Subject: Bug: WAIT FOR LSN crashes with assertion failure inside PL/pgSQL DO blocks and procedures

From: SATYANARAYANA NARLAPURAM <[email-masked]>
Date: Wed, 8 Apr 2026 19:03:31 -0700

Hi hackers, Alexander,

An assertion failure (server crash in assert-enabled builds) occurs when
WAIT FOR LSN ... INTO is used inside PL/pgSQL DO blocks or within void
procedures.

Repro:

-- Run this on a standby

CREATE PROCEDURE test_wait()
  LANGUAGE plpgsql AS $$
  DECLARE
    result text;
  BEGIN
    WAIT FOR LSN '0/1234' INTO result;
    RAISE NOTICE '%', result;
  END;
  $$;
  CALL test_wait();

The WAIT FOR itself succeeds, but the very next PL/pgSQL statement that
requires a snapshot crashes the backend with:

  TRAP: failed Assert("portal->portalSnapshot == NULL"),
  File: "pquery.c", Line: 1776

Attached patches for both the test case and a potential fix. Please review.

Thanks,
Satya

---

From: Alexander Korotkov <[email-masked]>
Date: Thu, 9 Apr 2026 09:00:06 +0300

Hi, Satya!

On Thu, Apr 9, 2026 at 5:03 AM SATYANARAYANA NARLAPURAM
<[email-masked]> wrote:
> An assertion failure (server crash in assert-enabled builds) occurs when WAIT FOR LSN ... INTO is used inside PL/pgSQL DO blocks or within void procedures.
>
> Repro:
>
> -- Run this on a standby
>
> The WAIT FOR itself succeeds, but the very next PL/pgSQL statement that requires a snapshot crashes the backend with:
>

Thank you for reporting.  But I doubt the fix is correct.  Even that
this particular might work OK, I don't think it's safe to release
snapshots belonging to functions/procedures: it might affect them.  I
tend to think we must forbid wrapping WAIT FOR LSN with
functions/procedures.  I'll explore more on this today.

------
Regards,
Alexander Korotkov
Supabase

---

From: Xuneng Zhou <[email-masked]>
Date: Thu, 9 Apr 2026 14:38:59 +0800

-- 
Best,
Xuneng

---

From: Xuneng Zhou <[email-masked]>
Date: Thu, 9 Apr 2026 15:04:08 +0800

Hi Satya, Alexander,

> > functions/procedures.  I'll explore more on this today.

Opus, sorry for clicking send incidentally before typing anything...

I had looked at these patches before and didn’t see anything
particularly wrong except:
1. patch 1 unconditionally nulled ActivePortal->portalSnapshot
whenever it was non-NULL after the pop;
2. patch 2 used RAISE NOTICE after WAIT FOR, which seems not excercise
the bug straightforwardly.

I didn't realized the safety implications of releasing a procedure/DO
snapshot during PL execution. I’ve noticed several warnings in the
tree advising against this.

/*
* Ensure there's an active snapshot whilst we execute whatever's
* involved here.  Note that this is *not* sufficient to make the
* world safe for TOAST pointers to be included in the returned data:
* the referenced data could have gone away while we didn't hold a
* snapshot.  Hence, it's incumbent on PLs that can do COMMIT/ROLLBACK
* to not return TOAST pointers, unless those pointers were fetched
* after the last COMMIT/ROLLBACK in the procedure.
*
* XXX that is a really nasty, hard-to-test requirement.  Is there a
* way to remove it?
*/
EnsurePortalSnapshotExists();

-- 
Best,
Xuneng

---

From: SATYANARAYANA NARLAPURAM <[email-masked]>
Date: Thu, 9 Apr 2026 00:26:54 -0700

Hi Alexnader,

> functions/procedures.  I'll explore more on this today.

Agreed, attached a v2 patch with your suggestion on preventing it running
from procedures.

Thanks,
Satya

---

From: Alexander Korotkov <[email-masked]>
Date: Thu, 9 Apr 2026 14:47:05 +0300

> EnsurePortalSnapshotExists();

Regarding functions, function may be part of bigger query running with
particular snapshot.  Note that single query is always executed within
the single snapshot (barring EvalPlanQual()) even in read committed
mode.  Releasing a snapshot in the middle of the query could cause, if
even we somehow re-acquire a new snapshot, could cause rest of query
to be executed inconsistently with its beginning.

It is probably different for procedures, which don't have to stick to
a single snapshot.  But I can still imagine WAIT FOR LSN to be inside
a loop over some query results or something similar.  We are now past
FF for PG19.  I suggest we should now forbid WAIT FOR LSN both in
functions and procedures.  For PG20 we can reconsider some cases when
running  WAIT FOR LSN inside the stored procedure is safe.

------
Regards,
Alexander Korotkov
Supabase

---

From: Alexander Korotkov <[email-masked]>
Date: Thu, 9 Apr 2026 15:28:16 +0300

On Thu, Apr 9, 2026 at 10:27 AM SATYANARAYANA NARLAPURAM
<[email-masked]> wrote:
> On Wed, Apr 8, 2026 at 11:00 PM Alexander Korotkov <[email-masked]> wrote:

Thank you.  I've slightly revised your patch.  I'm going to push it if
no objections.

------
Regards,
Alexander Korotkov
Supabase

---

From: SATYANARAYANA NARLAPURAM <[email-masked]>
Date: Thu, 9 Apr 2026 14:37:44 -0700

Hi Alexander,

On Thu, Apr 9, 2026 at 5:28 AM Alexander Korotkov <[email-masked]>
wrote:

> >> > An assertion failure (server crash in assert-enabled builds) occurs
> when WAIT FOR LSN ... INTO is used inside PL/pgSQL DO blocks or within void
> procedures.
> >> >
> >> > Repro:
> >> >
> >> > -- Run this on a standby
> >> >
> >> > The WAIT FOR itself succeeds, but the very next PL/pgSQL statement
> that requires a snapshot crashes the backend with:
> >> >

LGTM, thank you!

---

From: "wang.xiao.peng" <[email-masked]>
Date: Fri, 10 Apr 2026 07:44:54 +0800 (CST)

>Supabase

Hi,
This patch looks good to me overall. I spotted a typo in the commit message:

"it could pass this check causing an error elsewhere.  This commit implments"

implments -> implements, missing an "e".

Regard,
Xiaopeng Wang

---

From: Xuneng Zhou <[email-masked]>
Date: Fri, 10 Apr 2026 15:36:04 +0800

> implments -> implements, missing an "e".

I’ve revised the patch. Moving the non–top-level rejection to the
beginning of the function may help avoid unnecessary parsing and
validation work, although it could make the reasoning slightly less
localized.

Since this is user-facing, should we explicitly document this
constraint to make the behavior less surprising? The rejection applies
not only to wrapping the command in a procedure or function, but also
within a DO block.

It might also be worth adding a regression test and refining the error
message accordingly. With this new constraint, some existing comments
were outdated and have been updated as well.

--
Best,
Xuneng

---

From: Alexander Korotkov <[email-masked]>
Date: Mon, 13 Apr 2026 14:06:38 +0300

> were outdated and have been updated as well.

Accepted, thank you.  Also, I've added errdetail() to clarify when the
statement could be not top-level.  Pushed.

------
Regards,
Alexander Korotkov
Supabase