Content-Type: multipart/mixed; boundary="------------4wzQycIzQXqsmiR2i6HGApF7"
Message-ID: <950f4f1a-fb71-3e45-bb65-6a57da9f9b9e@gmail.com>
Date: Sat, 1 Apr 2023 15:00:00 +0300
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.4.2
Subject: Re: BUG #17798: Incorrect memory access occurs when using BEFORE ROW
 UPDATE trigger
Content-Language: en-US
From: Alexander Lakhin <exclusion@gmail.com>
To: pgsql-bugs@lists.postgresql.org
References: <17798-0907404928dcf0dd@postgresql.org>
 <87fe6c28-80b2-f709-a8db-d105e5240e39@gmail.com>
In-Reply-To: <87fe6c28-80b2-f709-a8db-d105e5240e39@gmail.com>
Archived-At: 
 <https://www.postgresql.org/message-id/950f4f1a-fb71-3e45-bb65-6a57da9f9b9e%40gmail.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------4wzQycIzQXqsmiR2i6HGApF7
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

07.03.2023 09:00, Alexander Lakhin wrote:
> I've tried to materialize newslot before the oldslot materialization
> (in ExecFetchSlotHeapTuple(), where their common memory is released),
> and it looks like it fixes the issue.

I've made a simple isolation test to illustrate the bug, which I'd consider
as serious. On master it shows (under valgrind):
# using temp instance on port 61696 with PID 614130
not ok 1     - bru-trigger                              2147 ms
# (test process exited with exit code 1)

src/test/isolation/output_iso/log/postmaster.log contains:
...
==00:00:00:05.840 615284== Invalid read of size 1
==00:00:00:05.840 615284==    at 0x1E376C: heap_compute_data_size (heaptuple.c:147)
==00:00:00:05.840 615284==    by 0x1E4458: heap_form_tuple (heaptuple.c:1061)
==00:00:00:05.840 615284==    by 0x3DB74A: tts_buffer_heap_materialize (execTuples.c:749)
==00:00:00:05.840 615284==    by 0x3DC5EB: ExecFetchSlotHeapTuple (execTuples.c:1655)
==00:00:00:05.840 615284==    by 0x3A6BA7: ExecBRUpdateTriggers (trigger.c:3032)
==00:00:00:05.840 615284==    by 0x3FE207: ExecUpdatePrologue (nodeModifyTable.c:1916)
==00:00:00:05.840 615284==    by 0x3FF838: ExecUpdate (nodeModifyTable.c:2289)
==00:00:00:05.840 615284==    by 0x401BD4: ExecModifyTable (nodeModifyTable.c:3795)
==00:00:00:05.840 615284==    by 0x3D65FF: ExecProcNodeFirst (execProcnode.c:464)
==00:00:00:05.840 615284==    by 0x3CE4F5: ExecProcNode (executor.h:272)
==00:00:00:05.840 615284==    by 0x3CE585: ExecutePlan (execMain.c:1633)
==00:00:00:05.840 615284==    by 0x3CF220: standard_ExecutorRun (execMain.c:364)
...
2023-04-01 14:26:31.543 MSK postmaster[615243] LOG:  server process (PID 615284) exited with exit code 1
2023-04-01 14:26:31.543 MSK postmaster[615243] DETAIL:  Failed process was running: UPDATE bruttest SET cnt = cnt + 1;

Maybe the test could supplement a fix (I'm still unsure how to fix the issue
right way).

Best regards,
Alexander
--------------4wzQycIzQXqsmiR2i6HGApF7
Content-Type: text/x-patch; charset=UTF-8; name="BRU-trigger-bug-demo.patch"
Content-Disposition: attachment; filename="BRU-trigger-bug-demo.patch"
Content-Transfer-Encoding: base64

ZGlmZiAtLWdpdCBhL3NyYy90ZXN0L2lzb2xhdGlvbi9leHBlY3RlZC9icnUtdHJpZ2dlci5v
dXQgYi9zcmMvdGVzdC9pc29sYXRpb24vZXhwZWN0ZWQvYnJ1LXRyaWdnZXIub3V0Cm5ldyBm
aWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAuLmVkYWUxYzU4MzIKLS0tIC9kZXYv
bnVsbAorKysgYi9zcmMvdGVzdC9pc29sYXRpb24vZXhwZWN0ZWQvYnJ1LXRyaWdnZXIub3V0
CkBAIC0wLDAgKzEsOCBAQAorUGFyc2VkIHRlc3Qgc3BlYyB3aXRoIDIgc2Vzc2lvbnMKKwor
c3RhcnRpbmcgcGVybXV0YXRpb246IHMxYiBzMXUgczJ1IHMxYworc3RlcCBzMWI6IEJFR0lO
Oworc3RlcCBzMXU6IFVQREFURSBicnV0dGVzdCBTRVQgY250ID0gY250ICsgMTsKK3N0ZXAg
czJ1OiBVUERBVEUgYnJ1dHRlc3QgU0VUIGNudCA9IGNudCArIDE7IDx3YWl0aW5nIC4uLj4K
K3N0ZXAgczFjOiBDT01NSVQ7CitzdGVwIHMydTogPC4uLiBjb21wbGV0ZWQ+CmRpZmYgLS1n
aXQgYS9zcmMvdGVzdC9pc29sYXRpb24vc3BlY3MvYnJ1LXRyaWdnZXIuc3BlYyBiL3NyYy90
ZXN0L2lzb2xhdGlvbi9zcGVjcy9icnUtdHJpZ2dlci5zcGVjCm5ldyBmaWxlIG1vZGUgMTAw
NjQ0CmluZGV4IDAwMDAwMDAwMDAuLjlkNDliMjUxNzQKLS0tIC9kZXYvbnVsbAorKysgYi9z
cmMvdGVzdC9pc29sYXRpb24vc3BlY3MvYnJ1LXRyaWdnZXIuc3BlYwpAQCAtMCwwICsxLDMy
IEBACisjIEJlZm9yZSBSb3cgVXBkYXRlIFRyaWdnZXIgdGVzdAorIworIyBUZXN0IGNvbmN1
cnJlbnQgYWNjZXNzIHRvIGEgcm93IGluIGEgbmV3IGJ1ZmZlciBmcm9tIHdpdGhpbiBCRUZP
UkUgVVBEQVRFIHRyaWdnZXIKKworc2V0dXAKK3sKKyBDUkVBVEUgVEFCTEUgYnJ1dHRlc3Qo
Y250IElOVEVHRVIgREVGQVVMVCAwLCB0IFRFWFQpOworIEFMVEVSIFRBQkxFIGJydXR0ZXN0
IEFMVEVSIENPTFVNTiB0IFNFVCBTVE9SQUdFIHBsYWluOworIENSRUFURSBGVU5DVElPTiBu
b29wX3RmdW5jKCkgUkVUVVJOUyBUUklHR0VSIExBTkdVQUdFIHBscGdzcWwgQVMgJGJvZHkk
CisgQkVHSU4KKyAgUkVUVVJOIE5FVzsKKyBFTkQKKyAkYm9keSQ7CisgQ1JFQVRFIFRSSUdH
RVIgYnJ1cGRhdGVfdHJpZ2dlciBCRUZPUkUgVVBEQVRFIE9OIGJydXR0ZXN0IEZPUiBFQUNI
IFJPVyBFWEVDVVRFIEZVTkNUSU9OIG5vb3BfdGZ1bmMoKTsKKyBJTlNFUlQgSU5UTyBicnV0
dGVzdCh0KSBWQUxVRVMgKHJlcGVhdCgneCcsIDUwMDApKTsKK30KKwordGVhcmRvd24KK3sK
KyBEUk9QIFRBQkxFIGJydXR0ZXN0OworIERST1AgRlVOQ1RJT04gbm9vcF90ZnVuYygpOwor
fQorCitzZXNzaW9uIHMxCitzdGVwIHMxYgl7IEJFR0lOOyB9CitzdGVwIHMxdQl7IFVQREFU
RSBicnV0dGVzdCBTRVQgY250ID0gY250ICsgMTsgfQorc3RlcCBzMWMJeyBDT01NSVQ7IH0K
Kworc2Vzc2lvbiBzMgorc3RlcCBzMnUJeyBVUERBVEUgYnJ1dHRlc3QgU0VUIGNudCA9IGNu
dCArIDE7IH0KKworcGVybXV0YXRpb24gczFiIHMxdSBzMnUgczFjCg==

--------------4wzQycIzQXqsmiR2i6HGApF7--