH2wNq4tDLcHr2B2NG=kMunJmNfYj5L5tMhQukVnJA@mail.gmail.com">
      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
      <div dir="ltr">
        <div dir="ltr">Hi,</div>
        <br>
        <div class="gmail_quote gmail_quote_container">
          <div dir="ltr" class="gmail_attr">On Tue, Jan 20, 2026 at
            2:29 PM PG Bug reporting form &lt;<a
              href="mailto:noreply@postgresql.org"
              moz-do-not-send="true" class="moz-txt-link-freetext">noreply@postgresql.org</a>&gt;
            wrote:<br>
          </div>
          <blockquote class="gmail_quote"
style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">The
            following bug has been logged on the website:<br>
            <br>
            Bug reference:      19384<br>
            Logged by:          Yuxiao Guo<br>
            Email address:      <a href="mailto:dllggyx@outlook.com"
              target="_blank" moz-do-not-send="true"
              class="moz-txt-link-freetext">dllggyx@outlook.com</a><br>
            PostgreSQL version: 17.7<br>
            Operating system:   Ubuntu 20.04 x86-64, docker image
            postgres:17.7<br>
            Description:        <br>
            <br>
            Hi, I found a crash in PostgreSQL. Here are the details:<br>
            <br>
            PoC:<br>
            DROP TYPE IF EXISTS foo CASCADE;<br>
            CREATE TYPE foo AS (a INT, b INT);<br>
            BEGIN;<br>
            DECLARE c CURSOR FOR SELECT (i, power(2, 30))::foo FROM<br>
            generate_series(1,10) i;<br>
            FETCH c;<br>
            ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT;<br>
            FETCH c;<br>
            <br>
            <br>
            Stacktrace:<br>
            #0 0x7ae1c818a00b (gsignal+0xcb)<br>
            #1 0x7ae1c8169859 (abort+0x12b)<br>
            #2 0x542fa7 (_ZN11__sanitizer5AbortEv+0x47)<br>
            #3 0x5414d1 (_ZN11__sanitizer3DieEv+0xc1)<br>
            #4 0x528a14 (_ZN6__asan19ScopedInErrorReportD2Ev+0x1c4)<br>
            #5 0x52a5da (_ZN6__asan18ReportGenericErrorEmmmmbmjb+0x5ba)<br>
            #6 0x523ef6 (__asan_memcpy+0x1d6)<br>
            #7 0x17772d5 (textout+0x1b5)<br>
            #8 0x1835834 (OutputFunctionCall+0x174)<br>
            #9 0x167a568 (record_out+0x828)<br>
            #10 0x1835834 (OutputFunctionCall+0x174)<br>
            #11 0x595848 (printtup+0x958)<br>
            #12 0x1336280 (RunFromStore+0x1d0)<br>
            #13 0x1333ec0 (PortalRunSelect+0x150)<br>
            #14 0x133321d (PortalRun+0x51d)<br>
            #15 0x132f1de (exec_simple_query+0x146e)<br>
            #16 0x1328627 (PostgresMain+0x2c57)<br>
            #17 0x13192e4 (BackendMain+0xe4)<br>
            #18 0x10a26c3 (postmaster_child_launch+0x193)<br>
            #19 0x10adb91 (ServerLoop+0x4821)<br>
            #20 0x10a76ec (PostmasterMain+0x241c)<br>
            #21 0xd5c2b8 (main+0x458)<br>
            #22 0x7ae1c816b083 (__libc_start_main+0xf3)<br>
            #23 0x4a9c6e (_start+0x2e)<br>
            <br>
            <br>
          </blockquote>
          <div><br>
          </div>
          <div>This problem is reproducible, also the issue seems to be
            linked to cursors<br>
            since the type cast with only SELECT statements runs fine.<br>
            <br>
            CREATE TYPE foo AS (a INT, b INT);<br>
            ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT;</div>
          <div><br>
            postgres=# SELECT (i, power(2, 30))::foo FROM<br>
            generate_series(1,10) i;<br>
                   row<br>
            -----------------<br>
             (1,1073741824)<br>
             (2,1073741824)<br>
             (3,1073741824)<br>
             (4,1073741824)<br>
             (5,1073741824)<br>
             (6,1073741824)<br>
             (7,1073741824)<br>
             (8,1073741824)<br>
             (9,1073741824)<br>
             (10,1073741824)<br>
            (10 rows)<br>
            <br>
            Also, it happens only  if ALTER TYPE to TEXT is run after
            DECLARING the cursor.</div>
          <div><br>
            Another observation is that when I lower the exponent to 10,
            the crash no longer occurs, <br>
            but the output is different.<br>
            <br>
            CREATE TYPE foo AS (a INT, b INT);</div>
          <div>BEGIN;<br>
            DECLARE c CURSOR FOR SELECT (i, power(2, 10))::foo FROM<br>
            generate_series(1,10) i;<br>
            DECLARE CURSOR<br>
            FETCH c;<br>
               row<br>
            ----------<br>
             (1,1024)<br>
            (1 row)<br>
            <br>
            ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT;<br>
            FETCH c;<br>
               row<br>
            ----------<br>
             (2,\x10)<br>
            (1 row)</div>
          <div><br>
            Thank you,</div>
          <div>Rahila Syed</div>
          <div><br>
          </div>
        </div>
      </div>
    </blockquote>
  </body>
</html>

--------------Ja7oocFGt09K2g0e0s58CnEJ--