## E.167. Release 9.2.2

Release date: 2012-12-06

This release contains a variety of fixes from 9.2.1. For information about new features in the 9.2 major release, see Section E.169.

### E.167.1. Migration to Version 9.2.2

A dump/restore is not required for those running 9.2.X.

However, you may need to perform `REINDEX` operations to correct problems in concurrently-built indexes, as described in the first changelog item below.

Also, if you are upgrading from version 9.2.0, see Section E.168.

### E.167.2. Changes

- Fix multiple bugs associated with `CREATE/DROP INDEX CONCURRENTLY` (Andres Freund, Tom Lane, Simon Riggs, Pavan Deolasee)

  An error introduced while adding `DROP INDEX CONCURRENTLY` allowed incorrect indexing decisions to be made during the initial phase of `CREATE INDEX CONCURRENTLY`; so that indexes built by that command could be corrupt. It is recommended that indexes built in 9.2.X with `CREATE INDEX CONCURRENTLY` be rebuilt after applying this update.

  In addition, fix `CREATE/DROP INDEX CONCURRENTLY` to use in-place updates when changing the state of an index's `pg_index` row. This prevents race conditions that could cause concurrent sessions to miss updating the target index, thus again resulting in corrupt concurrently-created indexes.

  Also, fix various other operations to ensure that they ignore invalid indexes resulting from a failed `CREATE INDEX CONCURRENTLY` command. The most important of these is `VACUUM`, because an auto-vacuum could easily be launched on the table before corrective action can be taken to fix or remove the invalid index.

  Also fix `DROP INDEX CONCURRENTLY` to not disable insertions into the target index until all queries using it are done.

  Also fix misbehavior if `DROP INDEX CONCURRENTLY` is canceled: the previous coding could leave an un-droppable index behind.

- Correct predicate locking for `DROP INDEX CONCURRENTLY` (Kevin Grittner)

  Previously, SSI predicate locks were processed at the wrong time, possibly leading to incorrect behavior of serializable transactions executing in parallel with the `DROP`.

- Fix buffer locking during WAL replay (Tom Lane)

  The WAL replay code was insufficiently careful about locking buffers when replaying WAL records that affect more than one page. This could result in hot standby queries transiently seeing inconsistent states, resulting in wrong answers or unexpected failures.

- Fix an error in WAL generation logic for GIN indexes (Tom Lane)

  This could result in index corruption, if a torn-page failure occurred.

- Fix an error in WAL replay logic for SP-GiST indexes (Tom Lane)

  This could result in index corruption after a crash, or on a standby server.

- Fix incorrect detection of end-of-base-backup location during WAL recovery (Heikki Linnakangas)

  This mistake allowed hot standby mode to start up before the database reaches a consistent state.

- Properly remove startup process's virtual XID lock when promoting a hot standby server to normal running (Simon Riggs)

  This oversight could prevent subsequent execution of certain operations such as `CREATE INDEX CONCURRENTLY`.

- Avoid bogus “out-of-sequence timeline ID” errors in standby mode (Heikki Linnakangas)

- Prevent the postmaster from launching new child processes after it's received a shutdown signal (Tom Lane)

  This mistake could result in shutdown taking longer than it should, or even never completing at all without additional user action.

- Fix the syslogger process to not fail when `log_rotation_age` exceeds 2^31 milliseconds (about 25 days) (Tom Lane)

- Fix `WaitLatch()` to return promptly when the requested timeout expires (Jeff Janes, Tom Lane)

  With the previous coding, a steady stream of non-wait-terminating interrupts could delay return from `WaitLatch()` indefinitely. This has been shown to be a problem for the autovacuum launcher process, and might cause trouble elsewhere as well.

- Avoid corruption of internal hash tables when out of memory (Hitoshi Harada)

- Prevent file descriptors for dropped tables from being held open past transaction end (Tom Lane)

  This should reduce problems with long-since-dropped tables continuing to occupy disk space.

- Prevent database-wide crash and restart when a new child process is unable to create a pipe for its latch (Tom Lane)

  Although the new process must fail, there is no good reason to force a database-wide restart, so avoid that. This improves robustness when the kernel is nearly out of file descriptors.

- Avoid planner crash with joins to unflattened subqueries (Tom Lane)

- Fix planning of non-strict equivalence clauses above outer joins (Tom Lane)

  The planner could derive incorrect constraints from a clause equating a non-strict construct to something else, for example `WHERE COALESCE(foo, 0) = 0` when `foo` is coming from the nullable side of an outer join. 9.2 showed this type of error in more cases than previous releases, but the basic bug has been there for a long time.

- Fix `SELECT DISTINCT` with index-optimized `MIN`/`MAX` on an inheritance tree (Tom Lane)

  The planner would fail with “failed to re-find MinMaxAggInfo record” given this combination of factors.

- Make sure the planner sees implicit and explicit casts as equivalent for all purposes, except in the minority of cases where there's actually a semantic difference (Tom Lane)

- Include join clauses when considering whether partial indexes can be used for a query (Tom Lane)

  A strict join clause can be sufficient to establish an `x` `IS NOT NULL` predicate, for example. This fixes a planner regression in 9.2, since previous versions could make comparable deductions.

- Limit growth of planning time when there are many indexable join clauses for the same index (Tom Lane)

- Improve planner's ability to prove exclusion constraints from equivalence classes (Tom Lane)

- Fix partial-row matching in hashed subplans to handle cross-type cases correctly (Tom Lane)

  This affects multicolumn `NOT IN` subplans, such as `WHERE (a, b) NOT IN (SELECT x, y FROM ...)` when for instance `b` and `y` are `int4` and `int8` respectively. This mistake led to wrong answers or crashes depending on the specific datatypes involved.

- Fix btree mark/restore functions to handle array keys (Tom Lane)

  This oversight could result in wrong answers from merge joins whose inner side is an index scan using an ``indexed_column` = ANY(`array`)` condition.

- Revert patch for taking fewer snapshots (Tom Lane)

  The 9.2 change to reduce the number of snapshots taken during query execution led to some anomalous behaviors not seen in previous releases, because execution would proceed with a snapshot acquired before locking the tables used by the query. Thus, for example, a query would not be guaranteed to see updates committed by a preceding transaction even if that transaction had exclusive lock. We'll probably revisit this in future releases, but meanwhile put it back the way it was before 9.2.

- Acquire buffer lock when re-fetching the old tuple for an `AFTER ROW UPDATE/DELETE` trigger (Andres Freund)

  In very unusual circumstances, this oversight could result in passing incorrect data to a trigger `WHEN` condition, or to the precheck logic for a foreign-key enforcement trigger. That could result in a crash, or in an incorrect decision about whether to fire the trigger.

- Fix `ALTER COLUMN TYPE` to handle inherited check constraints properly (Pavan Deolasee)

  This worked correctly in pre-8.4 releases, and now works correctly in 8.4 and later.

- Fix `ALTER EXTENSION SET SCHEMA`'s failure to move some subsidiary objects into the new schema (Álvaro Herrera, Dimitri Fontaine)

- Handle `CREATE TABLE AS EXECUTE` correctly in extended query protocol (Tom Lane)

- Don't modify the input parse tree in `DROP RULE IF NOT EXISTS` and `DROP TRIGGER IF NOT EXISTS` (Tom Lane)

  This mistake would cause errors if a cached statement of one of these types was re-executed.

- Fix `REASSIGN OWNED` to handle grants on tablespaces (Álvaro Herrera)

- Ignore incorrect `pg_attribute` entries for system columns for views (Tom Lane)

  Views do not have any system columns. However, we forgot to remove such entries when converting a table to a view. That's fixed properly for 9.3 and later, but in previous branches we need to defend against existing mis-converted views.

- Fix rule printing to dump `INSERT INTO `table` DEFAULT VALUES` correctly (Tom Lane)

- Guard against stack overflow when there are too many `UNION`/`INTERSECT`/`EXCEPT` clauses in a query (Tom Lane)

- Prevent platform-dependent failures when dividing the minimum possible integer value by -1 (Xi Wang, Tom Lane)

- Fix possible access past end of string in date parsing (Hitoshi Harada)

- Fix failure to advance XID epoch if XID wraparound happens during a checkpoint and `wal_level` is `hot_standby` (Tom Lane, Andres Freund)

  While this mistake had no particular impact on PostgreSQL itself, it was bad for applications that rely on `txid_current()` and related functions: the TXID value would appear to go backwards.

- Fix `pg_terminate_backend()` and `pg_cancel_backend()` to not throw error for a non-existent target process (Josh Kupershmidt)

  This case already worked as intended when called by a superuser, but not so much when called by ordinary users.

- Fix display of `pg_stat_replication`.`sync_state` at a page boundary (Kyotaro Horiguchi)

- Produce an understandable error message if the length of the path name for a Unix-domain socket exceeds the platform-specific limit (Tom Lane, Andrew Dunstan)

  Formerly, this would result in something quite unhelpful, such as “Non-recoverable failure in name resolution”.

- Fix memory leaks when sending composite column values to the client (Tom Lane)

- Save some cycles by not searching for subtransaction locks at commit (Simon Riggs)

  In a transaction holding many exclusive locks, this useless activity could be quite costly.

- Make pg_ctl more robust about reading the `postmaster.pid` file (Heikki Linnakangas)

  This fixes race conditions and possible file descriptor leakage.

- Fix possible crash in psql if incorrectly-encoded data is presented and the `client_encoding` setting is a client-only encoding, such as SJIS (Jiang Guiqing)

- Make pg_dump dump `SEQUENCE SET` items in the data not pre-data section of the archive (Tom Lane)

  This fixes an undesirable inconsistency between the meanings of `--data-only` and `--section=data`, and also fixes dumping of sequences that are marked as extension configuration tables.

- Fix pg_dump's handling of `DROP DATABASE` commands in `--clean` mode (Guillaume Lelarge)

  Beginning in 9.2.0, `pg_dump --clean` would issue a `DROP DATABASE` command, which was either useless or dangerous depending on the usage scenario. It no longer does that. This change also fixes the combination of `--clean` and `--create` to work sensibly, i.e., emit `DROP DATABASE` then `CREATE DATABASE` before reconnecting to the target database.

- Fix pg_dump for views with circular dependencies and no relation options (Tom Lane)

  The previous fix to dump relation options when a view is involved in a circular dependency didn't work right for the case that the view has no options; it emitted `ALTER VIEW foo SET ()` which is invalid syntax.

- Fix bugs in the `restore.sql` script emitted by pg_dump in `tar` output format (Tom Lane)

  The script would fail outright on tables whose names include upper-case characters. Also, make the script capable of restoring data in `--inserts` mode as well as the regular COPY mode.

- Fix pg_restore to accept POSIX-conformant `tar` files (Brian Weaver, Tom Lane)

  The original coding of pg_dump's `tar` output mode produced files that are not fully conformant with the POSIX standard. This has been corrected for version 9.3. This patch updates previous branches so that they will accept both the incorrect and the corrected formats, in hopes of avoiding compatibility problems when 9.3 comes out.

- Fix `tar` files emitted by pg_basebackup to be POSIX conformant (Brian Weaver, Tom Lane)

- Fix pg_resetxlog to locate `postmaster.pid` correctly when given a relative path to the data directory (Tom Lane)

  This mistake could lead to pg_resetxlog not noticing that there is an active postmaster using the data directory.

- Fix libpq's `lo_import()` and `lo_export()` functions to report file I/O errors properly (Tom Lane)

- Fix ecpg's processing of nested structure pointer variables (Muhammad Usama)

- Fix ecpg's `ecpg_get_data` function to handle arrays properly (Michael Meskes)

- Prevent pg_upgrade from trying to process TOAST tables for system catalogs (Bruce Momjian)

  This fixes an error seen when the `information_schema` has been dropped and recreated. Other failures were also possible.

- Improve pg_upgrade performance by setting `synchronous_commit` to `off` in the new cluster (Bruce Momjian)

- Make `contrib/pageinspect`'s btree page inspection functions take buffer locks while examining pages (Tom Lane)

- Work around unportable behavior of `malloc(0)` and `realloc(NULL, 0)` (Tom Lane)

  On platforms where these calls return `NULL`, some code mistakenly thought that meant out-of-memory. This is known to have broken pg_dump for databases containing no user-defined aggregates. There might be other cases as well.

- Ensure that `make install` for an extension creates the `extension` installation directory (Cédric Villemain)

  Previously, this step was missed if `MODULEDIR` was set in the extension's Makefile.

- Fix pgxs support for building loadable modules on AIX (Tom Lane)

  Building modules outside the original source tree didn't work on AIX.

- Update time zone data files to tzdata release 2012j for DST law changes in Cuba, Israel, Jordan, Libya, Palestine, Western Samoa, and portions of Brazil.