pgstat_heap() consults freed memory

pgstat_heap() creates a BufferAccessStrategy and attaches it to a
HeapScanDesc. It continues to use that strategy after calling heap_endscan(),
which frees the strategy. This is only a risk when the table contains empty
pages at the end. I get a crash in an assert-enabled build with this test
procedure, after disabling autovacuum:

-- session 1
create table t (c) as select * from generate_series(1,20000);
delete from t where c > 10000;
-- session 2
begin; lock table t in access share mode;
-- session 1
vacuum t;
-- restart PostgreSQL to clear shared buffers
-- session 3
select * from pgstattuple('t');

The simplest fix is to move the heap_endscan() call past the last use of the
strategy. However, I don't think this function ought to be creating a
strategy explicitly. It should use the one that initscan() creates, if any.

--
Noah Misch
EnterpriseDB http://www.enterprisedb.com