Re: JSON constructors and window functions - Mailing list pgsql-hackers

Hi,

On 2022-04-03 18:56:39 -0400, Andrew Dunstan wrote:
> Haven't found the issue yet :-( It happens on the second call for the
> partition to  json_check_unique_key().
>
> Here's a more idiomatic and self-contained query that triggers the problem.
>
>
> select json_objectagg('10' : ref_0.level2 with unique keys)
>     over (partition by ref_0.parent_no order by ref_0.level2)
> from (values (1::int,1::int),(1,2),(2,1),(2,2)) as ref_0(parent_no,level2);

The hash was created in a context that's already freed.

#1  0x00007febbcc556f9 in wipe_mem (ptr=0x7febbf084f88, size=6392) at
/home/andres/src/postgresql/src/include/utils/memdebug.h:42
#2  0x00007febbcc5603e in AllocSetReset (context=0x7febbf084e80) at
/home/andres/src/postgresql/src/backend/utils/mmgr/aset.c:591
#3  0x00007febbcc61ed6 in MemoryContextResetOnly (context=0x7febbf084e80) at
/home/andres/src/postgresql/src/backend/utils/mmgr/mcxt.c:181
#4  0x00007febbcc561cf in AllocSetDelete (context=0x7febbf084e80) at
/home/andres/src/postgresql/src/backend/utils/mmgr/aset.c:654
#5  0x00007febbcc62155 in MemoryContextDelete (context=0x7febbf084e80) at
/home/andres/src/postgresql/src/backend/utils/mmgr/mcxt.c:252
#6  0x00007febbcc31ee2 in hash_destroy (hashp=0x7febbf084fa0) at
/home/andres/src/postgresql/src/backend/utils/hash/dynahash.c:876
#7  0x00007febbcb01ac5 in json_unique_check_free (cxt=0x7febbf03f548) at
/home/andres/src/postgresql/src/backend/utils/adt/json.c:985
#8  0x00007febbcb01b7c in json_unique_builder_free (cxt=0x7febbf03f548) at
/home/andres/src/postgresql/src/backend/utils/adt/json.c:1014
#9  0x00007febbcb0218f in json_object_agg_finalfn (fcinfo=0x7ffeab802e20) at
/home/andres/src/postgresql/src/backend/utils/adt/json.c:1227
#10 0x00007febbc84e110 in finalize_windowaggregate (winstate=0x7febbf037730, perfuncstate=0x7febbf057560,
peraggstate=0x7febbf0552f8,result=0x7febbf057520,
 
    isnull=0x7febbf057540) at /home/andres/src/postgresql/src/backend/executor/nodeWindowAgg.c:626
#11 0x00007febbc84ea9b in eval_windowaggregates (winstate=0x7febbf037730) at
/home/andres/src/postgresql/src/backend/executor/nodeWindowAgg.c:993
#12 0x00007febbc8514a7 in ExecWindowAgg (pstate=0x7febbf037730) at
/home/andres/src/postgresql/src/backend/executor/nodeWindowAgg.c:2207
#13 0x00007febbc7fda4d in ExecProcNodeFirst (node=0x7febbf037730) at
/home/andres/src/postgresql/src/backend/executor/execProcnode.c:463
#14 0x00007febbc7f12fb in ExecProcNode (node=0x7febbf037730) at
/home/andres/src/postgresql/src/include/executor/executor.h:259
#15 0x00007febbc7f41b7 in ExecutePlan (estate=0x7febbf0374f0, planstate=0x7febbf037730, use_parallel_mode=false,
operation=CMD_SELECT,sendTuples=true,
 
    numberTuples=0, direction=ForwardScanDirection, dest=0x7febbf030098, execute_once=true)
    at /home/andres/src/postgresql/src/backend/executor/execMain.c:1636
#16 0x00007febbc7f19ff in standard_ExecutorRun (queryDesc=0x7febbef79030, direction=ForwardScanDirection, count=0,
execute_once=true)
    at /home/andres/src/postgresql/src/backend/executor/execMain.c:363
#17 0x00007febbc7f17ee in ExecutorRun (queryDesc=0x7febbef79030, direction=ForwardScanDirection, count=0,
execute_once=true)
    at /home/andres/src/postgresql/src/backend/executor/execMain.c:307
#18 0x00007febbca6d2cc in PortalRunSelect (portal=0x7febbefcbc10, forward=true, count=0, dest=0x7febbf030098)
    at /home/andres/src/postgresql/src/backend/tcop/pquery.c:924
#19 0x00007febbca6cf5c in PortalRun (portal=0x7febbefcbc10, count=9223372036854775807, isTopLevel=true, run_once=true,
dest=0x7febbf030098,


I don't think you're allowed to free stuff in a finalfunc - we might reuse the
transition state for further calls to the aggregate.

Greetings,

Andres Freund