> Because I think turning an elog(ERROR) into a system-wide crash is
> not a good idea ;-).  If you are correct that this behavior 
> is necessary for WAL-related critical sections, then indeed we need
> two kinds of critical sections, one that just holds off cancel/die
> response and one that turns elog(ERROR) into a dangerous weapon.
> I'm going to wait and see Vadim's response before I do anything ...

I've tried to move "dangerous" ops with non-zero probability of
elog(ERROR) (eg new file block allocation) out of crit sections.
Anyway we need in ERROR-->STOP for safety when changes aren't logged.

Vadim

Tue, 16 Jan 2001 09:28:45 -0800
"Mikheev, Vadim" <vmikheev@SECTORBASE.COM>
RE: SIGTERM -> elog(FATAL) -> proc_exit() is probably a
	 bad idea
"Mikheev, Vadim" <vmikheev@SECTORBASE.COM> writes:
>> Because I think turning an elog(ERROR) into a system-wide crash is
>> not a good idea ;-).  If you are correct that this behavior 
>> is necessary for WAL-related critical sections, then indeed we need
>> two kinds of critical sections, one that just holds off cancel/die
>> response and one that turns elog(ERROR) into a dangerous weapon.
>> I'm going to wait and see Vadim's response before I do anything ...

> I've tried to move "dangerous" ops with non-zero probability of
> elog(ERROR) (eg new file block allocation) out of crit sections.
> Anyway we need in ERROR-->STOP for safety when changes aren't logged.

Why is that safer than just treating an ERROR as an ERROR?  It seems to
me there's a real risk of a crash/restart loop if we force a restart
whenever we see an xlog-related problem.

			regards, tom lane

Tue, 16 Jan 2001 12:38:58 -0500
Tom Lane <tgl@sss.pgh.pa.us>
Re: SIGTERM -> elog(FATAL) -> proc_exit() is probably a bad idea 