Re: BUG #3860: xpath crashes backend when is querying xmlagg result

Alvaro Herrera <alvherre(at)commandprompt(dot)com> writes:
> Hmm, what I'm seeing is that libxml is apparently trying to pfree
> something that it didn't allocate via palloc ...

Not totally surprising --- when we call xmlMemSetup() we are telling
libxml to start using xml_palloc etc rather than its default of malloc
etc. We had some bugs earlier involving not calling xmlMemSetup soon
enough during some seqauence of operations; this may be another.

Another likely theory is that libxml is trying to pfree something that
had been palloc'd in a previous cycle of function calls, and then went
away in a memory context reset. We try to shut the library down
completely at exit from xml.c functions, so that it doesn't think it has
any open allocated memory, buut there may be something we've missed
doing. See the note at lines 27ff of xml.c.

If nothing else comes to mind, try instrumenting xml_palloc and friends
to print a trace of what they're doing, and match up the calls ...

regards, tom lane