Add restart_after_crash GUC.

Normally, we automatically restart after a backend crash, but in some
cases when PostgreSQL is invoked by clusterware it may be desirable to
suppress this behavior, so we provide an option which does this.
Since no existing GUC group quite fits, create a new group called
"error handling options" for this and the previously undocumented GUC
exit_on_error, which is now documented.

Review by Fujii Masao.

doc/src/sgml/config.sgml

-<!-- $PostgreSQL: pgsql/doc/src/sgml/config.sgml,v 1.297 2010/07/20 00:34:44 rhaas Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/config.sgml,v 1.298 2010/07/20 00:47:52 rhaas Exp $ -->
 
 <chapter Id="runtime-config">
   <title>Server Configuration</title>
@@ -5330,6 +5330,47 @@ dynamic_library_path = 'C:\tools\postgresql;H:\my_project\lib;$libdir'
     </sect2>
    </sect1>
 
+   <sect1 id="runtime-config-error-handling">
+    <title>Error Handling</title>
+
+    <variablelist>
+
+     <varlistentry id="guc-exit-on-error" xreflabel="exit_on_error">
+      <term><varname>exit_on_error</varname> (<type>boolean</type>)</term>
+      <indexterm>
+       <primary><varname>exit_on_error</> configuration parameter</primary>
+      </indexterm>
+      <listitem>
+       <para>
+        If true, any error will terminate the current session.  By default,
+        this is set to false, so that only FATAL errors will terminate the
+        session.
+       </para>
+      </listitem>
+     </varlistentry>
+
+     <varlistentry id="guc-restart-after-crash" xreflabel="restart_after_crash">
+      <term><varname>restart_after_crash</varname> (<type>boolean</type>)</term>
+      <indexterm>
+       <primary><varname>restart_after_crash</> configuration parameter</primary>
+      </indexterm>
+      <listitem>
+       <para>
+        When set to true, which is the default, <productname>PostgreSQL</>
+        will automatically reinitialize after a backend crash.  Leaving this
+        value set to true is normally the best way to maximize the availability
+        of the database.  However, in some circumstances, such as when
+        <productname>PostgreSQL</> is being invoked by clusterware, it may be
+        useful to disable this behavior, so that the clusterware can gain
+        control and take any actions it deems appropriate.
+       </para>
+      </listitem>
+     </varlistentry>
+
+    </variablelist>
+
+   </sect1>
+
    <sect1 id="runtime-config-preset">
     <title>Preset Options</title>
 

src/backend/postmaster/postmaster.c

@@ -37,7 +37,7 @@
  *
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/postmaster/postmaster.c,v 1.614 2010/07/06 19:18:57 momjian Exp $
+ *	  $PostgreSQL: pgsql/src/backend/postmaster/postmaster.c,v 1.615 2010/07/20 00:47:52 rhaas Exp $
  *
  * NOTES
  *
@@ -203,6 +203,7 @@ bool		Db_user_namespace = false;
 
 bool		enable_bonjour = false;
 char	   *bonjour_name;
+bool		restart_after_crash = true;
 
 /* PIDs of special child processes; 0 when not running */
 static pid_t StartupPID = 0,
@@ -3048,12 +3049,13 @@ PostmasterStateMachine(void)
 	}
 
 	/*
-	 * If recovery failed, wait for all non-syslogger children to exit, and
-	 * then exit postmaster. We don't try to reinitialize when recovery fails,
-	 * because more than likely it will just fail again and we will keep
-	 * trying forever.
+	 * If recovery failed, or the user does not want an automatic restart after
+	 * backend crashes, wait for all non-syslogger children to exit, and then
+	 * exit postmaster. We don't try to reinitialize when recovery fails,
+	 * because more than likely it will just fail again and we will keep trying
+	 * forever.
 	 */
-	if (RecoveryError && pmState == PM_NO_CHILDREN)
+	if (pmState == PM_NO_CHILDREN && (RecoveryError || !restart_after_crash))
 		ExitPostmaster(1);
 
 	/*

src/backend/utils/misc/check_guc

@@ -16,7 +16,7 @@
 ## if an option is valid but shows up in only one file (guc.c but not
 ## postgresql.conf.sample), it should be listed here so that it 
 ## can be ignored
-INTENTIONALLY_NOT_INCLUDED="autocommit debug_deadlocks exit_on_error \
+INTENTIONALLY_NOT_INCLUDED="autocommit debug_deadlocks \
 is_superuser lc_collate lc_ctype lc_messages lc_monetary lc_numeric lc_time \
 pre_auth_delay role seed server_encoding server_version server_version_int \
 session_authorization trace_lock_oidmin trace_lock_table trace_locks trace_lwlocks \

src/backend/utils/misc/guc.c

@@ -10,7 +10,7 @@
  * Written by Peter Eisentraut <peter_e@gmx.net>.
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.563 2010/07/20 00:34:44 rhaas Exp $
+ *	  $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.564 2010/07/20 00:47:53 rhaas Exp $
  *
  *--------------------------------------------------------------------
  */
@@ -550,6 +550,8 @@ const char *const config_group_names[] =
 	gettext_noop("Version and Platform Compatibility / Previous PostgreSQL Versions"),
 	/* COMPAT_OPTIONS_CLIENT */
 	gettext_noop("Version and Platform Compatibility / Other Platforms and Clients"),
+	/* ERROR_HANDLING */
+	gettext_noop("Error Handling"),
 	/* PRESET_OPTIONS */
 	gettext_noop("Preset Options"),
 	/* CUSTOM_OPTIONS */
@@ -813,16 +815,24 @@ static struct config_bool ConfigureNamesBool[] =
 #endif
 		assign_debug_assertions, NULL
 	},
+
 	{
-		/* currently undocumented, so don't show in SHOW ALL */
-		{"exit_on_error", PGC_USERSET, UNGROUPED,
-			gettext_noop("No description available."),
-			NULL,
-			GUC_NO_SHOW_ALL | GUC_NOT_IN_SAMPLE
+		{"exit_on_error", PGC_USERSET, ERROR_HANDLING_OPTIONS,
+			gettext_noop("Terminate session on any error."),
+			NULL
 		},
 		&ExitOnAnyError,
 		false, NULL, NULL
 	},
+	{
+		{"restart_after_crash", PGC_SIGHUP, ERROR_HANDLING_OPTIONS,
+			gettext_noop("Reinitialize after backend crash."),
+			NULL
+		},
+		&restart_after_crash,
+		true, NULL, NULL
+	},
+
 	{
 		{"log_duration", PGC_SUSET, LOGGING_WHAT,
 			gettext_noop("Logs the duration of each completed SQL statement."),

src/backend/utils/misc/postgresql.conf.sample

@@ -519,6 +519,14 @@
 #transform_null_equals = off
 
 
+#------------------------------------------------------------------------------
+# ERROR HANDLING
+#------------------------------------------------------------------------------
+
+#exit_on_error = false				# terminate session on any error?
+#restart_after_crash = true			# reinitialize after backend crash?
+
+
 #------------------------------------------------------------------------------
 # CUSTOMIZED OPTIONS
 #------------------------------------------------------------------------------

src/include/postmaster/postmaster.h

@@ -6,7 +6,7 @@
  * Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
  * Portions Copyright (c) 1994, Regents of the University of California
  *
- * $PostgreSQL: pgsql/src/include/postmaster/postmaster.h,v 1.22 2010/01/02 16:58:08 momjian Exp $
+ * $PostgreSQL: pgsql/src/include/postmaster/postmaster.h,v 1.23 2010/07/20 00:47:53 rhaas Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -29,6 +29,7 @@ extern bool Log_connections;
 extern bool log_hostname;
 extern bool enable_bonjour;
 extern char *bonjour_name;
+extern bool restart_after_crash;
 
 #ifdef WIN32
 extern HANDLE PostmasterHandle;

src/include/utils/guc_tables.h

@@ -7,7 +7,7 @@
  *
  * Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
  *
- *	  $PostgreSQL: pgsql/src/include/utils/guc_tables.h,v 1.49 2010/06/15 07:52:11 itagaki Exp $
+ *	  $PostgreSQL: pgsql/src/include/utils/guc_tables.h,v 1.50 2010/07/20 00:47:53 rhaas Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -80,6 +80,7 @@ enum config_group
 	COMPAT_OPTIONS,
 	COMPAT_OPTIONS_PREVIOUS,
 	COMPAT_OPTIONS_CLIENT,
+	ERROR_HANDLING_OPTIONS,
 	PRESET_OPTIONS,
 	CUSTOM_OPTIONS,
 	DEVELOPER_OPTIONS