6.4 Aggregate Bug

While testing my 6.4 patch to allow functions/expressions to be
specified in the ORDER/GROUP BY clause (and not in the target list) I
came across a nasty little bug. A segmentation fault gets thrown
somewhere in replace_agg_clause() when using aggregates, in combination
with a function or expression. (I am still tracking down the
offending lines of code. Sorry, the Linux/GCC environment is still new
to me.)

I backed out my patch, and discovered the bug was still present. The
bug does not exist in version 6.3.2. Here is an example:

-- This crashes the backend
select upper(a) as x, count(k) from t group by x;

-- This works fine
select upper(a) as x, count(a) from t group by x;

Notice how in the first query, (the one that does not work) upper() has
a different argument than count(). And in the second query (the one
that works) upper() has the same argument as count(). When using
count(*) it will always fail.

This is the the pattern that I have observed. If the arguments in the
aggregate and non-aggregate functions are the same, it runs; if the
arguments in the aggregate and non-aggregate functions are different, it
crashes.

I have attached a test script for anyone able to help with (or verify)
this problem.