BUG #5348: Postgres crashes with index on xpath_string

The following bug has been logged online:

Bug reference: 5348
Logged by: Thomas Kellerer
Email address: thomas(at)kellerer(dot)name
PostgreSQL version: 8.4.2
Operating system: Windows XP
Description: Postgres crashes with index on xpath_string
Details:

With the contrib module xml2 (pgxml.sql) installed, run the following
script:

create table t1 (id integer, xml_data xml);
insert into t1 (id, xml_data)
values
(1, '<attributes><attribute name="attr_1">Some
Value</attribute></attributes>');

create index idx_xpath on t1 ( xpath_string
('/attributes/attribute[(at)name="attr_1"]/text()', xml_data::text));

This will crash the backend.

The entry in the logfile is:

2010-02-27 17:21:28 CET STATEMENT: create index idx_xpath on t1 (
xpath_value ('/attributes/attribute[(at)name="attr_1"]/text()',
xml_data::text))
2010-02-27 17:21:55 CET LOG: server process (PID 2544) was terminated by
exception 0xC0000005
2010-02-27 17:21:55 CET HINT: See C include file "ntstatus.h" for a
description of the hexadecimal value.
2010-02-27 17:21:55 CET LOG: terminating any other active server processes
2010-02-27 17:21:55 CET LOG: all server processes terminated;
reinitializing

When restarting the server, the following messages are written to the
logfile:

2010-02-27 17:22:05 CET FATAL: pre-existing shared memory block is still in
use
2010-02-27 17:22:05 CET HINT: Check if there are any old server processes
still running, and terminate them.
2010-02-27 17:22:22 CET LOG: database system was interrupted; last known up
at 2010-02-27 16:22:32 CET
2010-02-27 17:22:22 CET LOG: database system was not properly shut down;
automatic recovery in progress
2010-02-27 17:22:22 CET LOG: redo starts at 3/B77FAB28
2010-02-27 17:22:22 CET LOG: unexpected pageaddr 3/95850000 in log file 3,
segment 183, offset 8716288
2010-02-27 17:22:22 CET LOG: redo done at 3/B784F758
2010-02-27 17:22:22 CET LOG: last completed transaction was at log time
2010-02-27 17:21:20.382+01
2010-02-27 17:22:23 CET FATAL: the database system is starting up
2010-02-27 17:22:23 CET LOG: database system is ready to accept
connections
2010-02-27 17:22:24 CET LOG: autovacuum launcher started

When the following index is created, things seem to work (at least the
backend is not crashing)

create index idx_xpath on t1 ( xpath_string
('/attributes/attribute[(at)name="attr_1"]', xml_data::text))

(note the missing text() in the xpath)