Brendan Jurd <direvus@gmail.com> writes:
> I have encountered a reproducible segfault in Postgres, and confirmed
> it in 9.0.1 and HEAD on three separate machines. The bug was not
> present in 8.4. I've attached a copy of the SQL script I have been
> using to induce the segfault.
> ...
> I had a go at investigating the cause of the bug, but didn't have much
> success as I'm not at all familiar with the guts of the optimizer.
Looks like the invalItems list has been clobbered:
(gdb) p *root->glob->invalItems
$6 = {type = 2139062143, length = 2139062143, head = 0x7f7f7f7f, tail = 0x7f7f7f7f}
I'm guessing it was modified in the temporary memory context and not
properly copied out to the parent context when we finished inlining
the function.
regards, tom lane