BUG #19849: queries fail after ANALYZE with expression stats on arrays

The following bug has been logged on the website:

Bug reference: 19849
Logged by: Atish Prakash
Email address: 125atishprak(at)gmail(dot)com
PostgreSQL version: 18.6
Operating system: Linux x86_64
Description:

With extended statistics on an array or tsvector expression, once ANALYZE
finds no
elements common enough to store, queries that use the statistics fail at
planning
time with an internal error. Elements that are all distinct are enough to
trigger
this, as is a column of empty arrays.

CREATE TABLE tags(id int, a int[]);
INSERT INTO tags
SELECT i, ARRAY[i, i + 1000000] FROM generate_series(1, 50000) i;
CREATE STATISTICS s_a ON (a || a) FROM tags;
ANALYZE tags;

SELECT count(*) FROM tags WHERE (a || a) @> '{5}';

Actual, on 19rc1 and master:

ERROR: unexpected null value in cached tuple for catalog pg_statistic
column stavalues3

Expected, as on 18.6: the query runs and returns 1.

Also failing the same way:
- (t || t) on text[], with @>
- (v || v) on tsvector, with @@ (the message names stavalues1)
- the array operators && and <@, and = ANY

A range expression with no non-empty values also stores a NULL stavalues,
but the
query I tried, (a * a) && '[1,2)', did not fail.

A plain column with the same data, and an expression index with the same
data, do
not fail.

Cause: commit 261f89a976 ("Track the maximum possible frequency of non-MCE
array
elements") stores a statistics slot even when there are no values. It
changed the
test in update_attstats() from numvalues > 0 to stavalues != NULL, but
serialize_expr_stats() in extended_stats.c still tests numvalues[k] > 0, so
the slot
kind and numbers are stored with a NULL stavalues. get_attstatsslot() then
fails in
SysCacheGetAttrNotNull(). I identified the commit from the code and the
commit
message, and did not bisect.

A possible patch is attached
(0001-fix-expression-stats-empty-stavalues.patch). It
changes that test to match update_attstats(). With it, the queries above
return
correct results on master, and all 239 core regression tests pass. It adds
no new
test.

Found with statistics round-trip tests. I reproduced and checked the result
myself.