[OffgridwithJD]

Depends on #12. This branch is stacked on #12's plx_emit_try helper, so until #12 merges the diff also shows its two commits. Only the last two commits belong here. Merge #12 first.

Summary

The try/finally lowering (plxjs, plxts, plxphp, plxruby, plxpython3) had two flaws:

1. finally didn't run on return, break or continue. A return inside try left the function without running finally, unlike every source language plx models.
2. The finally body was emitted twice (once on the normal path, once in the error handler), so nesting doubled the output per level. [2.1.0] Security audit: fix backend crashes, string-literal breakout, and transpiler DoS #12 capped this at 8 levels as a stopgap.

The finally body is now emitted once:

__plx_pend_N := 0; __plx_es_N := NULL;
<<__plx_try_N>>
BEGIN
  BEGIN
    body                 -- return x  ->  __plx_ret := x; __plx_pend_N := 1; EXIT __plx_try_N;
  EXCEPTION catch arms   -- exits from here are routed the same way
  END;
EXCEPTION WHEN OTHERS THEN
  GET STACKED DIAGNOSTICS __plx_es_N = RETURNED_SQLSTATE, ... MESSAGE_TEXT, ... DETAIL, ... HINT;
END;
finally body
IF __plx_es_N IS NOT NULL THEN RAISE EXCEPTION USING ERRCODE = ..., MESSAGE = ..., [DETAIL, HINT]; END IF;
IF __plx_pend_N = 1 THEN RETURN __plx_ret; ELSIF ... END IF;

How it works:

• While a try body and its catch arms are parsed, a frame is pushed.
• A return/break/continue that would leave the frame is emitted as a placeholder, because the parser doesn't know yet whether a finally follows.
• plx_emit_try resolves the placeholders. Without a finally they become the plain statement, so try/catch output is unchanged. With one they are routed through the finally body.
• Nested frames propagate outward.
• Labeled break/continue find their target through the frame their label was declared in.
• __plx_ret is typed from the function's result: RECORD for triggers and record, ALIAS FOR $0 for polymorphic results.

Semantics now match the source languages:

• The return value is evaluated before finally runs.
• A return or an error inside finally replaces the pending one.
• An uncaught error is re-raised after finally with its SQLSTATE, message, detail and hint.

Trade-off: a re-raised error's CONTEXT points at the re-raise, not the original statement.

Also:

• The 8-level cap from [2.1.0] Security audit: fix backend crashes, string-literal breakout, and transpiler DoS #12 is removed. 40 nested levels now produce 62 KB of output, where the old lowering doubled at every level.
• Source containing U+0001 (the placeholder delimiter) is rejected.

Upgrade note: stored functions keep the plpgsql they were created with. Only functions created or replaced after upgrading get the new behaviour (see CHANGELOG). #13 currently documents that return inside try skips finally; that note should be removed when this merges.

Testing

• New regression cases:
  • return, break and continue
  • nested try/finally, with inner and outer ordering
  • labeled break across a try
  • error re-raise keeping SQLSTATE/detail/hint
  • return in finally overriding an error
  • return from a catch arm
  • triggers returning NEW
  • SRF bare return
  • Ruby ensure, Python finally
  • 40-level nesting
• New test/finally_diff.py: generates random Python programs mixing nested try/except/finally, loops, return/break/continue (also inside finally) and raised errors, runs each in real Python and as plxpython3, and requires identical results. 1,200 programs across three seeds: 0 mismatches. make differentialcheck now runs 300 cases, so CI covers it.
• make installcheck: all 13 suites pass on PG 18.4.
• test/fuzz.py and the annotation fuzzer: no crashes.

🤖 Generated with Claude Code

[jdatcmd]

Adversarial review of the last two commits. The rest is #12, which has changes requested.

Tested on PostgreSQL 18.4: builds without warnings, make installcheck passes 13/13, and make differentialcheck (including finally_diff.py 300 1) reports 0 mismatches.

These hold up:

• A break inside a switch inside try/finally inside a loop.
• A trigger returning null and NEW from inside try/finally.
• A polymorphic result (anyelement).
• commit() in the finally body of a procedure.
• Output now grows linearly with nesting. An 8-level body of 209 KB stores 876 KB; under #12 the same shape stored 144 MB.

Must fix

1. The re-raise drops the error's object names

A bare RAISE; (the old lowering) re-raises the whole error. The new re-raise copies only the SQLSTATE, message, detail and hint, so the constraint, table, schema, column and datatype names are lost. Code that catches the error and reads them (for example, an application that maps a constraint name to a form field) silently gets empty strings.

CREATE TABLE t16(id int CONSTRAINT t16_pk PRIMARY KEY);
INSERT INTO t16 VALUES (1);
CREATE FUNCTION ins_fin() RETURNS void LANGUAGE plxjs AS $$
  try { execute("INSERT INTO t16 VALUES (1)"); } finally { let z = 1; }
$$;
DO $d$ DECLARE c text; t text; s text; BEGIN
  PERFORM ins_fin();
EXCEPTION WHEN unique_violation THEN
  GET STACKED DIAGNOSTICS c = CONSTRAINT_NAME, t = TABLE_NAME, s = SCHEMA_NAME;
  RAISE NOTICE 'constraint=% table=% schema=%', c, t, s;
END $d$;

build	output
master	constraint=t16_pk table=t16 schema=public
this PR	constraint= table= schema=

Suggested fix: also capture COLUMN_NAME, CONSTRAINT_NAME, PG_DATATYPE_NAME, TABLE_NAME and SCHEMA_NAME, and pass them back with RAISE ... USING COLUMN = ..., CONSTRAINT = ..., DATATYPE = ..., TABLE = ..., SCHEMA = .... The diagnostics come back as '' when absent, never NULL, so RAISE accepts them. Unlike DETAIL and HINT, these five fields are not printed in the error text, so they can be passed on every branch of the existing IF without a guard of their own. Add the probe above as a regression test.

If this stays as it is, the CHANGELOG must list the lost fields next to the CONTEXT note.

Should fix

2. A reused loop label makes break skip the finally

exit_crosses looks a label up in cx->labels, which only grows. A loop inside the try that reuses the label of the target loop is found first, so the break is judged not to cross the frame and is emitted as a plain EXIT:

CREATE FUNCTION lbl() RETURNS int LANGUAGE plxjs AS $$
  let r = 0;
  outer: for (let i = 0; i < 2; i++) {
    try {
      outer: for (let j = 0; j < 1; j++) { r = r * 10 + 1; }
      break outer;
    } finally { r = r * 10 + 9; }
  }
  return r;
$$;
SELECT lbl();  -- 1; expected 19 (the same body with the inner label renamed returns 19)

JavaScript rejects a label nested in a same-named label, but plx accepts it (and so does plpgsql). Either remove a label from the list when its loop ends, or reject a label that shadows an enclosing one.

3. finally_diff.py counts any error as a match

Python errors only with ValueError("x"), but the harness maps every plx failure to ERROR. A wrong SQLSTATE, a plpgsql runtime error in generated code, or record is not assigned yet would all pass. Please compare the SQLSTATE (P0001) and message x, not just "some error".

4. Say where finally still does not run

The CHANGELOG says the finally body runs on an error. It does not run on a query cancel or a failed assert, because WHEN OTHERS does not catch query_canceled or assert_failure. Both verified:

• statement_timeout = '300ms' around try { execute("SELECT pg_sleep(2)"); } finally { raise("warning", ...); }: no warning.
• try { assert(false, "boom"); } finally { raise("notice", ...); }: no notice.

This was true before too, but the new text promises more than the code does. One sentence in the CHANGELOG and the dialect chapters is enough.

CI has not run on this PR yet (fork run waiting for approval).

[OffgridwithJD]

Pushed 769f818, which fixes a memory blowup in this PR that came up while reviewing plxcsharp.

Problem. Put a return at every level of nested try/finally. Memory then grew with the cube of the depth, for two reasons:

• Each level kept its own copy of the text of every level inside it until the transpile ended.
• That text grew with the square of the depth, because of indentation.

A 15 KB plxjs body with 490 levels took the backend to 3.6 GB in 3.4 s, and 5.8 MB of prosrc. Any role can send that, including in a DO block. On master and #12 this can't happen, because finally nesting is capped at 8 levels there. It appeared when this PR removed the cap.

Fix.

• plx_emit_try now frees body, arms and ensure_body, and its resolved copies, once they are appended. Its comment documents the new ownership.
• The callers free each catch handler's text once it is added to the arms.
• plx_indent stops at 32 levels. Indentation is cosmetic in plpgsql.

Result. The same body now takes 31 MB and 0.37 s, and the output is 1.2 MB, linear in the source. Ruby begin/ensure and nested catches behave the same way.

Tests.

• A new plxjs test checks the output size at 300 levels. It fails without the fix.
• All suites pass, differentialcheck passes, and finally_diff.py with 1,200 programs has 0 mismatches.

🤖 Generated with Claude Code

[OffgridwithJD]

Thanks. I reproduced all four findings. They're fixed in 39f726e, with one correction to the suggested fix for 1.

1. Object names lost on re-raise. Confirmed with your probe: constraint= table= schema=.

One correction: an empty value doesn't behave like a missing one. With \set VERBOSITY verbose, RAISE EXCEPTION USING MESSAGE = 'plain', SCHEMA = '', TABLE = '', COLUMN = '', CONSTRAINT = '', DATATYPE = '' prints five empty lines (SCHEMA NAME:, TABLE NAME:, ...) that a plain RAISE does not. Drivers also see the empty values. Passing the five names on every branch would therefore add five empty fields to every re-raised error, a plain raise("...") included.

What the fix does instead:

• The five names are captured and passed back as a group, only when at least one is non-empty. DETAIL and HINT keep their own guards. That makes eight RAISEs.
• Result: a re-raised plain error carries no extra fields. Your probe now prints constraint=t16_pk table=t16 schema=public.
• Remaining cost: an error that names some objects also gets the others as empty fields. A unique violation, for example, shows empty COLUMN NAME and DATATYPE NAME in verbose mode. The CHANGELOG says so.
• An exact copy of every field, and of the original CONTEXT, would need a small C function that raises with only the non-empty fields. That's a new extension object, so I left it out of this PR. I can add it for 3.0 if you want it.
• Your probe is now a regression test (js_fin_objs). A domain-check case alongside it covers the type and constraint names.
• The re-raise block is longer: about 4.4 KB of generated code per level instead of about 2.4 KB, still linear. js_fin_ret_deep now checks linearity as a ratio rather than a fixed size: 300 levels must produce at most 2.5 times the code of 150. It measures 2.06; with the indentation cap removed it is 3.28, so the test still catches that regression.

2. A reused label skips the finally. Confirmed, and continue outer has the same bug: the continue form of your body returned 11 instead of 1919.

• A label reused by a later sibling loop, which JavaScript allows, already worked.
• Fix: a label is now in scope only inside its loop. The brace, Ruby and Python front ends restore the label list once the labelled loop is parsed.
• I didn't reject shadowing, because plpgsql accepts it. I didn't filter by loop depth either: plxcsharp also records a label for switch, which doesn't change the depth.
• Tests: plxjs covers break and continue; plxruby and plxpython3 cover the same shape.

3. finally_diff.py accepted any error. Confirmed. It now requires ERROR P0001:x, the SQLSTATE and message. 300 + 1,500 cases, 0 mismatches.

4. Where finally doesn't run. Both confirmed (a failed assert and a 300 ms statement_timeout). The CHANGELOG and the plxjs, plxphp, plxpython3 and plxruby chapters now say so. They also say that catch doesn't catch those two errors, for the same reason.

Two related points I didn't change:

• In real Python, except Exception and finally do see an AssertionError, so plxpython3 differs from Python there. Adding assert_failure to the catch-all is a behaviour change I'd rather make separately.
• The same gap was a bug in the new plxlua: real Lua's pcall catches a failed assert, and plxlua's didn't. Since plxlua isn't released, I fixed it on its branch (WHEN OTHERS OR assert_failure). A query cancel is still not caught.

Checked on PostgreSQL 18.4: make installcheck 13/13, make differentialcheck clean, and 600 fuzz iterations with no crashes. CI on this PR is waiting for workflow approval.

🤖 Generated with Claude Code