Horton

Re: PostgreSQL crashes with SIGSEGV

Peter Geoghegan <pg@bowt.ie>

View thread View on postgr.es
From: Peter Geoghegan <pg@bowt.ie>
To: Andreas Seltenreich <andreas.seltenreich@credativ.de>
Cc: Michael Paquier <michael.paquier@gmail.com>, Bernd Helmle <mailings@oopsware.de>, PostgreSQL mailing lists <pgsql-bugs@postgresql.org>
Date: 2017-12-14T20:06:26Z
Lists: pgsql-bugs, pgsql-hackers 
On Thu, Dec 14, 2017 at 10:47 AM, Andreas Seltenreich
<andreas.seltenreich@credativ.de> wrote:
> We did some more reducing work on the original query and data.  The
> following testcase reproduces the double free reported by valgrind for
> me when run against a vanilla REL9_6_STABLE build.

> --8<---------------cut here---------------start------------->8---
> drop table if exists bug;
> create table bug (n text, v text, b text, t text);
> insert into bug
>    select i%9, i%9, i%16 ,i%4096 from generate_series(1,100000) g(i);
> analyze bug;
>
> explain select * from (
> select thecube.nv
>    from ( select
>             (n || ' ') || coalesce(v, '') as nv
>            from bug
>            group by ((n || ' ') || coalesce(v, '')) ,cube(b, t)
>           ) thecube
>          where nv = '8 8'
> ) sub limit 7000;
> --8<---------------cut here---------------end--------------->8---

I can reproduce this against REL9_6_STABLE, once work_mem is set to
4MB, and replacement_sort_tuples is set to 150000.

-- 
Peter Geoghegan

Commits

  1. Fix actual and potential double-frees around tuplesort usage.

  2. Allow the built-in ordered-set aggregates to share transition state.

  3. Avoid integer overflow while sifting-up a heap in tuplesort.c.

  4. Allow avoiding tuple copy within tuplesort_gettupleslot().

  5. Remove should_free arguments to tuplesort routines.

  6. Fix use-after-free around DISTINCT transition function calls.

  7. Reuse abbreviated keys in ordered [set] aggregates.