Re: BUG #19078: Segfaults in tts_minimal_store_tuple() following pg_upgrade

From: Yuri Zamyatin <yuri(at)yrz(dot)am>
To: Jeff Davis <pgsql(at)j-davis(dot)com>, David Rowley <dgrowleyml(at)gmail(dot)com>, Amit Langote <amitlangote09(at)gmail(dot)com>
Cc: pgsql-bugs(at)lists(dot)postgresql(dot)org
Subject: Re: BUG #19078: Segfaults in tts_minimal_store_tuple() following pg_upgrade
Date: 2025-10-17 20:09:00
Message-ID: hduw2vt7l5ojmgcnophhqvffmcz4nqdzjs6hgx3nkggdyvtkyu@6jq72jymcj3a
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

Haven't managed to reproduce it consistently so far.
Perhaps we could use the existing dump to investigate.
I'm unfamiliar with Postgres internals. If it would be useful,
could you walk me through the structures I need to capture?

> (gdb) frame 2
> #2 0x0000555fe8566ec2 in agg_retrieve_hash_table_in_memory (aggstate=aggstate(at)entry=0x55601c7567d0) at ./build/../src/include/executor/executor.h:176
> 176 in ./build/../src/include/executor/executor.h
> (gdb) print *perhash
> $83 = {hashtable = 0x55601c182ac8, hashiter = {cur = 10, end = 43, done = false}, hashslot = 0x55601c765bb0, hashfunctions = 0x55601c765b28,
> eqfuncoids = 0x55601c765b18, numCols = 2, numhashGrpCols = 2, largestGrpColIdx = 4, hashGrpColIdxInput = 0x55601c7659f0, hashGrpColIdxHash = 0x55601c765a00,
> aggnode = 0x55601eba19f8}
> (gdb) print *hashtable->hashtab
> $84 = {size = 16, members = 4, sizemask = 15, grow_threshold = 14, data = 0x55601c182b98, ctx = 0x55601c1819b0, private_data = 0x55601c182ac8}
> (gdb) print *entry
> $86 = {firstTuple = 0x1b, status = 1, hash = 21856}

Does it look suspicious?
perhash->hashiter->end=43, hashtable->hashtab->size=16, 43-16=0x1b

Some more details from that step:

> (gdb) info locals
> hashslot = 0x55601c765bb0
> hashtable = 0x55601c182ac8
> i = <optimized out>
> econtext = 0x55601c756f00
> peragg = 0x55601c765198
> pergroup = <optimized out>
> entry = 0x55601c182e48
> firstSlot = 0x55601c763e48
> result = <optimized out>
> perhash = 0x55601c764e50
> (gdb) print *aggstate
> $87 = {ss = {ps = {type = T_AggState, plan = 0x55601eb9bb18, state = 0x55601b1a60a8, ExecProcNode = 0x555fe8567890 <ExecAgg>,
> ExecProcNodeReal = 0x555fe8567890 <ExecAgg>, instrument = 0x0, worker_instrument = 0x0, worker_jit_instrument = 0x0, qual = 0x0, lefttree = 0x55601c757008,
> righttree = 0x0, initPlan = 0x0, subPlan = 0x0, chgParam = 0x0, ps_ResultTupleDesc = 0x55601c763f50, ps_ResultTupleSlot = 0x55601c764758,
> ps_ExprContext = 0x55601c756f00, ps_ProjInfo = 0x55601c764860, async_capable = false, scandesc = 0x55601c762fa0, scanops = 0x555fe8bd0f20 <TTSOpsVirtual>,
> outerops = 0x555fe8bd0f20 <TTSOpsVirtual>, innerops = 0x0, resultops = 0x555fe8bd0f20 <TTSOpsVirtual>, scanopsfixed = true, outeropsfixed = true,
> inneropsfixed = false, resultopsfixed = true, scanopsset = true, outeropsset = true, inneropsset = false, resultopsset = true}, ss_currentRelation = 0x0,
> ss_currentScanDesc = 0x0, ss_ScanTupleSlot = 0x55601c763e48}, aggs = 0x55601c7628a8, numaggs = 1, numtrans = 1, aggstrategy = AGG_HASHED,
> aggsplit = AGGSPLIT_SIMPLE, phase = 0x55601c764d70, numphases = 1, current_phase = 0, peragg = 0x55601c765198, pertrans = 0x55601c765220,
> hashcontext = 0x55601c756df8, aggcontexts = 0x55601c756bd8, tmpcontext = 0x55601c756be8, curaggcontext = 0x55601c756df8, curperagg = 0x0,
> curpertrans = 0x55601c765220, input_done = false, agg_done = false, projected_set = -1, current_set = 1, grouped_cols = 0x55601c765040,
> all_grouped_cols = 0x55601c7650b8, colnos_needed = 0x55601c7656b0, max_colno_needed = 9, all_cols_needed = true, maxsets = 1, phases = 0x55601c764d70, sort_in = 0x0,
> sort_out = 0x0, sort_slot = 0x0, pergroups = 0x0, grp_firstTuple = 0x0, table_filled = true, num_hashes = 4, hash_metacxt = 0x55601c1819b0,
> hash_tablecxt = 0x55601c1839c0, hash_tapeset = 0x0, hash_spills = 0x0, hash_spill_rslot = 0x55601c765470, hash_spill_wslot = 0x55601c765578, hash_batches = 0x0,
> hash_ever_spilled = false, hash_spill_mode = false, hash_mem_limit = 2147483648, hash_ngroups_limit = 10324440, hash_planned_partitions = 0,
> hashentrysize = 138.26865671641792, hash_mem_peak = 81920, hash_ngroups_current = 67, hash_disk_used = 0, hash_batches_used = 1, perhash = 0x55601c764df8,
> hash_pergroup = 0x55601c765428, all_pergroups = 0x55601c765428, shared_info = 0x0}
> (gdb) print *hashslot
> $88 = {type = T_TupleTableSlot, tts_flags = 24, tts_nvalid = 0, tts_ops = 0x555fe8bd0e20 <TTSOpsMinimalTuple>, tts_tupleDescriptor = 0x55601c765a10,
> tts_values = 0x55601c765c20, tts_isnull = 0x55601c765c30, tts_mcxt = 0x55601b1a5fb0, tts_tid = {ip_blkid = {bi_hi = 65535, bi_lo = 65535}, ip_posid = 0},
> tts_tableOid = 0}
> (gdb) print *hashtable
> $89 = {hashtab = 0x55601c182b50, numCols = 2, keyColIdx = 0x55601c765a00, tab_hash_expr = 0x55601c182eb0, tab_eq_func = 0x55601c1833e8,
> tab_collations = 0x55601eba1b20, tablecxt = 0x55601c1839c0, tempcxt = 0x55601c17b980, additionalsize = 16, tableslot = 0x55601c182da8, inputslot = 0x55601c765bb0,
> in_hash_expr = 0x55601c182eb0, cur_eq_func = 0x55601c1833e8, exprcontext = 0x55601c14b7f8}
> (gdb) print *econtext
> $90 = {type = T_ExprContext, ecxt_scantuple = 0x0, ecxt_innertuple = 0x0, ecxt_outertuple = 0x55601c763e48, ecxt_per_query_memory = 0x55601b1a5fb0,
> ecxt_per_tuple_memory = 0x55601c1859d0, ecxt_param_exec_vals = 0x55601b42bcf0, ecxt_param_list_info = 0x55601b0f7a78, ecxt_aggvalues = 0x55601c762e88,
> ecxt_aggnulls = 0x55601c765188, caseValue_datum = 0, caseValue_isNull = true, domainValue_datum = 0, domainValue_isNull = true, ecxt_oldtuple = 0x0,
> ecxt_newtuple = 0x0, ecxt_estate = 0x55601b1a60a8, ecxt_callbacks = 0x0}
> (gdb) print *peragg
> $91 = {aggref = 0x55601eb9c170, transno = 0, finalfn_oid = 0, finalfn = {fn_addr = 0x0, fn_oid = 0, fn_nargs = 0, fn_strict = false, fn_retset = false,
> fn_stats = 0 '\000', fn_extra = 0x0, fn_mcxt = 0x0, fn_expr = 0x0}, numFinalArgs = 1, aggdirectargs = 0x0, resulttypeLen = 4, resulttypeByVal = true,
> shareable = false}
> (gdb) print *firstSlot
> $92 = {type = T_TupleTableSlot, tts_flags = 16, tts_nvalid = 9, tts_ops = 0x555fe8bd0f20 <TTSOpsVirtual>, tts_tupleDescriptor = 0x55601c762fa0,
> tts_values = 0x55601c763e90, tts_isnull = 0x55601c763ed8, tts_mcxt = 0x55601b1a5fb0, tts_tid = {ip_blkid = {bi_hi = 65535, bi_lo = 65535}, ip_posid = 0},
> tts_tableOid = 0}

In response to

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Álvaro Herrera 2025-10-17 20:50:30 Re: BUG #19074: pg_dump from v18 loses the NOT NULL flag in the inherited table field when dumping v17-databases
Previous Message Casey Shobe 2025-10-17 15:42:12 Issues with blocksize smaller than 8KB