UPDATE crash in HEAD and 8.1

A bug reported by Josh Drake, crashes 8.1 and CVS HEAD:

Test case is:

create table pk (id bigserial primary key);
insert into pk values (DEFAULT);
insert into pk values (DEFAULT);
insert into pk values (DEFAULT);
update pk set id = max(id) + 2;
-- SEGV

simple eh? :-)

The backtrace on HEAD looks like this:

(gdb) bt
#0 slot_getattr (slot=0x0, attnum=-1,
isnull=0x83fc3f9 "\177~\177\177\177\177\177¬\005A\b@")
at /pgsql/source/00orig/src/backend/access/common/heaptuple.c:1288
#1 0x08168ae1 in ExecProject (projInfo=0x83fc40c, isDone=0xafecda2c)
at /pgsql/source/00orig/src/backend/executor/execQual.c:3847
#2 0x08176c9d in ExecResult (node=0x83fbce0)
at /pgsql/source/00orig/src/backend/executor/nodeResult.c:157
#3 0x081647e5 in ExecProcNode (node=0x83fbce0)
at /pgsql/source/00orig/src/backend/executor/execProcnode.c:329
#4 0x0816315b in ExecutorRun (queryDesc=0x8404698, direction=ForwardScanDirection,
count=0) at /pgsql/source/00orig/src/backend/executor/execMain.c:1139
#5 0x081f8298 in ProcessQuery (parsetree=<value optimized out>, plan=0x8412670,
params=0x0, dest=0x8412754, completionTag=0xafecdcb8 "")
at /pgsql/source/00orig/src/backend/tcop/pquery.c:174
#6 0x081f94c2 in PortalRun (portal=0x84024bc, count=2147483647, dest=0x8412754,
altdest=0x8412754, completionTag=0xafecdcb8 "")
at /pgsql/source/00orig/src/backend/tcop/pquery.c:1079
#7 0x081f484f in exec_simple_query (
query_string=0x83f0ffc "update pk set id = max(id) + 2;")
at /pgsql/source/00orig/src/backend/tcop/postgres.c:1025

NULL slot!?

--
Alvaro Herrera http://www.CommandPrompt.com/
The PostgreSQL Company - Command Prompt, Inc.