Fix bogus optimization in JSONB containment tests.

When determining whether one JSONB object contains another, it's okay to
make a quick exit if the first object has fewer pairs than the second:
because we de-duplicate keys within objects, it is impossible that the
first object has all the keys the second does.  However, the code was
applying this rule to JSONB arrays as well, where it does *not* hold
because arrays can contain duplicate entries.  The test was really in
the wrong place anyway; we should do it within JsonbDeepContains, where
it can be applied to nested objects not only top-level ones.

Report and test cases by Alexander Korotkov; fix by Peter Geoghegan and
Tom Lane.

1 files changed, 14 insertions, 2 deletions

diff --git a/src/backend/utils/adt/jsonb_util.c b/src/backend/utils/adt/jsonb_util.c
index f157df3532d..2ff85396d01 100644
--- a/src/backend/utils/adt/jsonb_util.c
+++ b/src/backend/utils/adt/jsonb_util.c
@@ -957,13 +957,24 @@ JsonbDeepContains(JsonbIterator **val, JsonbIterator **mContained)
 	}
 	else if (rcont == WJB_BEGIN_OBJECT)
 	{
-		JsonbValue *lhsVal;		/* lhsVal is from pair in lhs object */
-
+		Assert(vval.type == jbvObject);
 		Assert(vcontained.type == jbvObject);
 
+		/*
+		 * If the lhs has fewer pairs than the rhs, it can't possibly contain
+		 * the rhs.  (This conclusion is safe only because we de-duplicate
+		 * keys in all Jsonb objects; thus there can be no corresponding
+		 * optimization in the array case.)  The case probably won't arise
+		 * often, but since it's such a cheap check we may as well make it.
+		 */
+		if (vval.val.object.nPairs < vcontained.val.object.nPairs)
+			return false;
+
 		/* Work through rhs "is it contained within?" object */
 		for (;;)
 		{
+			JsonbValue *lhsVal; /* lhsVal is from pair in lhs object */
+
 			rcont = JsonbIteratorNext(mContained, &vcontained, false);
 
 			/*
@@ -1047,6 +1058,7 @@ JsonbDeepContains(JsonbIterator **val, JsonbIterator **mContained)
 		JsonbValue *lhsConts = NULL;
 		uint32		nLhsElems = vval.val.array.nElems;
 
+		Assert(vval.type == jbvArray);
 		Assert(vcontained.type == jbvArray);
 
 		/*