nocfbot-0005-Fix-row_is_in_reduced_frame-SEEK_TAIL.txt

From 40a5d3ae0b3f76ffb2ad73100d83d4efb2a3fcc6 Mon Sep 17 00:00:00 2001
From: Henson Choi <assam258@gmail.com>
Date: Fri, 20 Mar 2026 14:14:17 +0900
Subject: [PATCH] Fix row_is_in_reduced_frame argument and add bounds check in
 WINDOW_SEEK_TAIL

In WinGetSlotInFrame, the WINDOW_SEEK_TAIL case passed frameheadpos+relpos
to row_is_in_reduced_frame to determine the reduced frame size. Since relpos
is non-positive, this queries a position at or before the frame head. When
relpos is negative the queried position falls outside the frame entirely,
which is invalid and could trigger internal Assert failures.

The correct argument is frameheadpos: the reduced frame always starts there,
and its size N gives the tail position as frameheadpos+N-1. Pass frameheadpos
directly instead.

Also add a bounds check (-relpos >= N -> out_of_frame) to handle future
callers that may pass negative relpos values. Currently only last_value()
calls this path with relpos=0, so the check has no effect at present.
---
 src/backend/executor/nodeWindowAgg.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/backend/executor/nodeWindowAgg.c b/src/backend/executor/nodeWindowAgg.c
index d3ce9897a4f..c92235c54c7 100644
--- a/src/backend/executor/nodeWindowAgg.c
+++ b/src/backend/executor/nodeWindowAgg.c
@@ -4906,12 +4906,16 @@ WinGetSlotInFrame(WindowObject winobj, TupleTableSlot *slot,
 			}
 
 			num_reduced_frame = row_is_in_reduced_frame(winobj,
-														winstate->frameheadpos + relpos);
+														winstate->frameheadpos);
 			if (num_reduced_frame < 0)
 				goto out_of_frame;
 			else if (num_reduced_frame > 0)
+			{
+				if (-relpos >= num_reduced_frame)
+					goto out_of_frame;
 				abs_pos = winstate->frameheadpos + relpos +
 					num_reduced_frame - 1;
+			}
 			break;
 		default:
 			elog(ERROR, "unrecognized window seek type: %d", seektype);
-- 
2.50.1 (Apple Git-155)