MIME-Version: 1.0
References: <19416-967b71bb54d8fe9b@postgresql.org>
In-Reply-To: <19416-967b71bb54d8fe9b@postgresql.org>
From: Thomas Munro <thomas.munro@gmail.com>
Date: Sat, 28 Mar 2026 20:03:14 +1300
Message-ID: <CA+hUKG+u6BCEJH27qTJd-SPxtehEpt=RbLc_ON7itYvrfVTc8A@mail.gmail.com>
Subject: Re: BUG #19416: Backend SIGSEGV in ExecShutdownHashJoin/ExecHashTableDetach/dsa_free
To: ch+pg@zeha.at, pgsql-bugs@lists.postgresql.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CA%2BhUKG%2Bu6BCEJH27qTJd-SPxtehEpt%3DRbLc_ON7itYvrfVTc8A%40mail.gmail.com>
Precedence: bulk

On Thu, Feb 26, 2026 at 11:28=E2=80=AFAM PG Bug reporting form
<noreply@postgresql.org> wrote:
> #0  0x0000564830c3c9d1 in dsa_free (area=3D0x5648621a9280, dp=3D<optimize=
d out>)
> at ./build/../src/backend/utils/mmgr/dsa.c:845
> 845     ./build/../src/backend/utils/mmgr/dsa.c: No such file or director=
y.
> (gdb) bt full
> #0  0x0000564830c3c9d1 in dsa_free (area=3D0x5648621a9280, dp=3D<optimize=
d out>)
> at ./build/../src/backend/utils/mmgr/dsa.c:845
>         segment_map =3D 0x5648621a92b8
>         pageno =3D 0
>         span_pointer =3D 0
>         span =3D <optimized out>
>         superblock =3D <optimized out>
>         object =3D <optimized out>
>         size =3D <optimized out>
>         size_class =3D <optimized out>
> #1  0x0000564830917ae1 in ExecHashTableDetach (hashtable=3D0x564862147fa0=
) at
> ./build/../src/backend/executor/nodeHash.c:3439
>         i =3D <optimized out>
>         pstate =3D 0x7ef9970b5040

Hmm, it's not supposed to be possible for two backends to reach the
dsa_free() at nodeHash.c:3439.  But it does smell a bit like that
that's what happened... hmmm. We were in _RUN phase, and then this
barrier should only let one process through to _FREE.  I'd be
interested in the contents of pstate->build_barrier in frame 1 if you
get another core file with the same stack in it.  Can you share the
outline of the query plan?   Does it happen to have a full/right PHJ
in it?

        /* If we're last to detach, clean up shared memory. */
        if (BarrierArriveAndDetach(&pstate->build_barrier))
        {
            /*
             * Late joining processes will see this state and give up
             * immediately.
             */
            Assert(BarrierPhase(&pstate->build_barrier) =3D=3D PHJ_BUILD_FR=
EE);

            if (DsaPointerIsValid(pstate->batches))
            {
                dsa_free(hashtable->area, pstate->batches);
                pstate->batches =3D InvalidDsaPointer;
            }
        }