9.4 wrap around issues

While stress testing the crash-recovery system, I keep running into
wraparound shutdowns that I think should not be occurring. I go out of my
way give autovac a chance to complete every now and then, more often than
it should need to in order to keep up with the xid usage.

I think the problem traces down to the fact that updating
pg_database.datfrozenxid is WAL logged, but
updating ShmemVariableCache->oldestXid is not.

So a crash at just the right time means that the databases no longer think
they need to be vacuumed for wrap around, but the system as a whole thinks
that they do.

Should crash recovery end with the system reading the recovered pg_database
and recomputing ShmemVariableCache->oldestXid ?

I don't know that any non-pathological case could trigger this in
production. But 2^32 is not getting any larger, while maximum common
database throughput and size is.

I bisect this down to f9b50b7c18c8ce7de1fee59409fe2 "Fix removal of files
in pgstats directories". I think that before that commit, the leftover
stats file was somehow tricking the system into vacuuming the databases
more aggressively following a crash.

Cheers,

Jeff