Server crash with certain encodings

Hi,

I can crash the server in 9.4, 9.5 and 9.6 when doing the following on
Linux:

initdb --encoding 'WIN1251' --locale 'C' win

psql

# \l
                         List of databases
   Name    | Owner | Encoding | Collate | Ctype | Access privileges
-----------+-------+----------+---------+-------+-------------------
 postgres  | thom  | WIN1251  | C       | C     |
 template0 | thom  | WIN1251  | C       | C     | =3Dc/thom          +
           |       |          |         |       | thom=3DCTc/thom
 template1 | thom  | WIN1251  | C       | C     | =3Dc/thom          +
           |       |          |         |       | thom=3DCTc/thom
(3 rows)

# SET lc_monetary =3D 'en_GB.ISO-8859-15';
SET

# SET client_encoding =3D 'WIN1251';
SET

# SELECT '=C2=A39'::money;
ERROR:  default conversion function for encoding "LATIN9" to "WIN1251" does
not exist
LINE 1: SELECT '=C2=A39'::money;

# SELECT '=C2=A39'::money;
server closed the connection unexpectedly
    This probably means the server terminated abnormally
    before or while processing the request.
The connection to the server was lost. Attempting reset: Failed.


Note that I need to run the above command twice in order for it to crash.

The log shows:

STATEMENT:  SELECT '=C2=A39'::money;
*** Error in `postgres: thom postgres [local] SELECT': free(): invalid
pointer: 0x00007faf67a16255 ***
=3D=3D=3D=3D=3D=3D=3D Backtrace: =3D=3D=3D=3D=3D=3D=3D=3D=3D
/lib/x86_64-linux-gnu/libc.so.6(+0x7aa16)[0x7faf68e42a16]
/lib/x86_64-linux-gnu/libc.so.6(+0x7b793)[0x7faf68e43793]
postgres: thom postgres [local] SELECT[0x85fd27]
postgres: thom postgres [local] SELECT(PGLC_localeconv+0x38)[0x86063a]
postgres: thom postgres [local] SELECT(cash_in+0x29)[0x7e72eb]
postgres: thom postgres [local] SELECT(InputFunctionCall+0xcc)[0x8fabf7]
postgres: thom postgres [local] SELECT(OidInputFunctionCall+0x41)[0x8faf47]
postgres: thom postgres [local] SELECT(stringTypeDatum+0x43)[0x599206]
postgres: thom postgres [local] SELECT(coerce_type+0x232)[0x57dac8]
postgres: thom postgres [local] SELECT(coerce_to_target_type+0xa2)[0x57cd8c=
]
postgres: thom postgres [local] SELECT[0x5858f9]
postgres: thom postgres [local] SELECT[0x584079]
postgres: thom postgres [local] SELECT(transformExpr+0x1e)[0x583cc6]
postgres: thom postgres [local] SELECT(transformTargetEntry+0x3c)[0x597ad3]
postgres: thom postgres [local] SELECT(transformTargetList+0x141)[0x597c80]
postgres: thom postgres [local] SELECT[0x54d916]
postgres: thom postgres [local] SELECT(transformStmt+0xa7)[0x54dc97]
postgres: thom postgres [local] SELECT(transformTopLevelStmt+0xad)[0x54ee8f=
]
postgres: thom postgres [local] SELECT(parse_analyze+0x6c)[0x54f02b]
postgres: thom postgres [local]
SELECT(pg_analyze_and_rewrite+0x4e)[0x7af9fe]
postgres: thom postgres [local] SELECT[0x7b059e]
postgres: thom postgres [local] SELECT(PostgresMain+0x981)[0x7b134d]
postgres: thom postgres [local] SELECT[0x731c61]
postgres: thom postgres [local] SELECT[0x7342fc]
postgres: thom postgres [local] SELECT[0x7346c2]
postgres: thom postgres [local] SELECT(PostmasterMain+0x1696)[0x736191]
postgres: thom postgres [local] SELECT[0x68a393]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x7faf68de9995]
postgres: thom postgres [local] SELECT[0x468379]
=3D=3D=3D=3D=3D=3D=3D Memory map: =3D=3D=3D=3D=3D=3D=3D=3D
00400000-00b57000 r-xp 00000000 08:01 3942667
 /home/thom/Development/psql/bin/postgres
00d56000-00e57000 rw-p 00756000 08:01 3942667
 /home/thom/Development/psql/bin/postgres
00e57000-0102d000 rw-p 00000000 00:00 0
0229c000-022da000 rw-p 00000000 00:00 0
 [heap]
022da000-02360000 rw-p 00000000 00:00 0
 [heap]
7faf5e482000-7faf5e497000 r-xp 00000000 08:01 13372735
/lib/x86_64-linux-gnu/libgcc_s.so.1
7faf5e497000-7faf5e697000 ---p 00015000 08:01 13372735
/lib/x86_64-linux-gnu/libgcc_s.so.1
7faf5e697000-7faf5e698000 rw-p 00015000 08:01 13372735
/lib/x86_64-linux-gnu/libgcc_s.so.1
7faf5e698000-7faf5e6a2000 r-xp 00000000 08:01 3942712
 /home/thom/Development/psql/lib/postgresql/utf8_and_win.so
7faf5e6a2000-7faf5e8a1000 ---p 0000a000 08:01 3942712
 /home/thom/Development/psql/lib/postgresql/utf8_and_win.so
7faf5e8a1000-7faf5e8a2000 rw-p 00009000 08:01 3942712
 /home/thom/Development/psql/lib/postgresql/utf8_and_win.so
7faf5e8a2000-7faf5e8a3000 rw-p 00000000 00:00 0
7faf5e8a3000-7faf67609000 rw-s 00000000 00:04 6786658
 /dev/zero (deleted)
7faf67609000-7faf67615000 r-xp 00000000 08:01 13372779
/lib/x86_64-linux-gnu/libnss_files-2.17.so
7faf67615000-7faf67814000 ---p 0000c000 08:01 13372779
/lib/x86_64-linux-gnu/libnss_files-2.17.so
7faf67814000-7faf67815000 r--p 0000b000 08:01 13372779
/lib/x86_64-linux-gnu/libnss_files-2.17.so
7faf67815000-7faf67816000 rw-p 0000c000 08:01 13372779
/lib/x86_64-linux-gnu/libnss_files-2.17.so
7faf67816000-7faf68771000 r--p 00000000 08:01 1465790
 /usr/lib/locale/locale-archive
7faf68771000-7faf68788000 r-xp 00000000 08:01 13372816
/lib/x86_64-linux-gnu/libpthread-2.17.so
7faf68788000-7faf68987000 ---p 00017000 08:01 13372816
/lib/x86_64-linux-gnu/libpthread-2.17.so
7faf68987000-7faf68988000 r--p 00016000 08:01 13372816
/lib/x86_64-linux-gnu/libpthread-2.17.so
7faf68988000-7faf68989000 rw-p 00017000 08:01 13372816
/lib/x86_64-linux-gnu/libpthread-2.17.so
7faf68989000-7faf6898d000 rw-p 00000000 00:00 0
7faf6898d000-7faf689af000 r-xp 00000000 08:01 13372757
/lib/x86_64-linux-gnu/liblzma.so.5.0.0
7faf689af000-7faf68bae000 ---p 00022000 08:01 13372757
/lib/x86_64-linux-gnu/liblzma.so.5.0.0
7faf68bae000-7faf68baf000 r--p 00021000 08:01 13372757
/lib/x86_64-linux-gnu/liblzma.so.5.0.0
7faf68baf000-7faf68bb0000 rw-p 00022000 08:01 13372757
/lib/x86_64-linux-gnu/liblzma.so.5.0.0
7faf68bb0000-7faf68bc7000 r-xp 00000000 08:01 13372862
/lib/x86_64-linux-gnu/libz.so.1.2.8
7faf68bc7000-7faf68dc6000 ---p 00017000 08:01 13372862
/lib/x86_64-linux-gnu/libz.so.1.2.8
7faf68dc6000-7faf68dc7000 r--p 00016000 08:01 13372862
/lib/x86_64-linux-gnu/libz.so.1.2.8
7faf68dc7000-7faf68dc8000 rw-p 00017000 08:01 13372862
/lib/x86_64-linux-gnu/libz.so.1.2.8
7faf68dc8000-7faf68f6b000 r-xp 00000000 08:01 13372711
/lib/x86_64-linux-gnu/libc-2.17.so
7faf68f6b000-7faf6916a000 ---p 001a3000 08:01 13372711
/lib/x86_64-linux-gnu/libc-2.17.so
7faf6916a000-7faf6916e000 r--p 001a2000 08:01 13372711
/lib/x86_64-linux-gnu/libc-2.17.so
7faf6916e000-7faf69170000 rw-p 001a6000 08:01 13372711
/lib/x86_64-linux-gnu/libc-2.17.so
7faf69170000-7faf69174000 rw-p 00000000 00:00 0
7faf69174000-7faf69270000 r-xp 00000000 08:01 13372760
/lib/x86_64-linux-gnu/libm-2.17.so
7faf69270000-7faf69470000 ---p 000fc000 08:01 13372760
/lib/x86_64-linux-gnu/libm-2.17.so
7faf69470000-7faf69471000 r--p 000fc000 08:01 13372760
/lib/x86_64-linux-gnu/libm-2.17.so
7faf69471000-7faf69472000 rw-p 000fd000 08:01 13372760
/lib/x86_64-linux-gnu/libm-2.17.so
7faf69472000-7faf69475000 r-xp 00000000 08:01 13372725
/lib/x86_64-linux-gnu/libdl-2.17.so
7faf69475000-7faf69674000 ---p 00003000 08:01 13372725
/lib/x86_64-linux-gnu/libdl-2.17.so
7faf69674000-7faf69675000 r--p 00002000 08:01 13372725
/lib/x86_64-linux-gnu/libdl-2.17.so
7faf69675000-7faf69676000 rw-p 00003000 08:01 13372725
/lib/x86_64-linux-gnu/libdl-2.17.so
7faf69676000-7faf6967d000 r-xp 00000000 08:01 13372824
/lib/x86_64-linux-gnu/librt-2.17.so
7faf6967d000-7faf6987c000 ---p 00007000 08:01 13372824
/lib/x86_64-linux-gnu/librt-2.17.so
7faf6987c000-7faf6987d000 r--p 00006000 08:01 13372824
/lib/x86_64-linux-gnu/librt-2.17.so
7faf6987d000-7faf6987e000 rw-p 00007000 08:01 13372824
/lib/x86_64-linux-gnu/librt-2.17.so
7faf6987e000-7faf69a48000 r-xp 00000000 08:01 1453415
 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
7faf69a48000-7faf69c48000 ---p 001ca000 08:01 1453415
 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
7faf69c48000-7faf69c65000 r--p 001ca000 08:01 1453415
 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
7faf69c65000-7faf69c75000 rw-p 001e7000 08:01 1453415
 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0
7faf69c75000-7faf69c78000 rw-p 00000000 00:00 0
7faf69c78000-7faf69cce000 r-xp 00000000 08:01 1453417
 /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0
7faf69cce000-7faf69ece000 ---p 00056000 08:01 1453417
 /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0
7faf69ece000-7faf69ed1000 r--p 00056000 08:01 1453417
 /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0
7faf69ed1000-7faf69ed8000 rw-p 00059000 08:01 1453417
 /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0
7faf69ed8000-7faf6a035000 r-xp 00000000 08:01 1451539
 /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.1
7faf6a035000-7faf6a234000 ---p 0015d000 08:01 1451539
 /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.1
7faf6a234000-7faf6a23c000 r--p 0015c000 08:01 1451539
 /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.1
7faf6a23c000-7faf6a23e000 rw-p 00164000 08:01 1451539
 /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.1
7faf6a23e000-7faf6a23f000 rw-p 00000000 00:00 0
7faf6a23f000-7faf6a260000 r-xp 00000000 08:01 13372685
/lib/x86_64-linux-gnu/ld-2.17.so
7faf6a3e8000-7faf6a429000 rw-p 00000000 00:00 0
7faf6a429000-7faf6a430000 rw-p 00000000 00:00 0
7faf6a43a000-7faf6a45c000 rw-p 00000000 00:00 0
7faf6a45c000-7faf6a45d000 rw-s 00000000 00:04 165707825
 /SYSV66e34b5c (deleted)
7faf6a45d000-7faf6a45e000 rw-s 00000000 00:04 165675056
 /SYSV0054c721 (deleted)
7faf6a45e000-7faf6a460000 rw-p 00000000 00:00 0
7faf6a460000-7faf6a461000 r--p 00021000 08:01 13372685
/lib/x86_64-linux-gnu/ld-2.17.so
7faf6a461000-7faf6a463000 rw-p 00022000 08:01 13372685
/lib/x86_64-linux-gnu/ld-2.17.so
7fff17481000-7fff174a5000 rw-p 00000000 00:00 0
 [stack]
7fff175e8000-7fff175ea000 r-xp 00000000 00:00 0
 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0
 [vsyscall]
LOG:  server process (PID 30853) was terminated by signal 6: Aborted
DETAIL:  Failed process was running: SELECT '??9'::money;
LOG:  terminating any other active server processes
WARNING:  terminating connection because of crash of another server process
DETAIL:  The postmaster has commanded this server process to roll back the
current transaction and exit, because another server process exited
abnormally and possibly corrupted shared memory.
HINT:  In a moment you should be able to reconnect to the database and
repeat your command.
FATAL:  the database system is in recovery mode
LOG:  all server processes terminated; reinitializing
LOG:  database system was interrupted; last known up at 2016-02-29 01:40:39
GMT
LOG:  database system was not properly shut down; automatic recovery in
progress
LOG:  invalid record length at 0/14D0CA0
LOG:  redo is not required
LOG:  MultiXact member wraparound protections are now enabled
LOG:  autovacuum launcher started
LOG:  database system is ready to accept connections


pg_config output:

BINDIR =3D /home/thom/Development/psql/bin
DOCDIR =3D /home/thom/Development/psql/share/doc/postgresql
HTMLDIR =3D /home/thom/Development/psql/share/doc/postgresql
INCLUDEDIR =3D /home/thom/Development/psql/include
PKGINCLUDEDIR =3D /home/thom/Development/psql/include/postgresql
INCLUDEDIR-SERVER =3D /home/thom/Development/psql/include/postgresql/server
LIBDIR =3D /home/thom/Development/psql/lib
PKGLIBDIR =3D /home/thom/Development/psql/lib/postgresql
LOCALEDIR =3D /home/thom/Development/psql/share/locale
MANDIR =3D /home/thom/Development/psql/share/man
SHAREDIR =3D /home/thom/Development/psql/share/postgresql
SYSCONFDIR =3D /home/thom/Development/psql/etc/postgresql
PGXS =3D /home/thom/Development/psql/lib/postgresql/pgxs/src/makefiles/pgxs=
.mk
CONFIGURE =3D '--enable-coverage' '--prefix=3D/home/thom/Development/psql'
'--enable-depend' '--enable-debug' '--with-libxml' '--with-openssl'
'--with-ossp-uuid' 'CFLAGS=3D-ggdb -Og -fno-omit-frame-pointer'
CC =3D gcc
CPPFLAGS =3D -DFRONTEND -D_GNU_SOURCE -I/usr/include/libxml2
CFLAGS =3D -Wall -Wmissing-prototypes -Wpointer-arith
-Wdeclaration-after-statement -Wendif-labels -Wmissing-format-attribute
-Wformat-security -fno-strict-aliasing -fwrapv -fexcess-precision=3Dstandar=
d
-g -fprofile-arcs -ftest-coverage -ggdb -Og -fno-omit-frame-pointer
CFLAGS_SL =3D -fpic
LDFLAGS =3D -L../../src/common -Wl,--as-needed
-Wl,-rpath,'/home/thom/Development/psql/lib',--enable-new-dtags
LDFLAGS_EX =3D
LDFLAGS_SL =3D
LIBS =3D -lpgcommon -lpgport -lxml2 -lssl -lcrypto -lz -lreadline -lrt
-lcrypt -ldl -lm
VERSION =3D PostgreSQL 9.6devel


Thom