Current sources dump core on COPY IN/OUT

The currently-checked-in sources are not working very well for me.
In particular, I can't restore from my pg_dump because COPY IN
coredumps; and a little experimentation shows that COPY OUT does too.

Is anyone else seeing this?

The immediate cause of the dumps seems to be trying to free() a pointer
value 0x1. I suspect it's got something to do with the two-to-four-byte
atttypmod changeover, but can't prove that.

template1=> \copy pg_shadow to -
QUERY: COPY pg_shadow TO stdout
pqReadData() -- backend closed the channel unexpectedly.
This probably means the backend terminated abnormally before or while processing the request.
We have lost the connection to the backend, so further processing is impossible.
Terminating.

Backtrace in backend's core file:

#0 0x800bb108 in free ()
#1 0x11cc90 in AllocSetFree (set=0x4007da98,
pointer=0x1 <Address 0x1 out of bounds>) at aset.c:223
#2 0x11d3b4 in PortalHeapMemoryFree (this=0x4007da98,
pointer=0x4007daa8 "postgres") at portalmem.c:283
#3 0x11cfa4 in MemoryContextFree (context=0x4007da98,
pointer=0x1 <Address 0x1 out of bounds>) at mcxt.c:251
#4 0x11d224 in pfree (pointer=0x1) at palloc.c:79
#5 0x7ac60 in CopyTo (rel=0x40074380, binary=0 '\000', oids=0 '\000',
fp=0x40001048, delim=0x3f500 "\t") at copy.c:284
#6 0x7a81c in DoCopy (relname=0x40001048 "", binary=0 '\000', oids=0 '\000',
from=0 '\000', pipe=1, filename=0x0, delim=0x3f500 "\t") at copy.c:181
#7 0xec768 in ProcessUtility (parsetree=0x4007d800, dest=Remote)
at utility.c:759
#8 0xea420 in pg_exec_query_dest (query_string=0x4007da98 "", dest=Remote)
at postgres.c:706
#9 0xea298 in pg_exec_query (query_string=0x4007da98 "") at postgres.c:602
#10 0xeb26c in PostgresMain (argc=1073930048, argv=0x40007f40, real_argc=4,
real_argv=0x4003b740) at postgres.c:1429
#11 0xd0b70 in DoBackend (port=0x4003f9c0) at postmaster.c:1412
#12 0xd0574 in BackendStartup (port=0x4003f9c0) at postmaster.c:1191
#13 0xcfb68 in ServerLoop () at postmaster.c:725
#14 0xcf66c in PostmasterMain (argc=1074256536, argv=0x7b033378)
at postmaster.c:534
#15 0x9f070 in main (argc=4, argv=0x7b033378) at main.c:93

Meanwhile the following snippet of pg_dump output

copy pg_shadow from stdin;
tgl 301 t t f t \N \N
tree 211 t t f t \N \N
\.

causes a coredump, from which we get
PQendcopy: resetting connection
and the following backtrace:

#0 0x800bb098 in free ()
#1 0x11cc90 in AllocSetFree (set=0x4007e0e8,
pointer=0x1 <Address 0x1 out of bounds>) at aset.c:223
#2 0x11d3b4 in PortalHeapMemoryFree (this=0x4007e0e8, pointer=0x4007e0f8 "")
at portalmem.c:283
#3 0x11cfa4 in MemoryContextFree (context=0x4007e0e8,
pointer=0x1 <Address 0x1 out of bounds>) at mcxt.c:251
#4 0x11d224 in pfree (pointer=0x1) at palloc.c:79
#5 0x74658 in CatalogIndexFetchTuple (heapRelation=0x40046940, idesc=0x1,
skey=0xffffffff) at indexing.c:245
#6 0x74ab4 in TypeOidIndexScan (heapRelation=0x40046940, typeId=1)
at indexing.c:492
#7 0x114060 in SearchSysCache (cache=0x4005bdf8, v1=25, v2=0, v3=0, v4=0)
at catcache.c:972
#8 0x1177d8 in SearchSysCacheTuple (cacheId=13, key1=25, key2=0, key3=0,
key4=0) at syscache.c:427
#9 0x7b988 in GetInputFunction (type=25) at copy.c:849
#10 0x7b11c in CopyFrom (rel=0x400747b0, binary=0 '\000', oids=0 '\000',
fp=0x40001038, delim=0x3f500 "\t") at copy.c:505
#11 0x7a81c in DoCopy (relname=0x40001038 "", binary=0 '\000', oids=0 '\000',
from=1 '\001', pipe=1, filename=0x0, delim=0x3f500 "\t") at copy.c:181
#12 0xec768 in ProcessUtility (parsetree=0x4007dc38, dest=Remote)
at utility.c:759
#13 0xea420 in pg_exec_query_dest (query_string=0x4007e0e8 "", dest=Remote)
at postgres.c:706
#14 0xea298 in pg_exec_query (query_string=0x4007e0e8 "") at postgres.c:602
#15 0xeb26c in PostgresMain (argc=1073930048, argv=0x40007f40, real_argc=4,
real_argv=0x4003b740) at postgres.c:1429
#16 0xd0b70 in DoBackend (port=0x4003fde0) at postmaster.c:1412
#17 0xd0574 in BackendStartup (port=0x4003fde0) at postmaster.c:1191
#18 0xcfb68 in ServerLoop () at postmaster.c:725
#19 0xcf66c in PostmasterMain (argc=1074258152, argv=0x7b033378)
at postmaster.c:534
#20 0x9f070 in main (argc=4, argv=0x7b033378) at main.c:93

regards, tom lane