Re: BUG #19828: "plan should not reference subplan's variable" with Memoize since f8da64e6

Hi,

Attached is a patch. pull_exec_params_walker() now walks only the args of a
SubPlan, which are evaluated in the memoized relation's context, and not its
testexpr, whose Params are set by the subplan itself. With the patch the
reproducer returns 400, and Memoize is still used (cache key a.x, with the
SubPlan as a filter on the inner scan).

The patch adds a regression test to memoize.sql (nested loop with Memoize
over tenk1 and 5 > ALL (SELECT t2.unique1)). make check passes (239/239).

Richard, Cc'ing you as the author of f8da64e6.

Regards,
Venu Kummari

On Mon, Nov 2, 2026 at 9:37 PM PG Bug reporting form
<noreply(at)postgresql(dot)org> wrote:
>
> The following bug has been logged on the website:
>
> Bug reference: 19828
> Logged by: Venu Kummari
> Email address: venu2805k(at)gmail(dot)com
> PostgreSQL version: 19rc1
> Operating system: Ubuntu 24.04, x86_64
> Description:
>
> PostgreSQL version: master (20devel) 633dee1b, built from source with
> assertions. Operating system: Ubuntu 24.04, x86_64.
>
> Since commit f8da64e6 ("Make cache keys of other Params a Memoize subplan
> depends on"), a correlated ALL/ANY sublink in the quals of a memoized
> relation makes planning fail, with default settings:
>
> CREATE TABLE d_a (x int NOT NULL);
> CREATE TABLE d_b (x int, pad text);
> INSERT INTO d_a SELECT g % 10 FROM generate_series(1, 1000) g;
> INSERT INTO d_b SELECT g, repeat('x', 100) FROM generate_series(1, 100000)
> g;
> CREATE INDEX ON d_b (x);
> VACUUM ANALYZE d_a, d_b;
>
> SELECT count(*) FROM d_a a JOIN d_b b ON a.x = b.x WHERE 5 > ALL (SELECT
> b.x);
> ERROR: plan should not reference subplan's variable
>
> Expected: 400 (the result with enable_memoize = off, on 126976a8, and with
> f8da64e6 reverted).
>
> Cause: paraminfo_get_equal_hashops() now collects every PARAM_EXEC Param in
> the inner relation's base quals and targetlist with
> pull_exec_params_walker() and makes it a cache key. The walker descends into
> SubPlans, so the Param in the SubPlan's testexpr (5 > $n), which stands for
> the subplan's own output and is set by the subplan itself, also becomes a
> cache key. The Memoize node then references a Param that only its child
> sets, and finalize_plan() raises the error.
>
> I will reply with a patch that, for a SubPlan, walks only its args (which
> are evaluated in the memoized relation's context), with a regression test
> in memoize.sql; make check passes.
>
> Found with a grammar-based fuzzer for PostgreSQL.
>
>