postgresql/src
Alvaro Herrera 232c7cbcbb Fix freezing of a dead HOT-updated tuple
Vacuum calls page-level HOT prune to remove dead HOT tuples before doing
liveness checks (HeapTupleSatisfiesVacuum) on the remaining tuples.  But
concurrent transaction commit/abort may turn DEAD some of the HOT tuples
that survived the prune, before HeapTupleSatisfiesVacuum tests them.
This happens to activate the code that decides to freeze the tuple ...
which resuscitates it, duplicating data.

(This is especially bad if there's any unique constraints, because those
are now internally violated due to the duplicate entries, though you
won't know until you try to REINDEX or dump/restore the table.)

One possible fix would be to simply skip doing anything to the tuple,
and hope that the next HOT prune would remove it.  But there is a
problem: if the tuple is older than freeze horizon, this would leave an
unfrozen XID behind, and if no HOT prune happens to clean it up before
the containing pg_clog segment is truncated away, it'd later cause an
error when the XID is looked up.

Fix the problem by having the tuple freezing routines cope with the
situation: don't freeze the tuple (and keep it dead).  In the cases that
the XID is older than the freeze age, set the HEAP_XMAX_COMMITTED flag
so that there is no need to look up the XID in pg_clog later on.

An isolation test is included, authored by Michael Paquier, loosely
based on Daniel Wood's original reproducer.  It only tests one
particular scenario, though, not all the possible ways for this problem
to surface; it be good to have a more reliable way to test this more
fully, but it'd require more work.
In message https://postgr.es/m/20170911140103.5akxptyrwgpc25bw@alvherre.pgsql
I outlined another test case (more closely matching Dan Wood's) that
exposed a few more ways for the problem to occur.

Backpatch all the way back to 9.3, where this problem was introduced by
multixact juggling.  In branches 9.3 and 9.4, this includes a backpatch
of commit e5ff9fefcd50 (of 9.5 era), since the original is not
correctable without matching the coding pattern in 9.5 up.

Reported-by: Daniel Wood
Diagnosed-by: Daniel Wood
Reviewed-by: Yi Wen Wong, Michaël Paquier
Discussion: https://postgr.es/m/E5711E62-8FDF-4DCA-A888-C200BF6B5742@amazon.com
2017-09-28 16:44:01 +02:00
..
backend Fix freezing of a dead HOT-updated tuple 2017-09-28 16:44:01 +02:00
bin Translation updates 2017-08-28 10:13:34 -04:00
common Unlink static libraries before rebuilding them. 2015-03-01 13:06:33 -05:00
include Avoid SIGBUS on Linux when a DSM memory request overruns tmpfs. 2017-09-25 16:09:20 -04:00
interfaces Fixed ECPG to correctly handle out-of-scope cursor declarations with pointers 2017-09-18 23:08:17 +02:00
makefiles Always use -fPIC, not -fpic, when building shared libraries with gcc. 2017-06-01 13:32:56 -04:00
pl Translation updates 2017-08-28 10:13:34 -04:00
port Stamp 9.4.14. 2017-08-28 17:26:11 -04:00
template AIX: Test the -qlonglong option before use. 2015-07-17 03:01:35 -04:00
test Fix freezing of a dead HOT-updated tuple 2017-09-28 16:44:01 +02:00
timezone Sync our copy of the timezone library with IANA tzcode master. 2017-09-22 00:04:21 -04:00
tools Fix macro-redefinition warning on MSVC. 2017-09-03 11:01:08 -04:00
tutorial pgindent run for 9.4 2014-05-06 12:12:18 -04:00
.gitignore Convert cvsignore to gitignore, and add .gitignore for build targets. 2010-09-22 12:57:04 +02:00
bcc32.mak Autoconfiscate selection of 64-bit int type for 64-bit large object API. 2012-10-07 21:52:43 -04:00
DEVELOPERS Replace a couple of references to files that no longer exist in the source 2009-05-04 08:08:47 +00:00
Makefile Install TAP test infrastructure so it's available for extension testing. 2016-09-23 15:50:00 -04:00
Makefile.global.in PL/Perl portability fix: absorb relevant -D switches from Perl. 2017-07-31 12:38:35 -04:00
Makefile.shlib Fix typos in comments. 2017-02-06 11:34:24 +02:00
nls-global.mk nls-global.mk: search build dir for source files, too 2016-06-07 18:55:18 -04:00
win32.mak Autoconfiscate selection of 64-bit int type for 64-bit large object API. 2012-10-07 21:52:43 -04:00