Skip to content

test: partial twins for four fixes that landed with shell arms only, and their refusals must be refusals (#1341 item 29) #1448

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jdatcmd merged 6 commits into from
Oct 16, 2026
Merged

test: partial twins for four fixes that landed with shell arms only, and their refusals must be refusals (#1341 item 29) #1448

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
fa44283
test: native_backend_crash gets its pytest twin, and a mid-write kill…
jdatcmd Oct 16, 2026
0115c61
test: native_backend_crash seeds the ledger, 3 of 28 arms dated by an…
jdatcmd Oct 16, 2026
18c6abc
test: corruption gets its pytest twin, and a backend crash can no lon…
jdatcmd Oct 16, 2026
ea88468
test: corruption seeds the ledger, 11 of 20 arms dated by seven mutat…
jdatcmd Oct 16, 2026
ed73ed0
test: partial twins for four fixes that landed with shell arms only, …
jdatcmd Oct 16, 2026
61b5250
test: inheritance's two #1259 refusal arms re-dated by the reverted p…
jdatcmd Oct 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
66 changes: 57 additions & 9 deletions test/check_ledger.tsv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -497,6 +497,26 @@ column_extent column_extent the extent of ty.s is the data's min and max, in the
column_extent column_extent the extent of ty.ts is the data's min and max, in the type's order 15;16;17;18;19 2026-10-14 a writer that finds no complete extent does not recompute one;no extent row is ever written (PgColumnarExtentPreCommit returns at once)
column_extent column_extent while the column that was there from the start still has one 15;16;17;18;19 2026-10-14 a writer that finds no complete extent does not recompute one;no extent row is ever written (PgColumnarExtentPreCommit returns at once)
column_extent column_extent without the extent rows the planner falls back to one zone_map scan 15;16;17;18;19 2026-10-13 the planner's zone-map fallback removed: with no complete extent it reads nothing and bounds nothing
corruption corruption alive after bad descriptor 15;16;17;18;19 2026-10-16 columnar_reader.c: the unrecognized-descriptor refusal replaced by a backend crash
corruption corruption alive after bloom corruption 15;16;17;18;19 2026-10-16 columnar_bloom.c: the bloom length check removed
corruption corruption alive after byte_length 15;16;17;18;19 2026-10-16 columnar_reader.c: the row group span refusal replaced by a backend crash
corruption corruption alive after column_index=-1 15;16;17;18;19 never -
corruption corruption alive after page_length 15;16;17;18;19 2026-10-16 columnar_reader.c: the chunk-inside-its-group refusal replaced by a backend crash
corruption corruption alive after row_count 15;16;17;18;19 2026-10-16 columnar_reader.c: the no-nulls row accounting and the value-stream bound both removed
corruption corruption alive after value_count 15;16;17;18;19 2026-10-16 columnar_reader.c: the chunk-inside-its-group refusal replaced by a backend crash
corruption corruption bad descriptor errors 15;16;17;18;19 2026-10-16 columnar_reader.c: the unrecognized-descriptor refusal replaced by a backend crash
corruption corruption byte_length corruption errors 15;16;17;18;19 2026-10-16 columnar_reader.c: the row group span refusal replaced by a backend crash;columnar_reader.c: the row group's span checked against its chunks no longer
corruption corruption corrupt bloom equality still correct 15;16;17;18;19 never -
corruption corruption corrupt bloom: a value the table holds is still found 15;16;17;18;19 2026-10-16 columnar_bloom.c: a malformed bloom header read as absent rather than as no filter;columnar_bloom.c: the bloom length check removed
corruption corruption page_length corruption errors 15;16;17;18;19 2026-10-16 columnar_reader.c: the chunk-inside-its-group refusal replaced by a backend crash
corruption corruption premise: the bloom filter corruption changed a catalog row 15;16;17;18;19 never -
corruption corruption premise: the byte_length corruption changed a catalog row 15;16;17;18;19 never -
corruption corruption premise: the column_index corruption changed a catalog row 15;16;17;18;19 never -
corruption corruption premise: the encoding_descriptor corruption changed a catalog row 15;16;17;18;19 never -
corruption corruption premise: the page_length corruption changed a catalog row 15;16;17;18;19 never -
corruption corruption premise: the row_count corruption changed a catalog row 15;16;17;18;19 never -
corruption corruption premise: the value_count corruption changed a catalog row 15;16;17;18;19 never -
corruption corruption row_count corruption errors 15;16;17;18;19 2026-10-16 columnar_reader.c: the no-nulls row accounting and the value-stream bound both removed
debug_hook_privilege debug_hook_privilege and that refusal is the owner gate too 15;16;17;18;19 2026-10-14 the debug set-metapage-version hook without its owner check
debug_hook_privilege debug_hook_privilege and the refusal is the owner gate, not an EXECUTE denial 15;16;17;18;19 2026-10-14 pgcolumnar_debug_advance_reserved_offset without its owner check
debug_hook_privilege debug_hook_privilege backend alive 15;16;17;18;19 never -
Expand Down Expand Up @@ -2116,7 +2136,7 @@ inheritance inheritance SELECT * from an INHERITS parent plans an Append 15;16;1
inheritance inheritance a columnar materialized view is still recognised as columnar 15;16;17;18;19 2026-09-24 the predicate narrowed to `relkind == RELKIND_RELATION` instead of RELKIND_HAS_STORAGE -- the obvious wrong fix, which also excludes RELKIND_MATVIEW and stops a columnar materialized view being recognised at all 31 call sites
inheritance inheritance a large child is still visible through the parent 15;16;17;18;19 never -
inheritance inheritance a partitioned parent still returns every row 15;16;17;18;19 never -
inheritance inheritance add_projection on the parent is refused rather than aborting the backend 15;16;17;18;19 never -
inheritance inheritance add_projection on the parent is refused rather than aborting the backend 15;16;17;18;19 2026-10-16 columnar_metadata.c: PgColumnarIsColumnarRelation answers from relam alone again, the #1259 predicate reverted
inheritance inheritance and it still returns its rows 15;16;17;18;19 never -
inheritance inheritance and the cluster is still up after it 15;16;17;18;19 never -
inheritance inheritance and the cluster is still up after that too 15;16;17;18;19 never -
Expand All @@ -2125,7 +2145,7 @@ inheritance inheritance control: add_projection on the LEAF still works 15;16;17
inheritance inheritance control: get_storage_id on the LEAF still returns an id 15;16;17;18;19 never -
inheritance inheritance count(*) from an INHERITS parent plans an Append 15;16;17;18;19 never -
inheritance inheritance filtered rows match the heap 15;16;17;18;19 never -
inheritance inheritance get_storage_id on the parent is refused rather than reading storage 15;16;17;18;19 never -
inheritance inheritance get_storage_id on the parent is refused rather than reading storage 15;16;17;18;19 2026-10-16 columnar_metadata.c: PgColumnarIsColumnarRelation answers from relam alone again, the #1259 predicate reverted
inheritance inheritance premise: a materialized view is relkind m 15;16;17;18;19 never -
inheritance inheritance premise: and it carries the columnar access method 15;16;17;18;19 never -
inheritance inheritance premise: and it is partitioned 15;16;17;18;19 never -
Expand Down Expand Up @@ -2226,6 +2246,34 @@ native_agg native_agg sum(int4) 15;16;17;18;19 never -
native_agg native_agg sum(int4,nulls) 15;16;17;18;19 never -
native_agg native_agg sum/min/max uses the metadata agg node 15;16;17;18;19 never -
native_agg native_agg the deletes removed rows at both ends, the same rows from each 15;16;17;18;19 never -
native_backend_crash native_backend_crash a second concurrent reader was also dropped by the crash 15;16;17;18;19 never -
native_backend_crash native_backend_crash crashA: kill lands mid-write (backend not yet in pg_sleep) 15;16;17;18;19 never -
native_backend_crash native_backend_crash crashA: the INSERT had written pages before the kill (the relation grew) 15;16;17;18;19 never -
native_backend_crash native_backend_crash crashB: kill lands after the stripes flushed (backend in pg_sleep) 15;16;17;18;19 never -
native_backend_crash native_backend_crash crashB: the INSERT had written pages before the kill (the relation grew) 15;16;17;18;19 never -
native_backend_crash native_backend_crash crashC: kill lands mid-write (backend not yet in pg_sleep) 15;16;17;18;19 never -
native_backend_crash native_backend_crash crashC: the INSERT had written pages before the kill (the relation grew) 15;16;17;18;19 never -
native_backend_crash native_backend_crash mid-write: cluster accepts new connections 15;16;17;18;19 never -
native_backend_crash native_backend_crash mid-write: committed content in c matches the heap mirror 15;16;17;18;19 2026-10-16 columnar_storage.c: a stripe data page written with no WAL record
native_backend_crash native_backend_crash mid-write: postmaster survived, same pid 15;16;17;18;19 never -
native_backend_crash native_backend_crash mid-write: the crash reinitialized the cluster (a live session was dropped) 15;16;17;18;19 never -
native_backend_crash native_backend_crash mid-write: the killed insert left no partial row group 15;16;17;18;19 never -
native_backend_crash native_backend_crash mid-write: the killed insert left no visible rows 15;16;17;18;19 never -
native_backend_crash native_backend_crash mid-write: the mirror itself is unchanged 15;16;17;18;19 never -
native_backend_crash native_backend_crash post-flush: cluster accepts new connections 15;16;17;18;19 never -
native_backend_crash native_backend_crash post-flush: committed content in c matches the heap mirror 15;16;17;18;19 2026-10-16 columnar_storage.c: a stripe data page written with no WAL record
native_backend_crash native_backend_crash post-flush: postmaster survived, same pid 15;16;17;18;19 never -
native_backend_crash native_backend_crash post-flush: the crash reinitialized the cluster (a live session was dropped) 15;16;17;18;19 never -
native_backend_crash native_backend_crash post-flush: the killed insert left no partial row group 15;16;17;18;19 never -
native_backend_crash native_backend_crash post-flush: the killed insert left no visible rows 15;16;17;18;19 never -
native_backend_crash native_backend_crash post-flush: the mirror itself is unchanged 15;16;17;18;19 never -
native_backend_crash native_backend_crash with-reader: cluster accepts new connections 15;16;17;18;19 never -
native_backend_crash native_backend_crash with-reader: committed content in c matches the heap mirror 15;16;17;18;19 2026-10-16 columnar_storage.c: a stripe data page written with no WAL record
native_backend_crash native_backend_crash with-reader: postmaster survived, same pid 15;16;17;18;19 never -
native_backend_crash native_backend_crash with-reader: the crash reinitialized the cluster (a live session was dropped) 15;16;17;18;19 never -
native_backend_crash native_backend_crash with-reader: the killed insert left no partial row group 15;16;17;18;19 never -
native_backend_crash native_backend_crash with-reader: the killed insert left no visible rows 15;16;17;18;19 never -
native_backend_crash native_backend_crash with-reader: the mirror itself is unchanged 15;16;17;18;19 never -
native_chunk_length_bound native_chunk_length_bound a sequential scan of the same poisoned chunk is refused (XX001) 15;16;17;18;19 never -
native_chunk_length_bound native_chunk_length_bound an index fetch of a chunk whose page_length is 2^32 too large is refused (XX001) 15;16;17;18;19 never -
native_chunk_length_bound native_chunk_length_bound backend survived the sequential refusal 15;16;17;18;19 never -
Expand Down Expand Up @@ -2352,6 +2400,9 @@ native_join_runtime_filter native_join_runtime_filter a (SELECT false) gate over
native_join_runtime_filter native_join_runtime_filter a (SELECT false) gate over a heap dimension equals heap 15;16;17;18;19 2026-10-15 the join runtime filter took a join carrying a gating qual and failed on the Result over it (the tree before #1437)
native_join_runtime_filter native_join_runtime_filter a (SELECT true) gate over a columnar dimension equals heap 15;16;17;18;19 2026-10-15 the join runtime filter took a join carrying a gating qual and failed on the Result over it (the tree before #1437)
native_join_runtime_filter native_join_runtime_filter a (SELECT true) gate over a heap dimension equals heap 15;16;17;18;19 2026-10-15 the join runtime filter took a join carrying a gating qual and failed on the Result over it (the tree before #1437)
native_join_runtime_filter native_join_runtime_filter an empty build from a large dimension answers as heap 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter an empty build on one rescan does not empty the next 15;16;17;18;19 2026-10-16 the rescan kept the first execution's runtime filter state: prepared not reset on rescan (mutation, #1447)
native_join_runtime_filter native_join_runtime_filter an empty build reads no fact chunk group 15;16;17;18;19 2026-10-16 an inner join whose build was empty ran on, and the fact scan rejected every row one at a time (the tree before #1447)
native_join_runtime_filter native_join_runtime_filter baseline core Hash Join 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter baseline reads all groups 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter build rows omit NULL 15;16;17;18;19 never -
Expand All @@ -2377,8 +2428,12 @@ native_join_runtime_filter native_join_runtime_filter join runtime filter defaul
native_join_runtime_filter native_join_runtime_filter plan has build tap 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter plan has runtime coordinator 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter plan retains core Hash Join 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter premise: and its build is empty 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter premise: heap's answer under a true gate over a columnar dimension holds 200 rows 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter premise: heap's answer under a true gate over a heap dimension holds 200 rows 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter premise: heap's empty-then-full rescan answer holds the 200 keys 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter premise: the empty-then-full rescan runs under the coordinator 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter premise: the large-dimension empty build runs under the coordinator 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter premise: with no gate, the columnar-dimension join has the coordinator 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter premise: with no gate, the heap-dimension join has the coordinator 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter projection join equals heap 15;16;17;18;19 never -
Expand Down Expand Up @@ -3562,10 +3617,3 @@ vm_privilege vm_privilege vm entry point is covered by this boundary test: vm_se
vm_privilege vm_privilege vm_is_visible refuses a heap relation even for its owner (#748) 15;16;17;18;19 never -
vm_privilege vm_privilege vm_selftest did not report success to the unprivileged role 15;16;17;18;19 2026-10-14 vm_selftest without its owner check
vm_privilege vm_privilege vm_selftest refuses a heap relation even for its owner (#748) 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter premise: the large-dimension empty build runs under the coordinator 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter premise: and its build is empty 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter an empty build reads no fact chunk group 15;16;17;18;19 2026-10-16 an inner join whose build was empty ran on, and the fact scan rejected every row one at a time (the tree before #1447)
native_join_runtime_filter native_join_runtime_filter an empty build from a large dimension answers as heap 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter premise: the empty-then-full rescan runs under the coordinator 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter premise: heap's empty-then-full rescan answer holds the 200 keys 15;16;17;18;19 never -
native_join_runtime_filter native_join_runtime_filter an empty build on one rescan does not empty the next 15;16;17;18;19 2026-10-16 the rescan kept the first execution's runtime filter state: prepared not reset on rescan (mutation, #1447)
51 changes: 49 additions & 2 deletions test/check_ledger_budget.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
#
# Adding a check to a suite that is already covered does not move it, which is
# what makes it safe to bound.
suites_not_covered 221
suites_not_covered 219
#
# checks_never_observed_red -- A CENSUS. NOT a ceiling, and it must not become
# one.
Expand Down Expand Up @@ -2886,4 +2886,51 @@ suites_not_covered 221
# never 2639 + 5 = 2644
# dated 925 + 2 = 927
# 2644 + 927 == 3571
checks_never_observed_red 2644
#
# #1341, native_backend_crash seeded, with its twin (OffgridwithJD): 2644 -> 2669,
# and suites_not_covered 221 -> 220. The suite had no rows. It enters with all 28
# checks from five-major runs (28/28 on each of 15-19). 3 are dated by a stripe data
# page written with no WAL record: each scenario's "committed content in c matches
# the heap mirror", which the reinit's crash recovery cannot rebuild. Twenty-five
# arrive never. The no-visible-rows and no-partial-row-group arms are MVCC's: no
# mutation of the extension leaves an aborted transaction's catalog rows visible.
# The sentinel, second-reader, kill-phase and relation-grew arms go red only under
# harness mutations (a signal that kills nothing, an INSERT whose stripes buffer
# whole), which observe the suite rather than the code. The rest hold of the heap
# mirror, the postmaster pid and a connection.
#
# ledger rows 3571 + 28 = 3599
# never 2644 + 25 = 2669
# dated 927 + 3 = 930
# 2669 + 930 == 3599
#
# #1341, corruption seeded, with its twin (OffgridwithJD): 2669 -> 2678, and
# suites_not_covered 220 -> 219. The suite had no rows. It enters with all 20 checks
# from five-major runs (20/20 on each of 15-19). 11 are dated by seven mutations of
# the reader and the bloom probe: the group-span check removed, the span, the
# chunk-bound and the descriptor refusals each replaced by a backend crash, the
# row-count accounting and the value-stream bound removed together, a malformed
# bloom header read as "absent", and the bloom length check removed. Each corruption
# has a second guard, so removing one refusal alone mostly leaves its arm green; a
# refusal turned into a crash is what the new XX001 and crash-count arms catch.
# Nine arrive never: the seven touched-a-row premises, which redden only when the
# harness's UPDATEs match nothing, column_index's liveness, which no single bound
# reddens, and the absent-value bloom lookup, which cannot see a false negative.
#
# ledger rows 3599 + 20 = 3619
# never 2669 + 9 = 2678
# dated 930 + 11 = 941
# 2678 + 941 == 3619
#
# #1341 item 29, inheritance re-dated (OffgridwithJD): 2678 -> 2676. Its two #1259
# refusal arms counted any error as a refusal, and with the #1259 predicate
# reverted a release build fails with 58P01 opening relfilenode 0, which is the bug:
# the suite stayed 26/26. They now require 42809, and the revert reddens both, so
# both leave never. parquet_import, phase5 and drop_cleanup gain partial twins but
# are not ledger-covered suites, so they owe no rows here.
#
# ledger rows 3619
# never 2678 - 2 = 2676
# dated 941 + 2 = 943
# 2676 + 943 == 3619
checks_never_observed_red 2676
Loading
Loading