BUG #3860: xpath crashes backend when is querying xmlagg result - Mailing list pgsql-bugs

The following bug has been logged online:

Bug reference:      3860
Logged by:          Sokolov Yura
Email address:      funny.falcon@gmail.com
PostgreSQL version: 8.3beta4
Operating system:   Debian Linux 4.0r2 both 32bit and amd64
Description:        xpath crashes backend when is querying xmlagg result
Details:

xpath() crashes backend when is querying particular xmlagg results.

Behavior is unstable, but it is reproduced with command line:

psql < bg***.sql

and initially observed with pgadmin3 1.8

-------- bg1.sql---------------
-- crashed, when queries xmlelement with containment given by xmlagg
-- and type of aggregated elements is different
select xpath('any_non_empty_expression', xmlelement(name a, xmlagg(el) )) as
el
from ( values
    ( xmlelement(name b, 0) ),  -- integer
    ( xmlelement(name c, 0.1) ) -- numeric, string crashe backend
                                -- on 32bit Debian float4 and float8 does
not
                                -- on 64 bit Debian float4 does but float8
not
    -- order is irrelevant
) as t(el);
-----end bg1.sql --------------

-------- bg2.sql---------------
-- crashed, when queries xml given by xmlagg
-- and types of elements text() is different
select xpath('any_non_empty_expression', xmlagg(el) ) as el
from ( values
    ( xmlelement(name b, 0) ),
    ( xmlelement(name c, 0.1) )
) as t(el);
-----end bg2.sql --------------

-------- bg3.sql---------------
-- this crashes 64bit machine
select xpath('/a/c', xmlagg(el)) as el
from ( values
   ( xmlelement(name b, 0) ),
   ( xmlelement(name c, 0.1::float4) )
) as t(el);
-----end bg3.sql --------------

-------- bg-not31.sql ----------
-- but this works on 64bit machine
select xpath('/b', xmlagg(el)) as el
from ( values
   ( xmlelement(name b, 0) ),
   ( xmlelement(name c, 0.1::float8) )
) as t(el);
-----end bg-not31.sql ----------

-------- bg-not32.sql ----------
-- and, hardly believed, combined file works too
select xpath('/b', xmlagg(el)) as el
from ( values
   ( xmlelement(name b, 0) ),
   ( xmlelement(name c, 0.1::float8) )
) as t(el);
select xpath('/c', xmlagg(el)) as el
from ( values
   ( xmlelement(name b, 0) ),
   ( xmlelement(name c, 0.1::float4) )
) as t(el);
-----end bg-not32.sql ----------

-------- bg-not.sql -----------
-- Empty xpath expression catched - no backend crash
select xpath('',xmlelement(name a, xmlagg(el) )) as el
from ( values
( xmlelement(name b, 0) ),
( xmlelement(name c, 0.1) )
) as t(el);
-----end bg-not.sql -----------

-------- bg-not1.sql -----------
-- when types are same no backend crash
-- with numeric works on 32bit machine, but crashes on 64bit
select xpath('/a/b',xmlelement(name a, xmlagg(el) )) as el
from ( values
( xmlelement(name b, 0.1) ),
( xmlelement(name c, 0.1) )
) as t(el);
-----end bg-not1.sql -----------

-------- bg-not2.sql -----------
-- when elements given explicitly then no backend crash
select xpath('/a/c',
           xmlelement(name a,
           xmlelement(name b, 0),
           xmlelement(name c, 0.1) ));
-----end bg-not2.sql -----------

-------- bg-not3.sql -----------
-- xmlelement itself not crashed
select xmlelement(name a, xmlagg(el) ) as el
from ( values
( xmlelement(name b, 0) ),
( xmlelement(name c, 0.1) )
) as t(el);
-----end bg-not3.sql -----------

-------- bg-not4.sql -----------
-- when elements given with xmlconcat2 then no backend crash
select xpath('/a/c',
           xmlelement(name a,
           xmlconcat2(
             xmlelement(name b, 0),
             xmlelement(name c, 0.1))
           ));
-----end bg-not4.sql -----------