PostgreSQL Source Code  git master
verify_nbtree.c
Go to the documentation of this file.
1 /*-------------------------------------------------------------------------
2  *
3  * verify_nbtree.c
4  * Verifies the integrity of nbtree indexes based on invariants.
5  *
6  * For B-Tree indexes, verification includes checking that each page in the
7  * target index has items in logical order as reported by an insertion scankey
8  * (the insertion scankey sort-wise NULL semantics are needed for
9  * verification).
10  *
11  * When index-to-heap verification is requested, a Bloom filter is used to
12  * fingerprint all tuples in the target index, as the index is traversed to
13  * verify its structure. A heap scan later uses Bloom filter probes to verify
14  * that every visible heap tuple has a matching index tuple.
15  *
16  *
17  * Copyright (c) 2017-2021, PostgreSQL Global Development Group
18  *
19  * IDENTIFICATION
20  * contrib/amcheck/verify_nbtree.c
21  *
22  *-------------------------------------------------------------------------
23  */
24 #include "postgres.h"
25 
26 #include "access/htup_details.h"
27 #include "access/nbtree.h"
28 #include "access/table.h"
29 #include "access/tableam.h"
30 #include "access/transam.h"
31 #include "access/xact.h"
32 #include "catalog/index.h"
33 #include "catalog/pg_am.h"
34 #include "commands/tablecmds.h"
35 #include "lib/bloomfilter.h"
36 #include "miscadmin.h"
37 #include "storage/lmgr.h"
38 #include "storage/smgr.h"
39 #include "utils/memutils.h"
40 #include "utils/snapmgr.h"
41 
42 
44 
45 /*
46  * A B-Tree cannot possibly have this many levels, since there must be one
47  * block per level, which is bound by the range of BlockNumber:
48  */
49 #define InvalidBtreeLevel ((uint32) InvalidBlockNumber)
50 #define BTreeTupleGetNKeyAtts(itup, rel) \
51  Min(IndexRelationGetNumberOfKeyAttributes(rel), BTreeTupleGetNAtts(itup, rel))
52 
53 /*
54  * State associated with verifying a B-Tree index
55  *
56  * target is the point of reference for a verification operation.
57  *
58  * Other B-Tree pages may be allocated, but those are always auxiliary (e.g.,
59  * they are current target's child pages). Conceptually, problems are only
60  * ever found in the current target page (or for a particular heap tuple during
61  * heapallindexed verification). Each page found by verification's left/right,
62  * top/bottom scan becomes the target exactly once.
63  */
64 typedef struct BtreeCheckState
65 {
66  /*
67  * Unchanging state, established at start of verification:
68  */
69 
70  /* B-Tree Index Relation and associated heap relation */
73  /* rel is heapkeyspace index? */
75  /* ShareLock held on heap/index, rather than AccessShareLock? */
76  bool readonly;
77  /* Also verifying heap has no unindexed tuples? */
79  /* Also making sure non-pivot tuples can be found by new search? */
81  /* Per-page context */
83  /* Buffer access strategy */
85 
86  /*
87  * Mutable state, for verification of particular page:
88  */
89 
90  /* Current target page */
92  /* Target block number */
94  /* Target page's LSN */
96 
97  /*
98  * Low key: high key of left sibling of target page. Used only for child
99  * verification. So, 'lowkey' is kept only when 'readonly' is set.
100  */
102 
103  /*
104  * The rightlink and incomplete split flag of block one level down to the
105  * target page, which was visited last time via downlink from taget page.
106  * We use it to check for missing downlinks.
107  */
110 
111  /*
112  * Mutable state, for optional heapallindexed verification:
113  */
114 
115  /* Bloom filter fingerprints B-Tree index */
117  /* Debug counter */
120 
121 /*
122  * Starting point for verifying an entire B-Tree index level
123  */
124 typedef struct BtreeLevel
125 {
126  /* Level number (0 is leaf page level). */
128 
129  /* Left most block on level. Scan of level begins here. */
131 
132  /* Is this level reported as "true" root level by meta page? */
134 } BtreeLevel;
135 
138 
139 static void bt_index_check_internal(Oid indrelid, bool parentcheck,
140  bool heapallindexed, bool rootdescend);
141 static inline void btree_index_checkable(Relation rel);
142 static inline bool btree_index_mainfork_expected(Relation rel);
144  bool heapkeyspace, bool readonly, bool heapallindexed,
145  bool rootdescend);
147  BtreeLevel level);
149  BlockNumber btpo_prev_from_target,
150  BlockNumber leftcurrent);
153 static void bt_child_check(BtreeCheckState *state, BTScanInsert targetkey,
154  OffsetNumber downlinkoffnum);
156  OffsetNumber target_downlinkoffnum,
157  Page loaded_child,
158  uint32 target_level);
159 static void bt_downlink_missing_check(BtreeCheckState *state, bool rightsplit,
162  Datum *values, bool *isnull,
163  bool tupleIsAlive, void *checkstate);
165  IndexTuple itup);
166 static inline IndexTuple bt_posting_plain_tuple(IndexTuple itup, int n);
167 static bool bt_rootdescend(BtreeCheckState *state, IndexTuple itup);
168 static inline bool offset_is_negative_infinity(BTPageOpaque opaque,
169  OffsetNumber offset);
171  OffsetNumber upperbound);
172 static inline bool invariant_leq_offset(BtreeCheckState *state,
174  OffsetNumber upperbound);
176  OffsetNumber lowerbound);
179  BlockNumber nontargetblock,
180  Page nontarget,
181  OffsetNumber upperbound);
184  IndexTuple itup);
186  Page page, OffsetNumber offset);
188  IndexTuple itup, bool nonpivot);
190 
191 /*
192  * bt_index_check(index regclass, heapallindexed boolean)
193  *
194  * Verify integrity of B-Tree index.
195  *
196  * Acquires AccessShareLock on heap & index relations. Does not consider
197  * invariants that exist between parent/child pages. Optionally verifies
198  * that heap does not contain any unindexed or incorrectly indexed tuples.
199  */
200 Datum
202 {
203  Oid indrelid = PG_GETARG_OID(0);
204  bool heapallindexed = false;
205 
206  if (PG_NARGS() == 2)
207  heapallindexed = PG_GETARG_BOOL(1);
208 
209  bt_index_check_internal(indrelid, false, heapallindexed, false);
210 
211  PG_RETURN_VOID();
212 }
213 
214 /*
215  * bt_index_parent_check(index regclass, heapallindexed boolean)
216  *
217  * Verify integrity of B-Tree index.
218  *
219  * Acquires ShareLock on heap & index relations. Verifies that downlinks in
220  * parent pages are valid lower bounds on child pages. Optionally verifies
221  * that heap does not contain any unindexed or incorrectly indexed tuples.
222  */
223 Datum
225 {
226  Oid indrelid = PG_GETARG_OID(0);
227  bool heapallindexed = false;
228  bool rootdescend = false;
229 
230  if (PG_NARGS() >= 2)
231  heapallindexed = PG_GETARG_BOOL(1);
232  if (PG_NARGS() == 3)
233  rootdescend = PG_GETARG_BOOL(2);
234 
235  bt_index_check_internal(indrelid, true, heapallindexed, rootdescend);
236 
237  PG_RETURN_VOID();
238 }
239 
240 /*
241  * Helper for bt_index_[parent_]check, coordinating the bulk of the work.
242  */
243 static void
244 bt_index_check_internal(Oid indrelid, bool parentcheck, bool heapallindexed,
245  bool rootdescend)
246 {
247  Oid heapid;
248  Relation indrel;
250  LOCKMODE lockmode;
251 
252  if (parentcheck)
253  lockmode = ShareLock;
254  else
255  lockmode = AccessShareLock;
256 
257  /*
258  * We must lock table before index to avoid deadlocks. However, if the
259  * passed indrelid isn't an index then IndexGetRelation() will fail.
260  * Rather than emitting a not-very-helpful error message, postpone
261  * complaining, expecting that the is-it-an-index test below will fail.
262  *
263  * In hot standby mode this will raise an error when parentcheck is true.
264  */
265  heapid = IndexGetRelation(indrelid, true);
266  if (OidIsValid(heapid))
267  heaprel = table_open(heapid, lockmode);
268  else
269  heaprel = NULL;
270 
271  /*
272  * Open the target index relations separately (like relation_openrv(), but
273  * with heap relation locked first to prevent deadlocking). In hot
274  * standby mode this will raise an error when parentcheck is true.
275  *
276  * There is no need for the usual indcheckxmin usability horizon test
277  * here, even in the heapallindexed case, because index undergoing
278  * verification only needs to have entries for a new transaction snapshot.
279  * (If this is a parentcheck verification, there is no question about
280  * committed or recently dead heap tuples lacking index entries due to
281  * concurrent activity.)
282  */
283  indrel = index_open(indrelid, lockmode);
284 
285  /*
286  * Since we did the IndexGetRelation call above without any lock, it's
287  * barely possible that a race against an index drop/recreation could have
288  * netted us the wrong table.
289  */
290  if (heaprel == NULL || heapid != IndexGetRelation(indrelid, false))
291  ereport(ERROR,
293  errmsg("could not open parent table of index \"%s\"",
294  RelationGetRelationName(indrel))));
295 
296  /* Relation suitable for checking as B-Tree? */
297  btree_index_checkable(indrel);
298 
299  if (btree_index_mainfork_expected(indrel))
300  {
301  bool heapkeyspace,
302  allequalimage;
303 
304  if (!smgrexists(RelationGetSmgr(indrel), MAIN_FORKNUM))
305  ereport(ERROR,
306  (errcode(ERRCODE_INDEX_CORRUPTED),
307  errmsg("index \"%s\" lacks a main relation fork",
308  RelationGetRelationName(indrel))));
309 
310  /* Extract metadata from metapage, and sanitize it in passing */
311  _bt_metaversion(indrel, &heapkeyspace, &allequalimage);
312  if (allequalimage && !heapkeyspace)
313  ereport(ERROR,
314  (errcode(ERRCODE_INDEX_CORRUPTED),
315  errmsg("index \"%s\" metapage has equalimage field set on unsupported nbtree version",
316  RelationGetRelationName(indrel))));
317  if (allequalimage && !_bt_allequalimage(indrel, false))
318  ereport(ERROR,
319  (errcode(ERRCODE_INDEX_CORRUPTED),
320  errmsg("index \"%s\" metapage incorrectly indicates that deduplication is safe",
321  RelationGetRelationName(indrel))));
322 
323  /* Check index, possibly against table it is an index on */
324  bt_check_every_level(indrel, heaprel, heapkeyspace, parentcheck,
325  heapallindexed, rootdescend);
326  }
327 
328  /*
329  * Release locks early. That's ok here because nothing in the called
330  * routines will trigger shared cache invalidations to be sent, so we can
331  * relax the usual pattern of only releasing locks after commit.
332  */
333  index_close(indrel, lockmode);
334  if (heaprel)
335  table_close(heaprel, lockmode);
336 }
337 
338 /*
339  * Basic checks about the suitability of a relation for checking as a B-Tree
340  * index.
341  *
342  * NB: Intentionally not checking permissions, the function is normally not
343  * callable by non-superusers. If granted, it's useful to be able to check a
344  * whole cluster.
345  */
346 static inline void
348 {
349  if (rel->rd_rel->relkind != RELKIND_INDEX ||
350  rel->rd_rel->relam != BTREE_AM_OID)
351  ereport(ERROR,
352  (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
353  errmsg("only B-Tree indexes are supported as targets for verification"),
354  errdetail("Relation \"%s\" is not a B-Tree index.",
355  RelationGetRelationName(rel))));
356 
357  if (RELATION_IS_OTHER_TEMP(rel))
358  ereport(ERROR,
359  (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
360  errmsg("cannot access temporary tables of other sessions"),
361  errdetail("Index \"%s\" is associated with temporary relation.",
362  RelationGetRelationName(rel))));
363 
364  if (!rel->rd_index->indisvalid)
365  ereport(ERROR,
366  (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
367  errmsg("cannot check index \"%s\"",
369  errdetail("Index is not valid.")));
370 }
371 
372 /*
373  * Check if B-Tree index relation should have a file for its main relation
374  * fork. Verification uses this to skip unlogged indexes when in hot standby
375  * mode, where there is simply nothing to verify.
376  *
377  * NB: Caller should call btree_index_checkable() before calling here.
378  */
379 static inline bool
381 {
382  if (rel->rd_rel->relpersistence != RELPERSISTENCE_UNLOGGED ||
384  return true;
385 
386  ereport(NOTICE,
387  (errcode(ERRCODE_READ_ONLY_SQL_TRANSACTION),
388  errmsg("cannot verify unlogged index \"%s\" during recovery, skipping",
389  RelationGetRelationName(rel))));
390 
391  return false;
392 }
393 
394 /*
395  * Main entry point for B-Tree SQL-callable functions. Walks the B-Tree in
396  * logical order, verifying invariants as it goes. Optionally, verification
397  * checks if the heap relation contains any tuples that are not represented in
398  * the index but should be.
399  *
400  * It is the caller's responsibility to acquire appropriate heavyweight lock on
401  * the index relation, and advise us if extra checks are safe when a ShareLock
402  * is held. (A lock of the same type must also have been acquired on the heap
403  * relation.)
404  *
405  * A ShareLock is generally assumed to prevent any kind of physical
406  * modification to the index structure, including modifications that VACUUM may
407  * make. This does not include setting of the LP_DEAD bit by concurrent index
408  * scans, although that is just metadata that is not able to directly affect
409  * any check performed here. Any concurrent process that might act on the
410  * LP_DEAD bit being set (recycle space) requires a heavyweight lock that
411  * cannot be held while we hold a ShareLock. (Besides, even if that could
412  * happen, the ad-hoc recycling when a page might otherwise split is performed
413  * per-page, and requires an exclusive buffer lock, which wouldn't cause us
414  * trouble. _bt_delitems_vacuum() may only delete leaf items, and so the extra
415  * parent/child check cannot be affected.)
416  */
417 static void
419  bool readonly, bool heapallindexed, bool rootdescend)
420 {
422  Page metapage;
423  BTMetaPageData *metad;
424  uint32 previouslevel;
425  BtreeLevel current;
426  Snapshot snapshot = SnapshotAny;
427 
428  if (!readonly)
429  elog(DEBUG1, "verifying consistency of tree structure for index \"%s\"",
431  else
432  elog(DEBUG1, "verifying consistency of tree structure for index \"%s\" with cross-level checks",
434 
435  /*
436  * This assertion matches the one in index_getnext_tid(). See page
437  * recycling/"visible to everyone" notes in nbtree README.
438  */
440 
441  /*
442  * Initialize state for entire verification operation
443  */
444  state = palloc0(sizeof(BtreeCheckState));
445  state->rel = rel;
446  state->heaprel = heaprel;
447  state->heapkeyspace = heapkeyspace;
448  state->readonly = readonly;
450  state->rootdescend = rootdescend;
451 
452  if (state->heapallindexed)
453  {
454  int64 total_pages;
455  int64 total_elems;
456  uint64 seed;
457 
458  /*
459  * Size Bloom filter based on estimated number of tuples in index,
460  * while conservatively assuming that each block must contain at least
461  * MaxTIDsPerBTreePage / 3 "plain" tuples -- see
462  * bt_posting_plain_tuple() for definition, and details of how posting
463  * list tuples are handled.
464  */
465  total_pages = RelationGetNumberOfBlocks(rel);
466  total_elems = Max(total_pages * (MaxTIDsPerBTreePage / 3),
467  (int64) state->rel->rd_rel->reltuples);
468  /* Random seed relies on backend srandom() call to avoid repetition */
469  seed = random();
470  /* Create Bloom filter to fingerprint index */
471  state->filter = bloom_create(total_elems, maintenance_work_mem, seed);
472  state->heaptuplespresent = 0;
473 
474  /*
475  * Register our own snapshot in !readonly case, rather than asking
476  * table_index_build_scan() to do this for us later. This needs to
477  * happen before index fingerprinting begins, so we can later be
478  * certain that index fingerprinting should have reached all tuples
479  * returned by table_index_build_scan().
480  */
481  if (!state->readonly)
482  {
484 
485  /*
486  * GetTransactionSnapshot() always acquires a new MVCC snapshot in
487  * READ COMMITTED mode. A new snapshot is guaranteed to have all
488  * the entries it requires in the index.
489  *
490  * We must defend against the possibility that an old xact
491  * snapshot was returned at higher isolation levels when that
492  * snapshot is not safe for index scans of the target index. This
493  * is possible when the snapshot sees tuples that are before the
494  * index's indcheckxmin horizon. Throwing an error here should be
495  * very rare. It doesn't seem worth using a secondary snapshot to
496  * avoid this.
497  */
498  if (IsolationUsesXactSnapshot() && rel->rd_index->indcheckxmin &&
500  snapshot->xmin))
501  ereport(ERROR,
502  (errcode(ERRCODE_T_R_SERIALIZATION_FAILURE),
503  errmsg("index \"%s\" cannot be verified using transaction snapshot",
504  RelationGetRelationName(rel))));
505  }
506  }
507 
508  Assert(!state->rootdescend || state->readonly);
509  if (state->rootdescend && !state->heapkeyspace)
510  ereport(ERROR,
511  (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
512  errmsg("cannot verify that tuples from index \"%s\" can each be found by an independent index search",
514  errhint("Only B-Tree version 4 indexes support rootdescend verification.")));
515 
516  /* Create context for page */
518  "amcheck context",
521 
522  /* Get true root block from meta-page */
523  metapage = palloc_btree_page(state, BTREE_METAPAGE);
524  metad = BTPageGetMeta(metapage);
525 
526  /*
527  * Certain deletion patterns can result in "skinny" B-Tree indexes, where
528  * the fast root and true root differ.
529  *
530  * Start from the true root, not the fast root, unlike conventional index
531  * scans. This approach is more thorough, and removes the risk of
532  * following a stale fast root from the meta page.
533  */
534  if (metad->btm_fastroot != metad->btm_root)
535  ereport(DEBUG1,
536  (errcode(ERRCODE_NO_DATA),
537  errmsg_internal("harmless fast root mismatch in index \"%s\"",
539  errdetail_internal("Fast root block %u (level %u) differs from true root block %u (level %u).",
540  metad->btm_fastroot, metad->btm_fastlevel,
541  metad->btm_root, metad->btm_level)));
542 
543  /*
544  * Starting at the root, verify every level. Move left to right, top to
545  * bottom. Note that there may be no pages other than the meta page (meta
546  * page can indicate that root is P_NONE when the index is totally empty).
547  */
548  previouslevel = InvalidBtreeLevel;
549  current.level = metad->btm_level;
550  current.leftmost = metad->btm_root;
551  current.istruerootlevel = true;
552  while (current.leftmost != P_NONE)
553  {
554  /*
555  * Verify this level, and get left most page for next level down, if
556  * not at leaf level
557  */
558  current = bt_check_level_from_leftmost(state, current);
559 
560  if (current.leftmost == InvalidBlockNumber)
561  ereport(ERROR,
562  (errcode(ERRCODE_INDEX_CORRUPTED),
563  errmsg("index \"%s\" has no valid pages on level below %u or first level",
564  RelationGetRelationName(rel), previouslevel)));
565 
566  previouslevel = current.level;
567  }
568 
569  /*
570  * * Check whether heap contains unindexed/malformed tuples *
571  */
572  if (state->heapallindexed)
573  {
574  IndexInfo *indexinfo = BuildIndexInfo(state->rel);
575  TableScanDesc scan;
576 
577  /*
578  * Create our own scan for table_index_build_scan(), rather than
579  * getting it to do so for us. This is required so that we can
580  * actually use the MVCC snapshot registered earlier in !readonly
581  * case.
582  *
583  * Note that table_index_build_scan() calls heap_endscan() for us.
584  */
585  scan = table_beginscan_strat(state->heaprel, /* relation */
586  snapshot, /* snapshot */
587  0, /* number of keys */
588  NULL, /* scan key */
589  true, /* buffer access strategy OK */
590  true); /* syncscan OK? */
591 
592  /*
593  * Scan will behave as the first scan of a CREATE INDEX CONCURRENTLY
594  * behaves in !readonly case.
595  *
596  * It's okay that we don't actually use the same lock strength for the
597  * heap relation as any other ii_Concurrent caller would in !readonly
598  * case. We have no reason to care about a concurrent VACUUM
599  * operation, since there isn't going to be a second scan of the heap
600  * that needs to be sure that there was no concurrent recycling of
601  * TIDs.
602  */
603  indexinfo->ii_Concurrent = !state->readonly;
604 
605  /*
606  * Don't wait for uncommitted tuple xact commit/abort when index is a
607  * unique index on a catalog (or an index used by an exclusion
608  * constraint). This could otherwise happen in the readonly case.
609  */
610  indexinfo->ii_Unique = false;
611  indexinfo->ii_ExclusionOps = NULL;
612  indexinfo->ii_ExclusionProcs = NULL;
613  indexinfo->ii_ExclusionStrats = NULL;
614 
615  elog(DEBUG1, "verifying that tuples from index \"%s\" are present in \"%s\"",
618 
619  table_index_build_scan(state->heaprel, state->rel, indexinfo, true, false,
620  bt_tuple_present_callback, (void *) state, scan);
621 
622  ereport(DEBUG1,
623  (errmsg_internal("finished verifying presence of " INT64_FORMAT " tuples from table \"%s\" with bitset %.2f%% set",
624  state->heaptuplespresent, RelationGetRelationName(heaprel),
625  100.0 * bloom_prop_bits_set(state->filter))));
626 
627  if (snapshot != SnapshotAny)
628  UnregisterSnapshot(snapshot);
629 
630  bloom_free(state->filter);
631  }
632 
633  /* Be tidy: */
635 }
636 
637 /*
638  * Given a left-most block at some level, move right, verifying each page
639  * individually (with more verification across pages for "readonly"
640  * callers). Caller should pass the true root page as the leftmost initially,
641  * working their way down by passing what is returned for the last call here
642  * until level 0 (leaf page level) was reached.
643  *
644  * Returns state for next call, if any. This includes left-most block number
645  * one level lower that should be passed on next level/call, which is set to
646  * P_NONE on last call here (when leaf level is verified). Level numbers
647  * follow the nbtree convention: higher levels have higher numbers, because new
648  * levels are added only due to a root page split. Note that prior to the
649  * first root page split, the root is also a leaf page, so there is always a
650  * level 0 (leaf level), and it's always the last level processed.
651  *
652  * Note on memory management: State's per-page context is reset here, between
653  * each call to bt_target_page_check().
654  */
655 static BtreeLevel
657 {
658  /* State to establish early, concerning entire level */
659  BTPageOpaque opaque;
660  MemoryContext oldcontext;
661  BtreeLevel nextleveldown;
662 
663  /* Variables for iterating across level using right links */
664  BlockNumber leftcurrent = P_NONE;
665  BlockNumber current = level.leftmost;
666 
667  /* Initialize return state */
668  nextleveldown.leftmost = InvalidBlockNumber;
669  nextleveldown.level = InvalidBtreeLevel;
670  nextleveldown.istruerootlevel = false;
671 
672  /* Use page-level context for duration of this call */
673  oldcontext = MemoryContextSwitchTo(state->targetcontext);
674 
675  elog(DEBUG1, "verifying level %u%s", level.level,
676  level.istruerootlevel ?
677  " (true root level)" : level.level == 0 ? " (leaf level)" : "");
678 
680  state->previncompletesplit = false;
681 
682  do
683  {
684  /* Don't rely on CHECK_FOR_INTERRUPTS() calls at lower level */
686 
687  /* Initialize state for this iteration */
688  state->targetblock = current;
689  state->target = palloc_btree_page(state, state->targetblock);
690  state->targetlsn = PageGetLSN(state->target);
691 
692  opaque = (BTPageOpaque) PageGetSpecialPointer(state->target);
693 
694  if (P_IGNORE(opaque))
695  {
696  /*
697  * Since there cannot be a concurrent VACUUM operation in readonly
698  * mode, and since a page has no links within other pages
699  * (siblings and parent) once it is marked fully deleted, it
700  * should be impossible to land on a fully deleted page in
701  * readonly mode. See bt_child_check() for further details.
702  *
703  * The bt_child_check() P_ISDELETED() check is repeated here so
704  * that pages that are only reachable through sibling links get
705  * checked.
706  */
707  if (state->readonly && P_ISDELETED(opaque))
708  ereport(ERROR,
709  (errcode(ERRCODE_INDEX_CORRUPTED),
710  errmsg("downlink or sibling link points to deleted block in index \"%s\"",
711  RelationGetRelationName(state->rel)),
712  errdetail_internal("Block=%u left block=%u left link from block=%u.",
713  current, leftcurrent, opaque->btpo_prev)));
714 
715  if (P_RIGHTMOST(opaque))
716  ereport(ERROR,
717  (errcode(ERRCODE_INDEX_CORRUPTED),
718  errmsg("block %u fell off the end of index \"%s\"",
719  current, RelationGetRelationName(state->rel))));
720  else
721  ereport(DEBUG1,
722  (errcode(ERRCODE_NO_DATA),
723  errmsg_internal("block %u of index \"%s\" concurrently deleted",
724  current, RelationGetRelationName(state->rel))));
725  goto nextpage;
726  }
727  else if (nextleveldown.leftmost == InvalidBlockNumber)
728  {
729  /*
730  * A concurrent page split could make the caller supplied leftmost
731  * block no longer contain the leftmost page, or no longer be the
732  * true root, but where that isn't possible due to heavyweight
733  * locking, check that the first valid page meets caller's
734  * expectations.
735  */
736  if (state->readonly)
737  {
738  if (!P_LEFTMOST(opaque))
739  ereport(ERROR,
740  (errcode(ERRCODE_INDEX_CORRUPTED),
741  errmsg("block %u is not leftmost in index \"%s\"",
742  current, RelationGetRelationName(state->rel))));
743 
744  if (level.istruerootlevel && !P_ISROOT(opaque))
745  ereport(ERROR,
746  (errcode(ERRCODE_INDEX_CORRUPTED),
747  errmsg("block %u is not true root in index \"%s\"",
748  current, RelationGetRelationName(state->rel))));
749  }
750 
751  /*
752  * Before beginning any non-trivial examination of level, prepare
753  * state for next bt_check_level_from_leftmost() invocation for
754  * the next level for the next level down (if any).
755  *
756  * There should be at least one non-ignorable page per level,
757  * unless this is the leaf level, which is assumed by caller to be
758  * final level.
759  */
760  if (!P_ISLEAF(opaque))
761  {
762  IndexTuple itup;
763  ItemId itemid;
764 
765  /* Internal page -- downlink gets leftmost on next level */
766  itemid = PageGetItemIdCareful(state, state->targetblock,
767  state->target,
768  P_FIRSTDATAKEY(opaque));
769  itup = (IndexTuple) PageGetItem(state->target, itemid);
770  nextleveldown.leftmost = BTreeTupleGetDownLink(itup);
771  nextleveldown.level = opaque->btpo_level - 1;
772  }
773  else
774  {
775  /*
776  * Leaf page -- final level caller must process.
777  *
778  * Note that this could also be the root page, if there has
779  * been no root page split yet.
780  */
781  nextleveldown.leftmost = P_NONE;
782  nextleveldown.level = InvalidBtreeLevel;
783  }
784 
785  /*
786  * Finished setting up state for this call/level. Control will
787  * never end up back here in any future loop iteration for this
788  * level.
789  */
790  }
791 
792  /* Sibling links should be in mutual agreement */
793  if (opaque->btpo_prev != leftcurrent)
794  bt_recheck_sibling_links(state, opaque->btpo_prev, leftcurrent);
795 
796  /* Check level */
797  if (level.level != opaque->btpo_level)
798  ereport(ERROR,
799  (errcode(ERRCODE_INDEX_CORRUPTED),
800  errmsg("leftmost down link for level points to block in index \"%s\" whose level is not one level down",
801  RelationGetRelationName(state->rel)),
802  errdetail_internal("Block pointed to=%u expected level=%u level in pointed to block=%u.",
803  current, level.level, opaque->btpo_level)));
804 
805  /* Verify invariants for page */
806  bt_target_page_check(state);
807 
808 nextpage:
809 
810  /* Try to detect circular links */
811  if (current == leftcurrent || current == opaque->btpo_prev)
812  ereport(ERROR,
813  (errcode(ERRCODE_INDEX_CORRUPTED),
814  errmsg("circular link chain found in block %u of index \"%s\"",
815  current, RelationGetRelationName(state->rel))));
816 
817  leftcurrent = current;
818  current = opaque->btpo_next;
819 
820  if (state->lowkey)
821  {
822  Assert(state->readonly);
823  pfree(state->lowkey);
824  state->lowkey = NULL;
825  }
826 
827  /*
828  * Copy current target high key as the low key of right sibling.
829  * Allocate memory in upper level context, so it would be cleared
830  * after reset of target context.
831  *
832  * We only need the low key in corner cases of checking child high
833  * keys. We use high key only when incomplete split on the child level
834  * falls to the boundary of pages on the target level. See
835  * bt_child_highkey_check() for details. So, typically we won't end
836  * up doing anything with low key, but it's simpler for general case
837  * high key verification to always have it available.
838  *
839  * The correctness of managing low key in the case of concurrent
840  * splits wasn't investigated yet. Thankfully we only need low key
841  * for readonly verification and concurrent splits won't happen.
842  */
843  if (state->readonly && !P_RIGHTMOST(opaque))
844  {
845  IndexTuple itup;
846  ItemId itemid;
847 
848  itemid = PageGetItemIdCareful(state, state->targetblock,
849  state->target, P_HIKEY);
850  itup = (IndexTuple) PageGetItem(state->target, itemid);
851 
852  state->lowkey = MemoryContextAlloc(oldcontext, IndexTupleSize(itup));
853  memcpy(state->lowkey, itup, IndexTupleSize(itup));
854  }
855 
856  /* Free page and associated memory for this iteration */
858  }
859  while (current != P_NONE);
860 
861  if (state->lowkey)
862  {
863  Assert(state->readonly);
864  pfree(state->lowkey);
865  state->lowkey = NULL;
866  }
867 
868  /* Don't change context for caller */
869  MemoryContextSwitchTo(oldcontext);
870 
871  return nextleveldown;
872 }
873 
874 /*
875  * Raise an error when target page's left link does not point back to the
876  * previous target page, called leftcurrent here. The leftcurrent page's
877  * right link was followed to get to the current target page, and we expect
878  * mutual agreement among leftcurrent and the current target page. Make sure
879  * that this condition has definitely been violated in the !readonly case,
880  * where concurrent page splits are something that we need to deal with.
881  *
882  * Cross-page inconsistencies involving pages that don't agree about being
883  * siblings are known to be a particularly good indicator of corruption
884  * involving partial writes/lost updates. The bt_right_page_check_scankey
885  * check also provides a way of detecting cross-page inconsistencies for
886  * !readonly callers, but it can only detect sibling pages that have an
887  * out-of-order keyspace, which can't catch many of the problems that we
888  * expect to catch here.
889  *
890  * The classic example of the kind of inconsistency that we can only catch
891  * with this check (when in !readonly mode) involves three sibling pages that
892  * were affected by a faulty page split at some point in the past. The
893  * effects of the split are reflected in the original page and its new right
894  * sibling page, with a lack of any accompanying changes for the _original_
895  * right sibling page. The original right sibling page's left link fails to
896  * point to the new right sibling page (its left link still points to the
897  * original page), even though the first phase of a page split is supposed to
898  * work as a single atomic action. This subtle inconsistency will probably
899  * only break backwards scans in practice.
900  *
901  * Note that this is the only place where amcheck will "couple" buffer locks
902  * (and only for !readonly callers). In general we prefer to avoid more
903  * thorough cross-page checks in !readonly mode, but it seems worth the
904  * complexity here. Also, the performance overhead of performing lock
905  * coupling here is negligible in practice. Control only reaches here with a
906  * non-corrupt index when there is a concurrent page split at the instant
907  * caller crossed over to target page from leftcurrent page.
908  */
909 static void
911  BlockNumber btpo_prev_from_target,
912  BlockNumber leftcurrent)
913 {
914  if (!state->readonly)
915  {
916  Buffer lbuf;
917  Buffer newtargetbuf;
918  Page page;
919  BTPageOpaque opaque;
920  BlockNumber newtargetblock;
921 
922  /* Couple locks in the usual order for nbtree: Left to right */
923  lbuf = ReadBufferExtended(state->rel, MAIN_FORKNUM, leftcurrent,
924  RBM_NORMAL, state->checkstrategy);
925  LockBuffer(lbuf, BT_READ);
926  _bt_checkpage(state->rel, lbuf);
927  page = BufferGetPage(lbuf);
928  opaque = (BTPageOpaque) PageGetSpecialPointer(page);
929  if (P_ISDELETED(opaque))
930  {
931  /*
932  * Cannot reason about concurrently deleted page -- the left link
933  * in the page to the right is expected to point to some other
934  * page to the left (not leftcurrent page).
935  *
936  * Note that we deliberately don't give up with a half-dead page.
937  */
938  UnlockReleaseBuffer(lbuf);
939  return;
940  }
941 
942  newtargetblock = opaque->btpo_next;
943  /* Avoid self-deadlock when newtargetblock == leftcurrent */
944  if (newtargetblock != leftcurrent)
945  {
946  newtargetbuf = ReadBufferExtended(state->rel, MAIN_FORKNUM,
947  newtargetblock, RBM_NORMAL,
948  state->checkstrategy);
949  LockBuffer(newtargetbuf, BT_READ);
950  _bt_checkpage(state->rel, newtargetbuf);
951  page = BufferGetPage(newtargetbuf);
952  opaque = (BTPageOpaque) PageGetSpecialPointer(page);
953  /* btpo_prev_from_target may have changed; update it */
954  btpo_prev_from_target = opaque->btpo_prev;
955  }
956  else
957  {
958  /*
959  * leftcurrent right sibling points back to leftcurrent block.
960  * Index is corrupt. Easiest way to handle this is to pretend
961  * that we actually read from a distinct page that has an invalid
962  * block number in its btpo_prev.
963  */
964  newtargetbuf = InvalidBuffer;
965  btpo_prev_from_target = InvalidBlockNumber;
966  }
967 
968  /*
969  * No need to check P_ISDELETED here, since new target block cannot be
970  * marked deleted as long as we hold a lock on lbuf
971  */
972  if (BufferIsValid(newtargetbuf))
973  UnlockReleaseBuffer(newtargetbuf);
974  UnlockReleaseBuffer(lbuf);
975 
976  if (btpo_prev_from_target == leftcurrent)
977  {
978  /* Report split in left sibling, not target (or new target) */
979  ereport(DEBUG1,
980  (errcode(ERRCODE_INTERNAL_ERROR),
981  errmsg_internal("harmless concurrent page split detected in index \"%s\"",
982  RelationGetRelationName(state->rel)),
983  errdetail_internal("Block=%u new right sibling=%u original right sibling=%u.",
984  leftcurrent, newtargetblock,
985  state->targetblock)));
986  return;
987  }
988 
989  /*
990  * Index is corrupt. Make sure that we report correct target page.
991  *
992  * This could have changed in cases where there was a concurrent page
993  * split, as well as index corruption (at least in theory). Note that
994  * btpo_prev_from_target was already updated above.
995  */
996  state->targetblock = newtargetblock;
997  }
998 
999  ereport(ERROR,
1000  (errcode(ERRCODE_INDEX_CORRUPTED),
1001  errmsg("left link/right link pair in index \"%s\" not in agreement",
1002  RelationGetRelationName(state->rel)),
1003  errdetail_internal("Block=%u left block=%u left link from block=%u.",
1004  state->targetblock, leftcurrent,
1005  btpo_prev_from_target)));
1006 }
1007 
1008 /*
1009  * Function performs the following checks on target page, or pages ancillary to
1010  * target page:
1011  *
1012  * - That every "real" data item is less than or equal to the high key, which
1013  * is an upper bound on the items on the page. Data items should be
1014  * strictly less than the high key when the page is an internal page.
1015  *
1016  * - That within the page, every data item is strictly less than the item
1017  * immediately to its right, if any (i.e., that the items are in order
1018  * within the page, so that the binary searches performed by index scans are
1019  * sane).
1020  *
1021  * - That the last data item stored on the page is strictly less than the
1022  * first data item on the page to the right (when such a first item is
1023  * available).
1024  *
1025  * - Various checks on the structure of tuples themselves. For example, check
1026  * that non-pivot tuples have no truncated attributes.
1027  *
1028  * Furthermore, when state passed shows ShareLock held, function also checks:
1029  *
1030  * - That all child pages respect strict lower bound from parent's pivot
1031  * tuple.
1032  *
1033  * - That downlink to block was encountered in parent where that's expected.
1034  *
1035  * - That high keys of child pages matches corresponding pivot keys in parent.
1036  *
1037  * This is also where heapallindexed callers use their Bloom filter to
1038  * fingerprint IndexTuples for later table_index_build_scan() verification.
1039  *
1040  * Note: Memory allocated in this routine is expected to be released by caller
1041  * resetting state->targetcontext.
1042  */
1043 static void
1045 {
1046  OffsetNumber offset;
1047  OffsetNumber max;
1048  BTPageOpaque topaque;
1049 
1050  topaque = (BTPageOpaque) PageGetSpecialPointer(state->target);
1051  max = PageGetMaxOffsetNumber(state->target);
1052 
1053  elog(DEBUG2, "verifying %u items on %s block %u", max,
1054  P_ISLEAF(topaque) ? "leaf" : "internal", state->targetblock);
1055 
1056  /*
1057  * Check the number of attributes in high key. Note, rightmost page
1058  * doesn't contain a high key, so nothing to check
1059  */
1060  if (!P_RIGHTMOST(topaque))
1061  {
1062  ItemId itemid;
1063  IndexTuple itup;
1064 
1065  /* Verify line pointer before checking tuple */
1066  itemid = PageGetItemIdCareful(state, state->targetblock,
1067  state->target, P_HIKEY);
1068  if (!_bt_check_natts(state->rel, state->heapkeyspace, state->target,
1069  P_HIKEY))
1070  {
1071  itup = (IndexTuple) PageGetItem(state->target, itemid);
1072  ereport(ERROR,
1073  (errcode(ERRCODE_INDEX_CORRUPTED),
1074  errmsg("wrong number of high key index tuple attributes in index \"%s\"",
1075  RelationGetRelationName(state->rel)),
1076  errdetail_internal("Index block=%u natts=%u block type=%s page lsn=%X/%X.",
1077  state->targetblock,
1078  BTreeTupleGetNAtts(itup, state->rel),
1079  P_ISLEAF(topaque) ? "heap" : "index",
1080  LSN_FORMAT_ARGS(state->targetlsn))));
1081  }
1082  }
1083 
1084  /*
1085  * Loop over page items, starting from first non-highkey item, not high
1086  * key (if any). Most tests are not performed for the "negative infinity"
1087  * real item (if any).
1088  */
1089  for (offset = P_FIRSTDATAKEY(topaque);
1090  offset <= max;
1091  offset = OffsetNumberNext(offset))
1092  {
1093  ItemId itemid;
1094  IndexTuple itup;
1095  size_t tupsize;
1096  BTScanInsert skey;
1097  bool lowersizelimit;
1098  ItemPointer scantid;
1099 
1101 
1102  itemid = PageGetItemIdCareful(state, state->targetblock,
1103  state->target, offset);
1104  itup = (IndexTuple) PageGetItem(state->target, itemid);
1105  tupsize = IndexTupleSize(itup);
1106 
1107  /*
1108  * lp_len should match the IndexTuple reported length exactly, since
1109  * lp_len is completely redundant in indexes, and both sources of
1110  * tuple length are MAXALIGN()'d. nbtree does not use lp_len all that
1111  * frequently, and is surprisingly tolerant of corrupt lp_len fields.
1112  */
1113  if (tupsize != ItemIdGetLength(itemid))
1114  ereport(ERROR,
1115  (errcode(ERRCODE_INDEX_CORRUPTED),
1116  errmsg("index tuple size does not equal lp_len in index \"%s\"",
1117  RelationGetRelationName(state->rel)),
1118  errdetail_internal("Index tid=(%u,%u) tuple size=%zu lp_len=%u page lsn=%X/%X.",
1119  state->targetblock, offset,
1120  tupsize, ItemIdGetLength(itemid),
1121  LSN_FORMAT_ARGS(state->targetlsn)),
1122  errhint("This could be a torn page problem.")));
1123 
1124  /* Check the number of index tuple attributes */
1125  if (!_bt_check_natts(state->rel, state->heapkeyspace, state->target,
1126  offset))
1127  {
1128  ItemPointer tid;
1129  char *itid,
1130  *htid;
1131 
1132  itid = psprintf("(%u,%u)", state->targetblock, offset);
1133  tid = BTreeTupleGetPointsToTID(itup);
1134  htid = psprintf("(%u,%u)",
1137 
1138  ereport(ERROR,
1139  (errcode(ERRCODE_INDEX_CORRUPTED),
1140  errmsg("wrong number of index tuple attributes in index \"%s\"",
1141  RelationGetRelationName(state->rel)),
1142  errdetail_internal("Index tid=%s natts=%u points to %s tid=%s page lsn=%X/%X.",
1143  itid,
1144  BTreeTupleGetNAtts(itup, state->rel),
1145  P_ISLEAF(topaque) ? "heap" : "index",
1146  htid,
1147  LSN_FORMAT_ARGS(state->targetlsn))));
1148  }
1149 
1150  /*
1151  * Don't try to generate scankey using "negative infinity" item on
1152  * internal pages. They are always truncated to zero attributes.
1153  */
1154  if (offset_is_negative_infinity(topaque, offset))
1155  {
1156  /*
1157  * We don't call bt_child_check() for "negative infinity" items.
1158  * But if we're performing downlink connectivity check, we do it
1159  * for every item including "negative infinity" one.
1160  */
1161  if (!P_ISLEAF(topaque) && state->readonly)
1162  {
1163  bt_child_highkey_check(state,
1164  offset,
1165  NULL,
1166  topaque->btpo_level);
1167  }
1168  continue;
1169  }
1170 
1171  /*
1172  * Readonly callers may optionally verify that non-pivot tuples can
1173  * each be found by an independent search that starts from the root.
1174  * Note that we deliberately don't do individual searches for each
1175  * TID, since the posting list itself is validated by other checks.
1176  */
1177  if (state->rootdescend && P_ISLEAF(topaque) &&
1178  !bt_rootdescend(state, itup))
1179  {
1181  char *itid,
1182  *htid;
1183 
1184  itid = psprintf("(%u,%u)", state->targetblock, offset);
1185  htid = psprintf("(%u,%u)", ItemPointerGetBlockNumber(tid),
1187 
1188  ereport(ERROR,
1189  (errcode(ERRCODE_INDEX_CORRUPTED),
1190  errmsg("could not find tuple using search from root page in index \"%s\"",
1191  RelationGetRelationName(state->rel)),
1192  errdetail_internal("Index tid=%s points to heap tid=%s page lsn=%X/%X.",
1193  itid, htid,
1194  LSN_FORMAT_ARGS(state->targetlsn))));
1195  }
1196 
1197  /*
1198  * If tuple is a posting list tuple, make sure posting list TIDs are
1199  * in order
1200  */
1201  if (BTreeTupleIsPosting(itup))
1202  {
1203  ItemPointerData last;
1204  ItemPointer current;
1205 
1206  ItemPointerCopy(BTreeTupleGetHeapTID(itup), &last);
1207 
1208  for (int i = 1; i < BTreeTupleGetNPosting(itup); i++)
1209  {
1210 
1211  current = BTreeTupleGetPostingN(itup, i);
1212 
1213  if (ItemPointerCompare(current, &last) <= 0)
1214  {
1215  char *itid = psprintf("(%u,%u)", state->targetblock, offset);
1216 
1217  ereport(ERROR,
1218  (errcode(ERRCODE_INDEX_CORRUPTED),
1219  errmsg_internal("posting list contains misplaced TID in index \"%s\"",
1220  RelationGetRelationName(state->rel)),
1221  errdetail_internal("Index tid=%s posting list offset=%d page lsn=%X/%X.",
1222  itid, i,
1223  LSN_FORMAT_ARGS(state->targetlsn))));
1224  }
1225 
1226  ItemPointerCopy(current, &last);
1227  }
1228  }
1229 
1230  /* Build insertion scankey for current page offset */
1231  skey = bt_mkscankey_pivotsearch(state->rel, itup);
1232 
1233  /*
1234  * Make sure tuple size does not exceed the relevant BTREE_VERSION
1235  * specific limit.
1236  *
1237  * BTREE_VERSION 4 (which introduced heapkeyspace rules) requisitioned
1238  * a small amount of space from BTMaxItemSize() in order to ensure
1239  * that suffix truncation always has enough space to add an explicit
1240  * heap TID back to a tuple -- we pessimistically assume that every
1241  * newly inserted tuple will eventually need to have a heap TID
1242  * appended during a future leaf page split, when the tuple becomes
1243  * the basis of the new high key (pivot tuple) for the leaf page.
1244  *
1245  * Since the reclaimed space is reserved for that purpose, we must not
1246  * enforce the slightly lower limit when the extra space has been used
1247  * as intended. In other words, there is only a cross-version
1248  * difference in the limit on tuple size within leaf pages.
1249  *
1250  * Still, we're particular about the details within BTREE_VERSION 4
1251  * internal pages. Pivot tuples may only use the extra space for its
1252  * designated purpose. Enforce the lower limit for pivot tuples when
1253  * an explicit heap TID isn't actually present. (In all other cases
1254  * suffix truncation is guaranteed to generate a pivot tuple that's no
1255  * larger than the firstright tuple provided to it by its caller.)
1256  */
1257  lowersizelimit = skey->heapkeyspace &&
1258  (P_ISLEAF(topaque) || BTreeTupleGetHeapTID(itup) == NULL);
1259  if (tupsize > (lowersizelimit ? BTMaxItemSize(state->target) :
1260  BTMaxItemSizeNoHeapTid(state->target)))
1261  {
1263  char *itid,
1264  *htid;
1265 
1266  itid = psprintf("(%u,%u)", state->targetblock, offset);
1267  htid = psprintf("(%u,%u)",
1270 
1271  ereport(ERROR,
1272  (errcode(ERRCODE_INDEX_CORRUPTED),
1273  errmsg("index row size %zu exceeds maximum for index \"%s\"",
1274  tupsize, RelationGetRelationName(state->rel)),
1275  errdetail_internal("Index tid=%s points to %s tid=%s page lsn=%X/%X.",
1276  itid,
1277  P_ISLEAF(topaque) ? "heap" : "index",
1278  htid,
1279  LSN_FORMAT_ARGS(state->targetlsn))));
1280  }
1281 
1282  /* Fingerprint leaf page tuples (those that point to the heap) */
1283  if (state->heapallindexed && P_ISLEAF(topaque) && !ItemIdIsDead(itemid))
1284  {
1285  IndexTuple norm;
1286 
1287  if (BTreeTupleIsPosting(itup))
1288  {
1289  /* Fingerprint all elements as distinct "plain" tuples */
1290  for (int i = 0; i < BTreeTupleGetNPosting(itup); i++)
1291  {
1292  IndexTuple logtuple;
1293 
1294  logtuple = bt_posting_plain_tuple(itup, i);
1295  norm = bt_normalize_tuple(state, logtuple);
1296  bloom_add_element(state->filter, (unsigned char *) norm,
1297  IndexTupleSize(norm));
1298  /* Be tidy */
1299  if (norm != logtuple)
1300  pfree(norm);
1301  pfree(logtuple);
1302  }
1303  }
1304  else
1305  {
1306  norm = bt_normalize_tuple(state, itup);
1307  bloom_add_element(state->filter, (unsigned char *) norm,
1308  IndexTupleSize(norm));
1309  /* Be tidy */
1310  if (norm != itup)
1311  pfree(norm);
1312  }
1313  }
1314 
1315  /*
1316  * * High key check *
1317  *
1318  * If there is a high key (if this is not the rightmost page on its
1319  * entire level), check that high key actually is upper bound on all
1320  * page items. If this is a posting list tuple, we'll need to set
1321  * scantid to be highest TID in posting list.
1322  *
1323  * We prefer to check all items against high key rather than checking
1324  * just the last and trusting that the operator class obeys the
1325  * transitive law (which implies that all previous items also
1326  * respected the high key invariant if they pass the item order
1327  * check).
1328  *
1329  * Ideally, we'd compare every item in the index against every other
1330  * item in the index, and not trust opclass obedience of the
1331  * transitive law to bridge the gap between children and their
1332  * grandparents (as well as great-grandparents, and so on). We don't
1333  * go to those lengths because that would be prohibitively expensive,
1334  * and probably not markedly more effective in practice.
1335  *
1336  * On the leaf level, we check that the key is <= the highkey.
1337  * However, on non-leaf levels we check that the key is < the highkey,
1338  * because the high key is "just another separator" rather than a copy
1339  * of some existing key item; we expect it to be unique among all keys
1340  * on the same level. (Suffix truncation will sometimes produce a
1341  * leaf highkey that is an untruncated copy of the lastleft item, but
1342  * never any other item, which necessitates weakening the leaf level
1343  * check to <=.)
1344  *
1345  * Full explanation for why a highkey is never truly a copy of another
1346  * item from the same level on internal levels:
1347  *
1348  * While the new left page's high key is copied from the first offset
1349  * on the right page during an internal page split, that's not the
1350  * full story. In effect, internal pages are split in the middle of
1351  * the firstright tuple, not between the would-be lastleft and
1352  * firstright tuples: the firstright key ends up on the left side as
1353  * left's new highkey, and the firstright downlink ends up on the
1354  * right side as right's new "negative infinity" item. The negative
1355  * infinity tuple is truncated to zero attributes, so we're only left
1356  * with the downlink. In other words, the copying is just an
1357  * implementation detail of splitting in the middle of a (pivot)
1358  * tuple. (See also: "Notes About Data Representation" in the nbtree
1359  * README.)
1360  */
1361  scantid = skey->scantid;
1362  if (state->heapkeyspace && BTreeTupleIsPosting(itup))
1363  skey->scantid = BTreeTupleGetMaxHeapTID(itup);
1364 
1365  if (!P_RIGHTMOST(topaque) &&
1366  !(P_ISLEAF(topaque) ? invariant_leq_offset(state, skey, P_HIKEY) :
1367  invariant_l_offset(state, skey, P_HIKEY)))
1368  {
1370  char *itid,
1371  *htid;
1372 
1373  itid = psprintf("(%u,%u)", state->targetblock, offset);
1374  htid = psprintf("(%u,%u)",
1377 
1378  ereport(ERROR,
1379  (errcode(ERRCODE_INDEX_CORRUPTED),
1380  errmsg("high key invariant violated for index \"%s\"",
1381  RelationGetRelationName(state->rel)),
1382  errdetail_internal("Index tid=%s points to %s tid=%s page lsn=%X/%X.",
1383  itid,
1384  P_ISLEAF(topaque) ? "heap" : "index",
1385  htid,
1386  LSN_FORMAT_ARGS(state->targetlsn))));
1387  }
1388  /* Reset, in case scantid was set to (itup) posting tuple's max TID */
1389  skey->scantid = scantid;
1390 
1391  /*
1392  * * Item order check *
1393  *
1394  * Check that items are stored on page in logical order, by checking
1395  * current item is strictly less than next item (if any).
1396  */
1397  if (OffsetNumberNext(offset) <= max &&
1398  !invariant_l_offset(state, skey, OffsetNumberNext(offset)))
1399  {
1400  ItemPointer tid;
1401  char *itid,
1402  *htid,
1403  *nitid,
1404  *nhtid;
1405 
1406  itid = psprintf("(%u,%u)", state->targetblock, offset);
1407  tid = BTreeTupleGetPointsToTID(itup);
1408  htid = psprintf("(%u,%u)",
1411  nitid = psprintf("(%u,%u)", state->targetblock,
1412  OffsetNumberNext(offset));
1413 
1414  /* Reuse itup to get pointed-to heap location of second item */
1415  itemid = PageGetItemIdCareful(state, state->targetblock,
1416  state->target,
1417  OffsetNumberNext(offset));
1418  itup = (IndexTuple) PageGetItem(state->target, itemid);
1419  tid = BTreeTupleGetPointsToTID(itup);
1420  nhtid = psprintf("(%u,%u)",
1423 
1424  ereport(ERROR,
1425  (errcode(ERRCODE_INDEX_CORRUPTED),
1426  errmsg("item order invariant violated for index \"%s\"",
1427  RelationGetRelationName(state->rel)),
1428  errdetail_internal("Lower index tid=%s (points to %s tid=%s) "
1429  "higher index tid=%s (points to %s tid=%s) "
1430  "page lsn=%X/%X.",
1431  itid,
1432  P_ISLEAF(topaque) ? "heap" : "index",
1433  htid,
1434  nitid,
1435  P_ISLEAF(topaque) ? "heap" : "index",
1436  nhtid,
1437  LSN_FORMAT_ARGS(state->targetlsn))));
1438  }
1439 
1440  /*
1441  * * Last item check *
1442  *
1443  * Check last item against next/right page's first data item's when
1444  * last item on page is reached. This additional check will detect
1445  * transposed pages iff the supposed right sibling page happens to
1446  * belong before target in the key space. (Otherwise, a subsequent
1447  * heap verification will probably detect the problem.)
1448  *
1449  * This check is similar to the item order check that will have
1450  * already been performed for every other "real" item on target page
1451  * when last item is checked. The difference is that the next item
1452  * (the item that is compared to target's last item) needs to come
1453  * from the next/sibling page. There may not be such an item
1454  * available from sibling for various reasons, though (e.g., target is
1455  * the rightmost page on level).
1456  */
1457  else if (offset == max)
1458  {
1459  BTScanInsert rightkey;
1460 
1461  /* Get item in next/right page */
1462  rightkey = bt_right_page_check_scankey(state);
1463 
1464  if (rightkey &&
1465  !invariant_g_offset(state, rightkey, max))
1466  {
1467  /*
1468  * As explained at length in bt_right_page_check_scankey(),
1469  * there is a known !readonly race that could account for
1470  * apparent violation of invariant, which we must check for
1471  * before actually proceeding with raising error. Our canary
1472  * condition is that target page was deleted.
1473  */
1474  if (!state->readonly)
1475  {
1476  /* Get fresh copy of target page */
1477  state->target = palloc_btree_page(state, state->targetblock);
1478  /* Note that we deliberately do not update target LSN */
1479  topaque = (BTPageOpaque) PageGetSpecialPointer(state->target);
1480 
1481  /*
1482  * All !readonly checks now performed; just return
1483  */
1484  if (P_IGNORE(topaque))
1485  return;
1486  }
1487 
1488  ereport(ERROR,
1489  (errcode(ERRCODE_INDEX_CORRUPTED),
1490  errmsg("cross page item order invariant violated for index \"%s\"",
1491  RelationGetRelationName(state->rel)),
1492  errdetail_internal("Last item on page tid=(%u,%u) page lsn=%X/%X.",
1493  state->targetblock, offset,
1494  LSN_FORMAT_ARGS(state->targetlsn))));
1495  }
1496  }
1497 
1498  /*
1499  * * Downlink check *
1500  *
1501  * Additional check of child items iff this is an internal page and
1502  * caller holds a ShareLock. This happens for every downlink (item)
1503  * in target excluding the negative-infinity downlink (again, this is
1504  * because it has no useful value to compare).
1505  */
1506  if (!P_ISLEAF(topaque) && state->readonly)
1507  bt_child_check(state, skey, offset);
1508  }
1509 
1510  /*
1511  * Special case bt_child_highkey_check() call
1512  *
1513  * We don't pass an real downlink, but we've to finish the level
1514  * processing. If condition is satisfied, we've already processed all the
1515  * downlinks from the target level. But there still might be pages to the
1516  * right of the child page pointer to by our rightmost downlink. And they
1517  * might have missing downlinks. This final call checks for them.
1518  */
1519  if (!P_ISLEAF(topaque) && P_RIGHTMOST(topaque) && state->readonly)
1520  {
1522  NULL, topaque->btpo_level);
1523  }
1524 }
1525 
1526 /*
1527  * Return a scankey for an item on page to right of current target (or the
1528  * first non-ignorable page), sufficient to check ordering invariant on last
1529  * item in current target page. Returned scankey relies on local memory
1530  * allocated for the child page, which caller cannot pfree(). Caller's memory
1531  * context should be reset between calls here.
1532  *
1533  * This is the first data item, and so all adjacent items are checked against
1534  * their immediate sibling item (which may be on a sibling page, or even a
1535  * "cousin" page at parent boundaries where target's rightlink points to page
1536  * with different parent page). If no such valid item is available, return
1537  * NULL instead.
1538  *
1539  * Note that !readonly callers must reverify that target page has not
1540  * been concurrently deleted.
1541  */
1542 static BTScanInsert
1544 {
1545  BTPageOpaque opaque;
1546  ItemId rightitem;
1547  IndexTuple firstitup;
1548  BlockNumber targetnext;
1549  Page rightpage;
1550  OffsetNumber nline;
1551 
1552  /* Determine target's next block number */
1553  opaque = (BTPageOpaque) PageGetSpecialPointer(state->target);
1554 
1555  /* If target is already rightmost, no right sibling; nothing to do here */
1556  if (P_RIGHTMOST(opaque))
1557  return NULL;
1558 
1559  /*
1560  * General notes on concurrent page splits and page deletion:
1561  *
1562  * Routines like _bt_search() don't require *any* page split interlock
1563  * when descending the tree, including something very light like a buffer
1564  * pin. That's why it's okay that we don't either. This avoidance of any
1565  * need to "couple" buffer locks is the raison d' etre of the Lehman & Yao
1566  * algorithm, in fact.
1567  *
1568  * That leaves deletion. A deleted page won't actually be recycled by
1569  * VACUUM early enough for us to fail to at least follow its right link
1570  * (or left link, or downlink) and find its sibling, because recycling
1571  * does not occur until no possible index scan could land on the page.
1572  * Index scans can follow links with nothing more than their snapshot as
1573  * an interlock and be sure of at least that much. (See page
1574  * recycling/"visible to everyone" notes in nbtree README.)
1575  *
1576  * Furthermore, it's okay if we follow a rightlink and find a half-dead or
1577  * dead (ignorable) page one or more times. There will either be a
1578  * further right link to follow that leads to a live page before too long
1579  * (before passing by parent's rightmost child), or we will find the end
1580  * of the entire level instead (possible when parent page is itself the
1581  * rightmost on its level).
1582  */
1583  targetnext = opaque->btpo_next;
1584  for (;;)
1585  {
1587 
1588  rightpage = palloc_btree_page(state, targetnext);
1589  opaque = (BTPageOpaque) PageGetSpecialPointer(rightpage);
1590 
1591  if (!P_IGNORE(opaque) || P_RIGHTMOST(opaque))
1592  break;
1593 
1594  /*
1595  * We landed on a deleted or half-dead sibling page. Step right until
1596  * we locate a live sibling page.
1597  */
1598  ereport(DEBUG2,
1599  (errcode(ERRCODE_NO_DATA),
1600  errmsg_internal("level %u sibling page in block %u of index \"%s\" was found deleted or half dead",
1601  opaque->btpo_level, targetnext, RelationGetRelationName(state->rel)),
1602  errdetail_internal("Deleted page found when building scankey from right sibling.")));
1603 
1604  targetnext = opaque->btpo_next;
1605 
1606  /* Be slightly more pro-active in freeing this memory, just in case */
1607  pfree(rightpage);
1608  }
1609 
1610  /*
1611  * No ShareLock held case -- why it's safe to proceed.
1612  *
1613  * Problem:
1614  *
1615  * We must avoid false positive reports of corruption when caller treats
1616  * item returned here as an upper bound on target's last item. In
1617  * general, false positives are disallowed. Avoiding them here when
1618  * caller is !readonly is subtle.
1619  *
1620  * A concurrent page deletion by VACUUM of the target page can result in
1621  * the insertion of items on to this right sibling page that would
1622  * previously have been inserted on our target page. There might have
1623  * been insertions that followed the target's downlink after it was made
1624  * to point to right sibling instead of target by page deletion's first
1625  * phase. The inserters insert items that would belong on target page.
1626  * This race is very tight, but it's possible. This is our only problem.
1627  *
1628  * Non-problems:
1629  *
1630  * We are not hindered by a concurrent page split of the target; we'll
1631  * never land on the second half of the page anyway. A concurrent split
1632  * of the right page will also not matter, because the first data item
1633  * remains the same within the left half, which we'll reliably land on. If
1634  * we had to skip over ignorable/deleted pages, it cannot matter because
1635  * their key space has already been atomically merged with the first
1636  * non-ignorable page we eventually find (doesn't matter whether the page
1637  * we eventually find is a true sibling or a cousin of target, which we go
1638  * into below).
1639  *
1640  * Solution:
1641  *
1642  * Caller knows that it should reverify that target is not ignorable
1643  * (half-dead or deleted) when cross-page sibling item comparison appears
1644  * to indicate corruption (invariant fails). This detects the single race
1645  * condition that exists for caller. This is correct because the
1646  * continued existence of target block as non-ignorable (not half-dead or
1647  * deleted) implies that target page was not merged into from the right by
1648  * deletion; the key space at or after target never moved left. Target's
1649  * parent either has the same downlink to target as before, or a <
1650  * downlink due to deletion at the left of target. Target either has the
1651  * same highkey as before, or a highkey < before when there is a page
1652  * split. (The rightmost concurrently-split-from-target-page page will
1653  * still have the same highkey as target was originally found to have,
1654  * which for our purposes is equivalent to target's highkey itself never
1655  * changing, since we reliably skip over
1656  * concurrently-split-from-target-page pages.)
1657  *
1658  * In simpler terms, we allow that the key space of the target may expand
1659  * left (the key space can move left on the left side of target only), but
1660  * the target key space cannot expand right and get ahead of us without
1661  * our detecting it. The key space of the target cannot shrink, unless it
1662  * shrinks to zero due to the deletion of the original page, our canary
1663  * condition. (To be very precise, we're a bit stricter than that because
1664  * it might just have been that the target page split and only the
1665  * original target page was deleted. We can be more strict, just not more
1666  * lax.)
1667  *
1668  * Top level tree walk caller moves on to next page (makes it the new
1669  * target) following recovery from this race. (cf. The rationale for
1670  * child/downlink verification needing a ShareLock within
1671  * bt_child_check(), where page deletion is also the main source of
1672  * trouble.)
1673  *
1674  * Note that it doesn't matter if right sibling page here is actually a
1675  * cousin page, because in order for the key space to be readjusted in a
1676  * way that causes us issues in next level up (guiding problematic
1677  * concurrent insertions to the cousin from the grandparent rather than to
1678  * the sibling from the parent), there'd have to be page deletion of
1679  * target's parent page (affecting target's parent's downlink in target's
1680  * grandparent page). Internal page deletion only occurs when there are
1681  * no child pages (they were all fully deleted), and caller is checking
1682  * that the target's parent has at least one non-deleted (so
1683  * non-ignorable) child: the target page. (Note that the first phase of
1684  * deletion atomically marks the page to be deleted half-dead/ignorable at
1685  * the same time downlink in its parent is removed, so caller will
1686  * definitely not fail to detect that this happened.)
1687  *
1688  * This trick is inspired by the method backward scans use for dealing
1689  * with concurrent page splits; concurrent page deletion is a problem that
1690  * similarly receives special consideration sometimes (it's possible that
1691  * the backwards scan will re-read its "original" block after failing to
1692  * find a right-link to it, having already moved in the opposite direction
1693  * (right/"forwards") a few times to try to locate one). Just like us,
1694  * that happens only to determine if there was a concurrent page deletion
1695  * of a reference page, and just like us if there was a page deletion of
1696  * that reference page it means we can move on from caring about the
1697  * reference page. See the nbtree README for a full description of how
1698  * that works.
1699  */
1700  nline = PageGetMaxOffsetNumber(rightpage);
1701 
1702  /*
1703  * Get first data item, if any
1704  */
1705  if (P_ISLEAF(opaque) && nline >= P_FIRSTDATAKEY(opaque))
1706  {
1707  /* Return first data item (if any) */
1708  rightitem = PageGetItemIdCareful(state, targetnext, rightpage,
1709  P_FIRSTDATAKEY(opaque));
1710  }
1711  else if (!P_ISLEAF(opaque) &&
1712  nline >= OffsetNumberNext(P_FIRSTDATAKEY(opaque)))
1713  {
1714  /*
1715  * Return first item after the internal page's "negative infinity"
1716  * item
1717  */
1718  rightitem = PageGetItemIdCareful(state, targetnext, rightpage,
1719  OffsetNumberNext(P_FIRSTDATAKEY(opaque)));
1720  }
1721  else
1722  {
1723  /*
1724  * No first item. Page is probably empty leaf page, but it's also
1725  * possible that it's an internal page with only a negative infinity
1726  * item.
1727  */
1728  ereport(DEBUG2,
1729  (errcode(ERRCODE_NO_DATA),
1730  errmsg_internal("%s block %u of index \"%s\" has no first data item",
1731  P_ISLEAF(opaque) ? "leaf" : "internal", targetnext,
1732  RelationGetRelationName(state->rel))));
1733  return NULL;
1734  }
1735 
1736  /*
1737  * Return first real item scankey. Note that this relies on right page
1738  * memory remaining allocated.
1739  */
1740  firstitup = (IndexTuple) PageGetItem(rightpage, rightitem);
1741  return bt_mkscankey_pivotsearch(state->rel, firstitup);
1742 }
1743 
1744 /*
1745  * Check if two tuples are binary identical except the block number. So,
1746  * this function is capable to compare pivot keys on different levels.
1747  */
1748 static bool
1750 {
1751  if (IndexTupleSize(itup1) != IndexTupleSize(itup2))
1752  return false;
1753 
1754  if (heapkeyspace)
1755  {
1756  /*
1757  * Offset number will contain important information in heapkeyspace
1758  * indexes: the number of attributes left in the pivot tuple following
1759  * suffix truncation. Don't skip over it (compare it too).
1760  */
1761  if (memcmp(&itup1->t_tid.ip_posid, &itup2->t_tid.ip_posid,
1762  IndexTupleSize(itup1) -
1763  offsetof(ItemPointerData, ip_posid)) != 0)
1764  return false;
1765  }
1766  else
1767  {
1768  /*
1769  * Cannot rely on offset number field having consistent value across
1770  * levels on pg_upgrade'd !heapkeyspace indexes. Compare contents of
1771  * tuple starting from just after item pointer (i.e. after block
1772  * number and offset number).
1773  */
1774  if (memcmp(&itup1->t_info, &itup2->t_info,
1775  IndexTupleSize(itup1) -
1776  offsetof(IndexTupleData, t_info)) != 0)
1777  return false;
1778  }
1779 
1780  return true;
1781 }
1782 
1783 /*---
1784  * Check high keys on the child level. Traverse rightlinks from previous
1785  * downlink to the current one. Check that there are no intermediate pages
1786  * with missing downlinks.
1787  *
1788  * If 'loaded_child' is given, it's assumed to be the page pointed to by the
1789  * downlink referenced by 'downlinkoffnum' of the target page.
1790  *
1791  * Basically this function is called for each target downlink and checks two
1792  * invariants:
1793  *
1794  * 1) You can reach the next child from previous one via rightlinks;
1795  * 2) Each child high key have matching pivot key on target level.
1796  *
1797  * Consider the sample tree picture.
1798  *
1799  * 1
1800  * / \
1801  * 2 <-> 3
1802  * / \ / \
1803  * 4 <> 5 <> 6 <> 7 <> 8
1804  *
1805  * This function will be called for blocks 4, 5, 6 and 8. Consider what is
1806  * happening for each function call.
1807  *
1808  * - The function call for block 4 initializes data structure and matches high
1809  * key of block 4 to downlink's pivot key of block 2.
1810  * - The high key of block 5 is matched to the high key of block 2.
1811  * - The block 6 has an incomplete split flag set, so its high key isn't
1812  * matched to anything.
1813  * - The function call for block 8 checks that block 8 can be found while
1814  * following rightlinks from block 6. The high key of block 7 will be
1815  * matched to downlink's pivot key in block 3.
1816  *
1817  * There is also final call of this function, which checks that there is no
1818  * missing downlinks for children to the right of the child referenced by
1819  * rightmost downlink in target level.
1820  */
1821 static void
1823  OffsetNumber target_downlinkoffnum,
1824  Page loaded_child,
1825  uint32 target_level)
1826 {
1827  BlockNumber blkno = state->prevrightlink;
1828  Page page;
1829  BTPageOpaque opaque;
1830  bool rightsplit = state->previncompletesplit;
1831  bool first = true;
1832  ItemId itemid;
1833  IndexTuple itup;
1834  BlockNumber downlink;
1835 
1836  if (OffsetNumberIsValid(target_downlinkoffnum))
1837  {
1838  itemid = PageGetItemIdCareful(state, state->targetblock,
1839  state->target, target_downlinkoffnum);
1840  itup = (IndexTuple) PageGetItem(state->target, itemid);
1841  downlink = BTreeTupleGetDownLink(itup);
1842  }
1843  else
1844  {
1845  downlink = P_NONE;
1846  }
1847 
1848  /*
1849  * If no previous rightlink is memorized for current level just below
1850  * target page's level, we are about to start from the leftmost page. We
1851  * can't follow rightlinks from previous page, because there is no
1852  * previous page. But we still can match high key.
1853  *
1854  * So we initialize variables for the loop above like there is previous
1855  * page referencing current child. Also we imply previous page to not
1856  * have incomplete split flag, that would make us require downlink for
1857  * current child. That's correct, because leftmost page on the level
1858  * should always have parent downlink.
1859  */
1860  if (!BlockNumberIsValid(blkno))
1861  {
1862  blkno = downlink;
1863  rightsplit = false;
1864  }
1865 
1866  /* Move to the right on the child level */
1867  while (true)
1868  {
1869  /*
1870  * Did we traverse the whole tree level and this is check for pages to
1871  * the right of rightmost downlink?
1872  */
1873  if (blkno == P_NONE && downlink == P_NONE)
1874  {
1876  state->previncompletesplit = false;
1877  return;
1878  }
1879 
1880  /* Did we traverse the whole tree level and don't find next downlink? */
1881  if (blkno == P_NONE)
1882  ereport(ERROR,
1883  (errcode(ERRCODE_INDEX_CORRUPTED),
1884  errmsg("can't traverse from downlink %u to downlink %u of index \"%s\"",
1885  state->prevrightlink, downlink,
1886  RelationGetRelationName(state->rel))));
1887 
1888  /* Load page contents */
1889  if (blkno == downlink && loaded_child)
1890  page = loaded_child;
1891  else
1892  page = palloc_btree_page(state, blkno);
1893 
1894  opaque = (BTPageOpaque) PageGetSpecialPointer(page);
1895 
1896  /* The first page we visit at the level should be leftmost */
1897  if (first && !BlockNumberIsValid(state->prevrightlink) && !P_LEFTMOST(opaque))
1898  ereport(ERROR,
1899  (errcode(ERRCODE_INDEX_CORRUPTED),
1900  errmsg("the first child of leftmost target page is not leftmost of its level in index \"%s\"",
1901  RelationGetRelationName(state->rel)),
1902  errdetail_internal("Target block=%u child block=%u target page lsn=%X/%X.",
1903  state->targetblock, blkno,
1904  LSN_FORMAT_ARGS(state->targetlsn))));
1905 
1906  /* Do level sanity check */
1907  if ((!P_ISDELETED(opaque) || P_HAS_FULLXID(opaque)) &&
1908  opaque->btpo_level != target_level - 1)
1909  ereport(ERROR,
1910  (errcode(ERRCODE_INDEX_CORRUPTED),
1911  errmsg("block found while following rightlinks from child of index \"%s\" has invalid level",
1912  RelationGetRelationName(state->rel)),
1913  errdetail_internal("Block pointed to=%u expected level=%u level in pointed to block=%u.",
1914  blkno, target_level - 1, opaque->btpo_level)));
1915 
1916  /* Try to detect circular links */
1917  if ((!first && blkno == state->prevrightlink) || blkno == opaque->btpo_prev)
1918  ereport(ERROR,
1919  (errcode(ERRCODE_INDEX_CORRUPTED),
1920  errmsg("circular link chain found in block %u of index \"%s\"",
1921  blkno, RelationGetRelationName(state->rel))));
1922 
1923  if (blkno != downlink && !P_IGNORE(opaque))
1924  {
1925  /* blkno probably has missing parent downlink */
1926  bt_downlink_missing_check(state, rightsplit, blkno, page);
1927  }
1928 
1929  rightsplit = P_INCOMPLETE_SPLIT(opaque);
1930 
1931  /*
1932  * If we visit page with high key, check that it is equal to the
1933  * target key next to corresponding downlink.
1934  */
1935  if (!rightsplit && !P_RIGHTMOST(opaque))
1936  {
1937  BTPageOpaque topaque;
1938  IndexTuple highkey;
1939  OffsetNumber pivotkey_offset;
1940 
1941  /* Get high key */
1942  itemid = PageGetItemIdCareful(state, blkno, page, P_HIKEY);
1943  highkey = (IndexTuple) PageGetItem(page, itemid);
1944 
1945  /*
1946  * There might be two situations when we examine high key. If
1947  * current child page is referenced by given target downlink, we
1948  * should look to the next offset number for matching key from
1949  * target page.
1950  *
1951  * Alternatively, we're following rightlinks somewhere in the
1952  * middle between page referenced by previous target's downlink
1953  * and the page referenced by current target's downlink. If
1954  * current child page hasn't incomplete split flag set, then its
1955  * high key should match to the target's key of current offset
1956  * number. This happens when a previous call here (to
1957  * bt_child_highkey_check()) found an incomplete split, and we
1958  * reach a right sibling page without a downlink -- the right
1959  * sibling page's high key still needs to be matched to a
1960  * separator key on the parent/target level.
1961  *
1962  * Don't apply OffsetNumberNext() to target_downlinkoffnum when we
1963  * already had to step right on the child level. Our traversal of
1964  * the child level must try to move in perfect lockstep behind (to
1965  * the left of) the target/parent level traversal.
1966  */
1967  if (blkno == downlink)
1968  pivotkey_offset = OffsetNumberNext(target_downlinkoffnum);
1969  else
1970  pivotkey_offset = target_downlinkoffnum;
1971 
1972  topaque = (BTPageOpaque) PageGetSpecialPointer(state->target);
1973 
1974  if (!offset_is_negative_infinity(topaque, pivotkey_offset))
1975  {
1976  /*
1977  * If we're looking for the next pivot tuple in target page,
1978  * but there is no more pivot tuples, then we should match to
1979  * high key instead.
1980  */
1981  if (pivotkey_offset > PageGetMaxOffsetNumber(state->target))
1982  {
1983  if (P_RIGHTMOST(topaque))
1984  ereport(ERROR,
1985  (errcode(ERRCODE_INDEX_CORRUPTED),
1986  errmsg("child high key is greater than rightmost pivot key on target level in index \"%s\"",
1987  RelationGetRelationName(state->rel)),
1988  errdetail_internal("Target block=%u child block=%u target page lsn=%X/%X.",
1989  state->targetblock, blkno,
1990  LSN_FORMAT_ARGS(state->targetlsn))));
1991  pivotkey_offset = P_HIKEY;
1992  }
1993  itemid = PageGetItemIdCareful(state, state->targetblock,
1994  state->target, pivotkey_offset);
1995  itup = (IndexTuple) PageGetItem(state->target, itemid);
1996  }
1997  else
1998  {
1999  /*
2000  * We cannot try to match child's high key to a negative
2001  * infinity key in target, since there is nothing to compare.
2002  * However, it's still possible to match child's high key
2003  * outside of target page. The reason why we're are is that
2004  * bt_child_highkey_check() was previously called for the
2005  * cousin page of 'loaded_child', which is incomplete split.
2006  * So, now we traverse to the right of that cousin page and
2007  * current child level page under consideration still belongs
2008  * to the subtree of target's left sibling. Thus, we need to
2009  * match child's high key to it's left uncle page high key.
2010  * Thankfully we saved it, it's called a "low key" of target
2011  * page.
2012  */
2013  if (!state->lowkey)
2014  ereport(ERROR,
2015  (errcode(ERRCODE_INDEX_CORRUPTED),
2016  errmsg("can't find left sibling high key in index \"%s\"",
2017  RelationGetRelationName(state->rel)),
2018  errdetail_internal("Target block=%u child block=%u target page lsn=%X/%X.",
2019  state->targetblock, blkno,
2020  LSN_FORMAT_ARGS(state->targetlsn))));
2021  itup = state->lowkey;
2022  }
2023 
2024  if (!bt_pivot_tuple_identical(state->heapkeyspace, highkey, itup))
2025  {
2026  ereport(ERROR,
2027  (errcode(ERRCODE_INDEX_CORRUPTED),
2028  errmsg("mismatch between parent key and child high key in index \"%s\"",
2029  RelationGetRelationName(state->rel)),
2030  errdetail_internal("Target block=%u child block=%u target page lsn=%X/%X.",
2031  state->targetblock, blkno,
2032  LSN_FORMAT_ARGS(state->targetlsn))));
2033  }
2034  }
2035 
2036  /* Exit if we already found next downlink */
2037  if (blkno == downlink)
2038  {
2039  state->prevrightlink = opaque->btpo_next;
2040  state->previncompletesplit = rightsplit;
2041  return;
2042  }
2043 
2044  /* Traverse to the next page using rightlink */
2045  blkno = opaque->btpo_next;
2046 
2047  /* Free page contents if it's allocated by us */
2048  if (page != loaded_child)
2049  pfree(page);
2050  first = false;
2051  }
2052 }
2053 
2054 /*
2055  * Checks one of target's downlink against its child page.
2056  *
2057  * Conceptually, the target page continues to be what is checked here. The
2058  * target block is still blamed in the event of finding an invariant violation.
2059  * The downlink insertion into the target is probably where any problem raised
2060  * here arises, and there is no such thing as a parent link, so doing the
2061  * verification this way around is much more practical.
2062  *
2063  * This function visits child page and it's sequentially called for each
2064  * downlink of target page. Assuming this we also check downlink connectivity
2065  * here in order to save child page visits.
2066  */
2067 static void
2069  OffsetNumber downlinkoffnum)
2070 {
2071  ItemId itemid;
2072  IndexTuple itup;
2073  BlockNumber childblock;
2074  OffsetNumber offset;
2075  OffsetNumber maxoffset;
2076  Page child;
2077  BTPageOpaque copaque;
2078  BTPageOpaque topaque;
2079 
2080  itemid = PageGetItemIdCareful(state, state->targetblock,
2081  state->target, downlinkoffnum);
2082  itup = (IndexTuple) PageGetItem(state->target, itemid);
2083  childblock = BTreeTupleGetDownLink(itup);
2084 
2085  /*
2086  * Caller must have ShareLock on target relation, because of
2087  * considerations around page deletion by VACUUM.
2088  *
2089  * NB: In general, page deletion deletes the right sibling's downlink, not
2090  * the downlink of the page being deleted; the deleted page's downlink is
2091  * reused for its sibling. The key space is thereby consolidated between
2092  * the deleted page and its right sibling. (We cannot delete a parent
2093  * page's rightmost child unless it is the last child page, and we intend
2094  * to also delete the parent itself.)
2095  *
2096  * If this verification happened without a ShareLock, the following race
2097  * condition could cause false positives:
2098  *
2099  * In general, concurrent page deletion might occur, including deletion of
2100  * the left sibling of the child page that is examined here. If such a
2101  * page deletion were to occur, closely followed by an insertion into the
2102  * newly expanded key space of the child, a window for the false positive
2103  * opens up: the stale parent/target downlink originally followed to get
2104  * to the child legitimately ceases to be a lower bound on all items in
2105  * the page, since the key space was concurrently expanded "left".
2106  * (Insertion followed the "new" downlink for the child, not our now-stale
2107  * downlink, which was concurrently physically removed in target/parent as
2108  * part of deletion's first phase.)
2109  *
2110  * While we use various techniques elsewhere to perform cross-page
2111  * verification for !readonly callers, a similar trick seems difficult
2112  * here. The tricks used by bt_recheck_sibling_links and by
2113  * bt_right_page_check_scankey both involve verification of a same-level,
2114  * cross-sibling invariant. Cross-level invariants are far more squishy,
2115  * though. The nbtree REDO routines do not actually couple buffer locks
2116  * across levels during page splits, so making any cross-level check work
2117  * reliably in !readonly mode may be impossible.
2118  */
2119  Assert(state->readonly);
2120 
2121  /*
2122  * Verify child page has the downlink key from target page (its parent) as
2123  * a lower bound; downlink must be strictly less than all keys on the
2124  * page.
2125  *
2126  * Check all items, rather than checking just the first and trusting that
2127  * the operator class obeys the transitive law.
2128  */
2129  topaque = (BTPageOpaque) PageGetSpecialPointer(state->target);
2130  child = palloc_btree_page(state, childblock);
2131  copaque = (BTPageOpaque) PageGetSpecialPointer(child);
2132  maxoffset = PageGetMaxOffsetNumber(child);
2133 
2134  /*
2135  * Since we've already loaded the child block, combine this check with
2136  * check for downlink connectivity.
2137  */
2138  bt_child_highkey_check(state, downlinkoffnum,
2139  child, topaque->btpo_level);
2140 
2141  /*
2142  * Since there cannot be a concurrent VACUUM operation in readonly mode,
2143  * and since a page has no links within other pages (siblings and parent)
2144  * once it is marked fully deleted, it should be impossible to land on a
2145  * fully deleted page.
2146  *
2147  * It does not quite make sense to enforce that the page cannot even be
2148  * half-dead, despite the fact the downlink is modified at the same stage
2149  * that the child leaf page is marked half-dead. That's incorrect because
2150  * there may occasionally be multiple downlinks from a chain of pages
2151  * undergoing deletion, where multiple successive calls are made to
2152  * _bt_unlink_halfdead_page() by VACUUM before it can finally safely mark
2153  * the leaf page as fully dead. While _bt_mark_page_halfdead() usually
2154  * removes the downlink to the leaf page that is marked half-dead, that's
2155  * not guaranteed, so it's possible we'll land on a half-dead page with a
2156  * downlink due to an interrupted multi-level page deletion.
2157  *
2158  * We go ahead with our checks if the child page is half-dead. It's safe
2159  * to do so because we do not test the child's high key, so it does not
2160  * matter that the original high key will have been replaced by a dummy
2161  * truncated high key within _bt_mark_page_halfdead(). All other page
2162  * items are left intact on a half-dead page, so there is still something
2163  * to test.
2164  */
2165  if (P_ISDELETED(copaque))
2166  ereport(ERROR,
2167  (errcode(ERRCODE_INDEX_CORRUPTED),
2168  errmsg("downlink to deleted page found in index \"%s\"",
2169  RelationGetRelationName(state->rel)),
2170  errdetail_internal("Parent block=%u child block=%u parent page lsn=%X/%X.",
2171  state->targetblock, childblock,
2172  LSN_FORMAT_ARGS(state->targetlsn))));
2173 
2174  for (offset = P_FIRSTDATAKEY(copaque);
2175  offset <= maxoffset;
2176  offset = OffsetNumberNext(offset))
2177  {
2178  /*
2179  * Skip comparison of target page key against "negative infinity"
2180  * item, if any. Checking it would indicate that it's not a strict
2181  * lower bound, but that's only because of the hard-coding for
2182  * negative infinity items within _bt_compare().
2183  *
2184  * If nbtree didn't truncate negative infinity tuples during internal
2185  * page splits then we'd expect child's negative infinity key to be
2186  * equal to the scankey/downlink from target/parent (it would be a
2187  * "low key" in this hypothetical scenario, and so it would still need
2188  * to be treated as a special case here).
2189  *
2190  * Negative infinity items can be thought of as a strict lower bound
2191  * that works transitively, with the last non-negative-infinity pivot
2192  * followed during a descent from the root as its "true" strict lower
2193  * bound. Only a small number of negative infinity items are truly
2194  * negative infinity; those that are the first items of leftmost
2195  * internal pages. In more general terms, a negative infinity item is
2196  * only negative infinity with respect to the subtree that the page is
2197  * at the root of.
2198  *
2199  * See also: bt_rootdescend(), which can even detect transitive
2200  * inconsistencies on cousin leaf pages.
2201  */
2202  if (offset_is_negative_infinity(copaque, offset))
2203  continue;
2204 
2205  if (!invariant_l_nontarget_offset(state, targetkey, childblock, child,
2206  offset))
2207  ereport(ERROR,
2208  (errcode(ERRCODE_INDEX_CORRUPTED),
2209  errmsg("down-link lower bound invariant violated for index \"%s\"",
2210  RelationGetRelationName(state->rel)),
2211  errdetail_internal("Parent block=%u child index tid=(%u,%u) parent page lsn=%X/%X.",
2212  state->targetblock, childblock, offset,
2213  LSN_FORMAT_ARGS(state->targetlsn))));
2214  }
2215 
2216  pfree(child);
2217 }
2218 
2219 /*
2220  * Checks if page is missing a downlink that it should have.
2221  *
2222  * A page that lacks a downlink/parent may indicate corruption. However, we
2223  * must account for the fact that a missing downlink can occasionally be
2224  * encountered in a non-corrupt index. This can be due to an interrupted page
2225  * split, or an interrupted multi-level page deletion (i.e. there was a hard
2226  * crash or an error during a page split, or while VACUUM was deleting a
2227  * multi-level chain of pages).
2228  *
2229  * Note that this can only be called in readonly mode, so there is no need to
2230  * be concerned about concurrent page splits or page deletions.
2231  */
2232 static void
2234  BlockNumber blkno, Page page)
2235 {
2237  ItemId itemid;
2238  IndexTuple itup;
2239  Page child;
2240  BTPageOpaque copaque;
2241  uint32 level;
2242  BlockNumber childblk;
2243  XLogRecPtr pagelsn;
2244 
2245  Assert(state->readonly);
2246  Assert(!P_IGNORE(opaque));
2247 
2248  /* No next level up with downlinks to fingerprint from the true root */
2249  if (P_ISROOT(opaque))
2250  return;
2251 
2252  pagelsn = PageGetLSN(page);
2253 
2254  /*
2255  * Incomplete (interrupted) page splits can account for the lack of a
2256  * downlink. Some inserting transaction should eventually complete the
2257  * page split in passing, when it notices that the left sibling page is
2258  * P_INCOMPLETE_SPLIT().
2259  *
2260  * In general, VACUUM is not prepared for there to be no downlink to a
2261  * page that it deletes. This is the main reason why the lack of a
2262  * downlink can be reported as corruption here. It's not obvious that an
2263  * invalid missing downlink can result in wrong answers to queries,
2264  * though, since index scans that land on the child may end up
2265  * consistently moving right. The handling of concurrent page splits (and
2266  * page deletions) within _bt_moveright() cannot distinguish
2267  * inconsistencies that last for a moment from inconsistencies that are
2268  * permanent and irrecoverable.
2269  *
2270  * VACUUM isn't even prepared to delete pages that have no downlink due to
2271  * an incomplete page split, but it can detect and reason about that case
2272  * by design, so it shouldn't be taken to indicate corruption. See
2273  * _bt_pagedel() for full details.
2274  */
2275  if (rightsplit)
2276  {
2277  ereport(DEBUG1,
2278  (errcode(ERRCODE_NO_DATA),
2279  errmsg_internal("harmless interrupted page split detected in index \"%s\"",
2280  RelationGetRelationName(state->rel)),
2281  errdetail_internal("Block=%u level=%u left sibling=%u page lsn=%X/%X.",
2282  blkno, opaque->btpo_level,
2283  opaque->btpo_prev,
2284  LSN_FORMAT_ARGS(pagelsn))));
2285  return;
2286  }
2287 
2288  /*
2289  * Page under check is probably the "top parent" of a multi-level page
2290  * deletion. We'll need to descend the subtree to make sure that
2291  * descendant pages are consistent with that, though.
2292  *
2293  * If the page (which must be non-ignorable) is a leaf page, then clearly
2294  * it can't be the top parent. The lack of a downlink is probably a
2295  * symptom of a broad problem that could just as easily cause
2296  * inconsistencies anywhere else.
2297  */
2298  if (P_ISLEAF(opaque))
2299  ereport(ERROR,
2300  (errcode(ERRCODE_INDEX_CORRUPTED),
2301  errmsg("leaf index block lacks downlink in index \"%s\"",
2302  RelationGetRelationName(state->rel)),
2303  errdetail_internal("Block=%u page lsn=%X/%X.",
2304  blkno,
2305  LSN_FORMAT_ARGS(pagelsn))));
2306 
2307  /* Descend from the given page, which is an internal page */
2308  elog(DEBUG1, "checking for interrupted multi-level deletion due to missing downlink in index \"%s\"",
2309  RelationGetRelationName(state->rel));
2310 
2311  level = opaque->btpo_level;
2312  itemid = PageGetItemIdCareful(state, blkno, page, P_FIRSTDATAKEY(opaque));
2313  itup = (IndexTuple) PageGetItem(page, itemid);
2314  childblk = BTreeTupleGetDownLink(itup);
2315  for (;;)
2316  {
2318 
2319  child = palloc_btree_page(state, childblk);
2320  copaque = (BTPageOpaque) PageGetSpecialPointer(child);
2321 
2322  if (P_ISLEAF(copaque))
2323  break;
2324 
2325  /* Do an extra sanity check in passing on internal pages */
2326  if (copaque->btpo_level != level - 1)
2327  ereport(ERROR,
2328  (errcode(ERRCODE_INDEX_CORRUPTED),
2329  errmsg_internal("downlink points to block in index \"%s\" whose level is not one level down",
2330  RelationGetRelationName(state->rel)),
2331  errdetail_internal("Top parent/under check block=%u block pointed to=%u expected level=%u level in pointed to block=%u.",
2332  blkno, childblk,
2333  level - 1, copaque->btpo_level)));
2334 
2335  level = copaque->btpo_level;
2336  itemid = PageGetItemIdCareful(state, childblk, child,
2337  P_FIRSTDATAKEY(copaque));
2338  itup = (IndexTuple) PageGetItem(child, itemid);
2339  childblk = BTreeTupleGetDownLink(itup);
2340  /* Be slightly more pro-active in freeing this memory, just in case */
2341  pfree(child);
2342  }
2343 
2344  /*
2345  * Since there cannot be a concurrent VACUUM operation in readonly mode,
2346  * and since a page has no links within other pages (siblings and parent)
2347  * once it is marked fully deleted, it should be impossible to land on a
2348  * fully deleted page. See bt_child_check() for further details.
2349  *
2350  * The bt_child_check() P_ISDELETED() check is repeated here because
2351  * bt_child_check() does not visit pages reachable through negative
2352  * infinity items. Besides, bt_child_check() is unwilling to descend
2353  * multiple levels. (The similar bt_child_check() P_ISDELETED() check
2354  * within bt_check_level_from_leftmost() won't reach the page either,
2355  * since the leaf's live siblings should have their sibling links updated
2356  * to bypass the deletion target page when it is marked fully dead.)
2357  *
2358  * If this error is raised, it might be due to a previous multi-level page
2359  * deletion that failed to realize that it wasn't yet safe to mark the
2360  * leaf page as fully dead. A "dangling downlink" will still remain when
2361  * this happens. The fact that the dangling downlink's page (the leaf's
2362  * parent/ancestor page) lacked a downlink is incidental.
2363  */
2364  if (P_ISDELETED(copaque))
2365  ereport(ERROR,
2366  (errcode(ERRCODE_INDEX_CORRUPTED),
2367  errmsg_internal("downlink to deleted leaf page found in index \"%s\"",
2368  RelationGetRelationName(state->rel)),
2369  errdetail_internal("Top parent/target block=%u leaf block=%u top parent/under check lsn=%X/%X.",
2370  blkno, childblk,
2371  LSN_FORMAT_ARGS(pagelsn))));
2372 
2373  /*
2374  * Iff leaf page is half-dead, its high key top parent link should point
2375  * to what VACUUM considered to be the top parent page at the instant it
2376  * was interrupted. Provided the high key link actually points to the
2377  * page under check, the missing downlink we detected is consistent with
2378  * there having been an interrupted multi-level page deletion. This means
2379  * that the subtree with the page under check at its root (a page deletion
2380  * chain) is in a consistent state, enabling VACUUM to resume deleting the
2381  * entire chain the next time it encounters the half-dead leaf page.
2382  */
2383  if (P_ISHALFDEAD(copaque) && !P_RIGHTMOST(copaque))
2384  {
2385  itemid = PageGetItemIdCareful(state, childblk, child, P_HIKEY);
2386  itup = (IndexTuple) PageGetItem(child, itemid);
2387  if (BTreeTupleGetTopParent(itup) == blkno)
2388  return;
2389  }
2390 
2391  ereport(ERROR,
2392  (errcode(ERRCODE_INDEX_CORRUPTED),
2393  errmsg("internal index block lacks downlink in index \"%s\"",
2394  RelationGetRelationName(state->rel)),
2395  errdetail_internal("Block=%u level=%u page lsn=%X/%X.",
2396  blkno, opaque->btpo_level,
2397  LSN_FORMAT_ARGS(pagelsn))));
2398 }
2399 
2400 /*
2401  * Per-tuple callback from table_index_build_scan, used to determine if index has
2402  * all the entries that definitely should have been observed in leaf pages of
2403  * the target index (that is, all IndexTuples that were fingerprinted by our
2404  * Bloom filter). All heapallindexed checks occur here.
2405  *
2406  * The redundancy between an index and the table it indexes provides a good
2407  * opportunity to detect corruption, especially corruption within the table.
2408  * The high level principle behind the verification performed here is that any
2409  * IndexTuple that should be in an index following a fresh CREATE INDEX (based
2410  * on the same index definition) should also have been in the original,
2411  * existing index, which should have used exactly the same representation
2412  *
2413  * Since the overall structure of the index has already been verified, the most
2414  * likely explanation for error here is a corrupt heap page (could be logical
2415  * or physical corruption). Index corruption may still be detected here,
2416  * though. Only readonly callers will have verified that left links and right
2417  * links are in agreement, and so it's possible that a leaf page transposition
2418  * within index is actually the source of corruption detected here (for
2419  * !readonly callers). The checks performed only for readonly callers might
2420  * more accurately frame the problem as a cross-page invariant issue (this
2421  * could even be due to recovery not replaying all WAL records). The !readonly
2422  * ERROR message raised here includes a HINT about retrying with readonly
2423  * verification, just in case it's a cross-page invariant issue, though that
2424  * isn't particularly likely.
2425  *
2426  * table_index_build_scan() expects to be able to find the root tuple when a
2427  * heap-only tuple (the live tuple at the end of some HOT chain) needs to be
2428  * indexed, in order to replace the actual tuple's TID with the root tuple's
2429  * TID (which is what we're actually passed back here). The index build heap
2430  * scan code will raise an error when a tuple that claims to be the root of the
2431  * heap-only tuple's HOT chain cannot be located. This catches cases where the
2432  * original root item offset/root tuple for a HOT chain indicates (for whatever
2433  * reason) that the entire HOT chain is dead, despite the fact that the latest
2434  * heap-only tuple should be indexed. When this happens, sequential scans may
2435  * always give correct answers, and all indexes may be considered structurally
2436  * consistent (i.e. the nbtree structural checks would not detect corruption).
2437  * It may be the case that only index scans give wrong answers, and yet heap or
2438  * SLRU corruption is the real culprit. (While it's true that LP_DEAD bit
2439  * setting will probably also leave the index in a corrupt state before too
2440  * long, the problem is nonetheless that there is heap corruption.)
2441  *
2442  * Heap-only tuple handling within table_index_build_scan() works in a way that
2443  * helps us to detect index tuples that contain the wrong values (values that
2444  * don't match the latest tuple in the HOT chain). This can happen when there
2445  * is no superseding index tuple due to a faulty assessment of HOT safety,
2446  * perhaps during the original CREATE INDEX. Because the latest tuple's
2447  * contents are used with the root TID, an error will be raised when a tuple
2448  * with the same TID but non-matching attribute values is passed back to us.
2449  * Faulty assessment of HOT-safety was behind at least two distinct CREATE
2450  * INDEX CONCURRENTLY bugs that made it into stable releases, one of which was
2451  * undetected for many years. In short, the same principle that allows a
2452  * REINDEX to repair corruption when there was an (undetected) broken HOT chain
2453  * also allows us to detect the corruption in many cases.
2454  */
2455 static void
2457  bool *isnull, bool tupleIsAlive, void *checkstate)
2458 {
2459  BtreeCheckState *state = (BtreeCheckState *) checkstate;
2460  IndexTuple itup,
2461  norm;
2462 
2463  Assert(state->heapallindexed);
2464 
2465  /* Generate a normalized index tuple for fingerprinting */
2466  itup = index_form_tuple(RelationGetDescr(index), values, isnull);
2467  itup->t_tid = *tid;
2468  norm = bt_normalize_tuple(state, itup);
2469 
2470  /* Probe Bloom filter -- tuple should be present */
2471  if (bloom_lacks_element(state->filter, (unsigned char *) norm,
2472  IndexTupleSize(norm)))
2473  ereport(ERROR,
2475  errmsg("heap tuple (%u,%u) from table \"%s\" lacks matching index tuple within index \"%s\"",
2476  ItemPointerGetBlockNumber(&(itup->t_tid)),
2479  RelationGetRelationName(state->rel)),
2480  !state->readonly
2481  ? errhint("Retrying verification using the function bt_index_parent_check() might provide a more specific error.")
2482  : 0));
2483 
2484  state->heaptuplespresent++;
2485  pfree(itup);
2486  /* Cannot leak memory here */
2487  if (norm != itup)
2488  pfree(norm);
2489 }
2490 
2491 /*
2492  * Normalize an index tuple for fingerprinting.
2493  *
2494  * In general, index tuple formation is assumed to be deterministic by
2495  * heapallindexed verification, and IndexTuples are assumed immutable. While
2496  * the LP_DEAD bit is mutable in leaf pages, that's ItemId metadata, which is
2497  * not fingerprinted. Normalization is required to compensate for corner
2498  * cases where the determinism assumption doesn't quite work.
2499  *
2500  * There is currently one such case: index_form_tuple() does not try to hide
2501  * the source TOAST state of input datums. The executor applies TOAST
2502  * compression for heap tuples based on different criteria to the compression
2503  * applied within btinsert()'s call to index_form_tuple(): it sometimes
2504  * compresses more aggressively, resulting in compressed heap tuple datums but
2505  * uncompressed corresponding index tuple datums. A subsequent heapallindexed
2506  * verification will get a logically equivalent though bitwise unequal tuple
2507  * from index_form_tuple(). False positive heapallindexed corruption reports
2508  * could occur without normalizing away the inconsistency.
2509  *
2510  * Returned tuple is often caller's own original tuple. Otherwise, it is a
2511  * new representation of caller's original index tuple, palloc()'d in caller's
2512  * memory context.
2513  *
2514  * Note: This routine is not concerned with distinctions about the
2515  * representation of tuples beyond those that might break heapallindexed
2516  * verification. In particular, it won't try to normalize opclass-equal
2517  * datums with potentially distinct representations (e.g., btree/numeric_ops
2518  * index datums will not get their display scale normalized-away here).
2519  * Caller does normalization for non-pivot tuples that have a posting list,
2520  * since dummy CREATE INDEX callback code generates new tuples with the same
2521  * normalized representation.
2522  */
2523 static IndexTuple
2525 {
2526  TupleDesc tupleDescriptor = RelationGetDescr(state->rel);
2527  Datum normalized[INDEX_MAX_KEYS];
2528  bool isnull[INDEX_MAX_KEYS];
2529  bool toast_free[INDEX_MAX_KEYS];
2530  bool formnewtup = false;
2531  IndexTuple reformed;
2532  int i;
2533 
2534  /* Caller should only pass "logical" non-pivot tuples here */
2535  Assert(!BTreeTupleIsPosting(itup) && !BTreeTupleIsPivot(itup));
2536 
2537  /* Easy case: It's immediately clear that tuple has no varlena datums */
2538  if (!IndexTupleHasVarwidths(itup))
2539  return itup;
2540 
2541  for (i = 0; i < tupleDescriptor->natts; i++)
2542  {
2543  Form_pg_attribute att;
2544 
2545  att = TupleDescAttr(tupleDescriptor, i);
2546 
2547  /* Assume untoasted/already normalized datum initially */
2548  toast_free[i] = false;
2549  normalized[i] = index_getattr(itup, att->attnum,
2550  tupleDescriptor,
2551  &isnull[i]);
2552  if (att->attbyval || att->attlen != -1 || isnull[i])
2553  continue;
2554 
2555  /*
2556  * Callers always pass a tuple that could safely be inserted into the
2557  * index without further processing, so an external varlena header
2558  * should never be encountered here
2559  */
2560  if (VARATT_IS_EXTERNAL(DatumGetPointer(normalized[i])))
2561  ereport(ERROR,
2562  (errcode(ERRCODE_INDEX_CORRUPTED),
2563  errmsg("external varlena datum in tuple that references heap row (%u,%u) in index \"%s\"",
2564  ItemPointerGetBlockNumber(&(itup->t_tid)),
2566  RelationGetRelationName(state->rel))));
2567  else if (VARATT_IS_COMPRESSED(DatumGetPointer(normalized[i])))
2568  {
2569  formnewtup = true;
2570  normalized[i] = PointerGetDatum(PG_DETOAST_DATUM(normalized[i]));
2571  toast_free[i] = true;
2572  }
2573  }
2574 
2575  /* Easier case: Tuple has varlena datums, none of which are compressed */
2576  if (!formnewtup)
2577  return itup;
2578 
2579  /*
2580  * Hard case: Tuple had compressed varlena datums that necessitate
2581  * creating normalized version of the tuple from uncompressed input datums
2582  * (normalized input datums). This is rather naive, but shouldn't be
2583  * necessary too often.
2584  *
2585  * Note that we rely on deterministic index_form_tuple() TOAST compression
2586  * of normalized input.
2587  */
2588  reformed = index_form_tuple(tupleDescriptor, normalized, isnull);
2589  reformed->t_tid = itup->t_tid;
2590 
2591  /* Cannot leak memory here */
2592  for (i = 0; i < tupleDescriptor->natts; i++)
2593  if (toast_free[i])
2594  pfree(DatumGetPointer(normalized[i]));
2595 
2596  return reformed;
2597 }
2598 
2599 /*
2600  * Produce palloc()'d "plain" tuple for nth posting list entry/TID.
2601  *
2602  * In general, deduplication is not supposed to change the logical contents of
2603  * an index. Multiple index tuples are merged together into one equivalent
2604  * posting list index tuple when convenient.
2605  *
2606  * heapallindexed verification must normalize-away this variation in
2607  * representation by converting posting list tuples into two or more "plain"
2608  * tuples. Each tuple must be fingerprinted separately -- there must be one
2609  * tuple for each corresponding Bloom filter probe during the heap scan.
2610  *
2611  * Note: Caller still needs to call bt_normalize_tuple() with returned tuple.
2612  */
2613 static inline IndexTuple
2615 {
2616  Assert(BTreeTupleIsPosting(itup));
2617 
2618  /* Returns non-posting-list tuple */
2619  return _bt_form_posting(itup, BTreeTupleGetPostingN(itup, n), 1);
2620 }
2621 
2622 /*
2623  * Search for itup in index, starting from fast root page. itup must be a
2624  * non-pivot tuple. This is only supported with heapkeyspace indexes, since
2625  * we rely on having fully unique keys to find a match with only a single
2626  * visit to a leaf page, barring an interrupted page split, where we may have
2627  * to move right. (A concurrent page split is impossible because caller must
2628  * be readonly caller.)
2629  *
2630  * This routine can detect very subtle transitive consistency issues across
2631  * more than one level of the tree. Leaf pages all have a high key (even the
2632  * rightmost page has a conceptual positive infinity high key), but not a low
2633  * key. Their downlink in parent is a lower bound, which along with the high
2634  * key is almost enough to detect every possible inconsistency. A downlink
2635  * separator key value won't always be available from parent, though, because
2636  * the first items of internal pages are negative infinity items, truncated
2637  * down to zero attributes during internal page splits. While it's true that
2638  * bt_child_check() and the high key check can detect most imaginable key
2639  * space problems, there are remaining problems it won't detect with non-pivot
2640  * tuples in cousin leaf pages. Starting a search from the root for every
2641  * existing leaf tuple detects small inconsistencies in upper levels of the
2642  * tree that cannot be detected any other way. (Besides all this, this is
2643  * probably also useful as a direct test of the code used by index scans
2644  * themselves.)
2645  */
2646 static bool
2648 {
2649  BTScanInsert key;
2650  BTStack stack;
2651  Buffer lbuf;
2652  bool exists;
2653 
2654  key = _bt_mkscankey(state->rel, itup);
2655  Assert(key->heapkeyspace && key->scantid != NULL);
2656 
2657  /*
2658  * Search from root.
2659  *
2660  * Ideally, we would arrange to only move right within _bt_search() when
2661  * an interrupted page split is detected (i.e. when the incomplete split
2662  * bit is found to be set), but for now we accept the possibility that
2663  * that could conceal an inconsistency.
2664  */
2665  Assert(state->readonly && state->rootdescend);
2666  exists = false;
2667  stack = _bt_search(state->rel, key, &lbuf, BT_READ, NULL);
2668 
2669  if (BufferIsValid(lbuf))
2670  {
2671  BTInsertStateData insertstate;
2672  OffsetNumber offnum;
2673  Page page;
2674 
2675  insertstate.itup = itup;
2676  insertstate.itemsz = MAXALIGN(IndexTupleSize(itup));
2677  insertstate.itup_key = key;
2678  insertstate.postingoff = 0;
2679  insertstate.bounds_valid = false;
2680  insertstate.buf = lbuf;
2681 
2682  /* Get matching tuple on leaf page */
2683  offnum = _bt_binsrch_insert(state->rel, &insertstate);
2684  /* Compare first >= matching item on leaf page, if any */
2685  page = BufferGetPage(lbuf);
2686  /* Should match on first heap TID when tuple has a posting list */
2687  if (offnum <= PageGetMaxOffsetNumber(page) &&
2688  insertstate.postingoff <= 0 &&
2689  _bt_compare(state->rel, key, page, offnum) == 0)
2690  exists = true;
2691  _bt_relbuf(state->rel, lbuf);
2692  }
2693 
2694  _bt_freestack(stack);
2695  pfree(key);
2696 
2697  return exists;
2698 }
2699 
2700 /*
2701  * Is particular offset within page (whose special state is passed by caller)
2702  * the page negative-infinity item?
2703  *
2704  * As noted in comments above _bt_compare(), there is special handling of the
2705  * first data item as a "negative infinity" item. The hard-coding within
2706  * _bt_compare() makes comparing this item for the purposes of verification
2707  * pointless at best, since the IndexTuple only contains a valid TID (a
2708  * reference TID to child page).
2709  */
2710 static inline bool
2712 {
2713  /*
2714  * For internal pages only, the first item after high key, if any, is
2715  * negative infinity item. Internal pages always have a negative infinity
2716  * item, whereas leaf pages never have one. This implies that negative
2717  * infinity item is either first or second line item, or there is none
2718  * within page.
2719  *
2720  * Negative infinity items are a special case among pivot tuples. They
2721  * always have zero attributes, while all other pivot tuples always have
2722  * nkeyatts attributes.
2723  *
2724  * Right-most pages don't have a high key, but could be said to
2725  * conceptually have a "positive infinity" high key. Thus, there is a
2726  * symmetry between down link items in parent pages, and high keys in
2727  * children. Together, they represent the part of the key space that
2728  * belongs to each page in the index. For example, all children of the
2729  * root page will have negative infinity as a lower bound from root
2730  * negative infinity downlink, and positive infinity as an upper bound
2731  * (implicitly, from "imaginary" positive infinity high key in root).
2732  */
2733  return !P_ISLEAF(opaque) && offset == P_FIRSTDATAKEY(opaque);
2734 }
2735 
2736 /*
2737  * Does the invariant hold that the key is strictly less than a given upper
2738  * bound offset item?
2739  *
2740  * Verifies line pointer on behalf of caller.
2741  *
2742  * If this function returns false, convention is that caller throws error due
2743  * to corruption.
2744  */
2745 static inline bool
2747  OffsetNumber upperbound)
2748 {
2749  ItemId itemid;
2750  int32 cmp;
2751 
2752  Assert(key->pivotsearch);
2753 
2754  /* Verify line pointer before checking tuple */
2755  itemid = PageGetItemIdCareful(state, state->targetblock, state->target,
2756  upperbound);
2757  /* pg_upgrade'd indexes may legally have equal sibling tuples */
2758  if (!key->heapkeyspace)
2759  return invariant_leq_offset(state, key, upperbound);
2760 
2761  cmp = _bt_compare(state->rel, key, state->target, upperbound);
2762 
2763  /*
2764  * _bt_compare() is capable of determining that a scankey with a
2765  * filled-out attribute is greater than pivot tuples where the comparison
2766  * is resolved at a truncated attribute (value of attribute in pivot is
2767  * minus infinity). However, it is not capable of determining that a
2768  * scankey is _less than_ a tuple on the basis of a comparison resolved at
2769  * _scankey_ minus infinity attribute. Complete an extra step to simulate
2770  * having minus infinity values for omitted scankey attribute(s).
2771  */
2772  if (cmp == 0)
2773  {
2774  BTPageOpaque topaque;
2775  IndexTuple ritup;
2776  int uppnkeyatts;
2777  ItemPointer rheaptid;
2778  bool nonpivot;
2779 
2780  ritup = (IndexTuple) PageGetItem(state->target, itemid);
2781  topaque = (BTPageOpaque) PageGetSpecialPointer(state->target);
2782  nonpivot = P_ISLEAF(topaque) && upperbound >= P_FIRSTDATAKEY(topaque);
2783 
2784  /* Get number of keys + heap TID for item to the right */
2785  uppnkeyatts = BTreeTupleGetNKeyAtts(ritup, state->rel);
2786  rheaptid = BTreeTupleGetHeapTIDCareful(state, ritup, nonpivot);
2787 
2788  /* Heap TID is tiebreaker key attribute */
2789  if (key->keysz == uppnkeyatts)
2790  return key->scantid == NULL && rheaptid != NULL;
2791 
2792  return key->keysz < uppnkeyatts;
2793  }
2794 
2795  return cmp < 0;
2796 }
2797 
2798 /*
2799  * Does the invariant hold that the key is less than or equal to a given upper
2800  * bound offset item?
2801  *
2802  * Caller should have verified that upperbound's line pointer is consistent
2803  * using PageGetItemIdCareful() call.
2804  *
2805  * If this function returns false, convention is that caller throws error due
2806  * to corruption.
2807  */
2808 static inline bool
2810  OffsetNumber upperbound)
2811 {
2812  int32 cmp;
2813 
2814  Assert(key->pivotsearch);
2815 
2816  cmp = _bt_compare(state->rel, key, state->target, upperbound);
2817 
2818  return cmp <= 0;
2819 }
2820 
2821 /*
2822  * Does the invariant hold that the key is strictly greater than a given lower
2823  * bound offset item?
2824  *
2825  * Caller should have verified that lowerbound's line pointer is consistent
2826  * using PageGetItemIdCareful() call.
2827  *
2828  * If this function returns false, convention is that caller throws error due
2829  * to corruption.
2830  */
2831 static inline bool
2833  OffsetNumber lowerbound)
2834 {
2835  int32 cmp;
2836 
2837  Assert(key->pivotsearch);
2838 
2839  cmp = _bt_compare(state->rel, key, state->target, lowerbound);
2840 
2841  /* pg_upgrade'd indexes may legally have equal sibling tuples */
2842  if (!key->heapkeyspace)
2843  return cmp >= 0;
2844 
2845  /*
2846  * No need to consider the possibility that scankey has attributes that we
2847  * need to force to be interpreted as negative infinity. _bt_compare() is
2848  * able to determine that scankey is greater than negative infinity. The
2849  * distinction between "==" and "<" isn't interesting here, since
2850  * corruption is indicated either way.
2851  */
2852  return cmp > 0;
2853 }
2854 
2855 /*
2856  * Does the invariant hold that the key is strictly less than a given upper
2857  * bound offset item, with the offset relating to a caller-supplied page that
2858  * is not the current target page?
2859  *
2860  * Caller's non-target page is a child page of the target, checked as part of
2861  * checking a property of the target page (i.e. the key comes from the
2862  * target). Verifies line pointer on behalf of caller.
2863  *
2864  * If this function returns false, convention is that caller throws error due
2865  * to corruption.
2866  */
2867 static inline bool
2869  BlockNumber nontargetblock, Page nontarget,
2870  OffsetNumber upperbound)
2871 {
2872  ItemId itemid;
2873  int32 cmp;
2874 
2875  Assert(key->pivotsearch);
2876 
2877  /* Verify line pointer before checking tuple */
2878  itemid = PageGetItemIdCareful(state, nontargetblock, nontarget,
2879  upperbound);
2880  cmp = _bt_compare(state->rel, key, nontarget, upperbound);
2881 
2882  /* pg_upgrade'd indexes may legally have equal sibling tuples */
2883  if (!key->heapkeyspace)
2884  return cmp <= 0;
2885 
2886  /* See invariant_l_offset() for an explanation of this extra step */
2887  if (cmp == 0)
2888  {
2889  IndexTuple child;
2890  int uppnkeyatts;
2891  ItemPointer childheaptid;
2892  BTPageOpaque copaque;
2893  bool nonpivot;
2894 
2895  child = (IndexTuple) PageGetItem(nontarget, itemid);
2896  copaque = (BTPageOpaque) PageGetSpecialPointer(nontarget);
2897  nonpivot = P_ISLEAF(copaque) && upperbound >= P_FIRSTDATAKEY(copaque);
2898 
2899  /* Get number of keys + heap TID for child/non-target item */
2900  uppnkeyatts = BTreeTupleGetNKeyAtts(child, state->rel);
2901  childheaptid = BTreeTupleGetHeapTIDCareful(state, child, nonpivot);
2902 
2903  /* Heap TID is tiebreaker key attribute */
2904  if (key->keysz == uppnkeyatts)
2905  return key->scantid == NULL && childheaptid != NULL;
2906 
2907  return key->keysz < uppnkeyatts;
2908  }
2909 
2910  return cmp < 0;
2911 }
2912 
2913 /*
2914  * Given a block number of a B-Tree page, return page in palloc()'d memory.
2915  * While at it, perform some basic checks of the page.
2916  *
2917  * There is never an attempt to get a consistent view of multiple pages using
2918  * multiple concurrent buffer locks; in general, we only acquire a single pin
2919  * and buffer lock at a time, which is often all that the nbtree code requires.
2920  * (Actually, bt_recheck_sibling_links couples buffer locks, which is the only
2921  * exception to this general rule.)
2922  *
2923  * Operating on a copy of the page is useful because it prevents control
2924  * getting stuck in an uninterruptible state when an underlying operator class
2925  * misbehaves.
2926  */
2927 static Page
2929 {
2930  Buffer buffer;
2931  Page page;
2932  BTPageOpaque opaque;
2933  OffsetNumber maxoffset;
2934 
2935  page = palloc(BLCKSZ);
2936 
2937  /*
2938  * We copy the page into local storage to avoid holding pin on the buffer
2939  * longer than we must.
2940  */
2941  buffer = ReadBufferExtended(state->rel, MAIN_FORKNUM, blocknum, RBM_NORMAL,
2942  state->checkstrategy);
2943  LockBuffer(buffer, BT_READ);
2944 
2945  /*
2946  * Perform the same basic sanity checking that nbtree itself performs for
2947  * every page:
2948  */
2949  _bt_checkpage(state->rel, buffer);
2950 
2951  /* Only use copy of page in palloc()'d memory */
2952  memcpy(page, BufferGetPage(buffer), BLCKSZ);
2953  UnlockReleaseBuffer(buffer);
2954 
2955  opaque = (BTPageOpaque) PageGetSpecialPointer(page);
2956 
2957  if (P_ISMETA(opaque) && blocknum != BTREE_METAPAGE)
2958  ereport(ERROR,
2959  (errcode(ERRCODE_INDEX_CORRUPTED),
2960  errmsg("invalid meta page found at block %u in index \"%s\"",
2961  blocknum, RelationGetRelationName(state->rel))));
2962 
2963  /* Check page from block that ought to be meta page */
2964  if (blocknum == BTREE_METAPAGE)
2965  {
2966  BTMetaPageData *metad = BTPageGetMeta(page);
2967 
2968  if (!P_ISMETA(opaque) ||
2969  metad->btm_magic != BTREE_MAGIC)
2970  ereport(ERROR,
2971  (errcode(ERRCODE_INDEX_CORRUPTED),
2972  errmsg("index \"%s\" meta page is corrupt",
2973  RelationGetRelationName(state->rel))));
2974 
2975  if (metad->btm_version < BTREE_MIN_VERSION ||
2976  metad->btm_version > BTREE_VERSION)
2977  ereport(ERROR,
2978  (errcode(ERRCODE_INDEX_CORRUPTED),
2979  errmsg("version mismatch in index \"%s\": file version %d, "
2980  "current version %d, minimum supported version %d",
2981  RelationGetRelationName(state->rel),
2982  metad->btm_version, BTREE_VERSION,
2983  BTREE_MIN_VERSION)));
2984 
2985  /* Finished with metapage checks */
2986  return page;
2987  }
2988 
2989  /*
2990  * Deleted pages that still use the old 32-bit XID representation have no
2991  * sane "level" field because they type pun the field, but all other pages
2992  * (including pages deleted on Postgres 14+) have a valid value.
2993  */
2994  if (!P_ISDELETED(opaque) || P_HAS_FULLXID(opaque))
2995  {
2996  /* Okay, no reason not to trust btpo_level field from page */
2997 
2998  if (P_ISLEAF(opaque) && opaque->btpo_level != 0)
2999  ereport(ERROR,
3000  (errcode(ERRCODE_INDEX_CORRUPTED),
3001  errmsg_internal("invalid leaf page level %u for block %u in index \"%s\"",
3002  opaque->btpo_level, blocknum,
3003  RelationGetRelationName(state->rel))));
3004 
3005  if (!P_ISLEAF(opaque) && opaque->btpo_level == 0)
3006  ereport(ERROR,
3007  (errcode(ERRCODE_INDEX_CORRUPTED),
3008  errmsg_internal("invalid internal page level 0 for block %u in index \"%s\"",
3009  blocknum,
3010  RelationGetRelationName(state->rel))));
3011  }
3012 
3013  /*
3014  * Sanity checks for number of items on page.
3015  *
3016  * As noted at the beginning of _bt_binsrch(), an internal page must have
3017  * children, since there must always be a negative infinity downlink
3018  * (there may also be a highkey). In the case of non-rightmost leaf
3019  * pages, there must be at least a highkey. The exceptions are deleted
3020  * pages, which contain no items.
3021  *
3022  * This is correct when pages are half-dead, since internal pages are
3023  * never half-dead, and leaf pages must have a high key when half-dead
3024  * (the rightmost page can never be deleted). It's also correct with
3025  * fully deleted pages: _bt_unlink_halfdead_page() doesn't change anything
3026  * about the target page other than setting the page as fully dead, and
3027  * setting its xact field. In particular, it doesn't change the sibling
3028  * links in the deletion target itself, since they're required when index
3029  * scans land on the deletion target, and then need to move right (or need
3030  * to move left, in the case of backward index scans).
3031  */
3032  maxoffset = PageGetMaxOffsetNumber(page);
3033  if (maxoffset > MaxIndexTuplesPerPage)
3034  ereport(ERROR,
3035  (errcode(ERRCODE_INDEX_CORRUPTED),
3036  errmsg("Number of items on block %u of index \"%s\" exceeds MaxIndexTuplesPerPage (%u)",
3037  blocknum, RelationGetRelationName(state->rel),
3039 
3040  if (!P_ISLEAF(opaque) && !P_ISDELETED(opaque) && maxoffset < P_FIRSTDATAKEY(opaque))
3041  ereport(ERROR,
3042  (errcode(ERRCODE_INDEX_CORRUPTED),
3043  errmsg("internal block %u in index \"%s\" lacks high key and/or at least one downlink",
3044  blocknum, RelationGetRelationName(state->rel))));
3045 
3046  if (P_ISLEAF(opaque) && !P_ISDELETED(opaque) && !P_RIGHTMOST(opaque) && maxoffset < P_HIKEY)
3047  ereport(ERROR,
3048  (errcode(ERRCODE_INDEX_CORRUPTED),
3049  errmsg("non-rightmost leaf block %u in index \"%s\" lacks high key item",
3050  blocknum, RelationGetRelationName(state->rel))));
3051 
3052  /*
3053  * In general, internal pages are never marked half-dead, except on
3054  * versions of Postgres prior to 9.4, where it can be valid transient
3055  * state. This state is nonetheless treated as corruption by VACUUM on
3056  * from version 9.4 on, so do the same here. See _bt_pagedel() for full
3057  * details.
3058  */
3059  if (!P_ISLEAF(opaque) && P_ISHALFDEAD(opaque))
3060  ereport(ERROR,
3061  (errcode(ERRCODE_INDEX_CORRUPTED),
3062  errmsg("internal page block %u in index \"%s\" is half-dead",
3063  blocknum, RelationGetRelationName(state->rel)),
3064  errhint("This can be caused by an interrupted VACUUM in version 9.3 or older, before upgrade. Please REINDEX it.")));
3065 
3066  /*
3067  * Check that internal pages have no garbage items, and that no page has
3068  * an invalid combination of deletion-related page level flags
3069  */
3070  if (!P_ISLEAF(opaque) && P_HAS_GARBAGE(opaque))
3071  ereport(ERROR,
3072  (errcode(ERRCODE_INDEX_CORRUPTED),
3073  errmsg_internal("internal page block %u in index \"%s\" has garbage items",
3074  blocknum, RelationGetRelationName(state->rel))));
3075 
3076  if (P_HAS_FULLXID(opaque) && !P_ISDELETED(opaque))
3077  ereport(ERROR,
3078  (errcode(ERRCODE_INDEX_CORRUPTED),
3079  errmsg_internal("full transaction id page flag appears in non-deleted block %u in index \"%s\"",
3080  blocknum, RelationGetRelationName(state->rel))));
3081 
3082  if (P_ISDELETED(opaque) && P_ISHALFDEAD(opaque))
3083  ereport(ERROR,
3084  (errcode(ERRCODE_INDEX_CORRUPTED),
3085  errmsg_internal("deleted page block %u in index \"%s\" is half-dead",
3086  blocknum, RelationGetRelationName(state->rel))));
3087 
3088  return page;
3089 }
3090 
3091 /*
3092  * _bt_mkscankey() wrapper that automatically prevents insertion scankey from
3093  * being considered greater than the pivot tuple that its values originated
3094  * from (or some other identical pivot tuple) in the common case where there
3095  * are truncated/minus infinity attributes. Without this extra step, there
3096  * are forms of corruption that amcheck could theoretically fail to report.
3097  *
3098  * For example, invariant_g_offset() might miss a cross-page invariant failure
3099  * on an internal level if the scankey built from the first item on the
3100  * target's right sibling page happened to be equal to (not greater than) the
3101  * last item on target page. The !pivotsearch tiebreaker in _bt_compare()
3102  * might otherwise cause amcheck to assume (rather than actually verify) that
3103  * the scankey is greater.
3104  */
3105 static inline BTScanInsert
3107 {
3108  BTScanInsert skey;
3109 
3110  skey = _bt_mkscankey(rel, itup);
3111  skey->pivotsearch = true;
3112 
3113  return skey;
3114 }
3115 
3116 /*
3117  * PageGetItemId() wrapper that validates returned line pointer.
3118  *
3119  * Buffer page/page item access macros generally trust that line pointers are
3120  * not corrupt, which might cause problems for verification itself. For
3121  * example, there is no bounds checking in PageGetItem(). Passing it a
3122  * corrupt line pointer can cause it to return a tuple/pointer that is unsafe
3123  * to dereference.
3124  *
3125  * Validating line pointers before tuples avoids undefined behavior and
3126  * assertion failures with corrupt indexes, making the verification process
3127  * more robust and predictable.
3128  */
3129 static ItemId
3131  OffsetNumber offset)
3132 {
3133  ItemId itemid = PageGetItemId(page, offset);
3134 
3135  if (ItemIdGetOffset(itemid) + ItemIdGetLength(itemid) >
3136  BLCKSZ - MAXALIGN(sizeof(BTPageOpaqueData)))
3137  ereport(ERROR,
3138  (errcode(ERRCODE_INDEX_CORRUPTED),
3139  errmsg("line pointer points past end of tuple space in index \"%s\"",
3140  RelationGetRelationName(state->rel)),
3141  errdetail_internal("Index tid=(%u,%u) lp_off=%u, lp_len=%u lp_flags=%u.",
3142  block, offset, ItemIdGetOffset(itemid),
3143  ItemIdGetLength(itemid),
3144  ItemIdGetFlags(itemid))));
3145 
3146  /*
3147  * Verify that line pointer isn't LP_REDIRECT or LP_UNUSED, since nbtree
3148  * never uses either. Verify that line pointer has storage, too, since
3149  * even LP_DEAD items should within nbtree.
3150  */
3151  if (ItemIdIsRedirected(itemid) || !ItemIdIsUsed(itemid) ||
3152  ItemIdGetLength(itemid) == 0)
3153  ereport(ERROR,
3154  (errcode(ERRCODE_INDEX_CORRUPTED),
3155  errmsg("invalid line pointer storage in index \"%s\"",
3156  RelationGetRelationName(state->rel)),
3157  errdetail_internal("Index tid=(%u,%u) lp_off=%u, lp_len=%u lp_flags=%u.",
3158  block, offset, ItemIdGetOffset(itemid),
3159  ItemIdGetLength(itemid),
3160  ItemIdGetFlags(itemid))));
3161 
3162  return itemid;
3163 }
3164 
3165 /*
3166  * BTreeTupleGetHeapTID() wrapper that enforces that a heap TID is present in
3167  * cases where that is mandatory (i.e. for non-pivot tuples)
3168  */
3169 static inline ItemPointer
3171  bool nonpivot)
3172 {
3173  ItemPointer htid;
3174 
3175  /*
3176  * Caller determines whether this is supposed to be a pivot or non-pivot
3177  * tuple using page type and item offset number. Verify that tuple
3178  * metadata agrees with this.
3179  */
3180  Assert(state->heapkeyspace);
3181  if (BTreeTupleIsPivot(itup) && nonpivot)
3182  ereport(ERROR,
3183  (errcode(ERRCODE_INDEX_CORRUPTED),
3184  errmsg_internal("block %u or its right sibling block or child block in index \"%s\" has unexpected pivot tuple",
3185  state->targetblock,
3186  RelationGetRelationName(state->rel))));
3187 
3188  if (!BTreeTupleIsPivot(itup) && !nonpivot)
3189  ereport(ERROR,
3190  (errcode(ERRCODE_INDEX_CORRUPTED),
3191  errmsg_internal("block %u or its right sibling block or child block in index \"%s\" has unexpected non-pivot tuple",
3192  state->targetblock,
3193  RelationGetRelationName(state->rel))));
3194 
3195  htid = BTreeTupleGetHeapTID(itup);
3196  if (!ItemPointerIsValid(htid) && nonpivot)
3197  ereport(ERROR,
3198  (errcode(ERRCODE_INDEX_CORRUPTED),
3199  errmsg("block %u or its right sibling block or child block in index \"%s\" contains non-pivot tuple that lacks a heap TID",
3200  state->targetblock,
3201  RelationGetRelationName(state->rel))));
3202 
3203  return htid;
3204 }
3205 
3206 /*
3207  * Return the "pointed to" TID for itup, which is used to generate a
3208  * descriptive error message. itup must be a "data item" tuple (it wouldn't
3209  * make much sense to call here with a high key tuple, since there won't be a
3210  * valid downlink/block number to display).
3211  *
3212  * Returns either a heap TID (which will be the first heap TID in posting list
3213  * if itup is posting list tuple), or a TID that contains downlink block
3214  * number, plus some encoded metadata (e.g., the number of attributes present
3215  * in itup).
3216  */
3217 static inline ItemPointer
3219 {
3220  /*
3221  * Rely on the assumption that !heapkeyspace internal page data items will
3222  * correctly return TID with downlink here -- BTreeTupleGetHeapTID() won't
3223  * recognize it as a pivot tuple, but everything still works out because
3224  * the t_tid field is still returned
3225  */
3226  if (!BTreeTupleIsPivot(itup))
3227  return BTreeTupleGetHeapTID(itup);
3228 
3229  /* Pivot tuple returns TID with downlink block (heapkeyspace variant) */
3230  return &itup->t_tid;
3231 }
PG_MODULE_MAGIC
Definition: verify_nbtree.c:43
BufferAccessStrategy GetAccessStrategy(BufferAccessStrategyType btype)
Definition: freelist.c:542
int32 ItemPointerCompare(ItemPointer arg1, ItemPointer arg2)
Definition: itemptr.c:52
#define ItemPointerIsValid(pointer)
Definition: itemptr.h:82
#define ItemPointerGetOffsetNumberNoCheck(pointer)
Definition: itemptr.h:108
bloom_filter * bloom_create(int64 total_elems, int bloom_work_mem, uint64 seed)
Definition: bloomfilter.c:88
Oid IndexGetRelation(Oid indexId, bool missing_ok)
Definition: index.c:3475
#define VARATT_IS_COMPRESSED(PTR)
Definition: postgres.h:325
static bool invariant_leq_offset(BtreeCheckState *state, BTScanInsert key, OffsetNumber upperbound)
static ItemPointer BTreeTupleGetPointsToTID(IndexTuple itup)
void _bt_freestack(BTStack stack)
Definition: nbtutils.c:175
BlockNumber targetblock
Definition: verify_nbtree.c:93
IndexTuple _bt_form_posting(IndexTuple base, ItemPointer htids, int nhtids)
Definition: nbtdedup.c:859
BlockNumber btpo_next
Definition: nbtree.h:65
static bool btree_index_mainfork_expected(Relation rel)
void MemoryContextDelete(MemoryContext context)
Definition: mcxt.c:218
#define AllocSetContextCreate
Definition: memutils.h:173
#define DEBUG1
Definition: elog.h:25
void table_close(Relation relation, LOCKMODE lockmode)
Definition: table.c:167
int errhint(const char *fmt,...)
Definition: elog.c:1156
#define ERRCODE_UNDEFINED_TABLE
Definition: pgbench.c:78
Datum bt_index_parent_check(PG_FUNCTION_ARGS)
static void btree_index_checkable(Relation rel)
#define ItemIdIsRedirected(itemId)
Definition: itemid.h:106
#define P_IGNORE(opaque)
Definition: nbtree.h:224
static bool BTreeTupleIsPivot(IndexTuple itup)
Definition: nbtree.h:473
bool bounds_valid
Definition: nbtree.h:821
static BtreeLevel bt_check_level_from_leftmost(BtreeCheckState *state, BtreeLevel level)
Snapshot RegisterSnapshot(Snapshot snapshot)
Definition: snapmgr.c:810
uint32 btm_version
Definition: nbtree.h:104
static ItemPointer BTreeTupleGetHeapTID(IndexTuple itup)
Definition: nbtree.h:631
#define RelationGetDescr(relation)
Definition: rel.h:503
int LOCKMODE
Definition: lockdefs.h:26
BTScanInsert _bt_mkscankey(Relation rel, IndexTuple itup)
Definition: nbtutils.c:90
ItemPointer scantid
Definition: nbtree.h:789
static Page palloc_btree_page(BtreeCheckState *state, BlockNumber blocknum)
uint32 level
#define PointerGetDatum(X)
Definition: postgres.h:600
#define BTREE_VERSION
Definition: nbtree.h:148
void bloom_add_element(bloom_filter *filter, unsigned char *elem, size_t len)
Definition: bloomfilter.c:136
#define TupleDescAttr(tupdesc, i)
Definition: tupdesc.h:92
long random(void)
Definition: random.c:22
static void bt_tuple_present_callback(Relation index, ItemPointer tid, Datum *values, bool *isnull, bool tupleIsAlive, void *checkstate)
char * psprintf(const char *fmt,...)
Definition: psprintf.c:46
#define P_FIRSTDATAKEY(opaque)
Definition: nbtree.h:369
uint32 btm_magic
Definition: nbtree.h:103
Buffer ReadBufferExtended(Relation reln, ForkNumber forkNum, BlockNumber blockNum, ReadBufferMode mode, BufferAccessStrategy strategy)
Definition: bufmgr.c:741
static IndexTuple bt_normalize_tuple(BtreeCheckState *state, IndexTuple itup)
ItemPointerData t_tid
Definition: itup.h:37
static bool bt_pivot_tuple_identical(bool heapkeyspace, IndexTuple itup1, IndexTuple itup2)
#define ItemIdIsUsed(itemId)
Definition: itemid.h:92
static MemoryContext MemoryContextSwitchTo(MemoryContext context)
Definition: palloc.h:109
#define IsolationUsesXactSnapshot()
Definition: xact.h:51
#define P_NONE
Definition: nbtree.h:211
static BlockNumber BTreeTupleGetDownLink(IndexTuple pivot)
Definition: nbtree.h:549
#define AccessShareLock
Definition: lockdefs.h:36
#define BTMaxItemSizeNoHeapTid(page)
Definition: nbtree.h:168
#define InvalidBuffer
Definition: buf.h:25
Oid * ii_ExclusionProcs
Definition: execnodes.h:166
#define P_HAS_GARBAGE(opaque)
Definition: nbtree.h:225
int errcode(int sqlerrcode)
Definition: elog.c:698
TransactionId RecentXmin
Definition: snapmgr.c:113
void MemoryContextReset(MemoryContext context)
Definition: mcxt.c:143
static BTScanInsert bt_right_page_check_scankey(BtreeCheckState *state)
uint32 BlockNumber
Definition: block.h:31
#define P_INCOMPLETE_SPLIT(opaque)
Definition: nbtree.h:226
#define PG_GETARG_BOOL(n)
Definition: fmgr.h:274
IndexInfo * BuildIndexInfo(Relation index)
Definition: index.c:2378
bool smgrexists(SMgrRelation reln, ForkNumber forknum)
Definition: smgr.c:247
#define MaxTIDsPerBTreePage
Definition: nbtree.h:184
Form_pg_class rd_rel
Definition: rel.h:109
unsigned int Oid
Definition: postgres_ext.h:31
bool RecoveryInProgress(void)
Definition: xlog.c:8217
#define ItemIdIsDead(itemId)
Definition: itemid.h:113
#define BTreeTupleGetNAtts(itup, rel)
Definition: nbtree.h:570
BufferAccessStrategy checkstrategy
Definition: verify_nbtree.c:84
Snapshot GetTransactionSnapshot(void)
Definition: snapmgr.c:250
#define OidIsValid(objectId)
Definition: c.h:710
#define PageGetMaxOffsetNumber(page)
Definition: bufpage.h:357
BTPageOpaqueData * BTPageOpaque
Definition: nbtree.h:71
static void bt_downlink_missing_check(BtreeCheckState *state, bool rightsplit, BlockNumber targetblock, Page target)
static TableScanDesc table_beginscan_strat(Relation rel, Snapshot snapshot, int nkeys, struct ScanKeyData *key, bool allow_strat, bool allow_sync)
Definition: tableam.h:907
bloom_filter * filter
signed int int32
Definition: c.h:429
int errdetail_internal(const char *fmt,...)
Definition: elog.c:1069
struct HeapTupleData * rd_indextuple
Definition: rel.h:189
#define P_HAS_FULLXID(opaque)
Definition: nbtree.h:227
uint16 OffsetNumber
Definition: off.h:24
HeapTupleHeader t_data
Definition: htup.h:68
static bool invariant_l_offset(BtreeCheckState *state, BTScanInsert key, OffsetNumber upperbound)
Definition: type.h:89
#define P_ISMETA(opaque)
Definition: nbtree.h:222
static void bt_index_check_internal(Oid indrelid, bool parentcheck, bool heapallindexed, bool rootdescend)
static bool invariant_g_offset(BtreeCheckState *state, BTScanInsert key, OffsetNumber lowerbound)
#define VARATT_IS_EXTERNAL(PTR)
Definition: postgres.h:326
IndexTuple index_form_tuple(TupleDesc tupleDescriptor, Datum *values, bool *isnull)
Definition: indextuple.c:47
#define BT_READ
Definition: nbtree.h:712
#define LSN_FORMAT_ARGS(lsn)
Definition: xlogdefs.h:43
XLogRecPtr targetlsn
Definition: verify_nbtree.c:95
Form_pg_index rd_index
Definition: rel.h:187
BlockNumber btm_fastroot
Definition: nbtree.h:107
#define ItemIdGetLength(itemId)
Definition: itemid.h:59
void pfree(void *pointer)
Definition: mcxt.c:1169
#define BTREE_MAGIC
Definition: nbtree.h:147
void _bt_checkpage(Relation rel, Buffer buf)
Definition: nbtpage.c:794
#define P_ISHALFDEAD(opaque)
Definition: nbtree.h:223
void UnlockReleaseBuffer(Buffer buffer)
Definition: bufmgr.c:3795
#define ERROR
Definition: elog.h:46
static double table_index_build_scan(Relation table_rel, Relation index_rel, struct IndexInfo *index_info, bool allow_sync, bool progress, IndexBuildCallback callback, void *callback_state, TableScanDesc scan)
Definition: tableam.h:1745
#define ALLOCSET_DEFAULT_SIZES
Definition: memutils.h:195
#define DEBUG2
Definition: elog.h:24
static void bt_recheck_sibling_links(BtreeCheckState *state, BlockNumber btpo_prev_from_target, BlockNumber leftcurrent)
#define BTPageGetMeta(p)
Definition: nbtree.h:119
BlockNumber btpo_prev
Definition: nbtree.h:64
uint32 btpo_level
Definition: nbtree.h:66
Datum bt_index_check(PG_FUNCTION_ARGS)
#define PG_GETARG_OID(n)
Definition: fmgr.h:275
static void bt_check_every_level(Relation rel, Relation heaprel, bool heapkeyspace, bool readonly, bool heapallindexed, bool rootdescend)
OffsetNumber _bt_binsrch_insert(Relation rel, BTInsertState insertstate)
Definition: nbtsearch.c:447
BlockNumber leftmost
IndexTupleData * IndexTuple
Definition: itup.h:53
int errdetail(const char *fmt,...)
Definition: elog.c:1042
#define RelationGetRelationName(relation)
Definition: rel.h:511
#define P_LEFTMOST(opaque)
Definition: nbtree.h:217
FormData_pg_attribute * Form_pg_attribute
Definition: pg_attribute.h:207
unsigned int uint32
Definition: c.h:441
#define ItemIdGetOffset(itemId)
Definition: itemid.h:65
TransactionId xmin
Definition: snapshot.h:157
MemoryContext CurrentMemoryContext
Definition: mcxt.c:42
IndexTuple itup
Definition: nbtree.h:809
int32 _bt_compare(Relation rel, BTScanInsert key, Page page, OffsetNumber offnum)
Definition: nbtsearch.c:644
#define BufferGetPage(buffer)
Definition: bufmgr.h:169
static ItemPointer BTreeTupleGetHeapTIDCareful(BtreeCheckState *state, IndexTuple itup, bool nonpivot)
#define BTREE_METAPAGE
Definition: nbtree.h:146
bool pivotsearch
Definition: nbtree.h:788
#define P_ISDELETED(opaque)
Definition: nbtree.h:221
bool TransactionIdPrecedes(TransactionId id1, TransactionId id2)
Definition: transam.c:300
#define P_ISROOT(opaque)
Definition: nbtree.h:220
void _bt_metaversion(Relation rel, bool *heapkeyspace, bool *allequalimage)
Definition: nbtpage.c:736
void UnregisterSnapshot(Snapshot snapshot)
Definition: snapmgr.c:852
#define ERRCODE_DATA_CORRUPTED
Definition: pg_basebackup.c:47
void bloom_free(bloom_filter *filter)
Definition: bloomfilter.c:127
#define PageGetItemId(page, offsetNumber)
Definition: bufpage.h:235
Relation heaprel
Definition: verify_nbtree.c:72
uint32 btm_fastlevel
Definition: nbtree.h:108
static ItemPointer BTreeTupleGetMaxHeapTID(IndexTuple itup)
Definition: nbtree.h:657
static bool invariant_l_nontarget_offset(BtreeCheckState *state, BTScanInsert key, BlockNumber nontargetblock, Page nontarget, OffsetNumber upperbound)
#define ItemIdGetFlags(itemId)
Definition: itemid.h:71
void * palloc0(Size size)
Definition: mcxt.c:1093
uintptr_t Datum
Definition: postgres.h:411
static BTScanInsert bt_mkscankey_pivotsearch(Relation rel, IndexTuple itup)
void LockBuffer(Buffer buffer, int mode)
Definition: bufmgr.c:4011
BlockNumber btm_root
Definition: nbtree.h:105
#define RelationGetNumberOfBlocks(reln)
Definition: bufmgr.h:213
#define BTREE_MIN_VERSION
Definition: nbtree.h:149
#define InvalidOffsetNumber
Definition: off.h:26
void _bt_relbuf(Relation rel, Buffer buf)
Definition: nbtpage.c:1035
#define ereport(elevel,...)
Definition: elog.h:157
int maintenance_work_mem
Definition: globals.c:126
#define BlockNumberIsValid(blockNumber)
Definition: block.h:70
#define NOTICE
Definition: elog.h:37
static ItemPointer BTreeTupleGetPostingN(IndexTuple posting, int n)
Definition: nbtree.h:537
#define PG_RETURN_VOID()
Definition: fmgr.h:349
static bool BTreeTupleIsPosting(IndexTuple itup)
Definition: nbtree.h:485
int errmsg_internal(const char *fmt,...)
Definition: elog.c:996
bool ii_Unique
Definition: execnodes.h:172
#define Max(x, y)
Definition: c.h:980
bool _bt_check_natts(Relation rel, bool heapkeyspace, Page page, OffsetNumber offnum)
Definition: nbtutils.c:2466
static void bt_child_highkey_check(BtreeCheckState *state, OffsetNumber target_downlinkoffnum, Page loaded_child, uint32 target_level)
uint64 XLogRecPtr
Definition: xlogdefs.h:21
BTScanInsert itup_key
Definition: nbtree.h:811
#define Assert(condition)
Definition: c.h:804
Definition: regguts.h:317
#define RELATION_IS_OTHER_TEMP(relation)
Definition: rel.h:631
#define BTreeTupleGetNKeyAtts(itup, rel)
Definition: verify_nbtree.c:50
static void bt_target_page_check(BtreeCheckState *state)
static SMgrRelation RelationGetSmgr(Relation rel)
Definition: rel.h:544
struct BtreeLevel BtreeLevel
bool heapkeyspace
Definition: nbtree.h:784
#define HeapTupleHeaderGetXmin(tup)
Definition: htup_details.h:313
#define INDEX_MAX_KEYS
#define OffsetNumberNext(offsetNumber)
Definition: off.h:52
#define PageGetSpecialPointer(page)
Definition: bufpage.h:326
#define InvalidBlockNumber
Definition: block.h:33
#define MAXALIGN(LEN)
Definition: c.h:757
#define BufferIsValid(bufnum)
Definition: bufmgr.h:123
#define index_getattr(tup, attnum, tupleDesc, isnull)
Definition: itup.h:100
#define ItemPointerGetOffsetNumber(pointer)
Definition: itemptr.h:117
#define PG_NARGS()
Definition: fmgr.h:203
#define IndexTupleHasVarwidths(itup)
Definition: itup.h:73
bool ii_Concurrent
Definition: execnodes.h:174
#define INT64_FORMAT
Definition: c.h:483
#define SnapshotAny
Definition: snapmgr.h:67
double bloom_prop_bits_set(bloom_filter *filter)
Definition: bloomfilter.c:188
static void bt_child_check(BtreeCheckState *state, BTScanInsert targetkey, OffsetNumber downlinkoffnum)
void index_close(Relation relation, LOCKMODE lockmode)
Definition: indexam.c:158
#define PageGetLSN(page)
Definition: bufpage.h:366
#define DatumGetPointer(X)
Definition: postgres.h:593
IndexTuple lowkey
#define BTMaxItemSize(page)
Definition: nbtree.h:162
#define P_HIKEY
Definition: nbtree.h:367
static bool bt_rootdescend(BtreeCheckState *state, IndexTuple itup)
static Datum values[MAXATTR]
Definition: bootstrap.c:166
Oid * ii_ExclusionOps
Definition: execnodes.h:165
#define MaxIndexTuplesPerPage
Definition: itup.h:145
void * palloc(Size size)
Definition: mcxt.c:1062
int errmsg(const char *fmt,...)
Definition: elog.c:909
static ItemId PageGetItemIdCareful(BtreeCheckState *state, BlockNumber block, Page page, OffsetNumber offset)
#define ItemPointerGetBlockNumberNoCheck(pointer)
Definition: itemptr.h:89
void * MemoryContextAlloc(MemoryContext context, Size size)
Definition: mcxt.c:863
uint32 btm_level
Definition: nbtree.h:106
#define elog(elevel,...)
Definition: elog.h:232
#define ShareLock
Definition: lockdefs.h:41
int i
#define OffsetNumberIsValid(offsetNumber)
Definition: off.h:39
bool istruerootlevel
static BlockNumber BTreeTupleGetTopParent(IndexTuple leafhikey)
Definition: nbtree.h:613
static uint16 BTreeTupleGetNPosting(IndexTuple posting)
Definition: nbtree.h:511
#define PG_DETOAST_DATUM(datum)
Definition: fmgr.h:240
#define PG_FUNCTION_ARGS
Definition: fmgr.h:193
static bool offset_is_negative_infinity(BTPageOpaque opaque, OffsetNumber offset)
#define CHECK_FOR_INTERRUPTS()
Definition: miscadmin.h:120
#define ItemPointerGetBlockNumber(pointer)
Definition: itemptr.h:98
#define InvalidBtreeLevel
Definition: verify_nbtree.c:49
unsigned short t_info
Definition: itup.h:49
#define TransactionIdIsValid(xid)
Definition: transam.h:41
PG_FUNCTION_INFO_V1(bt_index_check)
uint16 * ii_ExclusionStrats
Definition: execnodes.h:167
Relation table_open(Oid relationId, LOCKMODE lockmode)
Definition: table.c:39
bool _bt_allequalimage(Relation rel, bool debugmessage)
Definition: nbtutils.c:2692
MemoryContext targetcontext
Definition: verify_nbtree.c:82
int Buffer
Definition: buf.h:23
#define P_RIGHTMOST(opaque)
Definition: nbtree.h:218
BlockNumber prevrightlink
OffsetNumber ip_posid
Definition: itemptr.h:39
Relation index_open(Oid relationId, LOCKMODE lockmode)
Definition: indexam.c:132
BTStack _bt_search(Relation rel, BTScanInsert key, Buffer *bufP, int access, Snapshot snapshot)
Definition: nbtsearch.c:101
#define offsetof(type, field)
Definition: c.h:727
bool bloom_lacks_element(bloom_filter *filter, unsigned char *elem, size_t len)
Definition: bloomfilter.c:158
#define PageGetItem(page, itemId)
Definition: bufpage.h:340
Pointer Page
Definition: bufpage.h:78
#define IndexTupleSize(itup)
Definition: itup.h:71
#define ItemPointerCopy(fromPointer, toPointer)
Definition: itemptr.h:161
static int cmp(const chr *x, const chr *y, size_t len)
Definition: regc_locale.c:747
static IndexTuple bt_posting_plain_tuple(IndexTuple itup, int n)
#define P_ISLEAF(opaque)
Definition: nbtree.h:219
struct BtreeCheckState BtreeCheckState