Thank you for your fix.
> This assumes that the merge function returns a newly-palloc'd value.
> That's a shaky assumption; if one of the arguments is an empty range,
> range_merge() returns the other argument, rather than a newly
> constructed value. And surely we can't assume assume that for
> user-defined opclasses.
Your analysis looks right to me.
> brin_inclusion_union() has a similar issue, but I didn't write a script
> to reproduce that. Fix attached.
I am not sure about this part. If it's okay to use col_a->bv_values
without copying, it should also be okay to use col_b->bv_values, no?