E.49. Release 9.3.2

E.49.1. Migration to Version 9.3.2

A dump/restore is not required for those running 9.3.X.

However, this release corrects a number of potential data corruption issues. See the first three changelog entries below to find out whether your installation has been affected and what steps you can take if so.

Also, if you are upgrading from a version earlier than 9.3.1, see Section E.50.

E.49.2. Changes

• Fix VACUUM's tests to see whether it can update relfrozenxid (Andres Freund)

  In some cases VACUUM (either manual or autovacuum) could incorrectly advance a table's relfrozenxid value, allowing tuples to escape freezing, causing those rows to become invisible once 2^31 transactions have elapsed. The probability of data loss is fairly low since multiple incorrect advancements would need to happen before actual loss occurs, but it's not zero. In 9.2.0 and later, the probability of loss is higher, and it's also possible to get "could not access status of transaction" errors as a consequence of this bug. Users upgrading from releases 9.0.4 or 8.4.8 or earlier are not affected, but all later versions contain the bug.

  The issue can be ameliorated by, after upgrading, vacuuming all tables in all databases while having vacuum_freeze_table_age set to zero. This will fix any latent corruption but will not be able to fix all pre-existing data errors. However, an installation can be presumed safe after performing this vacuuming if it has executed fewer than 2^31 update transactions in its lifetime (check this with SELECT txid_current() < 2^31).

• Fix multiple bugs in MultiXactId freezing (Andres Freund, Álvaro Herrera)

  These bugs could lead to "could not access status of transaction" errors, or to duplicate or vanishing rows. Users upgrading from releases prior to 9.3.0 are not affected.

  The issue can be ameliorated by, after upgrading, vacuuming all tables in all databases while having vacuum_freeze_table_age set to zero. This will fix latent corruption but will not be able to fix all pre-existing data errors.

  As a separate issue, these bugs can also cause standby servers to get out of sync with the primary, thus exhibiting data errors that are not in the primary. Therefore, it's recommended that 9.3.0 and 9.3.1 standby servers be re-cloned from the primary (e.g., with a new base backup) after upgrading.

• Fix initialization of pg_clog and pg_subtrans during hot standby startup (Andres Freund, Heikki Linnakangas)

  This bug can cause data loss on standby servers at the moment they start to accept hot-standby queries, by marking committed transactions as uncommitted. The likelihood of such corruption is small unless, at the time of standby startup, the primary server has executed many updating transactions since its last checkpoint. Symptoms include missing rows, rows that should have been deleted being still visible, and obsolete versions of updated rows being still visible alongside their newer versions.

  This bug was introduced in versions 9.3.0, 9.2.5, 9.1.10, and 9.0.14. Standby servers that have only been running earlier releases are not at risk. It's recommended that standby servers that have ever run any of the buggy releases be re-cloned from the primary (e.g., with a new base backup) after upgrading.

• Fix multiple bugs in update chain traversal (Andres Freund, Álvaro Herrera)

  These bugs could result in incorrect behavior, such as locking or even updating the wrong row, in the presence of concurrent updates. Spurious "unable to fetch updated version of tuple" errors were also possible.

• Fix dangling-pointer problem in fast-path locking (Tom Lane)

  This could lead to corruption of the lock data structures in shared memory, causing "lock already held" and other odd errors.

• Fix assorted race conditions in timeout management (Tom Lane)

  These errors could result in a server process becoming unresponsive because it had blocked SIGALRM and/or SIGINT.

• Truncate pg_multixact contents during WAL replay (Andres Freund)

  This avoids ever-increasing disk space consumption in standby servers.

• Ensure an anti-wraparound VACUUM counts a page as scanned when it's only verified that no tuples need freezing (Sergey Burladyan, Jeff Janes)

  This bug could result in failing to advance relfrozenxid, so that the table would still be thought to need another anti-wraparound vacuum. In the worst case the database might even shut down to prevent wraparound.

• Fix full-table-vacuum request mechanism for MultiXactIds (Andres Freund)

  This bug could result in large amounts of useless autovacuum activity.

• Fix race condition in GIN index posting tree page deletion (Heikki Linnakangas)

  This could lead to transient wrong answers or query failures.

• Fix "unexpected spgdoinsert() failure" error during SP-GiST index creation (Teodor Sigaev)

• Fix assorted bugs in materialized views (Kevin Grittner, Andres Freund)

• Re-allow duplicate table aliases if they're within aliased JOINs (Tom Lane)

  Historically PostgreSQL has accepted queries like

  SELECT ... FROM tab1 x CROSS JOIN (tab2 x CROSS JOIN tab3 y) z

  although a strict reading of the SQL standard would forbid the duplicate usage of table alias x. A misguided change in 9.3.0 caused it to reject some such cases that were formerly accepted. Restore the previous behavior.

• Avoid flattening a subquery whose SELECT list contains a volatile function wrapped inside a sub-SELECT (Tom Lane)

  This avoids unexpected results due to extra evaluations of the volatile function.

• Fix planner's processing of non-simple-variable subquery outputs nested within outer joins (Tom Lane)

  This error could lead to incorrect plans for queries involving multiple levels of subqueries within JOIN syntax.

• Fix incorrect planning in cases where the same non-strict expression appears in multiple WHERE and outer JOIN equality clauses (Tom Lane)

• Fix planner crash with whole-row reference to a subquery (Tom Lane)

• Fix incorrect generation of optimized MIN()/MAX() plans for inheritance trees (Tom Lane)

  The planner could fail in cases where the MIN()/MAX() argument was an expression rather than a simple variable.

• Fix premature deletion of temporary files (Andres Freund)

• Prevent intra-transaction memory leak when printing range values (Tom Lane)

  This fix actually cures transient memory leaks in any datatype output function, but range types are the only ones known to have had a significant problem.

• Fix memory leaks when reloading configuration files (Heikki Linnakangas, Hari Babu)

• Prevent incorrect display of dropped columns in NOT NULL and CHECK constraint violation messages (Michael Paquier and Tom Lane)

• Allow default arguments and named-argument notation for window functions (Tom Lane)

  Previously, these cases were likely to crash.

• Suppress trailing whitespace on each line when pretty-printing rules and views (Tom Lane)

  9.3.0 generated such whitespace in many more cases than previous versions did. To reduce unexpected behavioral changes, suppress unnecessary whitespace in all cases.

• Fix possible read past end of memory in rule printing (Peter Eisentraut)

• Fix array slicing of int2vector and oidvector values (Tom Lane)

  Expressions of this kind are now implicitly promoted to regular int2 or oid arrays.

• Return a valid JSON value when converting an empty hstore value to json (Oskari Saarenmaa)

• Fix incorrect behaviors when using a SQL-standard, simple GMT offset timezone (Tom Lane)

  In some cases, the system would use the simple GMT offset value when it should have used the regular timezone setting that had prevailed before the simple offset was selected. This change also causes the timeofday function to honor the simple GMT offset zone.

• Prevent possible misbehavior when logging translations of Windows error codes (Tom Lane)

• Properly quote generated command lines in pg_ctl (Naoya Anzai and Tom Lane)

  This fix applies only to Windows.

• Fix pg_dumpall to work when a source database sets default_transaction_read_only via ALTER DATABASE SET (Kevin Grittner)

  Previously, the generated script would fail during restore.

• Fix pg_isready to handle its -d option properly (Fabrízio de Royes Mello and Fujii Masao)

• Fix parsing of WAL file names in pg_receivexlog (Heikki Linnakangas)

  This error made pg_receivexlog unable to restart streaming after stopping, once at least 4 GB of WAL had been written.

• Report out-of-disk-space failures properly in pg_upgrade (Peter Eisentraut)

• Make ecpg search for quoted cursor names case-sensitively (Zoltán Böszörményi)

• Fix ecpg's processing of lists of variables declared varchar (Zoltán Böszörményi)

• Make contrib/lo defend against incorrect trigger definitions (Marc Cousin)

• Update time zone data files to tzdata release 2013h for DST law changes in Argentina, Brazil, Jordan, Libya, Liechtenstein, Morocco, and Palestine. Also, new timezone abbreviations WIB, WIT, WITA for Indonesia.