Re: BUG #17607: Server process crashes when PLpgSQL function raises error in subtransaction
Tom Lane <tgl@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Alvaro Herrera <alvherre@alvh.no-ip.org>
Cc: thomas.d.mckay@gmail.com, pgsql-bugs@lists.postgresql.org
Date: 2022-09-25T19:01:15Z
Lists: pgsql-bugs
Attachments
- fix-trigger-tupdesc-refcount-issue-2.patch (text/x-diff) patch
I wrote: > It seems to me there are probably other hazards here, because the tupdesc > could possibly also go away before the slot does. I think what we ought > to do is copy the tupdesc, so that we have a non-refcounted descriptor > that we know has exactly the right lifespan. As attached. Actually, after looking around some more, I realize that there is a second mistake in 25936fd46: it ignored the comment on AfterTriggerFreeQuery that * Note: it's important for this to be safe if interrupted by an error * and then called again for the same query level. This is the reason why we end up in a recursive error and PANIC: we keep trying to free the tupdesc again after the previous error. If I fix that but omit the CreateTupleDescCopy step, then the reproducer behaves much more sanely: psql:bug17607.sql:29: WARNING: AbortSubTransaction while in ABORT state psql:bug17607.sql:29: ERROR: BOOM ! CONTEXT: PL/pgSQL function on_tbl_parent_id_change_fn() line 3 at RAISE ERROR: tupdesc reference 0x7fdef236a1b8 is not owned by resource owner SubTransaction ROLLBACK ROLLBACK So what we actually need here is more like the attached. regards, tom lane
Commits
-
Fix tupdesc lifespan bug with AfterTriggersTableData.storeslot.
- c82766c0298a 15.0 landed
- 9923764614a0 14.6 landed
- 8c17c8615470 13.9 landed
- 51976309450c 12.13 landed
- 216f9c1ab3a4 16.0 landed