From b62cd1e360f4774abebef32eac0bef8381381837 Mon Sep 17 00:00:00 2001
From: Matt Blewitt <mble@planetscale.com>
Date: Thu, 30 Jul 2026 15:40:59 +0100
Subject: [PATCH v3] Fix JSON_SERIALIZE() coercion placeholder type for jsonb
 input

When JSON_SERIALIZE() receives a jsonb-typed argument, the CaseTestExpr
placeholder used to set up coercion was unconditionally assigned JSONOID
(derived from the RETURNING format, which defaults to JS_FORMAT_JSON).
However, the executor passes the input argument value through directly
for JSON_SERIALIZE (see ExecInitExprRec in execExpr.c), so the actual
datum at runtime is jsonb, not json.  This type mismatch between the
placeholder and the runtime value caused the wrong coercion path to be
selected.

Fix by deriving the placeholder type from the actual argument type via
exprType(linitial(args)) when the constructor type is
JSCTOR_JSON_SERIALIZE, rather than from returning->format->format_type.

Add an Assert to guard the assumption that args contains exactly one
item, and update the block comment to explain why JSON_SERIALIZE differs
from the other constructor types (it consumes json/jsonb rather than
producing it).

Add regression coverage for the default text result and an explicit
bytea result with jsonb input, as well as implicit typmod coercion.
---
 src/backend/parser/parse_expr.c       | 18 +++++++++++++++---
 src/test/regress/expected/sqljson.out | 16 ++++++++++++++++
 src/test/regress/sql/sqljson.sql      |  7 +++++++
 3 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/src/backend/parser/parse_expr.c b/src/backend/parser/parse_expr.c
index 30c889f505f..0105bbb0326 100644
--- a/src/backend/parser/parse_expr.c
+++ b/src/backend/parser/parse_expr.c
@@ -3719,7 +3719,13 @@ makeJsonConstructorExpr(ParseState *pstate, JsonConstructorType type,
 	 * Coerce to the RETURNING type and format, if needed.  We abuse
 	 * CaseTestExpr here as placeholder to pass the result of either
 	 * evaluating 'fexpr' or whatever is produced by ExecEvalJsonConstructor()
-	 * that is of type JSON or JSONB to the coercion function.
+	 * to the coercion function.
+	 *
+	 * For most constructor types the placeholder type is JSON or JSONB,
+	 * determined by the RETURNING format.  JSON_SERIALIZE is different: it
+	 * doesn't produce json/jsonb but rather consumes it, and the executor
+	 * passes the input argument through directly (see execExpr.c), so the
+	 * placeholder must reflect the actual argument type.
 	 */
 	if (fexpr)
 	{
@@ -3735,8 +3741,14 @@ makeJsonConstructorExpr(ParseState *pstate, JsonConstructorType type,
 	{
 		CaseTestExpr *cte = makeNode(CaseTestExpr);
 
-		cte->typeId = returning->format->format_type == JS_FORMAT_JSONB ?
-			JSONBOID : JSONOID;
+		if (type == JSCTOR_JSON_SERIALIZE)
+		{
+			Assert(list_length(args) == 1);
+			cte->typeId = exprType((Node *) linitial(args));
+		}
+		else
+			cte->typeId = returning->format->format_type == JS_FORMAT_JSONB ?
+				JSONBOID : JSONOID;
 		cte->typeMod = -1;
 		cte->collation = InvalidOid;
 
diff --git a/src/test/regress/expected/sqljson.out b/src/test/regress/expected/sqljson.out
index d72278d67ca..0baccec2749 100644
--- a/src/test/regress/expected/sqljson.out
+++ b/src/test/regress/expected/sqljson.out
@@ -288,6 +288,22 @@ EXPLAIN (VERBOSE, COSTS OFF) SELECT JSON_SERIALIZE('{}' RETURNING bytea);
    Output: JSON_SERIALIZE('{}'::json RETURNING bytea)
 (2 rows)
 
+-- JSON_SERIALIZE() with jsonb input
+SELECT JSON_SERIALIZE('{"a": 1}'::jsonb);
+ json_serialize 
+----------------
+ {"a": 1}
+(1 row)
+
+SELECT JSON_SERIALIZE('{"a": 1}'::jsonb RETURNING bytea);
+   json_serialize   
+--------------------
+ \x7b2261223a20317d
+(1 row)
+
+-- Test implicit typmod coercion with jsonb input
+SELECT JSON_SERIALIZE('{ "a" : 1 } '::jsonb RETURNING varchar(2));
+ERROR:  value too long for type character varying(2)
 -- JSON_OBJECT()
 SELECT JSON_OBJECT();
  json_object 
diff --git a/src/test/regress/sql/sqljson.sql b/src/test/regress/sql/sqljson.sql
index 96217a55935..17313e0feb8 100644
--- a/src/test/regress/sql/sqljson.sql
+++ b/src/test/regress/sql/sqljson.sql
@@ -62,6 +62,13 @@ SELECT JSON_SERIALIZE('{ "a" : 1 } ' RETURNING jsonb);
 EXPLAIN (VERBOSE, COSTS OFF) SELECT JSON_SERIALIZE('{}');
 EXPLAIN (VERBOSE, COSTS OFF) SELECT JSON_SERIALIZE('{}' RETURNING bytea);
 
+-- JSON_SERIALIZE() with jsonb input
+SELECT JSON_SERIALIZE('{"a": 1}'::jsonb);
+SELECT JSON_SERIALIZE('{"a": 1}'::jsonb RETURNING bytea);
+
+-- Test implicit typmod coercion with jsonb input
+SELECT JSON_SERIALIZE('{ "a" : 1 } '::jsonb RETURNING varchar(2));
+
 -- JSON_OBJECT()
 SELECT JSON_OBJECT();
 SELECT JSON_OBJECT(RETURNING json);
-- 
2.55.0