Fix NULLIF()'s handling of read-write expanded objects.
authorTom Lane <tgl@sss.pgh.pa.us>
Mon, 25 Nov 2024 23:08:58 +0000 (18:08 -0500)
committerTom Lane <tgl@sss.pgh.pa.us>
Mon, 25 Nov 2024 23:09:09 +0000 (18:09 -0500)
commit5b8728cd7f9d3d93b6ff9b48887084fdf0a46e4f
treeb62eee91b8fa0d602753987f1a1c00aa0b7bb01f
parent4ba84de459532a7a79616e756f8bfd45ba4b8048
Fix NULLIF()'s handling of read-write expanded objects.

If passed a read-write expanded object pointer, the EEOP_NULLIF
code would hand that same pointer to the equality function
and then (unless equality was reported) also return the same
pointer as its value.  This is no good, because a function that
receives a read-write expanded object pointer is fully entitled
to scribble on or even delete the object, thus corrupting the
NULLIF output.  (This problem is likely unobservable with the
equality functions provided in core Postgres, but it's easy to
demonstrate with one coded in plpgsql.)

To fix, make sure the pointer passed to the equality function
is read-only.  We can still return the original read-write
pointer as the NULLIF result, allowing optimization of later
operations.

Per bug #18722 from Alexander Lakhin.  This has been wrong
since we invented expanded objects, so back-patch to all
supported branches.

Discussion: https://postgr.es/m/18722-fd9e645448cc78b4@postgresql.org
src/backend/executor/execExpr.c
src/backend/executor/execExprInterp.c
src/backend/jit/llvm/llvmjit_expr.c
src/include/executor/execExpr.h
src/test/regress/expected/case.out
src/test/regress/sql/case.sql