Re: BUG #15346: Replica fails to start after the crash

On Fri, Aug 31, 2018 at 02:52:06PM +0900, Kyotaro HORIGUCHI wrote:
> The patch inhibits turning off updateMinRecoveryPoint on other
> than the startup process running crash-recovery except at the end
> of XLogNeedsFlush.

Yes that's a matter of safety, as I put into the truck any modules which
may use XLogFlush().  And that maps with the old code, so there is no
more surprise.

> Even if any other processes than the startup calls the function
> during crash recovery, they don't have a means to turn on
> updateMinRecoveryPoint again. Actually the only process that
> calls the function during crash recovery is the startup. bwriter
> and checkpointer doesn't. Hot-standby backends come after
> crash-recvery ends. After all, we just won't have an invalid
> minRecoveryPoint value there, and updateMinRecoverypoint must be
> true.

Yes, until a recovery point is reached only the startup process could
call that.  Now I would imagine that we could have a background worker
as well which is spawned when the postmaster starts, and calls those
code paths...

> +    /*
> +     * No other process than the startup doesn't reach here before crash
> +     * recovery ends. So minRecoveryPoint must have a valid value here.
> +     */
> +    Assert(minRecoveryPoint != InvalidXLogRecPtr);

...  And that would invalidate your assertion here.
--
Michael