postgresql/src
Tom Lane 89bb2c76e4 Prevent leakage of SPI tuple tables during subtransaction abort.
plpgsql often just remembers SPI-result tuple tables in local variables,
and has no mechanism for freeing them if an ereport(ERROR) causes an escape
out of the execution function whose local variable it is.  In the original
coding, that wasn't a problem because the tuple table would be cleaned up
when the function's SPI context went away during transaction abort.
However, once plpgsql grew the ability to trap exceptions, repeated
trapping of errors within a function could result in significant
intra-function-call memory leakage, as illustrated in bug #8279 from
Chad Wagner.

We could fix this locally in plpgsql with a bunch of PG_TRY/PG_CATCH
coding, but that would be tedious, probably slow, and prone to bugs of
omission; moreover it would do nothing for similar risks elsewhere.
What seems like a better plan is to make SPI itself responsible for
freeing tuple tables at subtransaction abort.  This patch attacks the
problem that way, keeping a list of live tuple tables within each SPI
function context.  Currently, such freeing is automatic for tuple tables
made within the failed subtransaction.  We might later add a SPI call to
mark a tuple table as not to be freed this way, allowing callers to opt
out; but until someone exhibits a clear use-case for such behavior, it
doesn't seem worth bothering.

A very useful side-effect of this change is that SPI_freetuptable() can
now defend itself against bad calls, such as duplicate free requests;
this should make things more robust in many places.  (In particular,
this reduces the risks involved if a third-party extension contains
now-redundant SPI_freetuptable() calls in error cleanup code.)

Even though the leakage problem is of long standing, it seems imprudent
to back-patch this into stable branches, since it does represent an API
semantics change for SPI users.  We'll patch this in 9.3, but live with
the leakage in older branches.
2013-07-25 16:45:47 -04:00
..
backend Prevent leakage of SPI tuple tables during subtransaction abort. 2013-07-25 16:45:47 -04:00
bin Fix PQconninfoParse error message handling 2013-07-15 20:08:41 -04:00
common pgindent run for release 9.3 2013-05-29 16:58:43 -04:00
include Prevent leakage of SPI tuple tables during subtransaction abort. 2013-07-25 16:45:47 -04:00
interfaces Check for NULL result from strdup 2013-07-23 17:38:32 -04:00
makefiles Blind attempt at fixing the non-MSVC Windows builds 2013-02-22 11:51:15 -03:00
pl Prevent leakage of SPI tuple tables during subtransaction abort. 2013-07-25 16:45:47 -04:00
port Use SA_RESTART for all signals, including SIGALRM. 2013-06-15 15:40:05 -04:00
template Remove _FORTIFY_SOURCE 2012-10-10 21:42:38 -04:00
test Further hacking on ruleutils' new column-alias-assignment code. 2013-07-23 17:55:23 -04:00
timezone pgindent run for release 9.3 2013-05-29 16:58:43 -04:00
tools Minor spelling fixes 2013-06-01 10:18:59 -04:00
tutorial Modernize string literal syntax in tutorial example. 2013-01-19 17:20:32 -05:00
.gitignore Convert cvsignore to gitignore, and add .gitignore for build targets. 2010-09-22 12:57:04 +02:00
bcc32.mak Autoconfiscate selection of 64-bit int type for 64-bit large object API. 2012-10-07 21:52:43 -04:00
DEVELOPERS Replace a couple of references to files that no longer exist in the source 2009-05-04 08:08:47 +00:00
Makefile Create libpgcommon, and move pg_malloc et al to it 2013-02-12 11:21:05 -03:00
Makefile.global.in Remove whitespace from end of lines 2013-05-30 21:05:07 -04:00
Makefile.shlib Add pkg-config files for libpq and ecpg libraries 2013-03-31 16:58:40 -04:00
nls-global.mk NLS: Use msgmerge --previous option 2012-12-13 23:12:12 -05:00
win32.mak Autoconfiscate selection of 64-bit int type for 64-bit large object API. 2012-10-07 21:52:43 -04:00