BUG #3860: xpath crashes backend when is querying xmlagg result

The following bug has been logged online:

Bug reference: 3860
Logged by: Sokolov Yura
Email address: funny(dot)falcon(at)gmail(dot)com
PostgreSQL version: 8.3beta4
Operating system: Debian Linux 4.0r2 both 32bit and amd64
Description: xpath crashes backend when is querying xmlagg result
Details:

xpath() crashes backend when is querying particular xmlagg results.

Behavior is unstable, but it is reproduced with command line:

psql < bg***.sql

and initially observed with pgadmin3 1.8

-------- bg1.sql---------------
-- crashed, when queries xmlelement with containment given by xmlagg
-- and type of aggregated elements is different
select xpath('any_non_empty_expression', xmlelement(name a, xmlagg(el) )) as
el
from ( values
( xmlelement(name b, 0) ), -- integer
( xmlelement(name c, 0.1) ) -- numeric, string crashe backend
-- on 32bit Debian float4 and float8 does
not
-- on 64 bit Debian float4 does but float8
not
-- order is irrelevant
) as t(el);
-----end bg1.sql --------------

-------- bg2.sql---------------
-- crashed, when queries xml given by xmlagg
-- and types of elements text() is different
select xpath('any_non_empty_expression', xmlagg(el) ) as el
from ( values
( xmlelement(name b, 0) ),
( xmlelement(name c, 0.1) )
) as t(el);
-----end bg2.sql --------------

-------- bg3.sql---------------
-- this crashes 64bit machine
select xpath('/a/c', xmlagg(el)) as el
from ( values
( xmlelement(name b, 0) ),
( xmlelement(name c, 0.1::float4) )
) as t(el);
-----end bg3.sql --------------

-------- bg-not31.sql ----------
-- but this works on 64bit machine
select xpath('/b', xmlagg(el)) as el
from ( values
( xmlelement(name b, 0) ),
( xmlelement(name c, 0.1::float8) )
) as t(el);
-----end bg-not31.sql ----------

-------- bg-not32.sql ----------
-- and, hardly believed, combined file works too
select xpath('/b', xmlagg(el)) as el
from ( values
( xmlelement(name b, 0) ),
( xmlelement(name c, 0.1::float8) )
) as t(el);
select xpath('/c', xmlagg(el)) as el
from ( values
( xmlelement(name b, 0) ),
( xmlelement(name c, 0.1::float4) )
) as t(el);
-----end bg-not32.sql ----------

-------- bg-not.sql -----------
-- Empty xpath expression catched - no backend crash
select xpath('',xmlelement(name a, xmlagg(el) )) as el
from ( values
( xmlelement(name b, 0) ),
( xmlelement(name c, 0.1) )
) as t(el);
-----end bg-not.sql -----------

-------- bg-not1.sql -----------
-- when types are same no backend crash
-- with numeric works on 32bit machine, but crashes on 64bit
select xpath('/a/b',xmlelement(name a, xmlagg(el) )) as el
from ( values
( xmlelement(name b, 0.1) ),
( xmlelement(name c, 0.1) )
) as t(el);
-----end bg-not1.sql -----------

-------- bg-not2.sql -----------
-- when elements given explicitly then no backend crash
select xpath('/a/c',
xmlelement(name a,
xmlelement(name b, 0),
xmlelement(name c, 0.1) ));
-----end bg-not2.sql -----------

-------- bg-not3.sql -----------
-- xmlelement itself not crashed
select xmlelement(name a, xmlagg(el) ) as el
from ( values
( xmlelement(name b, 0) ),
( xmlelement(name c, 0.1) )
) as t(el);
-----end bg-not3.sql -----------

-------- bg-not4.sql -----------
-- when elements given with xmlconcat2 then no backend crash
select xpath('/a/c',
xmlelement(name a,
xmlconcat2(
xmlelement(name b, 0),
xmlelement(name c, 0.1))
));
-----end bg-not4.sql -----------