PostgreSQL 10.6.1

# Changes
* Update hstore extension with JSON functionality
- Users who installed hstore prior to 9.3.1 must execute: ALTER EXTENSION hstore UPDATE; to add two new JSON functions and a cast.
* Fix memory leak when creating range indexes
* Serializable snapshot fixes
* Fix libpq SSL deadlock bug
* Fix timeline handling bugs in pg_receivexlog
* Prevent CREATE FUNCTION from checking SET variables unless function body checking is enabled
* Remove rare inaccurate warning during vacuum of index-less tables

# Major enhancements:
* Add materialized views
* Make simple views auto-updatable
* Add many features for the JSON data type, including operators and functions to extract elements from JSON values
* Implement SQL-standard LATERAL option for FROM-clause subqueries and function calls
* Allow foreign data wrappers to support writes (inserts/updates/deletes) on foreign tables
* Add a Postgres foreign data wrapper to allow access to other Postgres servers
* Add support for event triggers
* Add optional ability to checksum data pages and report corruption
* Prevent non-key-field row updates from blocking foreign key checks
* Greatly reduce System V shared memory requirements

# Changes
* Fix insecure parsing of server command-line switches
* Reset OpenSSL randomness state in each postmaster child process
* Make REPLICATION privilege checks test current user not authenticated user
* Fix GiST indexes to not use "fuzzy" geometric comparisons when it's not appropriate to do so (Alexander Korotkov)
* Fix erroneous range-union and penalty logic in GiST indexes that use contrib/btree_gist for variable-width data types, that is text, bytea, bit, and numeric columns
* Fix bugs in GiST page splitting code for multi-column indexes
* Fix gist_point_consistent to handle fuzziness consistently
* Fix buffer leak in WAL replay
* Ensure we do crash recovery before entering archive recovery, if the database was not stopped cleanly and a recovery.conf file is present
* Avoid deleting not-yet-archived WAL files during crash recovery
* Fix race condition in DELETE RETURNING
* Fix infinite-loop risk in regular expression compilation
* Fix potential null-pointer dereference in regular expression compilation
* Fix to_char() to use ASCII-only case-folding rules where appropriate
* Fix unwanted rejection of timestamp 1999-12-31 24:00:00
* Fix SQL-language functions to be safely usable as support functions for range types
* Fix logic error when a single transaction does UNLISTEN then LISTEN
* Fix possible planner crash after columns have been added to a view that's depended on by another view
* Fix performance issue in EXPLAIN (ANALYZE, TIMING OFF)
* Remove useless "picksplit doesn't support secondary split" log messages
* Remove vestigial secondary-split support in gist_box_picksplit()
* Fix possible failure to send a session's last few transaction commit/abort counts to the statistics collector
* Eliminate memory leaks in PL/Perl's spi_prepare() function
* Fix pg_dumpall to handle database names containing "=" correctly
* Avoid crash in pg_dump when an incorrect connection string is given
* Ignore invalid indexes in pg_dump and pg_upgrade
* In pg_basebackup, include only the current server version's subdirectory when backing up a tablespace
* Add a server version check in pg_basebackup and pg_receivexlog, so they fail cleanly with version combinations that won't work
* Fix contrib/dblink to handle inconsistent settings of DateStyle or IntervalStyle safely
* Fix contrib/pg_trgm's similarity() function to return zero for trigram-less strings
* Enable building PostgreSQL with Microsoft Visual Studio 2012
* Update time zone data files to tzdata release 2013b for DST law changes in Chile, Haiti, Morocco, Paraguay, and some Russian areas. Also, historical zone data corrections for numerous places.

# changes-

- Prevent execution of enum_recv from SQL (Tom Lane)
The function was misdeclared, allowing a simple SQL command to crash the server. In principle an attacker might be able to use it to examine the contents of server memory. Our thanks to Sumit Soni (via Secunia SVCRP) for reporting this issue. (CVE-2013-0255)
- Fix multiple problems in detection of when a consistent database state has been reached during WAL replay (Fujii Masao, Heikki Linnakangas, Simon Riggs, Andres Freund)
- Fix detection of end-of-backup point when no actual redo work is required (Heikki Linnakangas)
This mistake could result in incorrect "WAL ends before end of online backup" errors.
- Update minimum recovery point when truncating a relation file (Heikki Linnakangas)
Once data has been discarded, it's no longer safe to stop recovery at an earlier point in the timeline.
- Fix recycling of WAL segments after changing recovery target timeline (Heikki Linnakangas)
Properly restore timeline history files from archive on cascading standby servers (Heikki Linnakangas)
- Fix lock conflict detection on hot-standby servers (Andres Freund, Robert Haas)
- Fix missing cancellations in hot standby mode (Noah Misch, Simon Riggs)
The need to cancel conflicting hot-standby queries would sometimes be missed, allowing those queries to see inconsistent data.
- Prevent recovery pause feature from pausing before users can connect (Tom Lane)
- Fix SQL grammar to allow subscripting or field selection from a sub-SELECT result (Tom Lane)
- Fix performance problems with autovacuum truncation in busy workloads (Jan Wieck)
Truncation of empty pages at the end of a table requires exclusive lock, but autovacuum was coded to fail (and release the table lock) when there are conflicting lock requests. Under load, it is easily possible that truncation would never occur, resulting in table bloat. Fix by performing a partial truncation, releasing the lock, then attempting to re-acquire the lock and continue. This fix also greatly reduces the average time before autovacuum releases the lock after a conflicting request arrives.
- Improve performance of SPI_execute and related functions, thereby improving PL/pgSQL's EXECUTE (Heikki Linnakangas, Tom Lane)
Remove some data-copying overhead that was added in 9.2 as a consequence of revisions in the plan caching mechanism. This eliminates a performance regression compared to 9.1, and also saves memory, especially when the query string to be executed contains many SQL statements.
A side benefit is that multi-statement query strings are now processed fully serially, that is we complete execution of earlier statements before running parse analysis and planning on the following ones. This eliminates a long-standing issue, in that DDL that should affect the behavior of a later statement will now behave as expected.
- Restore pre-9.2 cost estimates for index usage (Tom Lane)
An ill-considered change of a fudge factor led to undesirably high cost estimates for use of very large indexes.
- Fix intermittent crash in DROP INDEX CONCURRENTLY (Tom Lane)
- Fix potential corruption of shared-memory lock table during CREATE/DROP INDEX CONCURRENTLY (Tom Lane)
- Fix COPY's multiple-tuple-insertion code for the case of a tuple larger than page size minus fillfactor (Heikki Linnakangas)
The previous coding could get into an infinite loop.
- Protect against race conditions when scanning pg_tablespace (Stephen Frost, Tom Lane)
CREATE DATABASE and DROP DATABASE could misbehave if there were concurrent updates of pg_tablespace entries.
- Prevent DROP OWNED from trying to drop whole databases or tablespaces (Álvaro Herrera)
For safety, ownership of these objects must be reassigned, not dropped.
- Fix error in vacuum_freeze_table_age implementation (Andres Freund)
The main consequence of this mistake is that lowering vacuum_freeze_min_age would cause full-table vacuuming scans to occur much more frequently than intended.
- Prevent misbehavior when a RowExpr or XmlExpr is parse-analyzed twice (Andres Freund, Tom Lane)
This mistake could be user-visible in contexts such as CREATE TABLE LIKE INCLUDING INDEXES.
- Improve defenses against integer overflow in hashtable sizing calculations (Jeff Davis)
- Fix some bugs associated with privileges on datatypes (Tom Lane)
- There were some issues with default privileges for types, and pg_dump failed to dump such privileges at all.
- Fix failure to ignore leftover temporary tables after a server crash (Tom Lane)
- Fix failure to rotate postmaster log files for size reasons on Windows (Jeff Janes, Heikki Linnakangas)
Reject out-of-range dates in to_date() (Hitoshi Harada)
- Fix pg_extension_config_dump() to handle extension-update cases properly (Tom Lane)
This function will now replace any existing entry for the target table, making it usable in extension update scripts.
- Fix PL/pgSQL's reporting of plan-time errors in possibly-simple expressions (Tom Lane)
The previous coding resulted in sometimes omitting the first line in the CONTEXT traceback for the error.
- Fix PL/Python's handling of functions used as triggers on multiple tables (Andres Freund)
- Ensure that non-ASCII prompt strings are translated to the correct code page on Windows (Alexander Law, Noah Misch)
This bug affected psql and some other client programs.
- Fix possible crash in psql's ? command when not connected to a database (Meng Qingzhong)
- Fix possible error if a relation file is removed while pg_basebackup is running (Heikki Linnakangas)
- Tolerate timeline switches while pg_basebackup -X fetch is backing up a standby server (Heikki Linnakangas)
- Make pg_dump exclude data of unlogged tables when running on a hot-standby server (Magnus Hagander)
This would fail anyway because the data is not available on the standby server, so it seems most convenient to assume --no-unlogged-table-data automatically.
- Fix pg_upgrade to deal with invalid indexes safely (Bruce Momjian)
- Fix pg_upgrade's -O/-o options (Bruce Momjian)
- Fix one-byte buffer overrun in libpq's PQprintTuples (Xi Wang)
This ancient function is not used anywhere by PostgreSQL itself, but it might still be used by some client code.
- Make ecpglib use translated messages properly (Chen Huajun)
- Properly install ecpg_compat and pgtypes libraries on MSVC (Jiang Guiqing)
- Include our version of isinf() in libecpg if it's not provided by the system (Jiang Guiqing)
- Rearrange configure's tests for supplied functions so it is not fooled by bogus exports from libedit/libreadline (Christoph Berg)
- Ensure Windows build number increases over time (Magnus Hagander)
- Make pgxs build executables with the right .exe suffix when cross-compiling for Windows (Zoltan Boszormenyi)
- Add new timezone abbreviation FET (Tom Lane)

# Changes
* Fix multiple bugs associated with CREATE/DROP INDEX CONCURRENTLY
- An error introduced while adding DROP INDEX CONCURRENTLY allowed incorrect indexing decisions to be made during the initial phase of CREATE INDEX CONCURRENTLY; so that indexes built by that command could be corrupt. It is recommended that indexes built in 9.2.X with CREATE INDEX CONCURRENTLY be rebuilt after applying this update.
- In addition, fix CREATE/DROP INDEX CONCURRENTLY to use in-place updates when changing the state of an index's pg_index row. This prevents race conditions that could cause concurrent sessions to miss updating the target index, thus again resulting in corrupt concurrently-created indexes.
- Also, fix various other operations to ensure that they ignore invalid indexes resulting from a failed CREATE INDEX CONCURRENTLY command. The most important of these is VACUUM, because an auto-vacuum could easily be launched on the table before corrective action can be taken to fix or remove the invalid index.
- Also fix DROP INDEX CONCURRENTLY to not disable insertions into the target index until all queries using it are done.
- Also fix misbehavior if DROP INDEX CONCURRENTLY is canceled: the previous coding could leave an un-droppable index behind.
* Correct predicate locking for DROP INDEX CONCURRENTLY
- Previously, SSI predicate locks were processed at the wrong time, possibly leading to incorrect behavior of serializable transactions executing in parallel with the DROP.
* Fix buffer locking during WAL replay
- The WAL replay code was insufficiently careful about locking buffers when replaying WAL records that affect more than one page. This could result in hot standby queries transiently seeing inconsistent states, resulting in wrong answers or unexpected failures.
* Fix an error in WAL generation logic for GIN indexes
- This could result in index corruption, if a torn-page failure occurred.
* Fix an error in WAL replay logic for SP-GiST indexes
- This could result in index corruption after a crash, or on a standby server.
* Fix incorrect detection of end-of-base-backup location during WAL recovery
- This mistake allowed hot standby mode to start up before the database reaches a consistent state.
* Properly remove startup process's virtual XID lock when promoting a hot standby server to normal running
- This oversight could prevent subsequent execution of certain operations such as CREATE INDEX CONCURRENTLY.
* Avoid bogus "out-of-sequence timeline ID" errors in standby mode
* Prevent the postmaster from launching new child processes after it's received a shutdown signal
- This mistake could result in shutdown taking longer than it should, or even never completing at all without additional user action.
* Fix the syslogger process to not fail when log_rotation_age exceeds 2^31 milliseconds (about 25 days)
* Fix WaitLatch() to return promptly when the requested timeout expires
- With the previous coding, a steady stream of non-wait-terminating interrupts could delay return from WaitLatch() indefinitely. This has been shown to be a problem for the autovacuum launcher process, and might cause trouble elsewhere as well.
* Avoid corruption of internal hash tables when out of memory
* Prevent file descriptors for dropped tables from being held open past transaction end
- This should reduce problems with long-since-dropped tables continuing to occupy disk space.
* Prevent database-wide crash and restart when a new child process is unable to create a pipe for its latch
- Although the new process must fail, there is no good reason to force a database-wide restart, so avoid that. This improves robustness when the kernel is nearly out of file descriptors.
* Avoid planner crash with joins to unflattened subqueries
* Fix planning of non-strict equivalence clauses above outer joins
- The planner could derive incorrect constraints from a clause equating a non-strict construct to something else, for example WHERE COALESCE(foo, 0) = 0 when foo is coming from the nullable side of an outer join. 9.2 showed this type of error in more cases than previous releases, but the basic bug has been there for a long time.
* Fix SELECT DISTINCT with index-optimized MIN/MAX on an inheritance tree
- The planner would fail with "failed to re-find MinMaxAggInfo record" given this combination of factors.
* Make sure the planner sees implicit and explicit casts as equivalent for all purposes, except in the minority of cases where there's actually a semantic difference
* Include join clauses when considering whether partial indexes can be used for a query
- A strict join clause can be sufficient to establish an x IS NOT NULL predicate, for example. This fixes a planner regression in 9.2, since previous versions could make comparable deductions.
* Limit growth of planning time when there are many indexable join clauses for the same index
* Improve planner's ability to prove exclusion constraints from equivalence classes
* Fix partial-row matching in hashed subplans to handle cross-type cases correctly
- This affects multicolumn NOT IN subplans, such as WHERE (a, b) NOT IN (SELECT x, y FROM ...) when for instance b and y are int4 and int8 respectively. This mistake led to wrong answers or crashes depending on the specific datatypes involved.
* Fix btree mark/restore functions to handle array keys
- This oversight could result in wrong answers from merge joins whose inner side is an index scan using an indexed_column = ANY(array) condition.
* Revert patch for taking fewer snapshots
- The 9.2 change to reduce the number of snapshots taken during query execution led to some anomalous behaviors not seen in previous releases, because execution would proceed with a snapshot acquired before locking the tables used by the query. Thus, for example, a query would not be guaranteed to see updates committed by a preceding transaction even if that transaction had exclusive lock. We'll probably revisit this in future releases, but meanwhile put it back the way it was before 9.2.
* Acquire buffer lock when re-fetching the old tuple for an AFTER ROW UPDATE/DELETE trigger
- In very unusual circumstances, this oversight could result in passing incorrect data to a trigger WHEN condition, or to the precheck logic for a foreign-key enforcement trigger. That could result in a crash, or in an incorrect decision about whether to fire the trigger.
* Fix ALTER COLUMN TYPE to handle inherited check constraints properly
- This worked correctly in pre-8.4 releases, and now works correctly in 8.4 and later.
* Fix ALTER EXTENSION SET SCHEMA's failure to move some subsidiary objects into the new schema
* Handle CREATE TABLE AS EXECUTE correctly in extended query protocol
* Don't modify the input parse tree in DROP RULE IF NOT EXISTS and DROP TRIGGER IF NOT EXISTS
- This mistake would cause errors if a cached statement of one of these types was re-executed.
* Fix REASSIGN OWNED to handle grants on tablespaces
* Ignore incorrect pg_attribute entries for system columns for views
- Views do not have any system columns. However, we forgot to remove such entries when converting a table to a view. That's fixed properly for 9.3 and later, but in previous branches we need to defend against existing mis-converted views.
* Fix rule printing to dump INSERT INTO table DEFAULT VALUES correctly
* Guard against stack overflow when there are too many UNION/INTERSECT/EXCEPT clauses in a query
* Prevent platform-dependent failures when dividing the minimum possible integer value by -1
* Fix possible access past end of string in date parsing
* Fix failure to advance XID epoch if XID wraparound happens during a checkpoint and wal_level is hot_standby
- While this mistake had no particular impact on PostgreSQL itself, it was bad for applications that rely on txid_current() and related functions: the TXID value would appear to go backwards.
* Fix pg_terminate_backend() and pg_cancel_backend() to not throw error for a non-existent target process
- This case already worked as intended when called by a superuser, but not so much when called by ordinary users.
* Fix display of pg_stat_replication.sync_state at a page boundary
* Produce an understandable error message if the length of the path name for a Unix-domain socket exceeds the platform-specific limit
- Formerly, this would result in something quite unhelpful, such as "Non-recoverable failure in name resolution".
* Fix memory leaks when sending composite column values to the client
* Save some cycles by not searching for subtransaction locks at commit
- In a transaction holding many exclusive locks, this useless activity could be quite costly.
* Make pg_ctl more robust about reading the postmaster.pid file
- This fixes race conditions and possible file descriptor leakage.
* Fix possible crash in psql if incorrectly-encoded data is presented and the client_encoding setting is a client-only encoding, such as SJIS
* Make pg_dump dump SEQUENCE SET items in the data not pre-data section of the archive
- This fixes an undesirable inconsistency between the meanings of --data-only and --section=data, and also fixes dumping of sequences that are marked as extension configuration tables.
* Fix pg_dump's handling of DROP DATABASE commands in --clean mode
- Beginning in 9.2.0, pg_dump --clean would issue a DROP DATABASE command, which was either useless or dangerous depending on the usage scenario. It no longer does that. This change also fixes the combination of --clean and --create to work sensibly, i.e., emit DROP DATABASE then CREATE DATABASE before reconnecting to the target database.
* Fix pg_dump for views with circular dependencies and no relation options
- The previous fix to dump relation options when a view is involved in a circular dependency didn't work right for the case that the view has no options; it emitted ALTER VIEW foo SET () which is invalid syntax.
* Fix bugs in the restore.sql script emitted by pg_dump in tar output format
- The script would fail outright on tables whose names include upper-case characters. Also, make the script capable of restoring data in --inserts mode as well as the regular COPY mode.
* Fix pg_restore to accept POSIX-conformant tar files
- The original coding of pg_dump's tar output mode produced files that are not fully conformant with the POSIX standard. This has been corrected for version 9.3. This patch updates previous branches so that they will accept both the incorrect and the corrected formats, in hopes of avoiding compatibility problems when 9.3 comes out.
* Fix tar files emitted by pg_basebackup to be POSIX conformant
* Fix pg_resetxlog to locate postmaster.pid correctly when given a relative path to the data directory
- This mistake could lead to pg_resetxlog not noticing that there is an active postmaster using the data directory.
* Fix libpq's lo_import() and lo_export() functions to report file I/O errors properly
* Fix ecpg's processing of nested structure pointer variables
* Fix ecpg's ecpg_get_data function to handle arrays properly
* Prevent pg_upgrade from trying to process TOAST tables for system catalogs
- This fixes an error seen when the information_schema has been dropped and recreated. Other failures were also possible.
* Improve pg_upgrade performance by setting synchronous_commit to off in the new cluster
* Make contrib/pageinspect's btree page inspection functions take buffer locks while examining pages
* Work around unportable behavior of malloc(0) and realloc(NULL, 0)
- On platforms where these calls return NULL, some code mistakenly thought that meant out-of-memory. This is known to have broken pg_dump for databases containing no user-defined aggregates. There might be other cases as well.
* Ensure that make install for an extension creates the extension installation directory
- Previously, this step was missed if MODULEDIR was set in the extension's Makefile.
* Fix pgxs support for building loadable modules on AIX
- Building modules outside the original source tree didn't work on AIX.
* Update time zone data files to tzdata release 2012j for DST law changes in Cuba, Israel, Jordan, Libya, Palestine, Western Samoa, and portions of Brazil.

# Changes
* Fix persistence marking of shared buffers during WAL replay
* Fix possible incorrect sorting of output from queries involving WHERE indexed_column IN (list_of_values)
* Fix planner failure for queries involving GROUP BY expressions along with window functions and aggregates
* Fix planner's assignment of executor parameters
* Improve planner's handling of join conditions in index scans
* Improve selectivity estimation for text search queries involving prefixes, i.e. word:* patterns
* Fix delayed recognition of permissions changes
* Fix ANALYZE to not fail when a column is a domain over an array type
* Prevent PL/Perl from crashing if a recursive PL/Perl function is redefined while being executed
* Work around possible misoptimization in PL/Perl
* Remove unnecessary dependency on pg_config from pg_upgrade
* Update time zone data files to tzdata release 2012f for DST law changes in Fiji

# Major enhancements include:
- Allow queries to retrieve data only from indexes, avoiding heap access (index-only scans)
- Allow the planner to generate custom plans for specific parameter values even when using prepared statements
- Improve the planner's ability to use nested loops with inner index scans
- Allow streaming replication slaves to forward data to other slaves (cascading replication)
- Allow pg_basebackup to make base backups from standby servers
- Add a pg_receivexlog tool to archive WAL file changes as they are written
- Add the SP-GiST (Space-Partitioned GiST) index access method
- Add support for range data types
- Add a JSON data type
- Add a security_barrier option for views
- Allow libpq connection strings to have the format of a URI
- Add a single-row processing mode to libpq for better handling of large result sets

# Changes
* Prevent access to external files/URLs via XML entity references
* Prevent access to external files/URLs via contrib/xml2's xslt_process()
* Prevent too-early recycling of btree index pages
* Fix crash-safety bug with newly-created-or-reset sequences
* Fix race condition in enum-type value comparisons
* Fix txid_current() to report the correct epoch when not in hot standby
* Prevent selection of unsuitable replication connections as the synchronous standby
* Fix bug in startup of Hot Standby when a master transaction has many subtransactions
* Ensure the backup_label file is fsync'd after pg_start_backup()
* Fix timeout handling in walsender processes
* Wake walsenders after each background flush by walwriter
* Fix LISTEN/NOTIFY to cope better with I/O problems, such as out of disk space
* Only allow autovacuum to be auto-canceled by a directly blocked process
* Improve logging of autovacuum cancels
* Fix log collector so that log_truncate_on_rotation works during the very first log rotation after server start
* Fix WITH attached to a nested set operation (UNION/INTERSECT/EXCEPT)
* Ensure that a whole-row reference to a subquery doesn't include any extra GROUP BY or ORDER BY columns
* Fix dependencies generated during ALTER TABLE ... ADD CONSTRAINT USING INDEX
* Fix REASSIGN OWNED to work on extensions
* Disallow copying whole-row references in CHECK constraints and index definitions during CREATE TABLE
* Fix memory leak in ARRAY(SELECT ...) subqueries
* Fix planner to pass correct collation to operator selectivity estimators
* Fix extraction of common prefixes from regular expressions
* Fix bugs with parsing signed hh:mm and hh:mm:ss fields in interval constants
* Fix pg_dump to better handle views containing partial GROUP BY lists
* In PL/Perl, avoid setting UTF8 flag when in SQL_ASCII encoding
* Use Postgres' encoding conversion functions, not Python's, when converting a Python Unicode string to the server encoding in PL/Python
* Fix mapping of PostgreSQL encodings to Python encodings in PL/Python
* Report errors properly in contrib/xml2's xslt_process()
* Update time zone data files to tzdata release 2012e for DST law changes in Morocco and Tokelau

* Fix incorrect password transformation in contrib/pgcrypto's DES crypt() function (Solar Designer) If a password string contained the byte value 0x80, the remainder of the password was ignored, causing the password to be much weaker than it appeared. With this fix, the rest of the string is properly included in the DES hash. Any stored password values that are affected by this bug will thus no longer match, so the stored values may need to be updated.
* Ignore SECURITY DEFINER and SET attributes for a procedural language's call handler Applying such attributes to a call handler could crash the server.
* Make contrib/citext's upgrade script fix collations of citext arrays and domains over citext Release 9.1.2 provided a fix for collations of citext columns and indexes in databases upgraded or reloaded from pre-9.1 installations, but that fix was incomplete: it neglected to handle arrays and domains over citext. This release extends the module's upgrade script to handle these cases. As before, if you have already run the upgrade script, you'll need to run the collation update commands by hand instead. See the 9.1.2 release notes for more information about doing this.
* Allow numeric timezone offsets in timestamp input to be up to 16 hours away from UTC Some historical time zones have offsets larger than 15 hours, the previous limit. This could result in dumped data values being rejected during reload.
* Fix timestamp conversion to cope when the given time is exactly the last DST transition time for the current timezone This oversight has been there a long time, but was not noticed previously because most DST-using zones are presumed to have an indefinite sequence of future DST transitions.
* Fix text to name and char to name casts to perform string truncation correctly in multibyte encodings
* Fix memory copying bug in to_tsquery()
* Ensure txid_current() reports the correct epoch when executed in hot standby
* Fix planner's handling of outer PlaceHolderVars within subqueries This bug concerns sub-SELECTs that reference variables coming from the nullable side of an outer join of the surrounding query. In 9.1, queries affected by this bug would fail with "ERROR: Upper-level PlaceHolderVar found where not expected". But in 9.0 and 8.4, you'd silently get possibly-wrong answers, since the value transmitted into the subquery wouldn't go to null when it should.
* Fix planning of UNION ALL subqueries with output columns that are not simple variables Planning of such cases got noticeably worse in 9.1 as a result of a misguided fix for "MergeAppend child's targetlist doesn't match MergeAppend" errors. Revert that fix and do it another way.
* Fix slow session startup when pg_attribute is very large If pg_attribute exceeds one-fourth of shared_buffers, cache rebuilding code that is sometimes needed during session start would trigger the synchronized-scan logic, causing it to take many times longer than normal. The problem was particularly acute if many new sessions were starting at once.
* Ensure sequential scans check for query cancel reasonably often A scan encountering many consecutive pages that contain no live tuples would not respond to interrupts meanwhile.
* Ensure the Windows implementation of PGSemaphoreLock() clears ImmediateInterruptOK before returning This oversight meant that a query-cancel interrupt received later in the same query could be accepted at an unsafe time, with unpredictable but not good consequences.
* Show whole-row variables safely when printing views or rules Corner cases involving ambiguous names (that is, the name could be either a table or column name of the query) were printed in an ambiguous way, risking that the view or rule would be interpreted differently after dump and reload. Avoid the ambiguous case by attaching a no-op cast.
* Fix COPY FROM to properly handle null marker strings that correspond to invalid encoding A null marker string such as E'\0' should work, and did work in the past, but the case got broken in 8.4.
* Fix EXPLAIN VERBOSE for writable CTEs containing RETURNING clauses
* Fix PREPARE TRANSACTION to work correctly in the presence of advisory locks Historically, PREPARE TRANSACTION has simply ignored any session-level advisory locks the session holds, but this case was accidentally broken in 9.1.
* Fix truncation of unlogged tables
* Ignore missing schemas during non-interactive assignments of search_path This re-aligns 9.1's behavior with that of older branches. Previously 9.1 would throw an error for nonexistent schemas mentioned in search_path settings obtained from places such as ALTER DATABASE SET.
* Fix bugs with temporary or transient tables used in extension scripts This includes cases such as a rewriting ALTER TABLE within an extension update script, since that uses a transient table behind the scenes.
* Ensure autovacuum worker processes perform stack depth checking properly Previously, infinite recursion in a function invoked by auto-ANALYZE could crash worker processes.
* Fix logging collector to not lose log coherency under high load The collector previously could fail to reassemble large messages if it got too busy.
* Fix logging collector to ensure it will restart file rotation after receiving SIGHUP
* Fix "too many LWLocks taken" failure in GiST indexes
* Fix WAL replay logic for GIN indexes to not fail if the index was subsequently dropped
* Correctly detect SSI conflicts of prepared transactions after a crash
* Avoid synchronous replication delay when committing a transaction that only modified temporary tables In such a case the transaction's commit record need not be flushed to standby servers, but some of the code didn't know that and waited for it to happen anyway.
* Fix error handling in pg_basebackup
* Fix walsender to not go into a busy loop if connection is terminated
* Fix memory leak in PL/pgSQL's RETURN NEXT command
* Fix PL/pgSQL's GET DIAGNOSTICS command when the target is the function's first variable
* Ensure that PL/Perl package-qualifies the _TD variable This bug caused trigger invocations to fail when they are nested within a function invocation that changes the current package.
* Fix PL/Python functions returning composite types to accept a string for their result value This case was accidentally broken by the 9.1 additions to allow a composite result value to be supplied in other formats, such as dictionaries.
* Fix potential access off the end of memory in psql's expanded display (x) mode
* Fix several performance problems in pg_dump when the database contains many objects pg_dump could get very slow if the database contained many schemas, or if many objects are in dependency loops, or if there are many owned sequences.
* Fix memory and file descriptor leaks in pg_restore when reading a directory-format archive
* Fix pg_upgrade for the case that a database stored in a non-default tablespace contains a table in the cluster's default tablespace
* In ecpg, fix rare memory leaks and possible overwrite of one byte after the sqlca_t structure
* Fix contrib/dblink's dblink_exec() to not leak temporary database connections upon error
* Fix contrib/dblink to report the correct connection name in error messages
* Fix contrib/vacuumlo to use multiple transactions when dropping many large objects This change avoids exceeding max_locks_per_transaction when many objects need to be dropped. The behavior can be adjusted with the new -l (limit) option.
* Update time zone data files to tzdata release 2012c for DST law changes in Antarctica, Armenia, Chile, Cuba, Falkland Islands, Gaza, Haiti, Hebron, Morocco, Syria, and Tokelau Islands; also historical corrections for Canada.

# Changes
* Require execute permission on the trigger function for CREATE TRIGGER
- This missing check could allow another user to execute a trigger function with forged input data, by installing it on a table he owns. This is only of significance for trigger functions marked SECURITY DEFINER, since otherwise trigger functions run as the table owner anyway.
* Remove arbitrary limitation on length of common name in SSL certificates
- Both libpq and the server truncated the common name extracted from an SSL certificate at 32 bytes. Normally this would cause nothing worse than an unexpected verification failure, but there are some rather-implausible scenarios in which it might allow one certificate holder to impersonate another. The victim would have to have a common name exactly 32 bytes long, and the attacker would have to persuade a trusted CA to issue a certificate in which the common name has that string as a prefix. Impersonating a server would also require some additional exploit to redirect client connections.
* Convert newlines to spaces in names written in pg_dump comments
- pg_dump was incautious about sanitizing object names that are emitted within SQL comments in its output script. A name containing a newline would at least render the script syntactically incorrect. Maliciously crafted object names could present a SQL injection risk when the script is reloaded.
* Fix btree index corruption from insertions concurrent with vacuuming
- An index page split caused by an insertion could sometimes cause a concurrently-running VACUUM to miss removing index entries that it should remove. After the corresponding table rows are removed, the dangling index entries would cause errors (such as "could not read block N in file ...") or worse, silently wrong query results after unrelated rows are re-inserted at the now-free table locations. This bug has been present since release 8.2, but occurs so infrequently that it was not diagnosed until now. If you have reason to suspect that it has happened in your database, reindexing the affected index will fix things.
* Fix transient zeroing of shared buffers during WAL replay
- The replay logic would sometimes zero and refill a shared buffer, so that the contents were transiently invalid. In hot standby mode this can result in a query that's executing in parallel seeing garbage data. Various symptoms could result from that, but the most common one seems to be "invalid memory alloc request size".
* Fix handling of data-modifying WITH subplans in READ COMMITTED rechecking
- A WITH clause containing INSERT/UPDATE/DELETE would crash if the parent UPDATE or DELETE command needed to be re-evaluated at one or more rows due to concurrent updates in READ COMMITTED mode.
* Fix corner case in SSI transaction cleanup
- When finishing up a read-write serializable transaction, a crash could occur if all remaining active serializable transactions are read-only.
* Fix postmaster to attempt restart after a hot-standby crash
- A logic error caused the postmaster to terminate, rather than attempt to restart the cluster, if any backend process crashed while operating in hot standby mode.
* Fix CLUSTER/VACUUM FULL handling of toast values owned by recently-updated rows
- This oversight could lead to "duplicate key value violates unique constraint" errors being reported against the toast table's index during one of these commands.
* Update per-column permissions, not only per-table permissions, when changing table owner
- Failure to do this meant that any previously granted column permissions were still shown as having been granted by the old owner. This meant that neither the new owner nor a superuser could revoke the now-untraceable-to-table-owner permissions.
* Support foreign data wrappers and foreign servers in REASSIGN OWNED
- This command failed with "unexpected classid" errors if it needed to change the ownership of any such objects.
* Allow non-existent values for some settings in ALTER USER/DATABASE SET
- Allow default_text_search_config, default_tablespace, and temp_tablespaces to be set to names that are not known. This is because they might be known in another database where the setting is intended to be used, or for the tablespace cases because the tablespace might not be created yet. The same issue was previously recognized for search_path, and these settings now act like that one.
* Fix "unsupported node type" error caused by COLLATE in an INSERT expression
* Avoid crashing when we have problems deleting table files post-commit
- Dropping a table should lead to deleting the underlying disk files only after the transaction commits. In event of failure then (for instance, because of wrong file permissions) the code is supposed to just emit a warning message and go on, since it's too late to abort the transaction. This logic got broken as of release 8.4, causing such situations to result in a PANIC and an unrestartable database.
* Recover from errors occurring during WAL replay of DROP TABLESPACE
- Replay will attempt to remove the tablespace's directories, but there are various reasons why this might fail (for example, incorrect ownership or permissions on those directories). Formerly the replay code would panic, rendering the database unrestartable without manual intervention. It seems better to log the problem and continue, since the only consequence of failure to remove the directories is some wasted disk space.
* Fix race condition in logging AccessExclusiveLocks for hot standby
- Sometimes a lock would be logged as being held by "transaction zero". This is at least known to produce assertion failures on slave servers, and might be the cause of more serious problems.
* Track the OID counter correctly during WAL replay, even when it wraps around
- Previously the OID counter would remain stuck at a high value until the system exited replay mode. The practical consequences of that are usually nil, but there are scenarios wherein a standby server that's been promoted to master might take a long time to advance the OID counter to a reasonable value once values are needed.
* Prevent emitting misleading "consistent recovery state reached" log message at the beginning of crash recovery
* Fix initial value of pg_stat_replication.replay_location
- Previously, the value shown would be wrong until at least one WAL record had been replayed.
* Fix regular expression back-references with * attached
- Rather than enforcing an exact string match, the code would effectively accept any string that satisfies the pattern sub-expression referenced by the back-reference symbol.
- A similar problem still afflicts back-references that are embedded in a larger quantified expression, rather than being the immediate subject of the quantifier. This will be addressed in a future PostgreSQL release.
* Fix recently-introduced memory leak in processing of inet/cidr values
- A patch in the December 2011 releases of PostgreSQL caused memory leakage in these operations, which could be significant in scenarios such as building a btree index on such a column.
* Fix planner's ability to push down index-expression restrictions through UNION ALL
- This type of optimization was inadvertently disabled by a fix for another problem in 9.1.2.
* Fix planning of WITH clauses referenced in UPDATE/DELETE on an inherited table
- This bug led to "could not find plan for CTE" failures.
* Fix GIN cost estimation to handle column IN (...) index conditions
- This oversight would usually lead to crashes if such a condition could be used with a GIN index.
* Prevent assertion failure when exiting a session with an open, failed transaction
- This bug has no impact on normal builds with asserts not enabled.
* Fix dangling pointer after CREATE TABLE AS/SELECT INTO in a SQL-language function
- In most cases this only led to an assertion failure in assert-enabled builds, but worse consequences seem possible.
* Avoid double close of file handle in syslogger on Windows
- Ordinarily this error was invisible, but it would cause an exception when running on a debug version of Windows.
* Fix I/O-conversion-related memory leaks in plpgsql
- Certain operations would leak memory until the end of the current function.
* Work around bug in perl's SvPVutf8() function
- This function crashes when handed a typeglob or certain read-only objects such as $^V. Make plperl avoid passing those to it.
* In pg_dump, don't dump contents of an extension's configuration tables if the extension itself is not being dumped
* Improve pg_dump's handling of inherited table columns
- pg_dump mishandled situations where a child column has a different default expression than its parent column. If the default is textually identical to the parent's default, but not actually the same (for instance, because of schema search path differences) it would not be recognized as different, so that after dump and restore the child would be allowed to inherit the parent's default. Child columns that are NOT NULL where their parent is not could also be restored subtly incorrectly.
* Fix pg_restore's direct-to-database mode for INSERT-style table data
- Direct-to-database restores from archive files made with --inserts or --column-inserts options fail when using pg_restore from a release dated September or December 2011, as a result of an oversight in a fix for another problem. The archive file itself is not at fault, and text-mode output is okay.
* Teach pg_upgrade to handle renaming of plpython's shared library
- Upgrading a pre-9.1 database that included plpython would fail because of this oversight.
* Allow pg_upgrade to process tables containing regclass columns
- Since pg_upgrade now takes care to preserve pg_class OIDs, there was no longer any reason for this restriction.
* Make libpq ignore ENOTDIR errors when looking for an SSL client certificate file
- This allows SSL connections to be established, though without a certificate, even when the user's home directory is set to something like /dev/null.
* Fix some more field alignment issues in ecpg's SQLDA area
* Allow AT option in ecpg DEALLOCATE statements
- The infrastructure to support this has been there for awhile, but through an oversight there was still an error check rejecting the case.
* Do not use the variable name when defining a varchar structure in ecpg
* Fix contrib/auto_explain's JSON output mode to produce valid JSON
- The output used brackets at the top level, when it should have used braces.
* Fix error in contrib/intarray's int[] & int[] operator
- If the smallest integer the two input arrays have in common is 1, and there are smaller values in either array, then 1 would be incorrectly omitted from the result.
* Fix error detection in contrib/pgcrypto's encrypt_iv() and decrypt_iv()
- These functions failed to report certain types of invalid-input errors, and would instead return random garbage values for incorrect input.
* Fix one-byte buffer overrun in contrib/test_parser
- The code would try to read one more byte than it should, which would crash in corner cases. Since contrib/test_parser is only example code, this is not a security issue in itself, but bad example code is still bad.
* Use __sync_lock_test_and_set() for spinlocks on ARM, if available
- This function replaces our previous use of the SWPB instruction, which is deprecated and not available on ARMv6 and later. Reports suggest that the old code doesn't fail in an obvious way on recent ARM boards, but simply doesn't interlock concurrent accesses, leading to bizarre failures in multiprocess operation.
* Use -fexcess-precision=standard option when building with gcc versions that accept it
- This prevents assorted scenarios wherein recent versions of gcc will produce creative results.
* Allow use of threaded Python on FreeBSD
- Our configure script previously believed that this combination wouldn't work; but FreeBSD fixed the problem, so remove that error check.
* Allow MinGW builds to use standardly-named OpenSSL libraries

* Fix bugs in information_schema.referential_constraints view
- This view was being insufficiently careful about matching the foreign-key constraint to the depended-on primary or unique key constraint. That could result in failure to show a foreign key constraint at all, or showing it multiple times, or claiming that it depends on a different constraint than the one it really does.
- Since the view definition is installed by initdb, merely upgrading will not fix the problem. If you need to fix this in an existing installation, you can (as a superuser) drop the information_schema schema then re-create it by sourcing SHAREDIR/information_schema.sql. (Run pg_config --sharedir if you're uncertain where SHAREDIR is.) This must be repeated in each database to be fixed.
* Make contrib/citext's upgrade script fix collations of citext columns and indexes
- Existing citext columns and indexes aren't correctly marked as being of a collatable data type during pg_upgrade from a pre-9.1 server. That leads to operations on them failing with errors such as "could not determine which collation to use for string comparison". This change allows them to be fixed by the same script that upgrades the citext module into a proper 9.1 extension during CREATE EXTENSION citext FROM unpackaged.
- If you have a previously-upgraded database that is suffering from this problem, and you already ran the CREATE EXTENSION command, you can manually run (as superuser) the UPDATE commands found at the end of SHAREDIR/extension/citext--unpackaged--1.0.sql. (Run pg_config --sharedir if you're uncertain where SHAREDIR is.)
* Fix possible crash during UPDATE or DELETE that joins to the output of a scalar-returning function
- A crash could only occur if the target row had been concurrently updated, so this problem surfaced only intermittently.
* Fix incorrect replay of WAL records for GIN index updates
- This could result in transiently failing to find index entries after a crash, or on a hot-standby server. The problem would be repaired by the next VACUUM of the index, however.
* Fix TOAST-related data corruption during CREATE TABLE dest AS SELECT * FROM src or INSERT INTO dest SELECT * FROM src
- If a table has been modified by ALTER TABLE ADD COLUMN, attempts to copy its data verbatim to another table could produce corrupt results in certain corner cases. The problem can only manifest in this precise form in 8.4 and later, but we patched earlier versions as well in case there are other code paths that could trigger the same bug.
* Fix possible failures during hot standby startup
* Start hot standby faster when initial snapshot is incomplete
* Fix race condition during toast table access from stale syscache entries
- The typical symptom was transient errors like "missing chunk number 0 for toast value NNNNN in pg_toast_2619", where the cited toast table would always belong to a system catalog.
* Track dependencies of functions on items used in parameter default expressions
- Previously, a referenced object could be dropped without having dropped or modified the function, leading to misbehavior when the function was used. Note that merely installing this update will not fix the missing dependency entries; to do that, you'd need to CREATE OR REPLACE each such function afterwards. If you have functions whose defaults depend on non-built-in objects, doing so is recommended.
* Fix incorrect management of placeholder variables in nestloop joins
- This bug is known to lead to "variable not found in subplan target list" planner errors, and could possibly result in wrong query output when outer joins are involved.
* Fix window functions that sort by expressions involving aggregates
- Previously these could fail with "could not find pathkey item to sort" planner errors.
* Fix "MergeAppend child's targetlist doesn't match MergeAppend" planner errors
* Fix index matching for operators with both collatable and noncollatable inputs
- In 9.1.0, an indexable operator that has a non-collatable left-hand input type and a collatable right-hand input type would not be recognized as matching the left-hand column's index. An example is the hstore ? text operator.
* Allow inlining of set-returning SQL functions with multiple OUT parameters
* Don't trust deferred-unique indexes for join removal
- A deferred uniqueness constraint might not hold intra-transaction, so assuming that it does could give incorrect query results.
* Make DatumGetInetP() unpack inet datums that have a 1-byte header, and add a new macro, DatumGetInetPP(), that does not
- This change affects no core code, but might prevent crashes in add-on code that expects DatumGetInetP() to produce an unpacked datum as per usual convention.
* Improve locale support in money type's input and output
- Aside from not supporting all standard lc_monetary formatting options, the input and output functions were inconsistent, meaning there were locales in which dumped money values could not be re-read.
* Don't let transform_null_equals affect CASE foo WHEN NULL ... constructs
- transform_null_equals is only supposed to affect foo = NULL expressions written directly by the user, not equality checks generated internally by this form of CASE.
* Change foreign-key trigger creation order to better support self-referential foreign keys
- For a cascading foreign key that references its own table, a row update will fire both the ON UPDATE trigger and the CHECK trigger as one event. The ON UPDATE trigger must execute first, else the CHECK will check a non-final state of the row and possibly throw an inappropriate error. However, the firing order of these triggers is determined by their names, which generally sort in creation order since the triggers have auto-generated names following the convention "RI_ConstraintTrigger_NNNN". A proper fix would require modifying that convention, which we will do in 9.2, but it seems risky to change it in existing releases. So this patch just changes the creation order of the triggers. Users encountering this type of error should drop and re-create the foreign key constraint to get its triggers into the right order.
* Fix IF EXISTS to work correctly in DROP OPERATOR FAMILY
* Disallow dropping of an extension from within its own script
- This prevents odd behavior in case of incorrect management of extension dependencies.
* Don't mark auto-generated types as extension members
- Relation rowtypes and automatically-generated array types do not need to have their own extension membership entries in pg_depend, and creating such entries complicates matters for extension upgrades.
* Cope with invalid pre-existing search_path settings during CREATE EXTENSION
* Avoid floating-point underflow while tracking buffer allocation rate
- While harmless in itself, on certain platforms this would result in annoying kernel log messages.
* Prevent autovacuum transactions from running in serializable mode
- Autovacuum formerly used the cluster-wide default transaction isolation level, but there is no need for it to use anything higher than READ COMMITTED, and using SERIALIZABLE could result in unnecessary delays for other processes.
* Ensure walsender processes respond promptly to SIGTERM
* Exclude postmaster.opts from base backups
* Preserve configuration file name and line number values when starting child processes under Windows
- Formerly, these would not be displayed correctly in the pg_settings view.
* Fix incorrect field alignment in ecpg's SQLDA area
* Preserve blank lines within commands in psql's command history
- The former behavior could cause problems if an empty line was removed from within a string literal, for example.
* Avoid platform-specific infinite loop in pg_dump
* Fix compression of plain-text output format in pg_dump
- pg_dump has historically understood -Z with no -F switch to mean that it should emit a gzip-compressed version of its plain text output. Restore that behavior.
* Fix pg_dump to dump user-defined casts between auto-generated types, such as table rowtypes
* Fix missed quoting of foreign server names in pg_dump
* Assorted fixes for pg_upgrade
- Handle exclusion constraints correctly, avoid failures on Windows, don't complain about mismatched toast table names in 8.4 databases.
* In PL/pgSQL, allow foreign tables to define row types
* Fix up conversions of PL/Perl functions' results
- Restore the pre-9.1 behavior that PL/Perl functions returning void ignore the result value of their last Perl statement; 9.1.0 would throw an error if that statement returned a reference. Also, make sure it works to return a string value for a composite type, so long as the string meets the type's input format. In addition, throw errors for attempts to return Perl arrays or hashes when the function's declared result type is not an array or composite type, respectively. (Pre-9.1 versions rather uselessly returned strings like ARRAY(0x221a9a0) or HASH(0x221aa90) in such cases.)
* Ensure PL/Perl strings are always correctly UTF8-encoded
* Use the preferred version of xsubpp to build PL/Perl, not necessarily the operating system's main copy
* Correctly propagate SQLSTATE in PL/Python exceptions
* Do not install PL/Python extension files for Python major versions other than the one built against
* Change all the contrib extension script files to report a useful error message if they are fed to psql
- This should help teach people about the new method of using CREATE EXTENSION to load these files. In most cases, sourcing the scripts directly would fail anyway, but with harder-to-interpret messages.
* Fix incorrect coding in contrib/dict_int and contrib/dict_xsyn
- Some functions incorrectly assumed that memory returned by palloc() is guaranteed zeroed.
* Remove contrib/sepgsql tests from the regular regression test mechanism
- Since these tests require root privileges for setup, they're impractical to run automatically. Switch over to a manual approach instead, and provide a testing script to help with that.
* Fix assorted errors in contrib/unaccent's configuration file parsing
* Honor query cancel interrupts promptly in pgstatindex()
* Fix incorrect quoting of log file name in Mac OS X start script
* Revert unintentional enabling of WAL_DEBUG
- Fortunately, as debugging tools go, this one is pretty cheap; but it's not intended to be enabled by default, so revert.
* Ensure VPATH builds properly install all server header files
* Shorten file names reported in verbose error messages
- Regular builds have always reported just the name of the C file containing the error message call, but VPATH builds formerly reported an absolute path name.
* Fix interpretation of Windows timezone names for Central America
- Map "Central America Standard Time" to CST6, not CST6CDT, because DST is generally not observed anywhere in Central America.
* Update time zone data files to tzdata release 2011n for DST law changes in Brazil, Cuba, Fiji, Palestine, Russia, and Samoa; also historical corrections for Alaska and British East Africa.

* Make pg_options_to_table return NULL for an option with no value , Previously such cases would result in a server crash.
* Fix memory leak at end of a GiST index scan , Commands that perform many separate GiST index scans, such as verification of a new GiST-based exclusion constraint on a table already containing many rows, could transiently require large amounts of memory due to this leak.
* Fix explicit reference to pg_temp schema in CREATE TEMPORARY TABLE , This used to be allowed, but failed in 9.1.0.

* Allow synchronous replication
* Add support for foreign tables
* Add per-column collation support
* Add extensions which simplify packaging of additions to PostgreSQL
* Add a true serializable isolation level
* Support unlogged tables using the UNLOGGED option in CREATE TABLE
* Allow data-modification commands (INSERT/UPDATE/DELETE) in WITH clauses
* Add nearest-neighbor (order-by-operator) searching to GiST indexes
* Add a SECURITY LABEL command and support for SELinux permissions control
* Update the PL/Python server-side language

* Fix pg_upgrade's handling of TOAST tables
The pg_class.relfrozenxid value for TOAST tables was not correctly copied into the new installation during pg_upgrade. This could later result in pg_clog files being discarded while they were still needed to validate tuples in the TOAST tables, leading to "could not access status of transaction" failures.
This error poses a significant risk of data loss for installations that have been upgraded with pg_upgrade. This patch corrects the problem for future uses of pg_upgrade, but does not in itself cure the issue in installations that have been processed with a buggy version of pg_upgrade.
* Suppress incorrect "PD_ALL_VISIBLE flag was incorrectly set" warning
VACUUM would sometimes issue this warning in cases that are actually valid.
* Use better SQLSTATE error codes for hot standby conflict cases
All retryable conflict errors now have an error code that indicates that a retry is possible. Also, session closure due to the database being dropped on the master is now reported as ERRCODE_DATABASE_DROPPED, rather than ERRCODE_ADMIN_SHUTDOWN, so that connection poolers can handle the situation correctly.
* Prevent intermittent hang in interactions of startup process with bgwriter process
This affected recovery in non-hot-standby cases.
* Disallow including a composite type in itself
This prevents scenarios wherein the server could recurse infinitely while processing the composite type. While there are some possible uses for such a structure, they don't seem compelling enough to justify the effort required to make sure it always works safely.
* Avoid potential deadlock during catalog cache initialization
In some cases the cache loading code would acquire share lock on a system index before locking the index's catalog. This could deadlock against processes trying to acquire exclusive locks in the other, more standard order.
* Fix dangling-pointer problem in BEFORE ROW UPDATE trigger handling when there was a concurrent update to the target tuple
This bug has been observed to result in intermittent "cannot extract system attribute from virtual tuple" failures while trying to do UPDATE RETURNING ctid. There is a very small probability of more serious errors, such as generating incorrect index entries for the updated tuple.
* Disallow DROP TABLE when there are pending deferred trigger events for the table
Formerly the DROP would go through, leading to "could not open relation with OID nnn" errors when the triggers were eventually fired.
* Allow "replication" as a user name in pg_hba.conf
"replication" is special in the database name column, but it was mistakenly also treated as special in the user name column.
* Prevent crash triggered by constant-false WHERE conditions during GEQO optimization
* Improve planner's handling of semi-join and anti-join cases
* Fix handling of SELECT FOR UPDATE in a sub-SELECT
This bug typically led to "cannot extract system attribute from virtual tuple" errors.
* Fix selectivity estimation for text search to account for NULLs
* Fix get_actual_variable_range() to support hypothetical indexes injected by an index adviser plugin
* Fix PL/Python memory leak involving array slices
* Allow libpq's SSL initialization to succeed when user's home directory is unavailable
If the SSL mode is such that a root certificate file is not required, there is no need to fail. This change restores the behavior to what it was in pre-9.0 releases.
* Fix libpq to return a useful error message for errors detected in conninfo_array_parse
A typo caused the library to return NULL, rather than the PGconn structure containing the error message, to the application.
* Fix ecpg preprocessor's handling of float constants
* Fix parallel pg_restore to handle comments on POST_DATA items correctly
* Fix pg_restore to cope with long lines (over 1KB) in TOC files
* Put in more safeguards against crashing due to division-by-zero with overly enthusiastic compiler optimization
* Support use of dlopen() in FreeBSD and OpenBSD on MIPS
There was a hard-wired assumption that this system function was not available on MIPS hardware on these systems. Use a compile-time test instead, since more recent versions have it.
* Fix compilation failures on HP-UX
* Avoid crash when trying to write to the Windows console very early in process startup
* Support building with MinGW 64 bit compiler for Windows
* Fix version-incompatibility problem with libintl on Windows
* Fix usage of xcopy in Windows build scripts to work correctly under Windows 7
This affects the build scripts only, not installation or usage.
* Fix path separator used by pg_regress on Cygwin
* Update time zone data files to tzdata release 2011f for DST law changes in Chile, Cuba, Falkland Islands, Morocco, Samoa, and Turkey; also historical corrections for South Australia, Alaska, and Hawaii.