crash in ltree_compare_distance() in 14.24

From: Chris St Denis <chris(at)ctgameinfo(dot)com>
To: pgsql-bugs(at)lists(dot)postgresql(dot)org
Subject: crash in ltree_compare_distance() in 14.24
Date: 2026-10-27 02:54:40
Message-ID: 043a5139-1f0c-49df-b423-1cd129839aa9@ctgameinfo.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

I don't have it compiled with debug, and when I recompile and try the
old core I get corrupted stack, but hopefully you can make some use of
this data as is.

root(at)Satsuki:/var/db/postgres/data14 # gdb /usr/local/bin/postgres
postgres.core
GNU gdb (GDB) 15.1 [GDB v15.1 for FreeBSD]
<snip>
Reading symbols from /usr/local/bin/postgres...
(No debugging symbols found in /usr/local/bin/postgres)
[New LWP 101430]
Core was generated by `postgres: <removed> '.
Program terminated with signal SIGSEGV, Segmentation fault.
Address not mapped to object.
#0  0x0000001269bfe52a in ltree_compare_distance () from
/usr/local/lib/postgresql/ltree.so
(gdb)
(gdb) bt
#0  0x0000001269bfe52a in ltree_compare_distance () from
/usr/local/lib/postgresql/ltree.so
#1  0x0000001269bfb74b in ltree_penalty () from
/usr/local/lib/postgresql/ltree.so
#2  0x0000000000962cad in FunctionCall3Coll ()
#3  0x00000000005104eb in gistchoose ()
#4  0x000000000050529d in gistdoinsert ()
#5  0x0000000000504b7b in gistinsert ()
#6  0x0000000000694322 in ExecInsertIndexTuples ()
#7  0x00000000006c2485 in ?? ()
#8  0x00000000006c13ee in ?? ()
#9  0x0000000000695a2b in standard_ExecutorRun ()
#10 0x000000082bad035f in ?? () from
/usr/local/lib/postgresql/pg_stat_statements.so
#11 0x00000000008231bf in ?? ()
#12 0x0000000000822892 in ?? ()
#13 0x0000000000822330 in PortalRun ()
#14 0x000000000081fffe in PostgresMain ()
#15 0x0000000000792b42 in ?? ()
#16 0x00000000007917bc in ?? ()
#17 0x000000000078eaf4 in PostmasterMain ()
#18 0x00000000006e9ee1 in main ()

(gdb) info registers
rax            0x3f9ff300          1067447040
rbx            0x0                 0
rcx            0x8                 8
rdx            0x0                 0
rsi            0x127a2f2a0f        79359322639
rdi            0x2fa39243b1d8      52379580084696
rbp            0x8212247d0         0x8212247d0
rsp            0x821224790         0x821224790
r8             0x82122491c         34915633436
r9             0x0                 0
r10            0x2fa392591378      52379581485944
r11            0x123a8f3ca0        78291877024
r12            0x8                 8
r13            0x2fa39243b1d0      52379580084688
r14            0x127a2f2a0f        79359322639
r15            0x2fa39243b1d8      52379580084696
rip            0x1269bfe52a        0x1269bfe52a <ltree_compare_distance+26>
eflags         0x10246             [ PF ZF IF RF ]
cs             0x43                67
ss             0x3b                59
ds             0x3b                59
es             0x3b                59
fs             0x13                19
gs             0x1b                27
fs_base        0x2fa3916573a0      52379565519776
gs_base        0x0                 0
(gdb) disassemble
Dump of assembler code for function ltree_compare_distance:
   0x0000001269bfe510 <+0>:     push   %rbp
   0x0000001269bfe511 <+1>:     mov    %rsp,%rbp
   0x0000001269bfe514 <+4>:     push   %r15
   0x0000001269bfe516 <+6>:     push   %r14
   0x0000001269bfe518 <+8>:     push   %r13
   0x0000001269bfe51a <+10>:    push   %r12
   0x0000001269bfe51c <+12>:    push   %rbx
   0x0000001269bfe51d <+13>:    sub    $0x18,%rsp
   0x0000001269bfe521 <+17>:    movzwl 0x4(%rdi),%edx
   0x0000001269bfe525 <+21>:    test   %edx,%edx
   0x0000001269bfe527 <+23>:    setne  %al
=> 0x0000001269bfe52a <+26>:    movzwl 0x4(%rsi),%ecx
   0x0000001269bfe52e <+30>:    movzwl %cx,%ecx
   0x0000001269bfe531 <+33>:    mov    %ecx,-0x2c(%rbp)
   0x0000001269bfe534 <+36>:    test   %cx,%cx
   0x0000001269bfe537 <+39>:    setne  %cl
   0x0000001269bfe53a <+42>:    and    %al,%cl
   0x0000001269bfe53c <+44>:    mov    %edx,-0x30(%rbp)
   0x0000001269bfe53f <+47>:    mov    %edx,%eax
   0x0000001269bfe541 <+49>:    cmp    $0x1,%cl
   0x0000001269bfe544 <+52>:    jne    0x1269bfe5b8
<ltree_compare_distance+168>
   0x0000001269bfe546 <+54>:    mov    %rsi,%rbx
   0x0000001269bfe549 <+57>:    mov    %rdi,%r14
   0x0000001269bfe54c <+60>:    add    $0x8,%rbx
   0x0000001269bfe550 <+64>:    add    $0x8,%r14
   0x0000001269bfe554 <+68>:    mov    -0x2c(%rbp),%eax
   0x0000001269bfe557 <+71>:    mov    %eax,%r12d
   0x0000001269bfe55a <+74>:    mov    -0x30(%rbp),%eax
   0x0000001269bfe55d <+77>:    mov    %eax,%edx
   0x0000001269bfe55f <+79>:    nop
   0x0000001269bfe560 <+80>:    mov    %rdx,-0x38(%rbp)
   0x0000001269bfe564 <+84>:    lea    0x2(%r14),%rdi
   0x0000001269bfe568 <+88>:    lea    0x2(%rbx),%rsi
   0x0000001269bfe56c <+92>:    movzwl (%r14),%r15d
   0x0000001269bfe570 <+96>:    movzwl (%rbx),%r13d
   0x0000001269bfe574 <+100>:   cmp    %r13w,%r15w
   0x0000001269bfe578 <+104>:   mov    %r13d,%edx
   0x0000001269bfe57b <+107>:   cmovb  %r15d,%edx
   0x0000001269bfe57f <+111>:   call   0x1269c01310 <memcmp(at)plt>
   0x0000001269bfe584 <+116>:   test   %eax,%eax
   0x0000001269bfe586 <+118>:   jne    0x1269bfe5d9
<ltree_compare_distance+201>
   0x0000001269bfe588 <+120>:   cmp    %r13w,%r15w
   0x0000001269bfe58c <+124>:   mov    -0x38(%rbp),%rcx
   0x0000001269bfe590 <+128>:   jne    0x1269bfe5f1
<ltree_compare_distance+225>
   0x0000001269bfe592 <+130>:   lea    -0x1(%rcx),%eax
   0x0000001269bfe595 <+133>:   cmp    $0x2,%ecx
   0x0000001269bfe598 <+136>:   jl     0x1269bfe5b8
<ltree_compare_distance+168>
   0x0000001269bfe59a <+138>:   lea    -0x1(%r12),%ecx
   0x0000001269bfe59f <+143>:   add    $0x9,%r15d
   0x0000001269bfe5a3 <+147>:   and    $0xfffffff8,%r15d
   0x0000001269bfe5a7 <+151>:   add    %r15,%r14
   0x0000001269bfe5aa <+154>:   add    %r15,%rbx
   0x0000001269bfe5ad <+157>:   mov    %eax,%edx
   0x0000001269bfe5af <+159>:   cmp    $0x1,%r12d
   0x0000001269bfe5b3 <+163>:   mov    %ecx,%r12d
   0x0000001269bfe5b6 <+166>:   jg     0x1269bfe560
<ltree_compare_distance+80>
   0x0000001269bfe5b8 <+168>:   mov    -0x30(%rbp),%ecx
   0x0000001269bfe5bb <+171>:   sub    -0x2c(%rbp),%ecx
   0x0000001269bfe5be <+174>:   cvtsi2ss %ecx,%xmm0
   0x0000001269bfe5c2 <+178>:   cvtss2sd %xmm0,%xmm1

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Tender Wang 2026-10-27 03:27:39 Re: BUG #19799: Self-join elimination: "failed to build any 3-way joins" with LATERAL
Previous Message Manu 2026-10-26 23:43:22 Re: BUG #19760: CLUSTER loses a row the transaction inserted and then updated in a rolled-back subtransaction