BUG #18868: /src/backend/optimizer/path/joinrels.c list_head can be NULL

On Wed, Mar 26, 2025, at 7:16 AM, PG Bug reporting form wrote:

Pointers, returned from function 'list_head' at joinrels.c:1527 and 1528,
may be NULL and is dereferenced at joinrels.c:1550 and 1551.

joinrels.c:

compute_partition_bounds(root, rel1, rel2, joinrel, parent_sjinfo,
&parts1, &parts2);

if (joinrel->partbounds_merged)
{
lcr1 = list_head(parts1);
lcr2 = list_head(parts2);
}

Did you read compute_partition_bounds()?

if (joinrel->partbounds_merged)
{
get_matching_part_pairs(root, joinrel, rel1, rel2,
parts1, parts2);
Assert(list_length(*parts1) == joinrel->nparts);
Assert(list_length(*parts2) == joinrel->nparts);
}

parts1 and parts2 uses the same condition. I expect that if there is any bug
related to pointer deference, the assert(s) should report. Do you have a test
case that exposes this issue?

--
Euler Taveira
EDB https://www.enterprisedb.com/