More fixes for shutdown during recovery.

1. If we receive a fast shutdown request while in the PM_STARTUP state,
process it just as we would in PM_RECOVERY, PM_HOT_STANDBY, or PM_RUN.
Without this change, an early fast shutdown followed by Hot Standby causes
the database to get stuck in a state where a shutdown is pending (so no new
connections are allowed) but the shutdown request is never processed unless
we end Hot Standby and enter normal running.

2. Avoid removing the backup label file when a smart or fast shutdown occurs
during recovery.  It makes sense to do this once we've reached normal running,
since we must be taking a backup which now won't be valid.  But during
recovery we must be recovering from a previously taken backup, and any backup
label file is needed to restart recovery from the right place.

Fujii Masao and Robert Haas

src/backend/postmaster/postmaster.c

@@ -37,7 +37,7 @@
  *
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/postmaster/postmaster.c,v 1.608 2010/05/15 20:01:32 rhaas Exp $
+ *	  $PostgreSQL: pgsql/src/backend/postmaster/postmaster.c,v 1.609 2010/05/26 12:32:41 rhaas Exp $
  *
  * NOTES
  *
@@ -287,6 +287,8 @@ typedef enum
 
 static PMState pmState = PM_INIT;
 
+static bool ReachedNormalRunning = false;	/* T if we've reached PM_RUN */
+
 bool		ClientAuthInProgress = false;		/* T during new-client
 												 * authentication */
 
@@ -2168,7 +2170,7 @@ pmdie(SIGNAL_ARGS)
 					(errmsg("received smart shutdown request")));
 
 			if (pmState == PM_RUN || pmState == PM_RECOVERY ||
-				pmState == PM_HOT_STANDBY)
+				pmState == PM_HOT_STANDBY || pmState == PM_STARTUP)
 			{
 				/* autovacuum workers are told to shut down immediately */
 				SignalAutovacWorkers(SIGTERM);
@@ -2370,6 +2372,7 @@ reaper(SIGNAL_ARGS)
 			 * Startup succeeded, commence normal operations
 			 */
 			FatalError = false;
+			ReachedNormalRunning = true;
 			pmState = PM_RUN;
 
 			/*
@@ -3028,8 +3031,14 @@ PostmasterStateMachine(void)
 		{
 			/*
 			 * Terminate backup mode to avoid recovery after a clean fast
-			 * shutdown.
-			 */
+			 * shutdown.  Since a backup can only be taken during normal
+			 * running (and not, for example, while running under Hot Standby)
+			 * it only makes sense to do this if we reached normal running.
+			 * If we're still in recovery, the backup file is one we're
+			 * recovering *from*, and we must keep it around so that recovery
+			 * restarts from the right place.
+			 */
+			if (ReachedNormalRunning)
 				CancelBackup();
 
 			/* Normal exit from the postmaster is here */