Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 79c89f1

Browse files
committed
Fix crasher bug in array_position(s)
array_position and its cousin array_positions were caching the element type equality function's FmgrInfo without being careful enough to put it in a long-lived context. This is obviously broken but it didn't matter in most cases; only when using arrays of records (involving record_eq) it becomes a problem. The fix is to ensure that the type's equality function's FmgrInfo is cached in the array_position's flinfo->fn_mcxt rather than the current memory context. Apart from record types, the only other case that seems complex enough to possibly cause the same problem are range types. I didn't find a way to reproduce the problem with those, so I only include the test case submitted with the bug report as regression test. Bug report and patch: Junseok Yang Discussion: https://postgr.es/m/CAE+byMupUURYiZ6bKYgMZb9pgV1CYAijJGqWj-90W=nS7uEOeA@mail.gmail.com Backpatch to 9.5, where array_position appeared.
1 parent 86c6aaf commit 79c89f1

File tree

3 files changed

+27
-2
lines changed

3 files changed

+27
-2
lines changed

src/backend/utils/adt/array_userfuncs.c

+4-2
Original file line numberDiff line numberDiff line change
@@ -795,7 +795,8 @@ array_position_common(FunctionCallInfo fcinfo)
795795
format_type_be(element_type))));
796796

797797
my_extra->element_type = element_type;
798-
fmgr_info(typentry->eq_opr_finfo.fn_oid, &my_extra->proc);
798+
fmgr_info_cxt(typentry->eq_opr_finfo.fn_oid, &my_extra->proc,
799+
fcinfo->flinfo->fn_mcxt);
799800
}
800801

801802
/* Examine each array element until we find a match. */
@@ -933,7 +934,8 @@ array_positions(PG_FUNCTION_ARGS)
933934
format_type_be(element_type))));
934935

935936
my_extra->element_type = element_type;
936-
fmgr_info(typentry->eq_opr_finfo.fn_oid, &my_extra->proc);
937+
fmgr_info_cxt(typentry->eq_opr_finfo.fn_oid, &my_extra->proc,
938+
fcinfo->flinfo->fn_mcxt);
937939
}
938940

939941
/*

src/test/regress/expected/arrays.out

+14
Original file line numberDiff line numberDiff line change
@@ -589,6 +589,20 @@ SELECT array_positions('[2:4]={1,2,3}'::int[], 1);
589589
{2}
590590
(1 row)
591591

592+
SELECT
593+
array_position(ids, (1, 1)),
594+
array_positions(ids, (1, 1))
595+
FROM
596+
(VALUES
597+
(ARRAY[(0, 0), (1, 1)]),
598+
(ARRAY[(1, 1)])
599+
) AS f (ids);
600+
array_position | array_positions
601+
----------------+-----------------
602+
2 | {2}
603+
1 | {1}
604+
(2 rows)
605+
592606
-- operators
593607
SELECT a FROM arrtest WHERE b = ARRAY[[[113,142],[1,147]]];
594608
a

src/test/regress/sql/arrays.sql

+9
Original file line numberDiff line numberDiff line change
@@ -262,6 +262,15 @@ $$ LANGUAGE plpgsql;
262262
SELECT array_position('[2:4]={1,2,3}'::int[], 1);
263263
SELECT array_positions('[2:4]={1,2,3}'::int[], 1);
264264

265+
SELECT
266+
array_position(ids, (1, 1)),
267+
array_positions(ids, (1, 1))
268+
FROM
269+
(VALUES
270+
(ARRAY[(0, 0), (1, 1)]),
271+
(ARRAY[(1, 1)])
272+
) AS f (ids);
273+
265274
-- operators
266275
SELECT a FROM arrtest WHERE b = ARRAY[[[113,142],[1,147]]];
267276
SELECT NOT ARRAY[1.1,1.2,1.3] = ARRAY[1.1,1.2,1.3] AS "FALSE";

0 commit comments

Comments
 (0)