Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hlJf9-0004FV-4o for pgsql-hackers@arkaria.postgresql.org; Wed, 10 Jul 2019 20:58:03 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1hlJf7-00065T-Uw for pgsql-hackers@arkaria.postgresql.org; Wed, 10 Jul 2019 20:58:01 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hlJf7-000600-Hg for pgsql-hackers@lists.postgresql.org; Wed, 10 Jul 2019 20:58:01 +0000 Received: from sss.pgh.pa.us ([66.207.139.130]) by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hlJf5-0007UP-Bn; Wed, 10 Jul 2019 20:58:00 +0000 Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1]) by sss.pgh.pa.us (8.14.4/8.14.4) with ESMTP id x6AKvsno015098; Wed, 10 Jul 2019 16:57:54 -0400 From: Tom Lane To: Andreas Seltenreich cc: pgsql-hackers@lists.postgresql.org, Tomas Vondra Subject: Re: [sqlsmith] Crash in mcv_get_match_bitmap In-reply-to: <8736jdhbhc.fsf@ansel.ydns.eu> References: <8736jdhbhc.fsf@ansel.ydns.eu> Comments: In-reply-to Andreas Seltenreich message dated "Wed, 10 Jul 2019 22:37:51 +0200" MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <15096.1562792274.1@sss.pgh.pa.us> Date: Wed, 10 Jul 2019 16:57:54 -0400 Message-ID: <15097.1562792274@sss.pgh.pa.us> List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk Andreas Seltenreich writes: > running sqlsmith on the regression database of REL_12_STABLE at > ff597b656f yielded a crash in mcv_get_match_bitmap. I can reproduce it > with the following query on the regression database: > select filler1 from mcv_lists where a is not null and (select 42) <= c; Seems to be the same problem I just complained of in the other thread: mcv_get_match_bitmap has an untenable assumption that "is a pseudoconstant" means "is a Const". I notice it's also assuming that the Const must be non-null. It's not really easy to crash it that way, because if you just write "null <= c" that'll get reduced to constant-NULL earlier. But I bet there's a way. regards, tom lane