test(pgsql): regression test for poisoned-transaction recovery with JSON event logging (#6084)
Author: renecannaoCreated Sep 17, 2026Updated Sep 17, 2026
Context
#6084 reported an ASAN heap-use-after-free: recovering a poisoned PostgreSQL transaction logged CurrentQuery after the frontend packet had already been freed. Commit 0959fa9cf fixed it by calling RequestEnd() before l_free(pkt->ptr) in PgSQL_Session::handler_poisoned_simple_query().
The regression test requested in #6084 was never added. pgsql-tx_poisoned_recovery-t covers backend termination followed by ROLLBACK, but it does not enable the events log. The freed pointer is read only on the event-logging path (PgSQL_Logger::log_request() → PgSQL_Event::write_query_format_2_json()), so the current test would not detect a reintroduction of the bug.
Scope
- Extend
pgsql-tx_poisoned_recovery-tor add a new test that setspgsql-eventslog_filenameandpgsql-eventslog_formatto JSON (format 2) before triggering poisoned-transaction recovery. - Cover
ROLLBACK, and ideallyCOMMIT, after a backend is terminated mid-transaction (SQLSTATE57P01). - Assert that the recovery statement is present in the JSON events log with the expected query text.
- Restore the logging variables on exit.
- Register the test in the appropriate group in
test/tap/groups/groups.json. The test is most useful when it also runs in the ASAN CI fan-out.
Acceptance
- The test passes on current v3.0.
- Under ASAN, the test fails if the order of
RequestEnd()andl_free()inhandler_poisoned_simple_query()is reverted.
Source: sysown/proxysql