From 49f962eb1d07ca5d64f5a09e757dfe312ae666c4 Mon Sep 17 00:00:00 2001
From: Wen Lin <wen.lin@enterprisedb.com>
Date: Tue, 15 Sep 2026 16:46:06 +0800
Subject: [PATCH] grammar: fix modifying_stmt ignoring an explicitly passed
 victim

modifying_stmt skips pick_victim() when a victim is supplied, but never
assigns the argument to the member of the same name, leaving it
uninitialized.  Derived statements then dereference it (e.g.
insert_stmt iterating victim->columns()), which is undefined behaviour
and crashes in practice.

No in-tree caller passes a victim yet, so existing behaviour is
unchanged: null still means "pick a random table".
---
 grammar.cc | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/grammar.cc b/grammar.cc
index a8a0a83..59b6e3b 100644
--- a/grammar.cc
+++ b/grammar.cc
@@ -354,7 +354,10 @@ modifying_stmt::modifying_stmt(prod *p, struct scope *s, table *victim)
   scope = &myscope;
   scope->tables = s->tables;
 
-  if (!victim)
+  /* the parameter shadows the member */
+  if (victim)
+    this->victim = victim;
+  else
     pick_victim();
 }