Check for interrupts inside the nbtree page deletion code.

When deleting pages the nbtree code has to walk through siblings of a
tree node. When those sibling links are corrupted that can lead to
endless loops - which are currently not interruptible.  This is
especially problematic if autovacuum is repeatedly blocked on such
indexes, as it can be hard to get out of that situation without
resorting to single user mode.

Thus add interrupt checks to appropriate places in such
loops. Unfortunately in one of the cases it's it's not easy to do so.

Between 9.3 and 9.4 the page deletion (and page split) code changed
significantly. Before it was significantly less robust against
interruptions. Therefore don't backpatch to 9.3.

Author: Andres Freund
Discussion: https://postgr.es/m/20180627191629.wkunw2qbibnvlz53@alap3.anarazel.de
Backpatch: 9.4-

diff --git a/src/backend/access/nbtree/nbtpage.c b/src/backend/access/nbtree/nbtpage.c
index 5c817b6510523342d0904db6a6b221e8a8ce8fcb..0a3602aaa3f8a178cd71b6945e1d46ece9f1a662 100644 (file)
--- a/src/backend/access/nbtree/nbtpage.c
+++ b/src/backend/access/nbtree/nbtpage.c
@@ -1283,6 +1283,7 @@ _bt_pagedel(Relation rel, Buffer buf)
                rightsib_empty = false;
                while (P_ISHALFDEAD(opaque))
                {
+                       /* will check for interrupts, once lock is released */
                        if (!_bt_unlink_halfdead_page(rel, buf, &rightsib_empty))
                        {
                                /* _bt_unlink_halfdead_page already released buffer */
@@ -1295,6 +1296,12 @@ _bt_pagedel(Relation rel, Buffer buf)
 
                _bt_relbuf(rel, buf);
 
+               /*
+                * Check here, as calling loops will have locks held, preventing
+                * interrupts from being processed.
+                */
+               CHECK_FOR_INTERRUPTS();
+
                /*
                 * The page has now been deleted. If its right sibling is completely
                 * empty, it's possible that the reason we haven't deleted it earlier
@@ -1546,6 +1553,12 @@ _bt_unlink_halfdead_page(Relation rel, Buffer leafbuf, bool *rightsib_empty)
 
        LockBuffer(leafbuf, BUFFER_LOCK_UNLOCK);
 
+       /*
+        * Check here, as calling loops will have locks held, preventing
+        * interrupts from being processed.
+        */
+       CHECK_FOR_INTERRUPTS();
+
        /*
         * If the leaf page still has a parent pointing to it (or a chain of
         * parents), we don't unlink the leaf page yet, but the topmost remaining
@@ -1604,6 +1617,14 @@ _bt_unlink_halfdead_page(Relation rel, Buffer leafbuf, bool *rightsib_empty)
                        /* step right one page */
                        leftsib = opaque->btpo_next;
                        _bt_relbuf(rel, lbuf);
+
+                       /*
+                        * It'd be good to check for interrupts here, but it's not easy to
+                        * do so because a lock is always held. This block isn't
+                        * frequently reached, so hopefully the consequences of not
+                        * checking interrupts aren't too bad.
+                        */
+
                        if (leftsib == P_NONE)
                        {
                                elog(LOG, "no left sibling (concurrent deletion?) of block %u in \"%s\"",