MIME-Version: 1.0
References: <19458-a69c98bc498333ba@postgresql.org>
 <CAB8bMit1HvJsAasUYwmq+82Oa3zQhJyvsHNS4PGF_S_BCMnuVA@mail.gmail.com>
 <AE0E8193-85BD-4A10-BE23-582D92DA281D@yandex-team.ru>
 <CAN-LCVNh2z4EE+F21XPe7XRSWfPFtZx1WYAswpU5qs+RdR=jjg@mail.gmail.com>
 <6DE4A9D6-6D5C-41C0-8AFE-F51CFBDDAD5A@yandex-team.ru>
 <CAN-LCVPiBi9XXW__RorX=dH2_fANAMXhdbULmHFFg97F_0ubRw@mail.gmail.com>
 <674AEA44-D9C5-423D-B118-693CA130106E@yandex-team.ru>
 <CA+HiwqG5pP8g0oGkz8x6X80XJyZqGiS16F9DhvJ3Ukejkd8MbQ@mail.gmail.com>
 <CAB8bMivkf5X73X6LOSxt4r4tx_PN6DnGKVcBa3BtYX=eOKwHaw@mail.gmail.com>
 <CA+HiwqEL=Hr3ReVLqRy-U7JFOmx8ziS=_NLQcD4sA411kS5K9A@mail.gmail.com>
In-Reply-To: 
 <CA+HiwqEL=Hr3ReVLqRy-U7JFOmx8ziS=_NLQcD4sA411kS5K9A@mail.gmail.com>
From: Andrey Rachitskiy <pl0h0yp1@gmail.com>
Date: Wed, 17 Jun 2026 14:57:48 +0500
Message-ID: 
 <CAB8bMivQuj8kH_gaPNROFYmRZQ6ey4e5u3Va8kjeNzQp37triQ@mail.gmail.com>
Subject: Re: BUG #19458: OOM killer in jsonb_path_exists_opr (@?) with
 malformed JSONPath containing non-existent variables
To: Amit Langote <amitlangote09@gmail.com>
Cc: Andrey Borodin <x4mmm@yandex-team.ru>,
 Nikita Malakhov <hukutoc@gmail.com>,
	PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>,
 Nikolay Shaplov <dhyan@nataraj.su>
Content-Type: multipart/alternative; boundary="00000000000040fa9c06547018fe"
Archived-At: 
 <https://www.postgresql.org/message-id/CAB8bMivQuj8kH_gaPNROFYmRZQ6ey4e5u3Va8kjeNzQp37triQ%40mail.gmail.com>
Precedence: bulk

--00000000000040fa9c06547018fe
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Amit,

I tested patch
v2-0001-Report-undefined-jsonpath-variable-when-no-variab.patch on:

REL_14_STABLE
REL_15_STABLE
REL_16_STABLE

Results:
The patch applies cleanly on all three branches.
Regression tests added/affected by the patch pass on all three branches:
REL_14: all relevant tests passed
REL_15: all relevant tests passed
REL_16: all relevant tests passed
The provided jsonpath reproducer query now consistently returns an error
about an undefined jsonpath variable on all three branches, which matches
the expected behavior change from this patch.

Conclusion:
The patch looks good from the testing side and can be merged.

=D1=81=D1=80, 17 =D0=B8=D1=8E=D0=BD. 2026=E2=80=AF=D0=B3. =D0=B2 13:27, Ami=
t Langote <amitlangote09@gmail.com>:

> Hi Andrey,
>
> On Fri, Jun 5, 2026 at 7:03=E2=80=AFPM Andrey Rachitskiy <pl0h0yp1@gmail.=
com>
> wrote:
> > The growing allocation is leaked temporary JsonValueLists in
> executePredicate() (local lseq/rseq, ~1482=E2=80=931547) and the arithmet=
ic helpers
> executeBinaryArithmExpr() / executeUnaryArithmExpr() (~1561=E2=80=931684)=
. Each
> nested comparison or arithmetic subexpression materializes operands via
> executeItemOptUnwrapResult[NoThrow]() =E2=86=92 executeNextItem() =E2=86=
=92
> JsonValueListAppend() (~1165, ~2451), but the interim lists are never fre=
ed
> before return. For @? specifically, executeJsonPath() also leaks a local
> vals list in strict exists mode (~579=E2=80=93586).
> >
> > Missing vars make the AFL case worse by returning null instead of error=
,
> so evaluation continues deep into nested $?()/comparisons instead of
> stopping at the first $"=E2=80=A6" reference. The same leak mechanism is =
reachable
> without missing vars =E2=80=94 Tom Lane demonstrated this on master (5a20=
43bf713)
> with $[*] ? (@ < $) on a large array.
> >
> > Our missing-variable patch fixes the reported OOM and the @? semantics
> bug by aborting early. Whether REL_14/15/16 also need a broader fix for
> interim JsonValueList cleanup is beyond what I can confidently propose;
> I've tried to pin down where the growth happens for that discussion.
>
> Thanks for that tracedown and for pointing to Tom's commit. The deeper
> interim-JsonValueList leak looks unlikely to get fixed in the back
> branches; Tom's cleanup (5a2043bf713) went only to master.
>
> I'll look at committing the attached revised version of your Apr 20
> patch (same fix, plus a regression test) down to REL_14. Please
> check/test.
>
> --
> Thanks, Amit Langote
>


--=20
---
Regards,
Andrey Rachitskiy
Postgres Professional

--00000000000040fa9c06547018fe
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-size:small">Hi =
Amit,<br><br>I tested patch v2-0001-Report-undefined-jsonpath-variable-when=
-no-variab.patch on:<br><br>REL_14_STABLE<br>REL_15_STABLE<br>REL_16_STABLE=
<br><br>Results:<br>The patch applies cleanly on all three branches.<br>Reg=
ression tests added/affected by the patch pass on all three branches:<br>RE=
L_14: all relevant tests passed<br>REL_15: all relevant tests passed<br>REL=
_16: all relevant tests passed<br>The provided jsonpath reproducer query no=
w consistently returns an error about an undefined jsonpath variable on all=
 three branches, which matches the expected behavior change from this patch=
.<br><br>Conclusion:<br>The patch looks good from the testing side and can =
be merged.<br></div></div><br><div class=3D"gmail_quote gmail_quote_contain=
er"><div dir=3D"ltr" class=3D"gmail_attr">=D1=81=D1=80, 17 =D0=B8=D1=8E=D0=
=BD. 2026=E2=80=AF=D0=B3. =D0=B2 13:27, Amit Langote &lt;<a href=3D"mailto:=
amitlangote09@gmail.com">amitlangote09@gmail.com</a>&gt;:<br></div><blockqu=
ote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px=
 solid rgb(204,204,204);padding-left:1ex">Hi Andrey,<br>
<br>
On Fri, Jun 5, 2026 at 7:03=E2=80=AFPM Andrey Rachitskiy &lt;<a href=3D"mai=
lto:pl0h0yp1@gmail.com" target=3D"_blank">pl0h0yp1@gmail.com</a>&gt; wrote:=
<br>
&gt; The growing allocation is leaked temporary JsonValueLists in executePr=
edicate() (local lseq/rseq, ~1482=E2=80=931547) and the arithmetic helpers =
executeBinaryArithmExpr() / executeUnaryArithmExpr() (~1561=E2=80=931684). =
Each nested comparison or arithmetic subexpression materializes operands vi=
a executeItemOptUnwrapResult[NoThrow]() =E2=86=92 executeNextItem() =E2=86=
=92 JsonValueListAppend() (~1165, ~2451), but the interim lists are never f=
reed before return. For @? specifically, executeJsonPath() also leaks a loc=
al vals list in strict exists mode (~579=E2=80=93586).<br>
&gt;<br>
&gt; Missing vars make the AFL case worse by returning null instead of erro=
r, so evaluation continues deep into nested $?()/comparisons instead of sto=
pping at the first $&quot;=E2=80=A6&quot; reference. The same leak mechanis=
m is reachable without missing vars =E2=80=94 Tom Lane demonstrated this on=
 master (5a2043bf713) with $[*] ? (@ &lt; $) on a large array.<br>
&gt;<br>
&gt; Our missing-variable patch fixes the reported OOM and the @? semantics=
 bug by aborting early. Whether REL_14/15/16 also need a broader fix for in=
terim JsonValueList cleanup is beyond what I can confidently propose; I&#39=
;ve tried to pin down where the growth happens for that discussion.<br>
<br>
Thanks for that tracedown and for pointing to Tom&#39;s commit. The deeper<=
br>
interim-JsonValueList leak looks unlikely to get fixed in the back<br>
branches; Tom&#39;s cleanup (5a2043bf713) went only to master.<br>
<br>
I&#39;ll look at committing the attached revised version of your Apr 20<br>
patch (same fix, plus a regression test) down to REL_14. Please<br>
check/test.<br>
<br>
-- <br>
Thanks, Amit Langote<br>
</blockquote></div><div><br clear=3D"all"></div><div><br></div><span class=
=3D"gmail_signature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_s=
ignature"><div dir=3D"ltr"><div dir=3D"ltr" style=3D"color:rgb(34,34,34)">-=
--<br>Regards,<br>Andrey Rachitskiy</div><div dir=3D"ltr" style=3D"color:rg=
b(34,34,34)">Postgres Professional</div></div></div>

--00000000000040fa9c06547018fe--