From 40a5d3ae0b3f76ffb2ad73100d83d4efb2a3fcc6 Mon Sep 17 00:00:00 2001 From: Henson Choi Date: Fri, 20 Mar 2026 14:14:17 +0900 Subject: [PATCH] Fix row_is_in_reduced_frame argument and add bounds check in WINDOW_SEEK_TAIL In WinGetSlotInFrame, the WINDOW_SEEK_TAIL case passed frameheadpos+relpos to row_is_in_reduced_frame to determine the reduced frame size. Since relpos is non-positive, this queries a position at or before the frame head. When relpos is negative the queried position falls outside the frame entirely, which is invalid and could trigger internal Assert failures. The correct argument is frameheadpos: the reduced frame always starts there, and its size N gives the tail position as frameheadpos+N-1. Pass frameheadpos directly instead. Also add a bounds check (-relpos >= N -> out_of_frame) to handle future callers that may pass negative relpos values. Currently only last_value() calls this path with relpos=0, so the check has no effect at present. --- src/backend/executor/nodeWindowAgg.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/backend/executor/nodeWindowAgg.c b/src/backend/executor/nodeWindowAgg.c index d3ce9897a4f..c92235c54c7 100644 --- a/src/backend/executor/nodeWindowAgg.c +++ b/src/backend/executor/nodeWindowAgg.c @@ -4906,12 +4906,16 @@ WinGetSlotInFrame(WindowObject winobj, TupleTableSlot *slot, } num_reduced_frame = row_is_in_reduced_frame(winobj, - winstate->frameheadpos + relpos); + winstate->frameheadpos); if (num_reduced_frame < 0) goto out_of_frame; else if (num_reduced_frame > 0) + { + if (-relpos >= num_reduced_frame) + goto out_of_frame; abs_pos = winstate->frameheadpos + relpos + num_reduced_frame - 1; + } break; default: elog(ERROR, "unrecognized window seek type: %d", seektype); -- 2.50.1 (Apple Git-155)