Re: BUG #19763: ManualBug2 NULL pointer dereference in make_build_data via examine_expression bypass of lookup_var_a

From: Tomas Vondra <tomas(at)vondra(dot)me>
To: 1217816127(at)qq(dot)com, pgsql-bugs(at)lists(dot)postgresql(dot)org, PG Bug reporting form <noreply(at)postgresql(dot)org>
Subject: Re: BUG #19763: ManualBug2 NULL pointer dereference in make_build_data via examine_expression bypass of lookup_var_a
Date: 2026-10-15 19:50:30
Message-ID: 4a008244-3d3f-4563-8caf-0976fc59816f@vondra.me
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

On 10/15/26 20:52, Tomas Vondra wrote:
> ...
>
> I tried reproducing it using the provided information, without much
> success. Attached is the test_custom_types patch with the typanalyze
> function I used, but it always ends for me with
>
> WARNING: statistics object "public.st1" could not be computed for
> relation "public.t1"
>
> Please, provide a working reproducer, or clarify the instructions
>

After a bit more poking, I managed to make it crash. Attached are the
two pieces - patch for test_custom_types, and the SQL reproducer.

I haven't thought about how to fix it yet - it seems very unlikely a
typanalyze function would behave like this, but we should be more careful.

regards

--
Tomas Vondra

Attachment Content-Type Size
test_custom_types-repro.patch text/x-patch 2.0 KB
repro.sql application/sql 418 bytes

In response to

Browse pgsql-bugs by date

  From Date Subject
Previous Message Tomas Vondra 2026-10-15 19:36:24 Re: BUG #19764: ManualBug3 Assert failure in pgstat_setup_shared_refs crashes initdb post-bootstrap subprocess