From d4c339924cf7d258c569d48381aa3c90ee5d8695 Mon Sep 17 00:00:00 2001 From: Andres Freund Date: Mon, 20 Jan 2020 23:26:51 -0800 Subject: [PATCH] Fix edge case leading to agg transitions skipping ExecAggTransReparent() calls. The code checking whether an aggregate transition value needs to be reparented into the current context has always only compared the transition return value with the previous transition value by datum, i.e. without regard for NULLness. This normally works, because when the transition function returns NULL (via fcinfo->isnull), it'll return a value that won't be the same as its input value. But there's no hard requirement that that's the case. And it turns out, it's possible to hit this case (see discussion or reproducers), leading to a non-null transition value not being reparented, followed by a crash caused by that. Instead of adding another comparison of NULLness, instead have ExecAggTransReparent() ensure that pergroup->transValue ends up as 0 when the new transition value is NULL. That avoids having to add an additional branch to the much more common cases of the transition function returning the old transition value (which is a pointer in this case), and when the new value is different, but not NULL. In branches since 69c3936a149, also deduplicate the reparenting code between the expression evaluation based transitions, and the path for ordered aggregates. Reported-By: Teodor Sigaev, Nikita Glukhov Author: Andres Freund Discussion: https://postgr.es/m/bd34e930-cfec-ea9b-3827-a8bc50891393@sigaev.ru Backpatch: 9.4-, this issue has existed since at least 7.4 --- src/backend/executor/nodeAgg.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/src/backend/executor/nodeAgg.c b/src/backend/executor/nodeAgg.c index a49af6bf691..5c20b8a45ab 100644 --- a/src/backend/executor/nodeAgg.c +++ b/src/backend/executor/nodeAgg.c @@ -812,6 +812,15 @@ advance_transition_function(AggState *aggstate, * first input, we don't need to do anything. Also, if transfn returned a * pointer to a R/W expanded object that is already a child of the * aggcontext, assume we can adopt that value without copying it. + * + * It's safe to compare newVal with pergroupstate->transValue without + * regard for either being NULL, because we below take care to set + * transValue to 0 when NULL. Otherwise we could end up accidentally not + * reparenting, when the transValue has the same numerical value as + * newVal, despite being NULL. This is a somewhat hot path, making it + * undesirable to instead solve this with another branch for the common + * case of the transition function returning its (modified) input + * argument. */ if (!pertrans->transtypeByVal && DatumGetPointer(newVal) != DatumGetPointer(pergroupstate->transValue)) @@ -829,6 +838,16 @@ advance_transition_function(AggState *aggstate, pertrans->transtypeByVal, pertrans->transtypeLen); } + else + { + /* + * Ensure that pergroupstate->transValue ends up being 0, so we + * can safely compare newVal/transValue without having to check + * their respective nullness. + */ + newVal = (Datum) 0; + } + if (!pergroupstate->transValueIsNull) { if (DatumIsReadWriteExpandedObject(pergroupstate->transValue,