From c67989789cec3953effca4e01dff834abff9116a Mon Sep 17 00:00:00 2001
From: Amit Langote <amitlan@postgresql.org>
Date: Tue, 1 Jul 2025 13:13:48 +0900
Subject: [PATCH 1/6] Fix typos in comments

Commit 19d8e2308bc added enum values with the prefix TU_, but a few
comments still referred to TUUI_, which was used in development
versions of the patches committed as 19d8e2308bc.

Author: Yugo Nagata <nagata@sraoss.co.jp>
Discussion: https://postgr.es/m/20250701110216.8ac8a9e4c6f607f1d954f44a@sraoss.co.jp
Backpatch-through: 16
---
 src/backend/executor/execIndexing.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/backend/executor/execIndexing.c b/src/backend/executor/execIndexing.c
index bdf862b24062e..ca33a854278ed 100644
--- a/src/backend/executor/execIndexing.c
+++ b/src/backend/executor/execIndexing.c
@@ -279,7 +279,7 @@ ExecCloseIndices(ResultRelInfo *resultRelInfo)
  *		executor is performing an UPDATE that could not use an
  *		optimization like heapam's HOT (in more general terms a
  *		call to table_tuple_update() took place and set
- *		'update_indexes' to TUUI_All).  Receiving this hint makes
+ *		'update_indexes' to TU_All).  Receiving this hint makes
  *		us consider if we should pass down the 'indexUnchanged'
  *		hint in turn.  That's something that we figure out for
  *		each index_insert() call iff 'update' is true.
@@ -290,7 +290,7 @@ ExecCloseIndices(ResultRelInfo *resultRelInfo)
  *		HOT has been applied and any updated columns are indexed
  *		only by summarizing indexes (or in more general terms a
  *		call to table_tuple_update() took place and set
- *		'update_indexes' to TUUI_Summarizing). We can (and must)
+ *		'update_indexes' to TU_Summarizing). We can (and must)
  *		therefore only update the indexes that have
  *		'amsummarizing' = true.
  *

From 732061150b004385810e522f8629f5bf91d977b7 Mon Sep 17 00:00:00 2001
From: Michael Paquier <michael@paquier.xyz>
Date: Tue, 1 Jul 2025 15:48:32 +0900
Subject: [PATCH 2/6] xml2: Improve error handling of libxml2 calls

The contrib module xml2/ has always been fuzzy with the cleanup of the
memory allocated by the calls internal to libxml2, even if there are
APIs in place giving a lot of control over the error behavior, all
located in the backend's xml.c.

The code paths fixed in the commit address multiple defects, while
sanitizing the code:
- In xpath.c, several allocations are done by libxml2 for
xpath_workspace, whose memory cleanup could go out of sight as it relied
on a single TRY/CATCH block done in pgxml_xpath().  workspace->res is
allocated by libxml2, and may finish by not being freed at all upon a
failure outside of a TRY area.  This code is refactored so as the
TRY/CATCH block of pgxml_xpath() is moved one level higher to its
callers, which are responsible for cleaning up the contents of a
workspace on failure.  cleanup_workspace() now requires a volatile
workspace, forcing as a rule that a TRY/CATCH block should be used.
- Several calls, like xmlStrdup(), xmlXPathNewContext(),
xmlXPathCtxtCompile(), etc. can return NULL on failures (for most of
them allocation failures.  These forgot to check for failures, or missed
that pg_xml_error_occurred() should be called, to check if an error is
already on the stack.
- Some memory allocated by libxml2 calls was freed in an incorrect way,
"resstr" in xslt_process() being one example.

The class of errors fixed here are for problems that are unlikely going
to happen in practice, so no backpatch is done.  The changes have
finished by being rather invasive, so it is perhaps not a bad thing to
be conservative and to keep these changes only on HEAD anyway.

Author: Michael Paquier <michael@paquier.xyz>
Reported-by: Karavaev Alexey <maralist86@mail.ru>
Reviewed-by: Jim Jones <jim.jones@uni-muenster.de>
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://postgr.es/m/18943-2f2a04ab03904598@postgresql.org
---
 contrib/xml2/xpath.c     | 421 ++++++++++++++++++++++++++-------------
 contrib/xml2/xslt_proc.c |  26 ++-
 2 files changed, 296 insertions(+), 151 deletions(-)

diff --git a/contrib/xml2/xpath.c b/contrib/xml2/xpath.c
index 23d3f332dbaa7..3f733405ec6db 100644
--- a/contrib/xml2/xpath.c
+++ b/contrib/xml2/xpath.c
@@ -51,10 +51,10 @@ static text *pgxml_result_to_text(xmlXPathObjectPtr res, xmlChar *toptag,
 
 static xmlChar *pgxml_texttoxmlchar(text *textstring);
 
-static xmlXPathObjectPtr pgxml_xpath(text *document, xmlChar *xpath,
-									 xpath_workspace *workspace);
+static xpath_workspace *pgxml_xpath(text *document, xmlChar *xpath,
+									PgXmlErrorContext *xmlerrcxt);
 
-static void cleanup_workspace(xpath_workspace *workspace);
+static void cleanup_workspace(volatile xpath_workspace *workspace);
 
 
 /*
@@ -89,18 +89,40 @@ xml_encode_special_chars(PG_FUNCTION_ARGS)
 {
 	text	   *tin = PG_GETARG_TEXT_PP(0);
 	text	   *tout;
-	xmlChar    *ts,
-			   *tt;
+	volatile xmlChar *tt = NULL;
+	PgXmlErrorContext *xmlerrcxt;
+
+	xmlerrcxt = pg_xml_init(PG_XML_STRICTNESS_ALL);
+
+	PG_TRY();
+	{
+		xmlChar    *ts;
 
-	ts = pgxml_texttoxmlchar(tin);
+		ts = pgxml_texttoxmlchar(tin);
+
+		tt = xmlEncodeSpecialChars(NULL, ts);
+		if (tt == NULL || pg_xml_error_occurred(xmlerrcxt))
+			xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+						"could not allocate xmlChar");
+		pfree(ts);
+
+		tout = cstring_to_text((char *) tt);
+	}
+	PG_CATCH();
+	{
+		if (tt != NULL)
+			xmlFree((xmlChar *) tt);
 
-	tt = xmlEncodeSpecialChars(NULL, ts);
+		pg_xml_done(xmlerrcxt, true);
 
-	pfree(ts);
+		PG_RE_THROW();
+	}
+	PG_END_TRY();
 
-	tout = cstring_to_text((char *) tt);
+	if (tt != NULL)
+		xmlFree((xmlChar *) tt);
 
-	xmlFree(tt);
+	pg_xml_done(xmlerrcxt, false);
 
 	PG_RETURN_TEXT_P(tout);
 }
@@ -122,62 +144,90 @@ pgxmlNodeSetToText(xmlNodeSetPtr nodeset,
 				   xmlChar *septagname,
 				   xmlChar *plainsep)
 {
-	xmlBufferPtr buf;
+	volatile xmlBufferPtr buf = NULL;
 	xmlChar    *result;
 	int			i;
+	PgXmlErrorContext *xmlerrcxt;
 
-	buf = xmlBufferCreate();
+	/* spin some error handling */
+	xmlerrcxt = pg_xml_init(PG_XML_STRICTNESS_ALL);
 
-	if ((toptagname != NULL) && (xmlStrlen(toptagname) > 0))
-	{
-		xmlBufferWriteChar(buf, "<");
-		xmlBufferWriteCHAR(buf, toptagname);
-		xmlBufferWriteChar(buf, ">");
-	}
-	if (nodeset != NULL)
+	PG_TRY();
 	{
-		for (i = 0; i < nodeset->nodeNr; i++)
-		{
-			if (plainsep != NULL)
-			{
-				xmlBufferWriteCHAR(buf,
-								   xmlXPathCastNodeToString(nodeset->nodeTab[i]));
+		buf = xmlBufferCreate();
 
-				/* If this isn't the last entry, write the plain sep. */
-				if (i < (nodeset->nodeNr) - 1)
-					xmlBufferWriteChar(buf, (char *) plainsep);
-			}
-			else
+		if (buf == NULL || pg_xml_error_occurred(xmlerrcxt))
+			xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+						"could not allocate xmlBuffer");
+
+		if ((toptagname != NULL) && (xmlStrlen(toptagname) > 0))
+		{
+			xmlBufferWriteChar(buf, "<");
+			xmlBufferWriteCHAR(buf, toptagname);
+			xmlBufferWriteChar(buf, ">");
+		}
+		if (nodeset != NULL)
+		{
+			for (i = 0; i < nodeset->nodeNr; i++)
 			{
-				if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
+				if (plainsep != NULL)
 				{
-					xmlBufferWriteChar(buf, "<");
-					xmlBufferWriteCHAR(buf, septagname);
-					xmlBufferWriteChar(buf, ">");
-				}
-				xmlNodeDump(buf,
-							nodeset->nodeTab[i]->doc,
-							nodeset->nodeTab[i],
-							1, 0);
+					xmlBufferWriteCHAR(buf,
+									   xmlXPathCastNodeToString(nodeset->nodeTab[i]));
 
-				if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
+					/* If this isn't the last entry, write the plain sep. */
+					if (i < (nodeset->nodeNr) - 1)
+						xmlBufferWriteChar(buf, (char *) plainsep);
+				}
+				else
 				{
-					xmlBufferWriteChar(buf, "</");
-					xmlBufferWriteCHAR(buf, septagname);
-					xmlBufferWriteChar(buf, ">");
+					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
+					{
+						xmlBufferWriteChar(buf, "<");
+						xmlBufferWriteCHAR(buf, septagname);
+						xmlBufferWriteChar(buf, ">");
+					}
+					xmlNodeDump(buf,
+								nodeset->nodeTab[i]->doc,
+								nodeset->nodeTab[i],
+								1, 0);
+
+					if ((septagname != NULL) && (xmlStrlen(septagname) > 0))
+					{
+						xmlBufferWriteChar(buf, "</");
+						xmlBufferWriteCHAR(buf, septagname);
+						xmlBufferWriteChar(buf, ">");
+					}
 				}
 			}
 		}
-	}
 
-	if ((toptagname != NULL) && (xmlStrlen(toptagname) > 0))
+		if ((toptagname != NULL) && (xmlStrlen(toptagname) > 0))
+		{
+			xmlBufferWriteChar(buf, "</");
+			xmlBufferWriteCHAR(buf, toptagname);
+			xmlBufferWriteChar(buf, ">");
+		}
+
+		result = xmlStrdup(buf->content);
+		if (result == NULL || pg_xml_error_occurred(xmlerrcxt))
+			xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+						"could not allocate result");
+	}
+	PG_CATCH();
 	{
-		xmlBufferWriteChar(buf, "</");
-		xmlBufferWriteCHAR(buf, toptagname);
-		xmlBufferWriteChar(buf, ">");
+		if (buf)
+			xmlBufferFree(buf);
+
+		pg_xml_done(xmlerrcxt, true);
+
+		PG_RE_THROW();
 	}
-	result = xmlStrdup(buf->content);
+	PG_END_TRY();
+
 	xmlBufferFree(buf);
+	pg_xml_done(xmlerrcxt, false);
+
 	return result;
 }
 
@@ -208,16 +258,29 @@ xpath_nodeset(PG_FUNCTION_ARGS)
 	xmlChar    *septag = pgxml_texttoxmlchar(PG_GETARG_TEXT_PP(3));
 	xmlChar    *xpath;
 	text	   *xpres;
-	xmlXPathObjectPtr res;
-	xpath_workspace workspace;
+	volatile xpath_workspace *workspace;
+	PgXmlErrorContext *xmlerrcxt;
 
 	xpath = pgxml_texttoxmlchar(xpathsupp);
+	xmlerrcxt = pgxml_parser_init(PG_XML_STRICTNESS_LEGACY);
 
-	res = pgxml_xpath(document, xpath, &workspace);
+	PG_TRY();
+	{
+		workspace = pgxml_xpath(document, xpath, xmlerrcxt);
+		xpres = pgxml_result_to_text(workspace->res, toptag, septag, NULL);
+	}
+	PG_CATCH();
+	{
+		if (workspace)
+			cleanup_workspace(workspace);
 
-	xpres = pgxml_result_to_text(res, toptag, septag, NULL);
+		pg_xml_done(xmlerrcxt, true);
+		PG_RE_THROW();
+	}
+	PG_END_TRY();
 
-	cleanup_workspace(&workspace);
+	cleanup_workspace(workspace);
+	pg_xml_done(xmlerrcxt, false);
 
 	pfree(xpath);
 
@@ -240,16 +303,29 @@ xpath_list(PG_FUNCTION_ARGS)
 	xmlChar    *plainsep = pgxml_texttoxmlchar(PG_GETARG_TEXT_PP(2));
 	xmlChar    *xpath;
 	text	   *xpres;
-	xmlXPathObjectPtr res;
-	xpath_workspace workspace;
+	volatile xpath_workspace *workspace;
+	PgXmlErrorContext *xmlerrcxt;
 
 	xpath = pgxml_texttoxmlchar(xpathsupp);
+	xmlerrcxt = pgxml_parser_init(PG_XML_STRICTNESS_LEGACY);
 
-	res = pgxml_xpath(document, xpath, &workspace);
+	PG_TRY();
+	{
+		workspace = pgxml_xpath(document, xpath, xmlerrcxt);
+		xpres = pgxml_result_to_text(workspace->res, NULL, NULL, plainsep);
+	}
+	PG_CATCH();
+	{
+		if (workspace)
+			cleanup_workspace(workspace);
 
-	xpres = pgxml_result_to_text(res, NULL, NULL, plainsep);
+		pg_xml_done(xmlerrcxt, true);
+		PG_RE_THROW();
+	}
+	PG_END_TRY();
 
-	cleanup_workspace(&workspace);
+	cleanup_workspace(workspace);
+	pg_xml_done(xmlerrcxt, false);
 
 	pfree(xpath);
 
@@ -269,8 +345,8 @@ xpath_string(PG_FUNCTION_ARGS)
 	xmlChar    *xpath;
 	int32		pathsize;
 	text	   *xpres;
-	xmlXPathObjectPtr res;
-	xpath_workspace workspace;
+	volatile xpath_workspace *workspace;
+	PgXmlErrorContext *xmlerrcxt;
 
 	pathsize = VARSIZE_ANY_EXHDR(xpathsupp);
 
@@ -286,11 +362,25 @@ xpath_string(PG_FUNCTION_ARGS)
 	xpath[pathsize + 7] = ')';
 	xpath[pathsize + 8] = '\0';
 
-	res = pgxml_xpath(document, xpath, &workspace);
+	xmlerrcxt = pgxml_parser_init(PG_XML_STRICTNESS_LEGACY);
+
+	PG_TRY();
+	{
+		workspace = pgxml_xpath(document, xpath, xmlerrcxt);
+		xpres = pgxml_result_to_text(workspace->res, NULL, NULL, NULL);
+	}
+	PG_CATCH();
+	{
+		if (workspace)
+			cleanup_workspace(workspace);
 
-	xpres = pgxml_result_to_text(res, NULL, NULL, NULL);
+		pg_xml_done(xmlerrcxt, true);
+		PG_RE_THROW();
+	}
+	PG_END_TRY();
 
-	cleanup_workspace(&workspace);
+	cleanup_workspace(workspace);
+	pg_xml_done(xmlerrcxt, false);
 
 	pfree(xpath);
 
@@ -308,24 +398,38 @@ xpath_number(PG_FUNCTION_ARGS)
 	text	   *document = PG_GETARG_TEXT_PP(0);
 	text	   *xpathsupp = PG_GETARG_TEXT_PP(1);	/* XPath expression */
 	xmlChar    *xpath;
-	float4		fRes;
-	xmlXPathObjectPtr res;
-	xpath_workspace workspace;
+	float4		fRes = 0.0;
+	bool		isNull = false;
+	volatile xpath_workspace *workspace = NULL;
+	PgXmlErrorContext *xmlerrcxt;
 
 	xpath = pgxml_texttoxmlchar(xpathsupp);
+	xmlerrcxt = pgxml_parser_init(PG_XML_STRICTNESS_LEGACY);
 
-	res = pgxml_xpath(document, xpath, &workspace);
-
-	pfree(xpath);
+	PG_TRY();
+	{
+		workspace = pgxml_xpath(document, xpath, xmlerrcxt);
+		pfree(xpath);
 
-	if (res == NULL)
-		PG_RETURN_NULL();
+		if (workspace->res == NULL)
+			isNull = true;
+		else
+			fRes = xmlXPathCastToNumber(workspace->res);
+	}
+	PG_CATCH();
+	{
+		if (workspace)
+			cleanup_workspace(workspace);
 
-	fRes = xmlXPathCastToNumber(res);
+		pg_xml_done(xmlerrcxt, true);
+		PG_RE_THROW();
+	}
+	PG_END_TRY();
 
-	cleanup_workspace(&workspace);
+	cleanup_workspace(workspace);
+	pg_xml_done(xmlerrcxt, false);
 
-	if (xmlXPathIsNaN(fRes))
+	if (isNull || xmlXPathIsNaN(fRes))
 		PG_RETURN_NULL();
 
 	PG_RETURN_FLOAT4(fRes);
@@ -341,21 +445,34 @@ xpath_bool(PG_FUNCTION_ARGS)
 	text	   *xpathsupp = PG_GETARG_TEXT_PP(1);	/* XPath expression */
 	xmlChar    *xpath;
 	int			bRes;
-	xmlXPathObjectPtr res;
-	xpath_workspace workspace;
+	volatile xpath_workspace *workspace = NULL;
+	PgXmlErrorContext *xmlerrcxt;
 
 	xpath = pgxml_texttoxmlchar(xpathsupp);
+	xmlerrcxt = pgxml_parser_init(PG_XML_STRICTNESS_LEGACY);
 
-	res = pgxml_xpath(document, xpath, &workspace);
-
-	pfree(xpath);
+	PG_TRY();
+	{
+		workspace = pgxml_xpath(document, xpath, xmlerrcxt);
+		pfree(xpath);
 
-	if (res == NULL)
-		PG_RETURN_BOOL(false);
+		if (workspace->res == NULL)
+			bRes = 0;
+		else
+			bRes = xmlXPathCastToBoolean(workspace->res);
+	}
+	PG_CATCH();
+	{
+		if (workspace)
+			cleanup_workspace(workspace);
 
-	bRes = xmlXPathCastToBoolean(res);
+		pg_xml_done(xmlerrcxt, true);
+		PG_RE_THROW();
+	}
+	PG_END_TRY();
 
-	cleanup_workspace(&workspace);
+	cleanup_workspace(workspace);
+	pg_xml_done(xmlerrcxt, false);
 
 	PG_RETURN_BOOL(bRes);
 }
@@ -364,62 +481,44 @@ xpath_bool(PG_FUNCTION_ARGS)
 
 /* Core function to evaluate XPath query */
 
-static xmlXPathObjectPtr
-pgxml_xpath(text *document, xmlChar *xpath, xpath_workspace *workspace)
+static xpath_workspace *
+pgxml_xpath(text *document, xmlChar *xpath, PgXmlErrorContext *xmlerrcxt)
 {
 	int32		docsize = VARSIZE_ANY_EXHDR(document);
-	PgXmlErrorContext *xmlerrcxt;
 	xmlXPathCompExprPtr comppath;
+	xpath_workspace *workspace = (xpath_workspace *)
+		palloc0(sizeof(xpath_workspace));
 
 	workspace->doctree = NULL;
 	workspace->ctxt = NULL;
 	workspace->res = NULL;
 
-	xmlerrcxt = pgxml_parser_init(PG_XML_STRICTNESS_LEGACY);
-
-	PG_TRY();
+	workspace->doctree = xmlReadMemory((char *) VARDATA_ANY(document),
+									   docsize, NULL, NULL,
+									   XML_PARSE_NOENT);
+	if (workspace->doctree != NULL)
 	{
-		workspace->doctree = xmlReadMemory((char *) VARDATA_ANY(document),
-										   docsize, NULL, NULL,
-										   XML_PARSE_NOENT);
-		if (workspace->doctree != NULL)
-		{
-			workspace->ctxt = xmlXPathNewContext(workspace->doctree);
-			workspace->ctxt->node = xmlDocGetRootElement(workspace->doctree);
-
-			/* compile the path */
-			comppath = xmlXPathCtxtCompile(workspace->ctxt, xpath);
-			if (comppath == NULL)
-				xml_ereport(xmlerrcxt, ERROR, ERRCODE_INVALID_ARGUMENT_FOR_XQUERY,
-							"XPath Syntax Error");
+		workspace->ctxt = xmlXPathNewContext(workspace->doctree);
+		workspace->ctxt->node = xmlDocGetRootElement(workspace->doctree);
 
-			/* Now evaluate the path expression. */
-			workspace->res = xmlXPathCompiledEval(comppath, workspace->ctxt);
+		/* compile the path */
+		comppath = xmlXPathCtxtCompile(workspace->ctxt, xpath);
+		if (comppath == NULL || pg_xml_error_occurred(xmlerrcxt))
+			xml_ereport(xmlerrcxt, ERROR, ERRCODE_INVALID_ARGUMENT_FOR_XQUERY,
+						"XPath Syntax Error");
 
-			xmlXPathFreeCompExpr(comppath);
-		}
-	}
-	PG_CATCH();
-	{
-		cleanup_workspace(workspace);
-
-		pg_xml_done(xmlerrcxt, true);
+		/* Now evaluate the path expression. */
+		workspace->res = xmlXPathCompiledEval(comppath, workspace->ctxt);
 
-		PG_RE_THROW();
+		xmlXPathFreeCompExpr(comppath);
 	}
-	PG_END_TRY();
 
-	if (workspace->res == NULL)
-		cleanup_workspace(workspace);
-
-	pg_xml_done(xmlerrcxt, false);
-
-	return workspace->res;
+	return workspace;
 }
 
 /* Clean up after processing the result of pgxml_xpath() */
 static void
-cleanup_workspace(xpath_workspace *workspace)
+cleanup_workspace(volatile xpath_workspace *workspace)
 {
 	if (workspace->res)
 		xmlXPathFreeObject(workspace->res);
@@ -438,34 +537,59 @@ pgxml_result_to_text(xmlXPathObjectPtr res,
 					 xmlChar *septag,
 					 xmlChar *plainsep)
 {
-	xmlChar    *xpresstr;
+	volatile xmlChar *xpresstr = NULL;
+	PgXmlErrorContext *xmlerrcxt;
 	text	   *xpres;
 
 	if (res == NULL)
 		return NULL;
 
-	switch (res->type)
-	{
-		case XPATH_NODESET:
-			xpresstr = pgxmlNodeSetToText(res->nodesetval,
-										  toptag,
-										  septag, plainsep);
-			break;
+	/* spin some error handling */
+	xmlerrcxt = pg_xml_init(PG_XML_STRICTNESS_ALL);
 
-		case XPATH_STRING:
-			xpresstr = xmlStrdup(res->stringval);
-			break;
+	PG_TRY();
+	{
+		switch (res->type)
+		{
+			case XPATH_NODESET:
+				xpresstr = pgxmlNodeSetToText(res->nodesetval,
+											  toptag,
+											  septag, plainsep);
+				break;
+
+			case XPATH_STRING:
+				xpresstr = xmlStrdup(res->stringval);
+				if (xpresstr == NULL || pg_xml_error_occurred(xmlerrcxt))
+					xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+								"could not allocate result");
+				break;
+
+			default:
+				elog(NOTICE, "unsupported XQuery result: %d", res->type);
+				xpresstr = xmlStrdup((const xmlChar *) "<unsupported/>");
+				if (xpresstr == NULL || pg_xml_error_occurred(xmlerrcxt))
+					xml_ereport(xmlerrcxt, ERROR, ERRCODE_OUT_OF_MEMORY,
+								"could not allocate result");
+		}
 
-		default:
-			elog(NOTICE, "unsupported XQuery result: %d", res->type);
-			xpresstr = xmlStrdup((const xmlChar *) "<unsupported/>");
+		/* Now convert this result back to text */
+		xpres = cstring_to_text((char *) xpresstr);
 	}
+	PG_CATCH();
+	{
+		if (xpresstr != NULL)
+			xmlFree((xmlChar *) xpresstr);
 
-	/* Now convert this result back to text */
-	xpres = cstring_to_text((char *) xpresstr);
+		pg_xml_done(xmlerrcxt, true);
+
+		PG_RE_THROW();
+	}
+	PG_END_TRY();
 
 	/* Free various storage */
-	xmlFree(xpresstr);
+	xmlFree((xmlChar *) xpresstr);
+
+	pg_xml_done(xmlerrcxt, false);
 
 	return xpres;
 }
@@ -648,11 +772,16 @@ xpath_table(PG_FUNCTION_ARGS)
 					for (j = 0; j < numpaths; j++)
 					{
 						ctxt = xmlXPathNewContext(doctree);
+						if (ctxt == NULL || pg_xml_error_occurred(xmlerrcxt))
+							xml_ereport(xmlerrcxt,
+										ERROR, ERRCODE_OUT_OF_MEMORY,
+										"could not allocate XPath context");
+
 						ctxt->node = xmlDocGetRootElement(doctree);
 
 						/* compile the path */
 						comppath = xmlXPathCtxtCompile(ctxt, xpaths[j]);
-						if (comppath == NULL)
+						if (comppath == NULL || pg_xml_error_occurred(xmlerrcxt))
 							xml_ereport(xmlerrcxt, ERROR,
 										ERRCODE_INVALID_ARGUMENT_FOR_XQUERY,
 										"XPath Syntax Error");
@@ -671,6 +800,10 @@ xpath_table(PG_FUNCTION_ARGS)
 										rownr < res->nodesetval->nodeNr)
 									{
 										resstr = xmlXPathCastNodeToString(res->nodesetval->nodeTab[rownr]);
+										if (resstr == NULL || pg_xml_error_occurred(xmlerrcxt))
+											xml_ereport(xmlerrcxt,
+														ERROR, ERRCODE_OUT_OF_MEMORY,
+														"could not allocate result");
 										had_values = true;
 									}
 									else
@@ -680,11 +813,19 @@ xpath_table(PG_FUNCTION_ARGS)
 
 								case XPATH_STRING:
 									resstr = xmlStrdup(res->stringval);
+									if (resstr == NULL || pg_xml_error_occurred(xmlerrcxt))
+										xml_ereport(xmlerrcxt,
+													ERROR, ERRCODE_OUT_OF_MEMORY,
+													"could not allocate result");
 									break;
 
 								default:
 									elog(NOTICE, "unsupported XQuery result: %d", res->type);
 									resstr = xmlStrdup((const xmlChar *) "<unsupported/>");
+									if (resstr == NULL || pg_xml_error_occurred(xmlerrcxt))
+										xml_ereport(xmlerrcxt,
+													ERROR, ERRCODE_OUT_OF_MEMORY,
+													"could not allocate result");
 							}
 
 							/*
diff --git a/contrib/xml2/xslt_proc.c b/contrib/xml2/xslt_proc.c
index b720d89f754ae..c8e7dd45ed5b4 100644
--- a/contrib/xml2/xslt_proc.c
+++ b/contrib/xml2/xslt_proc.c
@@ -58,7 +58,7 @@ xslt_process(PG_FUNCTION_ARGS)
 	volatile xsltSecurityPrefsPtr xslt_sec_prefs = NULL;
 	volatile xsltTransformContextPtr xslt_ctxt = NULL;
 	volatile int resstat = -1;
-	xmlChar    *resstr = NULL;
+	volatile xmlChar *resstr = NULL;
 	int			reslen = 0;
 
 	if (fcinfo->nargs == 3)
@@ -86,7 +86,7 @@ xslt_process(PG_FUNCTION_ARGS)
 								VARSIZE_ANY_EXHDR(doct), NULL, NULL,
 								XML_PARSE_NOENT);
 
-		if (doctree == NULL)
+		if (doctree == NULL || pg_xml_error_occurred(xmlerrcxt))
 			xml_ereport(xmlerrcxt, ERROR, ERRCODE_INVALID_XML_DOCUMENT,
 						"error parsing XML document");
 
@@ -95,14 +95,14 @@ xslt_process(PG_FUNCTION_ARGS)
 							  VARSIZE_ANY_EXHDR(ssheet), NULL, NULL,
 							  XML_PARSE_NOENT);
 
-		if (ssdoc == NULL)
+		if (ssdoc == NULL || pg_xml_error_occurred(xmlerrcxt))
 			xml_ereport(xmlerrcxt, ERROR, ERRCODE_INVALID_XML_DOCUMENT,
 						"error parsing stylesheet as XML document");
 
 		/* After this call we need not free ssdoc separately */
 		stylesheet = xsltParseStylesheetDoc(ssdoc);
 
-		if (stylesheet == NULL)
+		if (stylesheet == NULL || pg_xml_error_occurred(xmlerrcxt))
 			xml_ereport(xmlerrcxt, ERROR, ERRCODE_INVALID_ARGUMENT_FOR_XQUERY,
 						"failed to parse stylesheet");
 
@@ -137,11 +137,15 @@ xslt_process(PG_FUNCTION_ARGS)
 		restree = xsltApplyStylesheetUser(stylesheet, doctree, params,
 										  NULL, NULL, xslt_ctxt);
 
-		if (restree == NULL)
+		if (restree == NULL || pg_xml_error_occurred(xmlerrcxt))
 			xml_ereport(xmlerrcxt, ERROR, ERRCODE_INVALID_ARGUMENT_FOR_XQUERY,
 						"failed to apply stylesheet");
 
-		resstat = xsltSaveResultToString(&resstr, &reslen, restree, stylesheet);
+		resstat = xsltSaveResultToString((xmlChar **) &resstr, &reslen,
+										 restree, stylesheet);
+
+		if (resstat >= 0)
+			result = cstring_to_text_with_len((char *) resstr, reslen);
 	}
 	PG_CATCH();
 	{
@@ -155,6 +159,8 @@ xslt_process(PG_FUNCTION_ARGS)
 			xsltFreeStylesheet(stylesheet);
 		if (doctree != NULL)
 			xmlFreeDoc(doctree);
+		if (resstr != NULL)
+			xmlFree((xmlChar *) resstr);
 		xsltCleanupGlobals();
 
 		pg_xml_done(xmlerrcxt, true);
@@ -170,17 +176,15 @@ xslt_process(PG_FUNCTION_ARGS)
 	xmlFreeDoc(doctree);
 	xsltCleanupGlobals();
 
+	if (resstr)
+		xmlFree((xmlChar *) resstr);
+
 	pg_xml_done(xmlerrcxt, false);
 
 	/* XXX this is pretty dubious, really ought to throw error instead */
 	if (resstat < 0)
 		PG_RETURN_NULL();
 
-	result = cstring_to_text_with_len((char *) resstr, reslen);
-
-	if (resstr)
-		xmlFree(resstr);
-
 	PG_RETURN_TEXT_P(result);
 #else							/* !USE_LIBXSLT */
 

From 8fd9bb1d9654c59d40613232ad964e9a648e4202 Mon Sep 17 00:00:00 2001
From: Peter Eisentraut <peter@eisentraut.org>
Date: Tue, 1 Jul 2025 09:36:33 +0200
Subject: [PATCH 3/6] Enable MSVC conforming preprocessor

Switch MSVC to use the conforming preprocessor, using the
/Zc:preprocessor option.

This allows us to drop the alternative implementation of
VA_ARGS_NARGS() for the previous "traditional" preprocessor.

This also prepares the way for enabling C11 mode in the future, which
enables the conforming preprocessor by default.

This now requires Visual Studio 2019.  The installation documentation
is adjusted accordingly.

Discussion: https://www.postgresql.org/message-id/flat/01a69441-af54-4822-891b-ca28e05b215a%40eisentraut.org
---
 doc/src/sgml/installation.sgml |  8 ++------
 meson.build                    |  4 ++++
 src/include/c.h                | 19 -------------------
 3 files changed, 6 insertions(+), 25 deletions(-)

diff --git a/doc/src/sgml/installation.sgml b/doc/src/sgml/installation.sgml
index de19f3ad92952..cb53530cc4fa8 100644
--- a/doc/src/sgml/installation.sgml
+++ b/doc/src/sgml/installation.sgml
@@ -3847,17 +3847,13 @@ make: *** [postgres] Error 1
    <para>
     Both 32-bit and 64-bit builds are possible with the Microsoft Compiler suite.
     32-bit PostgreSQL builds are possible with
-    <productname>Visual Studio 2015</productname> to
+    <productname>Visual Studio 2019</productname> to
     <productname>Visual Studio 2022</productname>,
     as well as standalone Windows SDK releases 10 and above.
     64-bit PostgreSQL builds are supported with
     <productname>Microsoft Windows SDK</productname> version 10 and above or
-    <productname>Visual Studio 2015</productname> and above.
+    <productname>Visual Studio 2019</productname> and above.
     <!--
-        For 2015 requirements:
-        https://docs.microsoft.com/en-us/visualstudio/productinfo/vs2015-sysrequirements-vs
-        For 2017 requirements:
-        https://docs.microsoft.com/en-us/visualstudio/productinfo/vs2017-system-requirements-vs
         For 2019 requirements:
         https://docs.microsoft.com/en-us/visualstudio/releases/2019/system-requirements
         For 2022 requirements:
diff --git a/meson.build b/meson.build
index 36e168a1a2ace..91fb4756ed433 100644
--- a/meson.build
+++ b/meson.build
@@ -279,6 +279,10 @@ elif host_system == 'windows'
     # define before including <time.h> for getting localtime_r() etc. on MinGW
     cppflags += '-D_POSIX_C_SOURCE'
   endif
+  if cc.get_id() == 'msvc'
+    # required for VA_ARGS_NARGS() in c.h; requires VS 2019
+    cppflags += '/Zc:preprocessor'
+  endif
 
   export_file_format = 'win'
   export_file_suffix = 'def'
diff --git a/src/include/c.h b/src/include/c.h
index 8cdc16a0f4a9b..04fd23577dee7 100644
--- a/src/include/c.h
+++ b/src/include/c.h
@@ -376,25 +376,7 @@
  * pretty trivial: VA_ARGS_NARGS_() returns its 64th argument, and we set up
  * the call so that that is the appropriate one of the list of constants.
  * This idea is due to Laurent Deniau.
- *
- * MSVC has an implementation of __VA_ARGS__ that doesn't conform to the
- * standard unless you use the /Zc:preprocessor compiler flag, but that
- * isn't available before Visual Studio 2019.  For now, use a different
- * definition that also works on older compilers.
  */
-#ifdef _MSC_VER
-#define EXPAND(args) args
-#define VA_ARGS_NARGS(...) \
-	VA_ARGS_NARGS_ EXPAND((__VA_ARGS__, \
-				   63,62,61,60,                   \
-				   59,58,57,56,55,54,53,52,51,50, \
-				   49,48,47,46,45,44,43,42,41,40, \
-				   39,38,37,36,35,34,33,32,31,30, \
-				   29,28,27,26,25,24,23,22,21,20, \
-				   19,18,17,16,15,14,13,12,11,10, \
-				   9, 8, 7, 6, 5, 4, 3, 2, 1, 0))
-#else
-
 #define VA_ARGS_NARGS(...) \
 	VA_ARGS_NARGS_(__VA_ARGS__, \
 				   63,62,61,60,                   \
@@ -404,7 +386,6 @@
 				   29,28,27,26,25,24,23,22,21,20, \
 				   19,18,17,16,15,14,13,12,11,10, \
 				   9, 8, 7, 6, 5, 4, 3, 2, 1, 0)
-#endif
 
 #define VA_ARGS_NARGS_( \
 	_01,_02,_03,_04,_05,_06,_07,_08,_09,_10, \

From 83389838827b75dbdc9e4c251e2f57b23bfb2cff Mon Sep 17 00:00:00 2001
From: Peter Eisentraut <peter@eisentraut.org>
Date: Tue, 1 Jul 2025 10:19:52 +0200
Subject: [PATCH 4/6] doc: TOAST not toast

There are different capitializations of "TOAST" around the
documentation and code.  This just changes a few places that were more
obviously inconsistent with similar phrases elsewhere.

Author: Peter Smith <peter.b.smith@fujitsu.com>
Discussion: https://www.postgresql.org/message-id/flat/CAHut+PtxXLJFhwJFvx+M=Ux8WGHU85XbT3nDqk-aAUS3E5ANCw@mail.gmail.com
---
 doc/src/sgml/amcheck.sgml         |  4 ++--
 doc/src/sgml/bki.sgml             |  2 +-
 doc/src/sgml/catalogs.sgml        |  2 +-
 doc/src/sgml/logicaldecoding.sgml |  2 +-
 doc/src/sgml/ref/alter_table.sgml |  2 +-
 doc/src/sgml/ref/pg_amcheck.sgml  | 12 ++++++------
 doc/src/sgml/sepgsql.sgml         |  2 +-
 7 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/doc/src/sgml/amcheck.sgml b/doc/src/sgml/amcheck.sgml
index 211a0ae1945bb..0aff0a6c8c6fc 100644
--- a/doc/src/sgml/amcheck.sgml
+++ b/doc/src/sgml/amcheck.sgml
@@ -278,8 +278,8 @@ SET client_min_messages = DEBUG1;
          TOAST table.
         </para>
         <para>
-         This option is known to be slow.  Also, if the toast table or its
-         index is corrupt, checking it against toast values could conceivably
+         This option is known to be slow.  Also, if the TOAST table or its
+         index is corrupt, checking it against TOAST values could conceivably
          crash the server, although in many cases this would just produce an
          error.
         </para>
diff --git a/doc/src/sgml/bki.sgml b/doc/src/sgml/bki.sgml
index 3cd5bee7ffaf4..53a982bf60d29 100644
--- a/doc/src/sgml/bki.sgml
+++ b/doc/src/sgml/bki.sgml
@@ -1042,7 +1042,7 @@ $ perl  rewrite_dat_with_prokind.pl  pg_proc.dat
     </listitem>
     <listitem>
      <para>
-      Define indexes and toast tables.
+      Define indexes and TOAST tables.
      </para>
     </listitem>
     <listitem>
diff --git a/doc/src/sgml/catalogs.sgml b/doc/src/sgml/catalogs.sgml
index fa86c569dc497..4f9192316e047 100644
--- a/doc/src/sgml/catalogs.sgml
+++ b/doc/src/sgml/catalogs.sgml
@@ -1951,7 +1951,7 @@ SCRAM-SHA-256$<replaceable>&lt;iteration count&gt;</replaceable>:<replaceable>&l
       </para>
       <para>
        The OID of the data type that corresponds to this table's row type,
-       if any; zero for indexes, sequences, and toast tables, which have
+       if any; zero for indexes, sequences, and TOAST tables, which have
        no <structname>pg_type</structname> entry
       </para></entry>
      </row>
diff --git a/doc/src/sgml/logicaldecoding.sgml b/doc/src/sgml/logicaldecoding.sgml
index fc288d691b9f6..a45a141241607 100644
--- a/doc/src/sgml/logicaldecoding.sgml
+++ b/doc/src/sgml/logicaldecoding.sgml
@@ -1412,7 +1412,7 @@ commit_prepared_cb(...);  &lt;-- commit of the prepared transaction
     currently used for decoded changes) is selected and streamed.  However, in
     some cases we still have to spill to disk even if streaming is enabled
     because we exceed the memory threshold but still have not decoded the
-    complete tuple e.g., only decoded toast table insert but not the main table
+    complete tuple e.g., only decoded TOAST table insert but not the main table
     insert.
    </para>
 
diff --git a/doc/src/sgml/ref/alter_table.sgml b/doc/src/sgml/ref/alter_table.sgml
index d16969916835d..1e4f26c13f650 100644
--- a/doc/src/sgml/ref/alter_table.sgml
+++ b/doc/src/sgml/ref/alter_table.sgml
@@ -852,7 +852,7 @@ WITH ( MODULUS <replaceable class="parameter">numeric_literal</replaceable>, REM
 
      <para>
       <literal>SHARE UPDATE EXCLUSIVE</literal> lock will be taken for
-      fillfactor, toast and autovacuum storage parameters, as well as the
+      fillfactor, TOAST and autovacuum storage parameters, as well as the
       planner parameter <varname>parallel_workers</varname>.
      </para>
     </listitem>
diff --git a/doc/src/sgml/ref/pg_amcheck.sgml b/doc/src/sgml/ref/pg_amcheck.sgml
index 6bfe28799c4e6..ef2bdfd19ae5d 100644
--- a/doc/src/sgml/ref/pg_amcheck.sgml
+++ b/doc/src/sgml/ref/pg_amcheck.sgml
@@ -41,7 +41,7 @@ PostgreSQL documentation
   </para>
 
   <para>
-   Only ordinary and toast table relations, materialized views, sequences, and
+   Only ordinary and TOAST table relations, materialized views, sequences, and
    btree indexes are currently supported.  Other relation types are silently
    skipped.
   </para>
@@ -276,7 +276,7 @@ PostgreSQL documentation
      <term><option>--no-dependent-toast</option></term>
      <listitem>
       <para>
-       By default, if a table is checked, its toast table, if any, will also
+       By default, if a table is checked, its TOAST table, if any, will also
        be checked, even if it is not explicitly selected by an option
        such as <literal>--table</literal> or <literal>--relation</literal>.
        This option suppresses that behavior.
@@ -306,9 +306,9 @@ PostgreSQL documentation
      <term><option>--exclude-toast-pointers</option></term>
      <listitem>
       <para>
-       By default, whenever a toast pointer is encountered in a table,
+       By default, whenever a TOAST pointer is encountered in a table,
        a lookup is performed to ensure that it references apparently-valid
-       entries in the toast table. These checks can be quite slow, and this
+       entries in the TOAST table. These checks can be quite slow, and this
        option can be used to skip them.
       </para>
      </listitem>
@@ -368,9 +368,9 @@ PostgreSQL documentation
        End checking at the specified block number.  An error will occur if the
        table relation being checked has fewer than this number of blocks.
        This option does not apply to indexes, and is probably only useful when
-       checking a single table relation. If both a regular table and a toast
+       checking a single table relation. If both a regular table and a TOAST
        table are checked, this option will apply to both, but higher-numbered
-       toast blocks may still be accessed while validating toast pointers,
+       TOAST blocks may still be accessed while validating TOAST pointers,
        unless that is suppressed using
        <option>--exclude-toast-pointers</option>.
       </para>
diff --git a/doc/src/sgml/sepgsql.sgml b/doc/src/sgml/sepgsql.sgml
index 03ed7d1c90d15..0708e48bcd950 100644
--- a/doc/src/sgml/sepgsql.sgml
+++ b/doc/src/sgml/sepgsql.sgml
@@ -442,7 +442,7 @@ UPDATE t1 SET x = 2, y = func1(y) WHERE z = 100;
    <para>
     The default database privilege system allows database superusers to
     modify system catalogs using DML commands, and reference or modify
-    toast tables.  These operations are prohibited when
+    TOAST tables.  These operations are prohibited when
     <filename>sepgsql</filename> is enabled.
    </para>
   </sect3>

From b5cd0ecd4d4fa89b716785f22e9f009624104d61 Mon Sep 17 00:00:00 2001
From: Amit Kapila <akapila@postgresql.org>
Date: Tue, 1 Jul 2025 15:17:03 +0530
Subject: [PATCH 5/6] Fix typo in pg_publication.h.

Author: shveta malik <shveta.malik@gmail.com>
Discussion: https://postgr.es/m/CAJpy0uAyFN9o7vU_ZkZFv5-6ysXDNKNx_fC0gwLLKg=8==E3ow@mail.gmail.com
---
 src/include/catalog/pg_publication.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/include/catalog/pg_publication.h b/src/include/catalog/pg_publication.h
index 48c7d1a861527..6e074190fd2cd 100644
--- a/src/include/catalog/pg_publication.h
+++ b/src/include/catalog/pg_publication.h
@@ -146,7 +146,7 @@ extern Publication *GetPublicationByName(const char *pubname, bool missing_ok);
 extern List *GetRelationPublications(Oid relid);
 
 /*---------
- * Expected values for pub_partopt parameter of GetRelationPublications(),
+ * Expected values for pub_partopt parameter of GetPublicationRelations(),
  * which allows callers to specify which partitions of partitioned tables
  * mentioned in the publication they expect to see.
  *

From 7fe2f67c7c9f27955df584eb79edd6ec2be7f9e4 Mon Sep 17 00:00:00 2001
From: Tomas Vondra <tomas.vondra@postgresql.org>
Date: Tue, 1 Jul 2025 12:02:31 +0200
Subject: [PATCH 6/6] Limit the size of numa_move_pages requests

There's a kernel bug in do_pages_stat(), affecting systems combining
64-bit kernel and 32-bit user space. The function splits the request
into chunks of 16 pointers, but forgets the pointers are 32-bit when
advancing to the next chunk. Some of the pointers get skipped, and
memory after the array is interpreted as pointers. The result is that
the produced status of memory pages is mostly bogus.

Systems combining 64-bit and 32-bit environments like this might seem
rare, but that's not the case - all 32-bit Debian packages are built in
a 32-bit chroot on a system with a 64-bit kernel.

This is a long-standing kernel bug (since 2010), affecting pretty much
all kernels, so it'll take time until all systems get a fixed kernel.
Luckily, we can work around the issue by chunking the requests the same
way do_pages_stat() does, at least on affected systems. We don't know
what kernel a 32-bit build will run on, so all 32-bit builds use chunks
of 16 elements (the largest chunk before hitting the issue).

64-bit builds are not affected by this issue, and so could work without
the chunking. But chunking has other advantages, so we apply chunking
even for 64-bit builds, with chunks of 1024 elements.

Reported-by: Christoph Berg <myon@debian.org>
Author: Christoph Berg <myon@debian.org>
Author: Bertrand Drouvot <bertranddrouvot.pg@gmail.com>
Discussion: https://postgr.es/m/aEtDozLmtZddARdB@msg.df7cb.de
Context: https://marc.info/?l=linux-mm&m=175077821909222&w=2
Backpatch-through: 18
---
 src/port/pg_numa.c | 50 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 49 insertions(+), 1 deletion(-)

diff --git a/src/port/pg_numa.c b/src/port/pg_numa.c
index 4b487a2a4e814..d5935207d0a13 100644
--- a/src/port/pg_numa.c
+++ b/src/port/pg_numa.c
@@ -29,6 +29,19 @@
 #include <numa.h>
 #include <numaif.h>
 
+/*
+ * numa_move_pages() chunk size, has to be <= 16 to work around a kernel bug
+ * in do_pages_stat() (chunked by DO_PAGES_STAT_CHUNK_NR). By using the same
+ * chunk size, we make it work even on unfixed kernels.
+ *
+ * 64-bit system are not affected by the bug, and so use much larger chunks.
+ */
+#if SIZEOF_SIZE_T == 4
+#define NUMA_QUERY_CHUNK_SIZE 16
+#else
+#define NUMA_QUERY_CHUNK_SIZE 1024
+#endif
+
 /* libnuma requires initialization as per numa(3) on Linux */
 int
 pg_numa_init(void)
@@ -42,11 +55,46 @@ pg_numa_init(void)
  * We use move_pages(2) syscall here - instead of get_mempolicy(2) - as the
  * first one allows us to batch and query about many memory pages in one single
  * giant system call that is way faster.
+ *
+ * We call numa_move_pages() for smaller chunks of the whole array. The first
+ * reason is to work around a kernel bug, but also to allow interrupting the
+ * query between the calls (for many pointers processing the whole array can
+ * take a lot of time).
  */
 int
 pg_numa_query_pages(int pid, unsigned long count, void **pages, int *status)
 {
-	return numa_move_pages(pid, count, pages, NULL, status, 0);
+	unsigned long	next = 0;
+	int				ret = 0;
+
+	/*
+	 * Chunk pointers passed to numa_move_pages to NUMA_QUERY_CHUNK_SIZE
+	 * items, to work around a kernel bug in do_pages_stat().
+	 */
+	while (next < count)
+	{
+		unsigned long count_chunk = Min(count - next,
+										NUMA_QUERY_CHUNK_SIZE);
+
+		/*
+		 * Bail out if any of the chunks errors out (ret<0). We ignore
+		 * (ret>0) which is used to return number of nonmigrated pages,
+		 * but we're not migrating any pages here.
+		 */
+		ret = numa_move_pages(pid, count_chunk, &pages[next], NULL, &status[next], 0);
+		if (ret < 0)
+		{
+			/* plain error, return as is */
+			return ret;
+		}
+
+		next += count_chunk;
+	}
+
+	/* should have consumed the input array exactly */
+	Assert(next == count);
+
+	return 0;
 }
 
 int