Re: TRAP: failed Assert("offsets[i] > offsets[i - 1]"), File: "tidstore.c"

From: Andrei Lepikhov <lepihov(at)gmail(dot)com>
To: Masahiko Sawada <sawada(dot)mshk(at)gmail(dot)com>
Cc: PostgreSQL mailing lists <pgsql-bugs(at)lists(dot)postgresql(dot)org>
Subject: Re: TRAP: failed Assert("offsets[i] > offsets[i - 1]"), File: "tidstore.c"
Date: 2026-04-22 17:23:39
Message-ID: 9dece148-3e1d-4b0f-b798-574988fe76fe@gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

On 22/04/2026 18:51, Masahiko Sawada wrote:
> On Fri, Apr 17, 2026 at 2:26 PM Andrei Lepikhov <lepihov(at)gmail(dot)com> wrote:
>>
>> On 16/04/2026 19:58, Masahiko Sawada wrote:
> Understood. After more thoughts, I think your idea would be better.
>
> One thing still unclear to me is in which situation the query inthe
> test produces an array of unsorted offset numbers. While I understand
> it's not guaranteed that the DISTINCT clause returns the sorted
> result, doing DISTINCT in an aggregation function is using sort-based
> deduplication. I'd like to confirm that the queries in the test could
> end up producing the results that violate the assertion. Is it
> possible to do that by changing GUC parameters or something?
No, this is part of ongoing research into Postgres Optimizer vulnerabilities. I
used two tools: pg_pathcheck [1] and pg-chaos-mode [2]. The first tool finds
hidden dangling pointers in pathlists, which we are currently discussing in
another thread. The second is a patch that makes the cost-based decision random
to help uncover hidden or unwritten coding contracts.
Both tools are experimental and not meant for core use; they are only used to
trigger potential issues. In this case, I think the query picked a costly sorted
path, which led to the crash.

[1] https://github.com/danolivo/pg_pathcheck
[2] https://github.com/danolivo/pg-chaos-test

--
regards, Andrei Lepikhov,
pgEdge

In response to

Browse pgsql-bugs by date

  From Date Subject
Next Message Jacob Champion 2026-04-22 18:29:04 Re: PostgreSQL 17: Bug in libpq when libpq is dlopened/closed multiple times
Previous Message Masahiko Sawada 2026-04-22 16:51:18 Re: TRAP: failed Assert("offsets[i] > offsets[i - 1]"), File: "tidstore.c"