BUG #16536: Segfault with partition-wise joins

The following bug has been logged on the website:

Bug reference:      16536
Logged by:          Andrew Gierth
Email address:      andrew@tao11.riddles.org.uk
PostgreSQL version: 11.8
Operating system:   any
Description:

Reported on 11.8 but seems to be still present in HEAD. My testcase,
generated from a report on IRC by Arne Roland.

The problem seems to be that in conditions of a bitmap index scan under a
bitmapAnd, in the case of a partitionwise join, a Var isn't being replaced
properly by a Param, resulting in a crash when we attempt to validate the
expression since no slot is available for the Var. The bitmapAnd seems to be
required to trip the bug, with a single bitmap index scan it does not
manifest.

create table ax1 (a integer, b integer, c integer) partition by range (a);
create table ax2 (a integer, b integer, c integer) partition by range (a);
create table ax1_1 partition of ax1 for values from (1) to (11);
create table ax1_2 partition of ax1 for values from (11) to (21);
create table ax1_3 partition of ax1 for values from (21) to (31);
create table ax2_1 partition of ax2 for values from (1) to (11);
create table ax2_2 partition of ax2 for values from (11) to (21);
create table ax2_3 partition of ax2 for values from (21) to (31);
create index on ax2 (b);
create index on ax2 (c);
insert into ax2 select 1 + i%30, i, i from generate_series(1,1000) i,
generate_series(1,10) j;
insert into ax1 select 1 + i%30, i, i from generate_series(1,1000) i;
vacuum analyze ax1;
vacuum analyze ax2;
set enable_partitionwise_join = on;
set enable_indexscan=false;
explain select * from ax1 where not exists (select from ax2 where
ax2.a=ax1.a and ax2.b=ax1.b and ax2.c=123) and a=1 and c=120;
select * from ax1 where not exists (select from ax2 where ax2.a=ax1.a and
ax2.b=ax1.b and ax2.c=123) and a=1 and c=120;

The explain ends up with this in it:

       ->  Bitmap Index Scan on ax2_1_b_idx1  (cost=0.00..4.43 rows=20
width=0)
             Index Cond: (b = b)

and inspection of the node tree shows that that second "b" is in fact a Var
not a Param.