BUG #6222: Segmentation fault on unlogged table

The following bug has been logged online:

Bug reference: 6222
Logged by: Fujii Masao
Email address: masao(dot)fujii(at)gmail(dot)com
PostgreSQL version: 9.2dev
Operating system: Linux hermes 2.6.38-11-generic #50-Ubuntu SMP Mon Sep 12
21:18:14 UTC 2011 i686 i686 i386 GNU/Linux
Description: Segmentation fault on unlogged table
Details:

When I made pgbench tables unlogged and ran pgbench, I encountered a
segmentation fault. Here is the test case which reproduces a segmentation
fault:

$ pgbench -i
$ pg_dump > pgbench.dump
$ sed s/"CREATE TABLE"/"CREATE UNLOGGED TABLE"/g pgbench.dump >
pgbench_unlogged.dump
$ createdb test
$ psql -f pgbench_unlogged.dump test
$ pgbench -c2 -T60 -Mprepared

LOG: server process (PID 23154) was terminated by signal 11: Segmentation
fault
LOG: terminating any other active server processes
WARNING: terminating connection because of crash of another server process
DETAIL: The postmaster has commanded this server process to roll back the
current transaction and exit, because another server process exited
abnormally and possibly corrupted shared memory.
HINT: In a moment you should be able to reconnect to the database and
repeat your command.
<snip>

The backtrace from core file shows that SEGV comes from ExecQual():

$ gdb -c data/core bin/postgres
<snip>
Core was generated by `postgres: postgres test [local] UPDATE '.
Program terminated with signal 11, Segmentation fault.
#0 0x0821a6fa in ExecQual ()
(gdb) bt
#0 0x0821a6fa in ExecQual ()
#1 0x0821aff1 in ExecScan ()
#2 0x0823035e in ExecSeqScan ()
#3 0x082113fe in ExecProcNode ()
#4 0x0822e1f0 in ExecModifyTable ()
#5 0x082113b2 in ExecProcNode ()
#6 0x0820f273 in ExecutePlan ()
#7 0x0820d93b in standard_ExecutorRun ()
#8 0x0820d7af in ExecutorRun ()
#9 0x0832886f in ProcessQuery ()
#10 0x08329e7c in PortalRunMulti ()
#11 0x083295b1 in PortalRun ()
#12 0x083251a8 in exec_execute_message ()
#13 0x08327c67 in PostgresMain ()
#14 0x082d0fb2 in BackendRun ()
#15 0x082d05c0 in BackendStartup ()
#16 0x082cd5c8 in ServerLoop ()
#17 0x082ccf48 in PostmasterMain ()
#18 0x0824d748 in main ()

BTW, when I did the same test on MacOS, I got a bus error instead of SEGV.