From: Tom Lane <tgl@sss.pgh.pa.us>
To: Laurenz Albe <laurenz.albe@cybertec.at>
cc: pgsql-hackers@lists.postgresql.org
Subject: Re: Making the ENUM operators LEAKPROOF
In-reply-to: <8222d01be22d9d87ba1e7f47e398f4ce81af4aaf.camel@cybertec.at>
References: <8222d01be22d9d87ba1e7f47e398f4ce81af4aaf.camel@cybertec.at>
Comments: In-reply-to Laurenz Albe <laurenz.albe@cybertec.at>
	message dated "Wed, 29 Apr 2026 17:32:44 +0200"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3652797.1782945225.1@sss.pgh.pa.us>
Date: Wed, 01 Jul 2026 18:33:45 -0400
Message-ID: <3652798.1782945225@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/3652798.1782945225%40sss.pgh.pa.us>
Precedence: bulk

Laurenz Albe <laurenz.albe@cybertec.at> writes:
> This is an attempt to get the operators from the "enum_ops" operator
> class LEAKPROOF.

I think we should reject this idea.  Our standard for marking
functions leakproof has always included a requirement that the amount
of code involved be small enough that one can immediately confirm that
there is no information leak.  I don't think that enum_cmp() can meet
that standard; the length of your argument already proves the point.
The issue here is not really "can I convince myself that it's safe
today?".  It's more about "am I willing to bet that no future code
change is going to unintentionally break the property?".  The more
code involved, the riskier that bet.

I know that you are going to say "but text_cmp covers a lot of
ground, including code (in libc or ICU) that isn't even ours".
To my mind, we made an exception for text_cmp because the performance
consequences of not making it leakproof were unacceptable.
I do not think enum_cmp() can clear that bar either.

FWIW, I do agree that marking enum_eq leakproof is safe.  How
many of the use-cases you are worried about would be satisfied
with that?

			regards, tom lane