Fix type-safety problem with parallel aggregate serial/deserialization.

The original specification for this called for the deserialization function to have signature "deserialize(serialtype) returns transtype", which is a security violation if transtype is INTERNAL (which it always would be in practice) and serialtype is not (which ditto). The patch blithely overrode the opr_sanity check for that, which was sloppy-enough work in itself, but the indisputable reason this cannot be allowed to stand is that CREATE FUNCTION will reject such a signature and thus it'd be impossible for extensions to create parallelizable aggregates. The minimum fix to make the signature type-safe is to add a second, dummy argument of type INTERNAL. But to lock it down a bit more and make misuse of INTERNAL-accepting functions less likely, let's get rid of the ability to specify a "serialtype" for an aggregate and just say that the only useful serialtype is BYTEA --- which, in practice, is the only interesting value anyway, due to the usefulness of the send/recv infrastructure for this purpose. That means we only have to allow "serialize(internal) returns bytea" and "deserialize(bytea, internal) returns internal" as the signatures for these support functions. In passing fix bogus signature of int4_avg_combine, which I found thanks to adding an opr_sanity check on combinefunc signatures. catversion bump due to removing pg_aggregate.aggserialtype and adjusting signatures of assorted built-in functions. David Rowley and Tom Lane Discussion: <27247.1466185504@sss.pgh.pa.us>

Fix type-safety problem with parallel aggregate serial/deserialization.
The original specification for this called for the deserialization function to have signature "deserialize(serialtype) returns transtype", which is a security violation if transtype is INTERNAL (which it always would be in practice) and serialtype is not (which ditto). The patch blithely overrode the opr_sanity check for that, which was sloppy-enough work in itself, but the indisputable reason this cannot be allowed to stand is that CREATE FUNCTION will reject such a signature and thus it'd be impossible for extensions to create parallelizable aggregates. The minimum fix to make the signature type-safe is to add a second, dummy argument of type INTERNAL. But to lock it down a bit more and make misuse of INTERNAL-accepting functions less likely, let's get rid of the ability to specify a "serialtype" for an aggregate and just say that the only useful serialtype is BYTEA --- which, in practice, is the only interesting value anyway, due to the usefulness of the send/recv infrastructure for this purpose. That means we only have to allow "serialize(internal) returns bytea" and "deserialize(bytea, internal) returns internal" as the signatures for these support functions. In passing fix bogus signature of int4_avg_combine, which I found thanks to adding an opr_sanity check on combinefunc signatures. catversion bump due to removing pg_aggregate.aggserialtype and adjusting signatures of assorted built-in functions. David Rowley and Tom Lane Discussion: <27247.1466185504@sss.pgh.pa.us>
f8ace547 · Tom Lane · e45e990e · f8ace547 · f8ace547 · f8ace547
Commit f8ace547 authored Jun 22, 2016 by Tom Lane
18 changed files
--- a/doc/src/sgml/catalogs.sgml
+++ b/doc/src/sgml/catalogs.sgml
@@ -463,12 +463,6 @@
      <entry><literal><link linkend="catalog-pg-type"><structname>pg_type</structname></link>.oid</literal></entry>
      <entry>Data type of the aggregate function's internal transition (state) data</entry>
     </row>
-     <row>
-      <entry><structfield>aggserialtype</structfield></entry>
-      <entry><type>oid</type></entry>
-      <entry><literal><link linkend="catalog-pg-type"><structname>pg_type</structname></link>.oid</literal></entry>
-      <entry>Return data type of the aggregate function's serialization function (zero if none)</entry>
-     </row>
     <row>
      <entry><structfield>aggtransspace</structfield></entry>
      <entry><type>int4</type></entry>

--- a/doc/src/sgml/ref/create_aggregate.sgml
+++ b/doc/src/sgml/ref/create_aggregate.sgml
@@ -30,7 +30,6 @@ CREATE AGGREGATE <replaceable class="parameter">name</replaceable> ( [ <replacea
    [ , COMBINEFUNC = <replaceable class="PARAMETER">combinefunc</replaceable> ]
    [ , SERIALFUNC = <replaceable class="PARAMETER">serialfunc</replaceable> ]
    [ , DESERIALFUNC = <replaceable class="PARAMETER">deserialfunc</replaceable> ]
-    [ , SERIALTYPE = <replaceable class="PARAMETER">serialtype</replaceable> ]
    [ , INITCOND = <replaceable class="PARAMETER">initial_condition</replaceable> ]
    [ , MSFUNC = <replaceable class="PARAMETER">msfunc</replaceable> ]
    [ , MINVFUNC = <replaceable class="PARAMETER">minvfunc</replaceable> ]
@@ -50,10 +49,6 @@ CREATE AGGREGATE <replaceable class="parameter">name</replaceable> ( [ [ <replac
    [ , SSPACE = <replaceable class="PARAMETER">state_data_size</replaceable> ]
    [ , FINALFUNC = <replaceable class="PARAMETER">ffunc</replaceable> ]
    [ , FINALFUNC_EXTRA ]
-    [ , COMBINEFUNC = <replaceable class="PARAMETER">combinefunc</replaceable> ]
-    [ , SERIALFUNC = <replaceable class="PARAMETER">serialfunc</replaceable> ]
-    [ , DESERIALFUNC = <replaceable class="PARAMETER">deserialfunc</replaceable> ]
-    [ , SERIALTYPE = <replaceable class="PARAMETER">serialtype</replaceable> ]
    [ , INITCOND = <replaceable class="PARAMETER">initial_condition</replaceable> ]
    [ , HYPOTHETICAL ]
    [ , PARALLEL = { SAFE | RESTRICTED | UNSAFE } ]
@@ -72,7 +67,6 @@ CREATE AGGREGATE <replaceable class="PARAMETER">name</replaceable> (
    [ , COMBINEFUNC = <replaceable class="PARAMETER">combinefunc</replaceable> ]
    [ , SERIALFUNC = <replaceable class="PARAMETER">serialfunc</replaceable> ]
    [ , DESERIALFUNC = <replaceable class="PARAMETER">deserialfunc</replaceable> ]
-    [ , SERIALTYPE = <replaceable class="PARAMETER">serialtype</replaceable> ]
    [ , INITCOND = <replaceable class="PARAMETER">initial_condition</replaceable> ]
    [ , MSFUNC = <replaceable class="PARAMETER">msfunc</replaceable> ]
    [ , MINVFUNC = <replaceable class="PARAMETER">minvfunc</replaceable> ]
@@ -255,7 +249,7 @@ SELECT col FROM tab ORDER BY col USING sortop LIMIT 1;
   To be able to create an aggregate function, you must
   have <literal>USAGE</literal> privilege on the argument types, the state
   type(s), and the return type, as well as <literal>EXECUTE</literal>
-   privilege on the transition and final functions.
+   privilege on the supporting functions.
  </para>
 </refsect1>
@@ -412,38 +406,51 @@ SELECT col FROM tab ORDER BY col USING sortop LIMIT 1;
    <term><replaceable class="PARAMETER">combinefunc</replaceable></term>
    <listitem>
     <para>
-      The <replaceable class="PARAMETER">combinefunc</replaceable> may
+      The <replaceable class="PARAMETER">combinefunc</replaceable> function
-      optionally be specified in order to allow the aggregate function to
+      may optionally be specified to allow the aggregate function to support
-      support partial aggregation. This is a prerequisite to allow the
+      partial aggregation. This is a prerequisite to allow the aggregate to
-      aggregate to participate in certain optimizations such as parallel
+      participate in certain optimizations such as parallel aggregation.
-      aggregation.
     </para>
     <para>
-      This function can be thought of as an <replaceable class="PARAMETER">
+      If provided,
-      sfunc</replaceable>, where instead of acting upon individual input rows
+      the <replaceable class="PARAMETER">combinefunc</replaceable> must
-      and adding these to the aggregate state, it adds other aggregate states
+      combine two <replaceable class="PARAMETER">state_data_type</replaceable>
-      to the aggregate state.
+      values, each containing the result of aggregation over some subset of
+      the input values, to produce a
+      new <replaceable class="PARAMETER">state_data_type</replaceable> that
+      represents the result of aggregating over both sets of inputs.  This
+      function can be thought of as
+      an <replaceable class="PARAMETER">sfunc</replaceable>, where instead of
+      acting upon individual input rows and adding these to the aggregate
+      state, it adds another aggregate state to the aggregate state.
+      Typically, it is not possible to define
+      a <replaceable class="PARAMETER">combinefunc</replaceable> for aggregate
+      functions that are sensitive to the order of the input values, since the
+      relative ordering of the inputs that went into the subset states is
+      indeterminate.
     </para>
     <para>
      The <replaceable class="PARAMETER">combinefunc</replaceable> must accept
-      two arguments of <replaceable class="PARAMETER">state_data_type
+      two arguments of
-      </replaceable> and return <replaceable class="PARAMETER">state_data_type
+      the <replaceable class="PARAMETER">state_data_type</replaceable> and
-      </replaceable>. Optionally this function may be <quote>strict</quote>. In
+      return a value of
-      this case the function will not be called when either of the input states
+      the <replaceable class="PARAMETER">state_data_type</replaceable>.
-      are null.
+      Optionally this function may be <quote>strict</quote>. In this case the
+      function will not be called when either of the input states are null;
+      the other state will be taken as the correct result.
     </para>
     <para>
-      For aggregate functions with an <literal>INTERNAL</literal>
+      For aggregate functions
-      <replaceable class="PARAMETER">state_data_type</replaceable> the
+      whose <replaceable class="PARAMETER">state_data_type</replaceable>
-      <replaceable class="PARAMETER">combinefunc</replaceable> must not be
+      is <type>internal</type>,
-      <quote>strict</quote>. In this scenario the
+      the <replaceable class="PARAMETER">combinefunc</replaceable> must not be
-      <replaceable class="PARAMETER">combinefunc</replaceable> must take charge
+      strict. In this scenario
-      and ensure that the null states are handled correctly and that the state
+      the <replaceable class="PARAMETER">combinefunc</replaceable> must ensure
-      being returned is a pointer to memory which belongs in the aggregate
+      that null states are handled correctly and that the state being returned
-      memory context.
+      is properly stored in the aggregate memory context.
     </para>
    </listitem>
   </varlistentry>
@@ -452,14 +459,13 @@ SELECT col FROM tab ORDER BY col USING sortop LIMIT 1;
    <term><replaceable class="PARAMETER">serialfunc</replaceable></term>
    <listitem>
     <para>
-      In order to allow aggregate functions with an <literal>INTERNAL</>
+      An aggregate function
-      <replaceable class="PARAMETER">state_data_type</replaceable> to
+      whose <replaceable class="PARAMETER">state_data_type</replaceable>
-      participate in parallel aggregation, the aggregate must have a valid
+      is <type>internal</> can participate in parallel aggregation only if it
-      <replaceable class="PARAMETER">serialfunc</replaceable>, which must
+      has a <replaceable class="PARAMETER">serialfunc</replaceable> function,
-      serialize the aggregate state into <replaceable class="PARAMETER">
+      which must serialize the aggregate state into a <type>bytea</> value for
-      serialtype</replaceable>. This function must take a single argument of
+      transmission to another process.  This function must take a single
-      <replaceable class="PARAMETER">state_data_type</replaceable> and return
+      argument of type <type>internal</> and return type <type>bytea</>.  A
-      <replaceable class="PARAMETER">serialtype</replaceable>. A
      corresponding <replaceable class="PARAMETER">deserialfunc</replaceable>
      is also required.
     </para>
@@ -470,21 +476,12 @@ SELECT col FROM tab ORDER BY col USING sortop LIMIT 1;
    <term><replaceable class="PARAMETER">deserialfunc</replaceable></term>
    <listitem>
     <para>
-      Deserializes a previously serialized aggregate state back into
+      Deserialize a previously serialized aggregate state back into
      <replaceable class="PARAMETER">state_data_type</replaceable>. This
-      function must take a single argument of <replaceable class="PARAMETER">
+      function must take two arguments of types <type>bytea</>
-      serialtype</replaceable> and return <replaceable class="PARAMETER">
+      and <type>internal</>, and produce a result of type <type>internal</>.
-      state_data_type</replaceable>.
+      (Note: the second, <type>internal</> argument is unused, but is required
-     </para>
+      for type safety reasons.)
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term><replaceable class="PARAMETER">serialtype</replaceable></term>
-    <listitem>
-     <para>
-      The data type to into which an <literal>INTERNAL</literal> aggregate
-      state should be serialized.
     </para>
    </listitem>
   </varlistentry>

--- a/src/backend/catalog/pg_aggregate.c
+++ b/src/backend/catalog/pg_aggregate.c
@@ -67,7 +67,6 @@ AggregateCreate(const char *aggName,
 				bool mfinalfnExtraArgs,
 				List *aggsortopName,
 				Oid aggTransType,
-				Oid aggSerialType,
 				int32 aggTransSpace,
 				Oid aggmTransType,
 				int32 aggmTransSpace,
@@ -440,44 +439,42 @@ AggregateCreate(const char *aggName,
 	}
 	/*
-	 * Validate the serialization function, if present. We must ensure that
+	 * Validate the serialization function, if present.
-	 * the return type of this function is the same as the specified
-	 * serialType.
 	 */
 	if (aggserialfnName)
 	{
-		fnArgs[0] = aggTransType;
+		fnArgs[0] = INTERNALOID;
 		serialfn = lookup_agg_function(aggserialfnName, 1,
 									   fnArgs, variadicArgType,
 									   &rettype);
-		if (rettype != aggSerialType)
+		if (rettype != BYTEAOID)
 			ereport(ERROR,
 					(errcode(ERRCODE_DATATYPE_MISMATCH),
 				 errmsg("return type of serialization function %s is not %s",
 						NameListToString(aggserialfnName),
-						format_type_be(aggSerialType))));
+						format_type_be(BYTEAOID))));
 	}
 	/*
-	 * Validate the deserialization function, if present. We must ensure that
+	 * Validate the deserialization function, if present.
-	 * the return type of this function is the same as the transType.
 	 */
 	if (aggdeserialfnName)
 	{
-		fnArgs[0] = aggSerialType;
+		fnArgs[0] = BYTEAOID;
+		fnArgs[1] = INTERNALOID;	/* dummy argument for type safety */
-		deserialfn = lookup_agg_function(aggdeserialfnName, 1,
+		deserialfn = lookup_agg_function(aggdeserialfnName, 2,
 										 fnArgs, variadicArgType,
 										 &rettype);
-		if (rettype != aggTransType)
+		if (rettype != INTERNALOID)
 			ereport(ERROR,
 					(errcode(ERRCODE_DATATYPE_MISMATCH),
 			   errmsg("return type of deserialization function %s is not %s",
 					  NameListToString(aggdeserialfnName),
-					  format_type_be(aggTransType))));
+					  format_type_be(INTERNALOID))));
 	}
 	/*
@@ -661,7 +658,6 @@ AggregateCreate(const char *aggName,
 	values[Anum_pg_aggregate_aggmfinalextra - 1] = BoolGetDatum(mfinalfnExtraArgs);
 	values[Anum_pg_aggregate_aggsortop - 1] = ObjectIdGetDatum(sortop);
 	values[Anum_pg_aggregate_aggtranstype - 1] = ObjectIdGetDatum(aggTransType);
-	values[Anum_pg_aggregate_aggserialtype - 1] = ObjectIdGetDatum(aggSerialType);
 	values[Anum_pg_aggregate_aggtransspace - 1] = Int32GetDatum(aggTransSpace);
 	values[Anum_pg_aggregate_aggmtranstype - 1] = ObjectIdGetDatum(aggmTransType);
 	values[Anum_pg_aggregate_aggmtransspace - 1] = Int32GetDatum(aggmTransSpace);
@@ -688,8 +684,7 @@ AggregateCreate(const char *aggName,
 	 * Create dependencies for the aggregate (above and beyond those already
 	 * made by ProcedureCreate).  Note: we don't need an explicit dependency
 	 * on aggTransType since we depend on it indirectly through transfn.
-	 * Likewise for aggmTransType using the mtransfunc, and also for
+	 * Likewise for aggmTransType using the mtransfunc, if it exists.
-	 * aggSerialType using the serialfn, if they exist.
 	 */
 	/* Depends on transition function */

--- a/src/backend/commands/aggregatecmds.c
+++ b/src/backend/commands/aggregatecmds.c
@@ -72,7 +72,6 @@ DefineAggregate(List *name, List *args, bool oldstyle, List *parameters,
 	List	   *sortoperatorName = NIL;
 	TypeName   *baseType = NULL;
 	TypeName   *transType = NULL;
-	TypeName   *serialType = NULL;
 	TypeName   *mtransType = NULL;
 	int32		transSpace = 0;
 	int32		mtransSpace = 0;
@@ -88,7 +87,6 @@ DefineAggregate(List *name, List *args, bool oldstyle, List *parameters,
 	List	   *parameterDefaults;
 	Oid			variadicArgType;
 	Oid			transTypeId;
-	Oid			serialTypeId = InvalidOid;
 	Oid			mtransTypeId = InvalidOid;
 	char		transTypeType;
 	char		mtransTypeType = 0;
@@ -164,8 +162,6 @@ DefineAggregate(List *name, List *args, bool oldstyle, List *parameters,
 		}
 		else if (pg_strcasecmp(defel->defname, "stype") == 0)
 			transType = defGetTypeName(defel);
-		else if (pg_strcasecmp(defel->defname, "serialtype") == 0)
-			serialType = defGetTypeName(defel);
 		else if (pg_strcasecmp(defel->defname, "stype1") == 0)
 			transType = defGetTypeName(defel);
 		else if (pg_strcasecmp(defel->defname, "sspace") == 0)
@@ -333,73 +329,25 @@ DefineAggregate(List *name, List *args, bool oldstyle, List *parameters,
 							format_type_be(transTypeId))));
 	}
-	if (serialType)
+	if (serialfuncName && deserialfuncName)
 	{
 		/*
-		 * There's little point in having a serialization/deserialization
+		 * Serialization is only needed/allowed for transtype INTERNAL.
-		 * function on aggregates that don't have an internal state, so let's
-		 * just disallow this as it may help clear up any confusion or
-		 * needless authoring of these functions.
 		 */
 		if (transTypeId != INTERNALOID)
 			ereport(ERROR,
 					(errcode(ERRCODE_INVALID_FUNCTION_DEFINITION),
-					 errmsg("a serialization type must only be specified when the aggregate transition data type is %s",
+					 errmsg("serialization functions may be specified only when the aggregate transition data type is %s",
 							format_type_be(INTERNALOID))));
-		serialTypeId = typenameTypeId(NULL, serialType);
-		if (get_typtype(mtransTypeId) == TYPTYPE_PSEUDO &&
-			!IsPolymorphicType(serialTypeId))
-			ereport(ERROR,
-					(errcode(ERRCODE_INVALID_FUNCTION_DEFINITION),
-					 errmsg("aggregate serialization data type cannot be %s",
-							format_type_be(serialTypeId))));
-		/*
-		 * We disallow INTERNAL serialType as the whole point of the
-		 * serialized types is to allow the aggregate state to be output, and
-		 * we cannot output INTERNAL. This check, combined with the one above
-		 * ensures that the trans type and serialization type are not the
-		 * same.
-		 */
-		if (serialTypeId == INTERNALOID)
-			ereport(ERROR,
-					(errcode(ERRCODE_INVALID_FUNCTION_DEFINITION),
-					 errmsg("aggregate serialization data type cannot be %s",
-							format_type_be(serialTypeId))));
-		/*
-		 * If serialType is specified then serialfuncName and deserialfuncName
-		 * must be present; if not, then none of the serialization options
-		 * should have been specified.
-		 */
-		if (serialfuncName == NIL)
-			ereport(ERROR,
-					(errcode(ERRCODE_INVALID_FUNCTION_DEFINITION),
-					 errmsg("aggregate serialization function must be specified when serialization type is specified")));
-		if (deserialfuncName == NIL)
-			ereport(ERROR,
-					(errcode(ERRCODE_INVALID_FUNCTION_DEFINITION),
-					 errmsg("aggregate deserialization function must be specified when serialization type is specified")));
 	}
-	else
+	else if (serialfuncName || deserialfuncName)
 	{
 		/*
-		 * If serialization type was not specified then there shouldn't be a
+		 * Cannot specify one function without the other.
-		 * serialization function.
 		 */
-		if (serialfuncName != NIL)
-			ereport(ERROR,
-					(errcode(ERRCODE_INVALID_FUNCTION_DEFINITION),
-					 errmsg("must specify serialization type when specifying serialization function")));
-		/* likewise for the deserialization function */
-		if (deserialfuncName != NIL)
 		ereport(ERROR,
 				(errcode(ERRCODE_INVALID_FUNCTION_DEFINITION),
-					 errmsg("must specify serialization type when specifying deserialization function")));
+				 errmsg("must specify both or neither of serialization and deserialization functions")));
 	}
 	/*
@@ -493,7 +441,6 @@ DefineAggregate(List *name, List *args, bool oldstyle, List *parameters,
 						   mfinalfuncExtraArgs,
 						   sortoperatorName,	/* sort operator name */
 						   transTypeId, /* transition data type */
-						   serialTypeId,		/* serialization data type */
 						   transSpace,	/* transition space */
 						   mtransTypeId,		/* transition data type */
 						   mtransSpace, /* transition space */

--- a/src/backend/executor/nodeAgg.c
+++ b/src/backend/executor/nodeAgg.c
@@ -514,10 +514,9 @@ static Datum GetAggInitVal(Datum textInitVal, Oid transtype);
 static void build_pertrans_for_aggref(AggStatePerTrans pertrans,
 						  AggState *aggsate, EState *estate,
 						  Aggref *aggref, Oid aggtransfn, Oid aggtranstype,
-						  Oid aggserialtype, Oid aggserialfn,
+						  Oid aggserialfn, Oid aggdeserialfn,
-						  Oid aggdeserialfn, Datum initValue,
+						  Datum initValue, bool initValueIsNull,
-						  bool initValueIsNull, Oid *inputTypes,
+						  Oid *inputTypes, int numArguments);
-						  int numArguments);
 static int find_compatible_peragg(Aggref *newagg, AggState *aggstate,
 					   int lastaggno, List **same_input_transnos);
 static int find_compatible_pertrans(AggState *aggstate, Aggref *newagg,
@@ -996,6 +995,9 @@ combine_aggregates(AggState *aggstate, AggStatePerGroup pergroup)
 				dsinfo->arg[0] = slot->tts_values[0];
 				dsinfo->argnull[0] = slot->tts_isnull[0];
+				/* Dummy second argument for type-safety reasons */
+				dsinfo->arg[1] = PointerGetDatum(NULL);
+				dsinfo->argnull[1] = false;
 				/*
 				 * We run the deserialization functions in per-input-tuple
@@ -2669,8 +2671,7 @@ ExecInitAgg(Agg *node, EState *estate, int eflags)
 		AclResult	aclresult;
 		Oid			transfn_oid,
 					finalfn_oid;
-		Oid			serialtype_oid,
+		Oid			serialfn_oid,
-					serialfn_oid,
 					deserialfn_oid;
 		Expr	   *finalfnexpr;
 		Oid			aggtranstype;
@@ -2740,7 +2741,6 @@ ExecInitAgg(Agg *node, EState *estate, int eflags)
 		else
 			peragg->finalfn_oid = finalfn_oid = InvalidOid;
-		serialtype_oid = InvalidOid;
 		serialfn_oid = InvalidOid;
 		deserialfn_oid = InvalidOid;
@@ -2753,13 +2753,9 @@ ExecInitAgg(Agg *node, EState *estate, int eflags)
 		{
 			/*
 			 * The planner should only have generated an agg node with
-			 * serialStates if every aggregate with an INTERNAL state has a
+			 * serialStates if every aggregate with an INTERNAL state has
-			 * serialization type, serialization function and deserialization
+			 * serialization/deserialization functions.  Verify that.
-			 * function. Let's ensure it didn't mess that up.
 			 */
-			if (!OidIsValid(aggform->aggserialtype))
-				elog(ERROR, "serialtype not set during serialStates aggregation step");
 			if (!OidIsValid(aggform->aggserialfn))
 				elog(ERROR, "serialfunc not set during serialStates aggregation step");
@@ -2768,17 +2764,11 @@ ExecInitAgg(Agg *node, EState *estate, int eflags)
 			/* serialization func only required when not finalizing aggs */
 			if (!aggstate->finalizeAggs)
-			{
 				serialfn_oid = aggform->aggserialfn;
-				serialtype_oid = aggform->aggserialtype;
-			}
 			/* deserialization func only required when combining states */
 			if (aggstate->combineStates)
-			{
 				deserialfn_oid = aggform->aggdeserialfn;
-				serialtype_oid = aggform->aggserialtype;
-			}
 		}
 		/* Check that aggregate owner has permission to call component fns */
@@ -2906,10 +2896,9 @@ ExecInitAgg(Agg *node, EState *estate, int eflags)
 			pertrans = &pertransstates[++transno];
 			build_pertrans_for_aggref(pertrans, aggstate, estate,
 									  aggref, transfn_oid, aggtranstype,
-									  serialtype_oid, serialfn_oid,
+									  serialfn_oid, deserialfn_oid,
-									  deserialfn_oid, initValue,
+									  initValue, initValueIsNull,
-									  initValueIsNull, inputTypes,
+									  inputTypes, numArguments);
-									  numArguments);
 			peragg->transno = transno;
 		}
 		ReleaseSysCache(aggTuple);
@@ -2937,7 +2926,7 @@ static void
 build_pertrans_for_aggref(AggStatePerTrans pertrans,
 						  AggState *aggstate, EState *estate,
 						  Aggref *aggref,
-						  Oid aggtransfn, Oid aggtranstype, Oid aggserialtype,
+						  Oid aggtransfn, Oid aggtranstype,
 						  Oid aggserialfn, Oid aggdeserialfn,
 						  Datum initValue, bool initValueIsNull,
 						  Oid *inputTypes, int numArguments)
@@ -3065,10 +3054,7 @@ build_pertrans_for_aggref(AggStatePerTrans pertrans,
 	if (OidIsValid(aggserialfn))
 	{
-		build_aggregate_serialfn_expr(aggtranstype,
+		build_aggregate_serialfn_expr(aggserialfn,
-									  aggserialtype,
-									  aggref->inputcollid,
-									  aggserialfn,
 									  &serialfnexpr);
 		fmgr_info(aggserialfn, &pertrans->serialfn);
 		fmgr_info_set_expr((Node *) serialfnexpr, &pertrans->serialfn);
@@ -3076,24 +3062,21 @@ build_pertrans_for_aggref(AggStatePerTrans pertrans,
 		InitFunctionCallInfoData(pertrans->serialfn_fcinfo,
 								 &pertrans->serialfn,
 								 1,
-								 pertrans->aggCollation,
+								 InvalidOid,
 								 (void *) aggstate, NULL);
 	}
 	if (OidIsValid(aggdeserialfn))
 	{
-		build_aggregate_serialfn_expr(aggserialtype,
+		build_aggregate_deserialfn_expr(aggdeserialfn,
-									  aggtranstype,
-									  aggref->inputcollid,
-									  aggdeserialfn,
 										&deserialfnexpr);
 		fmgr_info(aggdeserialfn, &pertrans->deserialfn);
 		fmgr_info_set_expr((Node *) deserialfnexpr, &pertrans->deserialfn);
 		InitFunctionCallInfoData(pertrans->deserialfn_fcinfo,
 								 &pertrans->deserialfn,
-								 1,
+								 2,
-								 pertrans->aggCollation,
+								 InvalidOid,
 								 (void *) aggstate, NULL);
 	}

--- a/src/backend/optimizer/util/clauses.c
+++ b/src/backend/optimizer/util/clauses.c
@@ -465,13 +465,11 @@ aggregates_allow_partial_walker(Node *node, partial_agg_context *context)
 		/*
 		 * If we find any aggs with an internal transtype then we must check
-		 * that these have a serialization type, serialization func and
+		 * whether these have serialization/deserialization functions;
-		 * deserialization func; otherwise, we set the maximum allowed type to
+		 * otherwise, we set the maximum allowed type to PAT_INTERNAL_ONLY.
-		 * PAT_INTERNAL_ONLY.
 		 */
 		if (aggform->aggtranstype == INTERNALOID &&
-			(!OidIsValid(aggform->aggserialtype) ||
+			(!OidIsValid(aggform->aggserialfn) ||
-			 !OidIsValid(aggform->aggserialfn) ||
 			 !OidIsValid(aggform->aggdeserialfn)))
 			context->allowedtype = PAT_INTERNAL_ONLY;

--- a/src/backend/optimizer/util/tlist.c
+++ b/src/backend/optimizer/util/tlist.c
@@ -15,7 +15,7 @@
 #include "postgres.h"
 #include "access/htup_details.h"
-#include "catalog/pg_aggregate.h"
+#include "catalog/pg_type.h"
 #include "nodes/makefuncs.h"
 #include "nodes/nodeFuncs.h"
 #include "optimizer/tlist.h"
@@ -766,8 +766,8 @@ apply_pathtarget_labeling_to_tlist(List *tlist, PathTarget *target)
 /*
 * apply_partialaggref_adjustment
 *	  Convert PathTarget to be suitable for a partial aggregate node. We simply
- *	  adjust any Aggref nodes found in the target and set the aggoutputtype to
+ *	  adjust any Aggref nodes found in the target and set the aggoutputtype
- *	  the aggtranstype or aggserialtype. This allows exprType() to return the
+ *	  appropriately. This allows exprType() to return the
 *	  actual type that will be produced.
 *
 * Note: We expect 'target' to be a flat target list and not have Aggrefs buried
@@ -784,40 +784,29 @@ apply_partialaggref_adjustment(PathTarget *target)
 		if (IsA(aggref, Aggref))
 		{
-			HeapTuple	aggTuple;
-			Form_pg_aggregate aggform;
 			Aggref	   *newaggref;
-			aggTuple = SearchSysCache1(AGGFNOID,
-									   ObjectIdGetDatum(aggref->aggfnoid));
-			if (!HeapTupleIsValid(aggTuple))
-				elog(ERROR, "cache lookup failed for aggregate %u",
-					 aggref->aggfnoid);
-			aggform = (Form_pg_aggregate) GETSTRUCT(aggTuple);
 			newaggref = (Aggref *) copyObject(aggref);
 			/*
-			 * Use the serialization type, if one exists.  Note that we don't
+			 * Normally, a partial aggregate returns the aggregate's
-			 * support it being a polymorphic type.  (XXX really we ought to
+			 * transition type, but if that's INTERNAL, it returns BYTEA
-			 * hardwire this as INTERNAL -> BYTEA, and avoid a catalog lookup
+			 * instead.  (XXX this assumes we're doing parallel aggregate with
-			 * here altogether?)
+			 * serialization; later we might need an argument to tell this
+			 * function whether we're doing parallel or just local partial
+			 * aggregation.)
 			 */
-			if (OidIsValid(aggform->aggserialtype))
-				newaggref->aggoutputtype = aggform->aggserialtype;
-			else
-			{
-				/* Otherwise, we return the aggregate's transition type */
 			Assert(OidIsValid(newaggref->aggtranstype));
+			if (newaggref->aggtranstype == INTERNALOID)
+				newaggref->aggoutputtype = BYTEAOID;
+			else
 				newaggref->aggoutputtype = newaggref->aggtranstype;
-			}
 			/* flag it as partial */
 			newaggref->aggpartial = true;
 			lfirst(lc) = newaggref;
-			ReleaseSysCache(aggTuple);
 		}
 	}
 }
--- a/src/backend/parser/parse_agg.c
+++ b/src/backend/parser/parse_agg.c
@@ -71,6 +71,8 @@ static bool finalize_grouping_exprs_walker(Node *node,
 							   check_ungrouped_columns_context *context);
 static void check_agglevels_and_constraints(ParseState *pstate, Node *expr);
 static List *expand_groupingset_node(GroupingSet *gs);
+static Node *make_agg_arg(Oid argtype, Oid argcollation);
 /*
 * transformAggregateCall -
@@ -1863,37 +1865,19 @@ build_aggregate_transfn_expr(Oid *agg_input_types,
 							 Expr **transfnexpr,
 							 Expr **invtransfnexpr)
 {
-	Param	   *argp;
 	List	   *args;
 	FuncExpr   *fexpr;
 	int			i;
 	/*
-	 * Build arg list to use in the transfn FuncExpr node. We really only care
+	 * Build arg list to use in the transfn FuncExpr node.
-	 * that transfn can discover the actual argument types at runtime using
-	 * get_fn_expr_argtype(), so it's okay to use Param nodes that don't
-	 * correspond to any real Param.
 	 */
-	argp = makeNode(Param);
+	args = list_make1(make_agg_arg(agg_state_type, agg_input_collation));
-	argp->paramkind = PARAM_EXEC;
-	argp->paramid = -1;
-	argp->paramtype = agg_state_type;
-	argp->paramtypmod = -1;
-	argp->paramcollid = agg_input_collation;
-	argp->location = -1;
-	args = list_make1(argp);
 	for (i = agg_num_direct_inputs; i < agg_num_inputs; i++)
 	{
-		argp = makeNode(Param);
+		args = lappend(args,
-		argp->paramkind = PARAM_EXEC;
+					   make_agg_arg(agg_input_types[i], agg_input_collation));
-		argp->paramid = -1;
-		argp->paramtype = agg_input_types[i];
-		argp->paramtypmod = -1;
-		argp->paramcollid = agg_input_collation;
-		argp->location = -1;
-		args = lappend(args, argp);
 	}
 	fexpr = makeFuncExpr(transfn_oid,
@@ -1936,20 +1920,13 @@ build_aggregate_combinefn_expr(Oid agg_state_type,
 							   Oid combinefn_oid,
 							   Expr **combinefnexpr)
 {
-	Param	   *argp;
+	Node	   *argp;
 	List	   *args;
 	FuncExpr   *fexpr;
-	/* Build arg list to use in the combinefn FuncExpr node. */
+	/* combinefn takes two arguments of the aggregate state type */
-	argp = makeNode(Param);
+	argp = make_agg_arg(agg_state_type, agg_input_collation);
-	argp->paramkind = PARAM_EXEC;
-	argp->paramid = -1;
-	argp->paramtype = agg_state_type;
-	argp->paramtypmod = -1;
-	argp->paramcollid = agg_input_collation;
-	argp->location = -1;
-	/* transition state type is arg 1 and 2 */
 	args = list_make2(argp, argp);
 	fexpr = makeFuncExpr(combinefn_oid,
@@ -1958,49 +1935,57 @@ build_aggregate_combinefn_expr(Oid agg_state_type,
 						 InvalidOid,
 						 agg_input_collation,
 						 COERCE_EXPLICIT_CALL);
-	fexpr->funcvariadic = false;
+	/* combinefn is currently never treated as variadic */
 	*combinefnexpr = (Expr *) fexpr;
 }
 /*
 * Like build_aggregate_transfn_expr, but creates an expression tree for the
- * serialization or deserialization function of an aggregate, rather than the
+ * serialization function of an aggregate.
- * transition function. This may be used for either the serialization or
- * deserialization function by swapping the first two parameters over.
 */
 void
-build_aggregate_serialfn_expr(Oid agg_input_type,
+build_aggregate_serialfn_expr(Oid serialfn_oid,
-							  Oid agg_output_type,
-							  Oid agg_input_collation,
-							  Oid serialfn_oid,
 							  Expr **serialfnexpr)
 {
-	Param	   *argp;
 	List	   *args;
 	FuncExpr   *fexpr;
-	/* Build arg list to use in the FuncExpr node. */
+	/* serialfn always takes INTERNAL and returns BYTEA */
-	argp = makeNode(Param);
+	args = list_make1(make_agg_arg(INTERNALOID, InvalidOid));
-	argp->paramkind = PARAM_EXEC;
-	argp->paramid = -1;
-	argp->paramtype = agg_input_type;
-	argp->paramtypmod = -1;
-	argp->paramcollid = agg_input_collation;
-	argp->location = -1;
-	/* takes a single arg of the agg_input_type */
-	args = list_make1(argp);
 	fexpr = makeFuncExpr(serialfn_oid,
-						 agg_output_type,
+						 BYTEAOID,
 						 args,
 						 InvalidOid,
-						 agg_input_collation,
+						 InvalidOid,
 						 COERCE_EXPLICIT_CALL);
-	fexpr->funcvariadic = false;
 	*serialfnexpr = (Expr *) fexpr;
 }
+/*
+ * Like build_aggregate_transfn_expr, but creates an expression tree for the
+ * deserialization function of an aggregate.
+ */
+void
+build_aggregate_deserialfn_expr(Oid deserialfn_oid,
+								Expr **deserialfnexpr)
+{
+	List	   *args;
+	FuncExpr   *fexpr;
+	/* deserialfn always takes BYTEA, INTERNAL and returns INTERNAL */
+	args = list_make2(make_agg_arg(BYTEAOID, InvalidOid),
+					  make_agg_arg(INTERNALOID, InvalidOid));
+	fexpr = makeFuncExpr(deserialfn_oid,
+						 INTERNALOID,
+						 args,
+						 InvalidOid,
+						 InvalidOid,
+						 COERCE_EXPLICIT_CALL);
+	*deserialfnexpr = (Expr *) fexpr;
+}
 /*
 * Like build_aggregate_transfn_expr, but creates an expression tree for the
 * final function of an aggregate, rather than the transition function.
@@ -2014,33 +1999,19 @@ build_aggregate_finalfn_expr(Oid *agg_input_types,
 							 Oid finalfn_oid,
 							 Expr **finalfnexpr)
 {
-	Param	   *argp;
 	List	   *args;
 	int			i;
 	/*
 	 * Build expr tree for final function
 	 */
-	argp = makeNode(Param);
+	args = list_make1(make_agg_arg(agg_state_type, agg_input_collation));
-	argp->paramkind = PARAM_EXEC;
-	argp->paramid = -1;
-	argp->paramtype = agg_state_type;
-	argp->paramtypmod = -1;
-	argp->paramcollid = agg_input_collation;
-	argp->location = -1;
-	args = list_make1(argp);
 	/* finalfn may take additional args, which match agg's input types */
 	for (i = 0; i < num_finalfn_inputs - 1; i++)
 	{
-		argp = makeNode(Param);
+		args = lappend(args,
-		argp->paramkind = PARAM_EXEC;
+					   make_agg_arg(agg_input_types[i], agg_input_collation));
-		argp->paramid = -1;
-		argp->paramtype = agg_input_types[i];
-		argp->paramtypmod = -1;
-		argp->paramcollid = agg_input_collation;
-		argp->location = -1;
-		args = lappend(args, argp);
 	}
 	*finalfnexpr = (Expr *) makeFuncExpr(finalfn_oid,
@@ -2051,3 +2022,24 @@ build_aggregate_finalfn_expr(Oid *agg_input_types,
 										 COERCE_EXPLICIT_CALL);
 	/* finalfn is currently never treated as variadic */
 }
+/*
+ * Convenience function to build dummy argument expressions for aggregates.
+ *
+ * We really only care that an aggregate support function can discover its
+ * actual argument types at runtime using get_fn_expr_argtype(), so it's okay
+ * to use Param nodes that don't correspond to any real Param.
+ */
+static Node *
+make_agg_arg(Oid argtype, Oid argcollation)
+{
+	Param	   *argp = makeNode(Param);
+	argp->paramkind = PARAM_EXEC;
+	argp->paramid = -1;
+	argp->paramtype = argtype;
+	argp->paramtypmod = -1;
+	argp->paramcollid = argcollation;
+	argp->location = -1;
+	return (Node *) argp;
+}
--- a/src/backend/utils/adt/numeric.c
+++ b/src/backend/utils/adt/numeric.c
@@ -3510,10 +3510,7 @@ numeric_avg_combine(PG_FUNCTION_ARGS)
 /*
 * numeric_avg_serialize
 *		Serialize NumericAggState for numeric aggregates that don't require
- *		sumX2. Serializes NumericAggState into bytea using the standard pq API.
+ *		sumX2.
- *
- * numeric_avg_deserialize(numeric_avg_serialize(state)) must result in a state
- * which matches the original input state.
 */
 Datum
 numeric_avg_serialize(PG_FUNCTION_ARGS)
@@ -3565,16 +3562,12 @@ numeric_avg_serialize(PG_FUNCTION_ARGS)
 /*
 * numeric_avg_deserialize
 *		Deserialize bytea into NumericAggState for numeric aggregates that
- *		don't require sumX2. Deserializes bytea into NumericAggState using the
+ *		don't require sumX2.
- *		standard pq API.
- *
- * numeric_avg_serialize(numeric_avg_deserialize(bytea)) must result in a value
- * which matches the original bytea value.
 */
 Datum
 numeric_avg_deserialize(PG_FUNCTION_ARGS)
 {
-	bytea	   *sstate = PG_GETARG_BYTEA_P(0);
+	bytea	   *sstate;
 	NumericAggState *result;
 	Datum		temp;
 	StringInfoData buf;
@@ -3582,6 +3575,8 @@ numeric_avg_deserialize(PG_FUNCTION_ARGS)
 	if (!AggCheckCallContext(fcinfo, NULL))
 		elog(ERROR, "aggregate function called in non-aggregate context");
+	sstate = PG_GETARG_BYTEA_P(0);
 	/*
 	 * Copy the bytea into a StringInfo so that we can "receive" it using the
 	 * standard pq API.
@@ -3619,11 +3614,7 @@ numeric_avg_deserialize(PG_FUNCTION_ARGS)
 /*
 * numeric_serialize
 *		Serialization function for NumericAggState for numeric aggregates that
- *		require sumX2. Serializes NumericAggState into bytea using the standard
+ *		require sumX2.
- *		pq API.
- *
- * numeric_deserialize(numeric_serialize(state)) must result in a state which
- * matches the original input state.
 */
 Datum
 numeric_serialize(PG_FUNCTION_ARGS)
@@ -3683,16 +3674,12 @@ numeric_serialize(PG_FUNCTION_ARGS)
 /*
 * numeric_deserialize
 *		Deserialization function for NumericAggState for numeric aggregates that
- *		require sumX2. Deserializes bytea into into NumericAggState using the
+ *		require sumX2.
- *		standard pq API.
- *
- * numeric_serialize(numeric_deserialize(bytea)) must result in a value which
- * matches the original bytea value.
 */
 Datum
 numeric_deserialize(PG_FUNCTION_ARGS)
 {
-	bytea	   *sstate = PG_GETARG_BYTEA_P(0);
+	bytea	   *sstate;
 	NumericAggState *result;
 	Datum		temp;
 	StringInfoData buf;
@@ -3700,6 +3687,8 @@ numeric_deserialize(PG_FUNCTION_ARGS)
 	if (!AggCheckCallContext(fcinfo, NULL))
 		elog(ERROR, "aggregate function called in non-aggregate context");
+	sstate = PG_GETARG_BYTEA_P(0);
 	/*
 	 * Copy the bytea into a StringInfo so that we can "receive" it using the
 	 * standard pq API.
@@ -3992,11 +3981,8 @@ numeric_poly_combine(PG_FUNCTION_ARGS)
 /*
 * numeric_poly_serialize
- *		Serialize PolyNumAggState into bytea using the standard pq API for
+ *		Serialize PolyNumAggState into bytea for aggregate functions which
- *		aggregate functions which require sumX2.
+ *		require sumX2.
- *
- * numeric_poly_deserialize(numeric_poly_serialize(state)) must result in a
- * state which matches the original input state.
 */
 Datum
 numeric_poly_serialize(PG_FUNCTION_ARGS)
@@ -4067,16 +4053,13 @@ numeric_poly_serialize(PG_FUNCTION_ARGS)
 /*
 * numeric_poly_deserialize
- *		Deserialize PolyNumAggState from bytea using the standard pq API for
+ *		Deserialize PolyNumAggState from bytea for aggregate functions which
- *		aggregate functions which require sumX2.
+ *		require sumX2.
- *
- * numeric_poly_serialize(numeric_poly_deserialize(bytea)) must result in a
- * state which matches the original input state.
 */
 Datum
 numeric_poly_deserialize(PG_FUNCTION_ARGS)
 {
-	bytea	   *sstate = PG_GETARG_BYTEA_P(0);
+	bytea	   *sstate;
 	PolyNumAggState *result;
 	Datum		sumX;
 	Datum		sumX2;
@@ -4085,6 +4068,8 @@ numeric_poly_deserialize(PG_FUNCTION_ARGS)
 	if (!AggCheckCallContext(fcinfo, NULL))
 		elog(ERROR, "aggregate function called in non-aggregate context");
+	sstate = PG_GETARG_BYTEA_P(0);
 	/*
 	 * Copy the bytea into a StringInfo so that we can "receive" it using the
 	 * standard pq API.
@@ -4226,9 +4211,6 @@ int8_avg_combine(PG_FUNCTION_ARGS)
 /*
 * int8_avg_serialize
 *		Serialize PolyNumAggState into bytea using the standard pq API.
- *
- * int8_avg_deserialize(int8_avg_serialize(state)) must result in a state which
- * matches the original input state.
 */
 Datum
 int8_avg_serialize(PG_FUNCTION_ARGS)
@@ -4286,14 +4268,11 @@ int8_avg_serialize(PG_FUNCTION_ARGS)
 /*
 * int8_avg_deserialize
 *		Deserialize bytea back into PolyNumAggState.
- *
- * int8_avg_serialize(int8_avg_deserialize(bytea)) must result in a value which
- * matches the original bytea value.
 */
 Datum
 int8_avg_deserialize(PG_FUNCTION_ARGS)
 {
-	bytea	   *sstate = PG_GETARG_BYTEA_P(0);
+	bytea	   *sstate;
 	PolyNumAggState *result;
 	StringInfoData buf;
 	Datum		temp;
@@ -4301,6 +4280,8 @@ int8_avg_deserialize(PG_FUNCTION_ARGS)
 	if (!AggCheckCallContext(fcinfo, NULL))
 		elog(ERROR, "aggregate function called in non-aggregate context");
+	sstate = PG_GETARG_BYTEA_P(0);
 	/*
 	 * Copy the bytea into a StringInfo so that we can "receive" it using the
 	 * standard pq API.

--- a/src/bin/pg_dump/pg_dump.c
+++ b/src/bin/pg_dump/pg_dump.c
@@ -13412,7 +13412,6 @@ dumpAgg(Archive *fout, AggInfo *agginfo)
 	int			i_aggsortop;
 	int			i_hypothetical;
 	int			i_aggtranstype;
-	int			i_aggserialtype;
 	int			i_aggtransspace;
 	int			i_aggmtranstype;
 	int			i_aggmtransspace;
@@ -13434,7 +13433,6 @@ dumpAgg(Archive *fout, AggInfo *agginfo)
 	char	   *aggsortconvop;
 	bool		hypothetical;
 	const char *aggtranstype;
-	const char *aggserialtype;
 	const char *aggtransspace;
 	const char *aggmtranstype;
 	const char *aggmtransspace;
@@ -13465,7 +13463,6 @@ dumpAgg(Archive *fout, AggInfo *agginfo)
 		   "aggminvtransfn, aggmfinalfn, aggmtranstype::pg_catalog.regtype, "
 						  "aggfinalextra, aggmfinalextra, "
 						  "aggsortop::pg_catalog.regoperator, "
-						  "aggserialtype::pg_catalog.regtype, "
 						  "(aggkind = 'h') AS hypothetical, "
 						  "aggtransspace, agginitval, "
 						  "aggmtransspace, aggminitval, "
@@ -13487,7 +13484,6 @@ dumpAgg(Archive *fout, AggInfo *agginfo)
 						  "aggmfinalfn, aggmtranstype::pg_catalog.regtype, "
 						  "aggfinalextra, aggmfinalextra, "
 						  "aggsortop::pg_catalog.regoperator, "
-						  "0 AS aggserialtype, "
 						  "(aggkind = 'h') AS hypothetical, "
 						  "aggtransspace, agginitval, "
 						  "aggmtransspace, aggminitval, "
@@ -13509,7 +13505,6 @@ dumpAgg(Archive *fout, AggInfo *agginfo)
 						  "0 AS aggmtranstype, false AS aggfinalextra, "
 						  "false AS aggmfinalextra, "
 						  "aggsortop::pg_catalog.regoperator, "
-						  "0 AS aggserialtype, "
 						  "false AS hypothetical, "
 						  "0 AS aggtransspace, agginitval, "
 						  "0 AS aggmtransspace, NULL AS aggminitval, "
@@ -13531,7 +13526,6 @@ dumpAgg(Archive *fout, AggInfo *agginfo)
 						  "0 AS aggmtranstype, false AS aggfinalextra, "
 						  "false AS aggmfinalextra, "
 						  "aggsortop::pg_catalog.regoperator, "
-						  "0 AS aggserialtype, "
 						  "false AS hypothetical, "
 						  "0 AS aggtransspace, agginitval, "
 						  "0 AS aggmtransspace, NULL AS aggminitval, "
@@ -13550,7 +13544,6 @@ dumpAgg(Archive *fout, AggInfo *agginfo)
 						  "'-' AS aggminvtransfn, '-' AS aggmfinalfn, "
 						  "0 AS aggmtranstype, false AS aggfinalextra, "
 						  "false AS aggmfinalextra, 0 AS aggsortop, "
-						  "0 AS aggserialtype, "
 						  "false AS hypothetical, "
 						  "0 AS aggtransspace, agginitval, "
 						  "0 AS aggmtransspace, NULL AS aggminitval, "
@@ -13569,7 +13562,6 @@ dumpAgg(Archive *fout, AggInfo *agginfo)
 						  "'-' AS aggminvtransfn, '-' AS aggmfinalfn, "
 						  "0 AS aggmtranstype, false AS aggfinalextra, "
 						  "false AS aggmfinalextra, 0 AS aggsortop, "
-						  "0 AS aggserialtype, "
 						  "false AS hypothetical, "
 						  "0 AS aggtransspace, agginitval, "
 						  "0 AS aggmtransspace, NULL AS aggminitval, "
@@ -13588,7 +13580,6 @@ dumpAgg(Archive *fout, AggInfo *agginfo)
 						  "'-' AS aggminvtransfn, '-' AS aggmfinalfn, "
 						  "0 AS aggmtranstype, false AS aggfinalextra, "
 						  "false AS aggmfinalextra, 0 AS aggsortop, "
-						  "0 AS aggserialtype, "
 						  "false AS hypothetical, "
 						  "0 AS aggtransspace, agginitval1 AS agginitval, "
 						  "0 AS aggmtransspace, NULL AS aggminitval, "
@@ -13611,7 +13602,6 @@ dumpAgg(Archive *fout, AggInfo *agginfo)
 	i_aggfinalextra = PQfnumber(res, "aggfinalextra");
 	i_aggmfinalextra = PQfnumber(res, "aggmfinalextra");
 	i_aggsortop = PQfnumber(res, "aggsortop");
-	i_aggserialtype = PQfnumber(res, "aggserialtype");
 	i_hypothetical = PQfnumber(res, "hypothetical");
 	i_aggtranstype = PQfnumber(res, "aggtranstype");
 	i_aggtransspace = PQfnumber(res, "aggtransspace");
@@ -13635,7 +13625,6 @@ dumpAgg(Archive *fout, AggInfo *agginfo)
 	aggsortop = PQgetvalue(res, 0, i_aggsortop);
 	hypothetical = (PQgetvalue(res, 0, i_hypothetical)[0] == 't');
 	aggtranstype = PQgetvalue(res, 0, i_aggtranstype);
-	aggserialtype = PQgetvalue(res, 0, i_aggserialtype);
 	aggtransspace = PQgetvalue(res, 0, i_aggtransspace);
 	aggmtranstype = PQgetvalue(res, 0, i_aggmtranstype);
 	aggmtransspace = PQgetvalue(res, 0, i_aggmtransspace);
@@ -13722,20 +13711,13 @@ dumpAgg(Archive *fout, AggInfo *agginfo)
 	}
 	if (strcmp(aggcombinefn, "-") != 0)
-	{
 		appendPQExpBuffer(details, ",\n    COMBINEFUNC = %s", aggcombinefn);
-	}
-	/*
-	 * CREATE AGGREGATE should ensure we either have all of these, or none of
-	 * them.
-	 */
 	if (strcmp(aggserialfn, "-") != 0)
-	{
 		appendPQExpBuffer(details, ",\n    SERIALFUNC = %s", aggserialfn);
+	if (strcmp(aggdeserialfn, "-") != 0)
 		appendPQExpBuffer(details, ",\n    DESERIALFUNC = %s", aggdeserialfn);
-		appendPQExpBuffer(details, ",\n    SERIALTYPE = %s", aggserialtype);
-	}
 	if (strcmp(aggmtransfn, "-") != 0)
 	{

--- a/src/include/catalog/catversion.h
+++ b/src/include/catalog/catversion.h
@@ -53,6 +53,6 @@
 */
 /*							yyyymmddN */
-#define CATALOG_VERSION_NO	201606171
+#define CATALOG_VERSION_NO	201606221
 #endif
--- a/src/include/catalog/pg_aggregate.h
+++ b/src/include/catalog/pg_aggregate.h
--- a/src/include/catalog/pg_proc.h
+++ b/src/include/catalog/pg_proc.h
@@ -2451,11 +2451,11 @@ DATA(insert OID = 3337 (  numeric_avg_combine	 PGNSP PGUID 12 1 0 0 0 f f f f f
 DESCR("aggregate combine function");
 DATA(insert OID = 2740 (  numeric_avg_serialize    PGNSP PGUID 12 1 0 0 0 f f f f t f i s 1 0 17 "2281" _null_ _null_ _null_ _null_ _null_ numeric_avg_serialize _null_ _null_ _null_ ));
 DESCR("aggregate serial function");
-DATA(insert OID = 2741 (  numeric_avg_deserialize	 PGNSP PGUID 12 1 0 0 0 f f f f t f i s 1 0 2281 "17" _null_ _null_ _null_ _null_ _null_ numeric_avg_deserialize _null_ _null_ _null_ ));
+DATA(insert OID = 2741 (  numeric_avg_deserialize	 PGNSP PGUID 12 1 0 0 0 f f f f t f i s 2 0 2281 "17 2281" _null_ _null_ _null_ _null_ _null_ numeric_avg_deserialize _null_ _null_ _null_ ));
 DESCR("aggregate deserial function");
 DATA(insert OID = 3335 (  numeric_serialize    PGNSP PGUID 12 1 0 0 0 f f f f t f i s 1 0 17 "2281" _null_ _null_ _null_ _null_ _null_ numeric_serialize _null_ _null_ _null_ ));
 DESCR("aggregate serial function");
-DATA(insert OID = 3336 (  numeric_deserialize	 PGNSP PGUID 12 1 0 0 0 f f f f t f i s 1 0 2281 "17" _null_ _null_ _null_ _null_ _null_ numeric_deserialize _null_ _null_ _null_ ));
+DATA(insert OID = 3336 (  numeric_deserialize	 PGNSP PGUID 12 1 0 0 0 f f f f t f i s 2 0 2281 "17 2281" _null_ _null_ _null_ _null_ _null_ numeric_deserialize _null_ _null_ _null_ ));
 DESCR("aggregate deserial function");
 DATA(insert OID = 3548 (  numeric_accum_inv    PGNSP PGUID 12 1 0 0 0 f f f f f f i s 2 0 2281 "2281 1700" _null_ _null_ _null_ _null_ _null_ numeric_accum_inv _null_ _null_ _null_ ));
 DESCR("aggregate transition function");
@@ -2469,7 +2469,7 @@ DATA(insert OID = 3338 (  numeric_poly_combine	  PGNSP PGUID 12 1 0 0 0 f f f f
 DESCR("aggregate combine function");
 DATA(insert OID = 3339 (  numeric_poly_serialize	PGNSP PGUID 12 1 0 0 0 f f f f t f i s 1 0 17 "2281" _null_ _null_ _null_ _null_ _null_ numeric_poly_serialize _null_ _null_ _null_ ));
 DESCR("aggregate serial function");
-DATA(insert OID = 3340 (  numeric_poly_deserialize	  PGNSP PGUID 12 1 0 0 0 f f f f t f i s 1 0 2281 "17" _null_ _null_ _null_ _null_ _null_ numeric_poly_deserialize _null_ _null_ _null_ ));
+DATA(insert OID = 3340 (  numeric_poly_deserialize	  PGNSP PGUID 12 1 0 0 0 f f f f t f i s 2 0 2281 "17 2281" _null_ _null_ _null_ _null_ _null_ numeric_poly_deserialize _null_ _null_ _null_ ));
 DESCR("aggregate deserial function");
 DATA(insert OID = 2746 (  int8_avg_accum	   PGNSP PGUID 12 1 0 0 0 f f f f f f i s 2 0 2281 "2281 20" _null_ _null_ _null_ _null_ _null_ int8_avg_accum _null_ _null_ _null_ ));
 DESCR("aggregate transition function");
@@ -2485,9 +2485,9 @@ DATA(insert OID = 2785 (  int8_avg_combine	  PGNSP PGUID 12 1 0 0 0 f f f f f f
 DESCR("aggregate combine function");
 DATA(insert OID = 2786 (  int8_avg_serialize	PGNSP PGUID 12 1 0 0 0 f f f f t f i s 1 0 17 "2281" _null_ _null_ _null_ _null_ _null_ int8_avg_serialize _null_ _null_ _null_ ));
 DESCR("aggregate serial function");
-DATA(insert OID = 2787 (  int8_avg_deserialize	  PGNSP PGUID 12 1 0 0 0 f f f f t f i s 1 0 2281 "17" _null_ _null_ _null_ _null_ _null_ int8_avg_deserialize _null_ _null_ _null_ ));
+DATA(insert OID = 2787 (  int8_avg_deserialize	  PGNSP PGUID 12 1 0 0 0 f f f f t f i s 2 0 2281 "17 2281" _null_ _null_ _null_ _null_ _null_ int8_avg_deserialize _null_ _null_ _null_ ));
 DESCR("aggregate deserial function");
-DATA(insert OID = 3324 (  int4_avg_combine	  PGNSP PGUID 12 1 0 0 0 f f f f f f i s 2 0 2281 "2281 2281" _null_ _null_ _null_ _null_ _null_ int4_avg_combine _null_ _null_ _null_ ));
+DATA(insert OID = 3324 (  int4_avg_combine	  PGNSP PGUID 12 1 0 0 0 f f f f t f i s 2 0 1016 "1016 1016" _null_ _null_ _null_ _null_ _null_ int4_avg_combine _null_ _null_ _null_ ));
 DESCR("aggregate combine function");
 DATA(insert OID = 3178 (  numeric_sum	   PGNSP PGUID 12 1 0 0 0 f f f f f f i s 1 0 1700 "2281" _null_ _null_ _null_ _null_ _null_ numeric_sum _null_ _null_ _null_ ));
 DESCR("aggregate final function");

--- a/src/include/parser/parse_agg.h
+++ b/src/include/parser/parse_agg.h
@@ -51,12 +51,12 @@ extern void build_aggregate_combinefn_expr(Oid agg_state_type,
 							   Oid combinefn_oid,
 							   Expr **combinefnexpr);
-extern void build_aggregate_serialfn_expr(Oid agg_state_type,
+extern void build_aggregate_serialfn_expr(Oid serialfn_oid,
-							  Oid agg_serial_type,
-							  Oid agg_input_collation,
-							  Oid serialfn_oid,
 							  Expr **serialfnexpr);
+extern void build_aggregate_deserialfn_expr(Oid deserialfn_oid,
+								Expr **deserialfnexpr);
 extern void build_aggregate_finalfn_expr(Oid *agg_input_types,
 							 int num_finalfn_inputs,
 							 Oid agg_state_type,

--- a/src/test/regress/expected/create_aggregate.out
+++ b/src/test/regress/expected/create_aggregate.out
@@ -102,36 +102,19 @@ CREATE AGGREGATE sumdouble (float8)
    minvfunc = float8mi
 );
 -- aggregate combine and serialization functions
-- Ensure stype and serialtype can't be the same
+-- can't specify just one of serialfunc and deserialfunc
 CREATE AGGREGATE myavg (numeric)
 (
 	stype = internal,
 	sfunc = numeric_avg_accum,
-	serialtype = internal
-);
-ERROR:  aggregate serialization data type cannot be internal
-- if serialtype is specified we need a serialfunc and deserialfunc
-CREATE AGGREGATE myavg (numeric)
-(
-	stype = internal,
-	sfunc = numeric_avg_accum,
-	serialtype = bytea
-);
-ERROR:  aggregate serialization function must be specified when serialization type is specified
-CREATE AGGREGATE myavg (numeric)
-(
-	stype = internal,
-	sfunc = numeric_avg_accum,
-	serialtype = bytea,
 	serialfunc = numeric_avg_serialize
 );
-ERROR:  aggregate deserialization function must be specified when serialization type is specified
+ERROR:  must specify both or neither of serialization and deserialization functions
 -- serialfunc must have correct parameters
 CREATE AGGREGATE myavg (numeric)
 (
 	stype = internal,
 	sfunc = numeric_avg_accum,
-	serialtype = bytea,
 	serialfunc = numeric_avg_deserialize,
 	deserialfunc = numeric_avg_deserialize
 );
@@ -141,27 +124,15 @@ CREATE AGGREGATE myavg (numeric)
 (
 	stype = internal,
 	sfunc = numeric_avg_accum,
-	serialtype = bytea,
 	serialfunc = numeric_avg_serialize,
 	deserialfunc = numeric_avg_serialize
 );
-ERROR:  function numeric_avg_serialize(bytea) does not exist
+ERROR:  function numeric_avg_serialize(bytea, internal) does not exist
-- ensure return type of serialfunc is checked
-CREATE AGGREGATE myavg (numeric)
-(
-	stype = internal,
-	sfunc = numeric_avg_accum,
-	serialtype = text,
-	serialfunc = numeric_avg_serialize,
-	deserialfunc = numeric_avg_deserialize
-);
-ERROR:  return type of serialization function numeric_avg_serialize is not text
 -- ensure combine function parameters are checked
 CREATE AGGREGATE myavg (numeric)
 (
 	stype = internal,
 	sfunc = numeric_avg_accum,
-	serialtype = bytea,
 	serialfunc = numeric_avg_serialize,
 	deserialfunc = numeric_avg_deserialize,
 	combinefunc = int4larger
@@ -173,18 +144,17 @@ CREATE AGGREGATE myavg (numeric)
 	stype = internal,
 	sfunc = numeric_avg_accum,
 	finalfunc = numeric_avg,
-	serialtype = bytea,
 	serialfunc = numeric_avg_serialize,
 	deserialfunc = numeric_avg_deserialize,
 	combinefunc = numeric_avg_combine
 );
 -- Ensure all these functions made it into the catalog
-SELECT aggfnoid,aggtransfn,aggcombinefn,aggtranstype,aggserialfn,aggdeserialfn,aggserialtype
+SELECT aggfnoid,aggtransfn,aggcombinefn,aggtranstype,aggserialfn,aggdeserialfn
 FROM pg_aggregate
 WHERE aggfnoid = 'myavg'::REGPROC;
- aggfnoid |    aggtransfn     |    aggcombinefn     | aggtranstype |      aggserialfn      |      aggdeserialfn      | aggserialtype 
+ aggfnoid |    aggtransfn     |    aggcombinefn     | aggtranstype |      aggserialfn      |      aggdeserialfn      
----------+-------------------+---------------------+--------------+-----------------------+-------------------------+---------------
+----------+-------------------+---------------------+--------------+-----------------------+-------------------------
- myavg    | numeric_avg_accum | numeric_avg_combine |         2281 | numeric_avg_serialize | numeric_avg_deserialize |            17
+ myavg    | numeric_avg_accum | numeric_avg_combine |         2281 | numeric_avg_serialize | numeric_avg_deserialize
 (1 row)
 DROP AGGREGATE myavg (numeric);

--- a/src/test/regress/expected/opr_sanity.out
+++ b/src/test/regress/expected/opr_sanity.out
@@ -279,21 +279,16 @@ ORDER BY 1, 2;
 -- Look for functions that return type "internal" and do not have any
 -- "internal" argument.  Such a function would be a security hole since
 -- it might be used to call an internal function from an SQL command.
-- As of 7.3 this query should find internal_in, and as of 9.6 aggregate
+-- As of 7.3 this query should find only internal_in, which is safe because
-- deserialization will be found too. These should contain a runtime check to
+-- it always throws an error when called.
-- ensure they can only be called in an aggregate context.
 SELECT p1.oid, p1.proname
 FROM pg_proc as p1
 WHERE p1.prorettype = 'internal'::regtype AND NOT
    'internal'::regtype = ANY (p1.proargtypes);
 oid  |   proname   
------+--------------------------
+------+-------------
- 2741 | numeric_avg_deserialize
- 3336 | numeric_deserialize
- 3340 | numeric_poly_deserialize
- 2787 | int8_avg_deserialize
 2304 | internal_in
-(5 rows)
+(1 row)
 -- Look for functions that return a polymorphic type and do not have any
 -- polymorphic argument.  Calls of such functions would be unresolvable
@@ -1442,6 +1437,84 @@ WHERE a.aggfnoid = p.oid AND
 ----------+---------+-----+---------+-----+---------
 (0 rows)
+-- Check that all combine functions have signature
+-- combine(transtype, transtype) returns transtype
+-- NOTE: use physically_coercible here, not binary_coercible, because
+-- max and min on abstime are implemented using int4larger/int4smaller.
+SELECT a.aggfnoid, p.proname
+FROM pg_aggregate as a, pg_proc as p
+WHERE a.aggcombinefn = p.oid AND
+    (p.pronargs != 2 OR
+     p.prorettype != p.proargtypes[0] OR
+     p.prorettype != p.proargtypes[1] OR
+     NOT physically_coercible(a.aggtranstype, p.proargtypes[0]));
+ aggfnoid | proname 
+----------+---------
+(0 rows)
+-- Check that no combine function for an INTERNAL transtype is strict.
+SELECT a.aggfnoid, p.proname
+FROM pg_aggregate as a, pg_proc as p
+WHERE a.aggcombinefn = p.oid AND
+    a.aggtranstype = 'internal'::regtype AND p.proisstrict;
+ aggfnoid | proname 
+----------+---------
+(0 rows)
+-- serialize/deserialize functions should be specified only for aggregates
+-- with transtype internal and a combine function, and we should have both
+-- or neither of them.
+SELECT aggfnoid, aggtranstype, aggserialfn, aggdeserialfn
+FROM pg_aggregate
+WHERE (aggserialfn != 0 OR aggdeserialfn != 0)
+  AND (aggtranstype != 'internal'::regtype OR aggcombinefn = 0 OR
+       aggserialfn = 0 OR aggdeserialfn = 0);
+ aggfnoid | aggtranstype | aggserialfn | aggdeserialfn 
+----------+--------------+-------------+---------------
+(0 rows)
+-- Check that all serialization functions have signature
+-- serialize(internal) returns bytea
+-- Also insist that they be strict; it's wasteful to run them on NULLs.
+SELECT a.aggfnoid, p.proname
+FROM pg_aggregate as a, pg_proc as p
+WHERE a.aggserialfn = p.oid AND
+    (p.prorettype != 'bytea'::regtype OR p.pronargs != 1 OR
+     p.proargtypes[0] != 'internal'::regtype OR
+     NOT p.proisstrict);
+ aggfnoid | proname 
+----------+---------
+(0 rows)
+-- Check that all deserialization functions have signature
+-- deserialize(bytea, internal) returns internal
+-- Also insist that they be strict; it's wasteful to run them on NULLs.
+SELECT a.aggfnoid, p.proname
+FROM pg_aggregate as a, pg_proc as p
+WHERE a.aggdeserialfn = p.oid AND
+    (p.prorettype != 'internal'::regtype OR p.pronargs != 2 OR
+     p.proargtypes[0] != 'bytea'::regtype OR
+     p.proargtypes[1] != 'internal'::regtype OR
+     NOT p.proisstrict);
+ aggfnoid | proname 
+----------+---------
+(0 rows)
+-- Check that aggregates which have the same transition function also have
+-- the same combine, serialization, and deserialization functions.
+-- While that isn't strictly necessary, it's fishy if they don't.
+SELECT a.aggfnoid, a.aggcombinefn, a.aggserialfn, a.aggdeserialfn,
+       b.aggfnoid, b.aggcombinefn, b.aggserialfn, b.aggdeserialfn
+FROM
+    pg_aggregate a, pg_aggregate b
+WHERE
+    a.aggfnoid < b.aggfnoid AND a.aggtransfn = b.aggtransfn AND
+    (a.aggcombinefn != b.aggcombinefn OR a.aggserialfn != b.aggserialfn
+     OR a.aggdeserialfn != b.aggdeserialfn);
+ aggfnoid | aggcombinefn | aggserialfn | aggdeserialfn | aggfnoid | aggcombinefn | aggserialfn | aggdeserialfn 
+----------+--------------+-------------+---------------+----------+--------------+-------------+---------------
+(0 rows)
 -- Cross-check aggsortop (if present) against pg_operator.
 -- We expect to find entries for bool_and, bool_or, every, max, and min.
 SELECT DISTINCT proname, oprname
@@ -1534,89 +1607,6 @@ WHERE proisagg AND provariadic != 0 AND a.aggkind = 'n';
 -----+---------
 (0 rows)
-- Check that all serial functions have a return type the same as the serial
-- type.
-SELECT a.aggserialfn,a.aggserialtype,p.prorettype
-FROM pg_aggregate a
-INNER JOIN pg_proc p ON a.aggserialfn = p.oid
-WHERE a.aggserialtype <> p.prorettype;
- aggserialfn | aggserialtype | prorettype 
-------------+---------------+------------
-(0 rows)
-- Check that all the deserial functions have the same input type as the
-- serialtype
-SELECT a.aggserialfn,a.aggserialtype,p.proargtypes[0]
-FROM pg_aggregate a
-INNER JOIN pg_proc p ON a.aggdeserialfn = p.oid
-WHERE p.proargtypes[0] <> a.aggserialtype;
- aggserialfn | aggserialtype | proargtypes 
-------------+---------------+-------------
-(0 rows)
-- An aggregate should either have a complete set of serialtype, serial func
-- and deserial func, or none of them.
-SELECT aggserialtype,aggserialfn,aggdeserialfn
-FROM pg_aggregate
-WHERE (aggserialtype <> 0 OR aggserialfn <> 0 OR aggdeserialfn <> 0)
-  AND (aggserialtype = 0 OR aggserialfn = 0 OR aggdeserialfn = 0);
- aggserialtype | aggserialfn | aggdeserialfn 
---------------+-------------+---------------
-(0 rows)
-- Check that all aggregates with serialtypes have internal states.
-- (There's no point in serializing anything apart from internal)
-SELECT aggfnoid,aggserialtype,aggtranstype
-FROM pg_aggregate
-WHERE aggserialtype <> 0 AND aggtranstype <> 'internal'::regtype;
- aggfnoid | aggserialtype | aggtranstype 
----------+---------------+--------------
-(0 rows)
-- Check that all serial functions are strict. It's wasteful for these to be
-- called with NULL values.
-SELECT aggfnoid,aggserialfn
-FROM pg_aggregate a
-INNER JOIN pg_proc p ON a.aggserialfn = p.oid
-WHERE p.proisstrict = false;
- aggfnoid | aggserialfn 
----------+-------------
-(0 rows)
-- Check that all deserial functions are strict. It's wasteful for these to be
-- called with NULL values.
-SELECT aggfnoid,aggdeserialfn
-FROM pg_aggregate a
-INNER JOIN pg_proc p ON a.aggdeserialfn = p.oid
-WHERE p.proisstrict = false;
- aggfnoid | aggdeserialfn 
----------+---------------
-(0 rows)
-- Check that no combine functions with an INTERNAL return type are strict.
-SELECT aggfnoid,aggcombinefn
-FROM pg_aggregate a
-INNER JOIN pg_proc p ON a.aggcombinefn = p.oid
-INNER JOIN pg_type t ON a.aggtranstype = t.oid
-WHERE t.typname = 'internal' AND p.proisstrict = true;
- aggfnoid | aggcombinefn 
----------+--------------
-(0 rows)
-- Check that aggregates which have the same transition function also have
-- the same combine, serialization, and deserialization functions.
-SELECT a.aggfnoid, a.aggcombinefn, a.aggserialfn, a.aggdeserialfn,
-       b.aggfnoid, b.aggcombinefn, b.aggserialfn, b.aggdeserialfn
-FROM
-    pg_aggregate a, pg_aggregate b
-WHERE
-    a.aggfnoid < b.aggfnoid AND a.aggtransfn = b.aggtransfn AND
-    (a.aggcombinefn != b.aggcombinefn OR a.aggserialfn != b.aggserialfn
-     OR a.aggdeserialfn != b.aggdeserialfn);
- aggfnoid | aggcombinefn | aggserialfn | aggdeserialfn | aggfnoid | aggcombinefn | aggserialfn | aggdeserialfn 
----------+--------------+-------------+---------------+----------+--------------+-------------+---------------
-(0 rows)
 -- **************** pg_opfamily ****************
 -- Look for illegal values in pg_opfamily fields
 SELECT p1.oid

--- a/src/test/regress/sql/create_aggregate.sql
+++ b/src/test/regress/sql/create_aggregate.sql
@@ -117,27 +117,11 @@ CREATE AGGREGATE sumdouble (float8)
 -- aggregate combine and serialization functions
-- Ensure stype and serialtype can't be the same
+-- can't specify just one of serialfunc and deserialfunc
 CREATE AGGREGATE myavg (numeric)
 (
 	stype = internal,
 	sfunc = numeric_avg_accum,
-	serialtype = internal
-);
-- if serialtype is specified we need a serialfunc and deserialfunc
-CREATE AGGREGATE myavg (numeric)
-(
-	stype = internal,
-	sfunc = numeric_avg_accum,
-	serialtype = bytea
-);
-CREATE AGGREGATE myavg (numeric)
-(
-	stype = internal,
-	sfunc = numeric_avg_accum,
-	serialtype = bytea,
 	serialfunc = numeric_avg_serialize
 );
@@ -146,7 +130,6 @@ CREATE AGGREGATE myavg (numeric)
 (
 	stype = internal,
 	sfunc = numeric_avg_accum,
-	serialtype = bytea,
 	serialfunc = numeric_avg_deserialize,
 	deserialfunc = numeric_avg_deserialize
 );
@@ -156,27 +139,15 @@ CREATE AGGREGATE myavg (numeric)
 (
 	stype = internal,
 	sfunc = numeric_avg_accum,
-	serialtype = bytea,
 	serialfunc = numeric_avg_serialize,
 	deserialfunc = numeric_avg_serialize
 );
-- ensure return type of serialfunc is checked
-CREATE AGGREGATE myavg (numeric)
-(
-	stype = internal,
-	sfunc = numeric_avg_accum,
-	serialtype = text,
-	serialfunc = numeric_avg_serialize,
-	deserialfunc = numeric_avg_deserialize
-);
 -- ensure combine function parameters are checked
 CREATE AGGREGATE myavg (numeric)
 (
 	stype = internal,
 	sfunc = numeric_avg_accum,
-	serialtype = bytea,
 	serialfunc = numeric_avg_serialize,
 	deserialfunc = numeric_avg_deserialize,
 	combinefunc = int4larger
@@ -188,14 +159,13 @@ CREATE AGGREGATE myavg (numeric)
 	stype = internal,
 	sfunc = numeric_avg_accum,
 	finalfunc = numeric_avg,
-	serialtype = bytea,
 	serialfunc = numeric_avg_serialize,
 	deserialfunc = numeric_avg_deserialize,
 	combinefunc = numeric_avg_combine
 );
 -- Ensure all these functions made it into the catalog
-SELECT aggfnoid,aggtransfn,aggcombinefn,aggtranstype,aggserialfn,aggdeserialfn,aggserialtype
+SELECT aggfnoid,aggtransfn,aggcombinefn,aggtranstype,aggserialfn,aggdeserialfn
 FROM pg_aggregate
 WHERE aggfnoid = 'myavg'::REGPROC;

--- a/src/test/regress/sql/opr_sanity.sql
+++ b/src/test/regress/sql/opr_sanity.sql
@@ -228,9 +228,8 @@ ORDER BY 1, 2;
 -- Look for functions that return type "internal" and do not have any
 -- "internal" argument.  Such a function would be a security hole since
 -- it might be used to call an internal function from an SQL command.
-- As of 7.3 this query should find internal_in, and as of 9.6 aggregate
+-- As of 7.3 this query should find only internal_in, which is safe because
-- deserialization will be found too. These should contain a runtime check to
+-- it always throws an error when called.
-- ensure they can only be called in an aggregate context.
 SELECT p1.oid, p1.proname
 FROM pg_proc as p1
@@ -937,6 +936,72 @@ WHERE a.aggfnoid = p.oid AND
    a.aggminvtransfn = iptr.oid AND
    ptr.proisstrict != iptr.proisstrict;
+-- Check that all combine functions have signature
+-- combine(transtype, transtype) returns transtype
+-- NOTE: use physically_coercible here, not binary_coercible, because
+-- max and min on abstime are implemented using int4larger/int4smaller.
+SELECT a.aggfnoid, p.proname
+FROM pg_aggregate as a, pg_proc as p
+WHERE a.aggcombinefn = p.oid AND
+    (p.pronargs != 2 OR
+     p.prorettype != p.proargtypes[0] OR
+     p.prorettype != p.proargtypes[1] OR
+     NOT physically_coercible(a.aggtranstype, p.proargtypes[0]));
+-- Check that no combine function for an INTERNAL transtype is strict.
+SELECT a.aggfnoid, p.proname
+FROM pg_aggregate as a, pg_proc as p
+WHERE a.aggcombinefn = p.oid AND
+    a.aggtranstype = 'internal'::regtype AND p.proisstrict;
+-- serialize/deserialize functions should be specified only for aggregates
+-- with transtype internal and a combine function, and we should have both
+-- or neither of them.
+SELECT aggfnoid, aggtranstype, aggserialfn, aggdeserialfn
+FROM pg_aggregate
+WHERE (aggserialfn != 0 OR aggdeserialfn != 0)
+  AND (aggtranstype != 'internal'::regtype OR aggcombinefn = 0 OR
+       aggserialfn = 0 OR aggdeserialfn = 0);
+-- Check that all serialization functions have signature
+-- serialize(internal) returns bytea
+-- Also insist that they be strict; it's wasteful to run them on NULLs.
+SELECT a.aggfnoid, p.proname
+FROM pg_aggregate as a, pg_proc as p
+WHERE a.aggserialfn = p.oid AND
+    (p.prorettype != 'bytea'::regtype OR p.pronargs != 1 OR
+     p.proargtypes[0] != 'internal'::regtype OR
+     NOT p.proisstrict);
+-- Check that all deserialization functions have signature
+-- deserialize(bytea, internal) returns internal
+-- Also insist that they be strict; it's wasteful to run them on NULLs.
+SELECT a.aggfnoid, p.proname
+FROM pg_aggregate as a, pg_proc as p
+WHERE a.aggdeserialfn = p.oid AND
+    (p.prorettype != 'internal'::regtype OR p.pronargs != 2 OR
+     p.proargtypes[0] != 'bytea'::regtype OR
+     p.proargtypes[1] != 'internal'::regtype OR
+     NOT p.proisstrict);
+-- Check that aggregates which have the same transition function also have
+-- the same combine, serialization, and deserialization functions.
+-- While that isn't strictly necessary, it's fishy if they don't.
+SELECT a.aggfnoid, a.aggcombinefn, a.aggserialfn, a.aggdeserialfn,
+       b.aggfnoid, b.aggcombinefn, b.aggserialfn, b.aggdeserialfn
+FROM
+    pg_aggregate a, pg_aggregate b
+WHERE
+    a.aggfnoid < b.aggfnoid AND a.aggtransfn = b.aggtransfn AND
+    (a.aggcombinefn != b.aggcombinefn OR a.aggserialfn != b.aggserialfn
+     OR a.aggdeserialfn != b.aggdeserialfn);
 -- Cross-check aggsortop (if present) against pg_operator.
 -- We expect to find entries for bool_and, bool_or, every, max, and min.
@@ -1004,64 +1069,6 @@ SELECT p.oid, proname
 FROM pg_proc AS p JOIN pg_aggregate AS a ON a.aggfnoid = p.oid
 WHERE proisagg AND provariadic != 0 AND a.aggkind = 'n';
-- Check that all serial functions have a return type the same as the serial
-- type.
-SELECT a.aggserialfn,a.aggserialtype,p.prorettype
-FROM pg_aggregate a
-INNER JOIN pg_proc p ON a.aggserialfn = p.oid
-WHERE a.aggserialtype <> p.prorettype;
-- Check that all the deserial functions have the same input type as the
-- serialtype
-SELECT a.aggserialfn,a.aggserialtype,p.proargtypes[0]
-FROM pg_aggregate a
-INNER JOIN pg_proc p ON a.aggdeserialfn = p.oid
-WHERE p.proargtypes[0] <> a.aggserialtype;
-- An aggregate should either have a complete set of serialtype, serial func
-- and deserial func, or none of them.
-SELECT aggserialtype,aggserialfn,aggdeserialfn
-FROM pg_aggregate
-WHERE (aggserialtype <> 0 OR aggserialfn <> 0 OR aggdeserialfn <> 0)
-  AND (aggserialtype = 0 OR aggserialfn = 0 OR aggdeserialfn = 0);
-- Check that all aggregates with serialtypes have internal states.
-- (There's no point in serializing anything apart from internal)
-SELECT aggfnoid,aggserialtype,aggtranstype
-FROM pg_aggregate
-WHERE aggserialtype <> 0 AND aggtranstype <> 'internal'::regtype;
-- Check that all serial functions are strict. It's wasteful for these to be
-- called with NULL values.
-SELECT aggfnoid,aggserialfn
-FROM pg_aggregate a
-INNER JOIN pg_proc p ON a.aggserialfn = p.oid
-WHERE p.proisstrict = false;
-- Check that all deserial functions are strict. It's wasteful for these to be
-- called with NULL values.
-SELECT aggfnoid,aggdeserialfn
-FROM pg_aggregate a
-INNER JOIN pg_proc p ON a.aggdeserialfn = p.oid
-WHERE p.proisstrict = false;
-- Check that no combine functions with an INTERNAL return type are strict.
-SELECT aggfnoid,aggcombinefn
-FROM pg_aggregate a
-INNER JOIN pg_proc p ON a.aggcombinefn = p.oid
-INNER JOIN pg_type t ON a.aggtranstype = t.oid
-WHERE t.typname = 'internal' AND p.proisstrict = true;
-- Check that aggregates which have the same transition function also have
-- the same combine, serialization, and deserialization functions.
-SELECT a.aggfnoid, a.aggcombinefn, a.aggserialfn, a.aggdeserialfn,
-       b.aggfnoid, b.aggcombinefn, b.aggserialfn, b.aggdeserialfn
-FROM
-    pg_aggregate a, pg_aggregate b
-WHERE
-    a.aggfnoid < b.aggfnoid AND a.aggtransfn = b.aggtransfn AND
-    (a.aggcombinefn != b.aggcombinefn OR a.aggserialfn != b.aggserialfn
-     OR a.aggdeserialfn != b.aggdeserialfn);
 -- **************** pg_opfamily ****************