MIME-Version: 1.0
References: <19466-dc32827173299fd4@postgresql.org>
In-Reply-To: <19466-dc32827173299fd4@postgresql.org>
From: Ayush Tiwari <ayushtiwari.slg01@gmail.com>
Date: Sat, 25 Apr 2026 15:45:31 +0530
Message-ID: <CAJTYsWUq5e1D6fFGphCj+Xqx1LuWu1QhgCfOckNRk945vmK6PQ@mail.gmail.com>
Subject: Re: BUG #19466: Server crash (SIGSEGV) when FETCH after ALTER TYPE
 during open cursor
To: haogangmao@gmail.com, pgsql-bugs@lists.postgresql.org
Content-Type: multipart/mixed; boundary="000000000000042c170650462aac"
Archived-At: <https://www.postgresql.org/message-id/CAJTYsWUq5e1D6fFGphCj%2BXqx1LuWu1QhgCfOckNRk945vmK6PQ%40mail.gmail.com>
Precedence: bulk

--000000000000042c170650462aac
Content-Type: multipart/alternative; boundary="000000000000042c160650462aaa"

--000000000000042c160650462aaa
Content-Type: text/plain; charset="UTF-8"

Hi,

On Sat, 25 Apr 2026 at 14:34, PG Bug reporting form <noreply@postgresql.org>
wrote:

> The following bug has been logged on the website:
>
> Bug reference:      19466
> Logged by:          HaoGang Mao
> Email address:      haogangmao@gmail.com
> PostgreSQL version: 18.3
> Operating system:   Linux
> Description:
>
> PostgreSQL version: 18.3
> OS: Linux (Docker)
>
> Summary:
> PostgreSQL crashes with SIGSEGV when a cursor is open over a composite
> type and the type is modified via ALTER TYPE during the same transaction,
> followed by a second FETCH.
>
> Reproduction steps (minimal):
>   CREATE TYPE foo AS (a INT, b INT);
>   BEGIN;
>   DECLARE c CURSOR FOR
>     SELECT (i, power(2, 30))::foo
>     FROM generate_series(1,10) i;
>   FETCH c;
>   ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT;
>   FETCH c;
>   COMMIT;
>
> Expected: Error message (type modified during active cursor)
> Actual:   Server process terminated with signal 11 (Segmentation fault)
>
> Server log:
>   client backend (PID 85) was terminated by signal 11: Segmentation fault
>   Failed process was running: [above SQL]
>
> Hypothesis:
> The cursor holds a reference to the tuple descriptor for type "foo".
> After ALTER TYPE modifies the type, the descriptor may be invalidated
> while the cursor still holds a dangling pointer to it. The second FETCH
> dereferences this invalid pointer.


I confirmed the crash on master and traced the root cause. EEOP_ROW was the
only rowtype-aware expression step that cached its TupleDesc at init
time without an ExprEvalRowtypeCache guard. When ALTER TYPE changes
an attribute's storage properties (e.g. int to text), the stale
descriptor leads to SIGSEGV.

Attached patch adds the same ExprEvalRowtypeCache check that
EEOP_FIELDSELECT, EEOP_FIELDSTORE_DEFORM, etc. already use. With
the fix the reproducer gets a clean error instead of crashing.

Regards,
Ayush

--000000000000042c160650462aaa
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">Hi,</div><br><div class=3D"gmail_quote gm=
ail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Sat, 25 Apr 2=
026 at 14:34, PG Bug reporting form &lt;<a href=3D"mailto:noreply@postgresq=
l.org">noreply@postgresql.org</a>&gt; wrote:<br></div><blockquote class=3D"=
gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(20=
4,204,204);padding-left:1ex">The following bug has been logged on the websi=
te:<br>
<br>
Bug reference:=C2=A0 =C2=A0 =C2=A0 19466<br>
Logged by:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 HaoGang Mao<br>
Email address:=C2=A0 =C2=A0 =C2=A0 <a href=3D"mailto:haogangmao@gmail.com" =
target=3D"_blank">haogangmao@gmail.com</a><br>
PostgreSQL version: 18.3<br>
Operating system:=C2=A0 =C2=A0Linux<br>
Description:=C2=A0 =C2=A0 =C2=A0 =C2=A0 <br>
<br>
PostgreSQL version: 18.3<br>
OS: Linux (Docker)<br>
<br>
Summary:<br>
PostgreSQL crashes with SIGSEGV when a cursor is open over a composite<br>
type and the type is modified via ALTER TYPE during the same transaction,<b=
r>
followed by a second FETCH.<br>
<br>
Reproduction steps (minimal):<br>
=C2=A0 CREATE TYPE foo AS (a INT, b INT);<br>
=C2=A0 BEGIN;<br>
=C2=A0 DECLARE c CURSOR FOR<br>
=C2=A0 =C2=A0 SELECT (i, power(2, 30))::foo<br>
=C2=A0 =C2=A0 FROM generate_series(1,10) i;<br>
=C2=A0 FETCH c;<br>
=C2=A0 ALTER TYPE foo ALTER ATTRIBUTE b TYPE TEXT;<br>
=C2=A0 FETCH c;<br>
=C2=A0 COMMIT;<br>
<br>
Expected: Error message (type modified during active cursor)<br>
Actual:=C2=A0 =C2=A0Server process terminated with signal 11 (Segmentation =
fault)<br>
<br>
Server log:<br>
=C2=A0 client backend (PID 85) was terminated by signal 11: Segmentation fa=
ult<br>
=C2=A0 Failed process was running: [above SQL]<br>
<br>
Hypothesis:<br>
The cursor holds a reference to the tuple descriptor for type &quot;foo&quo=
t;.<br>
After ALTER TYPE modifies the type, the descriptor may be invalidated<br>
while the cursor still holds a dangling pointer to it. The second FETCH<br>
dereferences this invalid pointer.</blockquote><div>=C2=A0</div><br>I confi=
rmed the crash on master and traced the root cause. EEOP_ROW was the<br>onl=
y rowtype-aware expression step that cached its TupleDesc at init<br>time w=
ithout an ExprEvalRowtypeCache guard. When ALTER TYPE changes<br>an attribu=
te&#39;s storage properties (e.g. int to text), the stale<br>descriptor lea=
ds to SIGSEGV.<br><br>Attached patch adds the same ExprEvalRowtypeCache che=
ck that<br>EEOP_FIELDSELECT, EEOP_FIELDSTORE_DEFORM, etc. already use. With=
<br>the fix the reproducer gets a clean error instead of crashing.<br></div=
><div class=3D"gmail_quote gmail_quote_container"><br>Regards,<br><div>Ayus=
h=C2=A0</div></div></div>

--000000000000042c160650462aaa--
--000000000000042c170650462aac
Content-Type: application/octet-stream; 
	name="v1-0001-Detect-row-type-changes-in-EEOP_ROW-expressions.patch"
Content-Disposition: attachment; 
	filename="v1-0001-Detect-row-type-changes-in-EEOP_ROW-expressions.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_moe6e8f90>
X-Attachment-Id: f_moe6e8f90

RnJvbSA1MzExZDQ0ZmVkNDg3MWEwY2IwYmMyYjIzYmUwMjdlYTM4ZWVlMTQyIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBBeXVzaCBUaXdhcmkgPGF5dXNodGl3YXJpLnNsZzAxQGdtYWls
LmNvbT4KRGF0ZTogU2F0LCAyNSBBcHIgMjAyNiAwOTo0OTo1MSArMDAwMApTdWJqZWN0OiBbUEFU
Q0hdIERldGVjdCByb3cgdHlwZSBjaGFuZ2VzIGluIEVFT1BfUk9XIGV4cHJlc3Npb25zCgpFRU9Q
X1JPVyBjYWNoZWQgdGhlIHRhcmdldCBjb21wb3NpdGUgdHlwZSdzIFR1cGxlRGVzYyBhdCBleGVj
dXRvcgpzdGFydHVwIGFuZCBuZXZlciByZS1jaGVja2VkIGl0LiAgSWYgQUxURVIgVFlQRSBtb2Rp
ZmllZCB0aGUgdHlwZQp3aGlsZSBhIGN1cnNvciB3YXMgc3RpbGwgb3BlbiwgdGhlIG5leHQgRkVU
Q0ggd291bGQgdXNlIHRoZSBzdGFsZQpkZXNjcmlwdG9yLCB3aGljaCBjb3VsZCBjcmFzaCB0aGUg
YmFja2VuZCB3aXRoIFNJR1NFR1Ygd2hlbiBhdHRyaWJ1dGUKc3RvcmFnZSBwcm9wZXJ0aWVzIGNo
YW5nZWQgKGUuZy4gaW50IC0+IHRleHQpLgoKT3RoZXIgcm93dHlwZS1hd2FyZSBzdGVwcyAoRUVP
UF9GSUVMRFNFTEVDVCwgRUVPUF9GSUVMRFNUT1JFX0RFRk9STSwKRUVPUF9OVUxMVEVTVF9ST1cq
LCBFRU9QX0NPTlZFUlRfUk9XVFlQRSkgYWxyZWFkeSBndWFyZCBhZ2FpbnN0IHRoaXMKdmlhIEV4
cHJFdmFsUm93dHlwZUNhY2hlLiAgQWRkIHRoZSBzYW1lIGNoZWNrIHRvIEVFT1BfUk9XOiBzdGFz
aCB0aGUKVHlwZUNhY2hlRW50cnkgcG9pbnRlciBhbmQgdHVwRGVzY19pZGVudGlmaWVyIGF0IGlu
aXQgdGltZSwgYW5kCmNvbXBhcmUgYXQgcnVudGltZSBpbiBFeGVjRXZhbFJvdygpLCByYWlzaW5n
IGFuIGVycm9yIGlmIHRoZSB0eXBlIGhhcwpjaGFuZ2VkLgoKUmVwb3J0ZWQtYnk6IEhhb0dhbmcg
TWFvCi0tLQogc3JjL2JhY2tlbmQvZXhlY3V0b3IvZXhlY0V4cHIuYyAgICAgICAgfCAxNSArKysr
KysrKysrKysrKy0KIHNyYy9iYWNrZW5kL2V4ZWN1dG9yL2V4ZWNFeHBySW50ZXJwLmMgIHwgMTEg
KysrKysrKysrKysKIHNyYy9pbmNsdWRlL2V4ZWN1dG9yL2V4ZWNFeHByLmggICAgICAgIHwgIDEg
Kwogc3JjL3Rlc3QvcmVncmVzcy9leHBlY3RlZC9yb3d0eXBlcy5vdXQgfCAxNyArKysrKysrKysr
KysrKysrKwogc3JjL3Rlc3QvcmVncmVzcy9zcWwvcm93dHlwZXMuc3FsICAgICAgfCAxMiArKysr
KysrKysrKysKIDUgZmlsZXMgY2hhbmdlZCwgNTUgaW5zZXJ0aW9ucygrKSwgMSBkZWxldGlvbigt
KQoKZGlmZiAtLWdpdCBhL3NyYy9iYWNrZW5kL2V4ZWN1dG9yL2V4ZWNFeHByLmMgYi9zcmMvYmFj
a2VuZC9leGVjdXRvci9leGVjRXhwci5jCmluZGV4IDc3MjI5MTQxYjM4Li44YjgzZTVkNzFlYSAx
MDA2NDQKLS0tIGEvc3JjL2JhY2tlbmQvZXhlY3V0b3IvZXhlY0V4cHIuYworKysgYi9zcmMvYmFj
a2VuZC9leGVjdXRvci9leGVjRXhwci5jCkBAIC0yMDExLDExICsyMDExLDI0IEBAIEV4ZWNJbml0
RXhwclJlYyhFeHByICpub2RlLCBFeHByU3RhdGUgKnN0YXRlLAogCQkJCQlFeGVjVHlwZVNldENv
bE5hbWVzKHR1cGRlc2MsIHJvd2V4cHItPmNvbG5hbWVzKTsKIAkJCQkJLyogQmxlc3MgdGhlIHR1
cGRlc2Mgc28gaXQgY2FuIGJlIGxvb2tlZCB1cCBsYXRlciAqLwogCQkJCQlCbGVzc1R1cGxlRGVz
Yyh0dXBkZXNjKTsKKwkJCQkJc2NyYXRjaC5kLnJvdy5yb3djYWNoZS5jYWNoZXB0ciA9IE5VTEw7
CisJCQkJCXNjcmF0Y2guZC5yb3cucm93Y2FjaGUudHVwZGVzY19pZCA9IDA7CiAJCQkJfQogCQkJ
CWVsc2UKIAkJCQl7CisJCQkJCVR5cGVDYWNoZUVudHJ5ICp0eXBlbnRyeTsKKwogCQkJCQkvKiBp
dCdzIGJlZW4gY2FzdCB0byBhIG5hbWVkIHR5cGUsIHVzZSB0aGF0ICovCi0JCQkJCXR1cGRlc2Mg
PSBsb29rdXBfcm93dHlwZV90dXBkZXNjX2NvcHkocm93ZXhwci0+cm93X3R5cGVpZCwgLTEpOwor
CQkJCQl0eXBlbnRyeSA9IGxvb2t1cF90eXBlX2NhY2hlKHJvd2V4cHItPnJvd190eXBlaWQsCisJ
CQkJCQkJCQkJCSAgIFRZUEVDQUNIRV9UVVBERVNDKTsKKwkJCQkJaWYgKHR5cGVudHJ5LT50dXBE
ZXNjID09IE5VTEwpCisJCQkJCQllcmVwb3J0KEVSUk9SLAorCQkJCQkJCQkoZXJyY29kZShFUlJD
T0RFX1dST05HX09CSkVDVF9UWVBFKSwKKwkJCQkJCQkJIGVycm1zZygidHlwZSAlcyBpcyBub3Qg
Y29tcG9zaXRlIiwKKwkJCQkJCQkJCQlmb3JtYXRfdHlwZV9iZShyb3dleHByLT5yb3dfdHlwZWlk
KSkpKTsKKwkJCQkJdHVwZGVzYyA9IENyZWF0ZVR1cGxlRGVzY0NvcHlDb25zdHIodHlwZW50cnkt
PnR1cERlc2MpOworCQkJCQlzY3JhdGNoLmQucm93LnJvd2NhY2hlLmNhY2hlcHRyID0gdHlwZW50
cnk7CisJCQkJCXNjcmF0Y2guZC5yb3cucm93Y2FjaGUudHVwZGVzY19pZCA9IHR5cGVudHJ5LT50
dXBEZXNjX2lkZW50aWZpZXI7CiAJCQkJfQogCiAJCQkJLyoKZGlmZiAtLWdpdCBhL3NyYy9iYWNr
ZW5kL2V4ZWN1dG9yL2V4ZWNFeHBySW50ZXJwLmMgYi9zcmMvYmFja2VuZC9leGVjdXRvci9leGVj
RXhwckludGVycC5jCmluZGV4IDA2MzRhZjk2NGE5Li4wZWMwNmU4NzI3OCAxMDA2NDQKLS0tIGEv
c3JjL2JhY2tlbmQvZXhlY3V0b3IvZXhlY0V4cHJJbnRlcnAuYworKysgYi9zcmMvYmFja2VuZC9l
eGVjdXRvci9leGVjRXhwckludGVycC5jCkBAIC0zNjY3LDYgKzM2NjcsMTcgQEAgRXhlY0V2YWxS
b3coRXhwclN0YXRlICpzdGF0ZSwgRXhwckV2YWxTdGVwICpvcCkKIHsKIAlIZWFwVHVwbGUJdHVw
bGU7CiAKKwlpZiAob3AtPmQucm93LnJvd2NhY2hlLnR1cGRlc2NfaWQgIT0gMCkKKwl7CisJCVR5
cGVDYWNoZUVudHJ5ICp0eXBlbnRyeSA9IChUeXBlQ2FjaGVFbnRyeSAqKSBvcC0+ZC5yb3cucm93
Y2FjaGUuY2FjaGVwdHI7CisKKwkJaWYgKHR5cGVudHJ5LT50dXBEZXNjX2lkZW50aWZpZXIgIT0g
b3AtPmQucm93LnJvd2NhY2hlLnR1cGRlc2NfaWQpCisJCQllcmVwb3J0KEVSUk9SLAorCQkJCQko
ZXJyY29kZShFUlJDT0RFX0RBVEFUWVBFX01JU01BVENIKSwKKwkJCQkJIGVycm1zZygicm93IHR5
cGUgJXMgaGFzIGNoYW5nZWQiLAorCQkJCQkJCWZvcm1hdF90eXBlX2JlKG9wLT5kLnJvdy50dXBk
ZXNjLT50ZHR5cGVpZCkpKSk7CisJfQorCiAJLyogYnVpbGQgdHVwbGUgZnJvbSBldmFsdWF0ZWQg
ZmllbGQgdmFsdWVzICovCiAJdHVwbGUgPSBoZWFwX2Zvcm1fdHVwbGUob3AtPmQucm93LnR1cGRl
c2MsCiAJCQkJCQkJb3AtPmQucm93LmVsZW12YWx1ZXMsCmRpZmYgLS1naXQgYS9zcmMvaW5jbHVk
ZS9leGVjdXRvci9leGVjRXhwci5oIGIvc3JjL2luY2x1ZGUvZXhlY3V0b3IvZXhlY0V4cHIuaApp
bmRleCBjNjFiM2Q2MjRkNS4uNTMyZTAxYjdiNmMgMTAwNjQ0Ci0tLSBhL3NyYy9pbmNsdWRlL2V4
ZWN1dG9yL2V4ZWNFeHByLmgKKysrIGIvc3JjL2luY2x1ZGUvZXhlY3V0b3IvZXhlY0V4cHIuaApA
QCAtNDk5LDYgKzQ5OSw3IEBAIHR5cGVkZWYgc3RydWN0IEV4cHJFdmFsU3RlcAogCQlzdHJ1Y3QK
IAkJewogCQkJVHVwbGVEZXNjCXR1cGRlc2M7CS8qIGRlc2NyaXB0b3IgZm9yIHJlc3VsdCB0dXBs
ZXMgKi8KKwkJCUV4cHJFdmFsUm93dHlwZUNhY2hlIHJvd2NhY2hlOwogCQkJLyogd29ya3NwYWNl
IGZvciB0aGUgdmFsdWVzIGNvbnN0aXR1dGluZyB0aGUgcm93OiAqLwogCQkJRGF0dW0JICAgKmVs
ZW12YWx1ZXM7CiAJCQlib29sCSAgICplbGVtbnVsbHM7CmRpZmYgLS1naXQgYS9zcmMvdGVzdC9y
ZWdyZXNzL2V4cGVjdGVkL3Jvd3R5cGVzLm91dCBiL3NyYy90ZXN0L3JlZ3Jlc3MvZXhwZWN0ZWQv
cm93dHlwZXMub3V0CmluZGV4IDk1NmJjMmQwMmZjLi43ZWRlNDViMzIwYSAxMDA2NDQKLS0tIGEv
c3JjL3Rlc3QvcmVncmVzcy9leHBlY3RlZC9yb3d0eXBlcy5vdXQKKysrIGIvc3JjL3Rlc3QvcmVn
cmVzcy9leHBlY3RlZC9yb3d0eXBlcy5vdXQKQEAgLTE0MDgsMyArMTQwOCwyMCBAQCBFUlJPUjog
IGNvbHVtbiAib2lkIiBub3QgZm91bmQgaW4gZGF0YSB0eXBlIGNvbXBvc2l0ZXRhYmxlCiBMSU5F
IDE6IFNFTEVDVCAoTlVMTDo6Y29tcG9zaXRldGFibGUpLm9pZDsKICAgICAgICAgICAgICAgICBe
CiBEUk9QIFRBQkxFIGNvbXBvc2l0ZXRhYmxlOworLS0gQSBuYW1lZCBST1coKSByZXN1bHQgbXVz
dCBub3Qgc3Vydml2ZSBBTFRFUiBUWVBFIHdpdGggdGhlIG9sZCBsYXlvdXQuCitDUkVBVEUgVFlQ
RSBjdXJzb3Jfcm93dHlwZSBBUyAoYSBpbnQsIGIgaW50KTsKK0JFR0lOOworREVDTEFSRSBjIENV
UlNPUiBGT1IKKyAgU0VMRUNUIChpLCBwb3dlcigyLCAzMCkpOjpjdXJzb3Jfcm93dHlwZQorICBG
Uk9NIGdlbmVyYXRlX3NlcmllcygxLCAyKSBpOworRkVUQ0ggYzsKKyAgICAgIHJvdyAgICAgICAK
Ky0tLS0tLS0tLS0tLS0tLS0KKyAoMSwxMDczNzQxODI0KQorKDEgcm93KQorCitBTFRFUiBUWVBF
IGN1cnNvcl9yb3d0eXBlIEFMVEVSIEFUVFJJQlVURSBiIFRZUEUgdGV4dDsKK0ZFVENIIGM7CitF
UlJPUjogIHJvdyB0eXBlIGN1cnNvcl9yb3d0eXBlIGhhcyBjaGFuZ2VkCitST0xMQkFDSzsKK0RS
T1AgVFlQRSBjdXJzb3Jfcm93dHlwZTsKZGlmZiAtLWdpdCBhL3NyYy90ZXN0L3JlZ3Jlc3Mvc3Fs
L3Jvd3R5cGVzLnNxbCBiL3NyYy90ZXN0L3JlZ3Jlc3Mvc3FsL3Jvd3R5cGVzLnNxbAppbmRleCAx
NzRiMDYyMTQ0YS4uZWM2NGY5NjhiZTggMTAwNjQ0Ci0tLSBhL3NyYy90ZXN0L3JlZ3Jlc3Mvc3Fs
L3Jvd3R5cGVzLnNxbAorKysgYi9zcmMvdGVzdC9yZWdyZXNzL3NxbC9yb3d0eXBlcy5zcWwKQEAg
LTU2MiwzICs1NjIsMTUgQEAgU0VMRUNUIChOVUxMOjpjb21wb3NpdGV0YWJsZSkuYTsKIFNFTEVD
VCAoTlVMTDo6Y29tcG9zaXRldGFibGUpLm9pZDsKIAogRFJPUCBUQUJMRSBjb21wb3NpdGV0YWJs
ZTsKKworLS0gQSBuYW1lZCBST1coKSByZXN1bHQgbXVzdCBub3Qgc3Vydml2ZSBBTFRFUiBUWVBF
IHdpdGggdGhlIG9sZCBsYXlvdXQuCitDUkVBVEUgVFlQRSBjdXJzb3Jfcm93dHlwZSBBUyAoYSBp
bnQsIGIgaW50KTsKK0JFR0lOOworREVDTEFSRSBjIENVUlNPUiBGT1IKKyAgU0VMRUNUIChpLCBw
b3dlcigyLCAzMCkpOjpjdXJzb3Jfcm93dHlwZQorICBGUk9NIGdlbmVyYXRlX3NlcmllcygxLCAy
KSBpOworRkVUQ0ggYzsKK0FMVEVSIFRZUEUgY3Vyc29yX3Jvd3R5cGUgQUxURVIgQVRUUklCVVRF
IGIgVFlQRSB0ZXh0OworRkVUQ0ggYzsKK1JPTExCQUNLOworRFJPUCBUWVBFIGN1cnNvcl9yb3d0
eXBlOwotLSAKMi40My4wCgo=
--000000000000042c170650462aac--