Fix portalmem.c to avoid keeping a dangling pointer to a cached plan list

after it's released its reference count for the cached plan.  There are
code paths that might try to examine the plan list before noticing that
the portal is already in aborted state.  Report and diagnosis by Tatsuo
Ishii, though this isn't exactly his proposed patch.

src/backend/utils/mmgr/portalmem.c

@@ -12,7 +12,7 @@
  * Portions Copyright (c) 1994, Regents of the University of California
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/utils/mmgr/portalmem.c,v 1.115 2010/01/02 16:57:58 momjian Exp $
+ *	  $PostgreSQL: pgsql/src/backend/utils/mmgr/portalmem.c,v 1.116 2010/01/18 02:30:25 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -328,6 +328,13 @@ PortalReleaseCachedPlan(Portal portal)
 	{
 		ReleaseCachedPlan(portal->cplan, false);
 		portal->cplan = NULL;
+
+		/*
+		 * We must also clear portal->stmts which is now a dangling
+		 * reference to the cached plan's plan list.  This protects any
+		 * code that might try to examine the Portal later.
+		 */
+		portal->stmts = NIL;
 	}
 }
 
@@ -395,7 +402,6 @@ PortalDrop(Portal portal, bool isTopCommit)
 		(*portal->cleanup) (portal);
 
 	/* drop cached plan reference, if any */
-	if (portal->cplan)
 	PortalReleaseCachedPlan(portal);
 
 	/*
@@ -529,7 +535,6 @@ CommitHoldablePortals(void)
 			PersistHoldablePortal(portal);
 
 			/* drop cached plan reference, if any */
-			if (portal->cplan)
 			PortalReleaseCachedPlan(portal);
 
 			/*
@@ -680,7 +685,6 @@ AtAbort_Portals(void)
 		}
 
 		/* drop cached plan reference, if any */
-		if (portal->cplan)
 		PortalReleaseCachedPlan(portal);
 
 		/*
@@ -823,7 +827,6 @@ AtSubAbort_Portals(SubTransactionId mySubid,
 			}
 
 			/* drop cached plan reference, if any */
-			if (portal->cplan)
 			PortalReleaseCachedPlan(portal);
 
 			/*