Fix some planner issues with degenerate outer join clauses.

An outer join clause that didn't actually reference the RHS (perhaps only
after constant-folding) could confuse the join order enforcement logic,
leading to wrong query results.  Also, nested occurrences of such things
could trigger an Assertion that on reflection seems incorrect.

Per fuzz testing by Andreas Seltenreich.  The practical use of such cases
seems thin enough that it's not too surprising we've not heard field
reports about it.

This has been broken for a long time, so back-patch to all active branches.

2 files changed, 32 insertions, 12 deletions

diff --git a/src/backend/optimizer/path/joinrels.c b/src/backend/optimizer/path/joinrels.c
index 357ee5399c7..3d4bc2530c5 100644
--- a/src/backend/optimizer/path/joinrels.c
+++ b/src/backend/optimizer/path/joinrels.c
@@ -459,20 +459,26 @@ join_is_legal(PlannerInfo *root, RelOptInfo *rel1, RelOptInfo *rel2,
 		}
 		else
 		{
+			/*
+			 * Otherwise, the proposed join overlaps the RHS but isn't a valid
+			 * implementation of this SJ.  It might still be a legal join,
+			 * however, if it does not overlap the LHS.
+			 */
+			if (bms_overlap(joinrelids, sjinfo->min_lefthand))
+				return false;
+
 			/*----------
-			 * Otherwise, the proposed join overlaps the RHS but isn't
-			 * a valid implementation of this SJ.  It might still be
-			 * a legal join, however.  If both inputs overlap the RHS,
-			 * assume that it's OK.  Since the inputs presumably got past
-			 * this function's checks previously, they can't overlap the
-			 * LHS and their violations of the RHS boundary must represent
-			 * SJs that have been determined to commute with this one.
+			 * If both inputs overlap the RHS, assume that it's OK.  Since the
+			 * inputs presumably got past this function's checks previously,
+			 * their violations of the RHS boundary must represent SJs that
+			 * have been determined to commute with this one.
 			 * We have to allow this to work correctly in cases like
 			 *		(a LEFT JOIN (b JOIN (c LEFT JOIN d)))
 			 * when the c/d join has been determined to commute with the join
 			 * to a, and hence d is not part of min_righthand for the upper
 			 * join.  It should be legal to join b to c/d but this will appear
 			 * as a violation of the upper join's RHS.
+			 *
 			 * Furthermore, if one input overlaps the RHS and the other does
 			 * not, we should still allow the join if it is a valid
 			 * implementation of some other SJ.  We have to allow this to
@@ -488,11 +494,13 @@ join_is_legal(PlannerInfo *root, RelOptInfo *rel1, RelOptInfo *rel2,
 				bms_overlap(rel1->relids, sjinfo->min_righthand) &&
 				bms_overlap(rel2->relids, sjinfo->min_righthand))
 			{
-				/* seems OK */
-				Assert(!bms_overlap(joinrelids, sjinfo->min_lefthand));
+				/* both overlap; assume OK */
 			}
 			else
+			{
+				/* one overlaps, the other doesn't (or it's a semijoin) */
 				is_valid_inner = false;
+			}
 		}
 	}
 
diff --git a/src/backend/optimizer/plan/initsplan.c b/src/backend/optimizer/plan/initsplan.c
index 5328f19afea..4ab3a6ea42b 100644
--- a/src/backend/optimizer/plan/initsplan.c
+++ b/src/backend/optimizer/plan/initsplan.c
@@ -641,6 +641,20 @@ make_outerjoininfo(PlannerInfo *root,
 	min_righthand = bms_int_members(bms_union(clause_relids, inner_join_rels),
 									right_rels);
 
+	/*
+	 * If we have a degenerate join clause that doesn't mention any RHS rels,
+	 * force the min RHS to be the syntactic RHS; otherwise we can end up
+	 * making serious errors, like putting the LHS on the wrong side of an
+	 * outer join.  It seems to be safe to not do this when we have a
+	 * contribution from inner_join_rels, though; that's enough to pin the SJ
+	 * to occur at a reasonable place in the tree.
+	 */
+	if (bms_is_empty(min_righthand))
+		min_righthand = bms_copy(right_rels);
+
+	/*
+	 * Now check previous outer joins for ordering restrictions.
+	 */
 	foreach(l, root->join_info_list)
 	{
 		SpecialJoinInfo *otherinfo = (SpecialJoinInfo *) lfirst(l);
@@ -742,12 +756,10 @@ make_outerjoininfo(PlannerInfo *root,
 	 * If we found nothing to put in min_lefthand, punt and make it the full
 	 * LHS, to avoid having an empty min_lefthand which will confuse later
 	 * processing. (We don't try to be smart about such cases, just correct.)
-	 * Likewise for min_righthand.
+	 * We already forced min_righthand nonempty, so nothing to do for that.
 	 */
 	if (bms_is_empty(min_lefthand))
 		min_lefthand = bms_copy(left_rels);
-	if (bms_is_empty(min_righthand))
-		min_righthand = bms_copy(right_rels);
 
 	/* Now they'd better be nonempty */
 	Assert(!bms_is_empty(min_lefthand));