PostgreSQL 9.5.23 commit log

commit   : 641d7cf4bc92499fdbf23f3b47112502d5720599    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Mon, 10 Aug 2020 17:23:10 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Mon, 10 Aug 2020 17:23:10 -0400    

commit   : 2e0358752da35d9c3496a5b448983d0ebd0ed9d9    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Mon, 10 Aug 2020 15:35:46 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Mon, 10 Aug 2020 15:35:46 -0400    

Security: CVE-2020-14349, CVE-2020-14350  

commit   : 6b11a46878523c5ebbc2dbd0428f11b8188791d5    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Mon, 10 Aug 2020 10:44:43 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Mon, 10 Aug 2020 10:44:43 -0400    

Hostile objects located within the installation-time search_path could  
capture references in an extension's installation or upgrade script.  
If the extension is being installed with superuser privileges, this  
opens the door to privilege escalation.  While such hazards have existed  
all along, their urgency increases with the v13 "trusted extensions"  
feature, because that lets a non-superuser control the installation path  
for a superuser-privileged script.  Therefore, make a number of changes  
to make such situations more secure:  
  
* Tweak the construction of the installation-time search_path to ensure  
that references to objects in pg_catalog can't be subverted; and  
explicitly add pg_temp to the end of the path to prevent attacks using  
temporary objects.  
  
* Disable check_function_bodies within installation/upgrade scripts,  
so that any security gaps in SQL-language or PL-language function bodies  
cannot create a risk of unwanted installation-time code execution.  
  
* Adjust lookup of type input/receive functions and join estimator  
functions to complain if there are multiple candidate functions.  This  
prevents capture of references to functions whose signature is not the  
first one checked; and it's arguably more user-friendly anyway.  
  
* Modify various contrib upgrade scripts to ensure that catalog  
modification queries are executed with secure search paths.  (These  
are in-place modifications with no extension version changes, since  
it is the update process itself that is at issue, not the end result.)  
  
Extensions that depend on other extensions cannot be made fully secure  
by these methods alone; therefore, revert the "trusted" marking that  
commit eb67623c9 applied to earthdistance and hstore_plperl, pending  
some better solution to that set of issues.  
  
Also add documentation around these issues, to help extension authors  
write secure installation scripts.  
  
Patch by me, following an observation by Andres Freund; thanks  
to Noah Misch for review.  
  
Security: CVE-2020-14350  

commit   : 76fe7ba5d8f09651751a91e357c13b8795e6e26c    
  
author   : Peter Eisentraut <peter@eisentraut.org>    
date     : Mon, 10 Aug 2020 15:36:46 +0200    
  
committer: Peter Eisentraut <peter@eisentraut.org>    
date     : Mon, 10 Aug 2020 15:36:46 +0200    

Source-Git-URL: https://git.postgresql.org/git/pgtranslation/messages.git  
Source-Git-Hash: 62652e0731507ea1a76c621e3340e23ef85abbc3  

commit   : af3677ef1bc0c76069ff7dd00cd0339f26d372e9    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Sun, 9 Aug 2020 12:39:08 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Sun, 9 Aug 2020 12:39:08 -0400    

Coverity pointed out, not unreasonably, that we checked fseeko's  
result at every other call site but these.  Failure to seek in the  
temp file (note this is NOT pg_dump's output file) seems quite  
unlikely, and even if it did happen the file length cross-check  
further down would probably detect the problem.  Still, that's a  
poor excuse for not checking the result of a system call.  

commit   : bc77fb7e47d493dce95c2a3c18a93b451ba6fa35    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Sat, 8 Aug 2020 20:01:41 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Sat, 8 Aug 2020 20:01:41 -0400    

commit   : ca8e87ea04a4ff824a773d484ac7eecf772db61e    
  
author   : Alvaro Herrera <alvherre@alvh.no-ip.org>    
date     : Sat, 8 Aug 2020 12:31:55 -0400    
  
committer: Alvaro Herrera <alvherre@alvh.no-ip.org>    
date     : Sat, 8 Aug 2020 12:31:55 -0400    

Ashutosh Bapat noticed that when logical walsender needs to wait for  
WAL, and it realizes that it must send a keepalive message to  
walreceiver to update the sent-LSN, which *does not* request a reply  
from walreceiver, it wrongly sets the flag that it's going to wait for  
that reply.  That means that any future would-be sender of feedback  
messages ends up not sending a feedback message, because they all  
believe that a reply is expected.  
  
With built-in logical replication there's not much harm in this, because  
WalReceiverMain will send a ping-back every wal_receiver_timeout/2  
anyway; but with other logical replication systems (e.g. pglogical) it  
can cause significant pain.  
  
This problem was introduced in commit 41d5f8ad734, where the  
request-reply flag was changed from true to false to WalSndKeepalive,  
without at the same time removing the line that sets  
waiting_for_ping_response.  
  
Just removing that line would be a sufficient fix, but it seems better  
to shift the responsibility of setting the flag to WalSndKeepalive  
itself instead of requiring caller to do it; this is clearly less  
error-prone.  
  
Author: Álvaro Herrera <alvherre@alvh.no-ip.org>  
Reported-by: Ashutosh Bapat <ashutosh.bapat@2ndquadrant.com>  
Backpatch: 9.5 and up  
Discussion: https://postgr.es/m/20200806225558.GA22401@alvherre.pgsql  

commit   : 74e1c967b533a334e61a2b343e2b6444067f6173    
  
author   : Bruce Momjian <bruce@momjian.us>    
date     : Wed, 5 Aug 2020 17:12:09 -0400    
  
committer: Bruce Momjian <bruce@momjian.us>    
date     : Wed, 5 Aug 2020 17:12:09 -0400    

Reported-by: Vyacheslav Shablistyy  
  
Discussion: https://postgr.es/m/159586122762.680.1361378513036616007@wrigleys.postgresql.org  
  
Backpatch-through: 9.5  

commit   : d809d99cd4dba1e42d4f330289664453889900a5    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Mon, 3 Aug 2020 13:11:16 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Mon, 3 Aug 2020 13:11:16 -0400    

We've allowed UTC offsets up to +/- 15:59 since commit cd0ff9c0f, but  
that commit forgot to fix the documentation about timetz.  
  
Per bug #16571 from osdba.  
  
Discussion: https://postgr.es/m/16571-eb7501598de78c8a@postgresql.org  

commit   : c4a13b361f0852fe408ba150741722c29ebc0176    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Fri, 31 Jul 2020 11:43:13 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Fri, 31 Jul 2020 11:43:13 -0400    

The new hlCover() algorithm that I introduced in commit c9b0c678d  
turns out to potentially take O(N^2) or worse time on long documents,  
if there are many occurrences of individual query words but few or no  
substrings that actually satisfy the query.  (One way to hit this  
behavior is with a "common_word & rare_word" type of query.)  This  
seems unavoidable given the original goal of checking every substring  
of the document, so we have to back off that idea.  Fortunately, it  
seems unlikely that anyone would really want headlines spanning all of  
a long document, so we can avoid the worse-than-linear behavior by  
imposing a maximum length of substring that we'll consider.  
  
For now, just hard-wire that maximum length as a multiple of max_words  
times max_fragments.  Perhaps at some point somebody will argue for  
exposing it as a ts_headline parameter, but I'm hesitant to make such  
a feature addition in a back-patched bug fix.  
  
I also noted that the hlFirstIndex() function I'd added in that  
commit was unnecessarily stupid: it really only needs to check whether  
a HeadlineWordEntry's item pointer is null or not.  This wouldn't make  
all that much difference in typical cases with queries having just  
a few terms, but a cycle shaved is a cycle earned.  
  
In addition, add a CHECK_FOR_INTERRUPTS call in TS_execute_recurse.  
This ensures that hlCover's loop is cancellable if it manages to take  
a long time, and it may protect some other TS_execute callers as well.  
  
Back-patch to 9.6 as the previous commit was.  I also chose to add the  
CHECK_FOR_INTERRUPTS call to 9.5.  The old hlCover() algorithm seems  
to avoid the O(N^2) behavior, at least on the test case I tried, but  
nonetheless it's not very quick on a long document.  
  
Per report from Stephen Frost.  
  
Discussion: https://postgr.es/m/20200724160535.GW12375@tamriel.snowman.net  

commit   : 9baf5d639261d72a2f86311fde93f612f7ede9dc    
  
author   : Tatsuo Ishii <ishii@postgresql.org>    
date     : Fri, 31 Jul 2020 08:04:26 +0900    
  
committer: Tatsuo Ishii <ishii@postgresql.org>    
date     : Fri, 31 Jul 2020 08:04:26 +0900    

In "High Availability, Load Balancing, and Replication" chapter,  
certain descriptions of Pgpool-II were not correct at this point.  It  
does not need conflict resolution. Also "Multiple-Server Parallel  
Query Execution" is not supported anymore.  
  
Discussion: https://postgr.es/m/20200726.230128.53842489850344110.t-ishii%40sraoss.co.jp  
Author: Tatsuo Ishii  
Reviewed-by: Bruce Momjian  
Backpatch-through: 9.5  

commit   : b6608ae5d3cc16005d4fd4f1be2790e3ad566892    
  
author   : Peter Geoghegan <pg@bowt.ie>    
date     : Wed, 29 Jul 2020 16:00:48 -0700    
  
committer: Peter Geoghegan <pg@bowt.ie>    
date     : Wed, 29 Jul 2020 16:00:48 -0700    

Backpatch an assertion (that was originally added to Postgres 12 by  
commit dd299df8189) that seems broadly useful.  The assertion can detect  
violations of the HOT invariant (i.e. no two index tuples can point to  
the same heap TID) when CREATE INDEX somehow incorrectly allows that to  
take place.  
  
For example, a IndexBuildHeapScan/heapam_index_build_range_scan bug  
might result in two tuples that both point to the same heap TID.  If  
these two tuples also happen to be duplicates, the assertion will fail.  
  
Discussion: https://postgr.es/m/CAH2-WzmBxu4o=pMsniur+bwHqCGCmV_AOLkuK6BuU7ngA6evqw@mail.gmail.com  
Backpatch: 9.5-11 only  

commit   : aaa132a65deb232125a999184857aaacf3140680    
  
author   : Michael Paquier <michael@paquier.xyz>    
date     : Mon, 27 Jul 2020 15:59:22 +0900    
  
committer: Michael Paquier <michael@paquier.xyz>    
date     : Mon, 27 Jul 2020 15:59:22 +0900    

A compressed stream may end with an empty packet.  In this case  
decompression finishes before reading the empty packet and the  
remaining stream packet causes a failure in reading the following  
data.  This commit makes sure to consume such extra data, avoiding a  
failure when decompression the data.  This corner case was reproducible  
easily with a data length of 16kB, and existed since e94dd6a.  A cheap  
regression test is added to cover this case based on a random,  
incompressible string.  
  
The first attempt of this patch has allowed to find an older failure  
within the compression logic of pgcrypto, fixed by b9b6105.  This  
involved SLES 15 with z390 where a custom flavor of libz gets used.  
Bonus thanks to Mark Wong for providing access to the specific  
environment.  
  
Reported-by: Frank Gagnepain  
Author: Kyotaro Horiguchi, Michael Paquier  
Reviewed-by: Tom Lane  
Discussion: https://postgr.es/m/16476-692ef7b84e5fb893@postgresql.org  
Backpatch-through: 9.5  

commit   : d0519e9fea96331fbc5f6d65373b2411526cd95d    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Thu, 23 Jul 2020 17:19:37 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Thu, 23 Jul 2020 17:19:37 -0400    

contrib/pgcrypto mishandled the case where deflate() does not consume  
all of the offered input on the first try.  It reset the next_in pointer  
to the start of the input instead of leaving it alone, causing the wrong  
data to be fed to the next deflate() call.  
  
This has been broken since pgcrypto was committed.  The reason for the  
lack of complaints seems to be that it's fairly hard to get stock zlib  
to not consume all the input, so long as the output buffer is big enough  
(which it normally would be in pgcrypto's usage; AFAICT the input is  
always going to be packetized into packets no larger than ZIP_OUT_BUF).  
However, IBM's zlibNX implementation for AIX evidently will do it  
in some cases.  
  
I did not add a test case for this, because I couldn't find one that  
would fail with stock zlib.  When we put back the test case for  
bug #16476, that will cover the zlibNX situation well enough.  
  
While here, write deflate()'s second argument as Z_NO_FLUSH per its  
API spec, instead of hard-wiring the value zero.  
  
Per buildfarm results and subsequent investigation.  
  
Discussion: https://postgr.es/m/16476-692ef7b84e5fb893@postgresql.org  

commit   : 77033aa97af75802dcf4985b86c4555c9722c348    
  
author   : Peter Eisentraut <peter@eisentraut.org>    
date     : Thu, 23 Jul 2020 17:13:00 +0200    
  
committer: Peter Eisentraut <peter@eisentraut.org>    
date     : Thu, 23 Jul 2020 17:13:00 +0200    

TLS 1.3 uses a different way of specifying ciphers and a different  
OpenSSL API.  PostgreSQL currently does not support setting those  
ciphers.  For now, just document this.  In the future, support for  
this might be added somehow.  
  
Reviewed-by: Jonathan S. Katz <jkatz@postgresql.org>  
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>  

commit   : 3725c8ce4b29076baabb3856e1ade2f15ceee938    
  
author   : Thomas Munro <tmunro@postgresql.org>    
date     : Thu, 23 Jul 2020 21:10:49 +1200    
  
committer: Thomas Munro <tmunro@postgresql.org>    
date     : Thu, 23 Jul 2020 21:10:49 +1200    

Remove extra space.  Back-patch to all releases, like commit 7897e3bb.  
  
Author: Lu, Chenyang <lucy.fnst@cn.fujitsu.com>  
Discussion: https://postgr.es/m/795d03c6129844d3803e7eea48f5af0d%40G08CNEXMBPEKD04.g08.fujitsu.local  

commit   : 43e21fd8f6e8680df0153a0286af394c22123694    
  
author   : Michael Paquier <michael@paquier.xyz>    
date     : Thu, 23 Jul 2020 08:29:38 +0900    
  
committer: Michael Paquier <michael@paquier.xyz>    
date     : Thu, 23 Jul 2020 08:29:38 +0900    

This reverts commit 9e10898, after finding out that buildfarm members  
running SLES 15 on z390 complain on the compression and decompression  
logic of the new test: pipistrelles, barbthroat and steamerduck.  
  
Those hosts are visibly using hardware-specific changes to improve zlib  
performance, requiring more investigation.  
  
Thanks to Tom Lane for the discussion.  
  
Discussion: https://postgr.es/m/20200722093749.GA2564@paquier.xyz  
Backpatch-through: 9.5  

commit   : dbf17ca1bfab1aec5783a1768d784875fb73a603    
  
author   : Michael Paquier <michael@paquier.xyz>    
date     : Wed, 22 Jul 2020 14:53:26 +0900    
  
committer: Michael Paquier <michael@paquier.xyz>    
date     : Wed, 22 Jul 2020 14:53:26 +0900    

A compressed stream may end with an empty packet, and PGP decompression  
finished before reading this empty packet in the remaining stream.  This  
caused a failure in pgcrypto, handling this case as corrupted data.  
This commit makes sure to consume such extra data, avoiding a failure  
when decompression the entire stream.  This corner case was reproducible  
with a data length of 16kB, and existed since its introduction in  
e94dd6a.  A cheap regression test is added to cover this case.  
  
Thanks to Jeff Janes for the extra investigation.  
  
Reported-by: Frank Gagnepain  
Author: Kyotaro Horiguchi, Michael Paquier  
Discussion: https://postgr.es/m/16476-692ef7b84e5fb893@postgresql.org  
Backpatch-through: 9.5  

commit   : 045d03fcaf208d45d509f0b0e6613c523d03cd2b    
  
author   : Michael Paquier <michael@paquier.xyz>    
date     : Sat, 18 Jul 2020 22:44:04 +0900    
  
committer: Michael Paquier <michael@paquier.xyz>    
date     : Sat, 18 Jul 2020 22:44:04 +0900    

This updates some URLs that are redirections, mostly to an equivalent  
using https.  One URL referring to generalized partial indexes was  
outdated.  
  
Author: Kyotaro Horiguchi  
Discussion: https://postgr.es/m/20200717.121308.1369606287593685396.horikyota.ntt@gmail.com  
Backpatch-through: 9.5  

commit   : ca5588acc3775193bd439e0c9a311cda4eff0edb    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Fri, 17 Jul 2020 11:03:55 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Fri, 17 Jul 2020 11:03:55 -0400    

We had two occurrences of "Mitteleuropäische Zeit" in Europe.txt,  
though the corresponding entries in Default were spelled  
"Mitteleuropaeische Zeit".  Standardize on the latter spelling to  
avoid questions of which encoding to use.  
  
While here, correct a couple of other trivial inconsistencies between  
the Default file and the supposedly-matching entries in the *.txt  
files, as exposed by some checking with comm(1).  Also, add BDST to  
the Europe.txt file; it previously was only listed in Default.  
None of this has any direct functional effect.  
  
Per complaint from Christoph Berg.  As usual for timezone data patches,  
apply to all branches.  
  
Discussion: https://postgr.es/m/20200716100743.GE3534683@msg.df7cb.de  

commit   : ab7ce97ece5729726b8fe4b4c0b695614b76937e    
  
author   : Michael Paquier <michael@paquier.xyz>    
date     : Thu, 16 Jul 2020 15:53:12 +0900    
  
committer: Michael Paquier <michael@paquier.xyz>    
date     : Thu, 16 Jul 2020 15:53:12 +0900    

pg_test_fsync has always opened files using the text mode on Windows, as  
this is the default mode used if not enforced by _setmode().  
  
This fixes a failure when running pg_test_fsync down to 12 because  
O_DSYNC and the text mode are not able to work together nicely.  We  
fixed the handling of O_DSYNC in 12~ for the tool by switching to the  
concurrent-safe version of fopen() in src/port/ with 0ba06e0.  And  
40cfe86, by enforcing the text mode for compatibility reasons if O_TEXT  
or O_BINARY are not specified by the caller, broke pg_test_fsync.  For  
all versions, this avoids any translation overhead, and pg_test_fsync  
should test binary writes, so it is a gain in all cases.  
  
Note that O_DSYNC is still not handled correctly in ~11, leading to  
pg_test_fsync to show insanely high numbers for open_datasync() (using  
this property it is easy to notice that the binary mode is much  
faster).  This would require a backpatch of 0ba06e0 and 40cfe86, which  
could potentially break existing applications, so this is left out.  
  
There are no TAP tests for this tool yet, so I have checked all builds  
manually using MSVC.  We could invent a new option to run a single  
transaction instead of using a duration of 1s to make the tests a  
maximum short, but this is left as future work.  
  
Thanks to Bruce Momjian for the discussion.  
  
Reported-by: Jeff Janes  
Author: Michael Paquier  
Discussion: https://postgr.es/m/16526-279ded30a230d275@postgresql.org  
Backpatch-through: 9.5  

commit   : d61dcccaf92618b06b232c1436c0fae3205aba98    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Wed, 15 Jul 2020 22:05:13 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Wed, 15 Jul 2020 22:05:13 -0400    

This commit back-patches the v12-era commits a73d08319, cc92cca43,  
and 7570df0f3 into supported pre-v12 branches.  The net effect is to  
eliminate our former dependency on the never-standard sys_siglist[]  
array, instead using POSIX-standard strsignal(3).  
  
What motivates doing this now is that glibc just removed sys_siglist[]  
from the set of symbols available to newly-built programs.  While our  
code can survive without sys_siglist[], it then fails to print any  
description of the signal that killed a child process, which is a  
non-negligible loss of friendliness.  We can expect that people will  
be wanting to build the back branches on platforms that include this  
change, so we need to do something.  
  
Since strsignal(3) has existed for quite a long time, and we've not  
had any trouble with these patches so far in v12, it seems safe to  
back-patch into older branches.  
  
Discussion: https://postgr.es/m/3179114.1594853308@sss.pgh.pa.us  

commit   : 18ec25412c08e6bdc42c0179a2b42d816d12fbbd    
  
author   : Michael Paquier <michael@paquier.xyz>    
date     : Wed, 15 Jul 2020 15:18:01 +0900    
  
committer: Michael Paquier <michael@paquier.xyz>    
date     : Wed, 15 Jul 2020 15:18:01 +0900    

When working with an online source cluster, pg_rewind gets a list of all  
the files in the source data directory using a WITH RECURSIVE query,  
returning a NULL result for a file's metadata if it gets removed between  
the moment it is listed in a directory and the moment its metadata is  
obtained with pg_stat_file() (say a recycled WAL segment).  The query  
result was processed in such a way that for each tuple we checked only  
that the first file's metadata was NULL.  This could have two  
consequences, both resulting in a failure of the rewind:  
- If the first tuple referred to a removed file, all files from the  
source would be ignored.  
- Any file actually missing would not be considered as such.  
  
While on it, rework slightly the code so as no values are saved if we  
know that a file is going to be skipped.  
  
Issue introduced by b36805f, so backpatch down to 9.5.  
  
Author: Justin Pryzby, Michael Paquier  
Reviewed-by: Daniel Gustafsson, Masahiko Sawada  
Discussion: https://postgr.es/m/20200713061010.GC23581@telsasoft.com  
Backpatch-through: 9.5  

commit   : e20003fa0f8d35fa03bc60273e1cee4558f19e41    
  
author   : David Rowley <drowley@postgresql.org>    
date     : Tue, 14 Jul 2020 17:01:25 +1200    
  
committer: David Rowley <drowley@postgresql.org>    
date     : Tue, 14 Jul 2020 17:01:25 +1200    

An ALTER TABLE to validate a foreign key in which another subcommand  
already caused a pending table rewrite could fail due to ALTER TABLE  
attempting to validate the foreign key before the actual table rewrite  
takes place.  This situation could result in an error such as:  
  
ERROR:  could not read block 0 in file "base/nnnnn/nnnnn": read only 0 of 8192 bytes  
  
The failure here was due to the SPI call which validates the foreign key  
trying to access an index which is yet to be rebuilt.  
  
Similarly, we also incorrectly tried to validate CHECK constraints before  
the heap had been rewritten.  
  
The fix for both is to delay constraint validation until phase 3, after  
the table has been rewritten.  For CHECK constraints this means a slight  
behavioral change.  Previously ALTER TABLE VALIDATE CONSTRAINT on  
inheritance tables would be validated from the bottom up.  This was  
different from the order of evaluation when a new CHECK constraint was  
added.  The changes made here aligns the VALIDATE CONSTRAINT evaluation  
order for inheritance tables to be the same as ADD CONSTRAINT, which is  
generally top-down.  
  
Reported-by: Nazli Ugur Koyluoglu, using SQLancer  
Discussion: https://postgr.es/m/CAApHDvp%3DZXv8wiRyk_0rWr00skhGkt8vXDrHJYXRMft3TjkxCA%40mail.gmail.com  
Backpatch-through: 9.5 (all supported versions)  

commit   : 80d8f6d1d6338c335c84048e65e1203fada863b2    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Mon, 13 Jul 2020 20:38:21 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Mon, 13 Jul 2020 20:38:21 -0400    

The qual pushdown logic assumed that all Vars in a restriction clause  
must be Vars referencing subquery outputs; but since we introduced  
LATERAL, it's possible for such a Var to be a lateral reference instead.  
This led to an assertion failure in debug builds.  In a non-debug  
build, there might be no ill effects (if qual_is_pushdown_safe decided  
the qual was unsafe anyway), or we could get failures later due to  
construction of an invalid plan.  I've not gone to much length to  
characterize the possible failures, but at least segfaults in the  
executor have been observed.  
  
Given that this has been busted since 9.3 and it took this long for  
anybody to notice, I judge that the case isn't worth going to great  
lengths to optimize.  Hence, fix by just teaching qual_is_pushdown_safe  
that such quals are unsafe to push down, matching the previous behavior  
when it accidentally didn't fail.  
  
Per report from Tom Ellis.  Back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/20200713175124.GQ8220@cloudinit-builder  

commit   : db820b9a9d004213b7a372dc0ba2e014ce1d2a73    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Sat, 11 Jul 2020 13:36:51 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Sat, 11 Jul 2020 13:36:51 -0400    

Parallel pg_restore has always supposed that ACL items for different  
objects are independent and can be restored in parallel without  
conflicts.  However, there is one case where this fails: because  
REVOKE on a table is defined to also revoke the privilege(s) at  
column level, we can't restore per-column ACLs till after we restore  
any table-level privileges on their table.  Failure to honor this  
restriction can lead to "tuple concurrently updated" errors during  
parallel restore, or even to the per-column ACLs silently disappearing  
because the table-level REVOKE is executed afterwards.  
  
To fix, add a dependency from each column-level ACL item to its table's  
ACL item, if there is one.  Note that this doesn't fix the hazard  
for pre-existing archive files, only for ones made with a corrected  
pg_dump.  Given that the bug's been there quite awhile without  
field reports, I think this is acceptable.  
  
This requires changing the API of pg_dump's dumpACL() function.  
To keep its argument list from getting even longer, I removed the  
"CatalogId objCatId" argument, which has been unused for ages.  
  
Per report from Justin Pryzby.  Back-patch to all supported branches.  
  
Discussion: https://postgr.es/m/20200706050129.GW4107@telsasoft.com  

commit   : df1265087900c068489c47b4934f96f8f0f3ec59    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Fri, 10 Jul 2020 13:16:00 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Fri, 10 Jul 2020 13:16:00 -0400    

Re-point comp.ai.genetic FAQ link to a more stable address.  
  
Remove stale links to AIX documentation; we don't really need to  
tell AIX users how to use their systems.  
  
Remove stale links to HP documentation about SSL.  We've had to  
update those twice before, making it increasingly obvious that  
HP does not intend them to be stable landing points.  They're  
not particularly authoritative, either.  (This change effectively  
reverts bbd3bdba3.)  
  
Daniel Gustafsson and Álvaro Herrera, per a gripe from  
Kyotaro Horiguchi.  Back-patch, since these links are  
just as dead in the back branches.  
  
Discussion: https://postgr.es/m/20200709.161226.204639179120026914.horikyota.ntt@gmail.com  

commit   : d0390509a1823d5cb29ae3ed7cbbedf8684d3d6c    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Thu, 9 Jul 2020 17:38:52 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Thu, 9 Jul 2020 17:38:52 -0400    

Back-patch commits 91bdf499b and ffb4cee43, so that all branches  
agree on when and how to do Windows CRLF conversion.  
  
This should close the referenced thread.  Thanks to Andrew Dunstan  
for discussion/review.  
  
Discussion: https://postgr.es/m/412ae8da-76bb-640f-039a-f3513499e53d@gmx.net  

commit   : e3ed833e0c566c106b00b9a0728bc2cb1db8161a    
  
author   : Michael Paquier <michael@paquier.xyz>    
date     : Sun, 5 Jul 2020 19:36:40 +0900    
  
committer: Michael Paquier <michael@paquier.xyz>    
date     : Sun, 5 Jul 2020 19:36:40 +0900    

This error has survived for 22 years, and has been introduced by  
da63386.  
  
Reported-by: Erwin Brandstetter  
Discussion: https://postgr.es/m/CAGHENJ57wogGOvGXo5LgWYcqswxafLck8ELqHDR+zrkTPgs_OQ@mail.gmail.com  
Backpatch-through: 9.5  

commit   : d83d59e42d0ce2b2588b18d069aa13105d04447d    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Fri, 3 Jul 2020 19:01:22 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Fri, 3 Jul 2020 19:01:22 -0400    

After running GetForeignRelSize for a foreign table, adjust rel->tuples  
to be at least as large as rel->rows.  This prevents bizarre behavior  
in estimate_num_groups() and perhaps other places, especially in the  
scenario where rel->tuples is zero because pg_class.reltuples is  
(suggesting that ANALYZE has never been run for the table).  As things  
stood, we'd end up estimating one group out of any GROUP BY on such a  
table, whereas the default group-count estimate is more likely to result  
in a sane plan.  
  
Also, clarify in the documentation that GetForeignRelSize has the option  
to override the rel->tuples value if it has a better idea of what to use  
than what is in pg_class.reltuples.  
  
Per report from Jeff Janes.  Back-patch to all supported branches.  
  
Patch by me; thanks to Etsuro Fujita for review  
  
Discussion: https://postgr.es/m/CAMkU=1xNo9cnan+Npxgz0eK7394xmjmKg-QEm8wYG9P5-CcaqQ@mail.gmail.com  

commit   : 57e978a622f0d9ce0e1a1d22d3e04fc2901ef5d7    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Fri, 3 Jul 2020 17:01:35 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Fri, 3 Jul 2020 17:01:35 -0400    

Commit ecd9e9f0b fixed the problem in the wrong place, causing unwanted  
side-effects on the behavior of GetNextTempTableSpace().  Instead,  
let's make SharedFileSetInit() responsible for subbing in the value  
of MyDatabaseTableSpace when the default tablespace is called for.  
  
The convention about what is in the tempTableSpaces[] array is  
evidently insufficiently documented, so try to improve that.  
  
It also looks like SharedFileSetInit() is doing the wrong thing in the  
case where temp_tablespaces is empty.  It was hard-wiring use of the  
pg_default tablespace, but it seems like using MyDatabaseTableSpace  
is more consistent with what happens for other temp files.  
  
Back-patch the reversion of PrepareTempTablespaces()'s behavior to  
9.5, as ecd9e9f0b was.  The changes in SharedFileSetInit() go back  
to v11 where that was introduced.  (Note there is net zero code change  
before v11 from these two patch sets, so nothing to release-note.)  
  
Magnus Hagander and Tom Lane  
  
Discussion: https://postgr.es/m/CABUevExg5YEsOvqMxrjoNvb3ApVyH+9jggWGKwTDFyFCVWczGQ@mail.gmail.com  

commit   : 8ac0eb51f7bfc5f7c95f2cc2918b623e85899616    
  
author   : Magnus Hagander <magnus@hagander.net>    
date     : Fri, 3 Jul 2020 15:09:06 +0200    
  
committer: Magnus Hagander <magnus@hagander.net>    
date     : Fri, 3 Jul 2020 15:09:06 +0200    

A likely copy/paste error in 98e8b480532 from  back in 2004 would  
cause temp tablespace to be reset to InvalidOid if temp_tablespaces  
was set to the same value as the primary tablespace in the database.  
This would cause shared filesets (such as for parallel hash joins)  
to ignore them, putting the temporary files in the default tablespace  
instead of the configured one. The bug is in the old code, but it  
appears to have been exposed only once we had shared filesets.  
  
Reviewed-By: Daniel Gustafsson  
Discussion: https://postgr.es/m/CABUevExg5YEsOvqMxrjoNvb3ApVyH+9jggWGKwTDFyFCVWczGQ@mail.gmail.com  
Backpatch-through: 9.5  

commit   : d353a7633943e954537e5454a757d5c7901afd95    
  
author   : Bruce Momjian <bruce@momjian.us>    
date     : Tue, 30 Jun 2020 12:26:51 -0400    
  
committer: Bruce Momjian <bruce@momjian.us>    
date     : Tue, 30 Jun 2020 12:26:51 -0400    

In a few cases, the documented syntax specified storage parameter values  
as required.  
  
Reported-by: galiev_mr@taximaxim.ru  
  
Discussion: https://postgr.es/m/159283163235.684.4482737698910467437@wrigleys.postgresql.org  
  
Backpatch-through: 9.5  

commit   : 41c0166317988d1eb0d8d445ff14574a1cbc2c1a    
  
author   : Bruce Momjian <bruce@momjian.us>    
date     : Tue, 30 Jun 2020 11:55:52 -0400    
  
committer: Bruce Momjian <bruce@momjian.us>    
date     : Tue, 30 Jun 2020 11:55:52 -0400    

Previously it was specified to be only replica.  
  
Discussion: https://postgr.es/m/20200618180058.GK7349@momjian.us  
  
Backpatch-through: 9.5  

commit   : 51ff9ff786f6b04acfc0e949171eace8b4b59240    
  
author   : Noah Misch <noah@leadboat.com>    
date     : Sat, 27 Jun 2020 22:05:04 -0700    
  
committer: Noah Misch <noah@leadboat.com>    
date     : Sat, 27 Jun 2020 22:05:04 -0700    

Warnings start 10M transactions before xidStopLimit, which is 11M  
transactions before wraparound.  The sample WARNING output showed a  
value greater than 11M, and its HINT message predated commit  
25ec228ef760eb91c094cc3b6dea7257cc22ffb5.  Hence, the sample was  
impossible.  Back-patch to 9.5 (all supported versions).  

commit   : dd2bb77c72f4af9b6e546d02e35e84668a909950    
  
author   : Bruce Momjian <bruce@momjian.us>    
date     : Thu, 25 Jun 2020 18:33:28 -0400    
  
committer: Bruce Momjian <bruce@momjian.us>    
date     : Thu, 25 Jun 2020 18:33:28 -0400    

Reported-by: petermpallesen@gmail.com  
  
Discussion: https://postgr.es/m/159195294959.673.5752624528747900508@wrigleys.postgresql.org  
  
Backpatch-through: 9.5  

commit   : 6685470dc822993bdfb038780c2f8e564033973e    
  
author   : Bruce Momjian <bruce@momjian.us>    
date     : Thu, 25 Jun 2020 18:22:44 -0400    
  
committer: Bruce Momjian <bruce@momjian.us>    
date     : Thu, 25 Jun 2020 18:22:44 -0400    

That is, those database permissions set by GRANT.  
  
Diagnosed-by: Joseph Nahmias  
  
Discussion: https://postgr.es/m/20200614072613.GA21852@nahmias.net  
  
Backpatch-through: 9.5  

commit   : 0d7066bc7f2010a4998f073690ea1eed2525fb60    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Wed, 24 Jun 2020 15:47:30 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Wed, 24 Jun 2020 15:47:30 -0400    

I forgot that INT64_FORMAT can't be used with sscanf on Windows.  
Use the same trick of sscanf'ing into a temp variable as we do in  
some other places in zic.c.  
  
The upstream IANA code avoids the portability problem by relying on  
<inttypes.h>'s SCNdFAST64 macro.  Once we're requiring C99 in all  
branches, we should do likewise and drop this set of diffs from  
upstream.  For now, though, a hack seems fine, since we do not  
actually care about leapseconds anyway.  
  
Discussion: https://postgr.es/m/4e5d1a5b-143e-e70e-a99d-a3b01c1ae7c3@2ndquadrant.com  

commit   : dda25c599fcfcb3a3d21403492c47a091b8293da    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Mon, 22 Jun 2020 11:46:41 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Mon, 22 Jun 2020 11:46:41 -0400    

explain_get_index_name() applied quote_identifier() to the index name.  
This is fine for text output, but the non-text output formats all have  
their own quoting conventions and would much rather start from the  
actual index name.  For example in JSON you'd get something like  
  
       "Index Name": "\"My Index\"",  
  
which is surely not desirable, especially when the same does not  
happen for table names.  Hence, move the responsibility for applying  
quoting out to the callers, where it can go into already-existing  
special code paths for text format.  
  
This changes the API spec for users of explain_get_index_name_hook:  
before, they were supposed to apply quote_identifier() if necessary,  
now they should not.  Research suggests that the only publicly  
available user of the hook is hypopg, and it actually forgot to  
apply quoting anyway, so it's fine.  (In any case, there's no  
behavioral change for the output of a hook as seen in non-text  
EXPLAIN formats, so this won't break any case that programs should  
be relying on.)  
  
Digging in the commit logs, it appears that quoting was included in  
explain_get_index_name's duties when commit 604ffd280 invented it;  
and that was fine at the time because we only had text output format.  
This should have been rethought when non-text formats were invented,  
but it wasn't.  
  
This is a fairly clear bug for users of non-text EXPLAIN formats,  
so back-patch to all supported branches.  
  
Per bug #16502 from Maciek Sakrejda.  Patch by me (based on  
investigation by Euler Taveira); thanks to Julien Rouhaud for review.  
  
Discussion: https://postgr.es/m/16502-57bd1c9f913ed1d1@postgresql.org  

commit   : bbbce94dc262fa255ec53a9949f899369afdb4e7    
  
author   : Alvaro Herrera <alvherre@alvh.no-ip.org>    
date     : Fri, 19 Jun 2020 16:46:06 -0400    
  
committer: Alvaro Herrera <alvherre@alvh.no-ip.org>    
date     : Fri, 19 Jun 2020 16:46:06 -0400    

A few places calling fwrite and gzwrite were not setting errno to ENOSPC  
when reporting errors, as is customary; this led to some failures being  
reported as  
"could not write file: Success"  
which makes us look silly.  Make a few of these places in pg_dump and  
pg_basebackup use our customary pattern.  
  
Backpatch-to: 9.5  
Author: Justin Pryzby <pryzby@telsasoft.com>  
Author: Tom Lane <tgl@sss.pgh.pa.us>  
Author: Álvaro Herrera <alvherre@alvh.no-ip.org>  
Discussion: https://postgr.es/m/20200611153753.GU14879@telsasoft.com  

commit   : 34ef5863c77bb070a6faf136a06728961d6e2a72    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Fri, 19 Jun 2020 13:55:21 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Fri, 19 Jun 2020 13:55:21 -0400    

The IANA time zone folk have deprecated use of a "posixrules" file in  
the tz database.  While for now it's our choice whether to keep  
supplying one in our own builds, installations built with  
--with-system-tzdata will soon be needing to cope with that file not  
being present, at least on some platforms.  
  
This causes a problem for the horology test, which expected the  
nonstandard POSIX zone spec "CST7CDT" to apply pre-2007 US daylight  
savings rules.  That does happen if the posixrules file supplies such  
information, but otherwise the test produces undesired results.  
To fix, add an explicit transition date rule that matches 2005 practice.  
(We could alternatively have switched the test to use some real time  
zone, but it seems useful to have coverage of this type of zone spec.)  
  
While at it, update a documentation example that also relied on  
"CST7CDT"; use a real-world zone name instead.  Also, document why  
the zone names EST5EDT, CST6CDT, MST7MDT, PST8PDT aren't subject to  
similar failures when "posixrules" is missing.  
  
Back-patch to all supported branches, since the hazard is the same  
for all.  
  
Discussion: https://postgr.es/m/1665379.1592581287@sss.pgh.pa.us  

commit   : f7aefd5158ffea5f5c7b2828658287719d5163d3    
  
author   : Andres Freund <andres@anarazel.de>    
date     : Thu, 18 Jun 2020 15:12:09 -0700    
  
committer: Andres Freund <andres@anarazel.de>    
date     : Thu, 18 Jun 2020 15:12:09 -0700    

commit   : 3e69bf3b142be3f4205435ef3baabcae168c6a14    
  
author   : Andres Freund <andres@anarazel.de>    
date     : Mon, 8 Jun 2020 16:50:37 -0700    
  
committer: Andres Freund <andres@anarazel.de>    
date     : Mon, 8 Jun 2020 16:50:37 -0700    

This was a danger only for --disable-spinlocks in combination with  
atomic operations unsupported by the current platform.  
  
While atomics.c was careful to signal that a separate semaphore ought  
to be used when spinlock emulation is active, spin.c didn't actually  
implement that mechanism. That's my (Andres') fault, it seems to have  
gotten lost during the development of the atomic operations support.  
  
Fix that issue and add test for nesting atomic operations inside a  
spinlock.  
  
Author: Andres Freund  
Discussion: https://postgr.es/m/20200605023302.g6v3ydozy5txifji@alap3.anarazel.de  
Backpatch: 9.5-  

commit   : 7e91f90a8ed4af18f4d2a3cb1b657b4296e2e710    
  
author   : Andres Freund <andres@anarazel.de>    
date     : Mon, 8 Jun 2020 16:36:51 -0700    
  
committer: Andres Freund <andres@anarazel.de>    
date     : Mon, 8 Jun 2020 16:36:51 -0700    

As s_lock_test, the already existing test for spinlocks, isn't run in  
an automated fashion (and doesn't test a normal backend environment),  
adding tests that are run as part of a normal regression run is a good  
idea. Particularly in light of several recent and upcoming spinlock  
related fixes.  
  
Currently the new tests are run as part of the pre-existing  
test_atomic_ops() test. That perhaps can be quibbled about, but for  
now seems ok.  
  
The only operations that s_lock_test tests but the new tests don't are  
the detection of a stuck spinlock and S_LOCK_FREE (which is otherwise  
unused, not implemented on all platforms, and will be removed).  
  
This currently contains a test for more than INT_MAX spinlocks (only  
run with --disable-spinlocks), to ensure the recent commit fixing a  
bug with more than INT_MAX spinlock initializations is correct. That  
test is somewhat slow, so we might want to disable it after a few  
days.  
  
It might be worth retiring s_lock_test after this. The added coverage  
of a stuck spinlock probably isn't worth the added complexity?  
  
Author: Andres Freund  
Discussion: https://postgr.es/m/20200606023103.avzrctgv7476xj7i@alap3.anarazel.de  

commit   : 089a63ec80e084a5ca380cf2462b61160d115808    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Thu, 18 Jun 2020 16:27:18 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Thu, 18 Jun 2020 16:27:18 -0400    

We'd glossed over most of this complexity for years, but it's hard  
to avoid writing it all down now, so that we can explain what happens  
when there's no "posixrules" file in the IANA time zone database.  
That was at best a tiny minority situation till now, but it's likely  
to become quite common in the future, so we'd better explain it.  
  
Nonetheless, we don't really encourage people to use POSIX zone specs;  
picking a named zone is almost always what you really want, unless  
perhaps you're stuck with an out-of-date zone database.  Therefore,  
let's shove all this detail into an appendix.  
  
Patch by me; thanks to Robert Haas for help with some awkward wording.  
  
Discussion: https://postgr.es/m/1390.1562258309@sss.pgh.pa.us  

commit   : 745c1ebb6efa467f6d3f03beb41fa791296bc12f    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Wed, 17 Jun 2020 18:29:29 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Wed, 17 Jun 2020 18:29:29 -0400    

This absorbs a leap-second-related bug fix in localtime.c, and  
teaches zic to handle an expiration marker in the leapseconds file.  
Neither are of any interest to us (for the foreseeable future  
anyway), but we need to stay more or less in sync with upstream.  
  
Also adjust some over-eager changes in the README from commit 957338418.  
I have no intention of making changes that require C99 in this code,  
until such time as all the live back branches require C99.  Otherwise  
back-patching will get too exciting.  
  
For the same reason, absorb assorted whitespace and other cosmetic  
changes from HEAD into the back branches; mostly this reflects use of  
improved versions of pgindent.  
  
All in all then, quite a boring update.  But I figured I'd get it  
done while I was looking at this code.  

commit   : dcf3cb60cbefe6f752c8a1aac5e24d869fd5c52c    
  
author   : Andres Freund <andres@anarazel.de>    
date     : Mon, 8 Jun 2020 15:25:49 -0700    
  
committer: Andres Freund <andres@anarazel.de>    
date     : Mon, 8 Jun 2020 15:25:49 -0700    

Once the counter goes negative we ended up with spinlocks that errored  
out on first use (due to check in tas_sema).  
  
Author: Andres Freund  
Reviewed-By: Robert Haas  
Discussion: https://postgr.es/m/20200606023103.avzrctgv7476xj7i@alap3.anarazel.de  
Backpatch: 9.5-  

commit   : 4f01103d647b9b01fbd87fbfb9fcb52b6a01573a    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Tue, 16 Jun 2020 16:41:11 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Tue, 16 Jun 2020 16:41:11 -0400    

The synopsis for PGTYPESinterval_free() used the wrong name.  
  
Discussion: https://postgr.es/m/159231203030.679.3061023914894071953@wrigleys.postgresql.org  

commit   : 89020a92fb62fe09cd40d651ecbd4cd9912fd9d8    
  
author   : Thomas Munro <tmunro@postgresql.org>    
date     : Tue, 16 Jun 2020 13:50:56 +1200    
  
committer: Thomas Munro <tmunro@postgresql.org>    
date     : Tue, 16 Jun 2020 13:50:56 +1200    

Convert buffile.c error handling to use ereport.  This fixes cases where  
I/O errors were indistinguishable from EOF or not reported.  Also remove  
"%m" from error messages where errno would be bogus.  While we're  
modifying those strings, add block numbers and short read byte counts  
where appropriate.  
  
Back-patch to all supported releases.  
  
Reported-by: Amit Khandekar <amitdkhan.pg@gmail.com>  
Reviewed-by: Melanie Plageman <melanieplageman@gmail.com>  
Reviewed-by: Alvaro Herrera <alvherre@2ndquadrant.com>  
Reviewed-by: Robert Haas <robertmhaas@gmail.com>  
Reviewed-by: Ibrar Ahmed <ibrar.ahmad@gmail.com>  
Reviewed-by: Michael Paquier <michael@paquier.xyz>  
Discussion: https://postgr.es/m/CA%2BhUKGJE04G%3D8TLK0DLypT_27D9dR8F1RQgNp0jK6qR0tZGWOw%40mail.gmail.com  

commit   : 39c698cff8a004c0027ffeb8c97b754d08a9a544    
  
author   : Bruce Momjian <bruce@momjian.us>    
date     : Mon, 15 Jun 2020 20:59:40 -0400    
  
committer: Bruce Momjian <bruce@momjian.us>    
date     : Mon, 15 Jun 2020 20:59:40 -0400    

Non-zero vacuum_defer_cleanup_age values cause pg_upgrade freezing of  
the system catalogs to be incomplete, or do nothing.  This will cause  
the upgrade to fail in confusing ways.  
  
Reported-by: Laurenz Albe  
  
Discussion: https://postgr.es/m/7d6f6c22ba05ce0c526e9e8b7bfa8105e7da45e6.camel@cybertec.at  
  
Backpatch-through: 9.5  

commit   : 4c897197d7939d290781edae6bc53f91f5fcb09b    
  
author   : Thomas Munro <tmunro@postgresql.org>    
date     : Mon, 15 Jun 2020 11:33:13 +1200    
  
committer: Thomas Munro <tmunro@postgresql.org>    
date     : Mon, 15 Jun 2020 11:33:13 +1200    

Our documentation failed to point out that REPEATABLE READ is really  
snapshot isolation, which might be important to some users.  Point to  
the standard reference paper for this complicated topic.  
  
Likewise, add a reference to the VLDB paper about PostgreSQL SSI, for  
technical information about our SSI implementation and how it compares  
to S2PL.  
  
While here, add a note about catalog access using a lower isolation  
level, per recent user complaint.  
  
Back-patch to all releases.  
  
Reported-by: Kyle Kingsbury <aphyr@jepsen.io>  
Reviewed-by: Andres Freund <andres@anarazel.de>  
Reviewed-by: Peter Geoghegan <pg@bowt.ie>  
Reviewed-by: Tatsuo Ishii <ishii@sraoss.co.jp>  
Discussion: https://postgr.es/m/db7b729d-0226-d162-a126-8a8ab2dc4443%40jepsen.io  
Discussion: https://postgr.es/m/16454-9408996bb1750faf%40postgresql.org  

commit   : dede9a6ada00d4975240e5a60de220124d547a08    
  
author   : Bruce Momjian <bruce@momjian.us>    
date     : Thu, 11 Jun 2020 18:19:25 -0400    
  
committer: Bruce Momjian <bruce@momjian.us>    
date     : Thu, 11 Jun 2020 18:19:25 -0400    

xreflabels prevent references to the chapter numbers of sections id's.  
It should only be used in specific cases.  
  
Discussion: https://postgr.es/m/8315c0ca-7758-8823-fcb6-f37f9413e6b6@2ndquadrant.com  
  
Backpatch-through: 9.5  

commit   : c05f6b354ffe04550f41f7e36091a80b571258ee    
  
author   : Peter Geoghegan <pg@bowt.ie>    
date     : Thu, 11 Jun 2020 10:09:32 -0700    
  
committer: Peter Geoghegan <pg@bowt.ie>    
date     : Thu, 11 Jun 2020 10:09:32 -0700    

SSI's HeapCheckForSerializableConflictOut() test failed to correctly  
handle conditions involving a concurrently inserted tuple which is later  
concurrently updated by a separate transaction .  A SELECT statement  
that called HeapCheckForSerializableConflictOut() could end up using the  
same XID (updater's XID) for both the original tuple, and the successor  
tuple, missing the XID of the xact that created the original tuple  
entirely.  This only happened when neither tuple from the chain was  
visible to the transaction's MVCC snapshot.  
  
The observable symptoms of this bug were subtle.  A pair of transactions  
could commit, with the later transaction failing to observe the effects  
of the earlier transaction (because of the confusion created by the  
update to the non-visible row).  This bug dates all the way back to  
commit dafaa3ef, which added SSI.  
  
To fix, make sure that we check the xmin of concurrently inserted tuples  
that happen to also have been updated concurrently.  
  
Author: Peter Geoghegan  
Reported-By: Kyle Kingsbury  
Reviewed-By: Thomas Munro  
Discussion: https://postgr.es/m/db7b729d-0226-d162-a126-8a8ab2dc4443@jepsen.io  
Backpatch: All supported versions  

commit   : 3c419f5f5881fd378f40e93ee1ef0fc59bbe6cdc    
  
author   : Amit Kapila <akapila@postgresql.org>    
date     : Thu, 11 Jun 2020 14:10:43 +0530    
  
committer: Amit Kapila <akapila@postgresql.org>    
date     : Thu, 11 Jun 2020 14:10:43 +0530    

Reported-by: John Naylor  
Author: John Naylor  
Backpatch-through: 9.5  
Discussion: https://postgr.es/m/CACPNZCtRuvs6G+EYqejhVJgBq2AKeZdXRVJsbX4syhO9gn5SNQ@mail.gmail.com  

commit   : 3801532918eba64d26265bb6f137805fe3c7d2ab    
  
author   : Andres Freund <andres@anarazel.de>    
date     : Mon, 8 Jun 2020 19:52:19 -0700    
  
committer: Andres Freund <andres@anarazel.de>    
date     : Mon, 8 Jun 2020 19:52:19 -0700    

Previously we used pg_atomic_write_64_impl inside  
pg_atomic_init_u64. That works correctly, but on platforms without  
64bit single copy atomicity it could trigger spurious valgrind errors  
about uninitialized memory, because we use compare_and_swap for atomic  
writes on such platforms.  
  
I previously suppressed one instance of this problem (6c878edc1df),  
but as Tom reports that wasn't enough. As the atomic variable cannot  
yet be concurrently accessible during initialization, it seems better  
to have pg_atomic_init_64_impl set the value directly.  
  
Change pg_atomic_init_u32_impl for symmetry.  
  
Reported-By: Tom Lane  
Author: Andres Freund  
Discussion: https://postgr.es/m/1714601.1591503815@sss.pgh.pa.us  
Backpatch: 9.5-  

commit   : 09dc17486393563a680400908b33061ada5826f5    
  
author   : Thomas Munro <tmunro@postgresql.org>    
date     : Mon, 8 Jun 2020 13:57:24 +1200    
  
committer: Thomas Munro <tmunro@postgresql.org>    
date     : Mon, 8 Jun 2020 13:57:24 +1200    

The redo routines for XLOG_CHECKPOINT_{ONLINE,SHUTDOWN} must acquire  
ControlFileLock before modifying ControlFile->checkPointCopy, or the  
checkpointer could write out a control file with a bad checksum.  
  
Likewise, XLogReportParameters() must acquire ControlFileLock before  
modifying ControlFile and calling UpdateControlFile().  
  
Back-patch to all supported releases.  
  
Author: Nathan Bossart <bossartn@amazon.com>  
Author: Fujii Masao <masao.fujii@oss.nttdata.com>  
Reviewed-by: Fujii Masao <masao.fujii@oss.nttdata.com>  
Reviewed-by: Michael Paquier <michael@paquier.xyz>  
Reviewed-by: Thomas Munro <thomas.munro@gmail.com>  
Discussion: https://postgr.es/m/70BF24D6-DC51-443F-B55A-95735803842A%40amazon.com  

commit   : 696cb6d8f6be667af79a512db57ab0bad3248f42    
  
author   : Noah Misch <noah@leadboat.com>    
date     : Sun, 7 Jun 2020 16:27:13 -0700    
  
committer: Noah Misch <noah@leadboat.com>    
date     : Sun, 7 Jun 2020 16:27:13 -0700    

Commit 7be5d8df1f74b78620167d3abf32ee607e728919 surfaced the logic  
error, which had no functional implications, by adding "use warnings".  
The buildfarm always customizes PROVE_FLAGS, so the warning did not  
appear there.  Back-patch to 9.5 (all supported versions).  

commit   : 109387075c36ecfb84e522ecd213f69d30af61c1    
  
author   : Noah Misch <noah@leadboat.com>    
date     : Fri, 5 Jun 2020 20:10:53 -0700    
  
committer: Noah Misch <noah@leadboat.com>    
date     : Fri, 5 Jun 2020 20:10:53 -0700    

Back-patch to 9.5, where commit 4f700bcd20c087f60346cb8aefd0e269be8e2157  
first appeared.  
  
Reviewed by Tom Lane.  Reported by Andrew Dunstan.  
  
Discussion: https://postgr.es/m/4dfabec2-a3ad-0546-2d62-f816c97edd0c@2ndQuadrant.com  

commit   : 4a9809e34d091881fd8bf6b72ded44eb50693b8d    
  
author   : Michael Paquier <michael@paquier.xyz>    
date     : Thu, 4 Jun 2020 10:18:27 +0900    
  
committer: Michael Paquier <michael@paquier.xyz>    
date     : Thu, 4 Jun 2020 10:18:27 +0900    

This broke the project rule to not call any complex code while a  
spinlock is held.  Issue introduced by b89e151.  
  
Discussion: https://postgr.es/m/20200602.161518.1399689010416646074.horikyota.ntt@gmail.com  
Backpatch-through: 9.5  

commit   : a8c6eb5b4c4cf3470159a0b4b3fd2f2942b7909b    
  
author   : Michael Paquier <michael@paquier.xyz>    
date     : Mon, 1 Jun 2020 14:41:46 +0900    
  
committer: Michael Paquier <michael@paquier.xyz>    
date     : Mon, 1 Jun 2020 14:41:46 +0900    

This issue has been present since the introduction of this code as of  
a3519a2 from 2002, and has been found by buildfarm member prion that  
uses RELCACHE_FORCE_RELEASE via the tests introduced recently in  
e786be5.  
  
Discussion: https://postgr.es/m/20200601022055.GB4121@paquier.xyz  
Backpatch-through: 9.5  

commit   : bb45c5de2750f8aa5ab501aa327ababafed890d2    
  
author   : Andrew Dunstan <andrew@dunslane.net>    
date     : Sun, 31 May 2020 18:33:00 -0400    
  
committer: Andrew Dunstan <andrew@dunslane.net>    
date     : Sun, 31 May 2020 18:33:00 -0400    

Also add a top-level install-tests target.  
  
Backpatch to all live branches.  
  
Craig Ringer, tweaked by me.  

commit   : f140d9b6e0aff91e07b7dd80cf0915bb19f02a9c    
  
author   : Joe Conway <mail@joeconway.com>    
date     : Thu, 28 May 2020 13:45:15 -0400    
  
committer: Joe Conway <mail@joeconway.com>    
date     : Thu, 28 May 2020 13:45:15 -0400    

Two of the members of rconn were left uninitialized. When  
dblink_open() is called without an outer transaction it  
handles the initialization for us, but with an outer  
transaction it does not. Arrange for initialization  
in all cases. Backpatch to all supported versions.  
  
Reported-by: Alexander Lakhin  
Discussion: https://www.postgresql.org/message-id/flat/9bd0744f-5f04-c778-c5b3-809efe9c30c7%40joeconway.com#c545909a41664991aca60c4d70a10ce7  

commit   : bfb9595a786e62359d0a2c1613f4acdd3e1b88e6    
  
author   : Joe Conway <mail@joeconway.com>    
date     : Thu, 28 May 2020 13:17:28 -0400    
  
committer: Joe Conway <mail@joeconway.com>    
date     : Thu, 28 May 2020 13:17:28 -0400    

The repeat() function loops for potentially a long time without  
ever checking for interrupts. This prevents, for example, a query  
cancel from interrupting until the work is all done. Fix by  
inserting a CHECK_FOR_INTERRUPTS() into the loop.  
  
Backpatch to all supported versions.  
  
Discussion: https://www.postgresql.org/message-id/flat/8692553c-7fe8-17d9-cbc1-7cddb758f4c6%40joeconway.com  

commit   : c893b99360a6c264aa5ece6e5f6c6fd96bd0b817    
  
author   : Noah Misch <noah@leadboat.com>    
date     : Mon, 25 May 2020 16:21:04 -0700    
  
committer: Noah Misch <noah@leadboat.com>    
date     : Mon, 25 May 2020 16:21:04 -0700    

The target failed, tested $PATH binaries, or tested a stale temporary  
installation.  Commit c66b438db62748000700c9b90b585e756dd54141 missed  
this.  Back-patch to 9.5 (all supported versions).  

commit   : 22fc8d1cfc8ced0722ac0dfe417ce4602a272ebc    
  
author   : Bruce Momjian <bruce@momjian.us>    
date     : Thu, 21 May 2020 20:28:38 -0400    
  
committer: Bruce Momjian <bruce@momjian.us>    
date     : Thu, 21 May 2020 20:28:38 -0400    

Reported-by: yigong hu  
  
Discussion: https://postgr.es/m/CAOxFffcourucFqSk+tZA13ErS3XRYkDy6EeaPff4AvHGiEEuug@mail.gmail.com  
  
Backpatch-through: 9.5  

commit   : c7c0db90c29c8cad31dc0aeb9131acac3d048dee    
  
author   : Bruce Momjian <bruce@momjian.us>    
date     : Thu, 21 May 2020 19:49:30 -0400    
  
committer: Bruce Momjian <bruce@momjian.us>    
date     : Thu, 21 May 2020 19:49:30 -0400    

Discussion: https://postgr.es/m/2304.1586532634@sss.pgh.pa.us  
  
Backpatch-through: 9.5  

commit   : 8de137017a158185b0dd022231aeb5ac2daede6b    
  
author   : Michael Paquier <michael@paquier.xyz>    
date     : Thu, 21 May 2020 14:41:43 +0900    
  
committer: Michael Paquier <michael@paquier.xyz>    
date     : Thu, 21 May 2020 14:41:43 +0900    

When installing binaries and libraries using the MSVC installation  
routines, the operation gets done after moving to the root folder, whose  
location is detected by checking if "configure" exists two times in a  
row.  So, calling the installation script from src/tools/msvc/ with an  
extra "configure" file four levels up the root path of the code tree  
causes the execution to go further up, leading to a failure in finding  
the builds.  This commit fixes the issue by moving to the root folder of  
the code tree only once, when necessary.  
  
Author: Arnold Müller  
Reviewed-by: Daniel Gustafsson  
Discussion: https://postgr.es/m/16343-f638f67e7e52b86c@postgresql.org  
Backpatch-through: 9.5  

commit   : 781b6a3ea7eaadf8813ad86b5842a8148b01bbd9    
  
author   : Michael Paquier <michael@paquier.xyz>    
date     : Wed, 20 May 2020 14:22:03 +0900    
  
committer: Michael Paquier <michael@paquier.xyz>    
date     : Wed, 20 May 2020 14:22:03 +0900    

The description missed a comma and lacked an explanation of what happens  
with REPLICA IDENTITY USING INDEX when the dependent index is dropped.  
  
Author: Marina Polyakova  
Reviewed-by: Daniel Gustafsson, Michael Paquier  
Discussion: https://postgr.es/m/ad1a0badc32658b1bbb07aa312346a1d@postgrespro.ru  
Backpatch-through: 9.5  

commit   : 7e6674e436b7070216813ca46d367400c0297a1c    
  
author   : Amit Kapila <akapila@postgresql.org>    
date     : Mon, 18 May 2020 08:40:32 +0530    
  
committer: Amit Kapila <akapila@postgresql.org>    
date     : Mon, 18 May 2020 08:40:32 +0530    

Reported-by: Sawada Masahiko  
Author: Sawada Masahiko  
Reviewed-by: Amit Kapila  
Backpatch-through: 9.5  
Discussion: https://postgr.es/m/CA+fd4k4Ws7M7YQ8PqSym5WB1y75dZeBTd1sZJUQdfe0KJQ-iSA@mail.gmail.com  

commit   : b3e71f5255eb689a91309562bfc5f9df3f1de15d    
  
author   : Tom Lane <tgl@sss.pgh.pa.us>    
date     : Fri, 15 May 2020 19:05:40 -0400    
  
committer: Tom Lane <tgl@sss.pgh.pa.us>    
date     : Fri, 15 May 2020 19:05:40 -0400    

The previous coding zeroed out offsetof(ReplicationStateCtl, states)  
more bytes than it was entitled to, as a consequence of starting the  
zeroing from the wrong pointer (or, if you prefer, using the wrong  
calculation of how much to zero).  
  
It's unsurprising that this has not caused any reported problems,  
since it can be expected that the newly-allocated block is at the end  
of what we've used in shared memory, and we always make the shmem  
block substantially bigger than minimally necessary.  Nonetheless,  
this is wrong and it could bite us someday; plus it's a dangerous  
model for somebody to copy.  
  
This dates back to the introduction of this code (commit 5aa235042),  
so back-patch to all supported branches.  

commit   : 0a319699d59c26538bd78742cdfc3817509d82bf    
  
author   : Alvaro Herrera <alvherre@alvh.no-ip.org>    
date     : Fri, 15 May 2020 16:50:34 -0400    
  
committer: Alvaro Herrera <alvherre@alvh.no-ip.org>    
date     : Fri, 15 May 2020 16:50:34 -0400    

_bt_killitems marks btree items dead when a scan leaves the page where  
they live, but it does so with only share lock (to improve concurrency).  
This was historicall okay, since killing a dead item has no  
consequences.  However, with the advent of data checksums and  
wal_log_hints, this action incurs a WAL full-page-image record of the  
page.  Multiple concurrent processes would write the same page several  
times, leading to WAL bloat.  The probability of this happening can be  
reduced by only killing items if they're not already dead, so change the  
code to do that.  
  
The problem could eliminated completely by having _bt_killitems upgrade  
to exclusive lock upon seeing a killable item, but that would reduce  
concurrency so it's considered a cure worse than the disease.  
  
Backpatch all the way back to 9.5, since wal_log_hints was introduced in  
9.4.  
  
Author: Masahiko Sawada <masahiko.sawada@2ndquadrant.com>  
Discussion: https://postgr.es/m/CA+fd4k6PeRj2CkzapWNrERkja5G0-6D-YQiKfbukJV+qZGFZ_Q@mail.gmail.com  

commit   : 87ca0f94d6ea27cc8db83cab8e7bb652ef383168    
  
author   : Bruce Momjian <bruce@momjian.us>    
date     : Fri, 15 May 2020 12:38:39 -0400    
  
committer: Bruce Momjian <bruce@momjian.us>    
date     : Fri, 15 May 2020 12:38:39 -0400    

This is for use by the PG 13 release notes, but might be used for minor  
release notes in the future.  
  
Backpatch-through: 9.5  

commit   : c2dff5035cadd232c0dde3924ac434a0218a7b8f    
  
author   : Bruce Momjian <bruce@momjian.us>    
date     : Fri, 15 May 2020 12:05:42 -0400    
  
committer: Bruce Momjian <bruce@momjian.us>    
date     : Fri, 15 May 2020 12:05:42 -0400    

Add missing xreflabels for index types, geqo, libpq, spi, server-side  
languages, ecpg, and vaacuumlo.  
  
Backpatch-through: 9.5  

commit   : 6e00b43fb822ee22fca344b6f92d7a81b85bd4fb    
  
author   : Bruce Momjian <bruce@momjian.us>    
date     : Fri, 15 May 2020 09:55:42 -0400    
  
committer: Bruce Momjian <bruce@momjian.us>    
date     : Fri, 15 May 2020 09:55:42 -0400    

Backpatch-through: 9.5  

commit   : ca5381dae7235ff73e3f6347af004ac9c901e5d2    
  
author   : Bruce Momjian <bruce@momjian.us>    
date     : Fri, 15 May 2020 08:52:24 -0400    
  
committer: Bruce Momjian <bruce@momjian.us>    
date     : Fri, 15 May 2020 08:52:24 -0400    

commit   : 650952aebbc8118f4d73bc519e9ecc82b0e0ce04    
  
author   : Amit Kapila <akapila@postgresql.org>    
date     : Thu, 14 May 2020 09:55:04 +0530    
  
committer: Amit Kapila <akapila@postgresql.org>    
date     : Thu, 14 May 2020 09:55:04 +0530    

Visual Studio 2015 and later versions should still be able to do the same  
as Visual Studio 2012, but the declaration of locale_name is missing in  
_locale_t, causing the code compilation to fail, hence this falls back  
instead on to enumerating all system locales by using EnumSystemLocalesEx  
to find the required locale name.  If the input argument is in Unix-style  
then we can get ISO Locale name directly by using GetLocaleInfoEx() with  
LCType as LOCALE_SNAME.  
  
In passing, change the documentation references of the now obsolete links.  
  
Note that this problem occurs only with NLS enabled builds.  
  
Author: Juan José Santamaría Flecha, Davinder Singh and Amit Kapila  
Reviewed-by: Ranier Vilela and Amit Kapila  
Backpatch-through: 9.5  
Discussion: https://postgr.es/m/CAHzhFSFoJEWezR96um4-rg5W6m2Rj9Ud2CNZvV4NWc9tXV7aXQ@mail.gmail.com  

commit   : 595b4115c91fb7cd217d2ed4460a397673baeaac    
  
author   : Noah Misch <noah@leadboat.com>    
date     : Wed, 13 May 2020 20:42:09 -0700    
  
committer: Noah Misch <noah@leadboat.com>    
date     : Wed, 13 May 2020 20:42:09 -0700    

The defect suppressed a Standby Status Update message when bytes flushed  
to disk had changed but bytes received had not changed.  If  
pg_recvlogical then exited with no intervening Standby Status Update,  
the next pg_recvlogical repeated already-flushed records.  The defect  
could also cause superfluous messages, which are functionally harmless.  
Back-patch to 9.5 (all supported versions).  
  
Discussion: https://postgr.es/m/20200502221647.GA3941274@rfd.leadboat.com