MIME-Version: 1.0
References: <19405-1ecf025dda171555@postgresql.org>
In-Reply-To: <19405-1ecf025dda171555@postgresql.org>
From: Richard Guo <guofenglinux@gmail.com>
Date: Sat, 14 Feb 2026 18:41:00 +0900
Message-ID: <CAMbWs4_GnG0NYnsBZJpHG-BLo28euD6VUx0WhFd4Ur6RaLr5WQ@mail.gmail.com>
Subject: Re: BUG #19405: Assertion in eval_windowaggregates() fails due to
 integer overflow
To: exclusion@gmail.com, pgsql-bugs@lists.postgresql.org
Content-Type: multipart/mixed; boundary="000000000000a502af064ac58579"
Archived-At: <https://www.postgresql.org/message-id/CAMbWs4_GnG0NYnsBZJpHG-BLo28euD6VUx0WhFd4Ur6RaLr5WQ%40mail.gmail.com>
Precedence: bulk

--000000000000a502af064ac58579
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, Feb 13, 2026 at 7:09=E2=80=AFPM PG Bug reporting form
<noreply@postgresql.org> wrote:
> The following script:
> CREATE TABLE t (i integer);
> INSERT INTO t SELECT g FROM generate_series(1, 2) g;
> SELECT SUM(i) OVER (ROWS BETWEEN 1 PRECEDING AND 0x7fffffffffffffff
> FOLLOWING EXCLUDE CURRENT ROW) FROM t;

Thanks for the report.  Reproduced here.

It seems to be caused by a signed integer overflow in row_is_in_frame
when calculating the frame's end position:

            if (pos > winstate->currentpos + offset)
                return -1;

When offset is very large (close to INT64_MAX, as in the reported
case), the addition can overflow, in which case the result would wrap
to a negative number (with -fwrapv), causing the comparison to
incorrectly return true.  In release builds, this causes valid rows to
be excluded from the window frame.  In debug builds, it leads to an
assertion failure.

I think we can fix this by leveraging the overflow-aware integer
operation (ie, pg_add_s64_overflow) to perform the addition here.  If
an overflow is detected, we can assume the frame boundary extends to
the end of the partition, meaning the current row is within the frame.

- Richard

--000000000000a502af064ac58579
Content-Type: application/octet-stream; 
	name="v1-0001-Fix-signed-integer-overflow-in-nodeWindowAgg.c.patch"
Content-Disposition: attachment; 
	filename="v1-0001-Fix-signed-integer-overflow-in-nodeWindowAgg.c.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mlm4maj90>
X-Attachment-Id: f_mlm4maj90

RnJvbSA3ZjMxYWIzOTc5NWFmYTQ5Njg5OWNlZjYyZDE2ODUyZDEyZTJlYzMxIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBSaWNoYXJkIEd1byA8Z3VvZmVuZ2xpbnV4QGdtYWlsLmNvbT4K
RGF0ZTogU2F0LCAxNCBGZWIgMjAyNiAxODoxNjoyNyArMDkwMApTdWJqZWN0OiBbUEFUQ0ggdjFd
IEZpeCBzaWduZWQgaW50ZWdlciBvdmVyZmxvdyBpbiBub2RlV2luZG93QWdnLmMKCi0tLQogc3Jj
L2JhY2tlbmQvZXhlY3V0b3Ivbm9kZVdpbmRvd0FnZy5jIHwgOCArKysrKysrLQogMSBmaWxlIGNo
YW5nZWQsIDcgaW5zZXJ0aW9ucygrKSwgMSBkZWxldGlvbigtKQoKZGlmZiAtLWdpdCBhL3NyYy9i
YWNrZW5kL2V4ZWN1dG9yL25vZGVXaW5kb3dBZ2cuYyBiL3NyYy9iYWNrZW5kL2V4ZWN1dG9yL25v
ZGVXaW5kb3dBZ2cuYwppbmRleCBkOWI2NGIwZjQ2NS4uMDY1MTlkNGRmNzAgMTAwNjQ0Ci0tLSBh
L3NyYy9iYWNrZW5kL2V4ZWN1dG9yL25vZGVXaW5kb3dBZ2cuYworKysgYi9zcmMvYmFja2VuZC9l
eGVjdXRvci9ub2RlV2luZG93QWdnLmMKQEAgLTM3LDYgKzM3LDcgQEAKICNpbmNsdWRlICJjYXRh
bG9nL29iamVjdGFjY2Vzcy5oIgogI2luY2x1ZGUgImNhdGFsb2cvcGdfYWdncmVnYXRlLmgiCiAj
aW5jbHVkZSAiY2F0YWxvZy9wZ19wcm9jLmgiCisjaW5jbHVkZSAiY29tbW9uL2ludC5oIgogI2lu
Y2x1ZGUgImV4ZWN1dG9yL2V4ZWN1dG9yLmgiCiAjaW5jbHVkZSAiZXhlY3V0b3Ivbm9kZVdpbmRv
d0FnZy5oIgogI2luY2x1ZGUgIm1pc2NhZG1pbi5oIgpAQCAtMTUzMiwxMiArMTUzMywxNyBAQCBy
b3dfaXNfaW5fZnJhbWUoV2luZG93T2JqZWN0IHdpbm9iaiwgaW50NjQgcG9zLCBUdXBsZVRhYmxl
U2xvdCAqc2xvdCwKIAkJaWYgKGZyYW1lT3B0aW9ucyAmIEZSQU1FT1BUSU9OX1JPV1MpCiAJCXsK
IAkJCWludDY0CQlvZmZzZXQgPSBEYXR1bUdldEludDY0KHdpbnN0YXRlLT5lbmRPZmZzZXRWYWx1
ZSk7CisJCQlpbnQ2NAkJdGFyZ2V0X3BvczsKIAogCQkJLyogcm93cyBhZnRlciBjdXJyZW50IHJv
dyArIG9mZnNldCBhcmUgb3V0IG9mIGZyYW1lICovCiAJCQlpZiAoZnJhbWVPcHRpb25zICYgRlJB
TUVPUFRJT05fRU5EX09GRlNFVF9QUkVDRURJTkcpCiAJCQkJb2Zmc2V0ID0gLW9mZnNldDsKIAot
CQkJaWYgKHBvcyA+IHdpbnN0YXRlLT5jdXJyZW50cG9zICsgb2Zmc2V0KQorCQkJaWYgKHBnX2Fk
ZF9zNjRfb3ZlcmZsb3cod2luc3RhdGUtPmN1cnJlbnRwb3MsIG9mZnNldCwgJnRhcmdldF9wb3Mp
KQorCQkJeworCQkJCS8qIG92ZXJmbG93OiBmcmFtZSBleHRlbmRzIHRvIGVuZCBvZiBwYXJ0aXRp
b24gKi8KKwkJCX0KKwkJCWVsc2UgaWYgKHBvcyA+IHRhcmdldF9wb3MpCiAJCQkJcmV0dXJuIC0x
OwogCQl9CiAJCWVsc2UgaWYgKGZyYW1lT3B0aW9ucyAmIChGUkFNRU9QVElPTl9SQU5HRSB8IEZS
QU1FT1BUSU9OX0dST1VQUykpCi0tIAoyLjM5LjUgKEFwcGxlIEdpdC0xNTQpCgo=
--000000000000a502af064ac58579--