[postgis-devel] st_asflatgeobuf detoast crash

[Justin Pryzby]

An instance running pg15beta1 crashed while running one of sqlsmith's appalling
queries.  I reproduced with this, simplified query:

	select st_asflatgeobuf(row(1), false, '')
	over () from information_schema.table_privileges

Program terminated with signal 11, Segmentation fault.
#0  pg_detoast_datum_copy (datum=0x514) at fmgr.c:1719

(gdb) bt
#0  pg_detoast_datum_copy (datum=0x514) at fmgr.c:1719
#1  0x00007f9c8f1210b0 in flatgeobuf_agg_transfn (ctx=ctx at entry=0x486e820) at flatgeobuf.c:528
#2  0x00007f9c8f121c37 in pgis_asflatgeobuf_transfn (fcinfo=0x7ffd94ac6c60) at lwgeom_out_flatgeobuf.c:74
#3  0x00000000006e3369 in advance_windowaggregate (winstate=winstate at entry=0x97d01c0, perfuncstate=0x9813c68, peraggstate=0x9813d00) at nodeWindowAgg.c:345
#4  0x00000000006e728a in eval_windowaggregates (winstate=0x97d01c0) at nodeWindowAgg.c:964
#5  ExecWindowAgg (pstate=0x97d01c0) at nodeWindowAgg.c:2240
#6  0x00000000006acb08 in ExecProcNodeInstr (node=0x97d01c0) at execProcnode.c:479
#7  0x00000000006cfc73 in ExecProcNode (node=0x97d01c0) at ../../../src/include/executor/executor.h:259
#8  ExecLimit (pstate=0x97cff10) at nodeLimit.c:96
#9  0x00000000006acb08 in ExecProcNodeInstr (node=0x97cff10) at execProcnode.c:479
#10 0x00000000006a4f02 in ExecProcNode (node=0x97cff10) at ../../../src/include/executor/executor.h:259
#11 ExecutePlan (execute_once=<optimized out>, dest=0xa8c5b58, direction=<optimized out>, numberTuples=0, sendTuples=true, operation=CMD_SELECT, use_parallel_mode=<optimized out>, planstate=0x97cff10, estate=0x6e5f530)
    at execMain.c:1636
#12 standard_ExecutorRun (queryDesc=0x88e2da0, direction=<optimized out>, count=0, execute_once=<optimized out>) at execMain.c:363
#13 0x00007f9c8f7fe39d in pgss_ExecutorRun (queryDesc=0x88e2da0, direction=ForwardScanDirection, count=0, execute_once=<optimized out>) at pg_stat_statements.c:1010
#14 0x00007f9c8f3f4781 in explain_ExecutorRun (queryDesc=0x88e2da0, direction=ForwardScanDirection, count=0, execute_once=<optimized out>) at auto_explain.c:320
#15 0x0000000000852b5e in PortalRunSelect (portal=portal at entry=0x254bf20, forward=forward at entry=true, count=0, count at entry=9223372036854775807, dest=dest at entry=0xa8c5b58) at pquery.c:924