From: Vishal Prasanna <vishal.g@zohocorp.com>
Subject: [PATCH] Fix specinsert leak in ReorderBufferProcessTXN error path
Date: Mon, 9 Mar 2026 00:46:12 +0530
---
.../replication/logical/reorderbuffer.c | 20 ++++-----
src/test/subscription/t/100_bugs.pl | 45 +++++++++++++++++++
2 files changed, 54 insertions(+), 11 deletions(-)
diff --git a/src/backend/replication/logical/reorderbuffer.c b/src/backend/replication/logical/reorderbuffer.cindex 11139a910b8..57e1ae2441b 100644--- a/src/backend/replication/logical/reorderbuffer.c+++ b/src/backend/replication/logical/reorderbuffer.c@@ -2164,8 +2164,7 @@ static void
ReorderBufferResetTXN(ReorderBuffer *rb, ReorderBufferTXN *txn,
Snapshot snapshot_now,
CommandId command_id,
- XLogRecPtr last_lsn,- ReorderBufferChange *specinsert)+ XLogRecPtr last_lsn)
{
/* Discard the changes that we just streamed */
ReorderBufferTruncateTXN(rb, txn, rbtxn_is_prepared(txn));
@@ -2173,13 +2172,6 @@ ReorderBufferResetTXN(ReorderBuffer *rb, ReorderBufferTXN *txn,
/* Free all resources allocated for toast reconstruction */
ReorderBufferToastReset(rb, txn);
- /* Return the spec insert change if it is not NULL */- if (specinsert != NULL)- {- ReorderBufferFreeChange(rb, specinsert, true);- specinsert = NULL;- }-
/*
* For the streaming case, stop the stream and remember the command ID and
* snapshot for the streaming run.
@@ -2753,6 +2745,13 @@ ReorderBufferProcessTXN(ReorderBuffer *rb, ReorderBufferTXN *txn,
if (using_subtxn)
RollbackAndReleaseCurrentSubTransaction();
+ /* Free the specinsert change before freeing the ReorderBufferTXN */+ if (specinsert != NULL)+ {+ ReorderBufferFreeChange(rb, specinsert, true);+ specinsert = NULL;+ }+
/*
* The error code ERRCODE_TRANSACTION_ROLLBACK indicates a concurrent
* abort of the (sub)transaction we are streaming or preparing. We
@@ -2786,8 +2785,7 @@ ReorderBufferProcessTXN(ReorderBuffer *rb, ReorderBufferTXN *txn,
/* Reset the TXN so that it is allowed to stream remaining data. */
ReorderBufferResetTXN(rb, txn, snapshot_now,
- command_id, prev_lsn,- specinsert);+ command_id, prev_lsn);
}
else
{
diff --git a/src/test/subscription/t/100_bugs.pl b/src/test/subscription/t/100_bugs.plindex 50223054918..df6b2e1296d 100644--- a/src/test/subscription/t/100_bugs.pl+++ b/src/test/subscription/t/100_bugs.pl@@ -605,4 +605,49 @@ $node_publisher->safe_psql('postgres', "DROP DATABASE regress_db");
$node_publisher->stop('fast');
+# https://postgr.es/m/19c7623e882.4080fd5426212.311756747309556767%40zohocorp.com++# The bug was that when an ERROR was raised while processing an INSERT ... ON+# CONFLICT statement, the decoded change misses to be free'd. This can cause an+# assertion failure if enabled.++$node_publisher->rotate_logfile();+$node_publisher->start();++# Create a publication with the zero-division row filter. It always throws an+# ERROR before publishing changes, when the filter is evaluated.+$node_publisher->safe_psql(+ 'postgres', qq(+ CREATE TABLE tab_upsert (a INT PRIMARY KEY, b INT);+ CREATE PUBLICATION pub_rowfilter_error FOR TABLE tab_upsert WHERE ((a / 0) > 0);+ SELECT * FROM pg_create_logical_replication_slot('upsert_slot', 'pgoutput');+ INSERT INTO tab_upsert (a, b) VALUES (1, 1)+ ON CONFLICT(a) DO UPDATE SET b = excluded.b;+));++# Decode the changes with a publication whose row filter causes a+# division by zero error, and verify that the logical decoder doesn't crash.+($ret, $stdout, $stderr) = $node_publisher->psql(+ 'postgres', qq(+ SELECT *+ FROM pg_logical_slot_peek_binary_changes(+ 'upsert_slot',+ NULL,+ NULL,+ 'proto_version', '1',+ 'publication_names', 'pub_rowfilter_error'+ );+));++ok( $stderr =~ qr/division by zero/,+ 'peek logical changes with row filter causing division by zero throws error'+);++# Clean up+$node_publisher->safe_psql('postgres', "SELECT pg_drop_replication_slot('upsert_slot')");+$node_publisher->safe_psql('postgres', "DROP PUBLICATION pub_rowfilter_error");+$node_publisher->safe_psql('postgres', "DROP TABLE tab_upsert");++$node_publisher->stop('fast');+
done_testing();
--
2.50.1 (Apple Git-155)
------=_Part_19194_1450465315.1773004443059--
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: vishal.g@zohocorp.com
Subject: Re: [PATCH] Fix specinsert leak in ReorderBufferProcessTXN error path
In-Reply-To: <no-message-id-19401@localhost>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox