From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
cc: Andres Freund <andres@anarazel.de>,
        Bharath Rupireddy <bharath.rupireddyforpostgres@gmail.com>,
        PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Issue with cancel_before_shmem_exit while searching to remove a
 particular registered exit callbacks
In-reply-to: 
 <CA+TgmoYgNMc7x814iih==wH-jN-4bO_FH_xWBdV5HEK=6e3kDQ@mail.gmail.com>
References: 
 <CALj2ACWk7j4F2v2fxxYfrroOF=AdFNPr1WsV+AGtHAFQOqm_pw@mail.gmail.com>
 <1519052.1594129481@sss.pgh.pa.us>
 <20200707165445.6qniqhzydlfsplvw@alap3.anarazel.de>
 <CA+TgmoZDFyV1RAmTEKvjaV8TvvS+gKha+RRiJUGMOLoY0-8Ekw@mail.gmail.com>
 <CA+TgmobdNtd+6gr2zFH6mTSDoNAwYNt=z=Jr1h59vM+PYrbQeQ@mail.gmail.com>
 <CA+Tgmoa_VpiNjKurhkScXaZbu6s7=NP6PL0NL4fMgstXNeGfPQ@mail.gmail.com>
 <CALj2ACX6O=UnQjR7p4nED45oWzj2gXWaXgcUmk_MwfVBVMQM9A@mail.gmail.com>
 <CA+TgmoY8hrNE-sO+B95M8AD6CL9VohSMik2VZkrnkbANRDS5gw@mail.gmail.com>
 <20200807212022.wocdoo2mmzhjsjm3@alap3.anarazel.de>
 <CA+TgmoYgNMc7x814iih==wH-jN-4bO_FH_xWBdV5HEK=6e3kDQ@mail.gmail.com>
Comments: In-reply-to Robert Haas <robertmhaas@gmail.com>
	message dated "Mon, 10 Aug 2020 10:29:54 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3195297.1597070661.1@sss.pgh.pa.us>
Date: Mon, 10 Aug 2020 10:44:21 -0400
Message-ID: <3195298.1597070661@sss.pgh.pa.us>
Precedence: bulk

Robert Haas <robertmhaas@gmail.com> writes:
> Well, I don't really care whether or not we change this function to
> iterate over the callback list or whether we add a warning that you
> need to use it in LIFO order, but I think we should do one or the
> other, because this same confusion has come up multiple times. I
> thought that Tom was opposed to making it iterate over the callback
> list (for reasons I don't really understand, honestly) so adding a
> comment and a cross-check seemed like the practical option. Now I also
> think it's fine to iterate over the callback list: this function
> doesn't get used so much that it's likely to be a performance problem,
> and I don't think this is the first bug that would have become a
> non-bug had we done that years and years ago whenever it was first
> proposed. In fact, I'd go so far as to say that the latter is a
> slightly better option. However, doing nothing is clearly worst.

I agree that doing nothing seems like a bad idea.  My concern about
allowing non-LIFO callback removal is that it seems to me that such
usage patterns have likely got *other* bugs, so we should discourage
that.  These callbacks don't exist in a vacuum: they reflect that
the mainline code path has set up, or torn down, important state.
Non-LIFO usage requires very strong assumptions that the states in
question are not interdependent, and that's something I'd rather not
rely on if we don't have to.

			regards, tom lane