PostgreSQL 12.17 commit log

commit   : 2fe2d1af14fd2fb5afeee94b94c4d8a34a829e32    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 6 Nov 2023 17:11:55 -0500    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 6 Nov 2023 17:11:55 -0500    

commit   : 8ff28255b6cd93b2fc3e12b12b05ed5430e48c4c    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 6 Nov 2023 13:26:33 -0500    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 6 Nov 2023 13:26:33 -0500    

Security: CVE-2023-5868, CVE-2023-5869, CVE-2023-5870  

commit   : d267cea24ea346c739c85bf7bccbd8e8f59da6b3    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 6 Nov 2023 10:56:43 -0500    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 6 Nov 2023 10:56:43 -0500    

array_set_element() and related functions allow an array to be  
enlarged by assigning to subscripts outside the current array bounds.  
While these places were careful to check that the new bounds are  
allowable, they neglected to consider the risk of integer overflow  
in computing the new bounds.  In edge cases, we could compute new  
bounds that are invalid but get past the subsequent checks,  
allowing bad things to happen.  Memory stomps that are potentially  
exploitable for arbitrary code execution are possible, and so is  
disclosure of server memory.  
  
To fix, perform the hazardous computations using overflow-detecting  
arithmetic routines, which fortunately exist in all still-supported  
branches.  
  
The test cases added for this generate (after patching) errors that  
mention the value of MaxArraySize, which is platform-dependent.  
Rather than introduce multiple expected-files, use psql's VERBOSITY  
parameter to suppress the printing of the message text.  v11 psql  
lacks that parameter, so omit the tests in that branch.  
  
Our thanks to Pedro Gallegos for reporting this problem.  
  
Security: CVE-2023-5869  

commit   : e911afd092c179563bef39839118acb6702066f4    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 6 Nov 2023 10:38:00 -0500    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 6 Nov 2023 10:38:00 -0500    

transformAggregateCall() captures the datatypes of the aggregate's  
arguments immediately to construct the Aggref.aggargtypes list.  
This seems reasonable because the arguments have already been  
transformed --- but there is an edge case where they haven't been.  
Specifically, if we have an unknown-type literal in an ANY argument  
position, nothing will have been done with it earlier.  But if we  
also have DISTINCT, then addTargetToGroupList() converts the literal  
to "text" type, resulting in the aggargtypes list not matching the  
actual runtime type of the argument.  The end result is that the  
aggregate tries to interpret a "text" value as being of type  
"unknown", that is a zero-terminated C string.  If the text value  
contains no zero bytes, this could result in disclosure of server  
memory following the text literal value.  
  
To fix, move the collection of the aggargtypes list to the end  
of transformAggregateCall(), after DISTINCT has been handled.  
This requires slightly more code, but not a great deal.  
  
Our thanks to Jingzhou Fu for reporting this problem.  
  
Security: CVE-2023-5868  

commit   : 7bbf4d03726200a8e42b48cac0b2a87abb7fb5fe    
  
author   : Noah Misch <[email protected]>    
date     : Mon, 6 Nov 2023 06:14:13 -0800    
  
committer: Noah Misch <[email protected]>    
date     : Mon, 6 Nov 2023 06:14:13 -0800    

It was always false in single-user mode, in autovacuum workers, and in  
background workers.  This had no specifically-identified security  
consequences, but non-core code or future work might make it  
security-relevant.  Back-patch to v11 (all supported versions).  
  
Jelte Fennema-Nio.  Reported by Jelte Fennema-Nio.  

commit   : 2893f2f40cfc2a7f6bd64b566f97140f8a379dd9    
  
author   : Noah Misch <[email protected]>    
date     : Mon, 6 Nov 2023 06:14:13 -0800    
  
committer: Noah Misch <[email protected]>    
date     : Mon, 6 Nov 2023 06:14:13 -0800    

Documentation says it cannot signal "a backend owned by a superuser".  
On the contrary, it could signal background workers, including the  
logical replication launcher.  It could signal autovacuum workers and  
the autovacuum launcher.  Block all that.  Signaling autovacuum workers  
and those two launchers doesn't stall progress beyond what one could  
achieve other ways.  If a cluster uses a non-core extension with a  
background worker that does not auto-restart, this could create a denial  
of service with respect to that background worker.  A background worker  
with bugs in its code for responding to terminations or cancellations  
could experience those bugs at a time the pg_signal_backend member  
chooses.  Back-patch to v11 (all supported versions).  
  
Reviewed by Jelte Fennema-Nio.  Reported by Hemanth Sandrana and  
Mahendrakar Srinivasarao.  
  
Security: CVE-2023-5870  

commit   : 1cfa44269c1260fd7ca6a3b99767f9c157f4c048    
  
author   : Peter Eisentraut <[email protected]>    
date     : Mon, 6 Nov 2023 13:27:02 +0100    
  
committer: Peter Eisentraut <[email protected]>    
date     : Mon, 6 Nov 2023 13:27:02 +0100    

Source-Git-URL: https://git.postgresql.org/git/pgtranslation/messages.git  
Source-Git-Hash: db060e1afcf150db436cc05807372480754013e5  

commit   : 87072ca373a745c54951723bd091d0fb6e2d3ce5    
  
author   : Tom Lane <[email protected]>    
date     : Sun, 5 Nov 2023 13:14:07 -0500    
  
committer: Tom Lane <[email protected]>    
date     : Sun, 5 Nov 2023 13:14:07 -0500    

commit   : 36726b7882180b798768239060e462fc9c184d27    
  
author   : Bruce Momjian <[email protected]>    
date     : Fri, 3 Nov 2023 13:57:58 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Fri, 3 Nov 2023 13:57:58 -0400    

Reported-by: Svante Richter  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 11  

commit   : 019317756673a5e55171918ab6a2a9a1ebf48648    
  
author   : Bruce Momjian <[email protected]>    
date     : Fri, 3 Nov 2023 13:39:50 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Fri, 3 Nov 2023 13:39:50 -0400    

Reported-by: [email protected]  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 11  

commit   : d3246a2ad80359ad0740eb2cc5c849b3e09547d9    
  
author   : Peter Eisentraut <[email protected]>    
date     : Fri, 3 Nov 2023 11:50:25 -0400    
  
committer: Peter Eisentraut <[email protected]>    
date     : Fri, 3 Nov 2023 11:50:25 -0400    

This was the backport of 2e3dc8c148, but in older releases the newline  
must be in the message.  

commit   : 1f7d7f102d14082336c862a11dff1f4849437f7a    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 3 Nov 2023 11:48:23 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 3 Nov 2023 11:48:23 -0400    

This text left one with the impression that an ON SELECT rule could  
be attached to a plain table, which has not been true since commit  
264c06820 (meaning the text was already misleading when written,  
evidently by me in 96bd67f61).  However, it didn't get really bad  
until b23cd185f removed the convert-a-table-to-a-view logic, which  
had made it possible for scripts that thought they were attaching  
ON SELECTs to tables to still work.  
  
Rewrite into a form that makes it clear that an ON SELECT rule  
is better regarded as an implementation detail of a view.  
Pre-v16, point out that adding ON SELECT to a table actually  
converts it to a view.  
  
Per bug #18178 from Joshua Uyehara.  Back-patch to all supported  
branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 421100b2edb4449fd3eb89f1672426382e8ffd4f    
  
author   : Bruce Momjian <[email protected]>    
date     : Fri, 3 Nov 2023 09:51:52 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Fri, 3 Nov 2023 09:51:52 -0400    

Reported-by: Jordi Gutiérrez Hermoso  
  
Discussion: https://postgr.es/m/[email protected]  
  
Co-authored-by: Laurenz Albe  
  
Backpatch-through: 11  

commit   : 65810fc6d0f6ccd3166713b9ec2f856be535383f    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 2 Nov 2023 11:47:33 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 2 Nov 2023 11:47:33 -0400    

get_explain_guc_options() crashed if a string GUC marked GUC_EXPLAIN  
has a NULL boot_val.  Nosing around found a couple of other places  
that seemed insufficiently cautious about NULL string values, although  
those are likely unreachable in practice.  Add some commentary  
defining the expectations for NULL values of string variables,  
in hopes of forestalling future additions of more such bugs.  
  
Xing Guo, Aleksander Alekseev, Tom Lane  
  
Discussion: https://postgr.es/m/CACpMh+AyDx5YUpPaAgzVwC1d8zfOL4JoD-uyFDnNSa1z0EsDQQ@mail.gmail.com  

commit   : 616de5bb35734d2b88b2d3bc9a685925def893f2    
  
author   : Michael Paquier <[email protected]>    
date     : Thu, 2 Nov 2023 07:33:02 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Thu, 2 Nov 2023 07:33:02 +0900    

This part of the documentation refers to exceptions as handled by  
PL/pgSQL, and using the internal error code is confusing.  
  
Per thinko in 66bde49d96a9.  
  
Reported-by: Euler Taveira, Bruce Momjian  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: 11  

commit   : ff81b9b7a74e147b4da730d6023fa69f461903fc    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 31 Oct 2023 10:21:31 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 31 Oct 2023 10:21:31 -0400    

Reported-by: [email protected]  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 11  

commit   : abf2c4499e59ff230ed12ccedd71442260784f79    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 31 Oct 2023 09:23:09 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 31 Oct 2023 09:23:09 -0400    

Also reorder entries and add commas.  
  
Reported-by: David G. Johnston  
  
Discussion: https://postgr.es/m/CAKFQuwYeNPxeocV3_0+Zx=_Xwvg+sNyEMdzyG5s2E2e0hZLQhg@mail.gmail.com  
  
Author: David G. Johnston (partial)  
  
Backpatch-through: 12  

commit   : adb82235b54c4746d0ca75a6d9c5b02aef7310fa    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 31 Oct 2023 09:10:35 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 31 Oct 2023 09:10:35 -0400    

This also updates some C comments.  
  
Reported-by: [email protected]  
  
Discussion: https://postgr.es/m/167336599095.2667301.15497893107226841625@wrigleys.postgresql.org  
  
Author: Laurenz Albe (doc patch)  
  
Backpatch-through: 11  

commit   : efcb601d2057e6828621d5d4a9426d10ad877897    
  
author   : David Rowley <[email protected]>    
date     : Tue, 31 Oct 2023 16:44:27 +1300    
  
committer: David Rowley <[email protected]>    
date     : Tue, 31 Oct 2023 16:44:27 +1300    

4b8266415 added a precheck to pgrowlocks() to ensure the given object's  
pg_class.relam is HEAP_TABLE_AM_OID, however, that check was put before  
another check which was checking if the given object was a partitioned  
table.  Since the pg_class.relam is always InvalidOid for partitioned  
tables, if pgrowlocks() was called passing a partitioned table, then the  
"only heap AM is supported" error would be raised instead of the intended  
error about the given object being a partitioned table.  
  
Here we simply move the pg_class.relam check to after the check that  
verifies that we are in fact working with a normal (non-partitioned)  
table.  
  
Reported-by: jian he  
Discussion: https://postgr.es/m/CACJufxFaSp_WguFCf0X98951zFVX+dXFnF1mxAb-G3g1HiHOow@mail.gmail.com  
Backpatch-through: 12, where 4b8266415 was introduced.  

commit   : 975ae05537fadcba6ea55b781b142eef887e6ffe    
  
author   : Noah Misch <[email protected]>    
date     : Mon, 30 Oct 2023 14:46:05 -0700    
  
committer: Noah Misch <[email protected]>    
date     : Mon, 30 Oct 2023 14:46:05 -0700    

pgstatindex failed with ERRCODE_DATA_CORRUPTED, of the "can't-happen"  
class XX.  The other functions succeeded on an empty index; they might  
have malfunctioned if the failed index build left torn I/O or other  
complex state.  Report an ERROR in statistics functions pgstatindex,  
pgstatginindex, pgstathashindex, and pgstattuple.  Report DEBUG1 and  
skip all index I/O in maintenance functions brin_desummarize_range,  
brin_summarize_new_values, brin_summarize_range, and  
gin_clean_pending_list.  Back-patch to v11 (all supported versions).  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 3a205c91665fddf76e333844884354874dc8ae1b    
  
author   : Noah Misch <[email protected]>    
date     : Mon, 30 Oct 2023 14:46:05 -0700    
  
committer: Noah Misch <[email protected]>    
date     : Mon, 30 Oct 2023 14:46:05 -0700    

This prevents false-positive reports about "the first child of leftmost  
target page is not leftmost of its level", "block %u is not leftmost"  
and "left link/right link pair".  They appeared if amcheck ran before  
VACUUM cleaned things, after a cluster exited recovery between the  
first-stage and second-stage WAL records of a deletion.  Back-patch to  
v11 (all supported versions).  
  
Reviewed by Peter Geoghegan.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : f7cd7b265f6f96689a42d61f1e312554e1ff9fa8    
  
author   : Dean Rasheed <[email protected]>    
date     : Sun, 29 Oct 2023 11:14:33 +0000    
  
committer: Dean Rasheed <[email protected]>    
date     : Sun, 29 Oct 2023 11:14:33 +0000    

Formerly, the value computed by leftmostvalue_interval() was a long  
way short of the minimum possible interval value.  As a result, an  
index scan on a GIN index on an interval column with < or <= operators  
would miss large negative interval values.  
  
Fix by setting all fields of the leftmost interval to their minimum  
values, ensuring that the result is less than any other possible  
interval.  Since this only affects index searches, no index rebuild is  
necessary.  
  
Back-patch to all supported branches.  
  
Dean Rasheed, reviewed by Heikki Linnakangas.  
  
Discussion: https://postgr.es/m/CAEZATCV80%2BgOfF8ehNUUfaKBZgZMDfCfL-g1HhWGb6kC3rpDfw%40mail.gmail.com  

commit   : d8d7f282fd1dc883e8062447b541aa230f6f29a3    
  
author   : Tom Lane <[email protected]>    
date     : Sat, 28 Oct 2023 14:04:43 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Sat, 28 Oct 2023 14:04:43 -0400    

When looping around after finding that the set-returning function  
returned zero rows for the current input tuple, ExecProjectSet  
neglected to reset either of the two memory contexts it's  
responsible for cleaning out.  Typically this wouldn't cause much  
problem, because once the SRF does return at least one row, the  
contexts would get reset on the next call.  However, if the SRF  
returns no rows for many input tuples in succession, quite a lot  
of memory could be transiently consumed.  
  
To fix, make sure we reset both contexts while looping around.  
  
Per bug #18172 from Sergei Kornilov.  Back-patch to all supported  
branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 7180bb827bf5f2638c2868c92ea942eb29d5b723    
  
author   : Tom Lane <[email protected]>    
date     : Sat, 28 Oct 2023 11:54:40 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Sat, 28 Oct 2023 11:54:40 -0400    

Debian recently decided to split out a bunch of "obsolete" timezone  
names into a new tzdata-legacy package, which isn't installed by  
default.  One of these zone names is Pacific/Enderbury, and that  
breaks our regression tests (on --with-system-tzdata builds)  
because our default timezone abbreviations list defines PHOT as  
Pacific/Enderbury.  
  
Pacific/Enderbury got renamed to Pacific/Kanton in tzdata 2021b,  
so that in distros that still have this entry it's just a symlink  
to Pacific/Kanton anyway.  So one answer would be to redefine PHOT  
as Pacific/Kanton.  However, then things would fail if the  
installed tzdata predates 2021b, which is recent enough that that  
seems like a real problem.  
  
Instead, let's just remove PHOT from the default list.  That seems  
likely to affect nobody in the real world, because (a) it was an  
abbreviation that the tzdb crew made up in the first place, with  
no evidence of real-world usage, and (b) the total human population  
of the Phoenix Islands is less than two dozen persons, per Wikipedia.  
If anyone does use this zone abbreviation they can easily put it back  
via a custom abbreviations file.  
  
We'll keep PHOT in the Pacific.txt reference file, but change it  
to Pacific/Kanton there, as that definition seems more likely to  
be useful to future readers of that file.  
  
Per report from Victor Wagner.  Back-patch to all supported  
branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : c45a45fedbcffecfcd318a0a9349d3e1bbfb5e49    
  
author   : Tom Lane <[email protected]>    
date     : Wed, 25 Oct 2023 17:34:47 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Wed, 25 Oct 2023 17:34:47 -0400    

As far as I can see, ecpg has no notion of a "default" open  
connection.  You can do "CONNECT TO DEFAULT" but that just specifies  
letting libpq use all its default connection parameters --- the  
resulting connection is not special subsequently.  In particular,  
SET CONNECTION = DEFAULT and DISCONNECT DEFAULT simply act on a  
connection named DEFAULT, if you've made one; they do not have  
special lookup rules.  But the documentation of these commands  
makes it look like they do.  
  
Simplest fix, I think, is just to remove the paras suggesting that  
DEFAULT is special here.  
  
Also, SET CONNECTION *does* have one special lookup rule, which  
is that it recognizes CURRENT as an alias for the currently selected  
connection.  SET CONNECTION = CURRENT is a no-op, so it's pretty  
useless, but nonetheless it does something different from selecting  
a connection by name; so we'd better document it.  
  
Per report from Sylvain Frandaz.  Back-patch to all supported  
versions.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 85b9e8853fb5bd9c99fb71a1f1852cbbbfedbe3f    
  
author   : Daniel Gustafsson <[email protected]>    
date     : Wed, 25 Oct 2023 11:33:24 +0200    
  
committer: Daniel Gustafsson <[email protected]>    
date     : Wed, 25 Oct 2023 11:33:24 +0200    

The link to pg_type was accidentally linking to pg_authid instead.  
Backpatch to 12 and 11.  
  
Author: Maxim Yablokov <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: 11, 12  

commit   : 07ef465e23a954c1a8f0ae439afbb30521bddba3    
  
author   : Michael Paquier <[email protected]>    
date     : Wed, 25 Oct 2023 09:41:16 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Wed, 25 Oct 2023 09:41:16 +0900    

Author: Ekaterina Kiryanova, Elena Indrupskaya, Oleg Sibiryakov, Maxim  
Yablokov  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: 11  

commit   : 9ad98627614bfd603654e1a57c386a84b8834dc5    
  
author   : Thomas Munro <[email protected]>    
date     : Tue, 24 Oct 2023 11:14:21 +1300    
  
committer: Thomas Munro <[email protected]>    
date     : Tue, 24 Oct 2023 11:14:21 +1300    

While back-patching f90b4a84, I missed that branches before  
REL_14_STABLE did some (accidental?) type punning in a function  
parameter, and failed to adjust these two branches accordingly.  That  
didn't seem to cause a problem for newer LLVM versions or non-debug  
builds, but older debug builds would fail a type cross-check assertion.  
Fix by supplying the correct function argument type.  In REL_14_STABLE  
the same change was made by commit df99ddc7.  
  
Per build farm animal xenodermus, which runs a debug build of LLVM 6  
with jit_above_cost=0.  
  
Discussion: https://postgr.es/m/CA%2BhUKGLQ38rgZ3bvNHXPRjsWFAg3pa%3Dtnpeq0osa%2B%3DmiFD5jAw%40mail.gmail.com  

commit   : 527e62a5e5d7037780e154159c76cb3f38716c87    
  
author   : Thomas Munro <[email protected]>    
date     : Sun, 22 Oct 2023 14:17:00 +1300    
  
committer: Thomas Munro <[email protected]>    
date     : Sun, 22 Oct 2023 14:17:00 +1300    

When scanning build farm results, it's useful to be able to see which  
version is in use.  For the Meson build system, this information was  
already displayed.  
  
Back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/4022690.1697852728%40sss.pgh.pa.us  

commit   : d8c2877b9efafd37505f3cbb2cc2a7072d955667    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 20 Oct 2023 13:40:15 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 20 Oct 2023 13:40:15 -0400    

This avoids a compiler bug occurring in AIX's xlc, even in pretty  
late-model revisions.  Buildfarm testing has now confirmed that  
only 64-bit xlc is affected.  Although we are contemplating  
dropping support for xlc in v17, it's still supported in the  
back branches, so we need this fix.  
  
Back-patch of code changes from HEAD commit 19fa97731.  
(The test cases were already back-patched, in 4a427b82c et al.)  
  
Discussion: https://postgr.es/m/CA+hUKGK=DOC+hE-62FKfZy=Ybt5uLkrg3zCZD-jFykM-iPn8yw@mail.gmail.com  

commit   : ed697c4040653cfeaff859078302517a198c9446    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 20 Oct 2023 13:01:02 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 20 Oct 2023 13:01:02 -0400    

This doco said that use of => as an operator "is deprecated".  
It's been fully disallowed since 865f14a2d back in 9.5, but  
evidently that commit missed updating this statement.  
Do so now.  

commit   : 7da915e33abf54ce126d68baead4c1871b302c1c    
  
author   : Thomas Munro <[email protected]>    
date     : Wed, 18 Oct 2023 22:15:54 +1300    
  
committer: Thomas Munro <[email protected]>    
date     : Wed, 18 Oct 2023 22:15:54 +1300    

Changes required by https://llvm.org/docs/NewPassManager.html.  
  
Back-patch to 12, leaving the final release of 11 unchanged, consistent  
with earlier decision not to back-patch LLVM 16 support either.  
  
Author: Dmitry Dolgov <[email protected]>  
Reviewed-by: Andres Freund <[email protected]>  
Reviewed-by: Thomas Munro <[email protected]>  
Discussion: https://postgr.es/m/CA%2BhUKG%2BWXznXCyTgCADd%3DHWkP9Qksa6chd7L%3DGCnZo-MBgg9Lg%40mail.gmail.com  

commit   : d701f0d1f3e7ed9e8b8ff0d368add9cdae3b8108    
  
author   : Thomas Munro <[email protected]>    
date     : Thu, 19 Oct 2023 03:01:55 +1300    
  
committer: Thomas Munro <[email protected]>    
date     : Thu, 19 Oct 2023 03:01:55 +1300    

Commit 37d5babb used this C API function while adding support for LLVM  
16 and opaque pointers, but it's not available in LLVM 7 and older.  
Provide it in our own llvmjit_wrap.cpp.  It just calls a C++ function  
that pre-dates LLVM 3.9, our minimum target.  
  
Back-patch to 12, like 37d5babb.  
  
Discussion: https://postgr.es/m/CA%2BhUKGKnLnJnWrkr%3D4mSGhE5FuTK55FY15uULR7%3Dzzc%3DwX4Nqw%40mail.gmail.com  

commit   : 15ddc9725eb73d97a16652c7c90d993302773544    
  
author   : Thomas Munro <[email protected]>    
date     : Wed, 18 Oct 2023 22:09:05 +1300    
  
committer: Thomas Munro <[email protected]>    
date     : Wed, 18 Oct 2023 22:09:05 +1300    

Remove use of LLVMGetElementType() and provide the type of all pointers  
to LLVMBuildXXX() functions when emitting IR, as required by modern LLVM  
versions[1].  
  
 * For LLVM <= 14, we'll still use the old LLVMBuildXXX() functions.  
 * For LLVM == 15, we'll continue to do the same, explicitly opting  
   out of opaque pointer mode.  
 * For LLVM >= 16, we'll use the new LLVMBuildXXX2() functions that take  
   the extra type argument.  
  
The difference is hidden behind some new IR emitting wrapper functions  
l_load(), l_gep(), l_call() etc.  The change is mostly mechanical,  
except that at each site the correct type had to be provided.  
  
In some places we needed to do some extra work to get functions types,  
including some new wrappers for C++ APIs that are not yet exposed by in  
LLVM's C API, and some new "example" functions in llvmjit_types.c  
because it's no longer possible to start from the function pointer type  
and ask for the function type.  
  
Back-patch to 12, because it's a little tricker in 11 and we agreed not  
to put the latest LLVM support into the upcoming final release of 11.  
  
[1] https://llvm.org/docs/OpaquePointers.html  
  
Reviewed-by: Dmitry Dolgov <[email protected]>  
Reviewed-by: Ronan Dunklau <[email protected]>  
Reviewed-by: Andres Freund <[email protected]>  
Discussion: https://postgr.es/m/CA%2BhUKGKNX_%3Df%2B1C4r06WETKTq0G4Z_7q4L4Fxn5WWpMycDj9Fw%40mail.gmail.com  

commit   : 0e32652a79164965e8ef409bb84804a6e608e9ea    
  
author   : Nathan Bossart <[email protected]>    
date     : Tue, 17 Oct 2023 16:11:13 -0500    
  
committer: Nathan Bossart <[email protected]>    
date     : Tue, 17 Oct 2023 16:11:13 -0500    

This commit (c290e79cf0) was originally back-patched to v15.  
Commit 97550c0711 added a new use of STDERR_FILENO, and it was  
back-patched all the way to v11, thus breaking MSVC builds for v11  
through v14.  Since STDERR_FILENO is now needed on older versions,  
let's back-patch c290e79cf0 down to v11, too.  
  
Here follows the original commit message describing the change:  
  
Because they are not available we've used _fileno(stdin) in some places, but  
that doesn't reliably work, because stdin might be closed. This is the  
prerequisite of the subsequent commit, fixing a failure introduced in  
76e38b37a5.  
  
Author: Andres Freund <[email protected]>  
Reported-By: Sandeep Thakkar <[email protected]>  
Message-Id: [email protected] (on pgsql-packagers)  
Discussion: https://postgr.es/m/20231017164517.GA613565%40nathanxps13  
Backpatch-through: 11  

commit   : b18781c2df44c2abf18dca95b1351ff917caf5fb    
  
author   : Tom Lane <[email protected]>    
date     : Tue, 17 Oct 2023 13:55:45 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Tue, 17 Oct 2023 13:55:45 -0400    

Per code coverage reports, we had zero regression test coverage  
of these functions.  That came back to bite us, as apparently  
that's allowed us to miss discovering misbehavior of this code  
with AIX's xlc compiler.  Install relevant portions of the  
test cases added in 97957fdba, 2f0472030, 19fa97731.  
  
(Assuming the expected outcome that the xlc problem does appear  
in back branches, a code fix will follow.)  
  
Discussion: https://postgr.es/m/CA+hUKGK=DOC+hE-62FKfZy=Ybt5uLkrg3zCZD-jFykM-iPn8yw@mail.gmail.com  

commit   : e2e16904224a94bf514b67604b9c476c8a8154ac    
  
author   : Nathan Bossart <[email protected]>    
date     : Tue, 17 Oct 2023 10:42:22 -0500    
  
committer: Nathan Bossart <[email protected]>    
date     : Tue, 17 Oct 2023 10:42:22 -0500    

The SIGTERM handler for the startup process immediately calls  
proc_exit() for the duration of the restore_command, i.e., a call  
to system().  This system() call forks a new process to execute the  
shell command, and this child process inherits the parent's signal  
handlers.  If both the parent and child processes receive SIGTERM,  
both will attempt to call proc_exit().  This can end badly.  For  
example, both processes will try to remove themselves from the  
PGPROC shared array.  
  
To fix this problem, this commit adds a check in  
StartupProcShutdownHandler() to see whether MyProcPid == getpid().  
If they match, this is the parent process, and we can proc_exit()  
like before.  If they do not match, this is a child process, and we  
just emit a message to STDERR (in a signal safe manner) and  
_exit(), thereby skipping any problematic exit callbacks.  
  
This commit also adds checks in proc_exit(), ProcKill(), and  
AuxiliaryProcKill() that verify they are not being called within  
such child processes.  
  
Suggested-by: Andres Freund  
Reviewed-by: Thomas Munro, Andres Freund  
Discussion: https://postgr.es/m/Y9nGDSgIm83FHcad%40paquier.xyz  
Discussion: https://postgr.es/m/20230223231503.GA743455%40nathanxps13  
Backpatch-through: 11  

commit   : 07eb22a7761f88a826c1d561c41aaeace23d3f7f    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 16 Oct 2023 14:06:11 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 16 Oct 2023 14:06:11 -0400    

Dropping a temp table could entail TOAST table access to clean out  
toasted catalog entries, such as large pg_constraint.conbin strings  
for complex CHECK constraints.  If we did that via ON COMMIT DROP,  
we triggered the assertion in init_toast_snapshot(), because  
there was no provision for setting up a snapshot for the drop  
actions.  Fix that.  
  
(I assume here that the adjacent truncation actions for ON COMMIT  
DELETE ROWS don't have a similar problem: it doesn't seem like  
nontransactional truncations would need to touch any toasted fields.  
If that proves wrong, we could refactor a bit to have the same  
snapshot acquisition cover that too.)  
  
The test case added here does not fail before v15, because that  
assertion was added in 277692220 which was not back-patched.  
However, the race condition the assertion warns of surely  
exists further back, so back-patch to all supported branches.  
  
Per report from Richard Guo.  
  
Discussion: https://postgr.es/m/CAMbWs4-x26=_QxxgdJyNbiCDzvtr2WV5ZDso_v-CukKEe6cBZw@mail.gmail.com  

commit   : 43c979086825e5df1816307fea9b41378cdc31bd    
  
author   : Thomas Munro <[email protected]>    
date     : Mon, 16 Oct 2023 17:10:13 +1300    
  
committer: Thomas Munro <[email protected]>    
date     : Mon, 16 Oct 2023 17:10:13 +1300    

Some of our src/bin tools read the control file without any kind of  
interlocking against concurrent writes from the server.  At least ext4  
and ntfs can expose partially modified contents when you do that.  
  
For now, we'll try to tolerate this by retrying up to 10 times if the  
checksum doesn't match, until we get two reads in a row with the same  
bad checksum.  This is not guaranteed to reach the right conclusion, but  
it seems very likely to.  Thanks to Tom Lane for this suggestion.  
  
Various ideas for interlocking or atomicity were considered too  
complicated, unportable or expensive given the lack of field reports,  
but remain open for future reconsideration.  
  
Back-patch as far as 12.  It doesn't seem like a good idea to put a  
heuristic change for a very rare problem into the final release of 11.  
  
Reviewed-by: Anton A. Melnikov <[email protected]>  
Reviewed-by: David Steele <[email protected]>  
Reviewed-by: Michael Paquier <[email protected]>  
Discussion: https://postgr.es/m/20221123014224.xisi44byq3cf5psi%40awork3.anarazel.de  

commit   : 637e86ecc5e4fcc5447b67d83337bc8752a40a52    
  
author   : Thomas Munro <[email protected]>    
date     : Mon, 16 Oct 2023 10:43:47 +1300    
  
committer: Thomas Munro <[email protected]>    
date     : Mon, 16 Oct 2023 10:43:47 +1300    

Commit dc7d70ea added functions that read the control file, but didn't  
acquire ControlFileLock.  With unlucky timing, file systems that have  
weak interlocking like ext4 and ntfs could expose partially overwritten  
contents, and the checksum would fail.  
  
Back-patch to all supported releases.  
  
Reviewed-by: David Steele <[email protected]>  
Reviewed-by: Anton A. Melnikov <[email protected]>  
Reviewed-by: Michael Paquier <[email protected]>  
Discussion: https://postgr.es/m/20221123014224.xisi44byq3cf5psi%40awork3.anarazel.de  

commit   : 73cda80a30a552c718f272379476a63d75327fda    
  
author   : Noah Misch <[email protected]>    
date     : Sat, 14 Oct 2023 15:54:46 -0700    
  
committer: Noah Misch <[email protected]>    
date     : Sat, 14 Oct 2023 15:54:46 -0700    

Starting on 2023-08-03, this intermittently terminated a "pgbench -C"  
test in CI.  It could affect a high-client-count "pgbench" without "-C".  
While parallel reindexdb and vacuumdb reach the same problematic check,  
sufficient client count and/or connection turnover is less plausible for  
them.  Given the lack of examples from the buildfarm or from manual  
builds, reproducing this must entail rare operating system  
configurations.  Also correct the associated error message, which was  
wrong for non-Windows.  Back-patch to v12, where the pgbench check first  
appeared.  While v11 vacuumdb has the problematic check, reaching it  
with typical vacuumdb usage is implausible.  
  
Reviewed by Thomas Munro.  
  
Discussion: https://postgr.es/m/CA+hUKG+JwvTNdcyJTriy9BbtzF1veSRQ=9M_ZKFn9_LqE7Kp7Q@mail.gmail.com  

commit   : 3cc0c25172b201f51dbd8cf2acfd1bfaff66e0d2    
  
author   : David Rowley <[email protected]>    
date     : Fri, 13 Oct 2023 01:14:46 +1300    
  
committer: David Rowley <[email protected]>    
date     : Fri, 13 Oct 2023 01:14:46 +1300    

This could only affect HASH partitioned tables with at least 2 partition  
key columns.  
  
If partition pruning was delayed until execution and the query contained  
an IS NULL qual on one of the partitioned keys, and some subsequent  
partitioned key was being compared to a non-Const, then this could result  
in a crash due to the incorrect keyno being used to calculate the  
stateidx for the expression evaluation code.  
  
Here we fix this by properly skipping partitioned keys which have a  
nullkey set.  Effectively, this must be the same as what's going on  
inside perform_pruning_base_step().  
  
Sergei Glukhov also provided a patch, but that's not what's being used  
here.  
  
Reported-by: Sergei Glukhov  
Reviewed-by: tender wang, Sergei Glukhov  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: 11, where runtime partition pruning was added.  

commit   : 7f1b5a60105d31e023961af0e9c3ca1e7e6f807b    
  
author   : David Rowley <[email protected]>    
date     : Thu, 12 Oct 2023 21:17:27 +1300    
  
committer: David Rowley <[email protected]>    
date     : Thu, 12 Oct 2023 21:17:27 +1300    

Author: Andrew Atkinson  
Reviewed-by: Ashutosh Bapat  
Discussion: https://postgr.es/m/CAG6XLEnC%3DEgq0YHRic2kWWDs4xwQnQ_kBA6qhhzAq1-pO_9Tfw%40mail.gmail.com  
Backpatch-through: 11, where enable_partitionwise_aggregate was added  

commit   : cd259de50ac5dc67bca5662921c4234682fe3c4a    
  
author   : David Rowley <[email protected]>    
date     : Thu, 12 Oct 2023 19:53:23 +1300    
  
committer: David Rowley <[email protected]>    
date     : Thu, 12 Oct 2023 19:53:23 +1300    

get_steps_using_prefix_recurse() incorrectly assumed that it could stop  
recursive processing of the 'prefix' list when cur_keyno was one before  
the step_lastkeyno.  Since hash partition pruning can prune using IS  
NULL quals, and these IS NULL quals are not present in the 'prefix'  
list, then that logic could cause more levels of recursion than what is  
needed and lead to there being no more items in the 'prefix' list to  
process.  This would manifest itself as a crash in some code that  
expected the 'start' ListCell not to be NULL.  
  
Here we adjust the logic so that instead of stopping recursion at 1 key  
before the step_lastkeyno, we just look at the llast(prefix) item and  
ensure we only recursively process up until just before whichever the last  
key is.  This effectively allows keys to be missing in the 'prefix' list.  
  
This change does mean that step_lastkeyno is no longer needed, so we  
remove that from the static functions.  I also spent quite some time  
reading this code and testing it to try to convince myself that there  
are no other issues.  That resulted in the irresistible temptation of  
rewriting some comments, many of which were just not true or inconcise.  
  
Reported-by: Sergei Glukhov  
Reviewed-by: Sergei Glukhov, tender wang  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: 11, where partition pruning was introduced.  

commit   : 077cedf20edc40d179dea0c5f5bb2bc97015398d    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 10 Oct 2023 16:51:08 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 10 Oct 2023 16:51:08 -0400    

Reported-by: [email protected]  
  
Discussion: https://postgr.es/m/167846222574.1803490.15815104179136215862@wrigleys.postgresql.org  
  
Backpatch-through: 11  

commit   : fb46719a985ee95e70f5627f3b4f06c84d7d04e7    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 10 Oct 2023 16:04:56 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 10 Oct 2023 16:04:56 -0400    

Reported-by: Pete Storer  
  
Discussion: https://postgr.es/m/BL0PR05MB66283C57D72E321591AE4EB1F3CE9@BL0PR05MB6628.namprd05.prod.outlook.com  
  
Backpatch-through: 11  

commit   : e631d12ecb979e3df6c5139ae2579c4c288facd9    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 10 Oct 2023 15:54:28 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 10 Oct 2023 15:54:28 -0400    

Reported-by: Steve Atkins  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 11  

commit   : c576acc7078d3f4eb8bfda199a05d794a28eb82c    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 10 Oct 2023 15:14:18 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 10 Oct 2023 15:14:18 -0400    

Autovacuum does not do it.  
  
Reported-by: Justin Pryzby  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 11  

commit   : 6dbd01b9fdad3150fb904444d010014c4f1da1a8    
  
author   : Jeff Davis <[email protected]>    
date     : Tue, 10 Oct 2023 11:01:13 -0700    
  
committer: Jeff Davis <[email protected]>    
date     : Tue, 10 Oct 2023 11:01:13 -0700    

Mark the buffers dirty before writing WAL.  
  
Discussion: https://postgr.es/m/[email protected]  
Reviewed-by: Heikki Linnakangas  
Backpatch-through: 11  

commit   : e187bf06c1e9abafd7f021e9706bf9e11e3dd594    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 9 Oct 2023 11:29:21 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 9 Oct 2023 11:29:21 -0400    

While these two built-in functions do exactly the same thing,  
CURRENT_USER seems preferable to use in documentation examples.  
It's easier to look up if the reader is unsure what it is.  
Also, this puts these examples in sync with an adjacent example  
that already used CURRENT_USER.  
  
Per question from Kirk Parker.  
  
Discussion: https://postgr.es/m/CANwZ8rmN_Eb0h0hoMRS8Feftaik0z89PxVsKg+cP+PctuOq=Qg@mail.gmail.com  

commit   : 9b3900cdb73418af42f5ca6aae821d51e57ca84e    
  
author   : Michael Paquier <[email protected]>    
date     : Tue, 3 Oct 2023 15:37:24 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Tue, 3 Oct 2023 15:37:24 +0900    

The code in charge of copying the contents of PgBackendStatus to local  
memory could fail on memory allocation because of an overflow on the  
amount of memory to use.  The overflow can happen when combining a high  
value track_activity_query_size (max at 1MB) with a large  
max_connections, when both multiplied get higher than INT32_MAX as both  
parameters treated as signed integers.  This could for example trigger  
with the following functions, all calling pgstat_read_current_status():  
- pg_stat_get_backend_subxact()  
- pg_stat_get_backend_idset()  
- pg_stat_get_progress_info()  
- pg_stat_get_activity()  
- pg_stat_get_db_numbackends()  
  
The change to use MemoryContextAllocHuge() has been introduced in  
8d0ddccec636, so backpatch down to 12.  
  
Author: Jakub Wartak  
Discussion: https://postgr.es/m/CAKZiRmw8QSNVw2qNK-dznsatQqz+9DkCquxP0GHbbv1jMkGHMA@mail.gmail.com  
Backpatch-through: 12  

commit   : 22b2e6e9df54f4d38e2fd20a882505d87c1f169f    
  
author   : Michael Paquier <[email protected]>    
date     : Tue, 3 Oct 2023 10:25:19 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Tue, 3 Oct 2023 10:25:19 +0900    

This commit changes the WAL reader routines so as a FATAL for the  
backend or exit(FAILURE) for the frontend is triggered if an allocation  
for a WAL record decode fails in walreader.c, rather than treating this  
case as bogus data, which would be equivalent to the end of WAL.  The  
key is to avoid palloc_extended(MCXT_ALLOC_NO_OOM) in walreader.c,  
relying on plain palloc() calls.  
  
The previous behavior could make WAL replay finish too early than it  
should.  For example, crash recovery finishing earlier may corrupt  
clusters because not all the WAL available locally was replayed to  
ensure a consistent state.  Out-of-memory failures would show up  
randomly depending on the memory pressure on the host, but one simple  
case would be to generate a large record, then replay this record after  
downsizing a host, as Ethan Mertz originally reported.  
  
This relies on bae868caf222, as the WAL reader routines now do the  
memory allocation required for a record only once its header has been  
fully read and validated, making xl_tot_len trustable.  Making the WAL  
reader react differently on out-of-memory or bogus record data would  
require ABI changes, so this is the safest choice for stable branches.  
Also, it is worth noting that 3f1ce973467a has been using a plain  
palloc() in this code for some time now.  
  
Thanks to Noah Misch and Thomas Munro for the discussion.  
  
Like the other commit, backpatch down to 12, leaving out v11 that will  
be EOL'd soon.  The behavior of considering a failed allocation as bogus  
data comes originally from 0ffe11abd3a0, where the record length  
retrieved from its header was not entirely trustable.  
  
Reported-by: Ethan Mertz  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: 12  

commit   : c02f29758bc8ccfb77e6bc84b248283ce87efb8f    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 2 Oct 2023 13:27:51 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 2 Oct 2023 13:27:51 -0400    

In a selective restore, ACLs for a table should be dumped if the  
table is selected to be dumped.  However, if the table has both  
table-level and column-level ACLs, only the table-level ACL was  
restored.  This happened because _tocEntryRequired assumed that  
an ACL could have only one dependency (the one on its table),  
and punted if there was more than one.  But since commit ea9125304,  
column-level ACLs also depend on the table-level ACL if any, to  
ensure correct ordering in parallel restores.  To fix, adjust the  
logic in _tocEntryRequired to ignore dependencies on ACLs.  
  
I extended a test case in 002_pg_dump.pl so that it purports to  
test for this; but in fact the test passes even without the fix.  
That's because this bug only manifests during a selective restore,  
while the scenarios 002_pg_dump.pl tests include only selective dumps.  
Perhaps somebody would like to extend the script so that it can test  
scenarios including selective restore, but I'm not touching that.  
  
Euler Taveira and Tom Lane, per report from Kong Man.  
Back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/DM4PR11MB73976902DBBA10B1D652F9498B06A@DM4PR11MB7397.namprd11.prod.outlook.com  

commit   : 2296bc36206b784d344b09191f2383e9e26e54ea    
  
author   : Tom Lane <[email protected]>    
date     : Sun, 1 Oct 2023 13:16:47 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Sun, 1 Oct 2023 13:16:47 -0400    

After receiving position data for a lexeme, tsvectorrecv()  
advanced its "datalen" value by (npos+1)*sizeof(WordEntry)  
where the correct calculation is (npos+1)*sizeof(WordEntryPos).  
This accidentally failed to render the constructed tsvector  
invalid, but it did result in leaving some wasted space  
approximately equal to the space consumed by the position data.  
That could have several bad effects:  
  
* Disk space is wasted if the received tsvector is stored into a  
  table as-is.  
  
* A legal tsvector could get rejected with "maximum total lexeme  
  length exceeded" if the extra space pushes it over the MAXSTRPOS  
  limit.  
  
* In edge cases, the finished tsvector could be assigned a length  
  larger than the allocated size of its palloc chunk, conceivably  
  leading to SIGSEGV when the tsvector gets copied somewhere else.  
  The odds of a field failure of this sort seem low, though valgrind  
  testing could probably have found this.  
  
While we're here, let's express the calculation as  
"sizeof(uint16) + npos * sizeof(WordEntryPos)" to avoid the type  
pun implicit in the "npos + 1" formulation.  It's not wrong  
given that WordEntryPos had better be 2 bytes to avoid padding  
problems, but it seems clearer this way.  
  
Report and patch by Denis Erokhin.  Back-patch to all supported  
versions.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : e37842e959f25102e60576c02abe3e52befd7e7b    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 29 Sep 2023 20:20:57 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 29 Sep 2023 20:20:57 -0400    

Add "-gmt 1" to our test invocations of the Tcl "clock" command,  
so that they do not consult the timezone environment.  While it  
doesn't really matter which timezone is used here, it does  
matter that the command not fall over entirely.  We've now  
discovered that at least on FreeBSD, "clock scan" will fail if  
/etc/localtime is missing.  It seems worth making the test  
insensitive to that.  
  
Per Tomas Vondras' buildfarm animal dikkop.  Thanks to  
Thomas Munro for the diagnosis.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : d8ceb98e4cb037f34178c6c2066771913d952000    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 29 Sep 2023 14:07:30 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 29 Sep 2023 14:07:30 -0400    

As of Xcode 15 (macOS Sonoma), the linker complains about duplicate  
references to the same library.  We see warnings about libpgport and  
libpgcommon being duplicated in many client executables.  This is a  
consequence of the hack introduced in commit 6b7ef076b to list  
libpgport before libpq while not removing it from $(LIBS).  
(Commit 8396447cd later applied the same rule to libpgcommon.)  
  
The concern in 6b7ef076b was to ensure that the client executable  
wouldn't unintentionally depend on pgport functions from libpq.  
That concern is obsolete on any platform for which we can do symbol  
export control, because if we can then the pgport functions in libpq  
won't be exposed anyway.  Hence, we can fix this problem by just  
removing libpgport and libpgcommon from $(libpq_pgport), and letting  
clients depend on the occurrences in $(LIBS).  
  
In the back branches, do that only on macOS (which we know has  
symbol export control).  In HEAD, let's be more aggressive and  
remove the extra libraries everywhere.  The only still-supported  
platforms that lack export control are MinGW/Cygwin, and it  
doesn't seem worth sweating over ABI stability details for those  
(or if somebody does care, it'd probably be possible to perform  
symbol export control for those too).  As well as being simpler,  
this might give some microscopic improvement in build time.  
  
The meson build system is not changed here, as it doesn't have  
this particular disease, though it does have some related issues  
that we'll fix separately.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 7478766f9d0cbe0b4f86c190c2d179a4d182e1b8    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 29 Sep 2023 13:13:54 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 29 Sep 2023 13:13:54 -0400    

Try to make these option descriptions a little clearer for novices.  
Per gripe from Attila Gulyás.  
  
Discussion: https://postgr.es/m/169590536647.3727336.11070254203649648453@wrigleys.postgresql.org  

commit   : 5db3c06a46c7b3f0cd14182ac95af9c25feea982    
  
author   : Daniel Gustafsson <[email protected]>    
date     : Fri, 29 Sep 2023 15:55:37 +0200    
  
committer: Daniel Gustafsson <[email protected]>    
date     : Fri, 29 Sep 2023 15:55:37 +0200    

Commit 7d3b7011b added a link to the statistics functions, which at the  
time were anchored under the section for statistics views.  aebe989477a  
added a separate section for statistics functions, but the link was not  
updated to point to the new anchor.  Fix by changing the xref.  
  
Backpatch to all supported branches.  
  
Author: Peter Smith <[email protected]>  
Discussion: https://postgr.es/m/CAHut+Ptr0jKzNNtWnssLq+3jNhbyaBseqf6NPrWHk08mQFRoTg@mail.gmail.com  
Backpatch-through: 11  

commit   : b36d72cbc6b008da062ac84850254a9de0da93d4    
  
author   : Peter Geoghegan <[email protected]>    
date     : Thu, 28 Sep 2023 16:29:24 -0700    
  
committer: Peter Geoghegan <[email protected]>    
date     : Thu, 28 Sep 2023 16:29:24 -0700    

nbtree's mark/restore processing failed to correctly handle an edge case  
involving array key advancement and related search-type scan key state.  
Scans with ScalarArrayScalarArrayOpExpr quals requiring mark/restore  
processing (for a merge join) could incorrectly conclude that an  
affected array/scan key must not have advanced during the time between  
marking and restoring the scan's position.  
  
As a result of all this, array key handling within btrestrpos could skip  
a required call to _bt_preprocess_keys().  This confusion allowed later  
primitive index scans to overlook tuples matching the true current array  
keys.  The scan's search-type scan keys would still have spurious values  
corresponding to the final array element(s) -- not values matching the  
first/now-current array element(s).  
  
To fix, remember that "array key wraparound" has taken place during the  
ongoing btrescan in a flag variable stored in the scan's state, and use  
that information at the point where btrestrpos decides if another call  
to _bt_preprocess_keys is required.  
  
Oversight in commit 70bc5833, which taught nbtree to handle array keys  
during mark/restore processing, but missed this subtlety.  That commit  
was itself a bug fix for an issue in commit 9e8da0f7, which taught  
nbtree to handle ScalarArrayOpExpr quals natively.  
  
Author: Peter Geoghegan <[email protected]>  
Discussion: https://postgr.es/m/CAH2-WzkgP3DDRJxw6DgjCxo-cu-DKrvjEv_ArkP2ctBJatDCYg@mail.gmail.com  
Backpatch: 11- (all supported branches).  

commit   : d6425987ba76317b706fbf155c5a08a7beb1f770    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 28 Sep 2023 14:05:25 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 28 Sep 2023 14:05:25 -0400    

This code was sloppy about comparison of index columns that  
are expressions.  It didn't reliably reject cases where one  
index has an expression where the other has a plain column,  
and it could index off the start of the attmap array, leading  
to a Valgrind complaint (though an actual crash seems unlikely).  
  
I'm not sure that the expression-vs-column sloppiness leads  
to any visible problem in practice, because the subsequent  
comparison of the two expression lists would reject cases  
where the indexes have different numbers of expressions  
overall.  Maybe we could falsely match indexes having the  
same expressions in different column positions, but it'd  
require unlucky contents of the word before the attmap array.  
It's not too surprising that no problem has been reported  
from the field.  Nonetheless, this code is clearly wrong.  
  
Per bug #18135 from Alexander Lakhin.  Back-patch to all  
supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : abe423712a12bfd53d2e35b5ca06f599ed926b9a    
  
author   : Tom Lane <[email protected]>    
date     : Tue, 26 Sep 2023 21:06:21 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Tue, 26 Sep 2023 21:06:21 -0400    

We started to use this linker switch in commit 9df308697 of  
2004-07-13, which was in the OS X 10.3 era.  Apparently it's been a  
no-op since around OS X 10.9.  Apple's most recent toolchain version  
actively complains about it, so it's time to get rid of it.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 9a59ff483e2c46ad24f23d1221dad418eeae4c1a    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 26 Sep 2023 19:44:21 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 26 Sep 2023 19:44:21 -0400    

Reported-by: Sami Imseih  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 11  

commit   : cc067621416687b56e0b536c51710b4ae456f2bc    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 26 Sep 2023 19:23:59 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 26 Sep 2023 19:23:59 -0400    

Reported-by: [email protected]  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 11  

commit   : 95b6b230a730d29fdb2f7f634da1afbb1f0c280f    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 26 Sep 2023 19:02:18 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 26 Sep 2023 19:02:18 -0400    

Reported-by: Gurjeet Singh  
  
Discussion: https://postgr.es/m/CABwTF4WYPD9ov-kcSq1+J+ZJ5wYDQLXquY6Lu2cvb-Y7pTpSGA@mail.gmail.com  
  
Backpatch-through: 11  

commit   : 35dd1aecf23c73777062a3d3b7e3aaf2000f5cfb    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 26 Sep 2023 18:54:10 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 26 Sep 2023 18:54:10 -0400    

Also mention that mismatching primary/standby LSNs should never  
happen.  
  
Reported-by: Nikolay Samokhvalov  
  
Discussion: https://postgr.es/m/CAM527d8heqkjG5VrvjU3Xjsqxg41ufUyabD9QZccdAxnpbRH-Q@mail.gmail.com  
  
Backpatch-through: 11  

commit   : 3d398ae4a5bb08ed146f94cedc4f4ca39dd8eed7    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 26 Sep 2023 17:31:06 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 26 Sep 2023 17:31:06 -0400    

Reported-by: hape <[email protected]>  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch-through: 11  

commit   : 26917ebea745b4254895b816e35375865cfa4177    
  
author   : Heikki Linnakangas <[email protected]>    
date     : Tue, 26 Sep 2023 14:14:49 +0300    
  
committer: Heikki Linnakangas <[email protected]>    
date     : Tue, 26 Sep 2023 14:14:49 +0300    

Yet another bug in the ilk of commits a7ee7c851 and 741b88435. In  
741b88435, we took care to clear the memorized location of the  
downlink when we split the parent page, because splitting the parent  
page can move the downlink. But we missed that even *updating* a tuple  
on the parent can move it, because updating a tuple on a gist page is  
implemented as a delete+insert, so the updated tuple gets moved to the  
end of the page.  
  
This commit fixes the bug in two different ways (belt and suspenders):  
  
1. Clear the downlink when we update a tuple on the parent page, even  
   if it's not split. This the same approach as in commits a7ee7c851  
   and 741b88435.  
  
   I also noticed that gistFindCorrectParent did not clear the  
   'downlinkoffnum' when it stepped to the right sibling. Fix that  
   too, as it seems like a clear bug even though I haven't been able  
   to find a test case to hit that.  
  
2. Change gistFindCorrectParent so that it treats 'downlinkoffnum'  
   merely as a hint. It now always first checks if the downlink is  
   still at that location, and if not, it scans the page like before.  
   That's more robust if there are still more cases where we fail to  
   clear 'downlinkoffnum' that we haven't yet uncovered. With this,  
   it's no longer necessary to meticulously clear 'downlinkoffnum',  
   so this makes the previous fixes unnecessary, but I didn't revert  
   them because it still seems nice to clear it when we know that the  
   downlink has moved.  
  
Also add the test case using the same test data that Alexander  
posted. I tried to reduce it to a smaller test, and I also tried to  
reproduce this with different test data, but I was not able to, so  
let's just include what we have.  
  
Backpatch to v12, like the previous fixes.  
  
Reported-by: Alexander Lakhin  
Discussion: https://www.postgresql.org/message-id/[email protected]  

commit   : 11bb77da233b0056fd44009b04171692a668626d    
  
author   : Michael Paquier <[email protected]>    
date     : Tue, 26 Sep 2023 08:16:47 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Tue, 26 Sep 2023 08:16:47 +0900    

There was no mention of this command in the documentation, and it is  
useful to run the TAP tests of a target source directory.  
  
Author: Yugo Nagata  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: 11  

commit   : bde2f1847f51577b8e5a13a3ccc2cda9626fb214    
  
author   : Thomas Munro <[email protected]>    
date     : Tue, 26 Sep 2023 09:07:26 +1300    
  
committer: Thomas Munro <[email protected]>    
date     : Tue, 26 Sep 2023 09:07:26 +1300    

bae868ca removed a check that was still needed.  If you had an  
xl_tot_len at the end of a page that was too small for a record header,  
but not big enough to span onto the next page, we'd immediately perform  
the CRC check using a bogus large length.  Because of arbitrary coding  
differences between the CRC implementations on different platforms,  
nothing very bad happened on common modern systems.  On systems using  
the _sb8.c fallback we could segfault.  
  
Restore that check, add a new assertion and supply a test for that case.  
Back-patch to 12, like bae868ca.  
  
Tested-by: Tom Lane <[email protected]>  
Tested-by: Alexander Lakhin <[email protected]>  
Discussion: https://postgr.es/m/CA%2BhUKGLCkTT7zYjzOxuLGahBdQ%3DMcF%3Dz5ZvrjSOnW4EDhVjT-g%40mail.gmail.com  

commit   : fd7a114dbb4e8b700b0b738bb9c513b5fa3198a3    
  
author   : Andres Freund <[email protected]>    
date     : Mon, 25 Sep 2023 11:50:02 -0700    
  
committer: Andres Freund <[email protected]>    
date     : Mon, 25 Sep 2023 11:50:02 -0700    

For some reason I used not_like = { pg_dumpall_dbprivs => 1, } in the test  
condition of one of the tests added in in c66a7d75e65. That doesn't make sense  
for two reasons: 1) not_like isn't a valid test condition 2) the database  
should not be dumped in any of the tests.  Due to 1), the test achieved its  
goal, but clearly the formulation is confusing.  Instead use like => {}, with  
a comment explaining why.  
  
Reported-by: Peter Eisentraut <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  
Backpatch: 11-, like c66a7d75e65  

commit   : 4435a8d5dbabbe41fc1c4b7b8dff34902853a07b    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 25 Sep 2023 14:41:57 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 25 Sep 2023 14:41:57 -0400    

Parse analysis of a CallStmt will inject mutable information,  
for instance the OID of the called procedure, so that subsequent  
DDL may create a need to re-parse the CALL.  We failed to detect  
this for CALLs in plpgsql routines, because no dependency information  
was collected when putting a CallStmt into the plan cache.  That  
could lead to misbehavior or strange errors such as "cache lookup  
failed".  
  
Before commit ee895a655, the issue would only manifest for CALLs  
appearing in atomic contexts, because we re-planned non-atomic  
CALLs every time through anyway.  
  
It is now apparent that extract_query_dependencies() probably  
needs a special case for every utility statement type for which  
stmt_requires_parse_analysis() returns true.  I wanted to add  
something like Assert(!stmt_requires_parse_analysis(...)) when  
falling out of extract_query_dependencies_walker without doing  
anything, but there are API issues as well as a more fundamental  
point: stmt_requires_parse_analysis is supposed to be applied to  
raw parser output, so it'd be cheating to assume it will give the  
correct answer for post-parse-analysis trees.  I contented myself  
with adding a comment.  
  
Per bug #18131 from Christian Stork.  Back-patch to all supported  
branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 4a81ed29d3c956ad11354c0dc4514f5af4a0d8d7    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 25 Sep 2023 11:50:28 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 25 Sep 2023 11:50:28 -0400    

The initial estimate of the number of distinct ParsedWords is just  
that: an estimate.  Don't let it exceed what palloc is willing to  
allocate.  If in fact we need more entries, we'll eventually fail  
trying to enlarge the array.  But if we don't, this allows success on  
inputs that currently draw "invalid memory alloc request size".  
  
Per bug #18080 from Uwe Binder.  Back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : af9f6cd1ddfa2bbc62c853f365fcf12d93bcde92    
  
author   : Alvaro Herrera <[email protected]>    
date     : Mon, 25 Sep 2023 14:34:05 +0200    
  
committer: Alvaro Herrera <[email protected]>    
date     : Mon, 25 Sep 2023 14:34:05 +0200    

Commit cda6a8d01d39 removed a few datatypes, but didn't update  
pg_upgrade --check to throw error if these types are used.  So the users  
find that pg_upgrade --check tells them that everything is fine, only to  
fail when the real upgrade is attempted.  
  
Reviewed-by: Tristan Partin <[email protected]>  
Reviewed-by: Suraj Kharage <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  

commit   : 82314dbfca7f257ac515668a16c65fc03976bc15    
  
author   : Thomas Munro <[email protected]>    
date     : Sat, 23 Sep 2023 14:13:06 +1200    
  
committer: Thomas Munro <[email protected]>    
date     : Sat, 23 Sep 2023 14:13:06 +1200    

'Q' for 64 bit integers turns out not to work on 32 bit Perl, as  
revealed by the build farm.  Use 'II' instead, and deal with endianness.  
  
Back-patch to 12, like bae868ca.  
  
Discussion: https://postgr.es/m/ZQ4r1vHcryBsSi_V%40paquier.xyz  

commit   : e8f3c0687116eb31fe7be74e0fbd2f5c0f29bb3b    
  
author   : Thomas Munro <[email protected]>    
date     : Sat, 23 Sep 2023 10:26:24 +1200    
  
committer: Thomas Munro <[email protected]>    
date     : Sat, 23 Sep 2023 10:26:24 +1200    

xl_tot_len comes first in a WAL record.  Usually we don't trust it to be  
the true length until we've validated the record header.  If the record  
header was split across two pages, previously we wouldn't do the  
validation until after we'd already tried to allocate enough memory to  
hold the record, which was bad because it might actually be garbage  
bytes from a recycled WAL file, so we could try to allocate a lot of  
memory.  Release 15 made it worse.  
  
Since 70b4f82a4b5, we'd at least generate an end-of-WAL condition if the  
garbage 4 byte value happened to be > 1GB, but we'd still try to  
allocate up to 1GB of memory bogusly otherwise.  That was an  
improvement, but unfortunately release 15 tries to allocate another  
object before that, so you could get a FATAL error and recovery could  
fail.  
  
We can fix both variants of the problem more fundamentally using  
pre-existing page-level validation, if we just re-order some logic.  
  
The new order of operations in the split-header case defers all memory  
allocation based on xl_tot_len until we've read the following page.  At  
that point we know that its first few bytes are not recycled data, by  
checking its xlp_pageaddr, and that its xlp_rem_len agrees with  
xl_tot_len on the preceding page.  That is strong evidence that  
xl_tot_len was truly the start of a record that was logged.  
  
This problem was most likely to occur on a standby, because  
walreceiver.c recycles WAL files without zeroing out trailing regions of  
each page.  We could fix that too, but it wouldn't protect us from rare  
crash scenarios where the trailing zeroes don't make it to disk.  
  
With reliable xl_tot_len validation in place, the ancient policy of  
considering malloc failure to indicate corruption at end-of-WAL seems  
quite surprising, but changing that is left for later work.  
  
Also included is a new TAP test to exercise various cases of end-of-WAL  
detection by writing contrived data into the WAL from Perl.  
  
Back-patch to 12.  We decided not to put this change into the final  
release of 11.  
  
Author: Thomas Munro <[email protected]>  
Author: Michael Paquier <[email protected]>  
Reported-by: Alexander Lakhin <[email protected]>  
Reviewed-by: Noah Misch <[email protected]> (the idea, not the code)  
Reviewed-by: Michael Paquier <[email protected]>  
Reviewed-by: Sergei Kornilov <[email protected]>  
Reviewed-by: Alexander Lakhin <[email protected]>  
Discussion: https://postgr.es/m/17928-aa92416a70ff44a2%40postgresql.org  

commit   : d7cc7184ccca230fd442ca26a8efe44d283724d8    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 22 Sep 2023 14:52:36 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 22 Sep 2023 14:52:36 -0400    

The previous wording had a faint archaic whiff to it, and more  
importantly used "catalogs" as a verb, which while cutely  
self-referential seems likely to provoke confusion in this  
particular context.  Also consistently use "kind" not "type" to  
refer to the different kinds of relations distinguished by relkind.  
  
Per gripe from Martin Nash.  Back-patch to supported versions.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 7cabb20a95aeea441c82552246732ea507f71469    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 21 Sep 2023 23:11:31 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 21 Sep 2023 23:11:31 -0400    

In older branches, COMMIT/ROLLBACK AND CHAIN failed to propagate  
the current transaction's properties to the new transaction if  
there was any open subtransaction (unreleased savepoint).  
Instead, some previous transaction's properties would be restored.  
This is because the "if (s->chain)" check in CommitTransactionCommand  
examined the wrong instance of the "chain" flag and falsely  
concluded that it didn't need to save transaction properties.  
  
Our regression tests would have noticed this, except they used  
identical transaction properties for multiple tests in a row,  
so that the faulty behavior was not distinguishable from correct  
behavior.  
  
Commit 12d768e70 fixed the problem in v15 and later, but only rather  
accidentally, because I removed the "if (s->chain)" test to avoid a  
compiler warning, while not realizing that the warning was flagging a  
real bug.  
  
In v14 and before, remove the if-test and save transaction properties  
unconditionally; just as in the newer branches, that's not expensive  
enough to justify thinking harder.  
  
Add the comment and extra regression test to v15 and later to  
forestall any future recurrence, but there's no live bug in those  
branches.  
  
Patch by me, per bug #18118 from Liu Xiang.  Back-patch to v12 where  
the AND CHAIN feature was added.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : c50ad79f609c8a66eef3e58afd97b6987df59f96    
  
author   : Etsuro Fujita <[email protected]>    
date     : Thu, 21 Sep 2023 19:45:09 +0900    
  
committer: Etsuro Fujita <[email protected]>    
date     : Thu, 21 Sep 2023 19:45:09 +0900    

The comment introduced by commit e7cb7ee14 was a bit too terse, which  
could lead to extensions doing different things within the hook function  
than we intend to allow.  Extend the comment to explain what they can do  
within the hook function.  
  
Back-patch to all supported branches.  
  
In passing, I rephrased a nearby comment that I recently added to the  
back branches.  
  
Reviewed by David Rowley and Andrei Lepikhov.  
  
Discussion: https://postgr.es/m/CAPmGK15SBPA1nr3Aqsdm%2BYyS-ay0Ayo2BRYQ8_A2To9eLqwopQ%40mail.gmail.com  

commit   : df4eddbe435953fa22e5bc873abe191611d69854    
  
author   : Heikki Linnakangas <[email protected]>    
date     : Tue, 19 Sep 2023 11:53:51 +0300    
  
committer: Heikki Linnakangas <[email protected]>    
date     : Tue, 19 Sep 2023 11:53:51 +0300    

The text got the condition backwards, it's "NSN > LSN", not "NSN < LSN".  
While we're at it, expand it a little for clarity.  
  
Reviewed-by: Daniel Gustafsson  
Discussion: https://www.postgresql.org/message-id/[email protected]  

commit   : 99d27e55ccac335317aa12a9440a946da915decf    
  
author   : Michael Paquier <[email protected]>    
date     : Tue, 19 Sep 2023 08:31:29 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Tue, 19 Sep 2023 08:31:29 +0900    

PLy_elog() was not able to handle correctly cases where a SPI called  
failed, which would fill in a DETAIL string able to trigger an  
assertion.  We may want to improve this infrastructure so as it is able  
to provide any extra detail information provided by an error stack, but  
this is left as a future improvement as it could impact existing error  
stacks and any applications that depend on them.  For now, the assertion  
is removed and a regression test is added to cover the case of a failure  
with a detail string.  
  
This problem exists since 2bd78eb8d51c, so backpatch all the way down  
with tweaks to the regression tests output added where required.  
  
Author: Alexander Lakhin  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: 11  

commit   : 1233370791fe12f7d9f7cb8b994cab70012bd961    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 18 Sep 2023 14:27:47 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 18 Sep 2023 14:27:47 -0400    

cursor_to_xmlschema() assumed that any Portal must have a tupDesc,  
which is not so.  Add a defensive check.  
  
It's plausible that this mistake occurred because of the rather  
poorly chosen name of the lookup function SPI_cursor_find(),  
which in such cases is returning something that isn't very much  
like a cursor.  Add some documentation to try to forestall future  
errors of the same ilk.  
  
Report and patch by Boyu Yang (docs changes by me).  Back-patch  
to all supported branches.  
  
Discussion: https://postgr.es/m/dd343010-c637-434c-a8cb-418f53bda3b8.yangboyu.yby@alibaba-inc.com  

commit   : d29812c0c6cd58794cb1c0eb1603a17a1ceb0d0b    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 15 Sep 2023 17:01:26 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 15 Sep 2023 17:01:26 -0400    

expandRecordVariable() failed to adjust the parse nesting structure  
correctly when recursing to inspect an outer-level Var.  This could  
result in assertion failures or core dumps in corner cases.  
  
Likewise, get_name_for_var_field() failed to adjust the deparse  
namespace stack correctly when recursing to inspect an outer-level  
Var.  In this case the likely result was a "bogus varno" error  
while deparsing a view.  
  
Per bug #18077 from Jingzhou Fu.  Back-patch to all supported  
branches.  
  
Richard Guo, with some adjustments by me  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 8a15b4178c40247ad56158b7ab79d66e9c8af908    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 15 Sep 2023 16:39:27 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 15 Sep 2023 16:39:27 -0400    

This is a back-patch of commit d57534740 ("Fix EXPLAIN of SEARCH  
BREADTH FIRST with a constant initial value") into pre-v14 branches.  
At the time I'd thought it was not needed in branches that lack the  
SEARCH/CYCLE feature, but that was just a failure of imagination.  
It's possible to demonstrate "record type has not been registered"  
failures in older branches too, during deparsing of views that contain  
references to fields of composite constants.  
  
Back-patch only the code changes, as the test cases added by d57534740  
all require SEARCH/CYCLE syntax.  A suitable test case will be added  
in the upcoming fix for bug #18077.  
  
Discussion: https://postgr.es/m/[email protected]  
Discussion: https://postgr.es/m/[email protected]  

commit   : 2f02d4a2b9cbf4991a73e15d4674d8cfa905bb61    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 15 Sep 2023 16:20:08 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 15 Sep 2023 16:20:08 -0400    

Teach get_expr_result_type() to manufacture a tuple descriptor directly  
from a RowExpr node.  If the RowExpr has type RECORD, this is the only  
way to get a tupdesc for its result, since even if the rowtype has been  
blessed, we don't have its typmod available at this point.  (If the  
RowExpr has some named composite type, we continue to let the existing  
code handle it, since the RowExpr might well not have the correct column  
names embedded in it.)  
  
This fixes assorted corner cases illustrated by the added regression  
tests.  
  
This is a back-patch of the v13-era commit 8b7a0f1d1 into previous  
branches.  At the time I'd judged it not important enough to back-patch,  
but the upcoming fix for bug #18077 includes a test case that depends  
on this working correctly; and 8b7a0f1d1 has now aged long enough to  
have good confidence that it won't break anything.  
  
Discussion: https://postgr.es/m/[email protected]  
Discussion: https://postgr.es/m/[email protected]  

commit   : 50d44c16335241ccf48c3814fb6cd584be300c09    
  
author   : Michael Paquier <[email protected]>    
date     : Thu, 14 Sep 2023 16:00:44 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Thu, 14 Sep 2023 16:00:44 +0900    

This reverts commit a0d87bcd9b57, following a remark from Andres Frend  
that the new error can be triggered with an incorrect SET TRANSACTION  
SNAPSHOT command without being really helpful for the user as it uses  
the internal file name.  
  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: 11  

commit   : 33bc7d4246956ada7830984d74114d3ef0f40201    
  
author   : Michael Paquier <[email protected]>    
date     : Thu, 14 Sep 2023 10:30:34 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Thu, 14 Sep 2023 10:30:34 +0900    

When a snapshot file fails to be read in ImportSnapshot(), it would  
issue an ERROR as "invalid snapshot identifier" when opening a stream  
for it in read-only mode.  This error message is reworded to be the same  
as all the other messages used in this case on failure, which is useful  
when debugging this area.  
  
Thinko introduced by bb446b689b66 where snapshot imports have been  
added.  A backpatch down to 11 is done as this can improve any work  
related to snapshot imports in older branches.  
  
Author: Bharath Rupireddy  
Reviewed-by: Daniel Gustafsson  
Discussion: https://postgr.es/m/CALj2ACWmr=3KdxDkm8h7Zn1XxBoF6hdzq8WQyMn2y1OL5RYFrg@mail.gmail.com  
Backpatch-through: 11  

commit   : 012b80ad20c2f8459d4cbe083e3f0323050d275b    
  
author   : Thomas Munro <[email protected]>    
date     : Wed, 13 Sep 2023 14:32:24 +1200    
  
committer: Thomas Munro <[email protected]>    
date     : Wed, 13 Sep 2023 14:32:24 +1200    

If an out-of-memory error was thrown at an unfortunate time,  
ensure_record_cache_typmod_slot_exists() could leak memory and leave  
behind a global state that produced an infinite loop on the next call.  
  
Fix by merging RecordCacheArray and RecordIdentifierArray into a single  
array.  With only one allocation or re-allocation, there is no  
intermediate state.  
  
Back-patch to all supported releases.  
  
Reported-by: "James Pang (chaolpan)" <[email protected]>  
Reviewed-by: Michael Paquier <[email protected]>  
Discussion: https://postgr.es/m/PH0PR11MB519113E738814BDDA702EDADD6EFA%40PH0PR11MB5191.namprd11.prod.outlook.com  

commit   : 7e57208ed51a9f29e7e1a5d103452bc0e54f5a96    
  
author   : Amit Kapila <[email protected]>    
date     : Tue, 12 Sep 2023 09:44:37 +0530    
  
committer: Amit Kapila <[email protected]>    
date     : Tue, 12 Sep 2023 09:44:37 +0530    

The transactions and subtransactions array that was allocated under  
snapshot builder memory context and recorded during decoding was not  
cleared in case of errors. This can result in an assertion failure if we  
attempt to retry logical decoding within the same session. To address this  
issue, we register a callback function under the snapshot builder memory  
context to clear the recorded transactions and subtransactions array along  
with the context.  
  
This problem doesn't exist in PG16 and HEAD as instead of using  
InitialRunningXacts, we added the list of transaction IDs and  
sub-transaction IDs, that have modified catalogs and are running during  
snapshot serialization, to the serialized snapshot (see commit 7f13ac8123).  
  
Author: Hou Zhijie  
Reviewed-by: Amit Kapila  
Backpatch-through: 11  
Discussion: http://postgr.es/m/[email protected]  

commit   : 7b03d3a3ba45b51e81b2a0706be1e57449710758    
  
author   : Fujii Masao <[email protected]>    
date     : Wed, 6 Oct 2021 00:16:03 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Wed, 6 Oct 2021 00:16:03 +0900    

Commit 0668719801 changed XLogPageRead() so that it validated the page  
header, if invalid page header was found reset the error message and  
retried reading the page, to fix the scenario where streaming standby  
got stuck at a continuation record. This change hid the error message  
about invalid page header, which would make it harder for users to  
investigate what the actual issue was found in WAL.  
  
To fix the issue, this commit makes XLogPageRead() report the error  
message when invalid page header is found.  
  
When not in standby mode, an invalid page header should cause recovery  
to end, not retry reading the page, so XLogPageRead() doesn't need to  
validate the page header for the retry. Instead, ReadPageInternal() should  
be responsible for the validation in that case. Therefore this commit  
changes XLogPageRead() so that if not in standby mode it doesn't validate  
the page header for the retry.  
  
This commit has been originally pushed as of 68601985e699 for 15 and  
newer versions, but not to the older branches.  A recent investigation  
related to WAL replay failures has showed up that the lack of this patch  
in 12~14 is an issue, as we want to be able to improve the WAL reader to  
make a correct distinction between the end-of-wal and OOM cases when  
validating record headers.  REL_11_STABLE is left out as it will be  
EOL'd soon.  
  
Reported-by: Yugo Nagata  
Author: Yugo Nagata, Kyotaro Horiguchi  
Reviewed-by: Ranier Vilela, Fujii Masao  
Discussion: https://postgr.es/m/[email protected]  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: 12  

commit   : c8cea8159f79e9c590ec924c2e4ac83be4453ad7    
  
author   : Bruce Momjian <[email protected]>    
date     : Fri, 8 Sep 2023 17:25:14 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Fri, 8 Sep 2023 17:25:14 -0400    

Reported-by: Laurenz Albe  
  
Discussion: https://postgr.es/m/[email protected]  
  
Author: Laurenz Albe  
  
Backpatch-through: 11  

commit   : 2fe968ce9347c0cff22db7190dc87c795f525dbb    
  
author   : Michael Paquier <[email protected]>    
date     : Thu, 7 Sep 2023 14:12:34 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Thu, 7 Sep 2023 14:12:34 +0900    

pgbouncer can cause PQbackendPID() to return negative values due to it  
filling be_pid with random bytes (even these days pid_max can only be  
set up to 2^22 on 64b machines on Linux, for example, so this cannot  
happen with normal PID numbers).  When this happens, pg_basebackup may  
generate a temporary slot name that may not be accepted by the parser,  
leading to spurious failures, like:  
pg_basebackup: error: could not send replication command  
ERROR:  replication slot name "pg_basebackup_-1201966863" contains  
invalid character  
  
This commit fixes that problem by formatting the result from  
PQbackendPID() as an unsigned integer when creating the temporary  
replication slot name, so as the invalid character is gone and the  
command can be parsed.  
  
Author: Jelte Fennema  
Reviewed-by: Daniel Gustafsson, Nishant Sharma  
Discussion: https://postgr.es/m/CAGECzQQOGvYfp8ziF4fWQ_o8s2K7ppaoWBQnTmdakn3s-4Z=5g@mail.gmail.com  
Backpatch-through: 11  

commit   : d6f90b3df90ac458ef13e590530b7aa4fa4da656    
  
author   : Bruce Momjian <[email protected]>    
date     : Wed, 6 Sep 2023 16:52:24 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Wed, 6 Sep 2023 16:52:24 -0400    

Reported-by: [email protected]  
  
Diagnosed-by: Laurenz Albe  
  
Discussion: https://postgr.es/m/[email protected]  
  
Author: Laurenz Albe  
  
Backpatch-through: 11  

commit   : caeb4cf191fac0f189647a64e5d246d4f378a960    
  
author   : Bruce Momjian <[email protected]>    
date     : Tue, 5 Sep 2023 13:05:27 -0400    
  
committer: Bruce Momjian <[email protected]>    
date     : Tue, 5 Sep 2023 13:05:27 -0400    

Reported-by: Ryo Matsumura  
  
Discussion: https://postgr.es/m/TYCPR01MB11316B3FB56EE54D70BF0CEF6E8E4A@TYCPR01MB11316.jpnprd01.prod.outlook.com  
  
Backpatch-through: 11  

commit   : 40ddb8db9f2c62aed5025aaf503e188f7d1f27af    
  
author   : Michael Paquier <[email protected]>    
date     : Mon, 4 Sep 2023 14:55:57 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Mon, 4 Sep 2023 14:55:57 +0900    

This could lead to an imprecise choice when splitting an index page of a  
GiST index on a tsvector, deciding which entries should remain on the  
old page and which entries should move to a new page.  
  
This is wrong since tsearch2 has been moved into core with commit  
140d4ebcb46e, so backpatch all the way down.  This error has been  
spotted by valgrind.  
  
Author: Alexander Lakhin  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: 11  

commit   : a67cf941151f3fcf35fb3ccf3446644ded89a942    
  
author   : Etsuro Fujita <[email protected]>    
date     : Wed, 30 Aug 2023 17:15:08 +0900    
  
committer: Etsuro Fujita <[email protected]>    
date     : Wed, 30 Aug 2023 17:15:08 +0900    

Commit e4106b252 should have updated this test, but did not; back-patch  
to all supported branches.  
  
Reviewed by Richard Guo.  
  
Discussion: http://postgr.es/m/CAPmGK15nR0NXLSCKQAcqbZbTzrzd5MozowWnTnGfPkayndF43Q%40mail.gmail.com  

commit   : f06e1711d2e64aa6f56fe7aee49d56ea085ed002    
  
author   : Andrew Dunstan <[email protected]>    
date     : Sun, 27 Aug 2023 07:01:26 -0400    
  
committer: Andrew Dunstan <[email protected]>    
date     : Sun, 27 Aug 2023 07:01:26 -0400    

The offending code is not present in later branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : b808dbf905827de5bbbd933677d57b6c4d35c111    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 24 Aug 2023 12:02:40 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 24 Aug 2023 12:02:40 -0400    

Revalidation of a plancache entry (after a cache invalidation event)  
requires acquiring a snapshot.  Normally that is harmless, but not  
if the cached statement is one that needs to run without acquiring a  
snapshot.  We were already aware of that for TransactionStmts,  
but for some reason hadn't extrapolated to the other statements that  
PlannedStmtRequiresSnapshot() knows mustn't set a snapshot.  This can  
lead to unexpected failures of commands such as SET TRANSACTION  
ISOLATION LEVEL.  We can fix it in the same way, by excluding those  
command types from revalidation.  
  
However, we can do even better than that: there is no need to  
revalidate for any statement type for which parse analysis, rewrite,  
and plan steps do nothing interesting, which is nearly all utility  
commands.  To mechanize this, invent a parser function  
stmt_requires_parse_analysis() that tells whether parse analysis does  
anything beyond wrapping a CMD_UTILITY Query around the raw parse  
tree.  If that's what it does, then rewrite and plan will just  
skip the Query, so that it is not possible for the same raw parse  
tree to produce a different plan tree after cache invalidation.  
  
stmt_requires_parse_analysis() is basically equivalent to the  
existing function analyze_requires_snapshot(), except that for  
obscure reasons that function omits ReturnStmt and CallStmt.  
It is unclear whether those were oversights or intentional.  
I have not been able to demonstrate a bug from not acquiring a  
snapshot while analyzing these commands, but at best it seems mighty  
fragile.  It seems safer to acquire a snapshot for parse analysis of  
these commands too, which allows making stmt_requires_parse_analysis  
and analyze_requires_snapshot equivalent.  
  
In passing this fixes a second bug, which is that ResetPlanCache  
would exclude ReturnStmts and CallStmts from revalidation.  
That's surely *not* safe, since they contain parsable expressions.  
  
Per bug #18059 from Pavel Kulakov.  Back-patch to all supported  
branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 2607380c955d2b8a8a6e06ced7ec2007705e102d    
  
author   : Daniel Gustafsson <[email protected]>    
date     : Wed, 23 Aug 2023 14:13:07 +0200    
  
committer: Daniel Gustafsson <[email protected]>    
date     : Wed, 23 Aug 2023 14:13:07 +0200    

The list of external language drivers and procedural languages was  
never complete or exhaustive, and rather than attempting to manage  
it the content has migrated to the wiki.  This replaces the tables  
altogether with links to the wiki as we regularly get requests for  
adding various projects,  which we reject without any clear policy  
for why or how the content should be managed.  
  
The threads linked to below are the most recent discussions about  
this, the archives contain many more.  
  
Backpatch to all supported branches since the list on the wiki  
applies to all branches.  
  
Author: Jonathan Katz <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: v11  

commit   : 01993ac748fda69495912205440a767edef0e039    
  
author   : Andrew Dunstan <[email protected]>    
date     : Tue, 22 Aug 2023 11:57:08 -0400    
  
committer: Andrew Dunstan <[email protected]>    
date     : Tue, 22 Aug 2023 11:57:08 -0400    

Attribute missing values might be needed past the lifetime of the tuple  
descriptors from which they are extracted. To avoid possibly using  
pointers for by-reference values which might thus be left dangling, we  
cache a datumCopy'd version of the datum in the TopMemoryContext. Since  
we first search for the value this only needs to be done once per  
session for any such value.  
  
Original complaint from Tom Lane, idea for mitigation by Andrew Dunstan,  
tweaked by Tom Lane.  
  
Backpatch to version 11 where missing values were introduced.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 01bc42634e59e1e746eec236ac17247bdcc228e9    
  
author   : Jeff Davis <[email protected]>    
date     : Thu, 10 Aug 2023 10:16:59 -0700    
  
committer: Jeff Davis <[email protected]>    
date     : Thu, 10 Aug 2023 10:16:59 -0700    

The fix itself is fine, but the test revealed other problems related  
to parallel query that are not easily fixable. Remove the test for  
now to fix the buildfarm.  
  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: 11  

commit   : a86d4022788943b6bd3141b64d2a3e1129570087    
  
author   : Jeff Davis <[email protected]>    
date     : Mon, 7 Aug 2023 15:11:18 -0700    
  
committer: Jeff Davis <[email protected]>    
date     : Mon, 7 Aug 2023 15:11:18 -0700    

Renaming a role can affect the meaning of the special string $user, so  
must cause search_path to be recalculated.  
  
Discussion: https://postgr.es/m/[email protected]  
Reviewed-by: Nathan Bossart, Michael Paquier  
Backpatch-through: 11