Re: Unexpected behavior after OOM errors

Hello Michael, Matthias, and Alexander,

The assertion in issue #3 (ent->entry_ref != NULL, pgstat_shmem.c) also has
a separate trigger I'd like to report — a different code path that poisons
the same hash in pgstat_get_entry_ref_cached().
pgstat_get_entry_ref_cached() inserts a zero-filled hash slot — entry_ref
== NULL — before allocating memory for it. If MemoryContextAlloc() fails
with OOM it longjmps out, leaving the NULL slot permanently poisoned in
pgStatEntryRefHash. The hash is backend-local and cross-transaction, so
abort does not clean it up.

Crash vectors:
- Debug builds: backend exit hits Assert(ent->entry_ref != NULL) in
pgstat_release_matching_entry_refs()
- Release builds: any GC pass (DROP TABLE etc.) causes
pgstat_gc_entry_refs() to unconditionally dereference the NULL → SIGSEGV

This is the backend-local sibling of the shared/DSA-path issue fixed in
8191e0c16a. Present since 5891c7a8ed8 (2022); affects PG15, PG17, PG18, and
master.

The bug can be reproduced without your OOM injection patch using the
built-in injection points infrastructure (--enable-injection-points
--enable-cassert). Apply this one-liner to pgstat_get_entry_ref_cached():

--- a/src/backend/utils/activity/pgstat_shmem.c
+++ b/src/backend/utils/activity/pgstat_shmem.c
@@ -14,6 +14,7 @@

#include "pgstat.h"
#include "storage/shmem.h"
+#include "utils/injection_point.h"
#include "utils/memutils.h"
#include "utils/pgstat_internal.h"

@@ -387,6 +388,9 @@
if (!found || !cache_entry->entry_ref)
{
PgStat_EntryRef *entry_ref;
+
+ /* slot exists, entry_ref == NULL -- same window a real OOM
longjmps from */
+ INJECTION_POINT("pgstat-entry-ref-oom");

cache_entry->entry_ref = entry_ref =
MemoryContextAlloc(pgStatSharedRefContext,

Then:

CREATE EXTENSION injection_points;
CREATE TABLE t (id int PRIMARY KEY, v int);
INSERT INTO t VALUES (1, 0);
SELECT injection_points_attach('pgstat-entry-ref-oom', 'error');
UPDATE t SET v = v + 1 WHERE id = 1;
SELECT injection_points_detach('pgstat-entry-ref-oom');
-- disconnect; backend exit crashes

The UPDATE fails as expected:
ERROR: error triggered for injection point pgstat-entry-ref-oom

But on session exit, the backend crashes:
TRAP: failed Assert("ent->entry_ref != NULL"), File: "pgstat_shmem.c",
Line: 781
server process (PID ...) was terminated by signal 6: Abort trap

Alexey