Assertion failure in _bt_pagedel (leafblkno == scanblkno) after interrupted VACUUM

From: Iliia Khaprov <i(dot)khaprov(at)gmail(dot)com>
To: pgsql-bugs(at)lists(dot)postgresql(dot)org
Subject: Assertion failure in _bt_pagedel (leafblkno == scanblkno) after interrupted VACUUM
Date: 2026-09-28 19:30:46
Message-ID: CAFO+O_p5So4MXwQ1VEcL9+9vGgODu11TTWcYq9RDbxnira8o2w@mail.gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

Hello,

We were doing some fuzzing with an oss-fuzz derivative
(github.com/stroppy-io/pg-fuzz) The usual crashes are ubsan-only
integer shifts. Yesterday it was a new thing - a cassert
in half-dead page processing (originally found on 17.10):

TRAP: failed Assert("leafblkno == scanblkno"), File: "nbtpage.c", Line:
1949

Note, unlike a similar report from 2024 on the same line, this one does
not need any concurrency.

A sweep was done across REL_16 to REL_19 and master heads:
master 5bd2e236e21b nbtpage.c:1959
REL_19_STABLE bb356f869fa5 nbtpage.c:1979
REL_18_STABLE ccffd34399f5 nbtpage.c:1949
REL_17_STABLE 0165f38d11ec nbtpage.c:1949
REL_16_STABLE 6f2f510845c5 nbtpage.c:1954

Stack trace, reproducer SQL and matrix summary attached. Reproduced on
master and REL_19 with the nbtree-leave-page-half-dead injection point.
The reproducer needs VACUUM (INDEX_CLEANUP ON).

I of course LLMed this and have a patch. LMK if it is of any interest.
Hope it was helpful,
Iliia

Attachment Content-Type Size
server-log-trap-excerpt.txt text/plain 2.3 KB
matrix-summary.txt text/plain 588 bytes
halfdead_rightsib.sql application/sql 3.9 KB
halfdead_rightsib_guc.sql application/sql 2.3 KB

Browse pgsql-bugs by date

  From Date Subject
Previous Message Manu 2026-09-28 17:55:21 Re: 42P16 error when dropping and adding column