Fix btmarkpos/btrestrpos array key wraparound bug.

nbtree's mark/restore processing failed to correctly handle an edge case
involving array key advancement and related search-type scan key state.
Scans with ScalarArrayScalarArrayOpExpr quals requiring mark/restore
processing (for a merge join) could incorrectly conclude that an
affected array/scan key must not have advanced during the time between
marking and restoring the scan's position.

As a result of all this, array key handling within btrestrpos could skip
a required call to _bt_preprocess_keys().  This confusion allowed later
primitive index scans to overlook tuples matching the true current array
keys.  The scan's search-type scan keys would still have spurious values
corresponding to the final array element(s) -- not values matching the
first/now-current array element(s).

To fix, remember that "array key wraparound" has taken place during the
ongoing btrescan in a flag variable stored in the scan's state, and use
that information at the point where btrestrpos decides if another call
to _bt_preprocess_keys is required.

Oversight in commit 70bc5833, which taught nbtree to handle array keys
during mark/restore processing, but missed this subtlety.  That commit
was itself a bug fix for an issue in commit 9e8da0f7, which taught
nbtree to handle ScalarArrayOpExpr quals natively.

Author: Peter Geoghegan <[email protected]>
Discussion: https://postgr.es/m/CAH2-WzkgP3DDRJxw6DgjCxo-cu-DKrvjEv_ArkP2ctBJatDCYg@mail.gmail.com
Backpatch: 11- (all supported branches).

diff --git a/src/backend/access/nbtree/nbtree.c b/src/backend/access/nbtree/nbtree.c
index 50b153fb9607a2c356af10da082b57de8bc29dd5..64ebf58fed272b04cfddfa55287f3d71ee0ed056 100644 (file)
--- a/src/backend/access/nbtree/nbtree.c
+++ b/src/backend/access/nbtree/nbtree.c
@@ -360,6 +360,7 @@ btbeginscan(Relation rel, int nkeys, int norderbys)
        so->keyData = NULL;
 
    so->arrayKeyData = NULL;    /* assume no array keys for now */
+   so->arraysStarted = false;
    so->numArrayKeys = 0;
    so->arrayKeys = NULL;
    so->arrayContext = NULL;

diff --git a/src/backend/access/nbtree/nbtutils.c b/src/backend/access/nbtree/nbtutils.c
index d5243107239bb16ca63fadcfd6c68356104bd8e4..73705df4fb1f8662e3388afa92450d97429da6e9 100644 (file)
--- a/src/backend/access/nbtree/nbtutils.c
+++ b/src/backend/access/nbtree/nbtutils.c
@@ -532,6 +532,8 @@ _bt_start_array_keys(IndexScanDesc scan, ScanDirection dir)
            curArrayKey->cur_elem = 0;
        skey->sk_argument = curArrayKey->elem_values[curArrayKey->cur_elem];
    }
+
+   so->arraysStarted = true;
 }
 
 /*
@@ -591,6 +593,14 @@ _bt_advance_array_keys(IndexScanDesc scan, ScanDirection dir)
    if (scan->parallel_scan != NULL)
        _bt_parallel_advance_array_keys(scan);
 
+   /*
+    * When no new array keys were found, the scan is "past the end" of the
+    * array keys.  _bt_start_array_keys can still "restart" the array keys if
+    * a rescan is required.
+    */
+   if (!found)
+       so->arraysStarted = false;
+
    return found;
 }
 
@@ -644,8 +654,13 @@ _bt_restore_array_keys(IndexScanDesc scan)
     * If we changed any keys, we must redo _bt_preprocess_keys.  That might
     * sound like overkill, but in cases with multiple keys per index column
     * it seems necessary to do the full set of pushups.
+    *
+    * Also do this whenever the scan's set of array keys "wrapped around" at
+    * the end of the last primitive index scan.  There won't have been a call
+    * to _bt_preprocess_keys from some other place following wrap around, so
+    * we do it for ourselves.
     */
-   if (changed)
+   if (changed || !so->arraysStarted)
    {
        _bt_preprocess_keys(scan);
        /* The mark should have been set on a consistent set of keys... */

diff --git a/src/include/access/nbtree.h b/src/include/access/nbtree.h
index 30a216e4c0d0c733f419a2d34600ce591c1fb42a..3d9192fbff1065d807c725203f7cb19c98751e47 100644 (file)
--- a/src/include/access/nbtree.h
+++ b/src/include/access/nbtree.h
@@ -1029,8 +1029,10 @@ typedef struct BTArrayKeyInfo
 
 typedef struct BTScanOpaqueData
 {
-   /* these fields are set by _bt_preprocess_keys(): */
+   /* all fields (except arraysStarted) are set by _bt_preprocess_keys(): */
    bool        qual_ok;        /* false if qual can never be satisfied */
+   bool        arraysStarted;  /* Started array keys, but have yet to "reach
+                                * past the end" of all arrays? */
    int         numberOfKeys;   /* number of preprocessed scan keys */
    ScanKey     keyData;        /* array of preprocessed scan keys */