Repair pg_upgrade's failure to preserve relfrozenxid for matviews.

This oversight led to data corruption in matviews, manifesting as
"could not access status of transaction" before our most recent releases,
and "found xmin from before relfrozenxid" errors since then.

The proximate cause of the problem seems to have been confusion between
the task of preserving dropped-column status and the task of preserving
frozenxid status.  Those are required for distinct sets of relkinds,
and the reasoning was entirely undocumented in the source code.  In hopes
of forestalling future errors of the same kind, try to improve the
commentary in this area.

In passing, also improve the remarkably unhelpful comments around
pg_upgrade's set_frozenxids().  That's not actually buggy AFAICS,
but good luck figuring out what it does from the old comments.

Per report from Claudio Freire.  It appears that bug #14852 from Alexey
Ermakov is an earlier report of the same issue, and there may be other
cases that we failed to identify at the time.

Patch by me based on analysis by Andres Freund.  The bug dates back
to the introduction of matviews, so back-patch to all supported branches.

Discussion: https://postgr.es/m/CAGTBQpbrY9CdRGGhyBZ9yqY4jWaGC85rUF4X+R7d-aim=mBNsw@mail.gmail.com
Discussion: https://postgr.es/m/20171013115320.28049.86457@wrigleys.postgresql.org

diff --git a/src/bin/pg_dump/pg_dump.c b/src/bin/pg_dump/pg_dump.c
index bbeeae031a6a7c22b7a542c6e17fd0954bdca24e..548f37f5543630e59e5722198dff0e84dc9e32d9 100644 (file)
--- a/src/bin/pg_dump/pg_dump.c
+++ b/src/bin/pg_dump/pg_dump.c
@@ -15688,6 +15688,13 @@ dumpTableSchema(Archive *fout, TableInfo *tbinfo)
                 * column order.  That also means we have to take care about setting
                 * attislocal correctly, plus fix up any inherited CHECK constraints.
                 * Analogously, we set up typed tables using ALTER TABLE / OF here.
+                *
+                * We process foreign tables here, even though they lack heap storage,
+                * because they can participate in inheritance relationships and we
+                * want this stuff to be consistent across the inheritance tree.  We
+                * exclude indexes, toast tables, sequences and matviews, even though
+                * they have storage, because we don't support altering or dropping
+                * columns in them, nor can they be part of inheritance trees.
                 */
                if (dopt->binary_upgrade &&
                        (tbinfo->relkind == RELKIND_RELATION ||
@@ -15777,7 +15784,19 @@ dumpTableSchema(Archive *fout, TableInfo *tbinfo)
                                                                  fmtId(tbinfo->dobj.name),
                                                                  tbinfo->reloftype);
                        }
+               }
 
+               /*
+                * In binary_upgrade mode, arrange to restore the old relfrozenxid and
+                * relminmxid of all vacuumable relations.  (While vacuum.c processes
+                * TOAST tables semi-independently, here we see them only as children
+                * of other relations; so this "if" lacks RELKIND_TOASTVALUE, and the
+                * child toast table is handled below.)
+                */
+               if (dopt->binary_upgrade &&
+                       (tbinfo->relkind == RELKIND_RELATION ||
+                        tbinfo->relkind == RELKIND_MATVIEW))
+               {
                        appendPQExpBufferStr(q, "\n-- For binary upgrade, set heap's relfrozenxid and relminmxid\n");
                        appendPQExpBuffer(q, "UPDATE pg_catalog.pg_class\n"
                                                          "SET relfrozenxid = '%u', relminmxid = '%u'\n"
@@ -15788,7 +15807,10 @@ dumpTableSchema(Archive *fout, TableInfo *tbinfo)
 
                        if (tbinfo->toast_oid)
                        {
-                               /* We preserve the toast oids, so we can use it during restore */
+                               /*
+                                * The toast table will have the same OID at restore, so we
+                                * can safely target it by OID.
+                                */
                                appendPQExpBufferStr(q, "\n-- For binary upgrade, set toast's relfrozenxid and relminmxid\n");
                                appendPQExpBuffer(q, "UPDATE pg_catalog.pg_class\n"
                                                           "SET relfrozenxid = '%u', relminmxid = '%u'\n"
@@ -15802,7 +15824,8 @@ dumpTableSchema(Archive *fout, TableInfo *tbinfo)
                 * In binary_upgrade mode, restore matviews' populated status by
                 * poking pg_class directly.  This is pretty ugly, but we can't use
                 * REFRESH MATERIALIZED VIEW since it's possible that some underlying
-                * matview is not populated even though this matview is.
+                * matview is not populated even though this matview is; in any case,
+                * we want to transfer the matview's heap storage, not run REFRESH.
                 */
                if (dopt->binary_upgrade && tbinfo->relkind == RELKIND_MATVIEW &&
                        tbinfo->relispopulated)

diff --git a/src/bin/pg_upgrade/pg_upgrade.c b/src/bin/pg_upgrade/pg_upgrade.c
index f9f73093f309e61a0e25394262b06d8e5b00d58f..a4faeb6513e4b1f66164a2ef62498adc14ef72aa 100644 (file)
--- a/src/bin/pg_upgrade/pg_upgrade.c
+++ b/src/bin/pg_upgrade/pg_upgrade.c
@@ -271,13 +271,13 @@ static void
 prepare_new_databases(void)
 {
        /*
-        * We set autovacuum_freeze_max_age to its maximum value so autovacuum
-        * does not launch here and delete clog files, before the frozen xids are
-        * set.
+        * Before we restore anything, set frozenxids of initdb-created tables.
         */
-
        set_frozenxids(false);
 
+       /*
+        * Now restore global objects (roles and tablespaces).
+        */
        prep_status("Restoring global objects in the new cluster");
 
        /*
@@ -495,14 +495,25 @@ copy_clog_xlog_xid(void)
 /*
  *     set_frozenxids()
  *
- *     We have frozen all xids, so set datfrozenxid, relfrozenxid, and
- *     relminmxid to be the old cluster's xid counter, which we just set
- *     in the new cluster.  User-table frozenxid and minmxid values will
- *     be set by pg_dump --binary-upgrade, but objects not set by the pg_dump
- *     must have proper frozen counters.
+ * This is called on the new cluster before we restore anything, with
+ * minmxid_only = false.  Its purpose is to ensure that all initdb-created
+ * vacuumable tables have relfrozenxid/relminmxid matching the old cluster's
+ * xid/mxid counters.  We also initialize the datfrozenxid/datminmxid of the
+ * built-in databases to match.
+ *
+ * As we create user tables later, their relfrozenxid/relminmxid fields will
+ * be restored properly by the binary-upgrade restore script.  Likewise for
+ * user-database datfrozenxid/datminmxid.  However, if we're upgrading from a
+ * pre-9.3 database, which does not store per-table or per-DB minmxid, then
+ * the relminmxid/datminmxid values filled in by the restore script will just
+ * be zeroes.
+ *
+ * Hence, with a pre-9.3 source database, a second call occurs after
+ * everything is restored, with minmxid_only = true.  This pass will
+ * initialize all tables and databases, both those made by initdb and user
+ * objects, with the desired minmxid value.  frozenxid values are left alone.
  */
-static
-void
+static void
 set_frozenxids(bool minmxid_only)
 {
        int                     dbnum;