I wrote:
>> Pushed at cfcd57111 et al. Thanks again for the report!
> Hmm, skink seems unhappy with this. Looking...
Ah: equivclass.c doesn't mind letting em->em_relids be an alias
for the left_relids or right_relids of some source RestrictInfo.
That's not problematic as long as those are all constants after
construction of the EquivalenceClass, but when remove_rel_from_eclass
is trying to change things, it's a big problem.
This seems to do the trick to fix it, although I'm going to wait
for a valgrind regression run to finish before deciding this
is enough:
diff --git a/src/backend/optimizer/plan/analyzejoins.c b/src/backend/optimizer/plan/analyzejoins.c
index bfb1af614c2..03056bdf3e0 100644
--- a/src/backend/optimizer/plan/analyzejoins.c
+++ b/src/backend/optimizer/plan/analyzejoins.c
@@ -783,6 +783,8 @@ remove_rel_from_eclass(EquivalenceClass *ec, int relid, int ojrelid)
bms_is_member(ojrelid, cur_em->em_relids))
{
Assert(!cur_em->em_is_const);
+ /* em_relids is likely to be shared with some RestrictInfo */
+ cur_em->em_relids = bms_copy(cur_em->em_relids);
cur_em->em_relids = bms_del_member(cur_em->em_relids, relid);
cur_em->em_relids = bms_del_member(cur_em->em_relids, ojrelid);
if (bms_is_empty(cur_em->em_relids))
This discovery may help explain why we'd seen so few trouble
reports up to now. At least some RestrictInfos' left/right_relids
would have indirectly gotten "fixed" by the above.
BTW, the case that is crashing the regression tests is where the above
bit reduces em_relids to empty, allowing bms_del_member to pfree it.
Now, the source RestrictInfo's left/right_relids is pointing at
garbage. The reason this didn't cause trouble before is that if
em_relids becomes empty, we remove that EquivalenceMember altogether,
and apparently that's enough to keep us from consulting the source
RestrictInfo anymore. But the loop over ec_sources just below does
see it, and now it is needing the left/right_relids to be valid.
regards, tom lane
