public inbox for [email protected]
help / color / mirror / Atom feedFrom: Nikita Malakhov <[email protected]>
To: Andrey Rachitskiy <[email protected]>
Cc: Amit Langote <[email protected]>
Cc: Andrey Borodin <[email protected]>
Cc: PostgreSQL mailing lists <[email protected]>
Cc: Nikolay Shaplov <[email protected]>
Subject: Re: BUG #19458: OOM killer in jsonb_path_exists_opr (@?) with malformed JSONPath containing non-existent variables
Date: Fri, 5 Jun 2026 13:57:27 +0300
Message-ID: <CAN-LCVP7dxvrvRTpRhZbfL8Obh_d4dvcQOfuOQC5aKukZ7+xRw@mail.gmail.com> (raw)
In-Reply-To: <CAB8bMivkf5X73X6LOSxt4r4tx_PN6DnGKVcBa3BtYX=eOKwHaw@mail.gmail.com>
References: <[email protected]>
<CAB8bMit1HvJsAasUYwmq+82Oa3zQhJyvsHNS4PGF_S_BCMnuVA@mail.gmail.com>
<[email protected]>
<CAN-LCVNh2z4EE+F21XPe7XRSWfPFtZx1WYAswpU5qs+RdR=jjg@mail.gmail.com>
<[email protected]>
<CAN-LCVPiBi9XXW__RorX=dH2_fANAMXhdbULmHFFg97F_0ubRw@mail.gmail.com>
<[email protected]>
<CA+HiwqG5pP8g0oGkz8x6X80XJyZqGiS16F9DhvJ3Ukejkd8MbQ@mail.gmail.com>
<CAB8bMivkf5X73X6LOSxt4r4tx_PN6DnGKVcBa3BtYX=eOKwHaw@mail.gmail.com>
Hi!
Thank you very much for this investigation! I'd take a look into the patch
after the weekend.
On Fri, Jun 5, 2026 at 1:03 PM Andrey Rachitskiy <[email protected]> wrote:
> The growing allocation is leaked temporary JsonValueLists in
> executePredicate() (local lseq/rseq, ~1482–1547) and the arithmetic helpers
> executeBinaryArithmExpr() / executeUnaryArithmExpr() (~1561–1684). Each
> nested comparison or arithmetic subexpression materializes operands via
> executeItemOptUnwrapResult[NoThrow]() → executeNextItem() →
> JsonValueListAppend() (~1165, ~2451), but the interim lists are never freed
> before return. For @? specifically, executeJsonPath() also leaks a local
> vals list in strict exists mode (~579–586).
>
> Missing vars make the AFL case worse by returning null instead of error,
> so evaluation continues deep into nested $?()/comparisons instead of
> stopping at the first $"…" reference. The same leak mechanism is reachable
> without missing vars — Tom Lane demonstrated this on master (5a2043bf713)
> with $[*] ? (@ < $) on a large array.
>
> Our missing-variable patch fixes the reported OOM and the @? semantics bug
> by aborting early. Whether REL_14/15/16 also need a broader fix for interim
> JsonValueList cleanup is beyond what I can confidently propose; I've tried
> to pin down where the growth happens for that discussion.
>
> пт, 5 июн. 2026 г. в 13:58, Amit Langote <[email protected]>:
>
>> Hi,
>>
>> Before I dig into the patch properly after the weekend, one question
>> on the report itself: has anyone traced why the old path runs away on
>> memory? We've characterized it as missing-var, then null, then
>> evaluation continues, then OOM, but I don't think the actual growing
>> allocation has been pinned down. Mostly want to understand whether the
>> same runaway is reachable without a missing variable, since raising
>> the error early wouldn't catch those cases.
>>
>> - Thanks, Amit
>>
>
--
Regards,
Nikita Malakhov
Postgres Professional
The Russian Postgres Company
https://postgrespro.ru/
view thread (10+ messages)
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Subject: Re: BUG #19458: OOM killer in jsonb_path_exists_opr (@?) with malformed JSONPath containing non-existent variables
In-Reply-To: <CAN-LCVP7dxvrvRTpRhZbfL8Obh_d4dvcQOfuOQC5aKukZ7+xRw@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox