MIME-Version: 1.0
References: <adab9758-f346-4263-93af-3e37b7b315b7@gmail.com>
 <20be3d9d-4147-492a-b69c-d69a87a014a9@gmail.com>
In-Reply-To: <20be3d9d-4147-492a-b69c-d69a87a014a9@gmail.com>
From: David Rowley <dgrowleyml@gmail.com>
Date: Tue, 21 Apr 2026 20:35:42 +1200
Message-ID: 
 <CAApHDvpBZ_hj0p1fYYQCxk9eCfNSsjFfR+LYCEryek9Mxh1V0Q@mail.gmail.com>
Subject: Re: A very quick observation of dangling pointers in Postgres
 pathlists
To: Andrei Lepikhov <lepihov@gmail.com>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>,
 Tom Lane <tgl@sss.pgh.pa.us>
Content-Type: text/plain; charset="UTF-8"
Archived-At: 
 <https://www.postgresql.org/message-id/CAApHDvpBZ_hj0p1fYYQCxk9eCfNSsjFfR%2BLYCEryek9Mxh1V0Q%40mail.gmail.com>
Precedence: bulk

On Tue, 21 Apr 2026 at 19:29, Andrei Lepikhov <lepihov@gmail.com> wrote:
>
> On 17/04/2026 10:56, Andrei Lepikhov wrote:
> > The best-known problematic code example causing this issue is
> > apply_scanjoin_target_to_paths(), and the current_rel/final_rel game from commit
> > 0927d2f46dd.  Quickly fixing it, I see some more combinations have emerged:
>
> On closer inspection, it looks like all the detected cases come from the same
> issue in create_ordered_paths. The ordered_rel has the same path in its pathlist
> as the input_rel. Sometimes, this path is removed and freed from ordered_rel,
> which leads to a dangling pointer in the child RelOptInfo.
>
> I've attached a patch that shows how to fix the issue. Some regression tests
> change because of a hidden rule where a projection and its subpath have
> different target lists. Right now, the patch always enforces a projection, even
> if the target lists are the same. This is still open for discussion on whether
> there's a better way to handle it.

IMO, we should write a function like copy_path() or reparent_path(),
which creates a copy of the given Path, or the latter also would copy
then set the ->parent to the given RelOptInfo.  Any time we use a path
directly from the pathlist of another RelOptInfo, we should reparent
or copy it. We could add an Assert in add_path() to check the new path
has the correct parent to help us find the places where we forget to
do this.

David