The following bug has been logged on the website:
Bug reference: 19609
Logged by: Artem Zarubin
Email address: a.prototype7@gmail.com
PostgreSQL version: 19beta2
Operating system: Ubuntu 24.04.4 LTS (s390x)
Description:
Hello, I found a reproducible server crash when an SQL-language function is
executed with LLVM JIT enabled on s390x.
Tested commit:
bad: 0392fb900eb89f52988cccd33046443c39c70d1c, PostgreSQL 19devel
The server was built with:
./configure \
--prefix=/home/test/pginstall-vanilla18 \
--enable-debug \
--enable-cassert \
--with-llvm \
LLVM_CONFIG=/usr/bin/llvm-config-18 \
CLANG=/usr/bin/clang-18
Environment:
Architecture: s390x
OS: Ubuntu 24.04.4 LTS
Kernel: Linux 6.8.0-136-generic
GCC: 13.3.0
LLVM: 18.1.3
The following parameters are used by the attached TAP test:
restart_after_crash = on
jit = on
Minimal SQL script to reproduce:
CREATE FUNCTION type_text(oid) RETURNS text
LANGUAGE sql STABLE
AS $$
SELECT typname::text
FROM pg_catalog.pg_type
WHERE oid = $1
$$;
SET jit = on;
SET jit_above_cost = 0;
SET jit_inline_above_cost = -1;
SET jit_optimize_above_cost = -1;
SET jit_expressions = on;
SET jit_tuple_deforming = off;
SELECT count(*)
FROM (
SELECT oid
FROM pg_catalog.pg_type
ORDER BY oid
LIMIT 7
) AS t
WHERE type_text(t.oid) = 'int2vector';
Expected result:
count
-------
1
(1 row)
Actual result:
server closed the connection unexpectedly
This probably means the server terminated abnormally before or while
processing the request.
connection to server was lost
The server log contains:
LOG: client backend (PID ...) was terminated by signal 11: Segmentation
fault
DETAIL: Failed process was running: SELECT count(*) ...
Complete backtrace available from the core dump produced by the minimal
reproducer:
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x000002aa3d0f29bc in cstring_to_text (s=0x0) at varlena.c:186
#1 name_text (fcinfo=<optimized out>) at varlena.c:2709
#2 0x000003ff9ae36126 in ?? ()
Backtrace stopped: frame did not save the PC
si_signo = 11 (SIGSEGV)
si_code = 1 (SEGV_MAPERR)
si_addr = 0x0
r1 = 0x0
r11 = 0x0
pc = 0x2aa3d0f29bc <name_text+60>
The frame above name_text() contains JIT-generated code without unwind
information. name_text() receives a NULL C-string pointer and crashes in
cstring_to_text().
With jit=off, the same query completes successfully and returns 1. LLVM
inlining and PostgreSQL's expensive-query JIT optimization tier are not
required: the crash is also reproduced with jit_inline_above_cost and
jit_optimize_above_cost set to -1.
The attached patch adds the reproducer as
src/test/modules/test_misc/t/014_jit_s390x.pl. From the PostgreSQL source
tree, I ran it against the installed build with:
PG_INSTALL=/home/test/pginstall-vanilla18
PATH="$PG_INSTALL/bin:$PATH" \
PERL5LIB="$PWD/src/test/perl" \
PG_REGRESS="$PWD/src/test/regress/pg_regress" \
prove -v src/test/modules/test_misc/t/014_jit_s390x.pl
The TAP test fails as follows because the backend crashes:
not ok 1 - JIT-compiled SQL function expression does not crash the backend
got: '2'
expected: '0'
not ok 2 - JIT-compiled SQL function expression returns expected row
got: ''
expected: '1'
The crash reproduced on every run of the final minimal test on this machine,
including runs against newly initialized test clusters.
---
Best regards,
Artem Zarubin
Postgres Professional: https://postgrespro.com/
