Simon Riggs <simon@2ndQuadrant.com> writes:
> A corrupt record of a block number would do this in XLogReadBuffer() if
> we had full page writes enabled. But it would have to be corrupt between
> setting it correctly and the CRC check on the WAL record. Which is a
> fairly small window of believability.
> Should there be a sanity check on how far a relation can be extended in
> recovery?
As you say, that's not a highly believable theory. I'd prefer not to
put an arbitrary limit into the recovery code unless we can positively
pin this down as the source of the problem.
Is there any particular reason to suppose that the empty pages appeared
during a crash recovery?
Have you read through md.c? I seem to recall there are some slightly
squirrelly choices made there about segment-extension behavior. Maybe
it could've done the wrong thing here during normal operation.
regards, tom lane