Sergey Burladyan, there are at least some dank corners of libxml2 that
assume this behavior, even though their published documentation suggests
they shouldn't.

This is only really a live problem in 8.3, but the code is still there
for possible debugging use in HEAD, so patch both branches.

Author: Itagaki Takahiro <itagaki.takahiro@oss.ntt.co.jp>

"array_agg_finalfn(null)".  We should modify pg_proc entries to prevent this
query from being accepted, but let's just make the function itself secure too.
Per my note of today.

the database list too often.

Per bug report from Łukasz Jagiełło and ensuing discussion on
pgsql-performance.

pg_get_function_arguments() and related functions.  Per report from
Andreas Nolte.

also backpatched to 8.3

behavior in cases where we don't know the heap tuple count accurately; in
particular partial vacuum, but this also makes the API a bit more useful
for ANALYZE.  This patch adds "estimated_count" flags to both structs so
that an approximate count can be flagged as such, and adjusts the logic
so that approximate counts are not used for updating pg_class.reltuples.

This fixes my previous complaint that VACUUM was putting ridiculous values
into pg_class.reltuples for indexes.  The actual impact of that bug is
limited, because the planner only pays attention to reltuples for an index
if the index is partial; which probably explains why beta testers hadn't
noticed a degradation in plan quality from it.  But it needs to be fixed.

The whole thing is a bit messy and should be redesigned in future, because
reltuples now has the potential to drift quite far away from reality when
a long period elapses with no non-partial vacuums.  But this is as good as
it's going to get for 8.4.

is supposed to remove duplicate heap TIDs, we have to be sure to reduce the
tuple size and posting-item count accordingly in addItemPointersToTuple().
Failing to do so resulted in the effective injection of garbage TIDs into the
index contents, ie, whatever happened to be in the memory palloc'd for the
new tuple.  I'm not sure that this fully explains the index corruption
reported by Tatsuo Ishii, but the test case I'm using no longer fails.

by extending the ereport() API to cater for pluralization directly.  This
is better than the original method of calling ngettext outside the elog.c
code because (1) it avoids double translation, which wastes cycles and in
the worst case could give a wrong result; and (2) it avoids having to use
a different coding method in PL code than in the core backend.  The
client-side uses of ngettext are not touched since neither of these concerns
is very pressing in the client environment.  Per my proposal of yesterday.

Tatsuo Ishii.

symbolic links with the -l option, and as Fujii Masao pointed out we ended up
overwriting files in the archive directory before this patch. Patch by
Aidan Van Dyk, Fujii Masao and me.

Backpatch to 8.3, where pg_standby was introduced.

grounds that they don't fit into the specified interval qualifier (typmod).
This behavior, while of long standing, is clearly wrong per spec --- for
example the value INTERVAL '999' SECOND means 999 seconds and should not be
reduced to less than 60 seconds.

In some cases there could be grounds to raise an error if higher-order field
values are not given as zero; for example '1 year 1 month'::INTERVAL MONTH
should arguably be taken as an error rather than equivalent to 13 months.
However our internal representation doesn't allow us to do that in a fashion
that would consistently reject all and only the cases that a strict reading
of the spec would suggest.  Also, seeing that for example INTERVAL '13' MONTH
will print out as '1 year 1 mon', we have to be careful not to create a
situation where valid data will fail to dump and reload.  The present patch
therefore takes the attitude of not throwing an error in any such case.
We might want to revisit that in future but it would take more redesign
than seems prudent in late beta.

Per a complaint from Sebastien Flaesch and subsequent discussion.  While
at other times we might have just postponed such an issue to the next
development cycle, 8.4 already has changed the parsing of interval literals
quite a bit in an effort to accept all spec-compliant cases correctly.
This seems like a change that should be part of that rather than coming
along later.

YEAR, DECADE, CENTURY, or MILLENIUM fields, just as it always has done for
other types of fields.  The previous behavior seems to have been a hack to
avoid defining bit-positions for all these field types in DTK_M() masks,
rather than something that was really considered to be desired behavior.
But there is room in the masks for these, and we really need to tighten up
at least the behavior of DAY and YEAR fields to avoid unexpected behavior
associated with the 8.4 changes to interpret ambiguous fields based on the
interval qualifier (typmod) value.  Per my example and proposed patch.

queries frequently took no lock at all on individual indexes.  That's not
true any more, but we still need lock on the parent table to make it safe
to use cached lists of index OIDs.

all transactions are archived.

Original patch by Guillaume Smet.

this, the username was in practice never matched against the kerberos principal
used to log in.

throwing an error as 8.4 had been doing.  The error interfered with porting
old database definitions (particularly for pg_migrator) without really buying
any safety.  Per bug #4817 and subsequent discussion.

"tsquery_op.c", line 193: warning: syntax error:  empty declaration

Zdenek Kotala

an expression that's not supposed to contain variables.  Per discussion
with Gevik Babakhani, this eliminates the need for an ugly kluge (namely,
specifying some unrelated relation name).  Remove one such kluge from
pg_dump.

EncodeTimeOnly, EncodeDateTime, EncodeInterval.  These don't have any good
reason to fail, and their callers were mostly not checking anyway.

of time values that would not be accepted via textual input.
Per gripe from Andrew McNamara.

This is potentially a back-patchable bug fix, but for the moment it doesn't
seem sufficiently high impact to justify doing that.

relopt_kind value in add_reloption_kind().  Per Zdenek Kotala.

this case is worth a special code path, but a special code path that gets
the boundary condition wrong is definitely no good.  Per bug #4821 from
Andrew Gierth.

In passing, clean up some minor code formatting issues (excess parentheses
and blank lines in odd places).

Back-patch to 8.3, where the bug was introduced.

Basically, it's needed to support binary dump from 8.3 because ordering rule
was changed.

Per discussion with Bruce.

when compiling with -Wformat-security. Fujii Masao.

there's no analyzable attributes or indexes. We also used to report 0 live
and dead tuples for such tables, which messed with autovacuum threshold
calculations.

This fixes bug #4812 reported by George Su. Backpatch back to 8.1.

minimal regression test coverage for matchPartialInPendingList().

copies?) to ensure they really don't run proc_exit/shmem_exit callbacks,
as was intended.  I broke this behavior recently by installing atexit
callbacks without thinking about the one case where we truly don't want
to run those callback functions.  Noted in an example from Dave Page.

Per suggestion of Jaime Casanova.

is run at the end of archive recovery, providing a chance to do external
cleanup. Modify pg_standby so that it no longer removes the trigger file,
that is to be done using the recovery_end_command now.

Provide a "smart" failover mode in pg_standby, where we don't fail over
immediately, but only after recovering all unapplied WAL from the archive.
That gives you zero data loss assuming all WAL was archived before
failover, which is what most users of pg_standby actually want.

recovery_end_command by Simon Riggs, pg_standby changes by Fujii Masao and
myself.

that aren't RELKIND_RELATION or RELKIND_VIEW, and to disallow attaching rules
to system relations unless allowSystemTableMods is on.  This is to make the
behavior of CREATE RULE more like CREATE TRIGGER, which disallows the
comparable cases.  Per discussion of bug #4808.