PostgreSQL 10.15 commit log

commit   : e6c792ab72b99a3d68bf0696d0720e9afc61695c    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 9 Nov 2020 17:29:52 -0500    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 9 Nov 2020 17:29:52 -0500    

commit   : b0529799960e910c4cf1e3d5509572dc8c653d67    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 9 Nov 2020 13:02:13 -0500    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 9 Nov 2020 13:02:13 -0500    

Security: CVE-2020-25694, CVE-2020-25695, CVE-2020-25696  

commit   : ca0c8ea6662e2bc7c730dca8eb33a0d5bc2b1e0b    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 9 Nov 2020 12:02:24 -0500    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 9 Nov 2020 12:02:24 -0500    

After studying the code, NULLIF is a lot more subtle than you might  
have guessed.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : a498db87be103f93856dd515a574b2d67d3c1237    
  
author   : Noah Misch <[email protected]>    
date     : Mon, 9 Nov 2020 07:32:09 -0800    
  
committer: Noah Misch <[email protected]>    
date     : Mon, 9 Nov 2020 07:32:09 -0800    

If an interactive psql session used \gset when querying a compromised  
server, the attacker could execute arbitrary code as the operating  
system account running psql.  Using a prefix not found among specially  
treated variables, e.g. every lowercase string, precluded the attack.  
Fix by issuing a warning and setting no variable for the column in  
question.  Users wanting the old behavior can use a prefix and then a  
meta-command like "\set HISTSIZE :prefix_HISTSIZE".  Back-patch to 9.5  
(all supported versions).  
  
Reviewed by Robert Haas.  Reported by Nick Cleaton.  
  
Security: CVE-2020-25696  

commit   : f97ecea1ed7b09c6f1398540a1d72a57eee70c9f    
  
author   : Noah Misch <[email protected]>    
date     : Mon, 9 Nov 2020 07:32:09 -0800    
  
committer: Noah Misch <[email protected]>    
date     : Mon, 9 Nov 2020 07:32:09 -0800    

Specifically, this blocks DECLARE ... WITH HOLD and firing of deferred  
triggers within index expressions and materialized view queries.  An  
attacker having permission to create non-temp objects in at least one  
schema could execute arbitrary SQL functions under the identity of the  
bootstrap superuser.  One can work around the vulnerability by disabling  
autovacuum and not manually running ANALYZE, CLUSTER, REINDEX, CREATE  
INDEX, VACUUM FULL, or REFRESH MATERIALIZED VIEW.  (Don't restore from  
pg_dump, since it runs some of those commands.)  Plain VACUUM (without  
FULL) is safe, and all commands are fine when a trusted user owns the  
target object.  Performance may degrade quickly under this workaround,  
however.  Back-patch to 9.5 (all supported versions).  
  
Reviewed by Robert Haas.  Reported by Etienne Stalmans.  
  
Security: CVE-2020-25695  

commit   : d7d9dc144075c8d4b37c38397709d178db14d0c0    
  
author   : Peter Eisentraut <[email protected]>    
date     : Mon, 9 Nov 2020 12:42:39 +0100    
  
committer: Peter Eisentraut <[email protected]>    
date     : Mon, 9 Nov 2020 12:42:39 +0100    

Source-Git-URL: https://git.postgresql.org/git/pgtranslation/messages.git  
Source-Git-Hash: 73696049f4e22e6bffd9cf13fdd816b7dd5b6fd8  

commit   : 4ef7b6450702675d4a01b11dd27e39eea3cea545    
  
author   : Tom Lane <[email protected]>    
date     : Sun, 8 Nov 2020 15:16:12 -0500    
  
committer: Tom Lane <[email protected]>    
date     : Sun, 8 Nov 2020 15:16:12 -0500    

commit   : 468bed27ce8dadb5f445ce1587b441b563dfb3d4    
  
author   : Peter Eisentraut <[email protected]>    
date     : Sat, 7 Nov 2020 22:15:52 +0100    
  
committer: Peter Eisentraut <[email protected]>    
date     : Sat, 7 Nov 2020 22:15:52 +0100    

A few client tools duplicate error messages already provided by libpq.  
  
Discussion: https://www.postgresql.org/message-id/flat/3e937641-88a1-e697-612e-99bba4b8e5e4%40enterprisedb.com  

commit   : 0b96fc977c5b387f0f8a980672f035b34cdf60b7    
  
author   : Tomas Vondra <[email protected]>    
date     : Sat, 7 Nov 2020 00:41:19 +0100    
  
committer: Tomas Vondra <[email protected]>    
date     : Sat, 7 Nov 2020 00:41:19 +0100    

brin_form_tuple failed to consider the values may be toasted, inserting  
the toast pointer into the index. This may easily result in index  
corruption, as the toast data may be deleted and cleaned up by vacuum.  
The cleanup however does not care about indexes, leaving invalid toast  
pointers behind, which triggers errors like this:  
  
  ERROR:  missing chunk number 0 for toast value 16433 in pg_toast_16426  
  
A less severe consequence are inconsistent failures due to the index row  
being too large, depending on whether brin_form_tuple operated on plain  
or toasted version of the row. For example  
  
    CREATE TABLE t (val TEXT);  
    INSERT INTO t VALUES ('... long value ...')  
    CREATE INDEX idx ON t USING brin (val);  
  
would likely succeed, as the row would likely include toast pointer.  
Switching the order of INSERT and CREATE INDEX would likely fail:  
  
    ERROR:  index row size 8712 exceeds maximum 8152 for index "idx"  
  
because this happens before the row values are toasted.  
  
The bug exists since PostgreSQL 9.5 where BRIN indexes were introduced.  
So backpatch all the way back.  
  
Author: Tomas Vondra  
Reviewed-by: Alvaro Herrera  
Backpatch-through: 9.5  
Discussion: https://postgr.es/m/20201001184133.oq5uq75sb45pu3aw@development  
Discussion: https://postgr.es/m/20201104010544.zexj52mlldagzowv%40development  

commit   : ec516818a81aa43c56eb433e9c47304c19f4ac1b    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 6 Nov 2020 16:17:57 -0500    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 6 Nov 2020 16:17:57 -0500    

Revert 59ab4ac32, as well as the followup fix 33862cb9c, in all  
branches.  We need to think a bit harder about what the behavior  
of LOCK TABLE on views should be, and there's no time for that  
before next week's releases.  We'll take another crack at this  
later.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : dee1fe5e339acdb12f187e568b5363663cea42d7    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 6 Nov 2020 15:48:21 -0500    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 6 Nov 2020 15:48:21 -0500    

Revert 403a3d91c, as well as the followup fix 7f4235032, in all  
branches.  We need to think a bit harder about what the behavior  
of LOCK TABLE on views should be, and there's no time for that  
before next week's releases.  We'll take another crack at this  
later.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 33862cb9c13a9d5c53e887bea4909415e73be634    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 6 Nov 2020 12:14:36 -0500    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 6 Nov 2020 12:14:36 -0500    

Commits 59ab4ac32 et al mistakenly copied-and-pasted some text about  
how LOCK on a view recurses to referenced tables into pre-v11 branches,  
which in fact don't do that.  Undo that, and instead state clearly  
that they don't.  (I also chose to add a note that this behavior  
changed in v11.  We usually don't back-patch such statements, but  
since it's easy to add the warning now, might as well.)  
  
Noted while considering followup fixes for bug #16703.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 9d878d7fee789d79afb846e401e56a65dd23a0f4    
  
author   : Tom Lane <[email protected]>    
date     : Tue, 3 Nov 2020 16:16:36 -0500    
  
committer: Tom Lane <[email protected]>    
date     : Tue, 3 Nov 2020 16:16:36 -0500    

If the planner erroneously puts a non-parallel-safe SubPlan into  
a parallelized portion of the query tree, nodeSubplan.c will fail  
in the worker processes because it finds a null in es_subplanstates,  
which it's unable to cope with.  It seems worth a test-and-elog to  
make that an error case rather than a core dump case.  
  
This probably should have been included in commit 16ebab688, which  
was responsible for allowing nulls to appear in es_subplanstates  
to begin with.  So, back-patch to v10 where that came in.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : df4405b7848599311c5799f48caba1605490f2b2    
  
author   : Tom Lane <[email protected]>    
date     : Tue, 3 Nov 2020 15:41:32 -0500    
  
committer: Tom Lane <[email protected]>    
date     : Tue, 3 Nov 2020 15:41:32 -0500    

The intention in commit 491c029db was to require superuserness to  
change the BYPASSRLS property, but the actual effect of the coding  
in AlterRole() was to require superuserness to change anything at all  
about a BYPASSRLS role.  Other properties of a BYPASSRLS role should  
be changeable under the same rules as for a normal role, though.  
  
Fix that, and also take care of some documentation omissions related  
to BYPASSRLS and REPLICATION role properties.  
  
Tom Lane and Stephen Frost, per bug report from Wolfgang Walther.  
Back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 7827497ba2e64fad80d44841758c2ec101f099f9    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 2 Nov 2020 21:11:50 -0500    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 2 Nov 2020 21:11:50 -0500    

fill_hba_line() thought it could get away with passing sizeof(struct  
sockaddr_storage) rather than the actual addrlen previously returned  
by getaddrinfo().  While that appears to work on many platforms,  
it does not work on FreeBSD 11: you get back a failure, which leads  
to the view showing NULL for the address and netmask columns in all  
rows.  The POSIX spec for getnameinfo() is pretty clearly on  
FreeBSD's side here: you should pass the actual address length.  
So it seems plausible that there are other platforms where this  
coding also fails, and we just hadn't noticed.  
  
Also, IMO the fact that getnameinfo() failure leads to a NULL output  
is pretty bogus in itself.  Our pg_getnameinfo_all() wrapper is  
careful to emit "???" on failure, and we should use that in such  
cases.  NULL should only be emitted in rows that don't have IP  
addresses.  
  
Per bug #16695 from Peter Vandivier.  Back-patch to v10 where this  
code was added.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 06801aef52f7f734a737cc0763a410fd1ec6e574    
  
author   : Magnus Hagander <[email protected]>    
date     : Mon, 2 Nov 2020 15:20:19 +0100    
  
committer: Magnus Hagander <[email protected]>    
date     : Mon, 2 Nov 2020 15:20:19 +0100    

commit   : b99cbbf5ce5174dd644d6b90fb0e4fbe253fa0c8    
  
author   : Michael Paquier <[email protected]>    
date     : Mon, 2 Nov 2020 15:15:32 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Mon, 2 Nov 2020 15:15:32 +0900    

The documentation fixes are backpatched down to where they apply.  
  
Author: Justin Pryzby  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: 9.6  

commit   : dd7ae03f8c2a5dbadd4e7e1f288afcecfedbfb32    
  
author   : Tom Lane <[email protected]>    
date     : Sun, 1 Nov 2020 11:26:16 -0500    
  
committer: Tom Lane <[email protected]>    
date     : Sun, 1 Nov 2020 11:26:16 -0500    

Although error results received from the backend should always have  
a SQLSTATE field, ones generated by libpq won't, making this code  
vulnerable to a crash after, say, untimely loss of connection.  
Noted by Coverity.  
  
Oversight in commit 403a3d91c.  Back-patch to 9.5, as that was.  

commit   : c39f4e81dc21406d610d0340a9a2e1d34c3372d3    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 29 Oct 2020 15:28:14 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 29 Oct 2020 15:28:14 -0400    

The timetz test cases I added in commit a9632830b were unintentionally  
sensitive to whether or not DST is active in the PST8PDT time zone.  
Thus, they'll start failing this coming weekend, as reported by  
Bernhard M. Wiedemann in bug #16689.  Fortunately, DST-awareness is  
not significant to the purpose of these test cases, so we can just  
force them all to PDT (DST hours) to preserve stability of the  
results.  
  
Back-patch to v10, as the prior patch was.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 504f963f76f0a5867b12cba8802e858cbfa53af9    
  
author   : Tom Lane <[email protected]>    
date     : Wed, 28 Oct 2020 14:35:53 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Wed, 28 Oct 2020 14:35:53 -0400    

In almost all other places, we use plain "r" or "w" mode in popen()  
calls (the exceptions being for COPY data).  This one has been  
overlooked (possibly because it's buried in a ".l" flex file?),  
but it's using PG_BINARY_R.  
  
Kensuke Okamura complained in bug #16688 that we fail to strip \r  
when stripping the trailing newline from a backtick result string.  
That's true enough, but we'd also fail to convert embedded \r\n  
cleanly, which also seems undesirable.  Fixing the popen() mode  
seems like the best way to deal with this.  
  
It's been like this for a long time, so back-patch to all supported  
branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 41c742a432427177e2ddd6ba434d555f8e6cf02b    
  
author   : Tom Lane <[email protected]>    
date     : Tue, 27 Oct 2020 15:37:13 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Tue, 27 Oct 2020 15:37:13 -0400    

EventTriggerAlterTableEnd neglected to make sure that it built its  
output list in the right context.  In simple cases this was masked  
because the function is called in PortalContext which will be  
sufficiently long-lived anyway; but that doesn't make it not a bug.  
Commit ced138e8c fixed this in HEAD and v13, but mistakenly chose  
not to back-patch further.  Back-patch the same code change all  
the way (I didn't bother with the test case though, as it would  
prove nothing in pre-v13 branches).  
  
Per report from Arseny Sher.  
Original fix by Jehan-Guillaume de Rorthais.  
  
Discussion: https://postgr.es/m/877drcyprb.fsf@ars-thinkpad  
Discussion: https://postgr.es/m/20200902193715.6e0269d4@firost  

commit   : 38e4b15e03ec1464d7843c6736669d436777469e    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 27 Oct 2020 14:00:38 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 27 Oct 2020 14:00:38 -0400    

You can't compile thread_test alone anymore, and the location moved too.  
  
Reported-by: Tom Lane  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : 5beea9514c9b5021a618bc1d5ddd27322794c47f    
  
author   : Alvaro Herrera <[email protected]>    
date     : Tue, 27 Oct 2020 14:31:37 -0300    
  
committer: Alvaro Herrera <[email protected]>    
date     : Tue, 27 Oct 2020 14:31:37 -0300    

Now that LOCK TABLE can take any relation type, acquire lock on all  
relations that are to be dumped.  This prevents schema changes or  
deadlock errors that could cause a dump to fail after expending much  
effort.  The server is tested to have the capability and the feature  
disabled if it doesn't, so that a patched pg_dump doesn't fail when  
connecting to an unpatched server.  
  
Backpatch to 9.5.  
  
Author: Álvaro Herrera <[email protected]>  
Reviewed-by: Tom Lane <[email protected]>  
Reported-by: Wells Oliver <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  

commit   : 2f0baa244f399ce152fb0da018d7156fdfe8b47d    
  
author   : Alvaro Herrera <[email protected]>    
date     : Tue, 27 Oct 2020 13:49:19 -0300    
  
committer: Alvaro Herrera <[email protected]>    
date     : Tue, 27 Oct 2020 13:49:19 -0300    

The restriction that only tables and views can be locked by LOCK TABLE  
is quite arbitrary, since the underlying mechanism can lock any relation  
type.  Drop the restriction so that programs such as pg_dump can lock  
all relations they're interested in, preventing schema changes that  
could cause a dump to fail after expending much effort.  
  
Backpatch to 9.5.  
  
Author: Álvaro Herrera <[email protected]>  
Reviewed-by: Tom Lane <[email protected]>  
Reported-by: Wells Oliver <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  

commit   : 2339038a9b212e3ae846b2330de15c51752b1059    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 27 Oct 2020 12:43:11 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 27 Oct 2020 12:43:11 -0400    

This directory and the ability to build the thread test independently  
were removed in commit 8a2121185b.  
  
Reported-by: [email protected]  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : 7868b6d0d79078b4dc462ea49b3a093d8016f58e    
  
author   : Bruce Momjian <[email protected]>    
date     : Mon, 26 Oct 2020 22:38:11 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Mon, 26 Oct 2020 22:38:11 -0400    

Reported-by: [email protected]  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : 37146659132072b499ebdf49c55b84e9bd8bcce2    
  
author   : Bruce Momjian <[email protected]>    
date     : Mon, 26 Oct 2020 19:17:05 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Mon, 26 Oct 2020 19:17:05 -0400    

Parallel execution changed the way bloom queries are executed, so update  
the EXPLAIN output, and restructure the docs to be clearer and more  
accurate.  
  
Reported-by: Daniel Westermann  
  
Discussion: https://postgr.es/m/ZR0P278MB0122119FAE78721A694C30C8D2340@ZR0P278MB0122.CHEP278.PROD.OUTLOOK.COM  
  
Author: Daniel Westermann and me  
  
Backpatch-through: 9.6  

commit   : f38b66ec056216a1efde6b7982ba582603262b0b    
  
author   : Tom Lane <[email protected]>    
date     : Sat, 24 Oct 2020 13:12:08 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Sat, 24 Oct 2020 13:12:08 -0400    

We must not set the "done" flag until after we've executed the  
initialization function.  Otherwise, other threads can fall through  
the initial unlocked test before initialization is really complete.  
  
This has been seen to cause rare failures of ecpg's thread/descriptor  
test, and it could presumably cause other sorts of misbehavior in  
threaded ECPG-using applications, since ecpglib relies on  
pthread_once() in several places.  
  
Diagnosis and patch by me, based on investigation by Alexander Lakhin.  
Back-patch to all supported branches (the bug dates to 2007).  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : a357cc05ddd9853302583c5f23f6e338ee3a611f    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 22 Oct 2020 21:23:47 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 22 Oct 2020 21:23:47 -0400    

DST law changes in Palestine, with a whopping 120 hours' notice.  
Also some historical corrections for Palestine.  

commit   : 34285083b368539ef9ad233cbe799209e304f286    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 22 Oct 2020 21:15:22 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 22 Oct 2020 21:15:22 -0400    

There's no functional change at all here, but I'm curious to see  
whether this change successfully shuts up Coverity's warning about  
a useless strcmp(), which appeared with the previous update.  
  
Discussion: http://mm.icann.org/pipermail/tz/2020-October/029370.html  

commit   : 8175da6e796e64bf45bc4bd27c1f12b3265b803f    
  
author   : Tom Lane <[email protected]>    
date     : Wed, 21 Oct 2020 16:18:41 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Wed, 21 Oct 2020 16:18:41 -0400    

psql's \connect claims to be able to re-use previous connection  
parameters, but in fact it only re-uses the database name, user name,  
host name (and possibly hostaddr, depending on version), and port.  
This is problematic for assorted use cases.  Notably, pg_dump[all]  
emits "\connect databasename" commands which we would like to have  
re-use all other parameters.  If such a script is loaded in a psql run  
that initially had "-d connstring" with some non-default parameters,  
those other parameters would be lost, potentially causing connection  
failure.  (Thus, this is the same kind of bug addressed in commits  
a45bc8a4f and 8e5793ab6, although the details are much different.)  
  
To fix, redesign do_connect() so that it pulls out all properties  
of the old PGconn using PQconninfo(), and then replaces individual  
properties in that array.  In the case where we don't wish to re-use  
anything, get libpq's default settings using PQconndefaults() and  
replace entries in that, so that we don't need different code paths  
for the two cases.  
  
This does result in an additional behavioral change for cases where  
the original connection parameters allowed multiple hosts, say  
"psql -h host1,host2", and the \connect request allows re-use of the  
host setting.  Because the previous coding relied on PQhost(), it  
would only permit reconnection to the same host originally selected.  
Although one can think of scenarios where that's a good thing, there  
are others where it is not.  Moreover, that behavior doesn't seem to  
meet the principle of least surprise, nor was it documented; nor is  
it even clear it was intended, since that coding long pre-dates the  
addition of multi-host support to libpq.  Hence, this patch is content  
to drop it and re-use the host list as given.  
  
Per Peter Eisentraut's comments on bug #16604.  Back-patch to all  
supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 35b4b7d0851444904f450805880f30b6cc49c514    
  
author   : Alvaro Herrera <[email protected]>    
date     : Wed, 21 Oct 2020 14:37:25 -0300    
  
committer: Alvaro Herrera <[email protected]>    
date     : Wed, 21 Oct 2020 14:37:25 -0300    

Should cause tests to be a bit faster  

commit   : f78ebbe68f48b7bb4fe8e23b5a30c32dfc452331    
  
author   : Peter Eisentraut <[email protected]>    
date     : Mon, 19 Oct 2020 08:52:25 +0200    
  
committer: Peter Eisentraut <[email protected]>    
date     : Mon, 19 Oct 2020 08:52:25 +0200    

In shm_mq_receive(), a huge payload could trigger an unjustified  
"invalid memory alloc request size" error due to the way the buffer  
size is increased.  
  
Add error checks (documenting the upper limit) and avoid the error by  
limiting the allocation size to MaxAllocSize.  
  
Author: Markus Wanner <[email protected]>  
Discussion: https://www.postgresql.org/message-id/flat/3bb363e7-ac04-0ac4-9fe8-db1148755bfa%402ndquadrant.com  

commit   : 68f2369930f923df79fef4c62843a40baa1facec    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 19 Oct 2020 19:03:47 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 19 Oct 2020 19:03:47 -0400    

When told to process all databases, clusterdb, reindexdb, and vacuumdb  
would reconnect by replacing their --maintenance-db parameter with the  
name of the target database.  If that parameter is a connstring (which  
has been allowed for a long time, though we failed to document that  
before this patch), we'd lose any other options it might specify, for  
example SSL or GSS parameters, possibly resulting in failure to connect.  
Thus, this is the same bug as commit a45bc8a4f fixed in pg_dump and  
pg_restore.  We can fix it in the same way, by using libpq's rules for  
handling multiple "dbname" parameters to add the target database name  
separately.  I chose to apply the same refactoring approach as in that  
patch, with a struct to handle the command line parameters that need to  
be passed through to connectDatabase.  (Maybe someday we can unify the  
very similar functions here and in pg_dump/pg_restore.)  
  
Per Peter Eisentraut's comments on bug #16604.  Back-patch to all  
supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 463bef28d8f2c85048fe5ecab0df8f4fb0924e1e    
  
author   : Heikki Linnakangas <[email protected]>    
date     : Mon, 19 Oct 2020 19:28:54 +0300    
  
committer: Heikki Linnakangas <[email protected]>    
date     : Mon, 19 Oct 2020 19:28:54 +0300    

- Misc grammar and punctuation fixes.  
  
- Stylistic cleanup: use spaces between function arguments and JSON fields  
  in examples. For example "foo(a,b)" -> "foo(a, b)". Add semicolon after  
  last END in a few PL/pgSQL examples that were missing them.  
  
- Make sentence that talked about "..." and ".." operators more clear,  
  by avoiding to end the sentence with "..". That makes it look the same  
  as "..."  
  
- Fix syntax description for HAVING: HAVING conditions cannot be repeated  
  
Patch by Justin Pryzby, per Yaroslav Schekin's report. Backpatch to all  
supported versions, to the extent that the patch applies easily.  
  
Discussion: https://www.postgresql.org/message-id/20201005191922.GE17626%40telsasoft.com  

commit   : d348473b783c37a1937065812217eb269b8f2613    
  
author   : Heikki Linnakangas <[email protected]>    
date     : Mon, 19 Oct 2020 19:02:25 +0300    
  
committer: Heikki Linnakangas <[email protected]>    
date     : Mon, 19 Oct 2020 19:02:25 +0300    

ALTER SEQUENCE RESTART was made transactional in commit 3d79013b97.  
Backpatch to v10, where that was introduced.  
  
Patch by Justin Pryzby, per Yaroslav Schekin's report.  
  
Discussion: https://www.postgresql.org/message-id/20201005191922.GE17626%40telsasoft.com  

commit   : 609fe21c0dbd50cd5e3d13a73ea2f757fdfc75ff    
  
author   : Heikki Linnakangas <[email protected]>    
date     : Mon, 19 Oct 2020 18:50:33 +0300    
  
committer: Heikki Linnakangas <[email protected]>    
date     : Mon, 19 Oct 2020 18:50:33 +0300    

The output for this query changed in commit 4e2477b7b8. Backport to 9.6  
like that commit.  
  
Patch by Justin Pryzby, per Yaroslav Schekin's report.  
  
Discussion: https://www.postgresql.org/message-id/20201005191922.GE17626%40telsasoft.com  

commit   : 6670e91078b3cc7927b9a16d2082586bef63b547    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 19 Oct 2020 11:23:52 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 19 Oct 2020 11:23:52 -0400    

The Windows documentation insists that every WSAStartup call should  
have a matching WSACleanup call.  However, if that ever had actual  
relevance, it wasn't in this century.  Every remotely-modern Windows  
kernel is capable of cleaning up when a process exits without doing  
that, and must be so to avoid resource leaks in case of a process  
crash.  Moreover, Postgres backends have done WSAStartup without  
WSACleanup since commit 4cdf51e64 in 2004, and we've never seen any  
indication of a problem with that.  
  
libpq's habit of doing WSAStartup during connection start and  
WSACleanup during shutdown is also rather inefficient, since a  
series of non-overlapping connection requests leads to repeated,  
quite expensive DLL unload/reload cycles.  We document a workaround  
for that (having the application call WSAStartup for itself), but  
that's just a kluge.  It's also worth noting that it's far from  
uncommon for applications to exit without doing PQfinish, and  
we've not heard reports of trouble from that either.  
  
However, the real reason for acting on this is that recent  
experiments by Alexander Lakhin show that calling WSACleanup  
during PQfinish is triggering the symptom we occasionally see  
that a process using libpq fails to emit expected stdio output.  
  
Therefore, let's change libpq so that it calls WSAStartup only  
once per process, during the first connection attempt, and never  
calls WSACleanup at all.  
  
While at it, get rid of the only other WSACleanup call in our code  
tree, in pg_dump/parallel.c; that presumably is equally useless.  
  
Back-patch of HEAD commit 7d00a6b2d.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 71cb2e43cde69b58cf7bbc7156a61ba4124a8bc3    
  
author   : Heikki Linnakangas <[email protected]>    
date     : Mon, 19 Oct 2020 17:58:38 +0300    
  
committer: Heikki Linnakangas <[email protected]>    
date     : Mon, 19 Oct 2020 17:58:38 +0300    

Commit 028350f619 changed its behavior from "at most" to "exactly", but  
forgot to update the documentation. Backpatch to 9.6.  
  
Patch by Justin Pryzby, per Yaroslav Schekin's report.  
  
Discussion: https://www.postgresql.org/message-id/20201005191922.GE17626%40telsasoft.com  

commit   : ecc173f5d35406ed8e57e5e0cc48cadcad34525f    
  
author   : Magnus Hagander <[email protected]>    
date     : Mon, 19 Oct 2020 13:47:09 +0200    
  
committer: Magnus Hagander <[email protected]>    
date     : Mon, 19 Oct 2020 13:47:09 +0200    

Author: Daniel Gustafsson <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  

commit   : 600c2412f850269b4c81b6f7468ba1c2f4913993    
  
author   : David Rowley <[email protected]>    
date     : Tue, 20 Oct 2020 00:04:03 +1300    
  
committer: David Rowley <[email protected]>    
date     : Tue, 20 Oct 2020 00:04:03 +1300    

In the planner, it was possible, given an extreme enough case containing a  
large number of joins for the number of estimated rows to become infinite.  
This could cause problems in initial_cost_mergejoin() where we perform  
some calculations based on those row estimates.  
  
A problem case, presented by Onder Kalaci showed an Assert failure from  
an Assert checking outerstartsel <= outerendsel.  In his test case this  
was effectively NaN <= Inf, which is false.  The NaN outerstartsel came  
from multiplying the infinite outer_path_rows by 0.0.  
  
In master, this problem was fixed by a90c950fc, however, that fix was too  
invasive for the backbranches.  Here we just relax the Asserts to allow  
them to pass.  The worst that appears to happen from this is that we show  
NaN cost values and infinite row estimates in EXPLAIN.  add_path() would  
have had a hard time doing anything useful with such costs, but that does  
not really matter as if the row estimates were even close to accurate,  
such plan would not complete this side of the heat death of the universe.  
  
Reported-by: Onder Kalaci  
Backpatch: 9.5 to 13  
Discussion: https://postgr.es/m/DM6PR21MB1211FF360183BCA901B27F04D80B0@DM6PR21MB1211.namprd21.prod.outlook.com  

commit   : e8d36f9ece5e48e6252f9ba3dc01c51755036f9a    
  
author   : Michael Paquier <[email protected]>    
date     : Mon, 19 Oct 2020 09:38:06 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Mon, 19 Oct 2020 09:38:06 +0900    

When allocating a EVP context, it would have been possible to leak some  
memory allocated directly by OpenSSL, that PostgreSQL lost track of if  
the initialization of the context allocated failed.  The cleanup can be  
done with EVP_MD_CTX_destroy().  
  
Note that EVP APIs exist since OpenSSL 0.9.7 and we have in the tree  
equivalent implementations for older versions since ce9b75d (code  
removed with 9b7cd59a as of 10~).  However, in 9.5 and 9.6, the existing  
code makes use of EVP_MD_CTX_destroy() and EVP_MD_CTX_create() without  
an equivalent implementation when building the tree with OpenSSL 0.9.6  
or older, meaning that this code is in reality broken with such versions  
since it got introduced in e2838c5.  As we have heard no complains about  
that, it does not seem worth bothering with in 9.5 and 9.6, so I have  
left that out for simplicity.  
  
Author: Michael Paquier  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: 9.5  

commit   : 3f898c986e39ffe88fb6bbedd71a0b7a0e4d1bc7    
  
author   : Tom Lane <[email protected]>    
date     : Sat, 17 Oct 2020 16:02:47 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Sat, 17 Oct 2020 16:02:47 -0400    

Section 8.5.1.4, which defines these literals, made only a vague  
reference to the fact that they might be evaluated too soon to be  
safe in non-interactive contexts.  Provide a more explicit caution  
against misuse.  Also, generalize the wording in the related tip in  
section 9.9.4: while it clearly described this problem, it implied  
(or really, stated outright) that the problem only applies to table  
DEFAULT clauses.  
  
Per gripe from Tijs van Dam.  Back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/c2LuRv9BiRT3bqIo5mMQiVraEXey_25B4vUn0kDqVqilwOEu_iVF1tbtvLnyQK7yDG3PFaz_GxLLPil2SDkj1MCObNRVaac-7j1dVdFERk8=@thalex.com  

commit   : aae4097b082e957a0728f3820cb6163b97267b66    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 16 Oct 2020 21:53:33 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 16 Oct 2020 21:53:33 -0400    

DST law changes in Morocco, Canadian Yukon, Fiji, Macquarie Island,  
Casey Station (Antarctica).  Historical corrections for France,  
Hungary, Monaco.  

commit   : 41eeeb3482bad068b75c24c0f6693b4c8da3f88d    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 16 Oct 2020 21:40:16 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 16 Oct 2020 21:40:16 -0400    

This changes zic's default output format from "-b fat" to "-b slim".  
We were already using "slim" in v13/HEAD, so those branches drop  
the explicit -b switch in the Makefiles.  Instead, add an explicit  
"-b fat" in v12 and before, so that we don't change the output file  
format in those branches.  (This is perhaps excessively conservative,  
but we decided not to do so in a12079109, and I'll stick with that.)  
  
Other non-cosmetic changes are to drop support for zic's long-obsolete  
"-y" switch, and to ensure that strftime() does not change errno  
unless it fails.  
  
As usual with tzcode changes, back-patch to all supported branches.  

commit   : 3e1a4c260ef29249f412f2fcaa66c898d8d0bd7c    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 16 Oct 2020 11:59:13 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 16 Oct 2020 11:59:13 -0400    

In theory, the second px_find_digest call in px_crypt_md5 could fail  
even though the first one succeeded, since resource allocation is  
required.  Don't skip testing for a failure.  (If one did happen,  
the likely result would be a crash rather than clean recovery from  
an OOM failure.)  
  
The code's been like this all along, so back-patch to all supported  
branches.  
  
Daniel Gustafsson  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : bc63c8704676c720266b02e59f861bdeff40e8a4    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 16 Oct 2020 11:36:34 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 16 Oct 2020 11:36:34 -0400    

Commit a97e85f2b caused "exceed the available area" warnings in PDF  
builds.  Fine-tune colwidth values to avoid that.  
  
Back-patch to 9.6, like the prior patch.  (This is of dubious value  
before v13, since we were far from free of such warnings in older  
branches.  But we might as well keep the SGML looking the same in all  
branches.)  
  
Per buildfarm.  

commit   : 6e34cc8ab596bd8c730fe786b068a400b7d502e9    
  
author   : Bruce Momjian <[email protected]>    
date     : Thu, 15 Oct 2020 20:37:19 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Thu, 15 Oct 2020 20:37:19 -0400    

This commit required support for inline variable definition, which is  
not a requirement.  
  
RELEASE NOTE AUTHOR:  the author of commit 3c0471b5fd  
(pg_upgrade/tablespaces) was Justin Pryzby, not me.  
  
Reported-by: Andres Freund  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : 85fedf39f07ecd5f7008eab04d03a4705716d1fe    
  
author   : Bruce Momjian <[email protected]>    
date     : Thu, 15 Oct 2020 19:33:36 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Thu, 15 Oct 2020 19:33:36 -0400    

Previously, if pg_upgrade failed, and the user recreated the cluster but  
did not remove the new cluster tablespace directory, a later pg_upgrade  
would fail since the new tablespace directory would already exists.  
This adds error reporting for this during check.  
  
Reported-by: Justin Pryzby  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : ed4a1c873649b4ababbe5b92ad17e9a29215f168    
  
author   : Bruce Momjian <[email protected]>    
date     : Thu, 15 Oct 2020 15:15:28 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Thu, 15 Oct 2020 15:15:28 -0400    

Previously it wasn't clear exactly what each of the synchronous_commit  
modes accomplished.  This clarifies that, and adds a table describing it.  
Only backpatched through 9.6 since 9.5 doesn't have all the options.  
  
Reported-by: [email protected]  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.6  

commit   : 4e95733b08648dbe6c39600521608bdf0cc80f44    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 15 Oct 2020 12:50:57 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 15 Oct 2020 12:50:57 -0400    

POSIX sigaction(2) can be told to block a set of signals while a  
signal handler executes.  Make use of that instead of manually  
blocking and unblocking signals in the postmaster's signal handlers.  
This should save a few cycles, but more importantly it prevents  
recursive invocation of signal handlers when many signals arrive in  
close succession.  (Assuming that the platform's signal infrastructure  
is designed to avoid consuming stack space in that case, but this is  
demonstrably true at least on Linux.)  The existing code has been seen  
to recurse to the point of stack overflow, either in the postmaster  
or in a forked-off child.  
  
Back-patch of commit 9abb2bfc0.  At the time, we'd only seen excess  
postmaster stack consumption in the buildfarm; but we now have a  
user report of it, and that commit has aged enough to have a fair  
amount of confidence that it doesn't break anything.  
  
This still doesn't change anything about the way that it works on  
Windows.  Perhaps someone else would like to fix that?  
  
Per bug #16673 from David Geier.  Back-patch to 9.6.  Although  
the problem exists in principle before that, we've only seen it  
actually materialize in connection with heavy use of parallel  
workers, so it doesn't seem necessary to do anything in 9.5;  
and the relevant code is different there, too.  
  
Discussion: https://postgr.es/m/[email protected]  
Discussion: https://postgr.es/m/[email protected]  

commit   : a5c77e6b8cd59949c6443d1371e5c420d1f07bc2    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 12 Oct 2020 13:31:24 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 12 Oct 2020 13:31:24 -0400    

The prohibitValueChange code paths in set_config_option(), which  
are executed whenever we re-read a PGC_POSTMASTER variable from  
postgresql.conf, neglected to free anything before exiting.  Thus  
we'd leak the proposed new value of a PGC_STRING variable, as noted  
by BoChen in bug #16666.  For all variable types, if the check hook  
creates an "extra" chunk, we'd also leak that.  
  
These are malloc not palloc chunks, so there is no mechanism for  
recovering the leaks before process exit.  Fortunately, the values  
are typically not very large, meaning you'd have to go through an  
awful lot of SIGHUP configuration-reload cycles to make the leakage  
amount to anything.  Still, for a long-lived postmaster process it  
could potentially be a problem.  
  
Oversight in commit 2594cf0e8.  Back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 9f3d3fb8702b51f028280b36f8d9abbdd253dc41    
  
author   : Tom Lane <[email protected]>    
date     : Wed, 7 Oct 2020 18:41:39 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Wed, 7 Oct 2020 18:41:39 -0400    

It appears that commit cf63c641c, which intended to prevent  
misoptimization of the result-building step in makeOrderedSetArgs,  
didn't go far enough: buildfarm member hornet's version of xlc  
is now optimizing back to the old, broken behavior in which  
list_length(directargs) is fetched only after list_concat() has  
changed that value.  I'm not entirely convinced whether that's  
an undeniable compiler bug or whether it can be justified by a  
sufficiently aggressive interpretation of C sequence points.  
So let's just change the code to make it harder to misinterpret.  
  
Back-patch to all supported versions, just in case.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 0c79dcb36c525234f1ffbab601f6f9716b8ca43a    
  
author   : Tom Lane <[email protected]>    
date     : Wed, 7 Oct 2020 12:50:55 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Wed, 7 Oct 2020 12:50:55 -0400    

Commit 3eb3d3e78 was a few bricks shy of a load: while it correctly  
set the table's "interesting" flag when deciding to dump the data of  
an extension config table, it was not correct to clear that flag  
if we concluded we shouldn't dump the data.  This led to the crash  
reported in bug #16655, because in fact we'll traverse dumpTableSchema  
anyway for all extension tables (to see if they have user-added  
seclabels or RLS policies).  
  
The right thing to do is to force "interesting" true in makeTableDataInfo,  
and otherwise leave the flag alone.  (Doing it there is more future-proof  
in case additional calls are added, and it also avoids setting the flag  
unnecessarily if that function decides the table is non-dumpable.)  
  
This investigation also showed that while only the --inserts code path  
had an obvious failure in the case considered by 3eb3d3e78, the COPY  
code path also has a problem with not having loaded table subsidiary  
data.  That causes fmtCopyColumnList to silently return an empty string  
instead of the correct column list.  That accidentally mostly works,  
which perhaps is why we didn't notice this before.  It would only fail  
if the restore column order is different from the dump column order,  
which only happens in weird inheritance cases, so it's not surprising  
nobody had hit the case with an extension config table.  Nonetheless,  
it's a bug, and it goes a long way back, not just to v12 where the  
--inserts code path started to have a problem with this.  
  
In hopes of catching such cases a bit sooner in future, add some  
Asserts that "interesting" has been set in both dumpTableData and  
dumpTableSchema.  Adjust the test case added by 3eb3d3e78 so that it  
checks the COPY rather than INSERT form of that bug, allowing it to  
detect the longer-standing symptom.  
  
Per bug #16655 from Cameron Daniel.  Back-patch to all supported  
branches.  
  
Discussion: https://postgr.es/m/[email protected]  
Discussion: https://postgr.es/m/[email protected]  

commit   : 957a78222071732f53d45f64ab6d655a27e65f65    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 6 Oct 2020 14:31:21 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 6 Oct 2020 14:31:21 -0400    

We only support upgrading from >= 8.4 so no need for this code or tests.  
  
Reported-by: Magnus Hagander  
  
Discussion: https://postgr.es/m/CABUevEx-D0PNVe00tkeQRGennZQwDtBJn=493MJt-x6sppbUxA@mail.gmail.com  
  
Backpatch-through: 9.5  

commit   : f09e2a8c6307058aa767924516bb057cc9cedef8    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 6 Oct 2020 12:12:09 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 6 Oct 2020 12:12:09 -0400    

This makes checking for older major versions more consistent.  
  
Backpatch-through: 9.5  

commit   : 9e2c53d4c8dfa9cd9f72282509ff1c7c466273b0    
  
author   : Bruce Momjian <[email protected]>    
date     : Mon, 5 Oct 2020 16:27:33 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Mon, 5 Oct 2020 16:27:33 -0400    

Previously it was unclear exactly how ROWS FROM behaved and how to cast  
the data types of columns returned by FROM functions.  Also document  
that only non-OUT record functions can have their columns cast to data  
types.  
  
Reported-by: [email protected]  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : 74dae41e5ac39c41c902119c2101c80d400c0718    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 5 Oct 2020 13:15:39 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 5 Oct 2020 13:15:39 -0400    

get_eclass_for_sort_expr() computes expr_relids and nullable_relids  
early on, even though they won't be needed unless we make a new  
EquivalenceClass, which we often don't.  Aside from the probably-minor  
inefficiency, there's a memory management problem: these bitmapsets will  
be built in the caller's context, leading to dangling pointers if that  
is shorter-lived than root->planner_cxt.  This would be a live bug if  
get_eclass_for_sort_expr() could be called with create_it = true during  
GEQO join planning.  So far as I can find, the core code never does  
that, but it's hard to be sure that no extensions do, especially since  
the comments make it clear that that's supposed to be a supported case.  
Fix by not computing these values until we've switched into planner_cxt  
to build the new EquivalenceClass.  
  
generate_join_implied_equalities() uses inner_rel->relids to look up  
relevant eclasses, but it ought to be using nominal_inner_relids.  
This is presently harmless because a child RelOptInfo will always have  
exactly the same eclass_indexes as its topmost parent; but that might  
not be true forever, and anyway it makes the code confusing.  
  
The first of these is old (introduced by me in f3b3b8d5b), so back-patch  
to all supported branches.  The second only dates to v13, but we might  
as well back-patch it to keep the code looking similar across branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : db7c7b88d00b615f203a4984ef0d01c5e2e46a33    
  
author   : Tom Lane <[email protected]>    
date     : Sun, 4 Oct 2020 20:45:06 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Sun, 4 Oct 2020 20:45:06 -0400    

I noticed while trying to run the regression tests under a low  
geqo_threshold that one query on information_schema.columns had  
unstable (as in, variable from one run to the next) output order.  
This is pretty unsurprising given the complexity of the underlying  
plan.  Interestingly, of this test's three nigh-identical queries on  
information_schema.columns, the other two already had ORDER BY clauses  
guaranteeing stable output.  Let's make this one look the same.  
  
Back-patch to v10 where this test was added.  We've not heard field  
reports of the test failing, but this experience shows that it can  
happen when testing under even slightly unusual conditions.  

commit   : 65aa18e85a0557e68d0e7464cc2ea8d417f3e577    
  
author   : Bruce Momjian <[email protected]>    
date     : Fri, 2 Oct 2020 22:19:30 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Fri, 2 Oct 2020 22:19:30 -0400    

Reported-by: Alexander Lakhin  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : 934bb65fdf3c03c981d6a2ff2bfa93bf7bb463f6    
  
author   : Bruce Momjian <[email protected]>    
date     : Fri, 2 Oct 2020 21:39:33 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Fri, 2 Oct 2020 21:39:33 -0400    

Reported-by: [email protected]  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : 26f4c14d7bcf53c4674055e53e69d94801ed8f68    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 1 Oct 2020 10:59:20 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 1 Oct 2020 10:59:20 -0400    

Commit 151c0c5f7 neglected the possibility that a TEMP_CONFIG file  
would explicitly set max_wal_senders=0; as indeed buildfarm member  
thorntail does, so that it can test wal_level=minimal in other test  
suites.  Hence, rather than assuming that max_wal_senders=10 will  
prevail if we say nothing, set it explicitly.  
  
Set max_replication_slots=10 explicitly too, just to be safe.  
  
Back-patch to v10, like the previous patch.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 3ae6ed9187bcd285eb8c099ea90dff8b09086e9a    
  
author   : Heikki Linnakangas <[email protected]>    
date     : Thu, 1 Oct 2020 11:48:48 +0300    
  
committer: Heikki Linnakangas <[email protected]>    
date     : Thu, 1 Oct 2020 11:48:48 +0300    

This has been wrong ever since the support for multi-dimensional  
arrays as PL/python function arguments and return values was  
introduced in commit 94aceed317.  
  
Backpatch-through: 10  
Discussion: https://www.postgresql.org/message-id/61647b8e-961c-0362-d5d3-c8a18f4a7ec6%40iki.fi  

commit   : db96be24ce32b70e24ac395213d23c4fec02e4de    
  
author   : Tom Lane <[email protected]>    
date     : Wed, 30 Sep 2020 15:40:23 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Wed, 30 Sep 2020 15:40:23 -0400    

Previously, a conversion such as  
	to_date('-44-02-01','YYYY-MM-DD')  
would result in '0045-02-01 BC', as the code attempted to interpret  
the negative year as BC, but failed to apply the correction needed  
for our internal handling of BC years.  Fix the off-by-one problem.  
  
Also, arrange for the combination of a negative year and an  
explicit "BC" marker to cancel out and produce AD.  This is how  
the negative-century case works, so it seems sane to do likewise.  
  
Continue to read "year 0000" as 1 BC.  Oracle would throw an error,  
but we've accepted that case for a long time so I'm hesitant to  
change it in a back-patch.  
  
Per bug #16419 from Saeed Hubaishan.  Back-patch to all supported  
branches.  
  
Dar Alathar-Yemen and Tom Lane  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 071b2f738e37a876406db39f2aa1692106d4e400    
  
author   : Tom Lane <[email protected]>    
date     : Tue, 29 Sep 2020 20:02:58 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Tue, 29 Sep 2020 20:02:58 -0400    

PostgresNode.pm set "max_wal_senders = 5" for replication testing,  
but this seems to be slightly too low for our current test suite.  
Slower buildfarm members frequently report "number of requested standby  
connections exceeds max_wal_senders" failures, due to old walsenders  
not exiting instantaneously.  Usually, the test does not fail overall  
because of automatic walreceiver restart, but sometimes the failure  
becomes visible; and in any case such retries slow down the test.  
  
That value came in with commit 89ac7004d, but was soon obsoleted by  
f6d6d2920, which raised the built-in default from zero to 10; so that  
PostgresNode.pm is actually setting it to less than the conservative  
built-in default.  That seems pretty pointless, so let's remove the  
special setting and let the default prevail, in hopes of making  
the TAP tests more robust.  
  
Likewise, the setting "max_replication_slots = 5" is obsolete and  
can be removed.  
  
While here, reverse-engineer a comment about why we're choosing  
less-than-default values for some other settings.  
  
(Note: before v12, max_wal_senders counted against max_connections  
so that the latter setting also needs some fiddling with.)  
  
Back-patch to v10 where the subscription tests were added.  
It's likely that the older branches aren't pushing the boundaries  
of max_wal_senders, but I'm disinclined to spend time trying to  
figure out exactly when it started to be a problem.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 33441753820b4695523ce29ddec0465d6552f087    
  
author   : Fujii Masao <[email protected]>    
date     : Tue, 29 Sep 2020 16:21:46 +0900    
  
committer: Fujii Masao <[email protected]>    
date     : Tue, 29 Sep 2020 16:21:46 +0900    

Previously the standby server didn't archive timeline history files  
streamed from the primary even when archive_mode is set to "always",  
while it archives the streamed WAL files. This could cause the PITR to  
fail because there was no required timeline history file in the archive.  
The cause of this issue was that walreceiver didn't mark those files as  
ready for archiving.  
  
This commit makes walreceiver mark those streamed timeline history  
files as ready for archiving if archive_mode=always. Then the archiver  
process archives the marked timeline history files.  
  
Back-patch to all supported versions.  
  
Reported-by: Grigory Smolkin  
Author: Grigory Smolkin, Fujii Masao  
Reviewed-by: David Zhang, Anastasia Lubennikova  
Discussion: https://postgr.es/m/[email protected]  

commit   : de6725debd00504fa71a43f718acb26bb045b07f    
  
author   : Tom Lane <[email protected]>    
date     : Sat, 26 Sep 2020 16:04:06 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Sat, 26 Sep 2020 16:04:06 -0400    

This function leaked some memory while loading qual clauses for  
an RLS policy.  While ordinarily negligible, that could build up  
in some repeated-reload cases, as reported by Konstantin Knizhnik.  
We can improve matters by borrowing the coding long used in  
RelationBuildRuleLock: build stringToNode's result directly in  
the target context, and remember to explicitly pfree the  
input string.  
  
This patch by no means completely guarantees zero leaks within  
this function, since we have no real guarantee that the catalog-  
reading subroutines it calls don't leak anything.  However,  
practical tests suggest that this is enough to resolve the issue.  
In any case, any remaining leaks are similar to those risked by  
RelationBuildRuleLock and other relcache-loading subroutines.  
If we need to fix them, we should adopt a more global approach  
such as that used by the RECOVER_RELATION_BUILD_MEMORY hack.  
  
While here, let's remove the need for an expensive PG_TRY block by  
using MemoryContextSetParent to reparent an initially-short-lived  
context for the RLS data.  
  
Back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 1888ff8d0d5ed018b4b557a1b92acc0327a81692    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 24 Sep 2020 18:19:39 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 24 Sep 2020 18:19:39 -0400    

Parallel pg_dump failed if its -d parameter was a connection string  
containing any essential information other than host, port, or username.  
The same was true for pg_restore with --create.  
  
The reason is that these scenarios failed to preserve the connection  
string from the command line; the code felt free to replace that with  
just the database name when reconnecting from a pg_dump parallel worker  
or after creating the target database.  By chance, parallel pg_restore  
did not suffer this defect, as long as you didn't say --create.  
  
In practice it seems that the error would be obvious only if the  
connstring included essential, non-default SSL or GSS parameters.  
This may explain why it took us so long to notice.  (It also makes  
it very difficult to craft a regression test case illustrating the  
problem, since the test would fail in builds without those options.)  
  
Fix by refactoring so that ConnectDatabase always receives all the  
relevant options directly from the command line, rather than  
reconstructed values.  Inject a different database name, when necessary,  
by relying on libpq's rules for handling multiple "dbname" parameters.  
  
While here, let's get rid of the essentially duplicate _connectDB  
function, as well as some obsolete nearby cruft.  
  
Per bug #16604 from Zsolt Ero.  Back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : dd36d6b0038928a0aa05b1847a7a44ff136349de    
  
author   : Thomas Munro <[email protected]>    
date     : Thu, 24 Sep 2020 09:26:09 +1200    
  
committer: Thomas Munro <[email protected]>    
date     : Thu, 24 Sep 2020 09:26:09 +1200    

Harmonize behavior by moving reponsibility for fsyncing directories down  
into slru.c.  In 10 and later, only the multixact directories were  
missed (see commit 1b02be21), and in older branches all SLRUs were  
missed.  
  
Back-patch to all supported releases.  
  
Reviewed-by: Andres Freund <[email protected]>  
Reviewed-by: Michael Paquier <[email protected]>  
Discussion: https://postgr.es/m/CA%2BhUKGLtsTUOScnNoSMZ-2ZLv%2BwGh01J6kAo_DM8mTRq1sKdSQ%40mail.gmail.com  

commit   : b91033ae9bc50a2d93656a128eb469bbfaec82a5    
  
author   : Tom Lane <[email protected]>    
date     : Wed, 23 Sep 2020 11:36:13 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Wed, 23 Sep 2020 11:36:13 -0400    

tsearch_readline() saves the string pointer it returns to the caller  
for possible use in the associated error context callback.  However,  
the caller will usually pfree that string sometime before it next  
calls tsearch_readline(), so that there is a window where an ereport  
will try to print an already-freed string.  
  
The built-in users of tsearch_readline() happen to all do that pfree  
at the bottoms of their loops, so that the window is effectively  
empty for them.  However, this is not documented as a requirement,  
and contrib/dict_xsyn doesn't do it like that, so it seems likely  
that third-party dictionaries might have live bugs here.  
  
The practical consequences of this seem pretty limited in any case,  
since production builds wouldn't clobber the freed string immediately,  
besides which you'd not expect syntax errors in dictionary files  
being used in production.  Still, it's clearly a bug waiting to bite  
somebody.  
  
Fix by pstrdup'ing the string to be saved for the error callback,  
and then pfree'ing it next time through.  It's been like this for  
a long time, so back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : a950fb0734267ebdc48e3a03b234b42f81135a9e    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 18 Sep 2020 18:03:44 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 18 Sep 2020 18:03:44 -0400    

These two SQL functions are aliases for the same C function, so this  
change has no semantic effect.  However, because we dropped the  
numeric_fac alias in HEAD (commit 76f412ab3), operator definitions  
based on that one don't port forward, causing problems for cross-version  
upgrade tests based on the regression database.  
  
Patch all active back branches to dodge the problem.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : fcc3665a03a644204d0a3fdf8ec138e3ec93e593    
  
author   : Amit Kapila <[email protected]>    
date     : Thu, 17 Sep 2020 15:16:46 +0530    
  
committer: Amit Kapila <[email protected]>    
date     : Thu, 17 Sep 2020 15:16:46 +0530    

For parallel btree scan to work for array of scan keys, it should reach  
BTPARALLEL_DONE state once for every distinct combination of array keys.  
This is required to ensure that the parallel workers don't try to seize  
blocks at the same time for different scan keys. We missed to update this  
state when we discovered that the scan keys can't be satisfied.  
  
Author: James Hunter  
Reviewed-by: Amit Kapila  
Tested-by: Justin Pryzby  
Backpatch-through: 10, where it was introduced  
Discussion: https://postgr.es/m/[email protected]  

commit   : d6d70f89a6f93dfd72b95ed840b0eb9089a48531    
  
author   : Tom Lane <[email protected]>    
date     : Wed, 16 Sep 2020 12:07:31 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Wed, 16 Sep 2020 12:07:31 -0400    

The code recorded cache invalidation events by zeroing the "localreloid"  
field of affected cache entries.  However, it's possible for an inval  
event to occur even while we have the entry open and locked.  So an  
ill-timed inval could result in "cache lookup failed for relation 0"  
errors, if the worker's code tried to use the cleared field.  We can  
fix that by creating a separate bool field to record whether the entry  
needs to be revalidated.  (In the back branches, cram the bool into  
what had been padding space, to avoid an ABI break in the somewhat  
unlikely event that any extension is looking at this struct.)  
  
Also, rearrange the logic in logicalrep_rel_open so that it  
does the right thing in cases where table_open would fail.  
We should retry the lookup by name in that case, but we didn't.  
  
The real-world impact of this is probably small.  In the first place,  
the error conditions are very low probability, and in the second place,  
the worker would just exit and get restarted.  We only noticed because  
in a CLOBBER_CACHE_ALWAYS build, the failure can occur repeatedly,  
preventing the worker from making progress.  Nonetheless, it's clearly  
a bug, and it impedes a useful type of testing; so back-patch to v10  
where this code was introduced.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : b6a5b766b3e5b7bd25e9d0db60a60657df2aa97e    
  
author   : Noah Misch <[email protected]>    
date     : Sun, 13 Sep 2020 23:13:44 -0700    
  
committer: Noah Misch <[email protected]>    
date     : Sun, 13 Sep 2020 23:13:44 -0700    

The test failed when something added WAL between pg_switch_wal() and  
pg_current_wal_lsn(), seen on buildfarm members hornet and sungazer.  
Fix v10, v9.6 and v9.5 by making this code mirror its v13+ counterpart.  
v12 and v11 lack a counterpart.  

commit   : 783a21eff37ec2cbe44b6e88aa4edb15a151155e    
  
author   : Tom Lane <[email protected]>    
date     : Sun, 13 Sep 2020 12:51:21 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Sun, 13 Sep 2020 12:51:21 -0400    

transformCreateStmt() adjusts the transformed statement's RangeVar  
to specify the target schema explicitly, for the express reason  
of making sure that auxiliary statements derived by parse  
transformation operate on the right table.  But the refactoring  
I did in commit 502898192 got this wrong and passed the untransformed  
RangeVar to expandTableLikeClause().  This could lead to assertion  
failures or weird misbehavior if the wrong table was accessed.  
  
Per report from Alexander Lakhin.  Like the previous patch, back-patch  
to all supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 1a7c5b6f7b5a18ace8199aba35b25ffd37053450    
  
author   : Peter Eisentraut <[email protected]>    
date     : Sun, 6 Sep 2020 16:46:13 +0200    
  
committer: Peter Eisentraut <[email protected]>    
date     : Sun, 6 Sep 2020 16:46:13 +0200    

The original stylesheets seemed to think this was a good idea, but our  
users find it confusing and unhelpful, so undo that logic.  
  
Reported-by: Fabien COELHO <[email protected]>  
Discussion: https://www.postgresql.org/message-id/flat/alpine.DEB.2.22.394.2006210914370.859381%40pseudo  

commit   : ac695b8f2d11604d83a1d0cd45b524314eb58b97    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 10 Sep 2020 12:06:26 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 10 Sep 2020 12:06:26 -0400    

Bring the signal handling for startup-packet collection into line  
with the policy established in commits bedadc732 and 8e19a8264,  
namely don't risk running atexit callbacks when handling SIGQUIT.  
  
Ideally, we'd not do so for SIGTERM or timeout interrupts either,  
but that change seems a bit too risky for the back branches.  
For now, just improve the comments in this area to describe the risk.  
  
Also relocate where BackendInitialize re-disables these interrupts,  
to minimize the code span where they're active.  This doesn't buy  
a whole lot of safety, but it can't hurt.  
  
In passing, rename startup_die() to remove confusion about whether  
it is for the startup process.  
  
Like the previous commits, back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : ddbb18743fd15bd8b17551ca79f3dc79dd1398d2    
  
author   : Peter Eisentraut <[email protected]>    
date     : Thu, 10 Sep 2020 15:31:09 +0200    
  
committer: Peter Eisentraut <[email protected]>    
date     : Thu, 10 Sep 2020 15:31:09 +0200    

We have had multiple reports that point to the  
'@colReorder=latn-digit' collation customization being buggy.  We have  
reported this to ICU and are waiting for a fix.  In the meantime,  
remove references to this from the documentation and replace it by  
another reordering example.  Apparently, many users have been picking  
up this example specifically from the documentation.  
  
Author: Jehan-Guillaume de Rorthais <[email protected]>  
Discussion: https://www.postgresql.org/message-id/flat/153201618542.1404.3611626898935613264%40wrigleys.postgresql.org  

commit   : a9d6f7466d393fef209598a72a6c32b092371bd9    
  
author   : Magnus Hagander <[email protected]>    
date     : Thu, 10 Sep 2020 14:15:26 +0200    
  
committer: Magnus Hagander <[email protected]>    
date     : Thu, 10 Sep 2020 14:15:26 +0200    

Reported-by: Robert Kahlert  
Author: Daniel Gustafsson  

commit   : d56d33052183ca57c5a91e16f8c7713903cc6fee    
  
author   : Michael Paquier <[email protected]>    
date     : Thu, 10 Sep 2020 15:50:54 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Thu, 10 Sep 2020 15:50:54 +0900    

Some comments are fixed while on it.  
  
Author: Justin Pryzby  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: 9.6  

commit   : 95cd8902e62d5ff508be7430ecfce87b3b3475f7    
  
author   : Tom Lane <[email protected]>    
date     : Wed, 9 Sep 2020 15:32:34 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Wed, 9 Sep 2020 15:32:34 -0400    

Commit 8e19a8264 changed the SIGQUIT handlers of almost all server  
processes not to run atexit callbacks.  The archiver process was  
skipped, perhaps because it's not connected to shared memory; but  
it's just as true here that running atexit callbacks in a signal  
handler is unsafe.  So let's make it work like the rest.  
  
In HEAD and v13, we can use the common SignalHandlerForCrashExit  
handler.  Before that, just tweak pgarch_exit to use _exit(2)  
explicitly.  
  
Like the previous commit, back-patch to all supported branches.  
  
Kyotaro Horiguchi, back-patching by me  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : f71b93b8646b2c85a62415ea54e0a7fbadd339a6    
  
author   : Tom Lane <[email protected]>    
date     : Sun, 6 Sep 2020 12:55:13 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Sun, 6 Sep 2020 12:55:13 -0400    

We reported the wrong types when complaining that an aggregate's  
moving-aggregate implementation is inconsistent with its regular  
implementation.  
  
This was wrong since the feature was introduced, so back-patch  
to all supported branches.  
  
Jeff Janes  
  
Discussion: https://postgr.es/m/CAMkU=1x808LH=LPhZp9mNSP0Xd1xDqEd+XeGcvEe48dfE6xV=A@mail.gmail.com  

commit   : 7d60e4183013c8b1316daf4ec0d08ef245d3b92c    
  
author   : Tom Lane <[email protected]>    
date     : Sun, 6 Sep 2020 11:50:41 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Sun, 6 Sep 2020 11:50:41 -0400    

This is duplicative of an lstat that was just done by the calling  
function (traverse_datadir), besides which we weren't really doing  
anything with the results.  There's not much point in checking to  
see if someone removed the file since the previous lstat, since the  
FILE_ACTION_REMOVE code would have to deal with missing-file cases  
anyway.  Moreover, the "exists = false" assignment was a dead store;  
nothing was done with that value later.  
  
A syscall saved is a syscall earned, so back-patch to 9.5  
where this code was introduced.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 546479f34f5c960494687f5808eb7b3d054478a1    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 4 Sep 2020 21:01:59 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 4 Sep 2020 21:01:59 -0400    

I happened to notice that the new test case I added in b55b4dad9  
falls over if one runs "make check" repeatedly; though not in branches  
after v10.  That's because it was assuming that tmp_check/pgpass  
wouldn't exist already.  However, it's only been since v11 that the  
Makefiles forcibly remove all of tmp_check/ before starting a TAP run.  
This fix to unlink the file is therefore strictly necessary only in  
v10 ... but it seems wisest to do it across the board, rather than  
let the test rely on external logic to get the conditions right.  

commit   : 9b8a8516ed2e4268026a826c5e9b768f88aa67aa    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 4 Sep 2020 20:20:06 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 4 Sep 2020 20:20:06 -0400    

Commit 3f60f690f only partially fixed the broken-status-tracking  
issue in LogicalRepApplyLoop: we need ping_sent to have the same  
lifetime as last_recv_timestamp.  The effects are much less serious  
than what that commit fixed, though.  AFAICS this would just lead to  
extra ping requests being sent, once per second until the sender  
responds.  Still, it's a bug, so backpatch to v10 as before.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 63abf9ad9b41f91a96d6eb9bc1c0c49877f1d854    
  
author   : Bruce Momjian <[email protected]>    
date     : Fri, 4 Sep 2020 13:27:52 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Fri, 4 Sep 2020 13:27:52 -0400    

Reported-by: Kelly Min  
  
Discussion: https://postgr.es/m/CAPSbxatOiQO90LYpSC3+svAU9-sHgDfEP4oFhcEUt_X=DqFA9g@mail.gmail.com  
  
Backpatch-through: 9.5  

commit   : 44f4986dd96bca9d847ccde9ee9428bd9901810b    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 4 Sep 2020 12:40:28 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 4 Sep 2020 12:40:28 -0400    

The "DROP ACCESS METHOD gist2" test will require locking the index  
to be dropped and then its table; while most ordinary operations  
lock a table first then its index.  While no concurrent test scripts  
should be touching fast_emp4000, autovacuum might chance to be  
processing that table when the DROP runs, resulting in a deadlock  
failure.  This is pretty rare but we see it in the buildfarm from  
time to time.  
  
To fix, acquire a lock on fast_emp4000 before issuing the DROP.  
  
Since the point of the exercise is mostly to prevent buildfarm  
failures, back-patch to 9.6 where this test was introduced.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 2a938c7935cf838b99b2017c5f86f9435ad9ad7e    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 3 Sep 2020 16:52:09 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 3 Sep 2020 16:52:09 -0400    

Because sigsetjmp() will restore the initial state with signals blocked,  
the code path in bgworker.c for reporting an error and exiting would  
execute that way.  Usually this is fairly harmless; but if a parallel  
worker had an error message exceeding the shared-memory communication  
buffer size (16K) it would lock up, because it would wait for a  
resume-sending signal from its parallel leader which it would never  
detect.  
  
To fix, just unblock signals at the appropriate point.  
  
This can be shown to fail back to 9.6.  The lack of parallel query  
infrastructure makes it difficult to provide a simple test case for  
9.5; but I'm pretty sure the issue exists in some form there as well,  
so apply the code change there too.  
  
Vignesh C, reviewed by Bharath Rupireddy, Robert Haas, and myself  
  
Discussion: https://postgr.es/m/CALDaNm1d1hHPZUg3xU4XjtWBOLCrA+-2cJcLpw-cePZ=GgDVfA@mail.gmail.com  

commit   : 579a022ca1852ef8923c8f9bb27cb9de216444ef    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 1 Sep 2020 17:00:10 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 1 Sep 2020 17:00:10 -0400    

Previous wording was "between".  
  
Reported-by: Pavel Luzanov  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : 0c0a3a8591d864305af3dd5d764ec512eb2a42d9    
  
author   : Tom Lane <[email protected]>    
date     : Tue, 1 Sep 2020 13:14:44 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Tue, 1 Sep 2020 13:14:44 -0400    

Historically there's been a hard-wired assumption here that no line of  
a .pgpass file could be as long as NAMEDATALEN*5 bytes.  That's a bit  
shaky to start off with, because (a) there's no reason to suppose that  
host names fit in NAMEDATALEN, and (b) this figure fails to allow for  
backslash escape characters.  However, it fails completely if someone  
wants to use a very long password, and we're now hearing reports of  
people wanting to use "security tokens" that can run up to several  
hundred bytes.  Another angle is that the file is specified to allow  
comment lines, but there's no reason to assume that long comment lines  
aren't possible.  
  
Rather than guessing at what might be a more suitable limit, let's  
replace the fixed-size buffer with an expansible PQExpBuffer.  That  
adds one malloc/free cycle to the typical use-case, but that's surely  
pretty cheap relative to the I/O this code has to do.  
  
Also, add TAP test cases to exercise this code, because there was no  
test coverage before.  
  
This reverts most of commit 2eb3bc588, as there's no longer a need for  
a warning message about overlength .pgpass lines.  (I kept the explicit  
check for comment lines, though.)  
  
In HEAD and v13, this also fixes an oversight in 74a308cf5: there's not  
much point in explicit_bzero'ing the line buffer if we only do so in two  
of the three exit paths.  
  
Back-patch to all supported branches, except that the test case only  
goes back to v10 where src/test/authentication/ was added.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : ffc61f865b9164fb99dc1732979ffca1d99f2a7d    
  
author   : Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 18:33:37 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 18:33:37 -0400    

This follows the American format,  
https://jakubmarian.com/comma-after-i-e-and-e-g/. There is no intention  
of requiring this format for future text, but making existing text  
consistent every few years makes sense.  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : 7d26d85f1b95806985cbc739428f929204d85256    
  
author   : Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 17:51:31 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 17:51:31 -0400    

Reported-by: Antonin Houska  
  
Discussion: https://postgr.es/m/21643.1595353537@antos  
  
Backpatch-through: 9.5  

commit   : cada05eb6c2d8effb705ef23dad59ca27f24c9c3    
  
author   : Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 17:36:22 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 17:36:22 -0400    

Also mention files included by postgresql.conf.  
  
Reported-by: Álvaro Herrera  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : 6d33681f57bb183821268d82a97e3fa5a36f5cf6    
  
author   : Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 17:05:53 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 17:05:53 -0400    

It is an int64.  
  
Reported-by: [email protected]  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : 33b8fa758609baad630361afce69fde1e53fbc74    
  
author   : Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 16:59:58 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 16:59:58 -0400    

There is an file-fdw example that reads the server config file, so cross  
link them.  
  
Reported-by: Oleg Samoilov  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : 0756921abeb8344dc4ca05b58016f71dddbe2ec9    
  
author   : Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 16:21:03 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 16:21:03 -0400    

Specifically, explain the v3_ca openssl specification.  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : f6679e0b4b435d2f9977bf0d03d10cf6c908c3e1    
  
author   : Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 15:23:18 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 15:23:18 -0400    

For PG, "durable storage" has a clear meaning, while "stable storage"  
does not, so use the former.  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : 663292eec56ec73e9701ae28c834eb60d7681050    
  
author   : Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 13:49:17 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 13:49:17 -0400    

It wasn't clear the non-integers are cast to integers for subscripting,  
rather than throwing an error.  
  
Reported-by: [email protected]  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : d9f488dc76dde5ed30a3c02d17dbbbad8f3ed0b6    
  
author   : Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 13:43:04 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Mon, 31 Aug 2020 13:43:04 -0400    

Adds constraints and improves wording.  
  
Reported-by: [email protected]  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : 1b694b70c05485d9dfc2e57cfec48d80caa6bea6    
  
author   : Magnus Hagander <[email protected]>    
date     : Mon, 31 Aug 2020 13:03:54 +0200    
  
committer: Magnus Hagander <[email protected]>    
date     : Mon, 31 Aug 2020 13:03:54 +0200    

It has always (since the first commit) worked with relative paths, so  
use the same wording as other parts of the documentation.  
  
Author: Bruce Momjian  
Discussion: https://postgr.es/m/CABUevExx-hm=cit+A9LeKBH39srvk8Y2tEZeEAj5mP8YfzNKUg@mail.gmail.com  

commit   : 1f38d385119002e060a1beb8fb54e63e87939216    
  
author   : Tom Lane <[email protected]>    
date     : Sun, 30 Aug 2020 16:03:19 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Sun, 30 Aug 2020 16:03:19 -0400    

Back-patch key parts of 4c5cf5431 and 6ca547cf7 into stable branches.  
I didn't touch pg_description entries here, so it's purely a docs  
change; and I didn't fool with any examples either.  The main point  
is so that anyone who's wondering if factorial() exists in the stable  
branches will be reassured.  
  
Mark Dilger and John Naylor, with some adjustments by me  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 0d3ad65404c00d1821de532774e0460e6312978e    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 27 Aug 2020 17:36:13 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 27 Aug 2020 17:36:13 -0400    

collectMatchBitmap() needs to re-find the index tuple it was previously  
looking at, after transiently dropping lock on the index page it's on.  
The tuple should still exist and be at its prior position or somewhere  
to the right of that, since ginvacuum never removes tuples but  
concurrent insertions could add one.  However, there was a thinko in  
that logic, to the effect of expecting any inserted tuples to have the  
same index "attnum" as what we'd been scanning.  Since there's no  
physical separation of tuples with different attnums, it's not terribly  
hard to devise scenarios where this fails, leading to transient "lost  
saved point in index" errors.  (While I've duplicated this with manual  
testing, it seems impossible to make a reproducible test case with our  
available testing technology.)  
  
Fix by just continuing the scan when the attnum doesn't match.  
  
While here, improve the error message used if we do fail, so that it  
matches the wording used in btree for a similar case.  
  
collectMatchBitmap()'s posting-tree code path was previously not  
exercised at all by our regression tests.  While I can't make  
a regression test that exhibits the bug, I can at least improve  
the code coverage here, so do that.  The test case I made for this  
is an extension of one added by 4b754d6c1, so it only works in  
HEAD and v13; didn't seem worth trying hard to back-patch it.  
  
Per bug #16595 from Jesse Kinkead.  This has been broken since  
multicolumn capability was added to GIN (commit 27cb66fdf),  
so back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 9cbbf07fdd33ecff1dc3159a16f8a2f5b4d80c9e    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 25 Aug 2020 09:53:12 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 25 Aug 2020 09:53:12 -0400    

They are not "requested" by the server.  
  
Reported-by: Kyotaro Horiguchi  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 9.5  

commit   : 6fa403e61241bea60db83ce13ebcea7d6dda3024    
  
author   : Tom Lane <[email protected]>    
date     : Sat, 22 Aug 2020 14:46:40 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Sat, 22 Aug 2020 14:46:40 -0400    

The trouble with doing this is that an apparently-constant subquery  
output column isn't really constant if it is a grouping column that  
appears in only some of the grouping sets.  A qual using such a  
column would be subject to incorrect const-folding after push-down,  
as seen in bug #16585 from Paul Sivash.  
  
To fix, just disable qual pushdown altogether if the sub-query has  
nonempty groupingSets.  While we could imagine far less restrictive  
solutions, there is not much point in working harder right now,  
because subquery_planner() won't move HAVING clauses to WHERE within  
such a subquery.  If the qual stays in HAVING it's not going to be  
a lot more useful than if we'd kept it at the outer level.  
  
Having said that, this restriction could be removed if we used a  
parsetree representation that distinguished such outputs from actual  
constants, which is something I hope to do in future.  Hence, make  
the patch a minimal addition rather than integrating it more tightly  
(e.g. by renumbering the existing items in subquery_is_pushdown_safe's  
comment).  
  
Back-patch to 9.5 where grouping sets were introduced.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : aa5b5c1740e870b45742c44602c40fe67f23a9a9    
  
author   : Bruce Momjian <[email protected]>    
date     : Fri, 21 Aug 2020 20:23:09 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Fri, 21 Aug 2020 20:23:09 -0400    

This is a redesign of the intro to the managing databases chapter.  
  
Discussion: https://postgr.es/m/[email protected]  
  
Author: David G. Johnston  
  
Backpatch-through: 9.5  

commit   : e22e29c258a1b10969376024027b469a8e1e1b0b    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 21 Aug 2020 15:00:43 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 21 Aug 2020 15:00:43 -0400    

If a CREATE TABLE command uses both LIKE and traditional inheritance,  
Vars in CHECK constraints and expression indexes that are absorbed  
from a LIKE parent table tended to get mis-numbered, resulting in  
wrong answers and/or bizarre error messages (though probably not any  
actual crashes, thanks to validation occurring in the executor).  
  
In v12 and up, the same could happen to Vars in GENERATED expressions,  
even in cases with no LIKE clause but multiple traditional-inheritance  
parents.  
  
The cause of the problem for LIKE is that parse_utilcmd.c supposed  
it could renumber such Vars correctly during transformCreateStmt(),  
which it cannot since we have not yet accounted for columns added via  
inheritance.  Fix that by postponing processing of LIKE INCLUDING  
CONSTRAINTS, DEFAULTS, GENERATED, INDEXES till after we've performed  
DefineRelation().  
  
The error with GENERATED and multiple inheritance is a simple oversight  
in MergeAttributes(); it knows it has to renumber Vars in inherited  
CHECK constraints, but forgot to apply the same processing to inherited  
GENERATED expressions (a/k/a defaults).  
  
Per bug #16272 from Tom Gottfried.  The non-GENERATED variants of the  
issue are ancient, presumably dating right back to the addition of  
CREATE TABLE LIKE; hence back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 3a45ac076aab6ba38830d84be6c8e99ccecdd8ce    
  
author   : Alvaro Herrera <[email protected]>    
date     : Mon, 17 Aug 2020 16:20:05 -0400    
  
committer: Alvaro Herrera <[email protected]>    
date     : Mon, 17 Aug 2020 16:20:05 -0400    

This should improve stability in the tests.  
  
Per buildfarm member hyrax (CLOBBER_CACHE_ALWAYS) via Tom Lane.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 59fb9ef15561f93691a282f1c3b4e6566fda7e15    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 17 Aug 2020 15:40:07 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 17 Aug 2020 15:40:07 -0400    

The description of what select_common_type() does was not terribly  
accurate.  Improve it.  
  
David Johnston and Tom Lane  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 812b2165b0c533999398dfc9c35298c43ef6030a    
  
author   : Michael Paquier <[email protected]>    
date     : Mon, 17 Aug 2020 10:24:38 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Mon, 17 Aug 2020 10:24:38 +0900    

Since 806a2ae, the work of the bgwriter is split the checkpointer, but a  
portion of the documentation did not get the message.  
  
Author: Masahiko Sawada  
Discussion: https://postgr.es/m/CA+fd4k6jXxjAtjMVC=wG3=QGpauZBtcgN3Jhw+oV7zXGKVLKzQ@mail.gmail.com  
Backpatch-through: 9.5  

commit   : e8e44e89090647f56bd62ce4f75ba11dd5bb77be    
  
author   : Noah Misch <[email protected]>    
date     : Sat, 15 Aug 2020 16:15:59 -0700    
  
committer: Noah Misch <[email protected]>    
date     : Sat, 15 Aug 2020 16:15:59 -0700    

Several PGXN modules reference LockTagType values; renumbering would  
force a recompile of those modules.  Oversight in back-patch of today's  
commit 566372b3d6435639e4cc4476d79b8505a0297c87.  Back-patch to released  
branches, v12 through 9.5.  
  
Reported by Tom Lane.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : e525770dd504e5f182229b9bee64430ebe71a2a8    
  
author   : Noah Misch <[email protected]>    
date     : Sat, 15 Aug 2020 10:15:53 -0700    
  
committer: Noah Misch <[email protected]>    
date     : Sat, 15 Aug 2020 10:15:53 -0700    

The SimpleLruTruncate() header comment states the new coding rule.  To  
achieve this, add locktype "frozenid" and two LWLocks.  This closes a  
rare opportunity for data loss, which manifested as "apparent  
wraparound" or "could not access status of transaction" errors.  Data  
loss is more likely in pg_multixact, due to released branches' thin  
margin between multiStopLimit and multiWrapLimit.  If a user's physical  
replication primary logged ":  apparent wraparound" messages, the user  
should rebuild standbys of that primary regardless of symptoms.  At less  
risk is a cluster having emitted "not accepting commands" errors or  
"must be vacuumed" warnings at some point.  One can test a cluster for  
this data loss by running VACUUM FREEZE in every database.  Back-patch  
to 9.5 (all supported versions).  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : dea07098af20f3dbaac873263020a5d95ea24ed8    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 14 Aug 2020 22:14:03 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 14 Aug 2020 22:14:03 -0400    

nodeSubplan.c expects that the testexpr for a hashable ANY SubPlan  
has the form of one or more OpExprs whose LHS is an expression of the  
outer query's, while the RHS is an expression over Params representing  
output columns of the subquery.  However, the planner only went as far  
as verifying that the clauses were all binary OpExprs.  This works  
99.99% of the time, because the clauses have the right shape when  
emitted by the parser --- but it's possible for function inlining to  
break that, as reported by PegoraroF10.  To fix, teach the planner  
to check that the LHS and RHS contain the right things, or more  
accurately don't contain the wrong things.  Given that this has been  
broken for years without anyone noticing, it seems sufficient to just  
give up hashing when it happens, rather than go to the trouble of  
commuting the clauses back again (which wouldn't necessarily work  
anyway).  
  
While poking at that, I also noticed that nodeSubplan.c had a baked-in  
assumption that the number of hash clauses is identical to the number  
of subquery output columns.  Again, that's fine as far as parser output  
goes, but it's not hard to break it via function inlining.  There seems  
little reason for that assumption though --- AFAICS, the only thing  
it's buying us is not having to store the number of hash clauses  
explicitly.  Adding code to the planner to reject such cases would take  
more code than getting nodeSubplan.c to cope, so I fixed it that way.  
  
This has been broken for as long as we've had hashable SubPlans,  
so back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 326b5fe0f084147dacdf7bb9290d3d97463d7309    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 14 Aug 2020 13:26:57 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 14 Aug 2020 13:26:57 -0400    

Up to now, upon receipt of a SIGTERM ("smart shutdown" command), the  
postmaster has immediately killed all "optional" background processes,  
and subsequently refused to launch new ones while it's waiting for  
foreground client processes to exit.  No doubt this seemed like an OK  
policy at some point; but it's a pretty bad one now, because it makes  
for a seriously degraded environment for the remaining clients:  
  
* Parallel queries are killed, and new ones fail to launch. (And our  
parallel-query infrastructure utterly fails to deal with the case  
in a reasonable way --- it just hangs waiting for workers that are  
not going to arrive.  There is more work needed in that area IMO.)  
  
* Autovacuum ceases to function.  We can tolerate that for awhile,  
but if bulk-update queries continue to run in the surviving client  
sessions, there's eventually going to be a mess.  In the worst case  
the system could reach a forced shutdown to prevent XID wraparound.  
  
* The bgwriter and walwriter are also stopped immediately, likely  
resulting in performance degradation.  
  
Hence, let's rearrange things so that the only immediate change in  
behavior is refusing to let in new normal connections.  Once the last  
normal connection is gone, shut everything down as though we'd received  
a "fast" shutdown.  To implement this, remove the PM_WAIT_BACKUP and  
PM_WAIT_READONLY states, instead staying in PM_RUN or PM_HOT_STANDBY  
while normal connections remain.  A subsidiary state variable tracks  
whether or not we're letting in new connections in those states.  
  
This also allows having just one copy of the logic for killing child  
processes in smart and fast shutdown modes.  I moved that logic into  
PostmasterStateMachine() by inventing a new state PM_STOP_BACKENDS.  
  
Back-patch to 9.6 where parallel query was added.  In principle  
this'd be a good idea in 9.5 as well, but the risk/reward ratio  
is not as good there, since lack of autovacuum is not a problem  
during typical uses of smart shutdown.  
  
Per report from Bharath Rupireddy.  
  
Patch by me, reviewed by Thomas Munro  
  
Discussion: https://postgr.es/m/CALj2ACXAZ5vKxT9P7P89D87i3MDO9bfS+_bjMHgnWJs8uwUOOw@mail.gmail.com  

commit   : 385cbe8e4197fd46c34a9142f2dee2ed664f0c7e    
  
author   : Alvaro Herrera <[email protected]>    
date     : Thu, 13 Aug 2020 17:33:49 -0400    
  
committer: Alvaro Herrera <[email protected]>    
date     : Thu, 13 Aug 2020 17:33:49 -0400    

When a table is scanned by heapam_index_build_range_scan (née  
IndexBuildHeapScan) and the table lock being held allows concurrent data  
changes, it is possible for new HOT chains to sprout in a page that were  
unknown when the scan of a page happened.  This leads to an error such  
as  
  ERROR:  failed to find parent tuple for heap-only tuple at (X,Y) in table "tbl"  
because the root tuple was not present when we first obtained the list  
of the page's root tuples.  This can be fixed by re-obtaining the list  
of root tuples, if we see that a heap-only tuple appears to point to a  
non-existing root.  
  
This was reported by Anastasia as occurring for BRIN summarization  
(which exists since 9.5), but I think it could theoretically also happen  
with CREATE INDEX CONCURRENTLY (much older) or REINDEX CONCURRENTLY  
(very recent).  It seems a happy coincidence that BRIN forces us to  
backpatch this all the way to 9.5.  
  
Reported-by: Anastasia Lubennikova <[email protected]>  
Diagnosed-by: Anastasia Lubennikova <[email protected]>  
Co-authored-by: Anastasia Lubennikova <[email protected]>  
Co-authored-by: Álvaro Herrera <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  
Backpatch: 9.5 - master  

commit   : 721ef4d28aae0afff6b714af9c545825f86a76da    
  
author   : Alvaro Herrera <[email protected]>    
date     : Wed, 12 Aug 2020 15:33:36 -0400    
  
committer: Alvaro Herrera <[email protected]>    
date     : Wed, 12 Aug 2020 15:33:36 -0400    

If a page range is desummarized at just the right time concurrently with  
an index walk, BRIN would raise an error indicating index corruption.  
This is scary and unhelpful; silently returning that the page range is  
not summarized is sufficient reaction.  
  
This bug was introduced by commit 975ad4e602ff as additional protection  
against a bug whose actual fix was elsewhere.  Backpatch equally.  
  
Reported-By: Anastasia Lubennikova <[email protected]>  
Diagnosed-By: Alexander Lakhin <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  
Backpatch: 9.5 - master