Crash when updating GIST index on geography column

[raduilie]

PostGIS 1.5.4 crashes when trying to update a GIST index on a geography column. The stack trace is:

#0 gidx_is_unknown (fcinfo=0xbff3a0ec) at geography_gist.c:172 #1 gidx_union_volume (fcinfo=0xbff3a0ec) at geography_gist.c:270 #2 geography_gist_penalty (fcinfo=0xbff3a0ec) at geography_gist.c:972 #3 0x0833e5d2 in FunctionCall3Coll (flinfo=0xbff3b578, collation=100, arg1=3220416064, arg2=3220415392, arg3=3220415272) at fmgr.c:1344 #4 0x08096e25 in gistpenalty (giststate=0x864c318, attno=0, orig=0xbff3a640, isNullOrig=1 '\001', add=0xbff3a3a0, isNullAdd=0 '\000') at gistutil.c:532 #5 0x080973cc in gistchoose (r=0x953ae988, p=0x96e13f80 "\005", it=0x864c310, giststate=0xbff3a778) at gistutil.c:409 #6 0x080961c3 in gistdoinsert (r=0x953ae988, itup=0x864c310, freespace≤value optimized out>, giststate=0xbff3a778) at gist.c:715 #7 0x0809694d in gistinsert (fcinfo=0xbff3c42c) at gist.c:277 #8 0x0833e349 in FunctionCall6Coll (flinfo=0x8581968, collation=0, arg1=2503666056, arg2=3220424396, arg3=3220424524, arg4=140788948, arg5=2504032136, arg6=0) at fmgr.c:1432 #9 0x080af105 in index_insert (indexRelation=0x953ae988, values=0xbff3c6cc, isnull=0xbff3c74c "", heap_t_ctid=0x86444d4, heapRelation=0x95407f88, checkUnique=UNIQUE_CHECK_NO) at indexam.c:215 #10 0x081b97e7 in ExecInsertIndexTuples (slot=0x8644488, tupleid=0x86444d4, estate=0x8644210) at execUtils.c:1085 #11 0x081c528f in ExecInsert (node=0x86442c8) at nodeModifyTable.c:247 #12 ExecModifyTable (node=0x86442c8) at nodeModifyTable.c:847 #13 0x081b0474 in ExecProcNode (node=0x86442c8) at execProcnode.c:371 #14 0x081af2e1 in ExecutePlan (queryDesc=0x8580d50, direction=ForwardScanDirection, count=0) at execMain.c:1439 #15 standard_ExecutorRun (queryDesc=0x8580d50, direction=ForwardScanDirection, count=0) at execMain.c:313 #16 0x0827e773 in ProcessQuery (plan=0x859cb18,

sourceText=0x8609488 "BEGIN; INSERT INTO test_crash VALUES(293, 'NAME 293', ST_GeometryFromText('POLYGON((0 0, 1 0, 1 1, 0 1, 0 0))', 4326)::geography); COMMIT;", params≤value optimized out>, dest=0x859cb88, completionTag=0xbff3ca4a "") at pquery.c:187

#17 0x0827e989 in PortalRunMulti (portal=0x857ed48, isTopLevel≤value optimized out>, dest=0x859cb88, altdest=0x859cb88, completionTag=0xbff3ca4a "") at pquery.c:1276 #18 0x0827f458 in PortalRun (portal=0x857ed48, count=2147483647, isTopLevel=0 '\000', dest=0x859cb88, altdest=0x859cb88, completionTag=0xbff3ca4a "") at pquery.c:813 #19 0x0827bd72 in exec_simple_query (

query_string=0x8609488 "BEGIN; INSERT INTO test_crash VALUES(293, 'NAME 293', ST_GeometryFromText('POLYGON((0 0, 1 0, 1 1, 0 1, 0 0))', 4326)::geography); COMMIT;") at postgres.c:1018

#20 0x0827c670 in PostgresMain (argc=2, argv=0x8579d70, username=0x8579cd0 "postgres") at postgres.c:3926 #21 0x0823d0f9 in ServerLoop () at postmaster.c:3606 #22 0x0823df29 in PostmasterMain (argc=3, argv=0x8577af0) at postmaster.c:1116 #23 0x081df940 in main (argc=3, argv=0x3f7fec09) at main.c:199

GDB says that variable a is NULL at frame 1:

(gdb) frame 1 #1 gidx_union_volume (fcinfo=0xbff3a0ec) at geography_gist.c:270 270 in geography_gist.c (gdb) p a $1 = (GIDX *) 0x0 (gdb) p b $2 = (GIDX *) 0x864c318

Which makes it clear why gidx_is_unknown is crashing.

I think that the checks in gidx_union_volume are in the wrong order. It should first check that a or b is NULL and then call gidx_is_unknown. Or add some check to gidx_is_unknown to check for NULL parameter.

I am attaching a couple of scripts: create.sql will create a test database, load PostGIS in it and create a very simple test table. The script named "test" will insert rows in that table until PostgreSQL crashes.

[raduilie]

Create test database and table

[raduilie]

bash script to insert rows until PostgreSQL crashes

[pramsey]

You were right, introducing the fix for empties also introduced this error, but curiously only in 1.5. The 2.x branches had the tests in the safe order. Fixed in 1.5 at r9776.

[pramsey]

Thanks for the excellent ticket btw.

[robe]

think this is related to #1904, #1905, #1906