MIME-Version: 1.0
References: <19458-a69c98bc498333ba@postgresql.org>
 <CAB8bMit1HvJsAasUYwmq+82Oa3zQhJyvsHNS4PGF_S_BCMnuVA@mail.gmail.com>
 <AE0E8193-85BD-4A10-BE23-582D92DA281D@yandex-team.ru>
 <CAN-LCVNh2z4EE+F21XPe7XRSWfPFtZx1WYAswpU5qs+RdR=jjg@mail.gmail.com>
 <6DE4A9D6-6D5C-41C0-8AFE-F51CFBDDAD5A@yandex-team.ru>
 <CAN-LCVPiBi9XXW__RorX=dH2_fANAMXhdbULmHFFg97F_0ubRw@mail.gmail.com>
 <674AEA44-D9C5-423D-B118-693CA130106E@yandex-team.ru>
 <CA+HiwqG5pP8g0oGkz8x6X80XJyZqGiS16F9DhvJ3Ukejkd8MbQ@mail.gmail.com>
 <CAB8bMivkf5X73X6LOSxt4r4tx_PN6DnGKVcBa3BtYX=eOKwHaw@mail.gmail.com>
In-Reply-To: 
 <CAB8bMivkf5X73X6LOSxt4r4tx_PN6DnGKVcBa3BtYX=eOKwHaw@mail.gmail.com>
From: Amit Langote <amitlangote09@gmail.com>
Date: Wed, 17 Jun 2026 17:27:25 +0900
Message-ID: 
 <CA+HiwqEL=Hr3ReVLqRy-U7JFOmx8ziS=_NLQcD4sA411kS5K9A@mail.gmail.com>
Subject: Re: BUG #19458: OOM killer in jsonb_path_exists_opr (@?) with
 malformed JSONPath containing non-existent variables
To: Andrey Rachitskiy <pl0h0yp1@gmail.com>
Cc: Andrey Borodin <x4mmm@yandex-team.ru>,
 Nikita Malakhov <hukutoc@gmail.com>,
	PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>,
 Nikolay Shaplov <dhyan@nataraj.su>
Content-Type: multipart/mixed; boundary="00000000000054c5a706546ed5df"
Archived-At: 
 <https://www.postgresql.org/message-id/CA%2BHiwqEL%3DHr3ReVLqRy-U7JFOmx8ziS%3D_NLQcD4sA411kS5K9A%40mail.gmail.com>
Precedence: bulk

--00000000000054c5a706546ed5df
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Andrey,

On Fri, Jun 5, 2026 at 7:03=E2=80=AFPM Andrey Rachitskiy <pl0h0yp1@gmail.co=
m> wrote:
> The growing allocation is leaked temporary JsonValueLists in executePredi=
cate() (local lseq/rseq, ~1482=E2=80=931547) and the arithmetic helpers exe=
cuteBinaryArithmExpr() / executeUnaryArithmExpr() (~1561=E2=80=931684). Eac=
h nested comparison or arithmetic subexpression materializes operands via e=
xecuteItemOptUnwrapResult[NoThrow]() =E2=86=92 executeNextItem() =E2=86=92 =
JsonValueListAppend() (~1165, ~2451), but the interim lists are never freed=
 before return. For @? specifically, executeJsonPath() also leaks a local v=
als list in strict exists mode (~579=E2=80=93586).
>
> Missing vars make the AFL case worse by returning null instead of error, =
so evaluation continues deep into nested $?()/comparisons instead of stoppi=
ng at the first $"=E2=80=A6" reference. The same leak mechanism is reachabl=
e without missing vars =E2=80=94 Tom Lane demonstrated this on master (5a20=
43bf713) with $[*] ? (@ < $) on a large array.
>
> Our missing-variable patch fixes the reported OOM and the @? semantics bu=
g by aborting early. Whether REL_14/15/16 also need a broader fix for inter=
im JsonValueList cleanup is beyond what I can confidently propose; I've tri=
ed to pin down where the growth happens for that discussion.

Thanks for that tracedown and for pointing to Tom's commit. The deeper
interim-JsonValueList leak looks unlikely to get fixed in the back
branches; Tom's cleanup (5a2043bf713) went only to master.

I'll look at committing the attached revised version of your Apr 20
patch (same fix, plus a regression test) down to REL_14. Please
check/test.

--=20
Thanks, Amit Langote

--00000000000054c5a706546ed5df
Content-Type: application/octet-stream;
	name="v2-0001-Report-undefined-jsonpath-variable-when-no-variab.patch"
Content-Disposition: attachment;
	filename="v2-0001-Report-undefined-jsonpath-variable-when-no-variab.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mqht507a0>
X-Attachment-Id: f_mqht507a0

RnJvbSBkNTJiM2I1YTcyOGQ1MTMwZTNlMTRhY2Q3NzhjNWI2MDhiOWU1MGYzIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBBbWl0IExhbmdvdGUgPGFtaXRsYW5AcG9zdGdyZXNxbC5vcmc+
CkRhdGU6IFdlZCwgMTcgSnVuIDIwMjYgMTc6MjE6MzggKzA5MDAKU3ViamVjdDogW1BBVENIIHYy
XSBSZXBvcnQgdW5kZWZpbmVkIGpzb25wYXRoIHZhcmlhYmxlIHdoZW4gbm8gdmFyaWFibGVzIGFy
ZQogc3VwcGxpZWQKClRoZSB0d28tYXJndW1lbnQganNvbmIgQD8gYW5kIEBAIG9wZXJhdG9ycyBp
bnZva2UgdGhlIGpzb25wYXRoIGV4ZWN1dG9yCndpdGggbm8gdmFyaWFibGUgc2V0LiAgSW4gdGhh
dCBjYXNlIGdldEpzb25QYXRoVmFyaWFibGUoKSB0cmVhdGVkIGFueQoiJG5hbWUiIHJlZmVyZW5j
ZSBhcyBKU09OIG51bGwgYW5kIGNvbnRpbnVlZCBldmFsdWF0aW5nLCBpbnN0ZWFkIG9mCnJlcG9y
dGluZyB0aGUgdmFyaWFibGUgYXMgdW5kZWZpbmVkLgoKVGhpcyBwcm9kdWNlZCBpbmNvcnJlY3Qg
cmVzdWx0cyAtLSBmb3IgZXhhbXBsZSAnNDInOjpqc29uYiBAPyAnJCJ4IicKcmV0dXJuZWQgdHJ1
ZSAtLSBhbmQsIGZvciBzb21lIG1hbGZvcm1lZCBvciBob3N0aWxlIGpzb25wYXRoIGV4cHJlc3Np
b25zCndpdGggZGVlcGx5IG5lc3RlZCBwcmVkaWNhdGVzLCBhbGxvd2VkIGVzc2VudGlhbGx5IHVu
Ym91bmRlZCBtZW1vcnkKY29uc3VtcHRpb24gdGhhdCBjb3VsZCBnZXQgdGhlIGJhY2tlbmQga2ls
bGVkIGJ5IHRoZSBPT00ga2lsbGVyLgoKUmVwb3J0IHRoZSB1bmRlZmluZWQgdmFyaWFibGUgYXMg
YW4gZXJyb3IgaW4gdGhpcyBjYXNlIGFzIHdlbGwsIHJldXNpbmcKdGhlIG1lc3NhZ2UgYWxyZWFk
eSBlbWl0dGVkIHdoZW4gYSB2YXJpYWJsZSBpcyBub3QgZm91bmQgYW1vbmcgc3VwcGxpZWQKdmFy
aWFibGVzLiAgVGhpcyBtYXRjaGVzIHRoZSBiZWhhdmlvciBvZiB2MTcgYW5kIGxhdGVyLCB3aGVy
ZSB0aGUKanNvbnBhdGggZXhlY3V0b3Igd2FzIHJlb3JnYW5pemVkLiAgU3RvcHBpbmcgYXQgdGhl
IGZpcnN0IHVuZGVmaW5lZAp2YXJpYWJsZSByZWZlcmVuY2UgYWxzbyByZXNvbHZlcyB0aGUgcmVw
b3J0ZWQgbWVtb3J5LWdyb3d0aCBjYXNlLgoKTm90ZSB0aGlzIGlzIGEgdXNlci12aXNpYmxlIGNo
YW5nZSBpbiB0aGUgYmFjayBicmFuY2hlczogYSBqc29ucGF0aApleHByZXNzaW9uIHRoYXQgcmVm
ZXJlbmNlcyBhIHZhcmlhYmxlIHdoaWxlIG5vIHZhcmlhYmxlcyBhcmUgc3VwcGxpZWQgbm93CnJh
aXNlcyBhbiBlcnJvciByYXRoZXIgdGhhbiBzaWxlbnRseSBldmFsdWF0aW5nIGl0IGFzIE5VTEwu
ICBUaGUgcHJldmlvdXMKYmVoYXZpb3Igd2FzIGluY29ycmVjdCwgc28gdGhlIGNoYW5nZSBpcyBq
dWRnZWQgd29ydGh3aGlsZS4KCkF1dGhvcjogQW5kcmV5IFJhY2hpdHNraXkgPHBsMGgweXAxQGdt
YWlsLmNvbT4KUmVwb3J0ZWQtYnk6IEFuZHJleSBSYWNoaXRza2l5IDxwbDBoMHlwMUBnbWFpbC5j
b20+ClJldmlld2VkLWJ5OiBBbmRyZXkgQm9yb2RpbiA8eDRtbW1AeWFuZGV4LXRlYW0ucnU+ClJl
dmlld2VkLWJ5OiBOaWtpdGEgTWFsYWtob3YgPGh1a3V0b2NAZ21haWwuY29tPgpEaXNjdXNzaW9u
OiBodHRwczovL3Bvc3Rnci5lcy9tLzE5NDU4LWE2OWM5OGJjNDk4MzMzYmFAcG9zdGdyZXNxbC5v
cmcKQmFja3BhdGNoLXRocm91Z2g6IDE0Ci0tLQogc3JjL2JhY2tlbmQvdXRpbHMvYWR0L2pzb25w
YXRoX2V4ZWMuYyAgICAgICAgfCAxMyArKysrKysrLS0tLS0tCiBzcmMvdGVzdC9yZWdyZXNzL2V4
cGVjdGVkL2pzb25iX2pzb25wYXRoLm91dCB8ICA3ICsrKysrKysKIHNyYy90ZXN0L3JlZ3Jlc3Mv
c3FsL2pzb25iX2pzb25wYXRoLnNxbCAgICAgIHwgIDUgKysrKysKIDMgZmlsZXMgY2hhbmdlZCwg
MTkgaW5zZXJ0aW9ucygrKSwgNiBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS9zcmMvYmFja2Vu
ZC91dGlscy9hZHQvanNvbnBhdGhfZXhlYy5jIGIvc3JjL2JhY2tlbmQvdXRpbHMvYWR0L2pzb25w
YXRoX2V4ZWMuYwppbmRleCAxMGVjNjZjNjI5My4uMzQ0MjA4NDllYWMgMTAwNjQ0Ci0tLSBhL3Ny
Yy9iYWNrZW5kL3V0aWxzL2FkdC9qc29ucGF0aF9leGVjLmMKKysrIGIvc3JjL2JhY2tlbmQvdXRp
bHMvYWR0L2pzb25wYXRoX2V4ZWMuYwpAQCAtMjEyOCwxNCArMjEyOCwxNSBAQCBnZXRKc29uUGF0
aFZhcmlhYmxlKEpzb25QYXRoRXhlY0NvbnRleHQgKmN4dCwgSnNvblBhdGhJdGVtICp2YXJpYWJs
ZSwKIAlKc29uYlZhbHVlCXRtcDsKIAlKc29uYlZhbHVlICp2OwogCi0JaWYgKCF2YXJzKQotCXsK
LQkJdmFsdWUtPnR5cGUgPSBqYnZOdWxsOwotCQlyZXR1cm47Ci0JfQotCiAJQXNzZXJ0KHZhcmlh
YmxlLT50eXBlID09IGpwaVZhcmlhYmxlKTsKIAl2YXJOYW1lID0ganNwR2V0U3RyaW5nKHZhcmlh
YmxlLCAmdmFyTmFtZUxlbmd0aCk7CisKKwlpZiAoIXZhcnMpCisJCWVyZXBvcnQoRVJST1IsCisJ
CQkoZXJyY29kZShFUlJDT0RFX1VOREVGSU5FRF9PQkpFQ1QpLAorCQkJIGVycm1zZygiY291bGQg
bm90IGZpbmQganNvbnBhdGggdmFyaWFibGUgXCIlc1wiIiwKKwkJCQkJcG5zdHJkdXAodmFyTmFt
ZSwgdmFyTmFtZUxlbmd0aCkpKSk7CisKIAl0bXAudHlwZSA9IGpidlN0cmluZzsKIAl0bXAudmFs
LnN0cmluZy52YWwgPSB2YXJOYW1lOwogCXRtcC52YWwuc3RyaW5nLmxlbiA9IHZhck5hbWVMZW5n
dGg7CmRpZmYgLS1naXQgYS9zcmMvdGVzdC9yZWdyZXNzL2V4cGVjdGVkL2pzb25iX2pzb25wYXRo
Lm91dCBiL3NyYy90ZXN0L3JlZ3Jlc3MvZXhwZWN0ZWQvanNvbmJfanNvbnBhdGgub3V0CmluZGV4
IDY2NTliYzkwOTFhLi4yYWI5MDY0MzQ1MCAxMDA2NDQKLS0tIGEvc3JjL3Rlc3QvcmVncmVzcy9l
eHBlY3RlZC9qc29uYl9qc29ucGF0aC5vdXQKKysrIGIvc3JjL3Rlc3QvcmVncmVzcy9leHBlY3Rl
ZC9qc29uYl9qc29ucGF0aC5vdXQKQEAgLTQ4Nyw2ICs0ODcsMTMgQEAgc2VsZWN0ICogZnJvbSBq
c29uYl9wYXRoX3F1ZXJ5KCd7ImEiOiAxMH0nLCAnJCcpOwogCiBzZWxlY3QgKiBmcm9tIGpzb25i
X3BhdGhfcXVlcnkoJ3siYSI6IDEwfScsICckID8gKEAuYSA8ICR2YWx1ZSknKTsKIEVSUk9SOiAg
Y291bGQgbm90IGZpbmQganNvbnBhdGggdmFyaWFibGUgInZhbHVlIgorLS0gYnVnICMxOTQ1ODog
dGhlIEA/IGFuZCBAQCBvcGVyYXRvcnMgc3VwcGx5IG5vIHZhcmlhYmxlcywgc28gYSB2YXJpYWJs
ZQorLS0gcmVmZXJlbmNlIG11c3QgYmUgcmVwb3J0ZWQgYXMgdW5kZWZpbmVkIHJhdGhlciB0aGFu
IHNpbGVudGx5IHRyZWF0ZWQgYXMKKy0tIE5VTEwgKHRoZSBsYXR0ZXIgZ2F2ZSB3cm9uZyByZXN1
bHRzIGFuZCBjb3VsZCBkcml2ZSB1bmJvdW5kZWQgbWVtb3J5IHVzZSkKK3NlbGVjdCBqc29uYiAn
NDInIEA/ICckIm5vX3N1Y2hfdmFyIic7CitFUlJPUjogIGNvdWxkIG5vdCBmaW5kIGpzb25wYXRo
IHZhcmlhYmxlICJub19zdWNoX3ZhciIKK3NlbGVjdCBqc29uYiAnNDInIEBAICckIm5vX3N1Y2hf
dmFyIiA9PSAxJzsKK0VSUk9SOiAgY291bGQgbm90IGZpbmQganNvbnBhdGggdmFyaWFibGUgIm5v
X3N1Y2hfdmFyIgogc2VsZWN0ICogZnJvbSBqc29uYl9wYXRoX3F1ZXJ5KCd7ImEiOiAxMH0nLCAn
JCA/IChALmEgPCAkdmFsdWUpJywgJzEnKTsKIEVSUk9SOiAgInZhcnMiIGFyZ3VtZW50IGlzIG5v
dCBhbiBvYmplY3QKIERFVEFJTDogIEpzb25wYXRoIHBhcmFtZXRlcnMgc2hvdWxkIGJlIGVuY29k
ZWQgYXMga2V5LXZhbHVlIHBhaXJzIG9mICJ2YXJzIiBvYmplY3QuCmRpZmYgLS1naXQgYS9zcmMv
dGVzdC9yZWdyZXNzL3NxbC9qc29uYl9qc29ucGF0aC5zcWwgYi9zcmMvdGVzdC9yZWdyZXNzL3Nx
bC9qc29uYl9qc29ucGF0aC5zcWwKaW5kZXggZTBjZTUwOTI2NGEuLmYwZTA4ZDI3ZTg0IDEwMDY0
NAotLS0gYS9zcmMvdGVzdC9yZWdyZXNzL3NxbC9qc29uYl9qc29ucGF0aC5zcWwKKysrIGIvc3Jj
L3Rlc3QvcmVncmVzcy9zcWwvanNvbmJfanNvbnBhdGguc3FsCkBAIC05OCw2ICs5OCwxMSBAQCBz
ZWxlY3QganNvbmJfcGF0aF9xdWVyeSgnWzEsMiwzXScsICckW2xhc3QgPyAoQC50eXBlKCkgPT0g
InN0cmluZyIpXScsIHNpbGVudCA9PgogCiBzZWxlY3QgKiBmcm9tIGpzb25iX3BhdGhfcXVlcnko
J3siYSI6IDEwfScsICckJyk7CiBzZWxlY3QgKiBmcm9tIGpzb25iX3BhdGhfcXVlcnkoJ3siYSI6
IDEwfScsICckID8gKEAuYSA8ICR2YWx1ZSknKTsKKy0tIGJ1ZyAjMTk0NTg6IHRoZSBAPyBhbmQg
QEAgb3BlcmF0b3JzIHN1cHBseSBubyB2YXJpYWJsZXMsIHNvIGEgdmFyaWFibGUKKy0tIHJlZmVy
ZW5jZSBtdXN0IGJlIHJlcG9ydGVkIGFzIHVuZGVmaW5lZCByYXRoZXIgdGhhbiBzaWxlbnRseSB0
cmVhdGVkIGFzCistLSBOVUxMICh0aGUgbGF0dGVyIGdhdmUgd3JvbmcgcmVzdWx0cyBhbmQgY291
bGQgZHJpdmUgdW5ib3VuZGVkIG1lbW9yeSB1c2UpCitzZWxlY3QganNvbmIgJzQyJyBAPyAnJCJu
b19zdWNoX3ZhciInOworc2VsZWN0IGpzb25iICc0MicgQEAgJyQibm9fc3VjaF92YXIiID09IDEn
Owogc2VsZWN0ICogZnJvbSBqc29uYl9wYXRoX3F1ZXJ5KCd7ImEiOiAxMH0nLCAnJCA/IChALmEg
PCAkdmFsdWUpJywgJzEnKTsKIHNlbGVjdCAqIGZyb20ganNvbmJfcGF0aF9xdWVyeSgneyJhIjog
MTB9JywgJyQgPyAoQC5hIDwgJHZhbHVlKScsICdbeyJ2YWx1ZSIgOiAxM31dJyk7CiBzZWxlY3Qg
KiBmcm9tIGpzb25iX3BhdGhfcXVlcnkoJ3siYSI6IDEwfScsICckID8gKEAuYSA8ICR2YWx1ZSkn
LCAneyJ2YWx1ZSIgOiAxM30nKTsKLS0gCjIuNDcuMwoK
--00000000000054c5a706546ed5df--