UPDATE crash in HEAD and 8.1

A bug reported by Josh Drake, crashes 8.1 and CVS HEAD:

Test case is:

create table pk (id bigserial primary key);
insert into pk values (DEFAULT);
insert into pk values (DEFAULT);
insert into pk values (DEFAULT);
update pk set id = max(id) + 2;
-- SEGV

simple eh? :-)

The backtrace on HEAD looks like this:

(gdb) bt
#0  slot_getattr (slot=0x0, attnum=-1,    isnull=0x83fc3f9 "\177~\177\177\177\177\177¬\005A\b@")   at
/pgsql/source/00orig/src/backend/access/common/heaptuple.c:1288
#1  0x08168ae1 in ExecProject (projInfo=0x83fc40c, isDone=0xafecda2c)   at
/pgsql/source/00orig/src/backend/executor/execQual.c:3847
#2  0x08176c9d in ExecResult (node=0x83fbce0)   at /pgsql/source/00orig/src/backend/executor/nodeResult.c:157
#3  0x081647e5 in ExecProcNode (node=0x83fbce0)   at /pgsql/source/00orig/src/backend/executor/execProcnode.c:329
#4  0x0816315b in ExecutorRun (queryDesc=0x8404698, direction=ForwardScanDirection,    count=0) at
/pgsql/source/00orig/src/backend/executor/execMain.c:1139
#5  0x081f8298 in ProcessQuery (parsetree=<value optimized out>, plan=0x8412670,    params=0x0, dest=0x8412754,
completionTag=0xafecdcb8"")   at /pgsql/source/00orig/src/backend/tcop/pquery.c:174
 
#6  0x081f94c2 in PortalRun (portal=0x84024bc, count=2147483647, dest=0x8412754,    altdest=0x8412754,
completionTag=0xafecdcb8"")   at /pgsql/source/00orig/src/backend/tcop/pquery.c:1079
 
#7  0x081f484f in exec_simple_query (   query_string=0x83f0ffc "update pk set id = max(id) + 2;")   at
/pgsql/source/00orig/src/backend/tcop/postgres.c:1025

NULL slot!?

-- 
Alvaro Herrera                                http://www.CommandPrompt.com/
The PostgreSQL Company - Command Prompt, Inc.