Re: BUG #18868: /src/backend/optimizer/path/joinrels.c list_head can be NULL

On Wed, Mar 26, 2025, at 7:16 AM, PG Bug reporting form wrote:
> Pointers, returned from function 'list_head' at joinrels.c:1527 and 1528,
> may be NULL and is dereferenced at joinrels.c:1550 and 1551.

joinrels.c:

    compute_partition_bounds(root, rel1, rel2, joinrel, parent_sjinfo,
                             &parts1, &parts2);

    if (joinrel->partbounds_merged)
    {    
        lcr1 = list_head(parts1);
        lcr2 = list_head(parts2);
    }    

Did you read compute_partition_bounds()?

        if (joinrel->partbounds_merged)
        {
            get_matching_part_pairs(root, joinrel, rel1, rel2,
                                    parts1, parts2);
            Assert(list_length(*parts1) == joinrel->nparts);
            Assert(list_length(*parts2) == joinrel->nparts);
        }

parts1 and parts2 uses the same condition. I expect that if there is any bug
related to pointer deference, the assert(s) should report. Do you have a test
case that exposes this issue?


--
Euler Taveira
EDB   https://www.enterprisedb.com/