BUG #17054: Memory corruption in logical replication worker when replicating into partitioned table

The following bug has been logged on the website:

Bug reference: 17054
Logged by: Sergey Bernikov
Email address: sbernikov(at)gmail(dot)com
PostgreSQL version: 13.3
Operating system: Ubuntu 18.04.4
Description:

When logical replication target is a partitioned table then execution of any
DDL on source table leads to crash of target (subscriber) server.

Steps to reproduce:
1. in source DB: create table and add to publication
create table test_replication (
id int not null,
value varchar(100),
primary key (id)
);
create publication test_publication for table test_replication;

2. in target DB: create partitioned table and start replication
create table test_replication (
id int not null,
value varchar(100),
primary key (id)
) partition by range (id);
create table test_replication_p_1 partition of test_replication
for values from (0) to (10);
create table test_replication_p_2 partition of test_replication
for values from (10) to (20);

create subscription test_subscription CONNECTION '...' publication
test_publication;

4. in source DB: insert and update data
insert into test_replication(id, value) values (1, 'a1');
insert into test_replication(id, value) values (2, 'a1');
insert into test_replication(id, value) values (3, 'a1');
update test_replication set value = 'a2';

5. in source DB: execute any DDL on the table
vacuum test_replication;

6. in source DB: update data
update test_replication set value = 'a3';

Result: logical replication worker on target server crashes with error
message:
LOG: background worker "logical replication worker" (PID 28356) was
terminated by signal 11: Segmentation fault
LOG: terminating any other active server processes

Backtrace from core dump:
Core was generated by `postgres: 13/main: logical replication worker for
subscription 781420 '.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000557026391fef in slot_modify_cstrings
(slot=slot(at)entry=0x557026fa8298, srcslot=<optimized out>,
rel=rel(at)entry=0x557026ff7370, values=values(at)entry=0x7ffff4135550,
replaces=replaces(at)entry=0x7ffff4138950) at
./build/../src/backend/replication/logical/worker.c:434
434 ./build/../src/backend/replication/logical/worker.c: No such file or
directory.
(gdb) bt
#0 0x0000557026391fef in slot_modify_cstrings
(slot=slot(at)entry=0x557026fa8298, srcslot=<optimized out>,
rel=rel(at)entry=0x557026ff7370, values=values(at)entry=0x7ffff4135550,
replaces=replaces(at)entry=0x7ffff4138950) at
./build/../src/backend/replication/logical/worker.c:434
#1 0x0000557026392b9f in apply_handle_tuple_routing
(relinfo=0x557026f80928, estate=estate(at)entry=0x557026fae108,
remoteslot=remoteslot(at)entry=0x557026f813d8,
newtup=newtup(at)entry=0x7ffff4135550,
relmapentry=relmapentry(at)entry=0x557026f96d90,
operation=operation(at)entry=CMD_UPDATE) at
./build/../src/backend/replication/logical/worker.c:1105
#2 0x00005570263934df in apply_handle_update (s=s(at)entry=0x7ffff41390a0) at
./build/../src/backend/replication/logical/worker.c:791
#3 0x00005570263941c1 in apply_dispatch (s=0x7ffff41390a0) at
./build/../src/backend/replication/logical/worker.c:1368
#4 LogicalRepApplyLoop (last_received=936525246824) at
./build/../src/backend/replication/logical/worker.c:1577
#5 ApplyWorkerMain (main_arg=<optimized out>) at
./build/../src/backend/replication/logical/worker.c:2123
#6 0x00005570263613ae in StartBackgroundWorker () at
./build/../src/backend/postmaster/bgworker.c:879
#7 0x000055702636d5a3 in do_start_bgworker (rw=0x557026ec9110) at
./build/../src/backend/postmaster/postmaster.c:5870
#8 maybe_start_bgworkers () at
./build/../src/backend/postmaster/postmaster.c:6095
#9 0x000055702636e035 in sigusr1_handler (postgres_signal_arg=<optimized
out>) at ./build/../src/backend/postmaster/postmaster.c:5255
#10 <signal handler called>
#11 0x00007f4bb7bbcdd7 in __GI___select (nfds=nfds(at)entry=10,
readfds=readfds(at)entry=0x7ffff4139870, writefds=writefds(at)entry=0x0,
exceptfds=exceptfds(at)entry=0x0, timeout=timeout(at)entry=0x7ffff41397d0)
at ../sysdeps/unix/sysv/linux/select.c:41
#12 0x000055702636e5f9 in ServerLoop () at
./build/../src/backend/postmaster/postmaster.c:1703
#13 0x0000557026370423 in PostmasterMain (argc=5, argv=<optimized out>) at
./build/../src/backend/postmaster/postmaster.c:1412
#14 0x00005570260c19f8 in main (argc=5, argv=0x557026e73fd0) at
./build/../src/backend/main/main.c:210