Date: Mon, 21 Jul 2014 00:56:53 +0200
From: Andres Freund <andres@2ndquadrant.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Bruce Momjian <bruce@momjian.us>,
 Alvaro Herrera <alvherre@2ndquadrant.com>,
 PostgreSQL Bugs <pgsql-bugs@postgresql.org>
Subject: Re: pg_upgrade < 9.3 -> >=9.3 misses a step around multixacts
Message-ID: <20140720225653.GG5974@alap3.anarazel.de>
References: <20140720200225.GA5974@alap3.anarazel.de>
 <13755.1405887378@sss.pgh.pa.us>
 <20140720204852.GB5974@alap3.anarazel.de>
 <15685.1405891368@sss.pgh.pa.us>
 <20140720213258.GD5974@alap3.anarazel.de>
 <16274.1405892584@sss.pgh.pa.us>
 <20140720220253.GE5974@alap3.anarazel.de>
 <17255.1405894611@sss.pgh.pa.us>
 <20140720223010.GF5974@alap3.anarazel.de>
 <17935.1405895946@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <17935.1405895946@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-bugs-owner@postgresql.org

On 2014-07-20 18:39:06 -0400, Tom Lane wrote:
> Andres Freund <andres@2ndquadrant.com> writes:
> > On 2014-07-20 18:16:51 -0400, Tom Lane wrote:
> >> My point is that the cutoff multi xid won't be new enough to remove
> >> non-LOCKED_ONLY (ie, post-9.3) mxids.
> 
> > Why not? Afaics this will continue to happen until multixacts are
> > wrapped around once? So the cutoff multi will be new enough for that at
> > some point after the pg_upgrade?
> 
> Before that happens, nextMultiXid will catch up with the minmxid = 1
> values, and they'll be in the past, and then we're at the same point
> that we're at to begin with if we used 9.3.5 pg_upgrade.

There'll be problems earlier than that afaics. Consider what happens if
a pg_upgrade happened at NextMulti=3000000000 which will have set
minmxid=1. If, after that, a couple 100k multis have been used, but
fewer than autovacuum_freeze_max_age normal xids were consumed we're in
an unfortunate situation.

If any *single* full table vacuum after that calls
vac_update_datfrozenxid() which just needs its datfrozenxid advance by
one we're in trouble: vac_truncate_clog() will be called with minMulti =
GetOldestMultiXactId(). Note that the latter only returns the oldest
*running* multi. Because vac_truncate_clog() only finds 1s in
datfrozenxid it'll ignore all of them because of:
		if (MultiXactIdPrecedes(dbform->datminmxid, minMulti))
		{
			minMulti = dbform->datminmxid;
			minmulti_datoid = HeapTupleGetOid(tuple);
		}
and calls
    SetMultiXactIdLimit(minMulti, minmulti_datoid);

If the vacuum happened without a concurrent backend using multis active
this will set the limit to the *current* NextMulti. Then
TruncateMultiXact() called after the checkpoint will truncate away
everything up to the current NextMulti essentially corrupting rows
created in 9.3+.

> > Luckily in most cases full table vacuums triggered due to normal xids
> > will prevent bad problems though.
> 
> Yeah.  While it's not that comfortable to rely on that, we were reliant
> on that effect in every pre-9.3 branch, so I'm not terribly upset about
> it continuing to be the case in existing 9.3 installations.

Well, there's a pretty fundamental distinction to < 9.3: The worst that
could happen before is a transient error while *writing*. Now it can
happen during reading.

Greetings,

Andres Freund

-- 
 Andres Freund	                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services


-- 
Sent via pgsql-bugs mailing list (pgsql-bugs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-bugs