Re: BUG #18247: Integer overflow leads to negative width

On Fri, Dec 15, 2023 at 2:00 PM Alexander Lakhin <exclusion(at)gmail(dot)com>
wrote:

> Your patch looks good to me, but maybe you would find it suitable to fix in
> passing one more integer overflow in costsize.c?
>
> Concretely, the query:
> CREATE TABLE t(id int PRIMARY KEY, i int);
> EXPLAIN (VERBOSE)
> UPDATE t SET i = ni FROM (SELECT g id, 1 ni FROM generate_series(1,
> 2147483648) g) s WHERE t.id = s.id;
>
> when executed with ubsan-enabled build, gives:
> costsize.c:1017:12: runtime error: 2.14748e+09 is outside the range of
> representable values of type 'int'
> #0 0x5603325818e0 in cost_bitmap_heap_scan
> .../src/backend/optimizer/path/costsize.c:1017:12
> #1 0x5603326cc519 in create_bitmap_heap_path
> .../src/backend/optimizer/util/pathnode.c:1065:2
>

Nice catch. The overflow occurs when cost_bitmap_heap_scan() calls
compute_bitmap_pages(), and the loop_count parameter is converted from
double to int. I wonder if we can change the loop_count parameter to be
double for compute_bitmap_pages() to avoid such overflow.

Thanks
Richard