aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* Fix VPATH builds of the replication parser from git for some !gcc compilers.Andres Freund2014-09-25
| | | | | | | | | | | | | Some compilers don't automatically search the current directory for included files. 9cc2c182fc2 fixed that for builds from tarballs by adding an include to the source directory. But that doesn't work when the scanner is generated in the VPATH directory. Use the same search path as the other parsers in the tree. One compiler that definitely was affected is solaris' sun cc. Backpatch to 9.1 which introduced using an actual parser for replication commands.
* Fix incorrect search for "x?" style matches in creviterdissect().Tom Lane2014-09-23
| | | | | | | | | | | | | | | | | | | | When the number of allowed iterations is limited (either a "?" quantifier or a bound expression), the last sub-match has to reach to the end of the target string. The previous coding here first tried the shortest possible match (one character, usually) and then gave up and back-tracked if that didn't work, typically leading to failure to match overall, as shown in bug #11478 from Christoph Berg. The minimum change to fix that would be to not decrement k before "goto backtrack"; but that would be a pretty stupid solution, because we'd laboriously try each possible sub-match length before finally discovering that only ending at the end can work. Instead, force the sub-match endpoint limit up to the end for even the first shortest() call if we cannot have any more sub-matches after this one. Bug introduced in my rewrite that added the iterdissect logic, commit 173e29aa5deefd9e71c183583ba37805c8102a72. The shortest-first search code was too closely modeled on the longest-first code, which hasn't got this issue since it tries a match reaching to the end to start with anyway. Back-patch to all affected branches.
* Fix mishandling of CreateEventTrigStmt's eventname field.Robert Haas2014-09-22
| | | | | | It's a string, not a scalar. Petr Jelinek
* Fix failure of contrib/auto_explain to print per-node timing information.Tom Lane2014-09-19
| | | | | | | | | | | | | This has been broken since commit af7914c6627bcf0b0ca614e9ce95d3f8056602bf, which added the EXPLAIN (TIMING) option. Although that commit included updates to auto_explain, they evidently weren't tested very carefully, because the code failed to print node timings even when it should, due to failure to set es.timing in the ExplainState struct. Reported off-list by Neelakanth Nadgir of Salesforce. In passing, clean up the documentation for auto_explain's options a little bit, including re-ordering them into what seems to me a more logical order.
* Mark x86's memory barrier inline assembly as clobbering the cpu flags.Andres Freund2014-09-19
| | | | | | | | | | | | | | x86's memory barrier assembly was marked as clobbering "memory" but not "cc" even though 'addl' sets various flags. As it turns out gcc on x86 implicitly assumes "cc" on every inline assembler statement, so it's not a bug. But as that's poorly documented and might get copied to architectures or compilers where that's not the case, it seems better to be precise. Discussion: 20140919100016.GH4277@alap3.anarazel.de To keep the code common, backpatch to 9.2 where explicit memory barriers were introduced.
* doc: Fix documentation of local_preload_librariesPeter Eisentraut2014-09-14
| | | | | | | The documentation used to suggest setting this parameter with ALTER ROLE SET, but that never worked, so replace it with a working suggestion. Reported-by: Kyotaro Horiguchi <horiguchi.kyotaro@lab.ntt.co.jp>
* Handle border = 3 in expanded modeStephen Frost2014-09-12
| | | | | | | | | | | | | | | | | | | | | In psql, expanded mode was not being displayed correctly when using the normal ascii or unicode linestyles and border set to '3'. Now, per the documentation, border '3' is really only sensible for HTML and LaTeX formats, however, that's no excuse for ascii/unicode to break in that case, and provisions had been made for psql to cleanly handle this case (and it did, in non-expanded mode). This was broken when ascii/unicode was initially added a good five years ago because print_aligned_vertical_line wasn't passed in the border setting being used by print_aligned_vertical but instead was given the whole printTableContent. There really isn't a good reason for vertical_line to have the entire printTableContent structure, so just pass in the printTextFormat and border setting (similar to how this is handled in horizontal_line). Pointed out by Pavel Stehule, fix by me. Back-patch to all currently-supported versions.
* Fix power_var_int() for large integer exponents.Tom Lane2014-09-11
| | | | | | | | | | | | | | | | | | | The code for raising a NUMERIC value to an integer power wasn't very careful about large powers. It got an outright wrong answer for an exponent of INT_MIN, due to failure to consider overflow of the Abs(exp) operation; which is fixable by using an unsigned rather than signed exponent value after that point. Also, even though the number of iterations of the power-computation loop is pretty limited, it's easy for the repeated squarings to result in ridiculously enormous intermediate values, which can take unreasonable amounts of time/memory to process, or even overflow the internal "weight" field and so produce a wrong answer. We can forestall misbehaviors of that sort by bailing out as soon as the weight value exceeds what will fit in int16, since then the final answer must overflow (if exp > 0) or underflow (if exp < 0) the packed numeric format. Per off-list report from Pavel Stehule. Back-patch to all supported branches.
* pg_upgrade: preserve the timestamp epochBruce Momjian2014-09-11
| | | | | | | | | This is useful for replication tools like Slony and Skytools. This is a backpatch of a74a4aa23bb95b590ff01ee564219d2eacea3706. Report by Sergey Konoplev Backpatch through 9.3
* Fix typo in solaris spinlock fix.Andres Freund2014-09-09
| | | | | 07968dbfaad03 missed part of the S_UNLOCK define when building for sparcv8+.
* Fix spinlock implementation for some !solaris sparc platforms.Andres Freund2014-09-09
| | | | | | | | | | | | | | | | | Some Sparc CPUs can be run in various coherence models, ranging from RMO (relaxed) over PSO (partial) to TSO (total). Solaris has always run CPUs in TSO mode while in userland, but linux didn't use to and the various *BSDs still don't. Unfortunately the sparc TAS/S_UNLOCK were only correct under TSO. Fix that by adding the necessary memory barrier instructions. On sparcv8+, which should be all relevant CPUs, these are treated as NOPs if the current consistency model doesn't require the barriers. Discussion: 20140630222854.GW26930@awork2.anarazel.de Will be backpatched to all released branches once a few buildfarm cycles haven't shown up problems. As I've no access to sparc, this is blindly written.
* Fix psql \s to work with recent libedit, and add pager support.Tom Lane2014-09-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | psql's \s (print command history) doesn't work at all with recent libedit versions when printing to the terminal, because libedit tries to do an fchmod() on the target file which will fail if the target is /dev/tty. (We'd already noted this in the context of the target being /dev/null.) Even before that, it didn't work pleasantly, because libedit likes to encode the command history file (to ensure successful reloading), which renders it nigh unreadable, not to mention significantly different-looking depending on exactly which libedit version you have. So let's forget using write_history() for this purpose, and instead print the data ourselves, using logic similar to that used to iterate over the history for newline encoding/decoding purposes. While we're at it, insert the ability to use the pager when \s is printing to the terminal. This has been an acknowledged shortcoming of \s for many years, so while you could argue it's not exactly a back-patchable bug fix it still seems like a good improvement. Anyone who's seriously annoyed at this can use "\s /dev/tty" or local equivalent to get the old behavior. Experimentation with this showed that the history iteration logic was actually rather broken when used with libedit. It turns out that with libedit you have to use previous_history() not next_history() to advance to more recent history entries. The easiest and most robust fix for this seems to be to make a run-time test to verify which function to call. We had not noticed this because libedit doesn't really need the newline encoding logic: its own encoding ensures that command entries containing newlines are reloaded correctly (unlike libreadline). So the effective behavior with recent libedits was that only the oldest history entry got newline-encoded or newline-decoded. However, because of yet other bugs in history_set_pos(), some old versions of libedit allowed the existing loop logic to reach entries besides the oldest, which means there may be libedit ~/.psql_history files out there containing encoded newlines in more than just the oldest entry. To ensure we can reload such files, it seems appropriate to back-patch this fix, even though that will result in some incompatibility with older psql versions (ie, multiline history entries written by a psql with this fix will look corrupted to a psql without it, if its libedit is reasonably up to date). Stepan Rutz and Tom Lane
* Documentation fix: sum(float4) returns float4, not float8.Tom Lane2014-09-07
| | | | | | | | | The old claim is from my commit d06ebdb8d3425185d7e641d15e45908658a0177d of 2000-07-17, but it seems to have been a plain old thinko; sum(float4) has been distinct from sum(float8) since Berkeley days. Noted by KaiGai Kohei. While at it, mention the existence of sum(money), which is also of embarrassingly ancient vintage.
* Fix segmentation fault that an empty prepared statement could cause.Fujii Masao2014-09-05
| | | | | | Back-patch to all supported branches. Per bug #11335 from Haruka Takatsuka
* doc: Various typo/grammar fixesKevin Grittner2014-08-30
| | | | | | | | | Errors detected using Topy (https://github.com/intgr/topy), all changes verified by hand and some manual tweaks added. Marti Raudsepp Individual changes backpatched, where applicable, as far as 9.0.
* Fix citext upgrade script for disallowance of oidvector element assignment.Tom Lane2014-08-28
| | | | | | | | | | | | | | | | | | | In commit 45e02e3232ac7cc5ffe36f7986159b5e0b1f6fdc, we intentionally disallowed updates on individual elements of oidvector columns. While that still seems like a sane idea in the abstract, we (I) forgot that citext's "upgrade from unpackaged" script did in fact perform exactly such updates, in order to fix the problem that citext indexes should have a collation but would not in databases dumped or upgraded from pre-9.1 installations. Even if we wanted to add casts to allow such updates, there's no practical way to do so in the back branches, so the only real alternative is to make citext's kluge even klugier. In this patch, I cast the oidvector to text, fix its contents with regexp_replace, and cast back to oidvector. (Ugh!) Since the aforementioned commit went into all active branches, we have to fix this in all branches that contain the now-broken update script. Per report from Eric Malm.
* Fix typos in some error messages thrown by extension scripts when fed to psql.Andres Freund2014-08-25
| | | | | | | | | | Some of the many error messages introduced in 458857cc missed 'FROM unpackaged'. Also e016b724 and 45ffeb7e forgot to quote extension version numbers. Backpatch to 9.1, just like 458857cc which introduced the messages. Do so because the error messages thrown when the wrong command is copy & pasted aren't easy to understand.
* Backpatch: Fix typo in update scripts for some contrib modules.Fujii Masao2014-08-25
| | | | | | | Backpatch as discussed in 20140702192641.GD22738@awork2.anarazel.de ff. as the error messages are user facing and possibly confusing. Original commit: 6f9e39bc9993c18686f0950f9b9657c7c97c7450
* Fix outdated commentAlvaro Herrera2014-08-22
|
* Install libpq DLL with $(INSTALL_SHLIB).Noah Misch2014-08-18
| | | | | | | Programs need execute permission on a DLL file to load it. MSYS "install" ignores the mode argument, and our Cygwin build statically links libpq into programs. That explains the lack of buildfarm trouble. Back-patch to 9.0 (all supported versions).
* Fix obsolete mention of non-int64 support in CREATE SEQUENCE documentation.Tom Lane2014-08-18
| | | | | | The old text explained what happened if we didn't have working int64 arithmetic. Since that case has been explicitly rejected by configure since 8.4.3, documenting it in the 9.x branches can only produce confusion.
* Fix bogus return macros in range_overright_internal().Tom Lane2014-08-16
| | | | | | | | | PG_RETURN_BOOL() should only be used in functions following the V1 SQL function API. This coding accidentally fails to fail since letting the compiler coerce the Datum representation of bool back to plain bool does give the right answer; but that doesn't make it a good idea. Back-patch to older branches just to avoid unnecessary code divergence.
* Update SysV parameter configuration documentation for FreeBSD.Tom Lane2014-08-14
| | | | | | | | | | FreeBSD hasn't made any use of kern.ipc.semmap since 1.1, and newer releases reject attempts to set it altogether; so stop recommending that it be adjusted. Per bug #11161. Back-patch to all supported branches. Before 9.3, also incorporate commit 7a42dff47, which touches the same text and for some reason was not back-patched at the time.
* Fix help message in pg_ctl.Fujii Masao2014-08-14
| | | | | | | | | Previously the help message described that -m is an option for "stop", "restart" and "promote" commands in pg_ctl. But actually that's not an option for "promote". So this commit fixes that incorrect description in the help message. Back-patch to 9.3 where the incorrect description was added.
* Fix failure to follow the directions when "init" fork was added.Fujii Masao2014-08-11
| | | | | | | | | | Specifically this commit updates forkname_to_number() so that the HINT message includes "init" fork, and also adds the description of "init" fork into pg_relation_size() document. This is a part of the commit 2d00190495b22e0d0ba351b2cda9c95fb2e3d083 which has fixed the same oversight in master and 9.4. Back-patch to 9.1 where "init" fork was added.
* Fix documentation oversights about pageinspect and initialization fork.Fujii Masao2014-08-11
| | | | | | | | | | | | | | The initialization fork was added in 9.1, but has not been taken into consideration in documents of get_raw_page function in pageinspect and storage layout. This commit fixes those oversights. get_raw_page can read not only a table but also an index, etc. So it should be documented that the function can read any relation. This commit also fixes the document of pageinspect that way. Back-patch to 9.1 where those oversights existed. Vik Fearing, review by MauMau
* Clarify type resolution behavior for domain types.Tom Lane2014-08-10
| | | | | | | | | | The user documentation was vague and not entirely accurate about how we treat domain inputs for ambiguous operators/functions. Clarify that, and add an example and some commentary. Per a recent question from Adam Mackler. It's acted like this ever since we added domains, so back-patch to all supported branches.
* Fix conversion of domains to JSON in 9.3 and 9.2.Tom Lane2014-08-09
| | | | | | | | | | | | | | | | | | | | | | | In commit 0ca6bda8e7501947c05f30c127f6d12ff90b5a64, I rewrote the json.c code that decided how to convert SQL data types into JSON values, so that it no longer relied on typcategory which is a pretty untrustworthy guide to the output format of user-defined datatypes. However, I overlooked the fact that CREATE DOMAIN inherits typcategory from the base type, so that the old coding did have the desirable property of treating domains like their base types --- but only in some cases, because not all its decisions turned on typcategory. The version of the patch that went into 9.4 and up did a getBaseType() call to ensure that domains were always treated like their base types, but I omitted that from the older branches, because it would result in a behavioral change for domains over json or hstore; a change that's arguably a bug fix, but nonetheless a change that users had not asked for. What I overlooked was that this meant that domains over numerics and boolean were no longer treated like their base types, and that we *did* get a complaint about, ie bug #11103 from David Grelaud. So let's do the getBaseType() call in the older branches as well, to restore their previous behavior in these cases. That means 9.2 and 9.3 will now make these decisions just like 9.4. We could probably kluge things to still ignore the domain's base type if it's json etc, but that seems a bit silly.
* Reject duplicate column names in foreign key referenced-columns lists.Tom Lane2014-08-09
| | | | | | | | | | | | | Such cases are disallowed by the SQL spec, and even if we wanted to allow them, the semantics seem ambiguous: how should the FK columns be matched up with the columns of a unique index? (The matching could be significant in the presence of opclasses with different notions of equality, so this issue isn't just academic.) However, our code did not previously reject such cases, but instead would either fail to match to any unique index, or generate a bizarre opclass-lookup error because of sloppy thinking in the index-matching code. David Rowley
* pg_upgrade: prevent oid conflicts with new-cluster TOAST tablesBruce Momjian2014-08-07
| | | | | | | | Previously, TOAST tables only required in the new cluster could cause oid conflicts if they were auto-numbered and a later conflicting oid had to be assigned. Backpatch through 9.3
* pg_upgrade: remove reference to autovacuum_multixact_freeze_max_ageBruce Momjian2014-08-04
| | | | | | | | | | | | | | | autovacuum_multixact_freeze_max_age was added as a pg_ctl start parameter in 9.3.X to prevent autovacuum from running. However, only some 9.3.X releases have autovacuum_multixact_freeze_max_age as it was added in a minor PG 9.3 release. It also isn't needed because -b turns off autovacuum in 9.1+. Without this fix, trying to upgrade from an early 9.3 release to 9.4 would fail. Report by EDB Backpatch through 9.3
* Add missing PQclear() calls into pg_receivexlog.Fujii Masao2014-08-02
| | | | Back-patch to 9.3.
* Fix bug in pg_receivexlog --verbose.Fujii Masao2014-08-02
| | | | | | | | | In 9.2, pg_receivexlog with verbose option has emitted the messages at the end of each WAL file. But the commit 0b63291 suppressed such messages by mistake. This commit fixes the bug so that pg_receivexlog --verbose outputs such messages again. Back-patch to 9.3 where the bug was added.
* Fix typo in user manualHeikki Linnakangas2014-08-01
|
* Avoid wholesale autovacuuming when autovacuum is nominally off.Tom Lane2014-07-30
| | | | | | | | | | | | | When autovacuum is nominally off, we will still launch autovac workers to vacuum tables that are at risk of XID wraparound. But after we'd done that, an autovac worker would proceed to autovacuum every table in the targeted database, if they meet the usual thresholds for autovacuuming. This is at best pretty unexpected; at worst it delays response to the wraparound threat. Fix it so that if autovacuum is nominally off, we *only* do forced vacuums and not any other work. Per gripe from Andrey Zhidenkov. This has been like this all along, so back-patch to all supported branches.
* Fix mishandling of background worker PGPROCs in EXEC_BACKEND builds.Robert Haas2014-07-30
| | | | | | | | | | InitProcess() relies on IsBackgroundWorker to decide whether the PGPROC for a new backend should be taken from ProcGlobal's freeProcs or from bgworkerFreeProcs. In EXEC_BACKEND builds, InitProcess() is called sooner than in non-EXEC_BACKEND builds, and IsBackgroundWorker wasn't getting initialized soon enough. Report by Noah Misch. Diagnosis and fix by me.
* Treat 2PC commit/abort the same as regular xacts in recovery.Heikki Linnakangas2014-07-29
| | | | | | | | | | | | | | | | | There were several oversights in recovery code where COMMIT/ABORT PREPARED records were ignored: * pg_last_xact_replay_timestamp() (wasn't updated for 2PC commits) * recovery_min_apply_delay (2PC commits were applied immediately) * recovery_target_xid (recovery would not stop if the XID used 2PC) The first of those was reported by Sergiy Zuban in bug #11032, analyzed by Tom Lane and Andres Freund. The bug was always there, but was masked before commit d19bd29f07aef9e508ff047d128a4046cc8bc1e2, because COMMIT PREPARED always created an extra regular transaction that was WAL-logged. Backpatch to all supported versions (older versions didn't have all the features and therefore didn't have all of the above bugs).
* Fix a performance problem in pg_dump's dump order selection logic.Tom Lane2014-07-25
| | | | | | | | | | | | | | | | | findDependencyLoops() was not bright about cases where there are multiple dependency paths between the same two dumpable objects. In most scenarios this did not hurt us too badly; but since the introduction of section boundary pseudo-objects in commit a1ef01fe163b304760088e3e30eb22036910a495, it was possible for this code to take unreasonable amounts of time (tens of seconds on a database with a couple thousand objects), as reported in bug #11033 from Joe Van Dyk. Joe's particular problem scenario involved "pg_dump -a" mode with long chains of foreign key constraints, but I think that similar problems could arise with other situations as long as there were enough objects. To fix, add a flag array that lets us notice when we arrive at the same object again while searching from a given start object. This simple change seems to be enough to eliminate the performance problem. Back-patch to 9.1, like the patch that introduced section boundary objects.
* Avoid access to already-released lock in LockRefindAndRelease.Robert Haas2014-07-24
| | | | Spotted by Tom Lane.
* Rearrange documentation paragraph describing pg_relation_size().Tom Lane2014-07-23
| | | | | | | | | | | | Break the list of available options into an <itemizedlist> instead of inline sentences. This is mostly motivated by wanting to ensure that the cross-references to the FSM and VM docs don't cross page boundaries in PDF format; but it seems to me to read more easily this way anyway. I took the liberty of editorializing a bit further while at it. Per complaint from Magnus about 9.0.18 docs not building in A4 format. Patch all active branches so we don't get blind-sided by this particular issue again in future.
* Report success when Windows kill() emulation signals an exiting process.Noah Misch2014-07-23
| | | | | | | | This is consistent with the POSIX verdict that kill() shall not report ESRCH for a zombie process. Back-patch to 9.0 (all supported versions). Test code from commit d7cdf6ee36adeac9233678fb8f2a112e6678a770 depends on it, and log messages about kill() reporting "Invalid argument" will cease to appear for this not-unexpected condition.
* MSVC: Substitute $(top_builddir) in REGRESS_OPTS.Noah Misch2014-07-23
| | | | | Commit d7cdf6ee36adeac9233678fb8f2a112e6678a770 introduced a usage thereof. Back-patch to 9.0, like that commit.
* Re-enable error for "SELECT ... OFFSET -1".Tom Lane2014-07-22
| | | | | | | | | | | The executor has thrown errors for negative OFFSET values since 8.4 (see commit bfce56eea45b1369b7bb2150a150d1ac109f5073), but in a moment of brain fade I taught the planner that OFFSET with a constant negative value was a no-op (commit 1a1832eb085e5bca198735e5d0e766a3cb61b8fc). Reinstate the former behavior by only discarding OFFSET with a value of exactly 0. In passing, adjust a planner comment that referenced the ancient behavior. Back-patch to 9.3 where the mistake was introduced.
* Check block number against the correct fork in get_raw_page().Tom Lane2014-07-22
| | | | | | | | | | | | | | | | | | get_raw_page tried to validate the supplied block number against RelationGetNumberOfBlocks(), which of course is only right when accessing the main fork. In most cases, the main fork is longer than the others, so that the check was too weak (allowing a lower-level error to be reported, but no real harm to be done). However, very small tables could have an FSM larger than their heap, in which case the mistake prevented access to some FSM pages. Per report from Torsten Foertsch. In passing, make the bad-block-number error into an ereport not elog (since it's certainly not an internal error); and fix sloppily maintained comment for RelationGetNumberOfBlocksInFork. This has been wrong since we invented relation forks, so back-patch to all supported branches.
* Diagnose incompatible OpenLDAP versions during build and test.Noah Misch2014-07-22
| | | | | | | With OpenLDAP versions 2.4.24 through 2.4.31, inclusive, PostgreSQL backends can crash at exit. Raise a warning during "configure" based on the compile-time OpenLDAP version number, and test the crash scenario in the dblink test suite. Back-patch to 9.0 (all supported versions).
* Reject out-of-range numeric timezone specifications.Tom Lane2014-07-21
| | | | | | | | | | | | | | | In commit 631dc390f49909a5c8ebd6002cfb2bcee5415a9d, we started to handle simple numeric timezone offsets via the zic library instead of the old CTimeZone/HasCTZSet kluge. However, we overlooked the fact that the zic code will reject UTC offsets exceeding a week (which seems a bit arbitrary, but not because it's too tight ...). This led to possibly setting session_timezone to NULL, which results in crashes in most timezone-related operations as of 9.4, and crashes in a small number of places even before that. So check for NULL return from pg_tzset_offset() and report an appropriate error message. Per bug #11014 from Duncan Gillis. Back-patch to all supported branches, like the previous patch. (Unfortunately, as of today that no longer includes 8.4.)
* Stamp 9.3.5.REL9_3_5Tom Lane2014-07-21
|
* Release notes for 9.3.5, 9.2.9, 9.1.14, 9.0.18, 8.4.22.Tom Lane2014-07-21
|
* Adjust cutoff points in newly-added sanity tests.Tom Lane2014-07-21
| | | | Per recommendation from Andres.
* Defend against bad relfrozenxid/relminmxid/datfrozenxid/datminmxid values.Tom Lane2014-07-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In commit a61daa14d56867e90dc011bbba52ef771cea6770, we fixed pg_upgrade so that it would install sane relminmxid and datminmxid values, but that does not cure the problem for installations that were already pg_upgraded to 9.3; they'll initially have "1" in those fields. This is not a big problem so long as 1 is "in the past" compared to the current nextMultiXact counter. But if an installation were more than halfway to the MXID wrap point at the time of upgrade, 1 would appear to be "in the future" and that would effectively disable tracking of oldest MXIDs in those tables/databases, until such time as the counter wrapped around. While in itself this isn't worse than the situation pre-9.3, where we did not manage MXID wraparound risk at all, the consequences of premature truncation of pg_multixact are worse now; so we ought to make some effort to cope with this. We discussed advising users to fix the tracking values manually, but that seems both very tedious and very error-prone. Instead, this patch adopts two amelioration rules. First, a relminmxid value that is "in the future" is allowed to be overwritten with a full-table VACUUM's actual freeze cutoff, ignoring the normal rule that relminmxid should never go backwards. (This essentially assumes that we have enough defenses in place that wraparound can never occur anymore, and thus that a value "in the future" must be corrupt.) Second, if we see any "in the future" values then we refrain from truncating pg_clog and pg_multixact. This prevents loss of clog data until we have cleaned up all the broken tracking data. In the worst case that could result in considerable clog bloat, but in practice we expect that relfrozenxid-driven freezing will happen soon enough to fix the problem before clog bloat becomes intolerable. (Users could do manual VACUUM FREEZEs if not.) Note that this mechanism cannot save us if there are already-wrapped or already-truncated-away MXIDs in the table; it's only capable of dealing with corrupt tracking values. But that's the situation we have with the pg_upgrade bug. For consistency, apply the same rules to relfrozenxid/datfrozenxid. There are not known mechanisms for these to get messed up, but if they were, the same tactics seem appropriate for fixing them.