Fix VACUUM's tests to see whether it can update relfrozenxid (Andres Freund)

In some cases VACUUM (either manual or autovacuum) could incorrectly advance a table's relfrozenxid value, allowing tuples to escape freezing, causing those rows to become invisible once 2^31 transactions have elapsed. The probability of data loss is fairly low since multiple incorrect advancements would need to happen before actual loss occurs, but it's not zero. In 9.2.0 and later, the probability of loss is higher, and it's also possible to get “could not access status of transaction” errors as a consequence of this bug. Users upgrading from releases 9.0.4 or 8.4.8 or earlier are not affected, but all later versions contain the bug.

The issue can be ameliorated by, after upgrading, vacuuming all tables in all databases while having vacuum_freeze_table_age set to zero. This will fix any latent corruption but will not be able to fix all pre-existing data errors. However, an installation can be presumed safe after performing this vacuuming if it has executed fewer than 2^31 update transactions in its lifetime (check this with SELECT txid_current() < 2^31).

Fix initialization of pg_clog and pg_subtrans during hot standby startup (Andres Freund, Heikki Linnakangas)

This bug can cause data loss on standby servers at the moment they start to accept hot-standby queries, by marking committed transactions as uncommitted. The likelihood of such corruption is small unless, at the time of standby startup, the primary server has executed many updating transactions since its last checkpoint. Symptoms include missing rows, rows that should have been deleted being still visible, and obsolete versions of updated rows being still visible alongside their newer versions.

This bug was introduced in versions 9.3.0, 9.2.5, 9.1.10, and 9.0.14. Standby servers that have only been running earlier releases are not at risk. It's recommended that standby servers that have ever run any of the buggy releases be re-cloned from the primary (e.g., with a new base backup) after upgrading.

Fix dangling-pointer problem in fast-path locking (Tom Lane)

This could lead to corruption of the lock data structures in shared memory, causing “lock already held” and other odd errors.

Truncate pg_multixact contents during WAL replay (Andres Freund)

This avoids ever-increasing disk space consumption in standby servers.

Ensure an anti-wraparound VACUUM counts a page as scanned when it's only verified that no tuples need freezing (Sergey Burladyan, Jeff Janes)

This bug could result in failing to advance relfrozenxid, so that the table would still be thought to need another anti-wraparound vacuum. In the worst case the database might even shut down to prevent wraparound.

Fix race condition in GIN index posting tree page deletion (Heikki Linnakangas)

This could lead to transient wrong answers or query failures.

Fix “unexpected spgdoinsert() failure” error during SP-GiST index creation (Teodor Sigaev)

Avoid flattening a subquery whose SELECT list contains a volatile function wrapped inside a sub-SELECT (Tom Lane)

This avoids unexpected results due to extra evaluations of the volatile function.

Fix planner's processing of non-simple-variable subquery outputs nested within outer joins (Tom Lane)

This error could lead to incorrect plans for queries involving multiple levels of subqueries within JOIN syntax.

Fix incorrect planning in cases where the same non-strict expression appears in multiple WHERE and outer JOIN equality clauses (Tom Lane)

Fix planner crash with whole-row reference to a subquery (Tom Lane)

Fix incorrect generation of optimized MIN()/MAX() plans for inheritance trees (Tom Lane)

The planner could fail in cases where the MIN()/MAX() argument was an expression rather than a simple variable.

Fix premature deletion of temporary files (Andres Freund)

Prevent intra-transaction memory leak when printing range values (Tom Lane)

This fix actually cures transient memory leaks in any datatype output function, but range types are the only ones known to have had a significant problem.

Prevent incorrect display of dropped columns in NOT NULL and CHECK constraint violation messages (Michael Paquier and Tom Lane)

Allow default arguments and named-argument notation for window functions (Tom Lane)

Previously, these cases were likely to crash.

Fix possible read past end of memory in rule printing (Peter Eisentraut)

Fix array slicing of int2vector and oidvector values (Tom Lane)

Expressions of this kind are now implicitly promoted to regular int2 or oid arrays.

Fix incorrect behaviors when using a SQL-standard, simple GMT offset timezone (Tom Lane)

In some cases, the system would use the simple GMT offset value when it should have used the regular timezone setting that had prevailed before the simple offset was selected. This change also causes the timeofday function to honor the simple GMT offset zone.

Prevent possible misbehavior when logging translations of Windows error codes (Tom Lane)

Properly quote generated command lines in pg_ctl (Naoya Anzai and Tom Lane)

This fix applies only to Windows.

Fix pg_dumpall to work when a source database sets default_transaction_read_only via ALTER DATABASE SET (Kevin Grittner)

Previously, the generated script would fail during restore.

Make ecpg search for quoted cursor names case-sensitively (Zoltán Böszörményi)

Fix ecpg's processing of lists of variables declared varchar (Zoltán Böszörményi)

Make contrib/lo defend against incorrect trigger definitions (Marc Cousin)

Update time zone data files to tzdata release 2013h for DST law changes in Argentina, Brazil, Jordan, Libya, Liechtenstein, Morocco, and Palestine. Also, new timezone abbreviations WIB, WIT, WITA for Indonesia.