PostgreSQL 14.13 commit log

commit   : 33965476b6ef6a37af2bc9bb1b5b2af17c35dc5e    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 5 Aug 2024 16:08:36 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 5 Aug 2024 16:08:36 -0400    

commit   : b942cc42b7c659da70c205151bde5e1f9af2ece0    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 5 Aug 2024 14:03:20 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 5 Aug 2024 14:03:20 -0400    

Security: CVE-2024-7348  

commit   : 72ef1675e2bc502b31854b1c31ccf22fde7cde47    
  
author   : Masahiko Sawada <[email protected]>    
date     : Mon, 5 Aug 2024 06:05:23 -0700    
  
committer: Masahiko Sawada <[email protected]>    
date     : Mon, 5 Aug 2024 06:05:23 -0700    

When pg_dump retrieves the list of database objects and performs the  
data dump, there was possibility that objects are replaced with others  
of the same name, such as views, and access them. This vulnerability  
could result in code execution with superuser privileges during the  
pg_dump process.  
  
This issue can arise when dumping data of sequences, foreign  
tables (only 13 or later), or tables registered with a WHERE clause in  
the extension configuration table.  
  
To address this, pg_dump now utilizes the newly introduced  
restrict_nonsystem_relation_kind GUC parameter to restrict the  
accesses to non-system views and foreign tables during the dump  
process. This new GUC parameter is added to back branches too, but  
these changes do not require cluster recreation.  
  
Back-patch to all supported branches.  
  
Reviewed-by: Noah Misch  
Security: CVE-2024-7348  
Backpatch-through: 12  

commit   : 426a224a6cb8f41776949eb20e40457150e8ee6e    
  
author   : Peter Eisentraut <[email protected]>    
date     : Mon, 5 Aug 2024 12:22:08 +0200    
  
committer: Peter Eisentraut <[email protected]>    
date     : Mon, 5 Aug 2024 12:22:08 +0200    

Source-Git-URL: https://git.postgresql.org/git/pgtranslation/messages.git  
Source-Git-Hash: 4040aedd08d20b68c9840873bded5493b136a4a9  

commit   : 7af99b2aeea5230d0bd3d88c47d700750f68a130    
  
author   : Tom Lane <[email protected]>    
date     : Sun, 4 Aug 2024 13:38:59 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Sun, 4 Aug 2024 13:38:59 -0400    

commit   : 4c61a3a46817c90e8f58ae56b001ce20e3fa1f0b    
  
author   : Etsuro Fujita <[email protected]>    
date     : Thu, 1 Aug 2024 17:45:06 +0900    
  
committer: Etsuro Fujita <[email protected]>    
date     : Thu, 1 Aug 2024 17:45:06 +0900    

We store tuples into the portal's tuple store for a PORTAL_ONE_MOD_WITH  
query as well.  
  
Back-patch to all supported branches.  
  
Reviewed by Andy Fan.  
  
Discussion: https://postgr.es/m/CAPmGK14HVYBZYZtHabjeCd-e31VT%3Dwx6rQNq8QfehywLcpZ2Hw%40mail.gmail.com  

commit   : 5f851b8bd070c599e537cc8a09a237b2a42f2fbc    
  
author   : Tom Lane <[email protected]>    
date     : Wed, 31 Jul 2024 20:55:51 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Wed, 31 Jul 2024 20:55:51 -0400    

This reverts commit 97380d4803d1f9188a1436c6fe7ecd7db285c55c.  
  
Some buildfarm animals are failing with "cannot change  
"client_encoding" during a parallel operation".  It looks like  
assign_client_encoding is unhappy at being asked to roll back a  
client_encoding setting after a parallel worker encounters a  
failure.  There must be more to it though: why didn't I see this  
during local testing?  In any case, it's clear that moving the  
RestoreGUCState() call is not as side-effect-free as I thought.  
Given that the bug f5f30c22e intended to fix has gone unreported  
for years, it's not something that's urgent to fix; I'm not  
willing to risk messing with it further with only days to our  
next release wrap.  

commit   : 97380d4803d1f9188a1436c6fe7ecd7db285c55c    
  
author   : Tom Lane <[email protected]>    
date     : Wed, 31 Jul 2024 18:54:10 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Wed, 31 Jul 2024 18:54:10 -0400    

Parallel workers failed after a sequence like  
	BEGIN;  
	CREATE USER foo;  
	SET SESSION AUTHORIZATION foo;  
because check_session_authorization could not see the uncommitted  
pg_authid row for "foo".  This is because we ran RestoreGUCState()  
in a separate transaction using an ordinary just-created snapshot.  
The same disease afflicts any other GUC that requires catalog lookups  
and isn't forgiving about the lookups failing.  
  
To fix, postpone RestoreGUCState() into the worker's main transaction  
after we've set up a snapshot duplicating the leader's.  This affects  
check_transaction_isolation and check_transaction_deferrable, which  
think they should only run during transaction start.  Make them  
act like check_transaction_read_only, which already knows it should  
silently accept the value when InitializingParallelWorker.  
  
Per bug #18545 from Andrey Rachitskiy.  Back-patch to all  
supported branches, because this has been wrong for awhile.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 51895d08b41a5e5ed7e7a477fb5aa36213347ea7    
  
author   : David Rowley <[email protected]>    
date     : Thu, 1 Aug 2024 01:27:54 +1200    
  
committer: David Rowley <[email protected]>    
date     : Thu, 1 Aug 2024 01:27:54 +1200    

Prior to this commit, the docs for enable_partitionwise_aggregate and  
enable_partitionwise_join mentioned the additional overheads enabling  
these causes for the query planner, but they mentioned nothing about the  
possible surge in work_mem-consuming executor nodes that could end up in  
the final plan.  Dimitrios reported the OOM killer intervened on his  
query as a result of using enable_partitionwise_aggregate=on.  
  
Here we adjust the docs to mention the possible increase in the number of  
work_mem-consuming executor nodes that can appear in the final plan as a  
result of enabling these GUCs.  
  
Reported-by: Dimitrios Apostolou  
Reviewed-by: Ashutosh Bapat  
Discussion: https://postgr.es/m/3603c380-d094-136e-e333-610914fb3e80%40gmx.net  
Discussion: https://postgr.es/m/CAApHDvoZ0_yqwPFEpb6h261L76BUpmh5GxBQq0LeRzQ5Jh3zzg@mail.gmail.com  
Backpatch-through: 12, oldest supported version  

commit   : 924a08b76f5d9f89b2569caed26113f0a020c644    
  
author   : Melanie Plageman <[email protected]>    
date     : Mon, 29 Jul 2024 15:36:38 -0400    
  
committer: Melanie Plageman <[email protected]>    
date     : Mon, 29 Jul 2024 15:36:38 -0400    

d42f60ccf07d89c introduced a test which generated dead tuples for vacuum  
with an UPDATE. The test only required enough dead TIDs for two rounds  
of index vacuuming. This can be accomplished with a DELETE instead of an  
UPDATE -- which generates about 50% less WAL and makes the test 20%  
faster in many cases. The test takes several seconds (more on slow  
buildfarm animals) because we need quite a few tuples to trigger two  
rounds of index vacuuming; so it is worth a follow-on commit to speed it  
up.  
  
Suggested-by: Masahiko Sawada  
Discussion: https://postgr.es/m/CAAKRu_bWmMjmqL%2BOZ2duEQ80u7cRvpsExLNZNjzk-pXX5skwMQ%40mail.gmail.com  
Backpatch-through: 14, the first version containing this test.  

commit   : 95e805e9cabeaf8bbf5b27e17763b44fbd85a686    
  
author   : Peter Eisentraut <[email protected]>    
date     : Sun, 28 Jul 2024 09:12:00 +0200    
  
committer: Peter Eisentraut <[email protected]>    
date     : Sun, 28 Jul 2024 09:12:00 +0200    

Commit 453c4687377 introduced a use of strerror() into libpq, but that  
is not thread-safe.  Fix by using strerror_r() instead.  
  
In passing, update some of the code comments added by 453c4687377, as  
we have learned more about the reason for the change in OpenSSL that  
started this.  
  
Reviewed-by: Daniel Gustafsson <[email protected]>  
Discussion: Discussion: https://postgr.es/m/[email protected]  

commit   : ddd66a6295c5205a5ce46dc09bcbd0dae38c7a8d    
  
author   : Daniel Gustafsson <[email protected]>    
date     : Fri, 26 Jul 2024 19:09:54 +0200    
  
committer: Daniel Gustafsson <[email protected]>    
date     : Fri, 26 Jul 2024 19:09:54 +0200    

Commit 274bbced85 omitted the required changes for the MSVC build  
system in v16 through v12. Per buildfarm animal hamerkop.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 51c1b4fd1579b7a410c53c193ac4e20730cbdbc5    
  
author   : Daniel Gustafsson <[email protected]>    
date     : Fri, 26 Jul 2024 14:16:40 +0200    
  
committer: Daniel Gustafsson <[email protected]>    
date     : Fri, 26 Jul 2024 14:16:40 +0200    

Commit 274bbced85383e831dde accidentally placed the pg_config.h.in  
for SSL_CTX_set_num_tickets on the wrong line wrt where autoheader  
places it.  Fix by re-arranging and backpatch to the same level as  
the original commit.  
  
Reported-by: Marina Polyakova <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: v12  

commit   : ecbb1cd9b7ec2ef30262708f30397b7d1cdab617    
  
author   : Daniel Gustafsson <[email protected]>    
date     : Fri, 26 Jul 2024 11:09:45 +0200    
  
committer: Daniel Gustafsson <[email protected]>    
date     : Fri, 26 Jul 2024 11:09:45 +0200    

OpenSSL supports two types of session tickets for TLSv1.3, stateless  
and stateful. The option we've used only turns off stateless tickets  
leaving stateful tickets active. Use the new API introduced in 1.1.1  
to disable all types of tickets.  
  
Backpatch to all supported versions.  
  
Reviewed-by: Heikki Linnakangas <[email protected]>  
Reported-by: Andres Freund <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: v12  

commit   : 33668fbefcc3547cb3641738c449801b07b1ac30    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 25 Jul 2024 19:52:08 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 25 Jul 2024 19:52:08 -0400    

In the syntax synopses for SELECT, INSERT, UPDATE, etc,  
SELECT ... and RETURNING ... targetlists were missing { ... }  
braces around an OR (|) operator.  That allows misinterpretation  
which could lead to confusion.  
  
David G. Johnston, per gripe from [email protected].  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 1c23961d223401100cec5c9610789637ef35022c    
  
author   : Alvaro Herrera <[email protected]>    
date     : Wed, 24 Jul 2024 14:13:55 +0200    
  
committer: Alvaro Herrera <[email protected]>    
date     : Wed, 24 Jul 2024 14:13:55 +0200    

Per complaint from Grant Gryczan.  
  
It's a very old typo; backpatch all the way back.  
  
Author: Laurenz Albe <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  

commit   : fe1d16f66350be01ffe4f316e0820d01f204f91a    
  
author   : Alvaro Herrera <[email protected]>    
date     : Wed, 24 Jul 2024 12:38:18 +0200    
  
committer: Alvaro Herrera <[email protected]>    
date     : Wed, 24 Jul 2024 12:38:18 +0200    

We don't allow inheritance parents as partitions, and have checks to  
prevent this; but if a table _was_ in the past an inheritance parents  
and all their children are removed, the pg_class.relhassubclass flag  
may remain set, which confuses the partition pruning code (most  
obviously, it results in an assertion failure; in production builds it  
may be worse.)  
  
Fix by resetting relhassubclass on attach.  
  
Backpatch to all supported versions.  
  
Reported-by: Alexander Lakhin <[email protected]>  
Reviewed-by: Tom Lane <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  

commit   : 670fb9f187cd75b6928cc044897a1f468439e19d    
  
author   : Nathan Bossart <[email protected]>    
date     : Tue, 23 Jul 2024 21:59:02 -0500    
  
committer: Nathan Bossart <[email protected]>    
date     : Tue, 23 Jul 2024 21:59:02 -0500    

When provided an empty initial array, array_set_slice() fails to  
check for overflow when computing the new array's dimensions.  
While such overflows are ordinarily caught by ArrayGetNItems(),  
commands with the following form are accepted:  
  
	INSERT INTO t (i[-2147483648:2147483647]) VALUES ('{}');  
  
To fix, perform the hazardous computations using overflow-detecting  
arithmetic routines.  As with commit 18b585155a, the added test  
cases generate errors that include a platform-dependent value, so  
we again use psql's VERBOSITY parameter to suppress printing the  
message text.  
  
Reported-by: Alexander Lakhin  
Author: Joseph Koshakow  
Reviewed-by: Jian He  
Discussion: https://postgr.es/m/31ad2cd1-db94-bdb3-f91a-65ffdb4bef95%40gmail.com  
Backpatch-through: 12  

commit   : 30281db50108468a18e0a8ad5eb83e5367472f2b    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 22 Jul 2024 19:43:12 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 22 Jul 2024 19:43:12 -0400    

We were not being clear about which variants of the "direction"  
clause are permitted in MOVE.  Also, the text seemed to be  
written with only the FETCH/MOVE NEXT case in mind, so it  
didn't apply very well to other variants.  
  
Also, document that "MOVE count IN cursor" only works if count  
is a constant.  This is not the whole truth, because some other  
cases such as a parenthesized expression will also work, but  
we want to push people to use "MOVE FORWARD count" instead.  
The constant case is enough to cover what we allow in plain SQL,  
and that seems sufficient to claim support for.  
  
Update a comment in pl_gram.y claiming that we don't document  
that point.  
  
Per gripe from Philipp Salvisberg.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 0d712ec12a904eb517a572581ca607d4ff9c19c1    
  
author   : Tom Lane <[email protected]>    
date     : Sat, 20 Jul 2024 13:40:15 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Sat, 20 Jul 2024 13:40:15 -0400    

If a view has some updatable and some non-updatable columns, we failed  
to verify updatability of any columns for which an INSERT or UPDATE  
on the view explicitly specifies a DEFAULT item (unless the view has  
a declared default for that column, which is rare anyway, and one  
would almost certainly not write one for a non-updatable column).  
This would lead to an unexpected "attribute number N not found in  
view targetlist" error rather than the intended error.  
  
Per bug #18546 from Alexander Lakhin.  This bug is old, so back-patch  
to all supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : e8dfe0430fad922948f56889a84af41da532c853    
  
author   : Nathan Bossart <[email protected]>    
date     : Fri, 19 Jul 2024 11:52:32 -0500    
  
committer: Nathan Bossart <[email protected]>    
date     : Fri, 19 Jul 2024 11:52:32 -0500    

None of the arithmetic functions for the the money type handle  
overflow.  This commit introduces several helper functions with  
overflow checking and makes use of them in the money type's  
arithmetic functions.  
  
Fixes bug #18240.  
  
Reported-by: Alexander Lakhin  
Author: Joseph Koshakow  
Discussion: https://postgr.es/m/18240-c5da758d7dc1ecf0%40postgresql.org  
Discussion: https://postgr.es/m/CAAvxfHdBPOyEGS7s%2Bxf4iaW0-cgiq25jpYdWBqQqvLtLe_t6tw%40mail.gmail.com  
Backpatch-through: 12  

commit   : d42f60ccf07d89c12645efa8a41c57320d01c184    
  
author   : Melanie Plageman <[email protected]>    
date     : Fri, 19 Jul 2024 11:20:07 -0400    
  
committer: Melanie Plageman <[email protected]>    
date     : Fri, 19 Jul 2024 11:20:07 -0400    

If vacuum fails to prune a tuple killed before OldestXmin, it will later  
find that tuple dead in lazy_scan_prune() and loop infinitely.  
  
Add a test reproducing this scenario to the recovery suite which creates  
a table on a primary, updates the table to generate dead tuples for  
vacuum, and then, during the vacuum, uses a replica to force  
GlobalVisState->maybe_needed on the primary to move backwards and  
precede the value of OldestXmin set at the beginning of vacuuming the  
table.  
  
This commit is separate from the fix in case there are test stability  
issues.  
  
Discussion of the bug: https://postgr.es/m/CAAKRu_Y_NJzF4-8gzTTeaOuUL3CcGoXPjXcAHbTTygT8AyVqag%40mail.gmail.com  
Discussion of the test: https://postgr.es/m/CAAKRu_apNU2MPBK96V%2BbXjTq0RiZ-%3DA4ZTaysakpx9jxbq1dbQ%40mail.gmail.com  
  
Author: Melanie Plageman  
Reviewed-by: Peter Geoghegan  

commit   : 45ce054c02b8ac42909b8617819ff645e5c0487f    
  
author   : Melanie Plageman <[email protected]>    
date     : Fri, 19 Jul 2024 11:16:51 -0400    
  
committer: Melanie Plageman <[email protected]>    
date     : Fri, 19 Jul 2024 11:16:51 -0400    

If vacuum fails to remove a tuple with xmax older than  
VacuumCutoffs->OldestXmin and younger than GlobalVisState->maybe_needed,  
it will loop infinitely in lazy_scan_prune(), which compares tuples'  
visibility information to OldestXmin.  
  
Starting in version 14, which uses GlobalVisState for visibility testing  
during pruning, it is possible for GlobalVisState->maybe_needed to  
precede OldestXmin if maybe_needed is forced to go backward while vacuum  
is running. This can happen if a disconnected standby with a running  
transaction older than VacuumCutoffs->OldestXmin reconnects to the  
primary after vacuum initially calculates GlobalVisState and OldestXmin.  
  
Fix this by having vacuum always remove tuples older than OldestXmin  
during pruning. This is okay because the standby won't replay the tuple  
removal until the tuple is removable. Thus, the worst that can happen is  
a recovery conflict.  
  
Fixes BUG# 17257  
  
Back-patched in versions 14-17  
  
Author: Melanie Plageman  
Reviewed-by: Noah Misch, Peter Geoghegan, Robert Haas, Andres Freund, and Heikki Linnakangas  
Discussion: https://postgr.es/m/CAAKRu_Y_NJzF4-8gzTTeaOuUL3CcGoXPjXcAHbTTygT8AyVqag%40mail.gmail.com  

commit   : 5e578acca54b47c0fe195458f3fe57a5a42f4f01    
  
author   : Andrew Dunstan <[email protected]>    
date     : Wed, 17 Jul 2024 10:35:50 -0400    
  
committer: Andrew Dunstan <[email protected]>    
date     : Wed, 17 Jul 2024 10:35:50 -0400    

Error was detected when testing use of libpq sessions instead of psql  
for polling queries.  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch to all live branches  

commit   : 3006fd8e6ececbb5662135da77a61af311edf81e    
  
author   : Andres Freund <[email protected]>    
date     : Mon, 15 Jul 2024 15:17:25 -0700    
  
committer: Andres Freund <[email protected]>    
date     : Mon, 15 Jul 2024 15:17:25 -0700    

Oops.  
  
Reported-by: Nathan Bossart <[email protected]>  
Discussion: https://postgr.es/m/ZpVZB9rH5tHllO75@nathan  
Backpatch: 12-, like 43cd30bcd1c  

commit   : ee89c4fa4b184bd2cc2a2b48fc13f474e6aa2a24    
  
author   : Andres Freund <[email protected]>    
date     : Mon, 15 Jul 2024 09:26:03 -0700    
  
committer: Andres Freund <[email protected]>    
date     : Mon, 15 Jul 2024 09:26:03 -0700    

Before this change guc_var_compare() cast the input arguments to  
const struct config_generic *.  That's not quite right however, as the input  
on one side is often just a char * on one side.  
  
Instead just use char *, the first field in config_generic.  
  
This fixes a -Warray-bounds warning with some versions of gcc. While the  
warning is only known to be triggered for <= 15, the issue the warning points  
out seems real, so apply the fix everywhere.  
  
Author: Nazir Bilal Yavuz <[email protected]>  
Reported-by: Erik Rijkers <[email protected]>  
Suggested-by: Andres Freund <[email protected]>  
Discussion: https://postgr.es/m/a74a1a0d-0fd2-3649-5224-4f754e8f91aa%40xs4all.nl  

commit   : 02b4f5e1f26b610fb2f6f4698810907547b68f12    
  
author   : Tom Lane <[email protected]>    
date     : Sun, 14 Jul 2024 13:49:46 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Sun, 14 Jul 2024 13:49:46 -0400    

checkWellFormedRecursion would issue "missing recursive reference"  
if a WITH RECURSIVE query contained a single self-reference but  
that self-reference was inside a top-level WITH, ORDER BY, LIMIT,  
etc, rather than inside the second arm of the UNION as expected.  
We already intended to throw more-on-point errors for such cases,  
but those error checks must be done before examining the UNION arm  
in order to have the desired results.  So this patch need only  
move some code (and improve the comments).  
  
Per bug #18536 from Alexander Lakhin.  Back-patch to all supported  
branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 2b415e95a8a7ccb4fe9276e2ca453f4ae69466c1    
  
author   : Noah Misch <[email protected]>    
date     : Sat, 13 Jul 2024 08:09:33 -0700    
  
committer: Noah Misch <[email protected]>    
date     : Sat, 13 Jul 2024 08:09:33 -0700    

ANALYZE sets relhassubclass=f when a partitioned table no longer has  
partitions.  An ANALYZE doing that proceeded to apply the inplace update  
of pg_class.reltuples to the old pg_class tuple instead of the new  
tuple, losing that reltuples=0 change if the ANALYZE committed.  
Non-partitioning inheritance trees were unaffected.  Back-patch to v14,  
where commit 375aed36ad83f0e021e9bdd3a0034c0c992c66dc introduced  
maintenance of partitioned table pg_class.reltuples.  
  
Reported by Alexander Lakhin.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : c5b15c417140b2b18b590d201b2fdb7b587214fd    
  
author   : Andrew Dunstan <[email protected]>    
date     : Fri, 12 Jul 2024 18:29:15 -0400    
  
committer: Andrew Dunstan <[email protected]>    
date     : Fri, 12 Jul 2024 18:29:15 -0400    

The current code can have pg_isready unexpectedly succeed if there is a  
server running on the default port. To avoid this we delay running the  
test until after a node has been created but before it starts, and then  
use that node's port, so we are fairly sure there is nothing running on  
the port.  
  
Backpatch to all live branches.  

commit   : 894b497ac91dcac79f85d1b4bae7f640788b1004    
  
author   : Thomas Munro <[email protected]>    
date     : Sat, 13 Jul 2024 14:59:46 +1200    
  
committer: Thomas Munro <[email protected]>    
date     : Sat, 13 Jul 2024 14:59:46 +1200    

Winsock only signals an FD_CLOSE event once if the other end of the  
socket shuts down gracefully.  Because each WaitLatchOrSocket() call  
constructs and destroys a new event handle every time, with unlucky  
timing we can lose it and hang.  We get away with this only if the other  
end disconnects non-gracefully, because FD_CLOSE is repeatedly signaled  
in that case.  
  
To fix this design flaw in our Windows socket support fundamentally,  
we'd probably need to rearchitect it so that a single event handle  
exists for the lifetime of a socket, or switch to completely different  
multiplexing or async I/O APIs.  That's going to be a bigger job  
and probably wouldn't be back-patchable.  
  
This brute force kludge closes the race by explicitly polling with  
MSG_PEEK before sleeping.  
  
Back-patch to all supported releases.  This should hopefully clear up  
some random build farm and CI hang failures reported over the years.  It  
might also allow us to try using graceful shutdown in more places again  
(reverted in commit 29992a6) to fix instability in the transmission of  
FATAL error messages, but that isn't done by this commit.  
  
Reported-by: Tom Lane <[email protected]>  
Tested-by: Alexander Lakhin <[email protected]>  
Discussion: https://postgr.es/m/176008.1715492071%40sss.pgh.pa.us  

commit   : 2f500745978f5da017933b880f606d15d351d5f7    
  
author   : Alvaro Herrera <[email protected]>    
date     : Fri, 12 Jul 2024 13:44:19 +0200    
  
committer: Alvaro Herrera <[email protected]>    
date     : Fri, 12 Jul 2024 13:44:19 +0200    

Per buildfarm.  

commit   : 66aaa7a71841f0dda4c5e2918d4a7fe371c4b701    
  
author   : Alvaro Herrera <[email protected]>    
date     : Fri, 12 Jul 2024 12:54:01 +0200    
  
committer: Alvaro Herrera <[email protected]>    
date     : Fri, 12 Jul 2024 12:54:01 +0200    

When a partitioned table has an index that doesn't support a constraint,  
but a partition has an equivalent index that does, then a DETACH  
operation would misbehave: a crash in assertion-enabled systems (because  
we fail to find the constraint in the parent that we expect to), or a  
broken coninhcount value (-1) in production systems (because we blindly  
believe that we've successfully detached the parent).  
  
While we should reject an ATTACH of a partition with such an index, we  
have failed to do so in existing releases, so adding an error in stable  
releases might break the (unlikely) existing applications that rely on  
this behavior.  At this point I don't even want to reject them in  
master, because it'd break pg_upgrade if such databases exist, and there  
would be no easy way to fix existing databases without expensive index  
rebuilds.  
  
(Later on we could add ALTER TABLE ... ADD CONSTRAINT USING INDEX to  
partitioned tables, which would allow the user to fix such patterns.  At  
that point we could add more restrictions to prevent the problem from  
its root.)  
  
Also, add a test case that leaves one table in this condition, so that  
we can verify that pg_upgrade continues to work if we later decide to  
change the policy on the master branch.  
  
Backpatch to all supported branches.  
  
Co-authored-by: Tender Wang <[email protected]>  
Reported-by: Alexander Lakhin <[email protected]>  
Reviewed-by: Tender Wang <[email protected]>  
Reviewed-by: Michael Paquier <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  

commit   : 27831127d641b3065bd238ed513def452baeea80    
  
author   : Thomas Munro <[email protected]>    
date     : Tue, 13 Dec 2022 10:03:28 +1300    
  
committer: Thomas Munro <[email protected]>    
date     : Tue, 13 Dec 2022 10:03:28 +1300    

This is a back-patch of commit 101c37cd into REL_14_STABLE and  
REL_15_STABLE.  Those branches had commit de8feb1f3, which turned on  
-Wcast-function-type, but did not disable -Wcast-function-type-strict.  
This silences warnings about function pointer types without prototypes  
based on new C23 rules, that we want to suppress for now.  
  
Reviewed-by: Tom Lane <[email protected]>  
Discussion: https://postgr.es/m/CA%2BhUKGKnBvdrbH2LW%2B7-Lv599t9JFOHjx%3Dxw-VQmdoj%3D9585CQ%40mail.gmail.com  
Discussion: https://postgr.es/m/CA%2BhUKGJvX%2BL3aMN84ksT-cGy08VHErRNip3nV-WmTx7f6Pqhyw%40mail.gmail.com  

commit   : f7d3caf9ddbfee2567d834ec4639ef717240809f    
  
author   : Masahiko Sawada <[email protected]>    
date     : Thu, 11 Jul 2024 22:48:13 +0900    
  
committer: Masahiko Sawada <[email protected]>    
date     : Thu, 11 Jul 2024 22:48:13 +0900    

When creating and initializing a logical slot, the restart_lsn is set  
to the latest WAL insertion point (or the latest replay point on  
standbys). Subsequently, WAL records are decoded from that point to  
find the start point for extracting changes in the  
DecodingContextFindStartpoint() function. Since the initial  
restart_lsn could be in the middle of a transaction, the start point  
must be a consistent point where we won't see the data for partial  
transactions.  
  
Previously, when not building a full snapshot, serialized snapshots  
were restored, and the SnapBuild jumps to the consistent state even  
while finding the start point. Consequently, the slot's restart_lsn  
and confirmed_flush could be set to the middle of a transaction. This  
could lead to various unexpected consequences. Specifically, there  
were reports of logical decoding decoding partial transactions, and  
assertion failures occurred because only subtransactions were decoded  
without decoding their top-level transaction until decoding the commit  
record.  
  
To resolve this issue, the changes prevent restoring the serialized  
snapshot and jumping to the consistent state while finding the start  
point.  
  
On v17 and HEAD, a flag indicating whether snapshot restores should be  
skipped has been added to the SnapBuild struct, and SNAPBUILD_VERSION  
has been bumpded.  
  
On backbranches, the flag is stored in the LogicalDecodingContext  
instead, preserving on-disk compatibility.  
  
Backpatch to all supported versions.  
  
Reported-by: Drew Callahan  
Reviewed-by: Amit Kapila, Hayato Kuroda  
Discussion: https://postgr.es/m/2444AA15-D21B-4CCE-8052-52C7C2DAFE5C%40amazon.com  
Backpatch-through: 12  

commit   : 475e1807c20f5b20fd670bd9218e3d3e6c11be6b    
  
author   : Tom Lane <[email protected]>    
date     : Wed, 10 Jul 2024 20:15:52 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Wed, 10 Jul 2024 20:15:52 -0400    

This back-patches HEAD commits 066e8ac6e, 6082b3d5d, e7192486d,  
and 896cd266f into supported branches.  Changes:  
  
* Use xmlAddChildList not xmlAddChild in XMLSERIALIZE  
(affects v16 and up only).  This was a flat-out coding mistake  
that we got away with due to lax checking in previous versions  
of xmlAddChild.  
  
* Use xmlParseInNodeContext not xmlParseBalancedChunkMemory.  
This is to dodge a bug in xmlParseBalancedChunkMemory in libxm2  
releases 2.13.0-2.13.2.  While that bug is now fixed upstream and  
will probably never be seen in any production-oriented distro, it is  
currently a problem on some more-bleeding-edge-friendly platforms.  
  
* Suppress "chunk is not well balanced" errors from libxml2,  
unless it is the only error.  This eliminates an error-reporting  
discrepancy between 2.13 and older releases.  This error is  
almost always redundant with previous errors, if not flat-out  
inappropriate, which is why 2.13 changed the behavior and why  
nobody's likely to miss it.  
  
Erik Wienhold and Tom Lane, per report from Frank Streitzig.  
  
Discussion: https://postgr.es/m/trinity-b0161630-d230-4598-9ebc-7a23acdb37cb-1720186432160@3c-app-gmx-bap25  
Discussion: https://postgr.es/m/trinity-361ba18b-541a-4fe7-bc63-655ae3a7d599-1720259822452@3c-app-gmx-bs01  

commit   : 4b719e15beed7ceb49d0bd4047aa08001c7fbcf6    
  
author   : Andrew Dunstan <[email protected]>    
date     : Mon, 8 Jul 2024 13:46:21 -0400    
  
committer: Andrew Dunstan <[email protected]>    
date     : Mon, 8 Jul 2024 13:46:21 -0400    

This reverts commit e9f15bc9. Instead of a hacky solution that didn't  
work on Windows, we avoid trying to move the directory possibly across  
drives, and instead remove it and recreate it in the new location.  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch to release 14 like the previous patch.  

commit   : b7d3be64e4378ad85e180838912c774825b02b8c    
  
author   : Andrew Dunstan <[email protected]>    
date     : Mon, 8 Jul 2024 11:18:06 -0400    
  
committer: Andrew Dunstan <[email protected]>    
date     : Mon, 8 Jul 2024 11:18:06 -0400    

If we choose ports in the range typically used for ephemeral ports there  
is a danger of encountering a port conflict due to a race condition  
between the time we choose the port in a range below that typically used  
to allocate ephemeral ports, but higher than the range typically used by  
well known services.  
  
Author: Jelte Fenema-Nio, with some editing by me.  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch to all live branches (12 and up)  

commit   : 81749aa39ec32a8dcb008448fa245b24639861f7    
  
author   : Andrew Dunstan <[email protected]>    
date     : Mon, 8 Jul 2024 05:51:26 -0400    
  
committer: Andrew Dunstan <[email protected]>    
date     : Mon, 8 Jul 2024 05:51:26 -0400    

Currently they are started in unix socket mode in ost cases, and then  
converted to run in TCP mode. This can result in port collisions, and  
there is no virtue in startng in unix socket mode, so start as we will  
be going on.  
  
Discussion: https://postgr.es/m/[email protected]  
  
Backpatch to all live branches (12 and up).  

commit   : a3c0124f69ffd2a299f099d4037ba8c6d2293aba    
  
author   : Dean Rasheed <[email protected]>    
date     : Mon, 8 Jul 2024 17:55:31 +0100    
  
committer: Dean Rasheed <[email protected]>    
date     : Mon, 8 Jul 2024 17:55:31 +0100    

The numeric round() and trunc() functions clamp the scale argument to  
the range between +/- NUMERIC_MAX_RESULT_SCALE (2000), which is much  
smaller than the actual allowed range of type numeric. As a result,  
they return incorrect results when asked to round/truncate more than  
2000 digits before or after the decimal point.  
  
Fix by using the correct upper and lower scale limits based on the  
actual allowed (and documented) range of type numeric.  
  
While at it, use the new NUMERIC_WEIGHT_MAX constant instead of  
SHRT_MAX in all other overflow checks, and fix a comment thinko in  
power_var() introduced by e54a758d24 -- the minimum value of  
ln_dweight is -NUMERIC_DSCALE_MAX (-16383), not -SHRT_MAX, though this  
doesn't affect the point being made in the comment, that the resulting  
local_rscale value may exceed NUMERIC_MAX_DISPLAY_SCALE (1000).  
  
Back-patch to all supported branches.  
  
Dean Rasheed, reviewed by Joel Jacobson.  
  
Discussion: https://postgr.es/m/CAEZATCXB%2BrDTuMjhK5ZxcouufigSc-X4tGJCBTMpZ3n%3DxxQuhg%40mail.gmail.com  

commit   : c2342a925b7042f3e4d8440e66bd7b61d80a961c    
  
author   : Thomas Munro <[email protected]>    
date     : Sat, 6 Jul 2024 10:24:49 +1200    
  
committer: Thomas Munro <[email protected]>    
date     : Sat, 6 Jul 2024 10:24:49 +1200    

macOS 15's SDK pulls in headers related to <regex.h> when we include  
<xlocale.h>.  This causes our own regex_t implementation to clash with  
the OS's regex_t implementation.  Luckily our function names already had  
pg_ prefixes, but the macros and typenames did not.  
  
Include <regex.h> explicitly on all POSIX systems, and fix everything  
that breaks.  Then we can prove that we are capable of fully hiding and  
replacing the system regex API with our own.  
  
1.  Deal with standard-clobbering macros by undefining them all first.  
POSIX says they are "symbolic constants".  If they are macros, this  
allows us to redefine them.  If they are enums or variables, our macros  
will hide them.  
  
2.  Deal with standard-clobbering types by giving our types pg_  
prefixes, and then using macros to redirect xxx_t -> pg_xxx_t.  
  
After including our "regex/regex.h", the system <regex.h> is hidden,  
because we've replaced all the standard names.  The PostgreSQL source  
tree and extensions can continue to use standard prefix-less type and  
macro names, but reach our implementation, if they included our  
"regex/regex.h" header.  
  
Back-patch to all supported branches, so that macOS 15's tool chain can  
build them.  
  
Reported-by: Stan Hu <[email protected]>  
Suggested-by: Tom Lane <[email protected]>  
Tested-by: Aleksander Alekseev <[email protected]>  
Discussion: https://postgr.es/m/CAMBWrQnEwEJtgOv7EUNsXmFw2Ub4p5P%2B5QTBEgYwiyjy7rAsEQ%40mail.gmail.com  

commit   : b261649c0a860cd49e11f3d52d3f117a10fde2b4    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 4 Jul 2024 13:23:32 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 4 Jul 2024 13:23:32 -0400    

State explicitly that the coordinates in our geometric data types are  
float8.  Also explain that polygons store their bounding box.  
  
While here, fix the table of geometric data types to show type  
"line"'s size correctly: it's 24 bytes not 32.  This has somehow  
escaped notice since that table was made in 1998.  
  
Per suggestion from Sebastian Skałacki.  The size error seems  
important enough to justify back-patching.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : f699ce85771c93aa09211f9ffc8799b585538d19    
  
author   : Daniel Gustafsson <[email protected]>    
date     : Thu, 4 Jul 2024 11:38:37 +0200    
  
committer: Daniel Gustafsson <[email protected]>    
date     : Thu, 4 Jul 2024 11:38:37 +0200    

The ssl_prefer_server_ciphers setting is quite important from a  
security point of view, so simply stating that older versions  
doesn't have it isn't very helpful.  This adds the version when  
the GUC was added to help readers.  
  
Backpatch to all supported versions since this setting has been  
around since 9.4.  
  
Reviewed-by: Peter Eisentraut <[email protected]>  
Reviewed-by: Tom Lane <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: v12  

commit   : 1185be355462d1dc7e2950a7e52eb7ca0cb6f3c8    
  
author   : Heikki Linnakangas <[email protected]>    
date     : Mon, 1 Jul 2024 19:22:36 +0300    
  
committer: Heikki Linnakangas <[email protected]>    
date     : Mon, 1 Jul 2024 19:22:36 +0300    

Commit d5fd7865 backported BackgroundPsql perl module module with  
helper functions for tests running interactive or background psql  
tasks to PG 12 to 15, but did not add installation/uninstallation  
rules of the build system, causing problems running TAP tests for the  
extensions.  
  
Author: Pavan Deolasee <[email protected]>  
Discussion: https://www.postgresql.org/message-id/CABOikdPmRuZrcf_gtgXmQzZ5Tbg9yUJmqXDCAZ2aW%3DWi-PbDyQ%40mail.gmail.com  

commit   : 1608902fc3a73b598dbc09922e877aee5da55cf5    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 1 Jul 2024 12:21:07 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 1 Jul 2024 12:21:07 -0400    

ProcessIncomingNotify is called from the main processing loop that  
normally runs in MessageContext.  That outer-loop code assumes that  
whatever it allocates will be cleaned up when we're done processing  
the current client message --- but if we service a notify interrupt,  
then whatever gets allocated before the next switch into  
MessageContext will be permanently leaked in TopMemoryContext,  
because CommitTransactionCommand sets CurrentMemoryContext to  
TopMemoryContext.  There are observable leaks associated with  
(at least) encoding conversion of incoming queries and parameters  
attached to Bind messages.  
  
sinval catchup interrupts have a similar problem.  There might be  
others, but I've not identified any other clear cases.  
  
To fix, take care to save and restore CurrentMemoryContext across  
the Start/CommitTransactionCommand calls in these functions.  
  
Per bug #18512 from wizardbrony.  Commit to back branches only;  
in HEAD, this was dealt with by the riskier but more thoroughgoing  
approach in commit 1afe31f03.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : f31c1e34bc801b57bbc3108725f13b793d7c4a4c    
  
author   : Noah Misch <[email protected]>    
date     : Fri, 28 Jun 2024 09:33:40 -0700    
  
committer: Noah Misch <[email protected]>    
date     : Fri, 28 Jun 2024 09:33:40 -0700    

Per buildfarm members prion and trilobite.  Back-patch to v12 (all  
supported versions), like commit  
0844b3968985447ed0a6937cfc8639e379da2fe6.  
  
Strategy reviewed by Tom Lane.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : c7f10df368063098be859a3ebbd6522bbea8d86a    
  
author   : Noah Misch <[email protected]>    
date     : Thu, 27 Jun 2024 19:21:06 -0700    
  
committer: Noah Misch <[email protected]>    
date     : Thu, 27 Jun 2024 19:21:06 -0700    

Commit 2c03216d831160bedd72d45f712601b6f7d03f1c moved the tuple data  
from there to the buffer-0 data.  Back-patch to v12 (all supported  
versions), the plan for the next change to this struct.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : af73e37fa181283a3199cda2233d89c7a669f772    
  
author   : Noah Misch <[email protected]>    
date     : Thu, 27 Jun 2024 19:21:06 -0700    
  
committer: Noah Misch <[email protected]>    
date     : Thu, 27 Jun 2024 19:21:06 -0700    

This extends ad98fb14226ae6456fbaed7990ee7591cbe5efd2 to invals of  
inplace updates.  Trouble requires an inplace update of a catalog having  
a TOAST table, so only pg_database was at risk.  (The other catalog on  
which core code performs inplace updates, pg_class, has no TOAST table.)  
Trouble would require something like the inplace-inval.spec test.  
Consider GRANT ... ON DATABASE fetching a stale row from cache and  
discarding a datfrozenxid update that vac_truncate_clog() has already  
relied upon.  Back-patch to v12 (all supported versions).  
  
Reviewed (in an earlier version) by Robert Haas.  
  
Discussion: https://postgr.es/m/[email protected]  
Discussion: https://postgr.es/m/[email protected]  

commit   : e038b7756df8a7487366d4e678c1e0d0d1ba5bbe    
  
author   : Noah Misch <[email protected]>    
date     : Thu, 27 Jun 2024 19:21:05 -0700    
  
committer: Noah Misch <[email protected]>    
date     : Thu, 27 Jun 2024 19:21:05 -0700    

This has no user-visible, important consequences, since other sessions'  
catalog scans can't find the relation until we commit.  However, this  
unblocks introducing a rule about locks required to heap_update() a  
pg_class row.  CREATE TABLE has been acquiring this lock eventually, but  
it can heap_update() pg_class.relchecks earlier.  create_toast_table()  
has been acquiring only ShareLock.  Back-patch to v12 (all supported  
versions), the plan for the commit relying on the new rule.  
  
Reviewed (in an earlier version) by Robert Haas.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 578db9c9257de00ee695d670fb7d62b295467fe8    
  
author   : Noah Misch <[email protected]>    
date     : Thu, 27 Jun 2024 19:21:05 -0700    
  
committer: Noah Misch <[email protected]>    
date     : Thu, 27 Jun 2024 19:21:05 -0700    

Commit 5b562644fec696977df4a82790064e8287927891 added a comment that  
SetRelationHasSubclass() callers must hold this lock.  When commit  
17f206fbc824d2b4b14480199ca9ff7dea417eda extended use of this column to  
partitioned indexes, it didn't take the lock.  As the latter commit  
message mentioned, we currently never reset a partitioned index to  
relhassubclass=f.  That largely avoids harm from the lock omission.  The  
cause for fixing this now is to unblock introducing a rule about locks  
required to heap_update() a pg_class row.  This might cause more  
deadlocks.  It gives minor user-visible benefits:  
  
- If an ALTER INDEX SET TABLESPACE runs concurrently with ALTER TABLE  
  ATTACH PARTITION or CREATE PARTITION OF, one transaction blocks  
  instead of failing with "tuple concurrently updated".  (Many cases of  
  DDL concurrency still fail that way.)  
  
- Match ALTER INDEX ATTACH PARTITION in choosing to lock the index.  
  
While not user-visible today, we'll need this if we ever make something  
set the flag to false for a partitioned index, like ANALYZE does today  
for tables.  Back-patch to v12 (all supported versions), the plan for  
the commit relying on the new rule.  In back branches, add  
LockOrStrongerHeldByMe() instead of adding a LockHeldByMe() parameter.  
  
Reviewed (in an earlier version) by Robert Haas.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : ad4653268c12cd50339dae0de59d9add41138d66    
  
author   : Noah Misch <[email protected]>    
date     : Thu, 27 Jun 2024 19:21:05 -0700    
  
committer: Noah Misch <[email protected]>    
date     : Thu, 27 Jun 2024 19:21:05 -0700    

Most comments concern RELKIND_VIEW.  One addresses the ExecUpdate()  
"tupleid" parameter.  A later commit will rely on these facts, but they  
hold already.  Back-patch to v12 (all supported versions), the plan for  
that commit.  
  
Reviewed (in an earlier version) by Robert Haas.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 2d06bdbc0cc34df354fd58a857c1a3a8cf4a9406    
  
author   : Noah Misch <[email protected]>    
date     : Thu, 27 Jun 2024 19:21:05 -0700    
  
committer: Noah Misch <[email protected]>    
date     : Thu, 27 Jun 2024 19:21:05 -0700    

This covers both regular and inplace changes, since bugs arise at their  
intersection.  Where marked, these witness extant bugs.  Back-patch to  
v12 (all supported versions).  
  
Reviewed (in an earlier version) by Robert Haas.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 13abc1f660740edab9c32d1ad4ca0fb5d5f387f6    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 27 Jun 2024 14:43:59 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 27 Jun 2024 14:43:59 -0400    

errfinish() assumes that the __FUNC__ and __FILE__ arguments it's  
passed are compile-time constant strings that can just be pointed  
to rather than physically copied.  However, it's possible for LLVM  
to generate code in which those pointers point into a dynamically  
loaded code segment.  If that segment gets unloaded before we're  
done with the ErrorData struct, we have dangling pointers that  
will lead to SIGSEGV.  In simple cases that won't happen, because we  
won't unload LLVM code before end of transaction.  But it's possible  
to happen if the error is thrown within end-of-transaction code run by  
_SPI_commit or _SPI_rollback, because since commit 2e517818f those  
functions clean up by ending the transaction and starting a new one.  
  
Rather than fixing this by adding pstrdup() overhead to every  
elog/ereport sequence, let's fix it by copying the risky pointers  
in CopyErrorData().  That solves it for _SPI_commit/_SPI_rollback  
because they use that function to preserve the error data across  
the transaction end/restart sequence; and it seems likely that  
any other code doing something similar would need to do that too.  
  
I'm suspicious that this behavior amounts to an LLVM bug (or a  
bug in our use of it?), because it implies that string constant  
references that should be pointer-equal according to a naive  
understanding of C semantics will sometimes not be equal.  
However, even if it is a bug and someday gets fixed, we'll have  
to cope with the current behavior for a long time to come.  
  
Report and patch by me.  Back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 9dbf8ab48c21f9a006e578983b21739326d7c621    
  
author   : Heikki Linnakangas <[email protected]>    
date     : Thu, 27 Jun 2024 21:06:32 +0300    
  
committer: Heikki Linnakangas <[email protected]>    
date     : Thu, 27 Jun 2024 21:06:32 +0300    

We did not recover the subtransaction IDs of prepared transactions  
when starting a hot standby from a shutdown checkpoint. As a result,  
such subtransactions were considered as aborted, rather than  
in-progress. That would lead to hint bits being set incorrectly, and  
the subtransactions suddenly becoming visible to old snapshots when  
the prepared transaction was committed.  
  
To fix, update pg_subtrans with prepared transactions's subxids when  
starting hot standby from a shutdown checkpoint. The snapshots taken  
from that state need to be marked as "suboverflowed", so that we also  
check the pg_subtrans.  
  
Backport to all supported versions.  
  
Discussion: https://www.postgresql.org/message-id/[email protected]  

commit   : 34221af648f1b5b2aaa5c1814e692ec98063ba52    
  
author   : Heikki Linnakangas <[email protected]>    
date     : Thu, 27 Jun 2024 21:06:27 +0300    
  
committer: Heikki Linnakangas <[email protected]>    
date     : Thu, 27 Jun 2024 21:06:27 +0300    

This went unnoticed, because only a few existing callers of  
BackgroundPsql->query used the result, and the ones that did were not  
bothered by an extra newline. I noticed because I was about to add a  
new test that checks the result.  
  
Backport to all supported versions, since I just backported the  
BackgroundPsql facility to all supported versions too.  

commit   : 5fcd0d0ce1e5f2abe6b3e9d6f05e439d3088a538    
  
author   : Alvaro Herrera <[email protected]>    
date     : Thu, 27 Jun 2024 19:51:47 +0200    
  
committer: Alvaro Herrera <[email protected]>    
date     : Thu, 27 Jun 2024 19:51:47 +0200    

The first one was noticed by Tender Wang and introduced with  
8aba9322511f; the other one was newly introduced with dbca3469ebf8.  

commit   : 31877cd8ec8ce59df4d485057117dba2528af2eb    
  
author   : Heikki Linnakangas <[email protected]>    
date     : Thu, 27 Jun 2024 19:00:59 +0300    
  
committer: Heikki Linnakangas <[email protected]>    
date     : Thu, 27 Jun 2024 19:00:59 +0300    

Backport the new BackgroundPsql modules and the constructor functions,  
background_psql() and interactive_psql, to all supported  
branches. That makes it easier to backpatch tests that use it.  
  
BackgroundPsql was introduced in version 16. On version 16, this  
commit backports just the new timeout argument from master (commit  
334f512f45). On older branches, the whole facility. This includes the  
change to `use warnings FATAL => 'all'`, which we haven't otherwise  
backported, but it seems good to keep the file identical across  
branches.  
  
Discussion: https://www.postgresql.org/message-id/[email protected]  

commit   : 4c8e00ae9ae3b53c08a56b584e1b185668a2aff5    
  
author   : Heikki Linnakangas <[email protected]>    
date     : Fri, 21 Jun 2024 18:31:15 +0300    
  
committer: Heikki Linnakangas <[email protected]>    
date     : Fri, 21 Jun 2024 18:31:15 +0300    

1. TruncateMultiXact() performs the SLRU truncations in a critical  
section. Deleting the SLRU segments calls ForwardSyncRequest(), which  
will try to compact the request queue if it's full  
(CompactCheckpointerRequestQueue()). That in turn allocates memory,  
which is not allowed in a critical section. Backtrace:  
  
    TRAP: failed Assert("CritSectionCount == 0 || (context)->allowInCritSection"), File: "../src/backend/utils/mmgr/mcxt.c", Line: 1353, PID: 920981  
    postgres: autovacuum worker template0(ExceptionalCondition+0x6e)[0x560a501e866e]  
    postgres: autovacuum worker template0(+0x5dce3d)[0x560a50217e3d]  
    postgres: autovacuum worker template0(ForwardSyncRequest+0x8e)[0x560a4ffec95e]  
    postgres: autovacuum worker template0(RegisterSyncRequest+0x2b)[0x560a50091eeb]  
    postgres: autovacuum worker template0(+0x187b0a)[0x560a4fdc2b0a]  
    postgres: autovacuum worker template0(SlruDeleteSegment+0x101)[0x560a4fdc2ab1]  
    postgres: autovacuum worker template0(TruncateMultiXact+0x2fb)[0x560a4fdbde1b]  
    postgres: autovacuum worker template0(vac_update_datfrozenxid+0x4b3)[0x560a4febd2f3]  
    postgres: autovacuum worker template0(+0x3adf66)[0x560a4ffe8f66]  
    postgres: autovacuum worker template0(AutoVacWorkerMain+0x3ed)[0x560a4ffe7c2d]  
    postgres: autovacuum worker template0(+0x3b1ead)[0x560a4ffecead]  
    postgres: autovacuum worker template0(+0x3b620e)[0x560a4fff120e]  
    postgres: autovacuum worker template0(+0x3b3fbb)[0x560a4ffeefbb]  
    postgres: autovacuum worker template0(+0x2f724e)[0x560a4ff3224e]  
    /lib/x86_64-linux-gnu/libc.so.6(+0x27c8a)[0x7f62cc642c8a]  
    /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x85)[0x7f62cc642d45]  
    postgres: autovacuum worker template0(_start+0x21)[0x560a4fd16f31]  
  
To fix, bail out in CompactCheckpointerRequestQueue() without doing  
anything, if it's called in a critical section. That covers the above  
call path, as well as any other similar cases where  
RegisterSyncRequest might be called in a critical section.  
  
2. After fixing that, another problem became apparent: Autovacuum  
process doing that truncation can deadlock with the checkpointer  
process. TruncateMultiXact() sets "MyProc->delayChkptFlags |=  
DELAY_CHKPT_START". If the sync request queue is full and cannot be  
compacted, the process will repeatedly sleep and retry, until there is  
room in the queue. However, if the checkpointer is trying to start a  
checkpoint at the same time, and is waiting for the DELAY_CHKPT_START  
processes to finish, the queue will never shrink.  
  
More concretely, the autovacuum process is stuck here:  
  
    #0  0x00007fc934926dc3 in epoll_wait () from /lib/x86_64-linux-gnu/libc.so.6  
    #1  0x000056220b24348b in WaitEventSetWaitBlock (set=0x56220c2e4b50, occurred_events=0x7ffe7856d040, nevents=1, cur_timeout=<optimized out>) at ../src/backend/storage/ipc/latch.c:1570  
    #2  WaitEventSetWait (set=0x56220c2e4b50, timeout=timeout@entry=10, occurred_events=<optimized out>, occurred_events@entry=0x7ffe7856d040, nevents=nevents@entry=1,  
        wait_event_info=wait_event_info@entry=150994949) at ../src/backend/storage/ipc/latch.c:1516  
    #3  0x000056220b243224 in WaitLatch (latch=<optimized out>, latch@entry=0x0, wakeEvents=wakeEvents@entry=40, timeout=timeout@entry=10, wait_event_info=wait_event_info@entry=150994949)  
        at ../src/backend/storage/ipc/latch.c:538  
    #4  0x000056220b26cf46 in RegisterSyncRequest (ftag=ftag@entry=0x7ffe7856d0a0, type=type@entry=SYNC_FORGET_REQUEST, retryOnError=true) at ../src/backend/storage/sync/sync.c:614  
    #5  0x000056220af9db0a in SlruInternalDeleteSegment (ctl=ctl@entry=0x56220b7beb60 <MultiXactMemberCtlData>, segno=segno@entry=11350) at ../src/backend/access/transam/slru.c:1495  
    #6  0x000056220af9dab1 in SlruDeleteSegment (ctl=ctl@entry=0x56220b7beb60 <MultiXactMemberCtlData>, segno=segno@entry=11350) at ../src/backend/access/transam/slru.c:1566  
    #7  0x000056220af98e1b in PerformMembersTruncation (oldestOffset=<optimized out>, newOldestOffset=<optimized out>) at ../src/backend/access/transam/multixact.c:3006  
    #8  TruncateMultiXact (newOldestMulti=newOldestMulti@entry=3221225472, newOldestMultiDB=newOldestMultiDB@entry=4) at ../src/backend/access/transam/multixact.c:3201  
    #9  0x000056220b098303 in vac_truncate_clog (frozenXID=749, minMulti=<optimized out>, lastSaneFrozenXid=749, lastSaneMinMulti=3221225472) at ../src/backend/commands/vacuum.c:1917  
    #10 vac_update_datfrozenxid () at ../src/backend/commands/vacuum.c:1760  
    #11 0x000056220b1c3f76 in do_autovacuum () at ../src/backend/postmaster/autovacuum.c:2550  
    #12 0x000056220b1c2c3d in AutoVacWorkerMain (startup_data=<optimized out>, startup_data_len=<optimized out>) at ../src/backend/postmaster/autovacuum.c:1569  
  
and the checkpointer is stuck here:  
  
    #0  0x00007fc9348ebf93 in clock_nanosleep () from /lib/x86_64-linux-gnu/libc.so.6  
    #1  0x00007fc9348fe353 in nanosleep () from /lib/x86_64-linux-gnu/libc.so.6  
    #2  0x000056220b40ecb4 in pg_usleep (microsec=microsec@entry=10000) at ../src/port/pgsleep.c:50  
    #3  0x000056220afb43c3 in CreateCheckPoint (flags=flags@entry=108) at ../src/backend/access/transam/xlog.c:7098  
    #4  0x000056220b1c6e86 in CheckpointerMain (startup_data=<optimized out>, startup_data_len=<optimized out>) at ../src/backend/postmaster/checkpointer.c:464  
  
To fix, add AbsorbSyncRequests() to the loops where the checkpointer  
waits for DELAY_CHKPT_START or DELAY_CHKPT_COMPLETE operations to  
finish.  
  
Backpatch to v14. Before that, SLRU deletion didn't call  
RegisterSyncRequest, which avoided this failure. I'm not sure if there  
are other similar scenarios on older versions, but we haven't had  
any such reports.  
  
Discussion: https://www.postgresql.org/message-id/[email protected]  

commit   : 20f22e6a67bcb90fbc4b40d7368ed309377c06b4    
  
author   : Andrew Dunstan <[email protected]>    
date     : Wed, 26 Jun 2024 07:01:47 -0400    
  
committer: Andrew Dunstan <[email protected]>    
date     : Wed, 26 Jun 2024 07:01:47 -0400    

Commit 4c1532763a removed some redundant uses of 'use 5.008001;' in perl  
scripts, including in plperl's plc_perlboot.pl. Because it made other  
changes it wasn't backpatched. However, now this is causing a failure on  
back branches when built with bleeding edge perl. Therefore, backpatch  
just that part of it which removed those uses, from 15 all the way down  
to 9.2, which is the earliest version currently built in the buildfarm.  
  
per report from Alexander Lakhin  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 66e569f5022beb987c6335d5d9d27d7da98fbb75    
  
author   : Alvaro Herrera <[email protected]>    
date     : Mon, 24 Jun 2024 15:56:32 +0200    
  
committer: Alvaro Herrera <[email protected]>    
date     : Mon, 24 Jun 2024 15:56:32 +0200    

When detaching partition in concurrent mode, it's possible for partition  
descriptors to not match the set that was recently seen when the plan  
was made, causing an assertion failure or (in production builds) failure  
to construct a working plan.  The case that was reported involves  
prepared statements, but I think it may be possible to hit this bug  
without that too.  
  
The problem is that CreatePartitionPruneState is constructing a  
PartitionPruneState under the assumption that new partitions can be  
added, but never removed, but it turns out that this isn't true: a  
prepared statement gets replanned when the DETACH CONCURRENTLY session  
sends out its invalidation message, but if the invalidation message  
arrives after ExecInitAppend started, we would build a partition  
descriptor without the partition, and then CreatePartitionPruneState  
would refuse to work with it.  
  
CreatePartitionPruneState already contains code to deal with the new  
descriptor having more partitions than before (and behaving for the  
extra partitions as if they had been pruned), but doesn't have code to  
deal with less partitions than before, and it is naïve about the case  
where the number of partitions is the same.  We could simply add that a  
new stanza for less partitions than before, and in simple testing it  
works to do that; but it's possible to press the test scripts even  
further and hit the case where one partition is added and a partition is  
removed quickly enough that we see the same number of partitions, but  
they don't actually match, causing hangs during execution.  
  
To cope with both these problems, we now memcmp() the arrays of  
partition OIDs, and do a more elaborate mapping (relying on the fact  
that both OID arrays are in partition-bounds order) if they're not  
identical.  
  
Backpatch to 14, where DETACH CONCURRENTLY appeared.  
  
Reported-by: yajun Hu <[email protected]>  
Reviewed-by: Tender Wang <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  

commit   : ac9615d9a5ae1368de3aa9b8491d217579db5bbf    
  
author   : Amit Kapila <[email protected]>    
date     : Fri, 21 Jun 2024 09:34:11 +0530    
  
committer: Amit Kapila <[email protected]>    
date     : Fri, 21 Jun 2024 09:34:11 +0530    

Add a note in docs that generated columns are skipped for logical  
replication.  
  
Author: Peter Smith  
Reviewed-by: Peter Eisentraut  
Backpatch-through: 12  
Discussion: https://postgr.es/m/CAHut+PuXb1GLQztQkoWzYjSwkAZZ0dgCJaAHyJtZF3kmtcL=kA@mail.gmail.com  

commit   : 88f3baa06afd45510ecef743e11443740b678156    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 20 Jun 2024 14:21:36 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 20 Jun 2024 14:21:36 -0400    

afterTriggerInvokeEvents and AfterTriggerExecute have always  
treated it as an error if the trigger OID mentioned in a queued  
after-trigger event can't be found.  However, that fails to  
account for the edge case where the trigger's been dropped in  
the current transaction since queueing the event.  There seems  
no very good reason to disallow that case, so instead silently  
do nothing if the trigger OID can't be found.  
  
This does give up a little bit of bug-detection ability, but I don't  
recall that these error messages have ever actually revealed a bug,  
so it seems mostly theoretical.  Alternatives such as marking  
pending events DONE at the time of dropping a trigger would be  
complicated and perhaps introduce bugs of their own.  
  
Per bug #18517 from Alexander Lakhin.  Back-patch to all  
supported branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : dae9f16aa31a941f6b596dcb192dd3c29f4d302c    
  
author   : David Rowley <[email protected]>    
date     : Wed, 19 Jun 2024 10:21:52 +1200    
  
committer: David Rowley <[email protected]>    
date     : Wed, 19 Jun 2024 10:21:52 +1200    

In cost_memoize_rescan(), when calculating the hit_ratio using the calls  
and ndistinct estimations, if the value that was set in  
MemoizePath.calls had not been processed through clamp_row_est(), then it  
was possible that it was set to some non-integer value which could result  
in ndistinct being 1 higher than calls due to estimate_num_groups()  
performing clamp_row_est() on its input_rows.  This could result in  
hit_ratio values slightly below 0.0, which would cause an Assert failure.  
  
The value of MemoizePath.calls comes from the final parameter in the  
create_memoize_path() function, of which we only have one true caller of.  
That caller passes outer_path->rows.  All the core code I looked at  
always seems to call clamp_row_est() on the Path.rows, so there might  
have been no issues with any core Paths causing troubles here.  The bug  
report was about a CustomPath with a non-clamped row estimated.  
  
The misbehavior as a result of this seems to be mostly limited to the  
Assert() failing.  Aside from that, it seems the Memoize costs would  
just come out slightly higher than they should have, which is likely  
fairly harmless.  
  
Reported-by: Kohei KaiGai <[email protected]>  
Discussion: https://postgr.es/m/CAOP8fzZnTU+N64UYJYogb1hN-5hFP+PwTb3m_cnGAD7EsQwrKw@mail.gmail.com  
Reviewed-by: Richard Guo  
Backpatch-through: 14, where Memoize was introduced  

commit   : e4a55378f726c6ad251923687ac1dea3aaaab08a    
  
author   : Tom Lane <[email protected]>    
date     : Mon, 17 Jun 2024 14:30:59 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Mon, 17 Jun 2024 14:30:59 -0400    

Reconstruction of an SP-GiST index by REINDEX CONCURRENTLY may  
insert some REDIRECT tuples.  This will typically happen in  
a transaction that lacks an XID, which leads either to assertion  
failure in spgFormDeadTuple or to insertion of a REDIRECT tuple  
with zero xid.  The latter's not good either, since eventually  
VACUUM will apply GlobalVisTestIsRemovableXid() to the zero xid,  
resulting in either an assertion failure or a garbage answer.  
  
In practice, since REINDEX CONCURRENTLY locks out index scans  
till it's done, it doesn't matter whether it inserts REDIRECTs  
or PLACEHOLDERs; and likewise it doesn't matter how soon VACUUM  
reduces such a REDIRECT to a PLACEHOLDER.  So in non-assert builds  
there's no observable problem here, other than perhaps a little  
index bloat.  But it's not behaving as intended.  
  
To fix, remove the failing Assert in spgFormDeadTuple, acknowledging  
that we might sometimes insert a zero XID; and guard VACUUM's  
GlobalVisTestIsRemovableXid() call with a test for valid XID,  
ensuring that we'll reduce such a REDIRECT the first time VACUUM  
sees it.  (Versions before v14 use TransactionIdPrecedes here,  
which won't fail on zero xid, so they really have no bug at all  
in non-assert builds.)  
  
Another solution could be to not create REDIRECTs at all during  
REINDEX CONCURRENTLY, making the relevant code paths treat that  
case like index build (which likewise knows that no concurrent  
index scans can be happening).  That would allow restoring the  
Assert in spgFormDeadTuple, but we'd still need the VACUUM change  
because redirection tuples with zero xid may be out there already.  
But there doesn't seem to be a nice way for spginsert() to tell that  
it's being called in REINDEX CONCURRENTLY without some API changes,  
so we'll leave that as a possible future improvement.  
  
In HEAD, also rename the SpGistState.myXid field to redirectXid,  
which seems less misleading (since it might not in fact be our  
transaction's XID) and is certainly less uninformatively generic.  
  
Per bug #18499 from Alexander Lakhin.  Back-patch to all supported  
branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : f3f6a14ce3e982fb7fbe9f4f33134f3f693f4b7e    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 14 Jun 2024 16:20:35 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 14 Jun 2024 16:20:35 -0400    

DeleteInitPrivs did not get the memo about how, when dropping a  
whole object (with subid == 0), you should drop entries relating  
to its sub-objects too.  This is visible in the test_pg_dump test  
case if one drops the extension at the end: the entry for  
	GRANT SELECT(col1) ON regress_pg_dump_table TO public;  
was still present in pg_init_privs afterwards, although it was  
pointing to a dangling table OID.  
  
Noted while fooling with a fix for REASSIGN OWNED for pg_init_privs  
entries.  This bug is aboriginal in the pg_init_privs feature  
though, and there seems no reason not to back-patch the fix.  

commit   : 5912bf77c526fdb8cfc9bbb56a509a152c6a3632    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 13 Jun 2024 20:34:43 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 13 Jun 2024 20:34:43 -0400    

The manual says clearly that punctuation in the input of  
websearch_to_tsquery() is ignored, except for the special cases  
of dashes and quotes.  However, this failed for cases like  
"(foo bar) or something", or in general an ISOPERATOR character  
in front of the "or".  We'd switch back to WAITOPERAND state,  
then ignore the operator character while remaining in that state,  
and then reach the "or" in WAITOPERAND state which (intentionally)  
makes us treat it as data.  
  
The fix is simple enough: if we see an ISOPERATOR character while in  
WAITOPERATOR state, we have to skip it while staying in that state.  
(We don't need to worry about other punctuation characters: those will  
be consumed as though they were words, but then rejected by lexizing.)  
  
In v14 and up (since commit eb086056f) we can simplify the code a bit  
more too, because there is no longer a reason for the WAITOPERAND  
state to distinguish between quoted and unquoted operands.  
  
Per bug #18479 from Manos Emmanouilidis.  Back-patch to all supported  
branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 1450db793f643991e4684fa8b5cee6ded51ab870    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 13 Jun 2024 13:37:46 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 13 Jun 2024 13:37:46 -0400    

The previous coding here assumed that we didn't need to recheck any  
of the querytree tests made in exec_simple_check_plan().  I think  
we supposed that those properties were fully determined by the  
syntax of the source text and hence couldn't change.  That is true  
for most of them, but at least hasTargetSRFs and hasAggs can change  
by dint of forcibly dropping an originally-referenced function and  
recreating it with new properties.  That leads to "unexpected plan  
node type" or similar failures.  
  
These tests are pretty cheap compared to the cost of replanning, so  
rather than sweat over exactly which properties need to be rechecked,  
let's just recheck them all.  Hence, factor out those tests into a new  
function exec_is_simple_query(), and rearrange callers as needed.  
  
A second problem in the same area was that if we failed during  
replanning or during exec_save_simple_expr(), we'd potentially  
leave behind now-dangling pointers to the old simple expression,  
potentially resulting in crashes later.  To fix, clear those pointers  
before replanning.  
  
The v12 code looks quite different in this area but still has the  
bug about needing to recheck query simplicity.  I chose to back-patch  
all of the plpgsql_simple.sql test script, which formerly didn't exist  
in this branch.  
  
Per bug #18497 from Nikita Kalinin.  Back-patch to all supported  
branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : d881f6fdf5e8346cd8924d4fd671a886a39853d3    
  
author   : Heikki Linnakangas <[email protected]>    
date     : Thu, 13 Jun 2024 19:01:30 +0300    
  
committer: Heikki Linnakangas <[email protected]>    
date     : Thu, 13 Jun 2024 19:01:30 +0300    

The purpose of the function is to reduce the effective  
autovacuum_multixact_freeze_max_age if the multixact members SLRU is  
approaching wraparound, to make multixid freezing more aggressive.  
The returned value should therefore never be greater than plain  
autovacuum_multixact_freeze_max_age.  
  
Reviewed-by: Robert Haas  
Discussion: https://www.postgresql.org/message-id/[email protected]  
Backpatch-through: 12, all supported versions  

commit   : 0e51485392c0c457de0709181a3d2bfdba6f3fb6    
  
author   : Andrew Dunstan <[email protected]>    
date     : Thu, 13 Jun 2024 07:38:48 -0400    
  
committer: Andrew Dunstan <[email protected]>    
date     : Thu, 13 Jun 2024 07:38:48 -0400    

These are checks that are already skipped on other Windows systems.  
  
Backpatch to all live branches, as appropriate.  

commit   : 096f2132c66c9e267999707b3d83482749748520    
  
author   : Tom Lane <[email protected]>    
date     : Tue, 11 Jun 2024 17:57:46 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Tue, 11 Jun 2024 17:57:46 -0400    

infer_arbiter_indexes failed to renumber varnos in index expressions  
or predicates that it got from the catalogs.  This escaped detection  
up to now because the stored varnos in such trees will be 1, and an  
INSERT's result relation is usually the first rangetable entry,  
so that that was fine.  However, in cases such as inserting through  
an updatable view, it's not fine, leading to failure to match the  
expressions to the query with ensuing "there is no unique or exclusion  
constraint matching the ON CONFLICT specification" errors.  
  
Fix by copy-and-paste from get_relation_info().  
  
Per bug #18502 from Michael Wang.  Back-patch to all supported  
versions.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 5dcaefc6a0cf35e3afed0a38216a463d736fff5b    
  
author   : Alvaro Herrera <[email protected]>    
date     : Tue, 11 Jun 2024 11:38:45 +0200    
  
committer: Alvaro Herrera <[email protected]>    
date     : Tue, 11 Jun 2024 11:38:45 +0200    

When a partition is being detached in concurrent mode, it is possible  
for find_inheritance_children_extended() to return that partition in the  
list, and immediately after that receive an invalidation message that  
sets its relpartbound to NULL just before we read it.  (This can happen  
because table_open() reads invalidation messages.)  Currently we raise  
an error  
  ERROR:  missing relpartbound for relation %u  
about the situation, but that's bogus because the table is no longer a  
partition, so we shouldn't be complaining about it.  A better reaction  
is to retry the find_inheritance_children_extended call to get a new  
list, which will no longer have the partition being detached.  
  
Noticed while investigating bug #18377.  
  
Backpatch to 14, where DETACH CONCURRENTLY appeared.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 5f200ab5749a0813c48b45b217b273abeb2fdc52    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 7 Jun 2024 16:45:56 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 7 Jun 2024 16:45:56 -0400    

test_predtest() neglected to consider the possibility that  
SPI_plan_get_cached_plan would return NULL.  This led to a core  
dump if the input (incorrectly) contains more than one SQL  
command.  
  
While here, let's expend more than zero effort on the error  
message for this case and nearby ones.  
  
Per (half of) bug #18483 from Alexander Kozhemyakin.  
Back-patch to all supported branches, not because this is  
very significant (it's merely test scaffolding) but to make  
our world a bit safer for fuzz testing.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 2dad0f433db9f8ec488153818ee27099fb83d398    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 7 Jun 2024 14:50:09 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 7 Jun 2024 14:50:09 -0400    

Normally this case isn't even reachable by non-superusers, since  
permissions checks prevent naming such a table.  However, it is  
possible to make it happen by altering a parent table whose child  
is another session's temp table.  
  
We definitely can't support any such ALTER that requires modifying  
the contents of such a table, since we lack access to the other  
session's temporary-buffer pool.  But there seems no good reason  
to allow it even if it'd only require changing catalog contents.  
One reason not to allow it is that we'd rather not expose the  
implementation-dependent behavior of whether a specific ALTER  
requires touching the table contents.  Another is that there may  
be (in future, even if not today) optimizations that assume that  
a session's own temp tables won't be modified by other sessions.  
  
Hence, add a RELATION_IS_OTHER_TEMP() check to all the places  
where ALTER TABLE currently does CheckTableNotInUse().  (I looked  
through all other callers of CheckTableNotInUse(), and they seem  
OK already.)  
  
Per bug #18492 from Alexander Lakhin.  Back-patch to all supported  
branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 0f7d1338c832f00645fe1be880529bac1cd1ff9c    
  
author   : Tom Lane <[email protected]>    
date     : Fri, 7 Jun 2024 13:27:26 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Fri, 7 Jun 2024 13:27:26 -0400    

If the CALL is within an atomic context (e.g. there's an outer  
transaction block), _SPI_execute_plan should acquire a fresh snapshot  
to execute any such functions with.  We failed to do that and instead  
passed them the Portal snapshot, which had been acquired at the start  
of the current SQL command.  This'd lead to seeing stale values of  
rows modified since the start of the command.  
  
This is arguably a bug in 84f5c2908: I failed to see that "are we in  
non-atomic mode" needs to be defined the same way as it is further  
down in _SPI_execute_plan, i.e. check !_SPI_current->atomic not just  
options->allow_nonatomic.  Alternatively the blame could be laid on  
plpgsql, which is unconditionally passing allow_nonatomic = true  
for CALL/DO even when it knows it's in an atomic context.  However,  
fixing it in spi.c seems like a better idea since that will also fix  
the problem for any extensions that may have copied plpgsql's coding  
pattern.  
  
While here, update an obsolete comment about _SPI_execute_plan's  
snapshot management.  
  
Per report from Victor Yegorov.  Back-patch to all supported versions.  
  
Discussion: https://postgr.es/m/CAGnEboiRe+fG2QxuBO2390F7P8e2MQ6UyBjZSL_w1Cej+E4=Vw@mail.gmail.com  

commit   : 269e2c39162811a170d7e8f87a1a0bde3b9e2fab    
  
author   : Etsuro Fujita <[email protected]>    
date     : Fri, 7 Jun 2024 17:45:06 +0900    
  
committer: Etsuro Fujita <[email protected]>    
date     : Fri, 7 Jun 2024 17:45:06 +0900    

Previously, when considering LIMIT pushdown, postgres_fdw failed to  
check whether the query has this clause, which led to pushing false  
LIMIT clauses, causing incorrect results.  
  
This clause has been supported since v13, so we need to do a  
remote-version check before deciding that it will be safe to push such a  
clause, but we do not currently have a way to do the check (without  
accessing the remote server); disable pushing such a clause for now.  
  
Oversight in commit 357889eb1.  Back-patch to v13, where that commit  
added the support.  
  
Per bug #18467 from Onder Kalaci.  
  
Patch by Japin Li, per a suggestion from Tom Lane, with some changes to  
the comments by me.  Review by Onder Kalaci, Alvaro Herrera, and me.  
  
Discussion: https://postgr.es/m/18467-7bb89084ff03a08d%40postgresql.org  

commit   : 788c23003f4c42d9114fa8e9881ccea870187da5    
  
author   : Peter Eisentraut <[email protected]>    
date     : Fri, 7 Jun 2024 08:02:15 +0200    
  
committer: Peter Eisentraut <[email protected]>    
date     : Fri, 7 Jun 2024 08:02:15 +0200    

The wording from the "columns" view was copied to the "attributes"  
view without the required adjustments.  

commit   : d88dcdf0fa5b0d6a3b21cea6241fc558e571727e    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 6 Jun 2024 15:16:56 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 6 Jun 2024 15:16:56 -0400    

Before the v13-era commit 913bbd88d, check_sql_fn_retval fails to  
resolve polymorphic output types and then just throws up its hands and  
assumes the check will be made at runtime.  I think that's true for  
ordinary functions returning RECORD, but it doesn't happen in CALL,  
potentially resulting in crashes if the actual output of the SQL  
procedure's SELECT doesn't match the type inferred from polymorphism.  
With a little bit of rearrangement, we can use get_call_result_type  
instead of get_func_result_type and thereby infer the correct types.  
  
I'm still unwilling to back-patch all of 913bbd88d, so if the types  
don't match you'll get an error rather than perhaps silently inserting  
a cast as v13 and later can.  That's consistent with prior behavior  
though, so it seems fine.  
  
Prior to 70ffb27b2, you'd typically get other errors due to other  
shortcomings of CALL's management of polymorphism.  Nonetheless,  
this is an independent bug.  
  
Although there is no bug in v13 and up, it seems prudent to add  
the test case for this to the newer branches too.  It's clearly  
an under-tested area.  
  
Per report from Andrew Bille.  
  
Discussion: https://postgr.es/m/CAJnzarw9EeWHAQRm76dXd=7j+rgw6ERqC=nCay8jeFqTwKwhqQ@mail.gmail.com  

commit   : 030ea3961f26c602929c3b277d2f4e5f9fd4bd87    
  
author   : Nathan Bossart <[email protected]>    
date     : Wed, 5 Jun 2024 15:32:47 -0500    
  
committer: Nathan Bossart <[email protected]>    
date     : Wed, 5 Jun 2024 15:32:47 -0500    

The documentation for POSIX semaphores is missing a reference to  
max_wal_senders.  This commit fixes that in the same way that  
commit 4ebe51a5fb fixed the same issue in the documentation for  
System V semaphores.  
  
Discussion: https://postgr.es/m/20240517164452.GA1914161%40nathanxps13  
Backpatch-through: 12  

commit   : 1488dee08c4aa5b92a4cde66eb69b3e78e80a6d8    
  
author   : Tom Lane <[email protected]>    
date     : Tue, 4 Jun 2024 18:02:13 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Tue, 4 Jun 2024 18:02:13 -0400    

In a procedure or function returning tuple, we use that function to  
parse the Tcl script's result, which is supposed to be a Tcl list.  
If it isn't, you get an error.  Commit 26abb50c4 incautiously  
supposed that we could use throw_tcl_error() to report such an error.  
That doesn't actually work, because low-level functions like  
Tcl_ListObjGetElements() don't fill Tcl's errorInfo variable.  
The result is either a null-pointer-dereference crash or emission  
of misleading context information describing the previous Tcl error.  
  
Back off to just reporting the interpreter's result string, and  
improve throw_tcl_error()'s comment to explain when to use it.  
  
Also, although the similar code in pltcl_trigger_handler() avoided  
this mistake, it was using a fairly confusing wording of the  
error message.  Improve that while we're here.  
  
Per report from A. Kozhemyakin.  Back-patch to all supported  
branches.  
  
Erik Wienhold and Tom Lane  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : d0c11ea29846e66a49eecc62260d11709da3c73e    
  
author   : Nathan Bossart <[email protected]>    
date     : Mon, 3 Jun 2024 12:10:43 -0500    
  
committer: Nathan Bossart <[email protected]>    
date     : Mon, 3 Jun 2024 12:10:43 -0500    

The formulas for SEMMNI and SEMMNS do not include the archiver  
process, which was converted to an auxiliary process in v14, and  
the WAL summarizer process, which was introduced in v17.  This  
commit corrects these formulas and adds a missing reference to  
max_wal_senders nearby.  Since this section of the documentation  
tends to be incorrect quite often, we should likely give up on  
documenting the exact formulas in favor of something less fragile,  
but that is left as a future exercise.  
  
Reported-by: Sami Imseih  
Reviewed-by: Sami Imseih  
Discussion: https://postgr.es/m/20240517164452.GA1914161%40nathanxps13  
Backpatch-through: 12  

commit   : 0795a35d13089c203f1b1ef523824c2fc22a6af9    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 23 May 2024 15:52:06 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 23 May 2024 15:52:06 -0400    

Coverity complains that ECPGdebug is accessing debugstream without  
holding debug_mutex, which is a fair complaint: we should take  
debug_mutex while changing the settings ecpg_log looks at.  
  
In some branches it also complains about unlocked use of simple_debug.  
I think it's intentional and safe to have a quick unlocked check of  
simple_debug at the start of ecpg_log, since that early exit will  
always be taken in non-debug cases.  But we should recheck  
simple_debug after acquiring the mutex.  In the worst case, calling  
ECPGdebug concurrently with ecpg_log in another thread could result  
in a null-pointer dereference due to debugstream transiently being  
NULL while simple_debug isn't 0.  
  
This is largely hypothetical, since it's unlikely anybody uses  
ECPGdebug() at all in the field, and our own regression tests  
don't seem to be hitting the theoretical race conditions either.  
Still, if we're going to the trouble of having mutexes here, we ought  
to be using them in a way that's actually safe not just almost safe.  
Hence, back-patch to all supported branches.  

commit   : 961608636461e259487223237147ce447672deaa    
  
author   : Michael Paquier <[email protected]>    
date     : Thu, 23 May 2024 13:03:17 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Thu, 23 May 2024 13:03:17 +0900    

Parameter column_name must be an existing column because ALTER  
MATERIALIZED VIEW cannot add new columns.  The old description was  
likely copied from ALTER TABLE.  
  
Author: Erik Wienhold  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: 12  

commit   : 1015162c353510854a3c47ad10b78029664ab13a    
  
author   : Tom Lane <[email protected]>    
date     : Wed, 22 May 2024 17:54:17 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Wed, 22 May 2024 17:54:17 -0400    

transformTableLikeClause believed that it could process extended  
statistics immediately because "the representation of CreateStatsStmt  
doesn't depend on column numbers".  That was true when extended stats  
were first introduced, but it was falsified by the addition of  
extended stats on expressions: the parsed expression tree is fed  
forward by the LIKE option, and that will contain Vars.  So if the  
new table doesn't have attnums identical to the old one's (typically  
because there are some dropped columns in the old one), that doesn't  
work.  The CREATE goes through, but it emits invalid statistics  
objects that will cause problems later.  
  
Fortunately, we already have logic that can adapt expression trees  
to the possibly-new column numbering.  To use it, we have to delay  
processing of CREATE_TABLE_LIKE_STATISTICS into expandTableLikeClause,  
just as for other LIKE options that involve expressions.  
  
Per bug #18468 from Alexander Lakhin.  Back-patch to v14 where  
extended statistics on expressions were added.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 5ac340602e7481198f2576567665ce6facc03a89    
  
author   : Tom Lane <[email protected]>    
date     : Sat, 18 May 2024 14:31:35 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Sat, 18 May 2024 14:31:35 -0400    

We are capable of optimizing MIN() and MAX() aggregates on indexed  
columns into subqueries that exploit the index, rather than the normal  
thing of scanning the whole table.  When we do this, we replace the  
Aggref node(s) with Params referencing subquery outputs.  Such Params  
really ought to be included in the per-plan-node extParam/allParam  
sets computed by SS_finalize_plan.  However, we've never done so  
up to now because of an ancient implementation choice to perform  
that substitution during set_plan_references, which runs after  
SS_finalize_plan, so that SS_finalize_plan never sees these Params.  
  
The cleanest fix would be to perform a separate tree walk to do  
these substitutions before SS_finalize_plan runs.  That seems  
unattractive, first because a whole-tree mutation pass is expensive,  
and second because we lack infrastructure for visiting expression  
subtrees in a Plan tree, so that we'd need a new function knowing  
as much as SS_finalize_plan knows about that.  I also considered  
swapping the order of SS_finalize_plan and set_plan_references,  
but that fell foul of various assumptions that seem tricky to fix.  
So the approach adopted here is to teach SS_finalize_plan itself  
to check for such Aggrefs.  I refactored things a bit in setrefs.c  
to avoid having three copies of the code that does that.  
  
Back-patch of v17 commits d0d44049d and 779ac2c74.  When d0d44049d  
went in, there was no evidence that it was fixing a reachable bug,  
so I refrained from back-patching.  Now we have such evidence.  
  
Per bug #18465 from Hal Takahara.  Back-patch to all supported  
branches.  
  
Discussion: https://postgr.es/m/[email protected]  
Discussion: https://postgr.es/m/[email protected]  

commit   : ccf3408cff539d21256f14a350dd156c8bee05ef    
  
author   : Daniel Gustafsson <[email protected]>    
date     : Fri, 17 May 2024 14:24:27 +0200    
  
committer: Daniel Gustafsson <[email protected]>    
date     : Fri, 17 May 2024 14:24:27 +0200    

Commit 695b4a113ab added a dependency on retrieving oldestxid from  
pg_control, which only exists in 9.0 and onwards, but the check for  
8.4 as the oldest version was retained. Since there has been few if  
any complaints of 8.4 upgrades not working, fix by setting 9.0 as  
the oldest version supported rather than resurrecting 8.4 support.  
  
Backpatch to all supported versions.  
  
Reviewed-by: Tom Lane <[email protected]>  
Discussion: https://postgr.es/m/[email protected]  
Backpatch-through: v12  

commit   : 01e98e0cdd36167f01b6d618486897eea1cfd09d    
  
author   : Noah Misch <[email protected]>    
date     : Thu, 16 May 2024 14:11:00 -0700    
  
committer: Noah Misch <[email protected]>    
date     : Thu, 16 May 2024 14:11:00 -0700    

Specifically, it terminates a background worker even if the caller  
couldn't terminate the background worker with pg_terminate_backend().  
Commit 3a9b18b3095366cd0c4305441d426d04572d88c1 neglected to update  
this.  Back-patch to v13, which introduced DROP DATABASE FORCE.  
  
Reviewed by Amit Kapila.  Reported by Kirill Reshke.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : b284513752529652344ce496df3b844b797dd6b4    
  
author   : Peter Eisentraut <[email protected]>    
date     : Wed, 15 May 2024 13:05:30 +0200    
  
committer: Peter Eisentraut <[email protected]>    
date     : Wed, 15 May 2024 13:05:30 +0200    

Erroneously introduced by 571df93cff8.  
  
Reviewed-by: Daniel Gustafsson <[email protected]>  
Discussion: https://www.postgresql.org/message-id/flat/8458c9c5-18f1-46d7-94c4-1c30e4f44908%40eisentraut.org  

commit   : 525bd1620e9ba6b9327cc8ad420ad0352965b2c7    
  
author   : Tom Lane <[email protected]>    
date     : Tue, 14 May 2024 20:19:20 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Tue, 14 May 2024 20:19:20 -0400    

Most of the infrastructure for procedure arguments was already  
okay with polymorphic output arguments, but it turns out that  
CallStmtResultDesc() was a few bricks shy of a load here.  It thought  
all it needed to do was call build_function_result_tupdesc_t, but  
that function specifically disclaims responsibility for resolving  
polymorphic arguments.  Failing to handle that doesn't seem to be  
a problem for CALL in plpgsql, but CALL from plain SQL would get  
errors like "cannot display a value of type anyelement", or even  
crash outright.  
  
In v14 and later we can simply examine the exposed types of the  
CallStmt.outargs nodes to get the right type OIDs.  But it's a lot  
more complicated to fix in v12/v13, because those versions don't  
have CallStmt.outargs, nor do they do expand_function_arguments  
until ExecuteCallStmt runs.  We have to duplicatively run  
expand_function_arguments, and then re-determine which elements  
of the args list are output arguments.  
  
Per bug #18463 from Drew Kimball.  Back-patch to all supported  
versions, since it's busted in all of them.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : c8714230ad35cc4587555ebe7052ba0ec87722f0    
  
author   : Nathan Bossart <[email protected]>    
date     : Mon, 13 May 2024 15:53:50 -0500    
  
committer: Nathan Bossart <[email protected]>    
date     : Mon, 13 May 2024 15:53:50 -0500    

Presently, when this function is called for an unlogged sequence on  
a standby server, it will error out with a message like  
  
	ERROR:  could not open file "base/5/16388": No such file or directory  
  
Since the pg_sequences system view uses pg_sequence_last_value(),  
it can error similarly.  To fix, modify the function to return NULL  
for unlogged sequences on standby servers.  Since this bug is  
present on all versions since v15, this approach is preferable to  
making the ERROR nicer because we need to repair the pg_sequences  
view without modifying its definition on released versions.  For  
consistency, this commit also modifies the function to return NULL  
for other sessions' temporary sequences.  The pg_sequences view  
already appropriately filters out such sequences, so there's no bug  
there, but we might as well offer some defense in case someone  
invokes this function directly.  
  
Unlogged sequences were first introduced in v15, but temporary  
sequences are much older, so while the fix for unlogged sequences  
is only back-patched to v15, the temporary sequence portion is  
back-patched to all supported versions.  
  
We could also remove the privilege check in the pg_sequences view  
definition in v18 if we modify this function to return NULL for  
sequences for which the current user lacks privileges, but that is  
left as a future exercise for when v18 development begins.  
  
Reviewed-by: Tom Lane, Michael Paquier  
Discussion: https://postgr.es/m/20240501005730.GA594666%40nathanxps13  
Backpatch-through: 12  

commit   : d39337021e12d569e3241a605120f010f77b9e22    
  
author   : Tom Lane <[email protected]>    
date     : Thu, 9 May 2024 13:16:21 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Thu, 9 May 2024 13:16:21 -0400    

If we recursed to a new call of the same function, with a different  
coldeflist (AS clause), it would fail because the inner call would  
overwrite the outer call's idea of what to return.  This is vaguely  
like 1d2fe56e4 and c5bec5426, but it's not due to any API decisions:  
it's just that we computed the actual output rowtype at the start of  
the call, and saved it in the per-procedure data structure.  We can  
fix it at basically zero cost by doing the computation at the end  
of each call instead of the start.  
  
It's not clear that there's any real-world use-case for such a  
function, but given that it doesn't cost anything to fix,  
it'd be silly not to.  
  
Per report from Andreas Karlsson.  Back-patch to all supported  
branches.  
  
Discussion: https://postgr.es/m/[email protected]  

commit   : 41adf9d960c0105ada615574126d5568d552f4db    
  
author   : Michael Paquier <[email protected]>    
date     : Thu, 9 May 2024 12:45:48 +0900    
  
committer: Michael Paquier <[email protected]>    
date     : Thu, 9 May 2024 12:45:48 +0900    

json_lex_string() relies on pg_encoding_mblen_bounded() to point to the  
end of a JSON string when generating an error message, and the input it  
uses is not guaranteed to be null-terminated.  
  
It was possible to walk off the end of the input buffer by a few bytes  
when the last bytes consist of an incomplete multi-byte sequence, as  
token_terminator would point to a location defined by  
pg_encoding_mblen_bounded() rather than the end of the input.  This  
commit switches token_terminator so as the error uses data up to the  
end of the JSON input.  
  
More work should be done so as this code could rely on an equivalent of  
report_invalid_encoding() so as incorrect byte sequences can show in  
error messages in a readable form.  This requires work for at least two  
cases in the JSON parsing API: an incomplete token and an invalid escape  
sequence.  A more complete solution may be too invasive for a backpatch,  
so this is left as a future improvement, taking care of the overread  
first.  
  
A test is added on HEAD as test_json_parser makes this issue  
straight-forward to check.  
  
Note that pg_encoding_mblen_bounded() no longer has any callers.  This  
will be removed on HEAD with a separate commit, as this is proving to  
encourage unsafe coding.  
  
Author: Jacob Champion  
Discussion: https://postgr.es/m/CAOYmi+ncM7pwLS3AnKCSmoqqtpjvA8wmCdoBtKA3ZrB2hZG6zA@mail.gmail.com  
Backpatch-through: 13  

commit   : 52b23b4e1c6f703a6617c027a5def99772af4ce4    
  
author   : Tom Lane <[email protected]>    
date     : Tue, 7 May 2024 18:22:52 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Tue, 7 May 2024 18:22:52 -0400    

If -l was specified together with selective-restore options such as -n  
or -N, dependent TOC entries such as comments would be omitted from  
the listing, even when an actual restore would have selected them.  
This happened because PrintTOCSummary neglected to update the te->reqs  
marking of the entry they depended on.  
  
Per report from Justin Pryzby.  This has been wrong since 0d4e6ed30  
taught _tocEntryRequired to sometimes look at the "reqs" marking of  
other TOC entries, so back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/ZjoeirG7yxODdC4P@pryzbyj2023  

commit   : 90d39929a8900ba38a3ded503481867ca3182849    
  
author   : Tom Lane <[email protected]>    
date     : Tue, 7 May 2024 18:15:00 -0400    
  
committer: Tom Lane <[email protected]>    
date     : Tue, 7 May 2024 18:15:00 -0400    

If a plpython-language trigger caused another one to be invoked,  
the "TD" dictionary created for the inner one would overwrite the  
outer one's "TD" dictionary.  This is more or less the same problem  
that 1d2fe56e4 fixed for ordinary functions in plpython, so fix it  
the same way, by saving and restoring "TD" during a recursive  
invocation.  
  
This fix makes an ABI-incompatible change in struct PLySavedArgs.  
I'm not too worried about that because it seems highly unlikely that  
any extension is messing with those structs.  We could imagine doing  
something weird to preserve nominal ABI compatibility in the back  
branches, like keeping the saved TD object in an extra element of  
namedargs[].  However, that would only be very nominal compatibility:  
if anything *is* touching PLySavedArgs, it would likely do the wrong  
thing due to not knowing about the additional value.  So I judge it  
not worth the ugliness to do something different there.  
  
(I also changed struct PLyProcedure, but its added field fits  
into formerly-padding space, so that should be safe.)  
  
Per bug #18456 from Jacques Combrink.  This bug is very ancient,  
so back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/[email protected]