E.73. Release 9.2.2

Fix multiple bugs associated with CREATE/DROP INDEX CONCURRENTLY (Andres Freund, Tom Lane, Simon Riggs, Pavan Deolasee)

An error introduced while adding DROP INDEX CONCURRENTLY allowed incorrect indexing decisions to be made during the initial phase of CREATE INDEX CONCURRENTLY; so that indexes built by that command could be corrupt. It is recommended that indexes built in 9.2.X with CREATE INDEX CONCURRENTLY be rebuilt after applying this update.

In addition, fix CREATE/DROP INDEX CONCURRENTLY to use in-place updates when changing the state of an index's pg_index row. This prevents race conditions that could cause concurrent sessions to miss updating the target index, thus again resulting in corrupt concurrently-created indexes.

Also, fix various other operations to ensure that they ignore invalid indexes resulting from a failed CREATE INDEX CONCURRENTLY command. The most important of these is VACUUM, because an auto-vacuum could easily be launched on the table before corrective action can be taken to fix or remove the invalid index.

Also fix DROP INDEX CONCURRENTLY to not disable insertions into the target index until all queries using it are done.

Also fix misbehavior if DROP INDEX CONCURRENTLY is canceled: the previous coding could leave an un-droppable index behind.

Correct predicate locking for DROP INDEX CONCURRENTLY (Kevin Grittner)

Previously, SSI predicate locks were processed at the wrong time, possibly leading to incorrect behavior of serializable transactions executing in parallel with the DROP.

Fix buffer locking during WAL replay (Tom Lane)

The WAL replay code was insufficiently careful about locking buffers when replaying WAL records that affect more than one page. This could result in hot standby queries transiently seeing inconsistent states, resulting in wrong answers or unexpected failures.

Fix an error in WAL generation logic for GIN indexes (Tom Lane)

This could result in index corruption, if a torn-page failure occurred.

Fix an error in WAL replay logic for SP-GiST indexes (Tom Lane)

This could result in index corruption after a crash, or on a standby server.

Fix incorrect detection of end-of-base-backup location during WAL recovery (Heikki Linnakangas)

This mistake allowed hot standby mode to start up before the database reaches a consistent state.

Properly remove startup process's virtual XID lock when promoting a hot standby server to normal running (Simon Riggs)

This oversight could prevent subsequent execution of certain operations such as CREATE INDEX CONCURRENTLY.

Avoid bogus « out-of-sequence timeline ID » errors in standby mode (Heikki Linnakangas)

Prevent the postmaster from launching new child processes after it's received a shutdown signal (Tom Lane)

This mistake could result in shutdown taking longer than it should, or even never completing at all without additional user action.

Fix the syslogger process to not fail when log_rotation_age exceeds 2^31 milliseconds (about 25 days) (Tom Lane)

Fix WaitLatch() to return promptly when the requested timeout expires (Jeff Janes, Tom Lane)

With the previous coding, a steady stream of non-wait-terminating interrupts could delay return from WaitLatch() indefinitely. This has been shown to be a problem for the autovacuum launcher process, and might cause trouble elsewhere as well.

Avoid corruption of internal hash tables when out of memory (Hitoshi Harada)

Prevent file descriptors for dropped tables from being held open past transaction end (Tom Lane)

This should reduce problems with long-since-dropped tables continuing to occupy disk space.

Prevent database-wide crash and restart when a new child process is unable to create a pipe for its latch (Tom Lane)

Although the new process must fail, there is no good reason to force a database-wide restart, so avoid that. This improves robustness when the kernel is nearly out of file descriptors.

Avoid planner crash with joins to unflattened subqueries (Tom Lane)

Fix planning of non-strict equivalence clauses above outer joins (Tom Lane)

The planner could derive incorrect constraints from a clause equating a non-strict construct to something else, for example WHERE COALESCE(foo, 0) = 0 when foo is coming from the nullable side of an outer join. 9.2 showed this type of error in more cases than previous releases, but the basic bug has been there for a long time.

Fix SELECT DISTINCT with index-optimized MIN/MAX on an inheritance tree (Tom Lane)

The planner would fail with « failed to re-find MinMaxAggInfo record » given this combination of factors.

Make sure the planner sees implicit and explicit casts as equivalent for all purposes, except in the minority of cases where there's actually a semantic difference (Tom Lane)

Include join clauses when considering whether partial indexes can be used for a query (Tom Lane)

A strict join clause can be sufficient to establish an x IS NOT NULL predicate, for example. This fixes a planner regression in 9.2, since previous versions could make comparable deductions.

Limit growth of planning time when there are many indexable join clauses for the same index (Tom Lane)

Improve planner's ability to prove exclusion constraints from equivalence classes (Tom Lane)

Fix partial-row matching in hashed subplans to handle cross-type cases correctly (Tom Lane)

This affects multicolumn NOT IN subplans, such as WHERE (a, b) NOT IN (SELECT x, y FROM ...) when for instance b and y are int4 and int8 respectively. This mistake led to wrong answers or crashes depending on the specific datatypes involved.

Fix btree mark/restore functions to handle array keys (Tom Lane)

This oversight could result in wrong answers from merge joins whose inner side is an index scan using an indexed_column = ANY(array) condition.

Revert patch for taking fewer snapshots (Tom Lane)

The 9.2 change to reduce the number of snapshots taken during query execution led to some anomalous behaviors not seen in previous releases, because execution would proceed with a snapshot acquired before locking the tables used by the query. Thus, for example, a query would not be guaranteed to see updates committed by a preceding transaction even if that transaction had exclusive lock. We'll probably revisit this in future releases, but meanwhile put it back the way it was before 9.2.

Acquire buffer lock when re-fetching the old tuple for an AFTER ROW UPDATE/DELETE trigger (Andres Freund)

In very unusual circumstances, this oversight could result in passing incorrect data to a trigger WHEN condition, or to the precheck logic for a foreign-key enforcement trigger. That could result in a crash, or in an incorrect decision about whether to fire the trigger.

Fix ALTER COLUMN TYPE to handle inherited check constraints properly (Pavan Deolasee)

This worked correctly in pre-8.4 releases, and now works correctly in 8.4 and later.

Fix ALTER EXTENSION SET SCHEMA's failure to move some subsidiary objects into the new schema (Álvaro Herrera, Dimitri Fontaine)

Handle CREATE TABLE AS EXECUTE correctly in extended query protocol (Tom Lane)

Don't modify the input parse tree in DROP RULE IF NOT EXISTS and DROP TRIGGER IF NOT EXISTS (Tom Lane)

This mistake would cause errors if a cached statement of one of these types was re-executed.

Fix REASSIGN OWNED to handle grants on tablespaces (Álvaro Herrera)

Ignore incorrect pg_attribute entries for system columns for views (Tom Lane)

Views do not have any system columns. However, we forgot to remove such entries when converting a table to a view. That's fixed properly for 9.3 and later, but in previous branches we need to defend against existing mis-converted views.

Fix rule printing to dump INSERT INTO table DEFAULT VALUES correctly (Tom Lane)

Guard against stack overflow when there are too many UNION/INTERSECT/EXCEPT clauses in a query (Tom Lane)

Prevent platform-dependent failures when dividing the minimum possible integer value by -1 (Xi Wang, Tom Lane)

Fix possible access past end of string in date parsing (Hitoshi Harada)

Fix failure to advance XID epoch if XID wraparound happens during a checkpoint and wal_level is hot_standby (Tom Lane, Andres Freund)

While this mistake had no particular impact on PostgreSQL™ itself, it was bad for applications that rely on txid_current() and related functions: the TXID value would appear to go backwards.

Fix pg_terminate_backend() and pg_cancel_backend() to not throw error for a non-existent target process (Josh Kupershmidt)

This case already worked as intended when called by a superuser, but not so much when called by ordinary users.

Fix display of pg_stat_replication.sync_state at a page boundary (Kyotaro Horiguchi)

Produce an understandable error message if the length of the path name for a Unix-domain socket exceeds the platform-specific limit (Tom Lane, Andrew Dunstan)

Formerly, this would result in something quite unhelpful, such as « Non-recoverable failure in name resolution ».

Fix memory leaks when sending composite column values to the client (Tom Lane)

Save some cycles by not searching for subtransaction locks at commit (Simon Riggs)

In a transaction holding many exclusive locks, this useless activity could be quite costly.

Make pg_ctl more robust about reading the postmaster.pid file (Heikki Linnakangas)

This fixes race conditions and possible file descriptor leakage.

Fix possible crash in psql if incorrectly-encoded data is presented and the client_encoding setting is a client-only encoding, such as SJIS (Jiang Guiqing)

Make pg_dump dump SEQUENCE SET items in the data not pre-data section of the archive (Tom Lane)

This fixes an undesirable inconsistency between the meanings of --data-only and --section=data, and also fixes dumping of sequences that are marked as extension configuration tables.

Fix pg_dump's handling of DROP DATABASE commands in --clean mode (Guillaume Lelarge)

Beginning in 9.2.0, pg_dump --clean would issue a DROP DATABASE command, which was either useless or dangerous depending on the usage scenario. It no longer does that. This change also fixes the combination of --clean and --create to work sensibly, i.e., emit DROP DATABASE then CREATE DATABASE before reconnecting to the target database.

Fix pg_dump for views with circular dependencies and no relation options (Tom Lane)

The previous fix to dump relation options when a view is involved in a circular dependency didn't work right for the case that the view has no options; it emitted ALTER VIEW foo SET () which is invalid syntax.

Fix bugs in the restore.sql script emitted by pg_dump in tar output format (Tom Lane)

The script would fail outright on tables whose names include upper-case characters. Also, make the script capable of restoring data in --inserts mode as well as the regular COPY mode.

Fix pg_restore to accept POSIX-conformant tar files (Brian Weaver, Tom Lane)

The original coding of pg_dump's tar output mode produced files that are not fully conformant with the POSIX standard. This has been corrected for version 9.3. This patch updates previous branches so that they will accept both the incorrect and the corrected formats, in hopes of avoiding compatibility problems when 9.3 comes out.

Fix tar files emitted by pg_basebackup to be POSIX conformant (Brian Weaver, Tom Lane)

Fix pg_resetxlog to locate postmaster.pid correctly when given a relative path to the data directory (Tom Lane)

This mistake could lead to pg_resetxlog not noticing that there is an active postmaster using the data directory.

Fix libpq's lo_import() and lo_export() functions to report file I/O errors properly (Tom Lane)

Fix ecpg's processing of nested structure pointer variables (Muhammad Usama)

Fix ecpg's ecpg_get_data function to handle arrays properly (Michael Meskes)

Prevent pg_upgrade from trying to process TOAST tables for system catalogs (Bruce Momjian)

This fixes an error seen when the information_schema has been dropped and recreated. Other failures were also possible.

Improve pg_upgrade performance by setting synchronous_commit to off in the new cluster (Bruce Momjian)

Make contrib/pageinspect's btree page inspection functions take buffer locks while examining pages (Tom Lane)

Work around unportable behavior of malloc(0) and realloc(NULL, 0) (Tom Lane)

On platforms where these calls return NULL, some code mistakenly thought that meant out-of-memory. This is known to have broken pg_dump for databases containing no user-defined aggregates. There might be other cases as well.

Ensure that make install for an extension creates the extension installation directory (Cédric Villemain)

Previously, this step was missed if MODULEDIR was set in the extension's Makefile.

Fix pgxs support for building loadable modules on AIX (Tom Lane)

Building modules outside the original source tree didn't work on AIX.

Update time zone data files to tzdata release 2012j for DST law changes in Cuba, Israel, Jordan, Libya, Palestine, Western Samoa, and portions of Brazil.