Failure while inserting parent tuple to B-tree is not fun

diff --git a/src/backend/access/nbtree/README b/src/backend/access/nbtree/README
index 40f09e3..29d8bd1 100644
--- a/src/backend/access/nbtree/README
+++ b/src/backend/access/nbtree/README
@@ -384,12 +384,41 @@ an additional insertion above that, etc).
 For a root split, the followon WAL entry is a "new root" entry rather than
 an "insertion" entry, but details are otherwise much the same.
 
-Because insertion involves multiple atomic actions, the WAL replay logic
-has to detect the case where a page split isn't followed by a matching
-insertion on the parent level, and then do that insertion on its own (and
-recursively for any subsequent parent insertion, of course).  This is
-feasible because the WAL entry for the split contains enough info to know
-what must be inserted in the parent level.
+Because insertion involves multiple atomic actions, it's possible that the
+system crashes between splitting a page and inserting the downlink for the
+new half to the parent. After recovery, the downlink for the new page will
+be missing. The search algorithm works correctly, as the page will be found
+by following the right-link from its left sibling, although if a lot of
+downlinks in the tree are missing, performance will suffer. A more serious
+consequence is that if the page without a downlink gets split again, the
+insertion algorithm will fail to find the location in the parent level to
+insert the downlink.
+
+Our approach is to create any missing downlinks along the way, when
+searching the tree for a new insertion. It could be done during searches,
+too, but it seems best not to put any extra writes in what would otherwise
+be a read-only operation (it would not be possible in hot standby mode
+anyway). To identify missing downlinks, when a page is split, the left page
+is flagged to indicate that the split is not yet complete (INCOMPLETE_SPLIT).
+When the downlink is inserted to the parent, the flag is atomically cleared.
+The child page is kept locked until the insertion in the parent is finished
+and the flag in the child cleared, but can be released immediately after
+that, before recursing up the tree, if the parent also needs to be split.
+That ensures that incompletely split pages should not be seen under normal
+circumstances; only when a transaction fails to insert the parent for some
+reason.
+
+We flag the left page, even though it's the right page that's missing the
+downlink, beacuse it's more convenient to know already when following the
+right-link from the left page to the right page that it will need to have
+its downlink inserted to the parent.
+
+We used to keep track of incomplete splits during recovery and finish them
+immediately at end of recovery, instead of doing it lazily at the next
+insertion. However, that made the recovery much more complicated, and only
+fixed the problem when crash recovery was performed. An incomplete split can
+also occur if an otherwise recoverable error, like out-of-memory or
+out-of-disk-space, happens while inserting the downlink to the parent.
 
 When splitting a non-root page that is alone on its level, the required
 metapage update (of the "fast root" link) is performed and logged as part
diff --git a/src/backend/access/nbtree/nbtinsert.c b/src/backend/access/nbtree/nbtinsert.c
index a452fea..a810015 100644
--- a/src/backend/access/nbtree/nbtinsert.c
+++ b/src/backend/access/nbtree/nbtinsert.c
@@ -59,14 +59,16 @@ static void _bt_findinsertloc(Relation rel,
 				  ScanKey scankey,
 				  IndexTuple newtup,
 				  Relation heapRel);
-static void _bt_insertonpg(Relation rel, Buffer buf,
+static void _bt_insertonpg(Relation rel, Buffer buf, Buffer cbuf,
 			   BTStack stack,
 			   IndexTuple itup,
 			   OffsetNumber newitemoff,
 			   bool split_only_page);
-static Buffer _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
-		  OffsetNumber newitemoff, Size newitemsz,
+static Buffer _bt_split(Relation rel, Buffer buf, Buffer cbuf,
+		  OffsetNumber firstright, OffsetNumber newitemoff, Size newitemsz,
 		  IndexTuple newitem, bool newitemonleft);
+static void _bt_insert_parent(Relation rel, Buffer buf, Buffer rbuf,
+				  BTStack stack, bool is_root, bool is_only);
 static OffsetNumber _bt_findsplitloc(Relation rel, Page page,
 				 OffsetNumber newitemoff,
 				 Size newitemsz,
@@ -130,7 +132,8 @@ top:
 	 * move right in the tree.	See Lehman and Yao for an excruciatingly
 	 * precise description.
 	 */
-	buf = _bt_moveright(rel, buf, natts, itup_scankey, false, BT_WRITE);
+	buf = _bt_moveright(rel, buf, natts, itup_scankey, false,
+						true, stack, BT_WRITE);
 
 	/*
 	 * If we're not allowing duplicates, make sure the key isn't already in
@@ -184,7 +187,7 @@ top:
 		CheckForSerializableConflictIn(rel, NULL, buf);
 		/* do the insertion */
 		_bt_findinsertloc(rel, &buf, &offset, natts, itup_scankey, itup, heapRel);
-		_bt_insertonpg(rel, buf, stack, itup, offset, false);
+		_bt_insertonpg(rel, buf, InvalidBuffer, stack, itup, offset, false);
 	}
 	else
 	{
@@ -664,6 +667,10 @@ _bt_findinsertloc(Relation rel,
  *		insertion, and the buffer must be pinned and write-locked.	On return,
  *		we will have dropped both the pin and the lock on the buffer.
  *
+ *		When inserting to a non-leaf page, 'cbuf' is the left-sibling of the
+ *		page we're inserting the downlink for. This function will clear the
+ *		INCOMPLETE_SPLIT flag on it, and release the buffer.
+ *
  *		The locking interactions in this code are critical.  You should
  *		grok Lehman and Yao's paper before making any changes.  In addition,
  *		you need to understand how we disambiguate duplicate keys in this
@@ -677,6 +684,7 @@ _bt_findinsertloc(Relation rel,
 static void
 _bt_insertonpg(Relation rel,
 			   Buffer buf,
+			   Buffer cbuf,
 			   BTStack stack,
 			   IndexTuple itup,
 			   OffsetNumber newitemoff,
@@ -690,6 +698,11 @@ _bt_insertonpg(Relation rel,
 	page = BufferGetPage(buf);
 	lpageop = (BTPageOpaque) PageGetSpecialPointer(page);
 
+	/* the caller should've finished any incomplete splits already */
+	if (P_INCOMPLETE_SPLIT(lpageop))
+		elog(ERROR, "cannot insert to incompletely-split page %u",
+			 BufferGetBlockNumber(buf));
+
 	itemsz = IndexTupleDSize(*itup);
 	itemsz = MAXALIGN(itemsz);	/* be safe, PageAddItem will do this but we
 								 * need to be consistent */
@@ -714,7 +727,7 @@ _bt_insertonpg(Relation rel,
 									  &newitemonleft);
 
 		/* split the buffer into left and right halves */
-		rbuf = _bt_split(rel, buf, firstright,
+		rbuf = _bt_split(rel, buf, cbuf, firstright,
 						 newitemoff, itemsz, itup, newitemonleft);
 		PredicateLockPageSplit(rel,
 							   BufferGetBlockNumber(buf),
@@ -788,15 +801,25 @@ _bt_insertonpg(Relation rel,
 			MarkBufferDirty(metabuf);
 		}
 
+		/* clear INCOMPLETE_SPLIT flag on child if this finishes a split */
+		if (!P_ISLEAF(lpageop))
+		{
+			Page		cpage = BufferGetPage(cbuf);
+			BTPageOpaque cpageop = (BTPageOpaque) PageGetSpecialPointer(cpage);
+			Assert(P_INCOMPLETE_SPLIT(cpageop));
+			cpageop->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+			MarkBufferDirty(cbuf);
+		}
+
 		/* XLOG stuff */
 		if (RelationNeedsWAL(rel))
 		{
 			xl_btree_insert xlrec;
-			BlockNumber xldownlink;
+			BlockNumber xlleftchild;
 			xl_btree_metadata xlmeta;
 			uint8		xlinfo;
 			XLogRecPtr	recptr;
-			XLogRecData rdata[4];
+			XLogRecData rdata[5];
 			XLogRecData *nextrdata;
 			IndexTupleData trunctuple;
 
@@ -812,12 +835,15 @@ _bt_insertonpg(Relation rel,
 				xlinfo = XLOG_BTREE_INSERT_LEAF;
 			else
 			{
-				xldownlink = ItemPointerGetBlockNumber(&(itup->t_tid));
-				Assert(ItemPointerGetOffsetNumber(&(itup->t_tid)) == P_HIKEY);
-
-				nextrdata->data = (char *) &xldownlink;
+				/*
+				 * Include the block number of the left child, whose
+				 * INCOMPLETE_SPLIT flag is cleared.
+				 */
+				xlleftchild = BufferGetBlockNumber(cbuf);
+				nextrdata->data = (char *) &xlleftchild;
 				nextrdata->len = sizeof(BlockNumber);
-				nextrdata->buffer = InvalidBuffer;
+				nextrdata->buffer = cbuf;
+				nextrdata->buffer_std = true;
 				nextrdata->next = nextrdata + 1;
 				nextrdata++;
 
@@ -870,6 +896,8 @@ _bt_insertonpg(Relation rel,
 		END_CRIT_SECTION();
 
 		/* release buffers; send out relcache inval if metapage changed */
+		if (!P_ISLEAF(lpageop))
+			_bt_relbuf(rel, cbuf);
 		if (BufferIsValid(metabuf))
 		{
 			if (!InRecovery)
@@ -889,11 +917,15 @@ _bt_insertonpg(Relation rel,
  *		new right page.  newitemoff etc. tell us about the new item that
  *		must be inserted along with the data from the old page.
  *
+ *		When splitting a non-leaf page, 'cbuf' is the left-sibling of the
+ *		page we're inserting the downlink for. This function will clear the
+ *		INCOMPLETE_SPLIT flag on it, and release the buffer.
+ *
  *		Returns the new right sibling of buf, pinned and write-locked.
  *		The pin and lock on buf are maintained.
  */
 static Buffer
-_bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
+_bt_split(Relation rel, Buffer buf, Buffer cbuf, OffsetNumber firstright,
 		  OffsetNumber newitemoff, Size newitemsz, IndexTuple newitem,
 		  bool newitemonleft)
 {
@@ -961,6 +993,8 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 	lopaque->btpo_flags = oopaque->btpo_flags;
 	lopaque->btpo_flags &= ~(BTP_ROOT | BTP_SPLIT_END | BTP_HAS_GARBAGE);
 	ropaque->btpo_flags = lopaque->btpo_flags;
+	/* set flag in left page indicating that the right page has no downlink */
+	lopaque->btpo_flags |= BTP_INCOMPLETE_SPLIT;
 	lopaque->btpo_prev = oopaque->btpo_prev;
 	lopaque->btpo_next = rightpagenumber;
 	ropaque->btpo_prev = origpagenumber;
@@ -1184,6 +1218,18 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 		MarkBufferDirty(sbuf);
 	}
 
+	/*
+	 * Clear INCOMPLETE_SPLIT flag on child if inserting the new item finishes
+	 * a split.
+	 */
+	if (ropaque->btpo.level > 0)
+	{
+		Page		cpage = BufferGetPage(cbuf);
+		BTPageOpaque cpageop = (BTPageOpaque) PageGetSpecialPointer(cpage);
+		cpageop->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+		MarkBufferDirty(cbuf);
+	}
+
 	/* XLOG stuff */
 	if (RelationNeedsWAL(rel))
 	{
@@ -1206,34 +1252,6 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 
 		lastrdata = &rdata[0];
 
-		if (ropaque->btpo.level > 0)
-		{
-			/* Log downlink on non-leaf pages */
-			lastrdata->next = lastrdata + 1;
-			lastrdata++;
-
-			lastrdata->data = (char *) &newitem->t_tid.ip_blkid;
-			lastrdata->len = sizeof(BlockIdData);
-			lastrdata->buffer = InvalidBuffer;
-
-			/*
-			 * We must also log the left page's high key, because the right
-			 * page's leftmost key is suppressed on non-leaf levels.  Show it
-			 * as belonging to the left page buffer, so that it is not stored
-			 * if XLogInsert decides it needs a full-page image of the left
-			 * page.
-			 */
-			lastrdata->next = lastrdata + 1;
-			lastrdata++;
-
-			itemid = PageGetItemId(origpage, P_HIKEY);
-			item = (IndexTuple) PageGetItem(origpage, itemid);
-			lastrdata->data = (char *) item;
-			lastrdata->len = MAXALIGN(IndexTupleSize(item));
-			lastrdata->buffer = buf;	/* backup block 1 */
-			lastrdata->buffer_std = true;
-		}
-
 		/*
 		 * Log the new item and its offset, if it was inserted on the left
 		 * page. (If it was put on the right page, we don't need to explicitly
@@ -1260,17 +1278,40 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 			lastrdata->buffer = buf;	/* backup block 1 */
 			lastrdata->buffer_std = true;
 		}
-		else if (ropaque->btpo.level == 0)
+
+		/* Log left page */
+		if (ropaque->btpo.level > 0)
 		{
+			lastrdata->next = lastrdata + 1;
+			lastrdata++;
+
 			/*
-			 * Although we don't need to WAL-log the new item, we still need
-			 * XLogInsert to consider storing a full-page image of the left
-			 * page, so make an empty entry referencing that buffer. This also
-			 * ensures that the left page is always backup block 1.
+			 * We must also log the left page's high key, because the right
+			 * page's leftmost key is suppressed on non-leaf levels.  Show it
+			 * as belonging to the left page buffer, so that it is not stored
+			 * if XLogInsert decides it needs a full-page image of the left
+			 * page.
 			 */
+			itemid = PageGetItemId(origpage, P_HIKEY);
+			item = (IndexTuple) PageGetItem(origpage, itemid);
+			lastrdata->data = (char *) item;
+			lastrdata->len = MAXALIGN(IndexTupleSize(item));
+			lastrdata->buffer = buf;	/* backup block 1 */
+			lastrdata->buffer_std = true;
+		}
+
+		if (ropaque->btpo.level == 0 && !newitemonleft)
+		{
 			lastrdata->next = lastrdata + 1;
 			lastrdata++;
 
+			/*
+			 * Although we don't need to WAL-log anything on the left page,
+			 * the new item, we still need XLogInsert to consider storing a
+			 * full-page image of the left page, so make an empty entry
+			 * referencing that buffer. This also ensures that the left page
+			 * is always backup block 1.
+			 */
 			lastrdata->data = NULL;
 			lastrdata->len = 0;
 			lastrdata->buffer = buf;	/* backup block 1 */
@@ -1278,6 +1319,22 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 		}
 
 		/*
+		 * Log block number of left child, whose INCOMPLETE_SPLIT flag this
+		 * insertion clears.
+		 */
+		if (ropaque->btpo.level > 0)
+		{
+			BlockNumber cblkno = BufferGetBlockNumber(cbuf);
+			lastrdata->next = lastrdata + 1;
+			lastrdata++;
+
+			lastrdata->data = (char *) &cblkno;
+			lastrdata->len = sizeof(BlockNumber);
+			lastrdata->buffer = cbuf;	/* backup block 2 */
+			lastrdata->buffer_std = true;
+		}
+
+		/*
 		 * Log the contents of the right page in the format understood by
 		 * _bt_restore_page(). We set lastrdata->buffer to InvalidBuffer,
 		 * because we're going to recreate the whole page anyway, so it should
@@ -1306,7 +1363,7 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 
 			lastrdata->data = NULL;
 			lastrdata->len = 0;
-			lastrdata->buffer = sbuf;	/* backup block 2 */
+			lastrdata->buffer = sbuf;	/* bkp block 2 (leaf) or 3 (non-leaf) */
 			lastrdata->buffer_std = true;
 		}
 
@@ -1333,6 +1390,10 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 	if (!P_RIGHTMOST(ropaque))
 		_bt_relbuf(rel, sbuf);
 
+	/* release the child */
+	if (ropaque->btpo.level > 0)
+		_bt_relbuf(rel, cbuf);
+
 	/* split's done */
 	return rbuf;
 }
@@ -1603,10 +1664,8 @@ _bt_checksplitloc(FindSplitData *state,
  *			have to be efficient (concurrent ROOT split, WAL recovery)
  * is_root - we split the true root
  * is_only - we split a page alone on its level (might have been fast root)
- *
- * This is exported so it can be called by nbtxlog.c.
  */
-void
+static void
 _bt_insert_parent(Relation rel,
 				  Buffer buf,
 				  Buffer rbuf,
@@ -1685,12 +1744,13 @@ _bt_insert_parent(Relation rel,
 		 * 05/27/97
 		 */
 		ItemPointerSet(&(stack->bts_btentry.t_tid), bknum, P_HIKEY);
-
 		pbuf = _bt_getstackbuf(rel, stack, BT_WRITE);
 
-		/* Now we can unlock the children */
+		/*
+		 * Now we can unlock the right child. The left child will be unlocked
+		 * by _bt_insertonpg().
+		 */
 		_bt_relbuf(rel, rbuf);
-		_bt_relbuf(rel, buf);
 
 		/* Check for error only after writing children */
 		if (pbuf == InvalidBuffer)
@@ -1698,7 +1758,7 @@ _bt_insert_parent(Relation rel,
 				 RelationGetRelationName(rel), bknum, rbknum);
 
 		/* Recursively update the parent */
-		_bt_insertonpg(rel, pbuf, stack->bts_parent,
+		_bt_insertonpg(rel, pbuf, buf, stack->bts_parent,
 					   new_item, stack->bts_offset + 1,
 					   is_only);
 
@@ -1708,6 +1768,56 @@ _bt_insert_parent(Relation rel,
 }
 
 /*
+ * _bt_finish_split() -- Finish an incomplete split
+ *
+ * 'lbuf' is the left buffer whose right sibling is missing the downlink.
+ * On entry, we hold write-lock on it, and the lock is released on exit.
+ */
+void
+_bt_finish_split(Relation rel, Buffer lbuf, BTStack stack)
+{
+	Page		lpage = BufferGetPage(lbuf);
+	BTPageOpaque lpageop = (BTPageOpaque) PageGetSpecialPointer(lpage);
+	Buffer		rbuf;
+	Page		rpage;
+	BTPageOpaque rpageop;
+	bool		was_root;
+	bool		was_only;
+
+	/* Lock the right sibling, the one missing the downlink */
+	rbuf = _bt_getbuf(rel, lpageop->btpo_next, BT_WRITE);
+	rpage = BufferGetPage(rbuf);
+	rpageop = (BTPageOpaque) PageGetSpecialPointer(rpage);
+
+	/* Could this be a root split? */
+	if (!stack)
+	{
+		Buffer		metabuf;
+		Page		metapg;
+		BTMetaPageData *metad;
+
+		/* acquire lock on the metapage */
+		metabuf = _bt_getbuf(rel, BTREE_METAPAGE, BT_WRITE);
+		metapg = BufferGetPage(metabuf);
+		metad = BTPageGetMeta(metapg);
+
+		was_root = (metad->btm_root == BufferGetBlockNumber(lbuf));
+
+		_bt_relbuf(rel, metabuf);
+	}
+	else
+		was_root = false;
+
+	/* Was this the only page on the level before split? */
+	was_only = (P_LEFTMOST(lpageop) && P_RIGHTMOST(rpageop));
+
+	elog(DEBUG1, "finishing incomplete split of %u/%u",
+		 BufferGetBlockNumber(lbuf), BufferGetBlockNumber(rbuf));
+
+	_bt_insert_parent(rel, lbuf, rbuf, stack, was_root, was_only);
+}
+
+/*
  *	_bt_getstackbuf() -- Walk back up the tree one step, and find the item
  *						 we last looked at in the parent.
  *
@@ -1843,6 +1953,7 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 				rbkno;
 	BlockNumber rootblknum;
 	BTPageOpaque rootopaque;
+	BTPageOpaque lopaque;
 	ItemId		itemid;
 	IndexTuple	item;
 	Size		itemsz;
@@ -1854,6 +1965,7 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 	lbkno = BufferGetBlockNumber(lbuf);
 	rbkno = BufferGetBlockNumber(rbuf);
 	lpage = BufferGetPage(lbuf);
+	lopaque = (BTPageOpaque) PageGetSpecialPointer(lpage);
 
 	/* get a new root page */
 	rootbuf = _bt_getbuf(rel, P_NEW, BT_WRITE);
@@ -1927,6 +2039,11 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 			 BufferGetBlockNumber(lbuf), RelationGetRelationName(rel));
 	pfree(new_item);
 
+	/* Clear the incomplete-split flag in the left child */
+	Assert(P_INCOMPLETE_SPLIT(lopaque));
+	lopaque->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+	MarkBufferDirty(lbuf);
+
 	MarkBufferDirty(rootbuf);
 	MarkBufferDirty(metabuf);
 
@@ -1935,7 +2052,7 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 	{
 		xl_btree_newroot xlrec;
 		XLogRecPtr	recptr;
-		XLogRecData rdata[2];
+		XLogRecData rdata[3];
 
 		xlrec.node = rel->rd_node;
 		xlrec.rootblk = rootblknum;
@@ -1954,7 +2071,13 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 		rdata[1].len = ((PageHeader) rootpage)->pd_special -
 			((PageHeader) rootpage)->pd_upper;
 		rdata[1].buffer = InvalidBuffer;
-		rdata[1].next = NULL;
+		rdata[1].next = &(rdata[2]);
+
+		/* Make a full-page image of the left child if needed */
+		rdata[2].data = NULL;
+		rdata[2].len = 0;
+		rdata[2].buffer = lbuf;
+		rdata[2].next = NULL;
 
 		recptr = XLogInsert(RM_BTREE_ID, XLOG_BTREE_NEWROOT, rdata);
 
diff --git a/src/backend/access/nbtree/nbtpage.c b/src/backend/access/nbtree/nbtpage.c
index f407753..cbbfc1d 100644
--- a/src/backend/access/nbtree/nbtpage.c
+++ b/src/backend/access/nbtree/nbtpage.c
@@ -992,8 +992,15 @@ _bt_parent_deletion_safe(Relation rel, BlockNumber target, BTStack stack)
 	ItemPointerSet(&(stack->bts_btentry.t_tid), target, P_HIKEY);
 	pbuf = _bt_getstackbuf(rel, stack, BT_READ);
 	if (pbuf == InvalidBuffer)
-		elog(ERROR, "failed to re-find parent key in index \"%s\" for deletion target page %u",
+	{
+		/*
+		 * If the target page's left sibling was incompletely split, it
+		 * has no downlink in the parent. Bail out.
+		 */
+		elog(DEBUG1, "failed to re-find parent key in index \"%s\" for deletion target page %u",
 			 RelationGetRelationName(rel), target);
+		return false;
+	}
 	parent = stack->bts_blkno;
 	poffset = stack->bts_offset;
 
@@ -1094,11 +1101,16 @@ _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
 	/*
 	 * We can never delete rightmost pages nor root pages.	While at it, check
 	 * that page is not already deleted and is empty.
+	 *
+	 * Also don't delete a page that was incompletely split. We could handle
+	 * that case, but it would complicate the logic, and incomplete splits are
+	 * rare.
 	 */
 	page = BufferGetPage(buf);
 	opaque = (BTPageOpaque) PageGetSpecialPointer(page);
 	if (P_RIGHTMOST(opaque) || P_ISROOT(opaque) || P_ISDELETED(opaque) ||
-		P_FIRSTDATAKEY(opaque) <= PageGetMaxOffsetNumber(page))
+		P_FIRSTDATAKEY(opaque) <= PageGetMaxOffsetNumber(page) ||
+		P_INCOMPLETE_SPLIT(opaque))
 	{
 		/* Should never fail to delete a half-dead page */
 		Assert(!P_ISHALFDEAD(opaque));
@@ -1223,6 +1235,19 @@ _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
 			page = BufferGetPage(lbuf);
 			opaque = (BTPageOpaque) PageGetSpecialPointer(page);
 		}
+
+		/*
+		 * If the left sibling was incompletely split, and therefore the target
+		 * page has no downlink in the parent, give up. We could handle this
+		 * case - in fact deleting a page that has no downlink would probably
+		 * be simpler than the general case, as the parent doesn't need to be
+		 * updated. But incomplete splits are rare.
+		 */
+		if (P_INCOMPLETE_SPLIT(opaque))
+		{
+			_bt_relbuf(rel, lbuf);
+			return 0;
+		}
 	}
 	else
 		lbuf = InvalidBuffer;
@@ -1242,7 +1267,8 @@ _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
 	 * didn't have it locked; the others are just for paranoia's sake.
 	 */
 	if (P_RIGHTMOST(opaque) || P_ISROOT(opaque) || P_ISDELETED(opaque) ||
-		P_FIRSTDATAKEY(opaque) <= PageGetMaxOffsetNumber(page))
+		P_FIRSTDATAKEY(opaque) <= PageGetMaxOffsetNumber(page) ||
+		P_INCOMPLETE_SPLIT(opaque))
 	{
 		_bt_relbuf(rel, buf);
 		if (BufferIsValid(lbuf))
diff --git a/src/backend/access/nbtree/nbtsearch.c b/src/backend/access/nbtree/nbtsearch.c
index ac98589..a85b5ee 100644
--- a/src/backend/access/nbtree/nbtsearch.c
+++ b/src/backend/access/nbtree/nbtsearch.c
@@ -51,7 +51,9 @@ static bool _bt_endpoint(IndexScanDesc scan, ScanDirection dir);
  * NOTE that the returned buffer is read-locked regardless of the access
  * parameter.  However, access = BT_WRITE will allow an empty root page
  * to be created and returned.	When access = BT_READ, an empty index
- * will result in *bufP being set to InvalidBuffer.
+ * will result in *bufP being set to InvalidBuffer. Also, in BT_WRITE mode,
+ * any incomplete splits encountered during the search will be finished by
+ * inserting the missing downlinks.
  */
 BTStack
 _bt_search(Relation rel, int keysz, ScanKey scankey, bool nextkey,
@@ -82,8 +84,13 @@ _bt_search(Relation rel, int keysz, ScanKey scankey, bool nextkey,
 		 * Race -- the page we just grabbed may have split since we read its
 		 * pointer in the parent (or metapage).  If it has, we may need to
 		 * move right to its new sibling.  Do that.
+		 *
+		 * In write-mode, allow _bt_moveright to finish any incomplete splits
+		 * along the way.
 		 */
-		*bufP = _bt_moveright(rel, *bufP, keysz, scankey, nextkey, BT_READ);
+		*bufP = _bt_moveright(rel, *bufP, keysz, scankey, nextkey,
+							  (access == BT_WRITE), stack_in,
+							  BT_READ);
 
 		/* if this is a leaf page, we're done */
 		page = BufferGetPage(*bufP);
@@ -148,6 +155,11 @@ _bt_search(Relation rel, int keysz, ScanKey scankey, bool nextkey,
  * item >= scankey.  When nextkey is true, we are looking for the first
  * item strictly greater than scankey.
  *
+ * If finishsplits is true, we will attempt to finish any incompletely split
+ * pages that we encounter. This is required when searching for a target page
+ * for an insertion, because the split algorithm will fail if it cannot find
+ * the downlink of a page. 'stack' is only used if finishsplits is true.
+ *
  * On entry, we have the buffer pinned and a lock of the type specified by
  * 'access'.  If we move right, we release the buffer and lock and acquire
  * the same on the right sibling.  Return value is the buffer we stop at.
@@ -158,11 +170,14 @@ _bt_moveright(Relation rel,
 			  int keysz,
 			  ScanKey scankey,
 			  bool nextkey,
+			  bool finishsplits,
+			  BTStack stack,
 			  int access)
 {
 	Page		page;
 	BTPageOpaque opaque;
 	int32		cmpval;
+	int			curaccess = access;
 
 	page = BufferGetPage(buf);
 	opaque = (BTPageOpaque) PageGetSpecialPointer(page);
@@ -186,12 +201,41 @@ _bt_moveright(Relation rel,
 
 	while (!P_RIGHTMOST(opaque) &&
 		   (P_IGNORE(opaque) ||
-			_bt_compare(rel, keysz, scankey, page, P_HIKEY) >= cmpval))
+			_bt_compare(rel, keysz, scankey, page, P_HIKEY) >= cmpval ||
+			(finishsplits && P_INCOMPLETE_SPLIT(opaque))))
 	{
-		/* step right one page */
-		BlockNumber rblkno = opaque->btpo_next;
+		BlockNumber blkno;
+		int			needaccess = access;
+
+		/*
+		 * Finish any incomplete splits we encounter along the way.
+		 */
+		if (finishsplits && P_INCOMPLETE_SPLIT(opaque))
+		{
+			blkno = BufferGetBlockNumber(buf);
+			if (curaccess == BT_READ)
+			{
+				/* re-acquire in write-mode, and recheck */
+				needaccess = BT_WRITE;
+			}
+			else
+			{
+				_bt_finish_split(rel, buf, stack);
+				/*
+				 * the buffer was released by _bt_finish_split, we will
+				 * re-acquire it in the right mode below.
+				 */
+				buf = InvalidBuffer;
+			}
+		}
+		else
+		{
+			/* step right one page */
+			blkno = opaque->btpo_next;
+		}
 
-		buf = _bt_relandgetbuf(rel, buf, rblkno, access);
+		buf = _bt_relandgetbuf(rel, buf, blkno, needaccess);
+		curaccess = needaccess;
 		page = BufferGetPage(buf);
 		opaque = (BTPageOpaque) PageGetSpecialPointer(page);
 	}
diff --git a/src/backend/access/nbtree/nbtxlog.c b/src/backend/access/nbtree/nbtxlog.c
index cb5867e..c934a5e 100644
--- a/src/backend/access/nbtree/nbtxlog.c
+++ b/src/backend/access/nbtree/nbtxlog.c
@@ -21,77 +21,29 @@
 #include "miscadmin.h"
 
 /*
- * We must keep track of expected insertions due to page splits, and apply
- * them manually if they are not seen in the WAL log during replay.  This
- * makes it safe for page insertion to be a multiple-WAL-action process.
- *
- * Similarly, deletion of an only child page and deletion of its parent page
+ * Deletion of an only child page and deletion of its parent page
  * form multiple WAL log entries, and we have to be prepared to follow through
- * with the deletion if the log ends between.
+ * with the deletion if the log ends between. Keep track of those actions,
  *
  * The data structure is a simple linked list --- this should be good enough,
- * since we don't expect a page split or multi deletion to remain incomplete
+ * since we don't expect a multi deletion to remain incomplete
  * for long.  In any case we need to respect the order of operations.
  */
 typedef struct bt_incomplete_action
 {
 	RelFileNode node;			/* the index */
-	bool		is_split;		/* T = pending split, F = pending delete */
-	/* these fields are for a split: */
-	bool		is_root;		/* we split the root */
-	BlockNumber leftblk;		/* left half of split */
-	BlockNumber rightblk;		/* right half of split */
 	/* these fields are for a delete: */
 	BlockNumber delblk;			/* parent block to be deleted */
 } bt_incomplete_action;
 
 static List *incomplete_actions;
 
-
-static void
-log_incomplete_split(RelFileNode node, BlockNumber leftblk,
-					 BlockNumber rightblk, bool is_root)
-{
-	bt_incomplete_action *action = palloc(sizeof(bt_incomplete_action));
-
-	action->node = node;
-	action->is_split = true;
-	action->is_root = is_root;
-	action->leftblk = leftblk;
-	action->rightblk = rightblk;
-	incomplete_actions = lappend(incomplete_actions, action);
-}
-
-static void
-forget_matching_split(RelFileNode node, BlockNumber downlink, bool is_root)
-{
-	ListCell   *l;
-
-	foreach(l, incomplete_actions)
-	{
-		bt_incomplete_action *action = (bt_incomplete_action *) lfirst(l);
-
-		if (RelFileNodeEquals(node, action->node) &&
-			action->is_split &&
-			downlink == action->rightblk)
-		{
-			if (is_root != action->is_root)
-				elog(LOG, "forget_matching_split: fishy is_root data (expected %d, got %d)",
-					 action->is_root, is_root);
-			incomplete_actions = list_delete_ptr(incomplete_actions, action);
-			pfree(action);
-			break;				/* need not look further */
-		}
-	}
-}
-
 static void
 log_incomplete_deletion(RelFileNode node, BlockNumber delblk)
 {
 	bt_incomplete_action *action = palloc(sizeof(bt_incomplete_action));
 
 	action->node = node;
-	action->is_split = false;
 	action->delblk = delblk;
 	incomplete_actions = lappend(incomplete_actions, action);
 }
@@ -106,7 +58,6 @@ forget_matching_deletion(RelFileNode node, BlockNumber delblk)
 		bt_incomplete_action *action = (bt_incomplete_action *) lfirst(l);
 
 		if (RelFileNodeEquals(node, action->node) &&
-			!action->is_split &&
 			delblk == action->delblk)
 		{
 			incomplete_actions = list_delete_ptr(incomplete_actions, action);
@@ -190,23 +141,60 @@ _bt_restore_meta(RelFileNode rnode, XLogRecPtr lsn,
 	UnlockReleaseBuffer(metabuf);
 }
 
+/*
+ * _bt_clear_incomplete_split -- clear INCOMPLETE_SPLIT flag on a page
+ *
+ * This is a common subroutine of the redo functions of all the WAL record
+ * types that can insert a downlink: insert, split, and newroot.
+ *
+ * Returns a (locked) buffer containing the child page, or InvalidBuffer if
+ * the page was not found (because it was truncated later).
+ */
+static Buffer
+_bt_clear_incomplete_split(XLogRecPtr lsn, XLogRecord *record,
+						   RelFileNode rnode, BlockNumber cblock)
+{
+	Buffer cbuf;
+
+	cbuf = XLogReadBuffer(rnode, cblock, false);
+	if (BufferIsValid(cbuf))
+	{
+		Page		page = (Page) BufferGetPage(cbuf);
+
+		if (lsn > PageGetLSN(page))
+		{
+			BTPageOpaque pageop = (BTPageOpaque) PageGetSpecialPointer(page);
+			Assert((pageop->btpo_flags & BTP_INCOMPLETE_SPLIT) != 0);
+			pageop->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+
+			PageSetLSN(page, lsn);
+			MarkBufferDirty(cbuf);
+		}
+	}
+
+	return cbuf;
+}
+
 static void
 btree_xlog_insert(bool isleaf, bool ismeta,
 				  XLogRecPtr lsn, XLogRecord *record)
 {
 	xl_btree_insert *xlrec = (xl_btree_insert *) XLogRecGetData(record);
 	Buffer		buffer;
+	Buffer		cbuffer = InvalidBuffer;
 	Page		page;
 	char	   *datapos;
 	int			datalen;
 	xl_btree_metadata md;
-	BlockNumber downlink = 0;
+	BlockNumber finishes_split = 0;
+	int			blk_index;
 
 	datapos = (char *) xlrec + SizeOfBtreeInsert;
 	datalen = record->xl_len - SizeOfBtreeInsert;
-	if (!isleaf)
+	if (!isleaf && (record->xl_info & XLR_BKP_BLOCK(0)) == 0)
 	{
-		memcpy(&downlink, datapos, sizeof(BlockNumber));
+		memcpy(&finishes_split, datapos, sizeof(BlockNumber));
+		Assert(finishes_split != 0);
 		datapos += sizeof(BlockNumber);
 		datalen -= sizeof(BlockNumber);
 	}
@@ -217,8 +205,18 @@ btree_xlog_insert(bool isleaf, bool ismeta,
 		datalen -= sizeof(xl_btree_metadata);
 	}
 
-	if (record->xl_info & XLR_BKP_BLOCK(0))
-		(void) RestoreBackupBlock(lsn, record, 0, false, false);
+	if (!isleaf)
+	{
+		if (record->xl_info & XLR_BKP_BLOCK(0))
+			cbuffer = RestoreBackupBlock(lsn, record, 0, false, true);
+		else
+			cbuffer = _bt_clear_incomplete_split(lsn, record, xlrec->target.node, finishes_split);
+	}
+
+	/* the backup block index containing the main page is 0 or 1 */
+	blk_index = isleaf ? 0 : 1;
+	if (record->xl_info & XLR_BKP_BLOCK(blk_index))
+		(void) RestoreBackupBlock(lsn, record, blk_index, false, false);
 	else
 	{
 		buffer = XLogReadBuffer(xlrec->target.node,
@@ -228,11 +226,7 @@ btree_xlog_insert(bool isleaf, bool ismeta,
 		{
 			page = (Page) BufferGetPage(buffer);
 
-			if (lsn <= PageGetLSN(page))
-			{
-				UnlockReleaseBuffer(buffer);
-			}
-			else
+			if (lsn > PageGetLSN(page))
 			{
 				if (PageAddItem(page, (Item) datapos, datalen,
 							ItemPointerGetOffsetNumber(&(xlrec->target.tid)),
@@ -241,11 +235,14 @@ btree_xlog_insert(bool isleaf, bool ismeta,
 
 				PageSetLSN(page, lsn);
 				MarkBufferDirty(buffer);
-				UnlockReleaseBuffer(buffer);
 			}
+			UnlockReleaseBuffer(buffer);
 		}
 	}
 
+	if (BufferIsValid(cbuffer))
+		UnlockReleaseBuffer(cbuffer);
+
 	/*
 	 * Note: in normal operation, we'd update the metapage while still holding
 	 * lock on the page we inserted into.  But during replay it's not
@@ -257,10 +254,6 @@ btree_xlog_insert(bool isleaf, bool ismeta,
 		_bt_restore_meta(xlrec->target.node, lsn,
 						 md.root, md.level,
 						 md.fastroot, md.fastlevel);
-
-	/* Forget any split this insertion completes */
-	if (!isleaf)
-		forget_matching_split(xlrec->target.node, downlink, false);
 }
 
 static void
@@ -268,7 +261,10 @@ btree_xlog_split(bool onleft, bool isroot,
 				 XLogRecPtr lsn, XLogRecord *record)
 {
 	xl_btree_split *xlrec = (xl_btree_split *) XLogRecGetData(record);
+	bool		isleaf = xlrec->level == 0;
+	Buffer		lbuf;
 	Buffer		rbuf;
+	Buffer		cbuf = InvalidBuffer;
 	Page		rpage;
 	BTPageOpaque ropaque;
 	char	   *datapos;
@@ -278,42 +274,19 @@ btree_xlog_split(bool onleft, bool isroot,
 	Size		newitemsz = 0;
 	Item		left_hikey = NULL;
 	Size		left_hikeysz = 0;
+	BlockNumber finishes_split = InvalidBlockNumber;
 
 	datapos = (char *) xlrec + SizeOfBtreeSplit;
 	datalen = record->xl_len - SizeOfBtreeSplit;
 
-	/* Forget any split this insertion completes */
-	if (xlrec->level > 0)
-	{
-		/* we assume SizeOfBtreeSplit is at least 16-bit aligned */
-		BlockNumber downlink = BlockIdGetBlockNumber((BlockId) datapos);
-
-		datapos += sizeof(BlockIdData);
-		datalen -= sizeof(BlockIdData);
-
-		forget_matching_split(xlrec->node, downlink, false);
-
-		/* Extract left hikey and its size (still assuming 16-bit alignment) */
-		if (!(record->xl_info & XLR_BKP_BLOCK(0)))
-		{
-			/* We assume 16-bit alignment is enough for IndexTupleSize */
-			left_hikey = (Item) datapos;
-			left_hikeysz = MAXALIGN(IndexTupleSize(left_hikey));
-
-			datapos += left_hikeysz;
-			datalen -= left_hikeysz;
-		}
-	}
-
-	/* Extract newitem and newitemoff, if present */
+	/* Extract newitemoff and newitem, if present */
 	if (onleft)
 	{
-		/* Extract the offset (still assuming 16-bit alignment) */
+		/* we assume SizeOfBtreeSplit is at least 16-bit aligned */
 		memcpy(&newitemoff, datapos, sizeof(OffsetNumber));
 		datapos += sizeof(OffsetNumber);
 		datalen -= sizeof(OffsetNumber);
 	}
-
 	if (onleft && !(record->xl_info & XLR_BKP_BLOCK(0)))
 	{
 		/*
@@ -327,6 +300,37 @@ btree_xlog_split(bool onleft, bool isroot,
 		datalen -= newitemsz;
 	}
 
+	/* Extract left hikey and its size (still assuming 16-bit alignment) */
+	if (!isleaf && !(record->xl_info & XLR_BKP_BLOCK(0)))
+	{
+		left_hikey = (Item) datapos;
+		left_hikeysz = MAXALIGN(IndexTupleSize(left_hikey));
+		datapos += left_hikeysz;
+		datalen -= left_hikeysz;
+	}
+	/*
+	 * If this insertion finishes an incomplete split, get the block number
+	 * of the child.
+	 */
+	if (!isleaf && !(record->xl_info & XLR_BKP_BLOCK(1)))
+	{
+		memcpy(&finishes_split, datapos, sizeof(BlockNumber));
+		datapos += sizeof(BlockNumber);
+		datalen -= sizeof(BlockNumber);
+	}
+
+	/*
+	 * Clear the incomplete split flag on the left sibling of the child page
+	 * this is a downlink for.
+	 */
+	if (!isleaf)
+	{
+		if (record->xl_info & XLR_BKP_BLOCK(2))
+			cbuf = RestoreBackupBlock(lsn, record, 2, false, true);
+		else
+			cbuf = _bt_clear_incomplete_split(lsn, record, xlrec->node, finishes_split);
+	}
+
 	/* Reconstruct right (new) sibling page from scratch */
 	rbuf = XLogReadBuffer(xlrec->node, xlrec->rightsib, true);
 	Assert(BufferIsValid(rbuf));
@@ -338,7 +342,7 @@ btree_xlog_split(bool onleft, bool isroot,
 	ropaque->btpo_prev = xlrec->leftsib;
 	ropaque->btpo_next = xlrec->rnext;
 	ropaque->btpo.level = xlrec->level;
-	ropaque->btpo_flags = (xlrec->level == 0) ? BTP_LEAF : 0;
+	ropaque->btpo_flags = isleaf ? BTP_LEAF : 0;
 	ropaque->btpo_cycleid = 0;
 
 	_bt_restore_page(rpage, datapos, datalen);
@@ -347,7 +351,7 @@ btree_xlog_split(bool onleft, bool isroot,
 	 * On leaf level, the high key of the left page is equal to the first key
 	 * on the right page.
 	 */
-	if (xlrec->level == 0)
+	if (isleaf)
 	{
 		ItemId		hiItemId = PageGetItemId(rpage, P_FIRSTDATAKEY(ropaque));
 
@@ -362,10 +366,10 @@ btree_xlog_split(bool onleft, bool isroot,
 
 	/* Now reconstruct left (original) sibling page */
 	if (record->xl_info & XLR_BKP_BLOCK(0))
-		(void) RestoreBackupBlock(lsn, record, 0, false, false);
+		lbuf = RestoreBackupBlock(lsn, record, 0, false, true);
 	else
 	{
-		Buffer		lbuf = XLogReadBuffer(xlrec->node, xlrec->leftsib, false);
+		lbuf = XLogReadBuffer(xlrec->node, xlrec->leftsib, false);
 
 		if (BufferIsValid(lbuf))
 		{
@@ -422,19 +426,22 @@ btree_xlog_split(bool onleft, bool isroot,
 					elog(PANIC, "failed to add high key to left page after split");
 
 				/* Fix opaque fields */
-				lopaque->btpo_flags = (xlrec->level == 0) ? BTP_LEAF : 0;
+				lopaque->btpo_flags = isleaf ? BTP_LEAF : 0;
+				lopaque->btpo_flags |= BTP_INCOMPLETE_SPLIT;
 				lopaque->btpo_next = xlrec->rightsib;
 				lopaque->btpo_cycleid = 0;
 
 				PageSetLSN(lpage, lsn);
 				MarkBufferDirty(lbuf);
 			}
-
-			UnlockReleaseBuffer(lbuf);
 		}
 	}
 
-	/* We no longer need the right buffer */
+	/* We no longer need the buffers */
+	if (BufferIsValid(cbuf))
+		UnlockReleaseBuffer(cbuf);
+	if (BufferIsValid(lbuf))
+		UnlockReleaseBuffer(lbuf);
 	UnlockReleaseBuffer(rbuf);
 
 	/*
@@ -445,32 +452,39 @@ btree_xlog_split(bool onleft, bool isroot,
 	 * replay, because no other index update can be in progress, and readers
 	 * will cope properly when following an obsolete left-link.
 	 */
-	if (record->xl_info & XLR_BKP_BLOCK(1))
-		(void) RestoreBackupBlock(lsn, record, 1, false, false);
-	else if (xlrec->rnext != P_NONE)
+	if (xlrec->rnext != P_NONE)
 	{
-		Buffer		buffer = XLogReadBuffer(xlrec->node, xlrec->rnext, false);
+		/*
+		 * the backup block containing right sibling is 2 or 3, depending
+		 * whether this was a leaf or internal page.
+		 */
+		int		rnext_index = isleaf ? 2 : 3;
 
-		if (BufferIsValid(buffer))
+		if (record->xl_info & XLR_BKP_BLOCK(rnext_index))
+			(void) RestoreBackupBlock(lsn, record, rnext_index, false, false);
+		else
 		{
-			Page		page = (Page) BufferGetPage(buffer);
+			Buffer		buffer;
 
-			if (lsn > PageGetLSN(page))
+			buffer = XLogReadBuffer(xlrec->node, xlrec->rnext, false);
+
+			if (BufferIsValid(buffer))
 			{
-				BTPageOpaque pageop = (BTPageOpaque) PageGetSpecialPointer(page);
+				Page		page = (Page) BufferGetPage(buffer);
 
-				pageop->btpo_prev = xlrec->rightsib;
+				if (lsn > PageGetLSN(page))
+				{
+					BTPageOpaque pageop = (BTPageOpaque) PageGetSpecialPointer(page);
 
-				PageSetLSN(page, lsn);
-				MarkBufferDirty(buffer);
+					pageop->btpo_prev = xlrec->rightsib;
+
+					PageSetLSN(page, lsn);
+					MarkBufferDirty(buffer);
+				}
+				UnlockReleaseBuffer(buffer);
 			}
-			UnlockReleaseBuffer(buffer);
 		}
 	}
-
-	/* The job ain't done till the parent link is inserted... */
-	log_incomplete_split(xlrec->node,
-						 xlrec->leftsib, xlrec->rightsib, isroot);
 }
 
 static void
@@ -946,12 +960,11 @@ btree_xlog_newroot(XLogRecPtr lsn, XLogRecord *record)
 {
 	xl_btree_newroot *xlrec = (xl_btree_newroot *) XLogRecGetData(record);
 	Buffer		buffer;
+	Buffer		cbuffer = InvalidBuffer;
 	Page		page;
 	BTPageOpaque pageop;
-	BlockNumber downlink = 0;
-
-	/* Backup blocks are not used in newroot records */
-	Assert(!(record->xl_info & XLR_BKP_BLOCK_MASK));
+	BlockNumber cblkno;
+	IndexTuple	itup;
 
 	buffer = XLogReadBuffer(xlrec->node, xlrec->rootblk, true);
 	Assert(BufferIsValid(buffer));
@@ -969,28 +982,31 @@ btree_xlog_newroot(XLogRecPtr lsn, XLogRecord *record)
 
 	if (record->xl_len > SizeOfBtreeNewroot)
 	{
-		IndexTuple	itup;
-
 		_bt_restore_page(page,
 						 (char *) xlrec + SizeOfBtreeNewroot,
 						 record->xl_len - SizeOfBtreeNewroot);
-		/* extract downlink to the right-hand split page */
-		itup = (IndexTuple) PageGetItem(page, PageGetItemId(page, P_FIRSTKEY));
-		downlink = ItemPointerGetBlockNumber(&(itup->t_tid));
+		/* extract block number of the left-hand split page */
+		itup = (IndexTuple) PageGetItem(page, PageGetItemId(page, P_HIKEY));
+		cblkno = ItemPointerGetBlockNumber(&(itup->t_tid));
 		Assert(ItemPointerGetOffsetNumber(&(itup->t_tid)) == P_HIKEY);
+
+		/* Clear the incomplete-split flag in left child */
+		if (record->xl_info & XLR_BKP_BLOCK(0))
+			cbuffer = RestoreBackupBlock(lsn, record, 0, false, true);
+		else
+			cbuffer = _bt_clear_incomplete_split(lsn, record,
+												 xlrec->node, cblkno);
 	}
 
 	PageSetLSN(page, lsn);
 	MarkBufferDirty(buffer);
 	UnlockReleaseBuffer(buffer);
+	if (BufferIsValid(cbuffer))
+		UnlockReleaseBuffer(cbuffer);
 
 	_bt_restore_meta(xlrec->node, lsn,
 					 xlrec->rootblk, xlrec->level,
 					 xlrec->rootblk, xlrec->level);
-
-	/* Check to see if this satisfies any incomplete insertions */
-	if (record->xl_len > SizeOfBtreeNewroot)
-		forget_matching_split(xlrec->node, downlink, true);
 }
 
 static void
@@ -1084,55 +1100,19 @@ btree_xlog_cleanup(void)
 	{
 		bt_incomplete_action *action = (bt_incomplete_action *) lfirst(l);
 
-		if (action->is_split)
+		/* finish an incomplete deletion (of a half-dead page) */
+		Buffer		buf;
+
+		buf = XLogReadBuffer(action->node, action->delblk, false);
+		if (BufferIsValid(buf))
 		{
-			/* finish an incomplete split */
-			Buffer		lbuf,
-						rbuf;
-			Page		lpage,
-						rpage;
-			BTPageOpaque lpageop,
-						rpageop;
-			bool		is_only;
 			Relation	reln;
 
-			lbuf = XLogReadBuffer(action->node, action->leftblk, false);
-			/* failure is impossible because we wrote this page earlier */
-			if (!BufferIsValid(lbuf))
-				elog(PANIC, "btree_xlog_cleanup: left block unfound");
-			lpage = (Page) BufferGetPage(lbuf);
-			lpageop = (BTPageOpaque) PageGetSpecialPointer(lpage);
-			rbuf = XLogReadBuffer(action->node, action->rightblk, false);
-			/* failure is impossible because we wrote this page earlier */
-			if (!BufferIsValid(rbuf))
-				elog(PANIC, "btree_xlog_cleanup: right block unfound");
-			rpage = (Page) BufferGetPage(rbuf);
-			rpageop = (BTPageOpaque) PageGetSpecialPointer(rpage);
-
-			/* if the pages are all of their level, it's a only-page split */
-			is_only = P_LEFTMOST(lpageop) && P_RIGHTMOST(rpageop);
-
 			reln = CreateFakeRelcacheEntry(action->node);
-			_bt_insert_parent(reln, lbuf, rbuf, NULL,
-							  action->is_root, is_only);
+			if (_bt_pagedel(reln, buf, NULL) == 0)
+				elog(PANIC, "btree_xlog_cleanup: _bt_pagedel failed");
 			FreeFakeRelcacheEntry(reln);
 		}
-		else
-		{
-			/* finish an incomplete deletion (of a half-dead page) */
-			Buffer		buf;
-
-			buf = XLogReadBuffer(action->node, action->delblk, false);
-			if (BufferIsValid(buf))
-			{
-				Relation	reln;
-
-				reln = CreateFakeRelcacheEntry(action->node);
-				if (_bt_pagedel(reln, buf, NULL) == 0)
-					elog(PANIC, "btree_xlog_cleanup: _bt_pagedel failed");
-				FreeFakeRelcacheEntry(reln);
-			}
-		}
 	}
 	incomplete_actions = NIL;
 }
diff --git a/src/include/access/nbtree.h b/src/include/access/nbtree.h
index 3997f94..803073f 100644
--- a/src/include/access/nbtree.h
+++ b/src/include/access/nbtree.h
@@ -73,6 +73,7 @@ typedef BTPageOpaqueData *BTPageOpaque;
 #define BTP_HALF_DEAD	(1 << 4)	/* empty, but still in tree */
 #define BTP_SPLIT_END	(1 << 5)	/* rightmost page of split group */
 #define BTP_HAS_GARBAGE (1 << 6)	/* page has LP_DEAD tuples */
+#define BTP_INCOMPLETE_SPLIT (1 << 7) /* right sibling's downlink is missing */
 
 /*
  * The max allowed value of a cycle ID is a bit less than 64K.	This is
@@ -178,6 +179,7 @@ typedef struct BTMetaPageData
 #define P_ISHALFDEAD(opaque)	((opaque)->btpo_flags & BTP_HALF_DEAD)
 #define P_IGNORE(opaque)		((opaque)->btpo_flags & (BTP_DELETED|BTP_HALF_DEAD))
 #define P_HAS_GARBAGE(opaque)	((opaque)->btpo_flags & BTP_HAS_GARBAGE)
+#define P_INCOMPLETE_SPLIT(opaque)	((opaque)->btpo_flags & BTP_INCOMPLETE_SPLIT)
 
 /*
  *	Lehman and Yao's algorithm requires a ``high key'' on every non-rightmost
@@ -254,7 +256,7 @@ typedef struct xl_btree_metadata
 typedef struct xl_btree_insert
 {
 	xl_btreetid target;			/* inserted tuple id */
-	/* BlockNumber downlink field FOLLOWS IF NOT XLOG_BTREE_INSERT_LEAF */
+	/* BlockNumber finishes_split field FOLLOWS IF NOT XLOG_BTREE_INSERT_LEAF */
 	/* xl_btree_metadata FOLLOWS IF XLOG_BTREE_INSERT_META */
 	/* INDEX TUPLE FOLLOWS AT END OF STRUCT */
 } xl_btree_insert;
@@ -287,19 +289,18 @@ typedef struct xl_btree_split
 	OffsetNumber firstright;	/* first item moved to right page */
 
 	/*
-	 * If level > 0, BlockIdData downlink follows.	(We use BlockIdData rather
-	 * than BlockNumber for alignment reasons: SizeOfBtreeSplit is only 16-bit
-	 * aligned.)
+	 * In the _L variants, next are OffsetNumber newitemoff and the new item.
+	 * (In the _R variants, the new item is one of the right page's tuples.)
+	 * The new item, but not newitemoff, is suppressed if XLogInsert chooses
+	 * to store the left page's whole page image.
 	 *
 	 * If level > 0, an IndexTuple representing the HIKEY of the left page
 	 * follows.  We don't need this on leaf pages, because it's the same as
 	 * the leftmost key in the new right page.	Also, it's suppressed if
 	 * XLogInsert chooses to store the left page's whole page image.
 	 *
-	 * In the _L variants, next are OffsetNumber newitemoff and the new item.
-	 * (In the _R variants, the new item is one of the right page's tuples.)
-	 * The new item, but not newitemoff, is suppressed if XLogInsert chooses
-	 * to store the left page's whole page image.
+	 * If level > 0, BlockNumber of the page whose incomplete-split flag
+	 * this insertion clears. (not aligned)
 	 *
 	 * Last are the right page's tuples in the form used by _bt_restore_page.
 	 */
@@ -617,8 +618,7 @@ extern Datum btoptions(PG_FUNCTION_ARGS);
 extern bool _bt_doinsert(Relation rel, IndexTuple itup,
 			 IndexUniqueCheck checkUnique, Relation heapRel);
 extern Buffer _bt_getstackbuf(Relation rel, BTStack stack, int access);
-extern void _bt_insert_parent(Relation rel, Buffer buf, Buffer rbuf,
-				  BTStack stack, bool is_root, bool is_only);
+extern void _bt_finish_split(Relation rel, Buffer lbuf, BTStack stack);
 
 /*
  * prototypes for functions in nbtpage.c
@@ -648,7 +648,8 @@ extern BTStack _bt_search(Relation rel,
 		   int keysz, ScanKey scankey, bool nextkey,
 		   Buffer *bufP, int access);
 extern Buffer _bt_moveright(Relation rel, Buffer buf, int keysz,
-			  ScanKey scankey, bool nextkey, int access);
+			  ScanKey scankey, bool nextkey,
+			  bool finishsplits, BTStack stack,  int access);
 extern OffsetNumber _bt_binsrch(Relation rel, Buffer buf, int keysz,
 			ScanKey scankey, bool nextkey);
 extern int32 _bt_compare(Relation rel, int keysz, ScanKey scankey,

*** a/src/backend/access/nbtree/README
--- b/src/backend/access/nbtree/README
***************
*** 168,173 **** parent item does still exist and can't have been deleted.  Also, because
--- 168,203 ----
  we are matching downlink page numbers and not data keys, we don't have any
  problem with possibly misidentifying the parent item.
  
+ VACUUM needs to do a linear scan of an index to search for deleted pages
+ that can be reclaimed because they are older than all open transactions.
+ For efficiency's sake, we'd like to use the same linear scan to search for
+ deletable tuples.  Before Postgres 8.2, btbulkdelete scanned the leaf pages
+ in index order, but it is possible to visit them in physical order instead.
+ The tricky part of this is to avoid missing any deletable tuples in the
+ presence of concurrent page splits: a page split could easily move some
+ tuples from a page not yet passed over by the sequential scan to a
+ lower-numbered page already passed over.  (This wasn't a concern for the
+ index-order scan, because splits always split right.)  To implement this,
+ we provide a "vacuum cycle ID" mechanism that makes it possible to
+ determine whether a page has been split since the current btbulkdelete
+ cycle started.  If btbulkdelete finds a page that has been split since
+ it started, and has a right-link pointing to a lower page number, then
+ it temporarily suspends its sequential scan and visits that page instead.
+ It must continue to follow right-links and vacuum dead tuples until
+ reaching a page that either hasn't been split since btbulkdelete started,
+ or is above the location of the outer sequential scan.  Then it can resume
+ the sequential scan.  This ensures that all tuples are visited.  It may be
+ that some tuples are visited twice, but that has no worse effect than an
+ inaccurate index tuple count (and we can't guarantee an accurate count
+ anyway in the face of concurrent activity).  Note that this still works
+ if the has-been-recently-split test has a small probability of false
+ positives, so long as it never gives a false negative.  This makes it
+ possible to implement the test with a small counter value stored on each
+ index page.
+ 
+ Page Deletion Algorithm
+ -----------------------
+ 
  We consider deleting an entire page from the btree only when it's become
  completely empty of items.  (Merging partly-full pages would allow better
  space reuse, but it seems impractical to move existing data items left or
***************
*** 216,229 **** The notion of a half-dead page means that the key space relationship between
  the half-dead page's level and its parent's level may be a little out of
  whack: key space that appears to belong to the half-dead page's parent on the
  parent level may really belong to its right sibling.  To prevent any possible
! problems, we hold lock on the deleted child page until we have finished
! deleting any now-half-dead parent page(s).  This prevents any insertions into
! the transferred keyspace until the operation is complete.  The reason for
! doing this is that a sufficiently large number of insertions into the
! transferred keyspace, resulting in multiple page splits, could propagate keys
! from that keyspace into the parent level, resulting in transiently
! out-of-order keys in that level.  It is thought that that wouldn't cause any
! serious problem, but it seems too risky to allow.
  
  A deleted page cannot be reclaimed immediately, since there may be other
  processes waiting to reference it (ie, search processes that just left the
--- 246,262 ----
  the half-dead page's level and its parent's level may be a little out of
  whack: key space that appears to belong to the half-dead page's parent on the
  parent level may really belong to its right sibling.  To prevent any possible
! problems, we mark the half-dead page's right sibling, which now owns the
! keyspace of the deleted page, with a flag indicating that the left sibling
! is half-dead. Any insertion into that page will force the half-dead page to be
! deleted first, similar we require any insertions to an incompletely-split page
! to finish the split first.
! 
! The reason for doing this is that a sufficiently large number of insertions
! into the transferred keyspace, resulting in multiple page splits, could
! propagate keys from that keyspace into the parent level, resulting in
! transiently out-of-order keys in that level.  It is thought that that wouldn't
! cause any serious problem, but it seems too risky to allow.
  
  A deleted page cannot be reclaimed immediately, since there may be other
  processes waiting to reference it (ie, search processes that just left the
***************
*** 298,330 **** as part of the atomic update for the delete (either way, the metapage has
  to be the last page locked in the update to avoid deadlock risks).  This
  avoids race conditions if two such operations are executing concurrently.
  
- VACUUM needs to do a linear scan of an index to search for deleted pages
- that can be reclaimed because they are older than all open transactions.
- For efficiency's sake, we'd like to use the same linear scan to search for
- deletable tuples.  Before Postgres 8.2, btbulkdelete scanned the leaf pages
- in index order, but it is possible to visit them in physical order instead.
- The tricky part of this is to avoid missing any deletable tuples in the
- presence of concurrent page splits: a page split could easily move some
- tuples from a page not yet passed over by the sequential scan to a
- lower-numbered page already passed over.  (This wasn't a concern for the
- index-order scan, because splits always split right.)  To implement this,
- we provide a "vacuum cycle ID" mechanism that makes it possible to
- determine whether a page has been split since the current btbulkdelete
- cycle started.  If btbulkdelete finds a page that has been split since
- it started, and has a right-link pointing to a lower page number, then
- it temporarily suspends its sequential scan and visits that page instead.
- It must continue to follow right-links and vacuum dead tuples until
- reaching a page that either hasn't been split since btbulkdelete started,
- or is above the location of the outer sequential scan.  Then it can resume
- the sequential scan.  This ensures that all tuples are visited.  It may be
- that some tuples are visited twice, but that has no worse effect than an
- inaccurate index tuple count (and we can't guarantee an accurate count
- anyway in the face of concurrent activity).  Note that this still works
- if the has-been-recently-split test has a small probability of false
- positives, so long as it never gives a false negative.  This makes it
- possible to implement the test with a small counter value stored on each
- index page.
- 
  On-the-Fly Deletion Of Index Tuples
  -----------------------------------
  
--- 331,336 ----
***************
*** 384,395 **** an additional insertion above that, etc).
  For a root split, the followon WAL entry is a "new root" entry rather than
  an "insertion" entry, but details are otherwise much the same.
  
! Because insertion involves multiple atomic actions, the WAL replay logic
! has to detect the case where a page split isn't followed by a matching
! insertion on the parent level, and then do that insertion on its own (and
! recursively for any subsequent parent insertion, of course).  This is
! feasible because the WAL entry for the split contains enough info to know
! what must be inserted in the parent level.
  
  When splitting a non-root page that is alone on its level, the required
  metapage update (of the "fast root" link) is performed and logged as part
--- 390,430 ----
  For a root split, the followon WAL entry is a "new root" entry rather than
  an "insertion" entry, but details are otherwise much the same.
  
! Because splitting involves multiple atomic actions, it's possible that the
! system crashes between splitting a page and inserting the downlink for the
! new half to the parent. After recovery, the downlink for the new page will
! be missing. The search algorithm works correctly, as the page will be found
! by following the right-link from its left sibling, although if a lot of
! downlinks in the tree are missing, performance will suffer. A more serious
! consequence is that if the page without a downlink gets split again, the
! insertion algorithm will fail to find the location in the parent level to
! insert the downlink.
! 
! Our approach is to create any missing downlinks on-they-fly, when
! searching the tree for a new insertion. It could be done during searches,
! too, but it seems best not to put any extra updates in what would otherwise
! be a read-only operation (updating is not possible in hot standby mode
! anyway). To identify missing downlinks, when a page is split, the left page
! is flagged to indicate that the split is not yet complete (INCOMPLETE_SPLIT).
! When the downlink is inserted to the parent, the flag is cleared atomically
! with the insertion. The child page is kept locked until the insertion in the
! parent is finished and the flag in the child cleared, but can be released
! immediately after that, before recursing up the tree, if the parent also
! needs to be split. This ensures that incompletely split pages should not be
! seen under normal circumstances; only when insertion to the parent fails
! for some reason.
! 
! We flag the left page, even though it's the right page that's missing the
! downlink, beacuse it's more convenient to know already when following the
! right-link from the left page to the right page that it will need to have
! its downlink inserted to the parent.
! 
! We used to keep track of incomplete splits during recovery and finish them
! immediately at end of recovery, instead of doing it lazily at the next
! insertion. However, that made the recovery much more complicated, and only
! fixed the problem when crash recovery was performed. An incomplete split can
! also occur if an otherwise recoverable error, like out-of-memory or
! out-of-disk-space, happens while inserting the downlink to the parent.
  
  When splitting a non-root page that is alone on its level, the required
  metapage update (of the "fast root" link) is performed and logged as part
*** a/src/backend/access/nbtree/nbtinsert.c
--- b/src/backend/access/nbtree/nbtinsert.c
***************
*** 58,72 **** static void _bt_findinsertloc(Relation rel,
  				  int keysz,
  				  ScanKey scankey,
  				  IndexTuple newtup,
  				  Relation heapRel);
! static void _bt_insertonpg(Relation rel, Buffer buf,
  			   BTStack stack,
  			   IndexTuple itup,
  			   OffsetNumber newitemoff,
  			   bool split_only_page);
! static Buffer _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
! 		  OffsetNumber newitemoff, Size newitemsz,
  		  IndexTuple newitem, bool newitemonleft);
  static OffsetNumber _bt_findsplitloc(Relation rel, Page page,
  				 OffsetNumber newitemoff,
  				 Size newitemsz,
--- 58,76 ----
  				  int keysz,
  				  ScanKey scankey,
  				  IndexTuple newtup,
+ 				  BTStack stack,
  				  Relation heapRel);
! static void _bt_insertonpg(Relation rel, Buffer buf, Buffer cbuf,
  			   BTStack stack,
  			   IndexTuple itup,
  			   OffsetNumber newitemoff,
  			   bool split_only_page);
! static Buffer _bt_split(Relation rel, Buffer buf, Buffer cbuf,
! 		  OffsetNumber firstright, OffsetNumber newitemoff, Size newitemsz,
  		  IndexTuple newitem, bool newitemonleft);
+ static void _bt_insert_parent(Relation rel, Buffer buf, Buffer rbuf,
+ 				  BTStack stack, bool is_root, bool is_only);
+ static void _bt_finish_split(Relation rel, Buffer lbuf, BTStack stack);
  static OffsetNumber _bt_findsplitloc(Relation rel, Page page,
  				 OffsetNumber newitemoff,
  				 Size newitemsz,
***************
*** 130,136 **** top:
  	 * move right in the tree.	See Lehman and Yao for an excruciatingly
  	 * precise description.
  	 */
! 	buf = _bt_moveright(rel, buf, natts, itup_scankey, false, BT_WRITE);
  
  	/*
  	 * If we're not allowing duplicates, make sure the key isn't already in
--- 134,141 ----
  	 * move right in the tree.	See Lehman and Yao for an excruciatingly
  	 * precise description.
  	 */
! 	buf = _bt_moveright(rel, buf, natts, itup_scankey, false,
! 						true, stack, BT_WRITE);
  
  	/*
  	 * If we're not allowing duplicates, make sure the key isn't already in
***************
*** 183,190 **** top:
  		 */
  		CheckForSerializableConflictIn(rel, NULL, buf);
  		/* do the insertion */
! 		_bt_findinsertloc(rel, &buf, &offset, natts, itup_scankey, itup, heapRel);
! 		_bt_insertonpg(rel, buf, stack, itup, offset, false);
  	}
  	else
  	{
--- 188,196 ----
  		 */
  		CheckForSerializableConflictIn(rel, NULL, buf);
  		/* do the insertion */
! 		_bt_findinsertloc(rel, &buf, &offset, natts, itup_scankey, itup,
! 						  stack, heapRel);
! 		_bt_insertonpg(rel, buf, InvalidBuffer, stack, itup, offset, false);
  	}
  	else
  	{
***************
*** 508,517 **** _bt_findinsertloc(Relation rel,
  				  int keysz,
  				  ScanKey scankey,
  				  IndexTuple newtup,
  				  Relation heapRel)
  {
  	Buffer		buf = *bufptr;
! 	Page		page = BufferGetPage(buf);
  	Size		itemsz;
  	BTPageOpaque lpageop;
  	bool		movedright,
--- 514,524 ----
  				  int keysz,
  				  ScanKey scankey,
  				  IndexTuple newtup,
+ 				  BTStack stack,
  				  Relation heapRel)
  {
  	Buffer		buf = *bufptr;
! 	Page		page;
  	Size		itemsz;
  	BTPageOpaque lpageop;
  	bool		movedright,
***************
*** 519,524 **** _bt_findinsertloc(Relation rel,
--- 526,532 ----
  	OffsetNumber newitemoff;
  	OffsetNumber firstlegaloff = *offsetptr;
  
+ 	page = BufferGetPage(buf);
  	lpageop = (BTPageOpaque) PageGetSpecialPointer(page);
  
  	itemsz = IndexTupleDSize(*newtup);
***************
*** 570,575 **** _bt_findinsertloc(Relation rel,
--- 578,584 ----
  	while (PageGetFreeSpace(page) < itemsz)
  	{
  		Buffer		rbuf;
+ 		BlockNumber	rblkno;
  
  		/*
  		 * before considering moving right, see if we can obtain enough space
***************
*** 607,624 **** _bt_findinsertloc(Relation rel,
  		 */
  		rbuf = InvalidBuffer;
  
  		for (;;)
  		{
- 			BlockNumber rblkno = lpageop->btpo_next;
- 
  			rbuf = _bt_relandgetbuf(rel, rbuf, rblkno, BT_WRITE);
  			page = BufferGetPage(rbuf);
  			lpageop = (BTPageOpaque) PageGetSpecialPointer(page);
  			if (!P_IGNORE(lpageop))
  				break;
  			if (P_RIGHTMOST(lpageop))
  				elog(ERROR, "fell off the end of index \"%s\"",
  					 RelationGetRelationName(rel));
  		}
  		_bt_relbuf(rel, buf);
  		buf = rbuf;
--- 616,648 ----
  		 */
  		rbuf = InvalidBuffer;
  
+ 		rblkno = lpageop->btpo_next;
  		for (;;)
  		{
  			rbuf = _bt_relandgetbuf(rel, rbuf, rblkno, BT_WRITE);
  			page = BufferGetPage(rbuf);
  			lpageop = (BTPageOpaque) PageGetSpecialPointer(page);
+ 
+ 			/*
+ 			 * If this page was incompletely split, do that now. We do this
+ 			 * while holding a lock on the left sibling, which is not good
+ 			 * because finishing the split could be a fairly length operation.
+ 			 * But this should happen very seldom.
+ 			 */
+ 			if (P_NEEDS_FIXUP(lpageop))
+ 			{
+ 				_bt_fixup(rel, rbuf, stack);
+ 				rbuf = InvalidBuffer;
+ 				continue;
+ 			}
+ 
  			if (!P_IGNORE(lpageop))
  				break;
  			if (P_RIGHTMOST(lpageop))
  				elog(ERROR, "fell off the end of index \"%s\"",
  					 RelationGetRelationName(rel));
+ 
+ 			rblkno = lpageop->btpo_next;
  		}
  		_bt_relbuf(rel, buf);
  		buf = rbuf;
***************
*** 664,669 **** _bt_findinsertloc(Relation rel,
--- 688,697 ----
   *		insertion, and the buffer must be pinned and write-locked.	On return,
   *		we will have dropped both the pin and the lock on the buffer.
   *
+  *		When inserting to a non-leaf page, 'cbuf' is the left-sibling of the
+  *		page we're inserting the downlink for. This function will clear the
+  *		INCOMPLETE_SPLIT flag on it, and release the buffer.
+  *
   *		The locking interactions in this code are critical.  You should
   *		grok Lehman and Yao's paper before making any changes.  In addition,
   *		you need to understand how we disambiguate duplicate keys in this
***************
*** 677,682 **** _bt_findinsertloc(Relation rel,
--- 705,711 ----
  static void
  _bt_insertonpg(Relation rel,
  			   Buffer buf,
+ 			   Buffer cbuf,
  			   BTStack stack,
  			   IndexTuple itup,
  			   OffsetNumber newitemoff,
***************
*** 690,695 **** _bt_insertonpg(Relation rel,
--- 719,735 ----
  	page = BufferGetPage(buf);
  	lpageop = (BTPageOpaque) PageGetSpecialPointer(page);
  
+ 	/*
+ 	 * The caller should've finished any incomplete splits and page deletions
+ 	 * already
+ 	 */
+ 	if (P_INCOMPLETE_SPLIT(lpageop))
+ 		elog(ERROR, "cannot insert to incompletely-split page %u",
+ 			 BufferGetBlockNumber(buf));
+ 	if (P_LEFT_HALF_DEAD(lpageop))
+ 		elog(ERROR, "cannot insert to page %u with half-dead left sibling",
+ 			 BufferGetBlockNumber(buf));
+ 
  	itemsz = IndexTupleDSize(*itup);
  	itemsz = MAXALIGN(itemsz);	/* be safe, PageAddItem will do this but we
  								 * need to be consistent */
***************
*** 714,720 **** _bt_insertonpg(Relation rel,
  									  &newitemonleft);
  
  		/* split the buffer into left and right halves */
! 		rbuf = _bt_split(rel, buf, firstright,
  						 newitemoff, itemsz, itup, newitemonleft);
  		PredicateLockPageSplit(rel,
  							   BufferGetBlockNumber(buf),
--- 754,760 ----
  									  &newitemonleft);
  
  		/* split the buffer into left and right halves */
! 		rbuf = _bt_split(rel, buf, cbuf, firstright,
  						 newitemoff, itemsz, itup, newitemonleft);
  		PredicateLockPageSplit(rel,
  							   BufferGetBlockNumber(buf),
***************
*** 788,798 **** _bt_insertonpg(Relation rel,
  			MarkBufferDirty(metabuf);
  		}
  
  		/* XLOG stuff */
  		if (RelationNeedsWAL(rel))
  		{
  			xl_btree_insert xlrec;
! 			BlockNumber xldownlink;
  			xl_btree_metadata xlmeta;
  			uint8		xlinfo;
  			XLogRecPtr	recptr;
--- 828,848 ----
  			MarkBufferDirty(metabuf);
  		}
  
+ 		/* clear INCOMPLETE_SPLIT flag on child if this finishes a split */
+ 		if (!P_ISLEAF(lpageop))
+ 		{
+ 			Page		cpage = BufferGetPage(cbuf);
+ 			BTPageOpaque cpageop = (BTPageOpaque) PageGetSpecialPointer(cpage);
+ 			Assert(P_INCOMPLETE_SPLIT(cpageop));
+ 			cpageop->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+ 			MarkBufferDirty(cbuf);
+ 		}
+ 
  		/* XLOG stuff */
  		if (RelationNeedsWAL(rel))
  		{
  			xl_btree_insert xlrec;
! 			BlockNumber xlleftchild;
  			xl_btree_metadata xlmeta;
  			uint8		xlinfo;
  			XLogRecPtr	recptr;
***************
*** 812,823 **** _bt_insertonpg(Relation rel,
  				xlinfo = XLOG_BTREE_INSERT_LEAF;
  			else
  			{
! 				xldownlink = ItemPointerGetBlockNumber(&(itup->t_tid));
! 				Assert(ItemPointerGetOffsetNumber(&(itup->t_tid)) == P_HIKEY);
! 
! 				nextrdata->data = (char *) &xldownlink;
  				nextrdata->len = sizeof(BlockNumber);
! 				nextrdata->buffer = InvalidBuffer;
  				nextrdata->next = nextrdata + 1;
  				nextrdata++;
  
--- 862,876 ----
  				xlinfo = XLOG_BTREE_INSERT_LEAF;
  			else
  			{
! 				/*
! 				 * Include the block number of the left child, whose
! 				 * INCOMPLETE_SPLIT flag is cleared.
! 				 */
! 				xlleftchild = BufferGetBlockNumber(cbuf);
! 				nextrdata->data = (char *) &xlleftchild;
  				nextrdata->len = sizeof(BlockNumber);
! 				nextrdata->buffer = cbuf;
! 				nextrdata->buffer_std = true;
  				nextrdata->next = nextrdata + 1;
  				nextrdata++;
  
***************
*** 870,875 **** _bt_insertonpg(Relation rel,
--- 923,930 ----
  		END_CRIT_SECTION();
  
  		/* release buffers; send out relcache inval if metapage changed */
+ 		if (!P_ISLEAF(lpageop))
+ 			_bt_relbuf(rel, cbuf);
  		if (BufferIsValid(metabuf))
  		{
  			if (!InRecovery)
***************
*** 889,899 **** _bt_insertonpg(Relation rel,
   *		new right page.  newitemoff etc. tell us about the new item that
   *		must be inserted along with the data from the old page.
   *
   *		Returns the new right sibling of buf, pinned and write-locked.
   *		The pin and lock on buf are maintained.
   */
  static Buffer
! _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
  		  OffsetNumber newitemoff, Size newitemsz, IndexTuple newitem,
  		  bool newitemonleft)
  {
--- 944,958 ----
   *		new right page.  newitemoff etc. tell us about the new item that
   *		must be inserted along with the data from the old page.
   *
+  *		When splitting a non-leaf page, 'cbuf' is the left-sibling of the
+  *		page we're inserting the downlink for. This function will clear the
+  *		INCOMPLETE_SPLIT flag on it, and release the buffer.
+  *
   *		Returns the new right sibling of buf, pinned and write-locked.
   *		The pin and lock on buf are maintained.
   */
  static Buffer
! _bt_split(Relation rel, Buffer buf, Buffer cbuf, OffsetNumber firstright,
  		  OffsetNumber newitemoff, Size newitemsz, IndexTuple newitem,
  		  bool newitemonleft)
  {
***************
*** 961,966 **** _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
--- 1020,1027 ----
  	lopaque->btpo_flags = oopaque->btpo_flags;
  	lopaque->btpo_flags &= ~(BTP_ROOT | BTP_SPLIT_END | BTP_HAS_GARBAGE);
  	ropaque->btpo_flags = lopaque->btpo_flags;
+ 	/* set flag in left page indicating that the right page has no downlink */
+ 	lopaque->btpo_flags |= BTP_INCOMPLETE_SPLIT;
  	lopaque->btpo_prev = oopaque->btpo_prev;
  	lopaque->btpo_next = rightpagenumber;
  	ropaque->btpo_prev = origpagenumber;
***************
*** 1184,1189 **** _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
--- 1245,1262 ----
  		MarkBufferDirty(sbuf);
  	}
  
+ 	/*
+ 	 * Clear INCOMPLETE_SPLIT flag on child if inserting the new item finishes
+ 	 * a split.
+ 	 */
+ 	if (ropaque->btpo.level > 0)
+ 	{
+ 		Page		cpage = BufferGetPage(cbuf);
+ 		BTPageOpaque cpageop = (BTPageOpaque) PageGetSpecialPointer(cpage);
+ 		cpageop->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+ 		MarkBufferDirty(cbuf);
+ 	}
+ 
  	/* XLOG stuff */
  	if (RelationNeedsWAL(rel))
  	{
***************
*** 1206,1239 **** _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
  
  		lastrdata = &rdata[0];
  
- 		if (ropaque->btpo.level > 0)
- 		{
- 			/* Log downlink on non-leaf pages */
- 			lastrdata->next = lastrdata + 1;
- 			lastrdata++;
- 
- 			lastrdata->data = (char *) &newitem->t_tid.ip_blkid;
- 			lastrdata->len = sizeof(BlockIdData);
- 			lastrdata->buffer = InvalidBuffer;
- 
- 			/*
- 			 * We must also log the left page's high key, because the right
- 			 * page's leftmost key is suppressed on non-leaf levels.  Show it
- 			 * as belonging to the left page buffer, so that it is not stored
- 			 * if XLogInsert decides it needs a full-page image of the left
- 			 * page.
- 			 */
- 			lastrdata->next = lastrdata + 1;
- 			lastrdata++;
- 
- 			itemid = PageGetItemId(origpage, P_HIKEY);
- 			item = (IndexTuple) PageGetItem(origpage, itemid);
- 			lastrdata->data = (char *) item;
- 			lastrdata->len = MAXALIGN(IndexTupleSize(item));
- 			lastrdata->buffer = buf;	/* backup block 1 */
- 			lastrdata->buffer_std = true;
- 		}
- 
  		/*
  		 * Log the new item and its offset, if it was inserted on the left
  		 * page. (If it was put on the right page, we don't need to explicitly
--- 1279,1284 ----
***************
*** 1260,1276 **** _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
  			lastrdata->buffer = buf;	/* backup block 1 */
  			lastrdata->buffer_std = true;
  		}
! 		else if (ropaque->btpo.level == 0)
  		{
  			/*
! 			 * Although we don't need to WAL-log the new item, we still need
! 			 * XLogInsert to consider storing a full-page image of the left
! 			 * page, so make an empty entry referencing that buffer. This also
! 			 * ensures that the left page is always backup block 1.
  			 */
  			lastrdata->next = lastrdata + 1;
  			lastrdata++;
  
  			lastrdata->data = NULL;
  			lastrdata->len = 0;
  			lastrdata->buffer = buf;	/* backup block 1 */
--- 1305,1344 ----
  			lastrdata->buffer = buf;	/* backup block 1 */
  			lastrdata->buffer_std = true;
  		}
! 
! 		/* Log left page */
! 		if (ropaque->btpo.level > 0)
  		{
+ 			lastrdata->next = lastrdata + 1;
+ 			lastrdata++;
+ 
  			/*
! 			 * We must also log the left page's high key, because the right
! 			 * page's leftmost key is suppressed on non-leaf levels.  Show it
! 			 * as belonging to the left page buffer, so that it is not stored
! 			 * if XLogInsert decides it needs a full-page image of the left
! 			 * page.
  			 */
+ 			itemid = PageGetItemId(origpage, P_HIKEY);
+ 			item = (IndexTuple) PageGetItem(origpage, itemid);
+ 			lastrdata->data = (char *) item;
+ 			lastrdata->len = MAXALIGN(IndexTupleSize(item));
+ 			lastrdata->buffer = buf;	/* backup block 1 */
+ 			lastrdata->buffer_std = true;
+ 		}
+ 
+ 		if (ropaque->btpo.level == 0 && !newitemonleft)
+ 		{
  			lastrdata->next = lastrdata + 1;
  			lastrdata++;
  
+ 			/*
+ 			 * Although we don't need to WAL-log anything on the left page,
+ 			 * the new item, we still need XLogInsert to consider storing a
+ 			 * full-page image of the left page, so make an empty entry
+ 			 * referencing that buffer. This also ensures that the left page
+ 			 * is always backup block 1.
+ 			 */
  			lastrdata->data = NULL;
  			lastrdata->len = 0;
  			lastrdata->buffer = buf;	/* backup block 1 */
***************
*** 1278,1283 **** _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
--- 1346,1367 ----
  		}
  
  		/*
+ 		 * Log block number of left child, whose INCOMPLETE_SPLIT flag this
+ 		 * insertion clears.
+ 		 */
+ 		if (ropaque->btpo.level > 0)
+ 		{
+ 			BlockNumber cblkno = BufferGetBlockNumber(cbuf);
+ 			lastrdata->next = lastrdata + 1;
+ 			lastrdata++;
+ 
+ 			lastrdata->data = (char *) &cblkno;
+ 			lastrdata->len = sizeof(BlockNumber);
+ 			lastrdata->buffer = cbuf;	/* backup block 2 */
+ 			lastrdata->buffer_std = true;
+ 		}
+ 
+ 		/*
  		 * Log the contents of the right page in the format understood by
  		 * _bt_restore_page(). We set lastrdata->buffer to InvalidBuffer,
  		 * because we're going to recreate the whole page anyway, so it should
***************
*** 1306,1312 **** _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
  
  			lastrdata->data = NULL;
  			lastrdata->len = 0;
! 			lastrdata->buffer = sbuf;	/* backup block 2 */
  			lastrdata->buffer_std = true;
  		}
  
--- 1390,1396 ----
  
  			lastrdata->data = NULL;
  			lastrdata->len = 0;
! 			lastrdata->buffer = sbuf;	/* bkp block 2 (leaf) or 3 (non-leaf) */
  			lastrdata->buffer_std = true;
  		}
  
***************
*** 1333,1338 **** _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
--- 1417,1426 ----
  	if (!P_RIGHTMOST(ropaque))
  		_bt_relbuf(rel, sbuf);
  
+ 	/* release the child */
+ 	if (ropaque->btpo.level > 0)
+ 		_bt_relbuf(rel, cbuf);
+ 
  	/* split's done */
  	return rbuf;
  }
***************
*** 1603,1612 **** _bt_checksplitloc(FindSplitData *state,
   *			have to be efficient (concurrent ROOT split, WAL recovery)
   * is_root - we split the true root
   * is_only - we split a page alone on its level (might have been fast root)
-  *
-  * This is exported so it can be called by nbtxlog.c.
   */
! void
  _bt_insert_parent(Relation rel,
  				  Buffer buf,
  				  Buffer rbuf,
--- 1691,1698 ----
   *			have to be efficient (concurrent ROOT split, WAL recovery)
   * is_root - we split the true root
   * is_only - we split a page alone on its level (might have been fast root)
   */
! static void
  _bt_insert_parent(Relation rel,
  				  Buffer buf,
  				  Buffer rbuf,
***************
*** 1685,1696 **** _bt_insert_parent(Relation rel,
  		 * 05/27/97
  		 */
  		ItemPointerSet(&(stack->bts_btentry.t_tid), bknum, P_HIKEY);
- 
  		pbuf = _bt_getstackbuf(rel, stack, BT_WRITE);
  
! 		/* Now we can unlock the children */
  		_bt_relbuf(rel, rbuf);
- 		_bt_relbuf(rel, buf);
  
  		/* Check for error only after writing children */
  		if (pbuf == InvalidBuffer)
--- 1771,1783 ----
  		 * 05/27/97
  		 */
  		ItemPointerSet(&(stack->bts_btentry.t_tid), bknum, P_HIKEY);
  		pbuf = _bt_getstackbuf(rel, stack, BT_WRITE);
  
! 		/*
! 		 * Now we can unlock the right child. The left child will be unlocked
! 		 * by _bt_insertonpg().
! 		 */
  		_bt_relbuf(rel, rbuf);
  
  		/* Check for error only after writing children */
  		if (pbuf == InvalidBuffer)
***************
*** 1698,1704 **** _bt_insert_parent(Relation rel,
  				 RelationGetRelationName(rel), bknum, rbknum);
  
  		/* Recursively update the parent */
! 		_bt_insertonpg(rel, pbuf, stack->bts_parent,
  					   new_item, stack->bts_offset + 1,
  					   is_only);
  
--- 1785,1791 ----
  				 RelationGetRelationName(rel), bknum, rbknum);
  
  		/* Recursively update the parent */
! 		_bt_insertonpg(rel, pbuf, buf, stack->bts_parent,
  					   new_item, stack->bts_offset + 1,
  					   is_only);
  
***************
*** 1708,1713 **** _bt_insert_parent(Relation rel,
--- 1795,1895 ----
  }
  
  /*
+  * _bt_fixup() -- Finish incomplete actions on a page.
+  *
+  * A crash or other failure can leave a split or the deletion of a half-dead
+  * page incomplete. The insertion routines won't allow to insert on a page
+  * that is incompletely split, or whose left sibling is half-dead (in which
+  * case the key of the page's downlink is too high, and needs to be replaced
+  * with the half-dead left siblings downlink key). Before inserting on such
+  * a page, call _bt_fixup() to finish the incomplete action.
+  */
+ void
+ _bt_fixup(Relation rel, Buffer buf, BTStack stack)
+ {
+ 	Page		page = BufferGetPage(buf);
+ 	BTPageOpaque opaque = (BTPageOpaque) PageGetSpecialPointer(page);
+ 
+ 	if (P_ISHALFDEAD(opaque))
+ 	{
+ 		elog(LOG, "finishing deletion of half-dead page %u",
+ 			 BufferGetBlockNumber(buf));
+ 		(void) _bt_pagedel(rel, buf, stack);
+ 	}
+ 	else if (P_LEFT_HALF_DEAD(opaque))
+ 	{
+ 		buf = _bt_walk_left(rel, buf);
+ 
+ 		elog(LOG, "finishing deletion of half-dead page %u",
+ 			 BufferGetBlockNumber(buf));
+ 		(void) _bt_pagedel(rel, buf, NULL);
+ 	}
+ 	else if (P_INCOMPLETE_SPLIT(opaque))
+ 	{
+ 		/* upgrade the lock */
+ 		buf = _bt_relandgetbuf(rel, buf, BufferGetBlockNumber(buf), BT_WRITE);
+ 		page = BufferGetPage(buf);
+ 		opaque = (BTPageOpaque) PageGetSpecialPointer(page);
+ 		if (!P_INCOMPLETE_SPLIT(opaque))
+ 			_bt_relbuf(rel, buf);
+ 		else
+ 			_bt_finish_split(rel, buf, stack);
+ 	}
+ 	else
+ 		_bt_relbuf(rel, buf);
+ }
+ 
+ /*
+  * _bt_finish_split() -- Finish an incomplete split
+  *
+  * On entry, we hold write-mode lock on it, and the lock is released on
+  * exit.
+  */
+ static void
+ _bt_finish_split(Relation rel, Buffer lbuf, BTStack stack)
+ {
+ 	Page		lpage = BufferGetPage(lbuf);
+ 	BTPageOpaque lpageop = (BTPageOpaque) PageGetSpecialPointer(lpage);
+ 	Buffer		rbuf;
+ 	Page		rpage;
+ 	BTPageOpaque rpageop;
+ 	bool		was_root;
+ 	bool		was_only;
+ 
+ 	/* Lock right sibling, the one missing the downlink */
+ 	rbuf = _bt_getbuf(rel, lpageop->btpo_next, BT_WRITE);
+ 	rpage = BufferGetPage(rbuf);
+ 	rpageop = (BTPageOpaque) PageGetSpecialPointer(rpage);
+ 
+ 	/* Could this be a root split? */
+ 	if (!stack)
+ 	{
+ 		Buffer		metabuf;
+ 		Page		metapg;
+ 		BTMetaPageData *metad;
+ 
+ 		/* acquire lock on the metapage */
+ 		metabuf = _bt_getbuf(rel, BTREE_METAPAGE, BT_WRITE);
+ 		metapg = BufferGetPage(metabuf);
+ 		metad = BTPageGetMeta(metapg);
+ 
+ 		was_root = (metad->btm_root == BufferGetBlockNumber(lbuf));
+ 
+ 		_bt_relbuf(rel, metabuf);
+ 	}
+ 	else
+ 		was_root = false;
+ 
+ 	/* Was this the only page on the level before split? */
+ 	was_only = (P_LEFTMOST(lpageop) && P_RIGHTMOST(rpageop));
+ 
+ 	elog(DEBUG1, "finishing incomplete split of %u/%u",
+ 		 BufferGetBlockNumber(lbuf), BufferGetBlockNumber(rbuf));
+ 
+ 	_bt_insert_parent(rel, lbuf, rbuf, stack, was_root, was_only);
+ }
+ 
+ /*
   *	_bt_getstackbuf() -- Walk back up the tree one step, and find the item
   *						 we last looked at in the parent.
   *
***************
*** 1739,1744 **** _bt_getstackbuf(Relation rel, BTStack stack, int access)
--- 1921,1932 ----
  		page = BufferGetPage(buf);
  		opaque = (BTPageOpaque) PageGetSpecialPointer(page);
  
+ 		if (P_NEEDS_FIXUP(opaque))
+ 		{
+ 			_bt_fixup(rel, buf, stack);
+ 			continue;
+ 		}
+ 
  		if (!P_IGNORE(opaque))
  		{
  			OffsetNumber offnum,
***************
*** 1843,1848 **** _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
--- 2031,2037 ----
  				rbkno;
  	BlockNumber rootblknum;
  	BTPageOpaque rootopaque;
+ 	BTPageOpaque lopaque;
  	ItemId		itemid;
  	IndexTuple	item;
  	Size		itemsz;
***************
*** 1854,1859 **** _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
--- 2043,2049 ----
  	lbkno = BufferGetBlockNumber(lbuf);
  	rbkno = BufferGetBlockNumber(rbuf);
  	lpage = BufferGetPage(lbuf);
+ 	lopaque = (BTPageOpaque) PageGetSpecialPointer(lpage);
  
  	/* get a new root page */
  	rootbuf = _bt_getbuf(rel, P_NEW, BT_WRITE);
***************
*** 1927,1932 **** _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
--- 2117,2127 ----
  			 BufferGetBlockNumber(lbuf), RelationGetRelationName(rel));
  	pfree(new_item);
  
+ 	/* Clear the incomplete-split flag in the left child */
+ 	Assert(P_INCOMPLETE_SPLIT(lopaque));
+ 	lopaque->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+ 	MarkBufferDirty(lbuf);
+ 
  	MarkBufferDirty(rootbuf);
  	MarkBufferDirty(metabuf);
  
***************
*** 1935,1941 **** _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
  	{
  		xl_btree_newroot xlrec;
  		XLogRecPtr	recptr;
! 		XLogRecData rdata[2];
  
  		xlrec.node = rel->rd_node;
  		xlrec.rootblk = rootblknum;
--- 2130,2136 ----
  	{
  		xl_btree_newroot xlrec;
  		XLogRecPtr	recptr;
! 		XLogRecData rdata[3];
  
  		xlrec.node = rel->rd_node;
  		xlrec.rootblk = rootblknum;
***************
*** 1954,1960 **** _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
  		rdata[1].len = ((PageHeader) rootpage)->pd_special -
  			((PageHeader) rootpage)->pd_upper;
  		rdata[1].buffer = InvalidBuffer;
! 		rdata[1].next = NULL;
  
  		recptr = XLogInsert(RM_BTREE_ID, XLOG_BTREE_NEWROOT, rdata);
  
--- 2149,2161 ----
  		rdata[1].len = ((PageHeader) rootpage)->pd_special -
  			((PageHeader) rootpage)->pd_upper;
  		rdata[1].buffer = InvalidBuffer;
! 		rdata[1].next = &(rdata[2]);
! 
! 		/* Make a full-page image of the left child if needed */
! 		rdata[2].data = NULL;
! 		rdata[2].len = 0;
! 		rdata[2].buffer = lbuf;
! 		rdata[2].next = NULL;
  
  		recptr = XLogInsert(RM_BTREE_ID, XLOG_BTREE_NEWROOT, rdata);
  
*** a/src/backend/access/nbtree/nbtpage.c
--- b/src/backend/access/nbtree/nbtpage.c
***************
*** 980,993 **** _bt_parent_deletion_safe(Relation rel, BlockNumber target, BTStack stack)
  	Page		page;
  	BTPageOpaque opaque;
  
- 	/*
- 	 * In recovery mode, assume the deletion being replayed is valid.  We
- 	 * can't always check it because we won't have a full search stack, and we
- 	 * should complain if there's a problem, anyway.
- 	 */
- 	if (InRecovery)
- 		return true;
- 
  	/* Locate the parent's downlink (updating the stack entry if needed) */
  	ItemPointerSet(&(stack->bts_btentry.t_tid), target, P_HIKEY);
  	pbuf = _bt_getstackbuf(rel, stack, BT_READ);
--- 980,985 ----
***************
*** 1081,1089 **** _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
  	ScanKey		itup_scankey;
  	Buffer		lbuf,
  				rbuf,
! 				pbuf;
  	bool		parent_half_dead;
  	bool		parent_one_child;
  	bool		rightsib_empty;
  	Buffer		metabuf = InvalidBuffer;
  	Page		metapg = NULL;
--- 1073,1083 ----
  	ScanKey		itup_scankey;
  	Buffer		lbuf,
  				rbuf,
! 				pbuf,
! 				prbuf;
  	bool		parent_half_dead;
  	bool		parent_one_child;
+ 	bool		leftsib_half_dead;
  	bool		rightsib_empty;
  	Buffer		metabuf = InvalidBuffer;
  	Page		metapg = NULL;
***************
*** 1133,1182 **** _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
  	 */
  	if (stack == NULL)
  	{
! 		if (!InRecovery)
! 		{
! 			/* we need an insertion scan key to do our search, so build one */
! 			itup_scankey = _bt_mkscankey(rel, targetkey);
! 			/* find the leftmost leaf page containing this key */
! 			stack = _bt_search(rel, rel->rd_rel->relnatts, itup_scankey, false,
! 							   &lbuf, BT_READ);
! 			/* don't need a pin on that either */
! 			_bt_relbuf(rel, lbuf);
  
! 			/*
! 			 * If we are trying to delete an interior page, _bt_search did
! 			 * more than we needed.  Locate the stack item pointing to our
! 			 * parent level.
! 			 */
! 			ilevel = 0;
! 			for (;;)
! 			{
! 				if (stack == NULL)
! 					elog(ERROR, "not enough stack items");
! 				if (ilevel == targetlevel)
! 					break;
! 				stack = stack->bts_parent;
! 				ilevel++;
! 			}
! 		}
! 		else
  		{
! 			/*
! 			 * During WAL recovery, we can't use _bt_search (for one reason,
! 			 * it might invoke user-defined comparison functions that expect
! 			 * facilities not available in recovery mode).	Instead, just set
! 			 * up a dummy stack pointing to the left end of the parent tree
! 			 * level, from which _bt_getstackbuf will walk right to the parent
! 			 * page.  Painful, but we don't care too much about performance in
! 			 * this scenario.
! 			 */
! 			pbuf = _bt_get_endpoint(rel, targetlevel + 1, false);
! 			stack = (BTStack) palloc(sizeof(BTStackData));
! 			stack->bts_blkno = BufferGetBlockNumber(pbuf);
! 			stack->bts_offset = InvalidOffsetNumber;
! 			/* bts_btentry will be initialized below */
! 			stack->bts_parent = NULL;
! 			_bt_relbuf(rel, pbuf);
  		}
  	}
  
--- 1127,1155 ----
  	 */
  	if (stack == NULL)
  	{
! 		/* we need an insertion scan key to do our search, so build one */
! 		itup_scankey = _bt_mkscankey(rel, targetkey);
! 		/* find the leftmost leaf page containing this key */
! 		stack = _bt_search(rel, rel->rd_rel->relnatts, itup_scankey, false,
! 						   &lbuf, BT_READ);
! 		/* don't need a pin on that either */
! 		_bt_relbuf(rel, lbuf);
! 		lbuf = InvalidBuffer;
  
! 		/*
! 		 * If we are trying to delete an interior page, _bt_search did
! 		 * more than we needed.  Locate the stack item pointing to our
! 		 * parent level.
! 		 */
! 		ilevel = 0;
! 		for (;;)
  		{
! 			if (stack == NULL)
! 				elog(ERROR, "not enough stack items");
! 			if (ilevel == targetlevel)
! 				break;
! 			stack = stack->bts_parent;
! 			ilevel++;
  		}
  	}
  
***************
*** 1199,1207 **** _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
  	 * target page.  The sibling that was current a moment ago could have
  	 * split, so we may have to move right.  This search could fail if either
  	 * the sibling or the target page was deleted by someone else meanwhile;
! 	 * if so, give up.	(Right now, that should never happen, since page
! 	 * deletion is only done in VACUUM and there shouldn't be multiple VACUUMs
! 	 * concurrently on the same table.)
  	 */
  	if (leftsib != P_NONE)
  	{
--- 1172,1180 ----
  	 * target page.  The sibling that was current a moment ago could have
  	 * split, so we may have to move right.  This search could fail if either
  	 * the sibling or the target page was deleted by someone else meanwhile;
! 	 * if so, give up. Although page deletion is only initiated by VACUUM,
! 	 * other backends can delete half-dead pages they encounter during
! 	 * insertions.
  	 */
  	if (leftsib != P_NONE)
  	{
***************
*** 1223,1228 **** _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
--- 1196,1203 ----
  			page = BufferGetPage(lbuf);
  			opaque = (BTPageOpaque) PageGetSpecialPointer(page);
  		}
+ 
+ 		leftsib_half_dead = P_ISHALFDEAD(opaque);
  	}
  	else
  		lbuf = InvalidBuffer;
***************
*** 1311,1316 **** _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
--- 1286,1300 ----
  	}
  
  	/*
+ 	 * Also lock the parent's right sibling, if we need to set its
+ 	 * LEFT_IS_HALF_DEAD flag.
+ 	 */
+ 	if (parent_half_dead)
+ 		prbuf = _bt_getbuf(rel, opaque->btpo_next, BT_WRITE);
+ 	else
+ 		prbuf = InvalidBuffer;
+ 
+ 	/*
  	 * If we are deleting the next-to-last page on the target's level, then
  	 * the rightsib is a candidate to become the new fast root. (In theory, it
  	 * might be possible to push the fast root even further down, but the odds
***************
*** 1397,1402 **** _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
--- 1381,1390 ----
  	{
  		PageIndexTupleDelete(page, poffset);
  		opaque->btpo_flags |= BTP_HALF_DEAD;
+ 
+ 		page = BufferGetPage(prbuf);
+ 		opaque = (BTPageOpaque) PageGetSpecialPointer(page);
+ 		opaque->btpo_flags |= BTP_LEFT_HALF_DEAD;
  	}
  	else
  	{
***************
*** 1426,1431 **** _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
--- 1414,1424 ----
  	opaque = (BTPageOpaque) PageGetSpecialPointer(page);
  	Assert(opaque->btpo_prev == target);
  	opaque->btpo_prev = leftsib;
+ 	/* Update the right page's left-is-half-dead flag */
+ 	if (leftsib_half_dead)
+ 		opaque->btpo_flags |= BTP_LEFT_HALF_DEAD;
+ 	else
+ 		opaque->btpo_flags &= ~BTP_LEFT_HALF_DEAD;
  	rightsib_empty = (P_FIRSTDATAKEY(opaque) > PageGetMaxOffsetNumber(page));
  
  	/*
***************
*** 1458,1463 **** _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
--- 1451,1458 ----
  	MarkBufferDirty(buf);
  	if (BufferIsValid(lbuf))
  		MarkBufferDirty(lbuf);
+ 	if (BufferIsValid(prbuf))
+ 		MarkBufferDirty(prbuf);
  
  	/* XLOG stuff */
  	if (RelationNeedsWAL(rel))
***************
*** 1466,1472 **** _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
  		xl_btree_metadata xlmeta;
  		uint8		xlinfo;
  		XLogRecPtr	recptr;
! 		XLogRecData rdata[5];
  		XLogRecData *nextrdata;
  
  		xlrec.target.node = rel->rd_node;
--- 1461,1467 ----
  		xl_btree_metadata xlmeta;
  		uint8		xlinfo;
  		XLogRecPtr	recptr;
! 		XLogRecData rdata[6];
  		XLogRecData *nextrdata;
  
  		xlrec.target.node = rel->rd_node;
***************
*** 1474,1479 **** _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
--- 1469,1481 ----
  		xlrec.deadblk = target;
  		xlrec.leftblk = leftsib;
  		xlrec.rightblk = rightsib;
+ 		xlrec.flags = 0;
+ 		if (leftsib_half_dead)
+ 			xlrec.flags |= DP_LEFT_IS_HALF_DEAD;
+ 		if (BufferIsValid(prbuf))
+ 			xlrec.parentright = BufferGetBlockNumber(prbuf);
+ 		else
+ 			xlrec.parentright = InvalidBlockNumber;
  		xlrec.btpo_xact = opaque->btpo.xact;
  
  		rdata[0].data = (char *) &xlrec;
***************
*** 1502,1517 **** _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
  
  		nextrdata->data = NULL;
  		nextrdata->len = 0;
- 		nextrdata->next = nextrdata + 1;
  		nextrdata->buffer = pbuf;
  		nextrdata->buffer_std = true;
  		nextrdata++;
  
  		nextrdata->data = NULL;
  		nextrdata->len = 0;
  		nextrdata->buffer = rbuf;
  		nextrdata->buffer_std = true;
- 		nextrdata->next = NULL;
  
  		if (BufferIsValid(lbuf))
  		{
--- 1504,1518 ----
  
  		nextrdata->data = NULL;
  		nextrdata->len = 0;
  		nextrdata->buffer = pbuf;
  		nextrdata->buffer_std = true;
+ 		nextrdata->next = nextrdata + 1;
  		nextrdata++;
  
  		nextrdata->data = NULL;
  		nextrdata->len = 0;
  		nextrdata->buffer = rbuf;
  		nextrdata->buffer_std = true;
  
  		if (BufferIsValid(lbuf))
  		{
***************
*** 1521,1529 **** _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
  			nextrdata->len = 0;
  			nextrdata->buffer = lbuf;
  			nextrdata->buffer_std = true;
- 			nextrdata->next = NULL;
  		}
  
  		recptr = XLogInsert(RM_BTREE_ID, xlinfo, rdata);
  
  		if (BufferIsValid(metabuf))
--- 1522,1540 ----
  			nextrdata->len = 0;
  			nextrdata->buffer = lbuf;
  			nextrdata->buffer_std = true;
  		}
  
+ 		if (BufferIsValid(prbuf))
+ 		{
+ 			nextrdata->next = nextrdata + 1;
+ 			nextrdata++;
+ 			nextrdata->data = NULL;
+ 			nextrdata->len = 0;
+ 			nextrdata->buffer = prbuf;
+ 			nextrdata->buffer_std = true;
+ 		}
+ 		nextrdata->next = NULL;
+ 
  		recptr = XLogInsert(RM_BTREE_ID, xlinfo, rdata);
  
  		if (BufferIsValid(metabuf))
***************
*** 1541,1546 **** _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
--- 1552,1562 ----
  			page = BufferGetPage(lbuf);
  			PageSetLSN(page, recptr);
  		}
+ 		if (BufferIsValid(prbuf))
+ 		{
+ 			page = BufferGetPage(prbuf);
+ 			PageSetLSN(page, recptr);
+ 		}
  	}
  
  	END_CRIT_SECTION();
***************
*** 1551,1593 **** _bt_pagedel(Relation rel, Buffer buf, BTStack stack)
  		CacheInvalidateRelcache(rel);
  		_bt_relbuf(rel, metabuf);
  	}
! 	/* can always release leftsib immediately */
  	if (BufferIsValid(lbuf))
  		_bt_relbuf(rel, lbuf);
  
  	/*
  	 * If parent became half dead, recurse to delete it. Otherwise, if right
  	 * sibling is empty and is now the last child of the parent, recurse to
  	 * try to delete it.  (These cases cannot apply at the same time, though
  	 * the second case might itself recurse to the first.)
- 	 *
- 	 * When recursing to parent, we hold the lock on the target page until
- 	 * done.  This delays any insertions into the keyspace that was just
- 	 * effectively reassigned to the parent's right sibling.  If we allowed
- 	 * that, and there were enough such insertions before we finish deleting
- 	 * the parent, page splits within that keyspace could lead to inserting
- 	 * out-of-order keys into the grandparent level.  It is thought that that
- 	 * wouldn't have any serious consequences, but it still seems like a
- 	 * pretty bad idea.
  	 */
  	if (parent_half_dead)
  	{
  		/* recursive call will release pbuf */
  		_bt_relbuf(rel, rbuf);
  		result = _bt_pagedel(rel, pbuf, stack->bts_parent) + 1;
- 		_bt_relbuf(rel, buf);
  	}
  	else if (parent_one_child && rightsib_empty)
  	{
  		_bt_relbuf(rel, pbuf);
- 		_bt_relbuf(rel, buf);
  		/* recursive call will release rbuf */
  		result = _bt_pagedel(rel, rbuf, stack) + 1;
  	}
  	else
  	{
  		_bt_relbuf(rel, pbuf);
- 		_bt_relbuf(rel, buf);
  		_bt_relbuf(rel, rbuf);
  		result = 1;
  	}
--- 1567,1601 ----
  		CacheInvalidateRelcache(rel);
  		_bt_relbuf(rel, metabuf);
  	}
! 	/* can always release buffer and its left sibling immediately */
! 	_bt_relbuf(rel, buf);
  	if (BufferIsValid(lbuf))
  		_bt_relbuf(rel, lbuf);
+ 	if (BufferIsValid(prbuf))
+ 		_bt_relbuf(rel, prbuf);
  
  	/*
  	 * If parent became half dead, recurse to delete it. Otherwise, if right
  	 * sibling is empty and is now the last child of the parent, recurse to
  	 * try to delete it.  (These cases cannot apply at the same time, though
  	 * the second case might itself recurse to the first.)
  	 */
  	if (parent_half_dead)
  	{
  		/* recursive call will release pbuf */
  		_bt_relbuf(rel, rbuf);
+ 
  		result = _bt_pagedel(rel, pbuf, stack->bts_parent) + 1;
  	}
  	else if (parent_one_child && rightsib_empty)
  	{
  		_bt_relbuf(rel, pbuf);
  		/* recursive call will release rbuf */
  		result = _bt_pagedel(rel, rbuf, stack) + 1;
  	}
  	else
  	{
  		_bt_relbuf(rel, pbuf);
  		_bt_relbuf(rel, rbuf);
  		result = 1;
  	}
*** a/src/backend/access/nbtree/nbtsearch.c
--- b/src/backend/access/nbtree/nbtsearch.c
***************
*** 29,35 **** static bool _bt_readpage(IndexScanDesc scan, ScanDirection dir,
  static void _bt_saveitem(BTScanOpaque so, int itemIndex,
  			 OffsetNumber offnum, IndexTuple itup);
  static bool _bt_steppage(IndexScanDesc scan, ScanDirection dir);
- static Buffer _bt_walk_left(Relation rel, Buffer buf);
  static bool _bt_endpoint(IndexScanDesc scan, ScanDirection dir);
  
  
--- 29,34 ----
***************
*** 51,57 **** static bool _bt_endpoint(IndexScanDesc scan, ScanDirection dir);
   * NOTE that the returned buffer is read-locked regardless of the access
   * parameter.  However, access = BT_WRITE will allow an empty root page
   * to be created and returned.	When access = BT_READ, an empty index
!  * will result in *bufP being set to InvalidBuffer.
   */
  BTStack
  _bt_search(Relation rel, int keysz, ScanKey scankey, bool nextkey,
--- 50,58 ----
   * NOTE that the returned buffer is read-locked regardless of the access
   * parameter.  However, access = BT_WRITE will allow an empty root page
   * to be created and returned.	When access = BT_READ, an empty index
!  * will result in *bufP being set to InvalidBuffer. Also, in BT_WRITE mode,
!  * any incomplete splits or half-dead pages encountered during the search
!  * will be finished.
   */
  BTStack
  _bt_search(Relation rel, int keysz, ScanKey scankey, bool nextkey,
***************
*** 82,89 **** _bt_search(Relation rel, int keysz, ScanKey scankey, bool nextkey,
  		 * Race -- the page we just grabbed may have split since we read its
  		 * pointer in the parent (or metapage).  If it has, we may need to
  		 * move right to its new sibling.  Do that.
  		 */
! 		*bufP = _bt_moveright(rel, *bufP, keysz, scankey, nextkey, BT_READ);
  
  		/* if this is a leaf page, we're done */
  		page = BufferGetPage(*bufP);
--- 83,95 ----
  		 * Race -- the page we just grabbed may have split since we read its
  		 * pointer in the parent (or metapage).  If it has, we may need to
  		 * move right to its new sibling.  Do that.
+ 		 *
+ 		 * In write-mode, allow _bt_moveright to finish any incomplete splits
+ 		 * along the way.
  		 */
! 		*bufP = _bt_moveright(rel, *bufP, keysz, scankey, nextkey,
! 							  (access == BT_WRITE), stack_in,
! 							  BT_READ);
  
  		/* if this is a leaf page, we're done */
  		page = BufferGetPage(*bufP);
***************
*** 148,153 **** _bt_search(Relation rel, int keysz, ScanKey scankey, bool nextkey,
--- 154,164 ----
   * item >= scankey.  When nextkey is true, we are looking for the first
   * item strictly greater than scankey.
   *
+  * If forupdate is true, we will attempt to finish any incomplete splits
+  * or half-dead pages that we encounter. This is required when searching for
+  * a target page for an insertion, because we don't allow inserting on a
+  * page with incomplete actions. 'stack' is only used if forupdate is true.
+  *
   * On entry, we have the buffer pinned and a lock of the type specified by
   * 'access'.  If we move right, we release the buffer and lock and acquire
   * the same on the right sibling.  Return value is the buffer we stop at.
***************
*** 158,163 **** _bt_moveright(Relation rel,
--- 169,176 ----
  			  int keysz,
  			  ScanKey scankey,
  			  bool nextkey,
+ 			  bool forupdate,
+ 			  BTStack stack,
  			  int access)
  {
  	Page		page;
***************
*** 186,199 **** _bt_moveright(Relation rel,
  
  	while (!P_RIGHTMOST(opaque) &&
  		   (P_IGNORE(opaque) ||
  			_bt_compare(rel, keysz, scankey, page, P_HIKEY) >= cmpval))
  	{
! 		/* step right one page */
! 		BlockNumber rblkno = opaque->btpo_next;
  
! 		buf = _bt_relandgetbuf(rel, buf, rblkno, access);
! 		page = BufferGetPage(buf);
! 		opaque = (BTPageOpaque) PageGetSpecialPointer(page);
  	}
  
  	if (P_IGNORE(opaque))
--- 199,226 ----
  
  	while (!P_RIGHTMOST(opaque) &&
  		   (P_IGNORE(opaque) ||
+ 			(forupdate && P_NEEDS_FIXUP(opaque)) ||
  			_bt_compare(rel, keysz, scankey, page, P_HIKEY) >= cmpval))
  	{
! 		/*
! 		 * Finish any incomplete splits and remove any half-dead pages we
! 		 * encounter along the way.
! 		 */
! 		if (forupdate && P_NEEDS_FIXUP(opaque))
! 		{
! 			BlockNumber blkno = BufferGetBlockNumber(buf);
! 			_bt_fixup(rel, buf, stack);
! 			_bt_getbuf(rel, blkno, access);
! 		}
! 		else
! 		{
! 			/* step right one page */
! 			BlockNumber rblkno = opaque->btpo_next;
  
! 			buf = _bt_relandgetbuf(rel, buf, rblkno, access);
! 			page = BufferGetPage(buf);
! 			opaque = (BTPageOpaque) PageGetSpecialPointer(page);
! 		}
  	}
  
  	if (P_IGNORE(opaque))
***************
*** 1314,1320 **** _bt_steppage(IndexScanDesc scan, ScanDirection dir)
   * to be half-dead; the caller should check that condition and step left
   * again if it's important.
   */
! static Buffer
  _bt_walk_left(Relation rel, Buffer buf)
  {
  	Page		page;
--- 1341,1347 ----
   * to be half-dead; the caller should check that condition and step left
   * again if it's important.
   */
! Buffer
  _bt_walk_left(Relation rel, Buffer buf)
  {
  	Page		page;
*** a/src/backend/access/nbtree/nbtxlog.c
--- b/src/backend/access/nbtree/nbtxlog.c
***************
*** 21,122 ****
  #include "miscadmin.h"
  
  /*
-  * We must keep track of expected insertions due to page splits, and apply
-  * them manually if they are not seen in the WAL log during replay.  This
-  * makes it safe for page insertion to be a multiple-WAL-action process.
-  *
-  * Similarly, deletion of an only child page and deletion of its parent page
-  * form multiple WAL log entries, and we have to be prepared to follow through
-  * with the deletion if the log ends between.
-  *
-  * The data structure is a simple linked list --- this should be good enough,
-  * since we don't expect a page split or multi deletion to remain incomplete
-  * for long.  In any case we need to respect the order of operations.
-  */
- typedef struct bt_incomplete_action
- {
- 	RelFileNode node;			/* the index */
- 	bool		is_split;		/* T = pending split, F = pending delete */
- 	/* these fields are for a split: */
- 	bool		is_root;		/* we split the root */
- 	BlockNumber leftblk;		/* left half of split */
- 	BlockNumber rightblk;		/* right half of split */
- 	/* these fields are for a delete: */
- 	BlockNumber delblk;			/* parent block to be deleted */
- } bt_incomplete_action;
- 
- static List *incomplete_actions;
- 
- 
- static void
- log_incomplete_split(RelFileNode node, BlockNumber leftblk,
- 					 BlockNumber rightblk, bool is_root)
- {
- 	bt_incomplete_action *action = palloc(sizeof(bt_incomplete_action));
- 
- 	action->node = node;
- 	action->is_split = true;
- 	action->is_root = is_root;
- 	action->leftblk = leftblk;
- 	action->rightblk = rightblk;
- 	incomplete_actions = lappend(incomplete_actions, action);
- }
- 
- static void
- forget_matching_split(RelFileNode node, BlockNumber downlink, bool is_root)
- {
- 	ListCell   *l;
- 
- 	foreach(l, incomplete_actions)
- 	{
- 		bt_incomplete_action *action = (bt_incomplete_action *) lfirst(l);
- 
- 		if (RelFileNodeEquals(node, action->node) &&
- 			action->is_split &&
- 			downlink == action->rightblk)
- 		{
- 			if (is_root != action->is_root)
- 				elog(LOG, "forget_matching_split: fishy is_root data (expected %d, got %d)",
- 					 action->is_root, is_root);
- 			incomplete_actions = list_delete_ptr(incomplete_actions, action);
- 			pfree(action);
- 			break;				/* need not look further */
- 		}
- 	}
- }
- 
- static void
- log_incomplete_deletion(RelFileNode node, BlockNumber delblk)
- {
- 	bt_incomplete_action *action = palloc(sizeof(bt_incomplete_action));
- 
- 	action->node = node;
- 	action->is_split = false;
- 	action->delblk = delblk;
- 	incomplete_actions = lappend(incomplete_actions, action);
- }
- 
- static void
- forget_matching_deletion(RelFileNode node, BlockNumber delblk)
- {
- 	ListCell   *l;
- 
- 	foreach(l, incomplete_actions)
- 	{
- 		bt_incomplete_action *action = (bt_incomplete_action *) lfirst(l);
- 
- 		if (RelFileNodeEquals(node, action->node) &&
- 			!action->is_split &&
- 			delblk == action->delblk)
- 		{
- 			incomplete_actions = list_delete_ptr(incomplete_actions, action);
- 			pfree(action);
- 			break;				/* need not look further */
- 		}
- 	}
- }
- 
- /*
   * _bt_restore_page -- re-enter all the index tuples on a page
   *
   * The page is freshly init'd, and *from (length len) is a copy of what
--- 21,26 ----
***************
*** 190,212 **** _bt_restore_meta(RelFileNode rnode, XLogRecPtr lsn,
  	UnlockReleaseBuffer(metabuf);
  }
  
  static void
  btree_xlog_insert(bool isleaf, bool ismeta,
  				  XLogRecPtr lsn, XLogRecord *record)
  {
  	xl_btree_insert *xlrec = (xl_btree_insert *) XLogRecGetData(record);
  	Buffer		buffer;
  	Page		page;
  	char	   *datapos;
  	int			datalen;
  	xl_btree_metadata md;
! 	BlockNumber downlink = 0;
  
  	datapos = (char *) xlrec + SizeOfBtreeInsert;
  	datalen = record->xl_len - SizeOfBtreeInsert;
! 	if (!isleaf)
  	{
! 		memcpy(&downlink, datapos, sizeof(BlockNumber));
  		datapos += sizeof(BlockNumber);
  		datalen -= sizeof(BlockNumber);
  	}
--- 94,153 ----
  	UnlockReleaseBuffer(metabuf);
  }
  
+ /*
+  * _bt_clear_incomplete_split -- clear INCOMPLETE_SPLIT flag on a page
+  *
+  * This is a common subroutine of the redo functions of all the WAL record
+  * types that can insert a downlink: insert, split, and newroot.
+  */
+ static void
+ _bt_clear_incomplete_split(XLogRecPtr lsn, XLogRecord *record,
+ 						   RelFileNode rnode, BlockNumber cblock)
+ {
+ 	Buffer buf;
+ 
+ 	buf = XLogReadBuffer(rnode, cblock, false);
+ 	if (BufferIsValid(buf))
+ 	{
+ 		Page		page = (Page) BufferGetPage(buf);
+ 
+ 		if (lsn > PageGetLSN(page))
+ 		{
+ 			BTPageOpaque pageop = (BTPageOpaque) PageGetSpecialPointer(page);
+ 			Assert((pageop->btpo_flags & BTP_INCOMPLETE_SPLIT) != 0);
+ 			pageop->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+ 
+ 			PageSetLSN(page, lsn);
+ 			MarkBufferDirty(buf);
+ 		}
+ 		UnlockReleaseBuffer(buf);
+ 	}
+ }
+ 
  static void
  btree_xlog_insert(bool isleaf, bool ismeta,
  				  XLogRecPtr lsn, XLogRecord *record)
  {
  	xl_btree_insert *xlrec = (xl_btree_insert *) XLogRecGetData(record);
  	Buffer		buffer;
+ 	Buffer		cbuffer = InvalidBuffer;
  	Page		page;
  	char	   *datapos;
  	int			datalen;
  	xl_btree_metadata md;
! 	BlockNumber cblkno = 0;
! 	int			main_blk_index;
  
  	datapos = (char *) xlrec + SizeOfBtreeInsert;
  	datalen = record->xl_len - SizeOfBtreeInsert;
! 	/*
! 	 * if this insert finishes a split at lower level, extract the block
! 	 * number of the (left) child.
! 	 */
! 	if (!isleaf && (record->xl_info & XLR_BKP_BLOCK(0)) == 0)
  	{
! 		memcpy(&cblkno, datapos, sizeof(BlockNumber));
! 		Assert(cblkno != 0);
  		datapos += sizeof(BlockNumber);
  		datalen -= sizeof(BlockNumber);
  	}
***************
*** 217,224 **** btree_xlog_insert(bool isleaf, bool ismeta,
  		datalen -= sizeof(xl_btree_metadata);
  	}
  
! 	if (record->xl_info & XLR_BKP_BLOCK(0))
! 		(void) RestoreBackupBlock(lsn, record, 0, false, false);
  	else
  	{
  		buffer = XLogReadBuffer(xlrec->target.node,
--- 158,176 ----
  		datalen -= sizeof(xl_btree_metadata);
  	}
  
! 	if (!isleaf)
! 	{
! 		if (record->xl_info & XLR_BKP_BLOCK(0))
! 			(void) RestoreBackupBlock(lsn, record, 0, false, false);
! 		else
! 			_bt_clear_incomplete_split(lsn, record, xlrec->target.node, cblkno);
! 		main_blk_index = 1;
! 	}
! 	else
! 		main_blk_index = 0;
! 
! 	if (record->xl_info & XLR_BKP_BLOCK(main_blk_index))
! 		(void) RestoreBackupBlock(lsn, record, main_blk_index, false, false);
  	else
  	{
  		buffer = XLogReadBuffer(xlrec->target.node,
***************
*** 228,238 **** btree_xlog_insert(bool isleaf, bool ismeta,
  		{
  			page = (Page) BufferGetPage(buffer);
  
! 			if (lsn <= PageGetLSN(page))
! 			{
! 				UnlockReleaseBuffer(buffer);
! 			}
! 			else
  			{
  				if (PageAddItem(page, (Item) datapos, datalen,
  							ItemPointerGetOffsetNumber(&(xlrec->target.tid)),
--- 180,186 ----
  		{
  			page = (Page) BufferGetPage(buffer);
  
! 			if (lsn > PageGetLSN(page))
  			{
  				if (PageAddItem(page, (Item) datapos, datalen,
  							ItemPointerGetOffsetNumber(&(xlrec->target.tid)),
***************
*** 241,251 **** btree_xlog_insert(bool isleaf, bool ismeta,
  
  				PageSetLSN(page, lsn);
  				MarkBufferDirty(buffer);
- 				UnlockReleaseBuffer(buffer);
  			}
  		}
  	}
  
  	/*
  	 * Note: in normal operation, we'd update the metapage while still holding
  	 * lock on the page we inserted into.  But during replay it's not
--- 189,202 ----
  
  				PageSetLSN(page, lsn);
  				MarkBufferDirty(buffer);
  			}
+ 			UnlockReleaseBuffer(buffer);
  		}
  	}
  
+ 	if (BufferIsValid(cbuffer))
+ 		UnlockReleaseBuffer(cbuffer);
+ 
  	/*
  	 * Note: in normal operation, we'd update the metapage while still holding
  	 * lock on the page we inserted into.  But during replay it's not
***************
*** 257,266 **** btree_xlog_insert(bool isleaf, bool ismeta,
  		_bt_restore_meta(xlrec->target.node, lsn,
  						 md.root, md.level,
  						 md.fastroot, md.fastlevel);
- 
- 	/* Forget any split this insertion completes */
- 	if (!isleaf)
- 		forget_matching_split(xlrec->target.node, downlink, false);
  }
  
  static void
--- 208,213 ----
***************
*** 268,273 **** btree_xlog_split(bool onleft, bool isroot,
--- 215,222 ----
  				 XLogRecPtr lsn, XLogRecord *record)
  {
  	xl_btree_split *xlrec = (xl_btree_split *) XLogRecGetData(record);
+ 	bool		isleaf = (xlrec->level == 0);
+ 	Buffer		lbuf;
  	Buffer		rbuf;
  	Page		rpage;
  	BTPageOpaque ropaque;
***************
*** 278,319 **** btree_xlog_split(bool onleft, bool isroot,
  	Size		newitemsz = 0;
  	Item		left_hikey = NULL;
  	Size		left_hikeysz = 0;
  
  	datapos = (char *) xlrec + SizeOfBtreeSplit;
  	datalen = record->xl_len - SizeOfBtreeSplit;
  
! 	/* Forget any split this insertion completes */
! 	if (xlrec->level > 0)
! 	{
! 		/* we assume SizeOfBtreeSplit is at least 16-bit aligned */
! 		BlockNumber downlink = BlockIdGetBlockNumber((BlockId) datapos);
! 
! 		datapos += sizeof(BlockIdData);
! 		datalen -= sizeof(BlockIdData);
! 
! 		forget_matching_split(xlrec->node, downlink, false);
! 
! 		/* Extract left hikey and its size (still assuming 16-bit alignment) */
! 		if (!(record->xl_info & XLR_BKP_BLOCK(0)))
! 		{
! 			/* We assume 16-bit alignment is enough for IndexTupleSize */
! 			left_hikey = (Item) datapos;
! 			left_hikeysz = MAXALIGN(IndexTupleSize(left_hikey));
! 
! 			datapos += left_hikeysz;
! 			datalen -= left_hikeysz;
! 		}
! 	}
! 
! 	/* Extract newitem and newitemoff, if present */
  	if (onleft)
  	{
- 		/* Extract the offset (still assuming 16-bit alignment) */
  		memcpy(&newitemoff, datapos, sizeof(OffsetNumber));
  		datapos += sizeof(OffsetNumber);
  		datalen -= sizeof(OffsetNumber);
  	}
- 
  	if (onleft && !(record->xl_info & XLR_BKP_BLOCK(0)))
  	{
  		/*
--- 227,244 ----
  	Size		newitemsz = 0;
  	Item		left_hikey = NULL;
  	Size		left_hikeysz = 0;
+ 	BlockNumber cblkno = InvalidBlockNumber;
  
  	datapos = (char *) xlrec + SizeOfBtreeSplit;
  	datalen = record->xl_len - SizeOfBtreeSplit;
  
! 	/* Extract newitemoff and newitem, if present */
  	if (onleft)
  	{
  		memcpy(&newitemoff, datapos, sizeof(OffsetNumber));
  		datapos += sizeof(OffsetNumber);
  		datalen -= sizeof(OffsetNumber);
  	}
  	if (onleft && !(record->xl_info & XLR_BKP_BLOCK(0)))
  	{
  		/*
***************
*** 327,332 **** btree_xlog_split(bool onleft, bool isroot,
--- 252,288 ----
  		datalen -= newitemsz;
  	}
  
+ 	/* Extract left hikey and its size (still assuming 16-bit alignment) */
+ 	if (!isleaf && !(record->xl_info & XLR_BKP_BLOCK(0)))
+ 	{
+ 		left_hikey = (Item) datapos;
+ 		left_hikeysz = MAXALIGN(IndexTupleSize(left_hikey));
+ 		datapos += left_hikeysz;
+ 		datalen -= left_hikeysz;
+ 	}
+ 	/*
+ 	 * If this insertion finishes an incomplete split, get the block number
+ 	 * of the child.
+ 	 */
+ 	if (!isleaf && !(record->xl_info & XLR_BKP_BLOCK(1)))
+ 	{
+ 		memcpy(&cblkno, datapos, sizeof(BlockNumber));
+ 		datapos += sizeof(BlockNumber);
+ 		datalen -= sizeof(BlockNumber);
+ 	}
+ 
+ 	/*
+ 	 * Clear the incomplete split flag on the left sibling of the child page
+ 	 * this is a downlink for.
+ 	 */
+ 	if (!isleaf)
+ 	{
+ 		if (record->xl_info & XLR_BKP_BLOCK(2))
+ 			(void) RestoreBackupBlock(lsn, record, 2, false, false);
+ 		else
+ 			_bt_clear_incomplete_split(lsn, record, xlrec->node, cblkno);
+ 	}
+ 
  	/* Reconstruct right (new) sibling page from scratch */
  	rbuf = XLogReadBuffer(xlrec->node, xlrec->rightsib, true);
  	Assert(BufferIsValid(rbuf));
***************
*** 338,344 **** btree_xlog_split(bool onleft, bool isroot,
  	ropaque->btpo_prev = xlrec->leftsib;
  	ropaque->btpo_next = xlrec->rnext;
  	ropaque->btpo.level = xlrec->level;
! 	ropaque->btpo_flags = (xlrec->level == 0) ? BTP_LEAF : 0;
  	ropaque->btpo_cycleid = 0;
  
  	_bt_restore_page(rpage, datapos, datalen);
--- 294,300 ----
  	ropaque->btpo_prev = xlrec->leftsib;
  	ropaque->btpo_next = xlrec->rnext;
  	ropaque->btpo.level = xlrec->level;
! 	ropaque->btpo_flags = isleaf ? BTP_LEAF : 0;
  	ropaque->btpo_cycleid = 0;
  
  	_bt_restore_page(rpage, datapos, datalen);
***************
*** 347,353 **** btree_xlog_split(bool onleft, bool isroot,
  	 * On leaf level, the high key of the left page is equal to the first key
  	 * on the right page.
  	 */
! 	if (xlrec->level == 0)
  	{
  		ItemId		hiItemId = PageGetItemId(rpage, P_FIRSTDATAKEY(ropaque));
  
--- 303,309 ----
  	 * On leaf level, the high key of the left page is equal to the first key
  	 * on the right page.
  	 */
! 	if (isleaf)
  	{
  		ItemId		hiItemId = PageGetItemId(rpage, P_FIRSTDATAKEY(ropaque));
  
***************
*** 362,371 **** btree_xlog_split(bool onleft, bool isroot,
  
  	/* Now reconstruct left (original) sibling page */
  	if (record->xl_info & XLR_BKP_BLOCK(0))
! 		(void) RestoreBackupBlock(lsn, record, 0, false, false);
  	else
  	{
! 		Buffer		lbuf = XLogReadBuffer(xlrec->node, xlrec->leftsib, false);
  
  		if (BufferIsValid(lbuf))
  		{
--- 318,327 ----
  
  	/* Now reconstruct left (original) sibling page */
  	if (record->xl_info & XLR_BKP_BLOCK(0))
! 		lbuf = RestoreBackupBlock(lsn, record, 0, false, true);
  	else
  	{
! 		lbuf = XLogReadBuffer(xlrec->node, xlrec->leftsib, false);
  
  		if (BufferIsValid(lbuf))
  		{
***************
*** 422,440 **** btree_xlog_split(bool onleft, bool isroot,
  					elog(PANIC, "failed to add high key to left page after split");
  
  				/* Fix opaque fields */
! 				lopaque->btpo_flags = (xlrec->level == 0) ? BTP_LEAF : 0;
  				lopaque->btpo_next = xlrec->rightsib;
  				lopaque->btpo_cycleid = 0;
  
  				PageSetLSN(lpage, lsn);
  				MarkBufferDirty(lbuf);
  			}
- 
- 			UnlockReleaseBuffer(lbuf);
  		}
  	}
  
! 	/* We no longer need the right buffer */
  	UnlockReleaseBuffer(rbuf);
  
  	/*
--- 378,398 ----
  					elog(PANIC, "failed to add high key to left page after split");
  
  				/* Fix opaque fields */
! 				lopaque->btpo_flags = BTP_INCOMPLETE_SPLIT;
! 				if (isleaf)
! 					lopaque->btpo_flags |= BTP_LEAF;
  				lopaque->btpo_next = xlrec->rightsib;
  				lopaque->btpo_cycleid = 0;
  
  				PageSetLSN(lpage, lsn);
  				MarkBufferDirty(lbuf);
  			}
  		}
  	}
  
! 	/* We no longer need the buffers */
! 	if (BufferIsValid(lbuf))
! 		UnlockReleaseBuffer(lbuf);
  	UnlockReleaseBuffer(rbuf);
  
  	/*
***************
*** 445,476 **** btree_xlog_split(bool onleft, bool isroot,
  	 * replay, because no other index update can be in progress, and readers
  	 * will cope properly when following an obsolete left-link.
  	 */
! 	if (record->xl_info & XLR_BKP_BLOCK(1))
! 		(void) RestoreBackupBlock(lsn, record, 1, false, false);
! 	else if (xlrec->rnext != P_NONE)
  	{
! 		Buffer		buffer = XLogReadBuffer(xlrec->node, xlrec->rnext, false);
  
! 		if (BufferIsValid(buffer))
  		{
! 			Page		page = (Page) BufferGetPage(buffer);
  
! 			if (lsn > PageGetLSN(page))
  			{
! 				BTPageOpaque pageop = (BTPageOpaque) PageGetSpecialPointer(page);
  
! 				pageop->btpo_prev = xlrec->rightsib;
  
! 				PageSetLSN(page, lsn);
! 				MarkBufferDirty(buffer);
  			}
- 			UnlockReleaseBuffer(buffer);
  		}
  	}
- 
- 	/* The job ain't done till the parent link is inserted... */
- 	log_incomplete_split(xlrec->node,
- 						 xlrec->leftsib, xlrec->rightsib, isroot);
  }
  
  static void
--- 403,441 ----
  	 * replay, because no other index update can be in progress, and readers
  	 * will cope properly when following an obsolete left-link.
  	 */
! 	if (xlrec->rnext != P_NONE)
  	{
! 		/*
! 		 * the backup block containing right sibling is 2 or 3, depending
! 		 * whether this was a leaf or internal page.
! 		 */
! 		int		rnext_index = isleaf ? 2 : 3;
  
! 		if (record->xl_info & XLR_BKP_BLOCK(rnext_index))
! 			(void) RestoreBackupBlock(lsn, record, rnext_index, false, false);
! 		else
  		{
! 			Buffer		buffer;
  
! 			buffer = XLogReadBuffer(xlrec->node, xlrec->rnext, false);
! 
! 			if (BufferIsValid(buffer))
  			{
! 				Page		page = (Page) BufferGetPage(buffer);
  
! 				if (lsn > PageGetLSN(page))
! 				{
! 					BTPageOpaque pageop = (BTPageOpaque) PageGetSpecialPointer(page);
  
! 					pageop->btpo_prev = xlrec->rightsib;
! 
! 					PageSetLSN(page, lsn);
! 					MarkBufferDirty(buffer);
! 				}
! 				UnlockReleaseBuffer(buffer);
  			}
  		}
  	}
  }
  
  static void
***************
*** 850,856 **** btree_xlog_delete_page(uint8 info, XLogRecPtr lsn, XLogRecord *record)
  		}
  	}
  
! 	/* Fix left-link of right sibling */
  	if (record->xl_info & XLR_BKP_BLOCK(1))
  		(void) RestoreBackupBlock(lsn, record, 1, false, false);
  	else
--- 815,821 ----
  		}
  	}
  
! 	/* Fix left-link and flags of right sibling */
  	if (record->xl_info & XLR_BKP_BLOCK(1))
  		(void) RestoreBackupBlock(lsn, record, 1, false, false);
  	else
***************
*** 867,872 **** btree_xlog_delete_page(uint8 info, XLogRecPtr lsn, XLogRecord *record)
--- 832,841 ----
  			{
  				pageop = (BTPageOpaque) PageGetSpecialPointer(page);
  				pageop->btpo_prev = leftsib;
+ 				if (xlrec->flags & DP_LEFT_IS_HALF_DEAD)
+ 					pageop->btpo_flags |= BTP_LEFT_HALF_DEAD;
+ 				else
+ 					pageop->btpo_flags &= ~BTP_LEFT_HALF_DEAD;
  
  				PageSetLSN(page, lsn);
  				MarkBufferDirty(buffer);
***************
*** 876,886 **** btree_xlog_delete_page(uint8 info, XLogRecPtr lsn, XLogRecord *record)
  	}
  
  	/* Fix right-link of left sibling, if any */
! 	if (record->xl_info & XLR_BKP_BLOCK(2))
! 		(void) RestoreBackupBlock(lsn, record, 2, false, false);
! 	else
  	{
! 		if (leftsib != P_NONE)
  		{
  			buffer = XLogReadBuffer(xlrec->target.node, leftsib, false);
  			if (BufferIsValid(buffer))
--- 845,855 ----
  	}
  
  	/* Fix right-link of left sibling, if any */
! 	if (leftsib != P_NONE)
  	{
! 		if (record->xl_info & XLR_BKP_BLOCK(2))
! 			(void) RestoreBackupBlock(lsn, record, 2, false, false);
! 		else
  		{
  			buffer = XLogReadBuffer(xlrec->target.node, leftsib, false);
  			if (BufferIsValid(buffer))
***************
*** 903,908 **** btree_xlog_delete_page(uint8 info, XLogRecPtr lsn, XLogRecord *record)
--- 872,910 ----
  		}
  	}
  
+ 	/*
+ 	 * Set LEFT_HALF_DEAD flag in the right sibling of the parent page that's
+ 	 * now half-dead.
+ 	 */
+ 	if (info == XLOG_BTREE_DELETE_PAGE_HALF)
+ 	{
+ 		int		blkidx = (leftsib == P_NONE) ? 2 : 3;
+ 		if (record->xl_info & XLR_BKP_BLOCK(blkidx))
+ 			(void) RestoreBackupBlock(lsn, record, blkidx, false, false);
+ 		else
+ 		{
+ 			buffer = XLogReadBuffer(xlrec->target.node, xlrec->parentright, false);
+ 			if (BufferIsValid(buffer))
+ 			{
+ 				page = (Page) BufferGetPage(buffer);
+ 				if (lsn <= PageGetLSN(page))
+ 				{
+ 					UnlockReleaseBuffer(buffer);
+ 				}
+ 				else
+ 				{
+ 					pageop = (BTPageOpaque) PageGetSpecialPointer(page);
+ 					pageop->btpo_flags |= BTP_LEFT_HALF_DEAD;
+ 
+ 					PageSetLSN(page, lsn);
+ 					MarkBufferDirty(buffer);
+ 					UnlockReleaseBuffer(buffer);
+ 				}
+ 			}
+ 		}
+ 
+ 	}
+ 
  	/* Rewrite target page as empty deleted page */
  	buffer = XLogReadBuffer(xlrec->target.node, target, true);
  	Assert(BufferIsValid(buffer));
***************
*** 932,944 **** btree_xlog_delete_page(uint8 info, XLogRecPtr lsn, XLogRecord *record)
  						 md.root, md.level,
  						 md.fastroot, md.fastlevel);
  	}
- 
- 	/* Forget any completed deletion */
- 	forget_matching_deletion(xlrec->target.node, target);
- 
- 	/* If parent became half-dead, remember it for deletion */
- 	if (info == XLOG_BTREE_DELETE_PAGE_HALF)
- 		log_incomplete_deletion(xlrec->target.node, parent);
  }
  
  static void
--- 934,939 ----
***************
*** 948,957 **** btree_xlog_newroot(XLogRecPtr lsn, XLogRecord *record)
  	Buffer		buffer;
  	Page		page;
  	BTPageOpaque pageop;
! 	BlockNumber downlink = 0;
! 
! 	/* Backup blocks are not used in newroot records */
! 	Assert(!(record->xl_info & XLR_BKP_BLOCK_MASK));
  
  	buffer = XLogReadBuffer(xlrec->node, xlrec->rootblk, true);
  	Assert(BufferIsValid(buffer));
--- 943,949 ----
  	Buffer		buffer;
  	Page		page;
  	BTPageOpaque pageop;
! 	BlockNumber cblkno;
  
  	buffer = XLogReadBuffer(xlrec->node, xlrec->rootblk, true);
  	Assert(BufferIsValid(buffer));
***************
*** 974,983 **** btree_xlog_newroot(XLogRecPtr lsn, XLogRecord *record)
  		_bt_restore_page(page,
  						 (char *) xlrec + SizeOfBtreeNewroot,
  						 record->xl_len - SizeOfBtreeNewroot);
! 		/* extract downlink to the right-hand split page */
! 		itup = (IndexTuple) PageGetItem(page, PageGetItemId(page, P_FIRSTKEY));
! 		downlink = ItemPointerGetBlockNumber(&(itup->t_tid));
  		Assert(ItemPointerGetOffsetNumber(&(itup->t_tid)) == P_HIKEY);
  	}
  
  	PageSetLSN(page, lsn);
--- 966,981 ----
  		_bt_restore_page(page,
  						 (char *) xlrec + SizeOfBtreeNewroot,
  						 record->xl_len - SizeOfBtreeNewroot);
! 		/* extract block number of the left-hand split page */
! 		itup = (IndexTuple) PageGetItem(page, PageGetItemId(page, P_HIKEY));
! 		cblkno = ItemPointerGetBlockNumber(&(itup->t_tid));
  		Assert(ItemPointerGetOffsetNumber(&(itup->t_tid)) == P_HIKEY);
+ 
+ 		/* Clear the incomplete-split flag in left child */
+ 		if (record->xl_info & XLR_BKP_BLOCK(0))
+ 			(void) RestoreBackupBlock(lsn, record, 0, false, false);
+ 		else
+ 			_bt_clear_incomplete_split(lsn, record, xlrec->node, cblkno);
  	}
  
  	PageSetLSN(page, lsn);
***************
*** 987,996 **** btree_xlog_newroot(XLogRecPtr lsn, XLogRecord *record)
  	_bt_restore_meta(xlrec->node, lsn,
  					 xlrec->rootblk, xlrec->level,
  					 xlrec->rootblk, xlrec->level);
- 
- 	/* Check to see if this satisfies any incomplete insertions */
- 	if (record->xl_len > SizeOfBtreeNewroot)
- 		forget_matching_split(xlrec->node, downlink, true);
  }
  
  static void
--- 985,990 ----
***************
*** 1068,1146 **** btree_redo(XLogRecPtr lsn, XLogRecord *record)
  			elog(PANIC, "btree_redo: unknown op code %u", info);
  	}
  }
- 
- void
- btree_xlog_startup(void)
- {
- 	incomplete_actions = NIL;
- }
- 
- void
- btree_xlog_cleanup(void)
- {
- 	ListCell   *l;
- 
- 	foreach(l, incomplete_actions)
- 	{
- 		bt_incomplete_action *action = (bt_incomplete_action *) lfirst(l);
- 
- 		if (action->is_split)
- 		{
- 			/* finish an incomplete split */
- 			Buffer		lbuf,
- 						rbuf;
- 			Page		lpage,
- 						rpage;
- 			BTPageOpaque lpageop,
- 						rpageop;
- 			bool		is_only;
- 			Relation	reln;
- 
- 			lbuf = XLogReadBuffer(action->node, action->leftblk, false);
- 			/* failure is impossible because we wrote this page earlier */
- 			if (!BufferIsValid(lbuf))
- 				elog(PANIC, "btree_xlog_cleanup: left block unfound");
- 			lpage = (Page) BufferGetPage(lbuf);
- 			lpageop = (BTPageOpaque) PageGetSpecialPointer(lpage);
- 			rbuf = XLogReadBuffer(action->node, action->rightblk, false);
- 			/* failure is impossible because we wrote this page earlier */
- 			if (!BufferIsValid(rbuf))
- 				elog(PANIC, "btree_xlog_cleanup: right block unfound");
- 			rpage = (Page) BufferGetPage(rbuf);
- 			rpageop = (BTPageOpaque) PageGetSpecialPointer(rpage);
- 
- 			/* if the pages are all of their level, it's a only-page split */
- 			is_only = P_LEFTMOST(lpageop) && P_RIGHTMOST(rpageop);
- 
- 			reln = CreateFakeRelcacheEntry(action->node);
- 			_bt_insert_parent(reln, lbuf, rbuf, NULL,
- 							  action->is_root, is_only);
- 			FreeFakeRelcacheEntry(reln);
- 		}
- 		else
- 		{
- 			/* finish an incomplete deletion (of a half-dead page) */
- 			Buffer		buf;
- 
- 			buf = XLogReadBuffer(action->node, action->delblk, false);
- 			if (BufferIsValid(buf))
- 			{
- 				Relation	reln;
- 
- 				reln = CreateFakeRelcacheEntry(action->node);
- 				if (_bt_pagedel(reln, buf, NULL) == 0)
- 					elog(PANIC, "btree_xlog_cleanup: _bt_pagedel failed");
- 				FreeFakeRelcacheEntry(reln);
- 			}
- 		}
- 	}
- 	incomplete_actions = NIL;
- }
- 
- bool
- btree_safe_restartpoint(void)
- {
- 	if (incomplete_actions)
- 		return false;
- 	return true;
- }
--- 1062,1064 ----
*** a/src/include/access/nbtree.h
--- b/src/include/access/nbtree.h
***************
*** 73,78 **** typedef BTPageOpaqueData *BTPageOpaque;
--- 73,80 ----
  #define BTP_HALF_DEAD	(1 << 4)	/* empty, but still in tree */
  #define BTP_SPLIT_END	(1 << 5)	/* rightmost page of split group */
  #define BTP_HAS_GARBAGE (1 << 6)	/* page has LP_DEAD tuples */
+ #define BTP_INCOMPLETE_SPLIT (1 << 7) /* right sibling's downlink is missing */
+ #define BTP_LEFT_HALF_DEAD (1 << 8)	/* left sibling is half-dead */
  
  /*
   * The max allowed value of a cycle ID is a bit less than 64K.	This is
***************
*** 178,183 **** typedef struct BTMetaPageData
--- 180,189 ----
  #define P_ISHALFDEAD(opaque)	((opaque)->btpo_flags & BTP_HALF_DEAD)
  #define P_IGNORE(opaque)		((opaque)->btpo_flags & (BTP_DELETED|BTP_HALF_DEAD))
  #define P_HAS_GARBAGE(opaque)	((opaque)->btpo_flags & BTP_HAS_GARBAGE)
+ #define P_INCOMPLETE_SPLIT(opaque)	((opaque)->btpo_flags & BTP_INCOMPLETE_SPLIT)
+ #define P_LEFT_HALF_DEAD(opaque) ((opaque)->btpo_flags & BTP_LEFT_HALF_DEAD)
+ #define P_NEEDS_FIXUP(opaque)	\
+ 	((opaque)->btpo_flags & (BTP_INCOMPLETE_SPLIT | BTP_LEFT_HALF_DEAD))
  
  /*
   *	Lehman and Yao's algorithm requires a ``high key'' on every non-rightmost
***************
*** 254,260 **** typedef struct xl_btree_metadata
  typedef struct xl_btree_insert
  {
  	xl_btreetid target;			/* inserted tuple id */
! 	/* BlockNumber downlink field FOLLOWS IF NOT XLOG_BTREE_INSERT_LEAF */
  	/* xl_btree_metadata FOLLOWS IF XLOG_BTREE_INSERT_META */
  	/* INDEX TUPLE FOLLOWS AT END OF STRUCT */
  } xl_btree_insert;
--- 260,266 ----
  typedef struct xl_btree_insert
  {
  	xl_btreetid target;			/* inserted tuple id */
! 	/* BlockNumber finishes_split field FOLLOWS IF NOT XLOG_BTREE_INSERT_LEAF */
  	/* xl_btree_metadata FOLLOWS IF XLOG_BTREE_INSERT_META */
  	/* INDEX TUPLE FOLLOWS AT END OF STRUCT */
  } xl_btree_insert;
***************
*** 287,305 **** typedef struct xl_btree_split
  	OffsetNumber firstright;	/* first item moved to right page */
  
  	/*
! 	 * If level > 0, BlockIdData downlink follows.	(We use BlockIdData rather
! 	 * than BlockNumber for alignment reasons: SizeOfBtreeSplit is only 16-bit
! 	 * aligned.)
  	 *
  	 * If level > 0, an IndexTuple representing the HIKEY of the left page
  	 * follows.  We don't need this on leaf pages, because it's the same as
  	 * the leftmost key in the new right page.	Also, it's suppressed if
  	 * XLogInsert chooses to store the left page's whole page image.
  	 *
! 	 * In the _L variants, next are OffsetNumber newitemoff and the new item.
! 	 * (In the _R variants, the new item is one of the right page's tuples.)
! 	 * The new item, but not newitemoff, is suppressed if XLogInsert chooses
! 	 * to store the left page's whole page image.
  	 *
  	 * Last are the right page's tuples in the form used by _bt_restore_page.
  	 */
--- 293,310 ----
  	OffsetNumber firstright;	/* first item moved to right page */
  
  	/*
! 	 * In the _L variants, next are OffsetNumber newitemoff and the new item.
! 	 * (In the _R variants, the new item is one of the right page's tuples.)
! 	 * The new item, but not newitemoff, is suppressed if XLogInsert chooses
! 	 * to store the left page's whole page image.
  	 *
  	 * If level > 0, an IndexTuple representing the HIKEY of the left page
  	 * follows.  We don't need this on leaf pages, because it's the same as
  	 * the leftmost key in the new right page.	Also, it's suppressed if
  	 * XLogInsert chooses to store the left page's whole page image.
  	 *
! 	 * If level > 0, BlockNumber of the page whose incomplete-split flag
! 	 * this insertion clears. (not aligned)
  	 *
  	 * Last are the right page's tuples in the form used by _bt_restore_page.
  	 */
***************
*** 379,393 **** typedef struct xl_btree_vacuum
--- 384,404 ----
  typedef struct xl_btree_delete_page
  {
  	xl_btreetid target;			/* deleted tuple id in parent page */
+ 	uint16		flags;			/* see below */
  	BlockNumber deadblk;		/* child block being deleted */
  	BlockNumber leftblk;		/* child block's left sibling, if any */
  	BlockNumber rightblk;		/* child block's right sibling */
+ 	BlockNumber parentright;	/* if parent is half-dead, its right sibling */
  	TransactionId btpo_xact;	/* value of btpo.xact for use in recovery */
  	/* xl_btree_metadata FOLLOWS IF XLOG_BTREE_DELETE_PAGE_META */
  } xl_btree_delete_page;
  
  #define SizeOfBtreeDeletePage	(offsetof(xl_btree_delete_page, btpo_xact) + sizeof(TransactionId))
  
+ /* Flags for xl_btree_delete_page */
+ #define DP_LEFT_IS_HALF_DEAD	0x01 /* deleted page's left sibling is
+ 									  *	half-dead */
+ 
  /*
   * New root log record.  There are zero tuples if this is to establish an
   * empty root, or two if it is the result of splitting an old root.
***************
*** 617,624 **** extern Datum btoptions(PG_FUNCTION_ARGS);
  extern bool _bt_doinsert(Relation rel, IndexTuple itup,
  			 IndexUniqueCheck checkUnique, Relation heapRel);
  extern Buffer _bt_getstackbuf(Relation rel, BTStack stack, int access);
! extern void _bt_insert_parent(Relation rel, Buffer buf, Buffer rbuf,
! 				  BTStack stack, bool is_root, bool is_only);
  
  /*
   * prototypes for functions in nbtpage.c
--- 628,634 ----
  extern bool _bt_doinsert(Relation rel, IndexTuple itup,
  			 IndexUniqueCheck checkUnique, Relation heapRel);
  extern Buffer _bt_getstackbuf(Relation rel, BTStack stack, int access);
! extern void _bt_fixup(Relation rel, Buffer bbuf, BTStack stack);
  
  /*
   * prototypes for functions in nbtpage.c
***************
*** 648,654 **** extern BTStack _bt_search(Relation rel,
  		   int keysz, ScanKey scankey, bool nextkey,
  		   Buffer *bufP, int access);
  extern Buffer _bt_moveright(Relation rel, Buffer buf, int keysz,
! 			  ScanKey scankey, bool nextkey, int access);
  extern OffsetNumber _bt_binsrch(Relation rel, Buffer buf, int keysz,
  			ScanKey scankey, bool nextkey);
  extern int32 _bt_compare(Relation rel, int keysz, ScanKey scankey,
--- 658,665 ----
  		   int keysz, ScanKey scankey, bool nextkey,
  		   Buffer *bufP, int access);
  extern Buffer _bt_moveright(Relation rel, Buffer buf, int keysz,
! 			  ScanKey scankey, bool nextkey,
! 			  bool finishsplits, BTStack stack,  int access);
  extern OffsetNumber _bt_binsrch(Relation rel, Buffer buf, int keysz,
  			ScanKey scankey, bool nextkey);
  extern int32 _bt_compare(Relation rel, int keysz, ScanKey scankey,
***************
*** 656,661 **** extern int32 _bt_compare(Relation rel, int keysz, ScanKey scankey,
--- 667,673 ----
  extern bool _bt_first(IndexScanDesc scan, ScanDirection dir);
  extern bool _bt_next(IndexScanDesc scan, ScanDirection dir);
  extern Buffer _bt_get_endpoint(Relation rel, uint32 level, bool rightmost);
+ extern Buffer _bt_walk_left(Relation rel, Buffer buf);
  
  /*
   * prototypes for functions in nbtutils.c
***************
*** 697,704 **** extern void _bt_leafbuild(BTSpool *btspool, BTSpool *spool2);
   */
  extern void btree_redo(XLogRecPtr lsn, XLogRecord *record);
  extern void btree_desc(StringInfo buf, uint8 xl_info, char *rec);
- extern void btree_xlog_startup(void);
- extern void btree_xlog_cleanup(void);
- extern bool btree_safe_restartpoint(void);
  
  #endif   /* NBTREE_H */
--- 709,713 ----
*** a/src/include/access/rmgrlist.h
--- b/src/include/access/rmgrlist.h
***************
*** 36,42 **** PG_RMGR(RM_RELMAP_ID, "RelMap", relmap_redo, relmap_desc, NULL, NULL, NULL)
  PG_RMGR(RM_STANDBY_ID, "Standby", standby_redo, standby_desc, NULL, NULL, NULL)
  PG_RMGR(RM_HEAP2_ID, "Heap2", heap2_redo, heap2_desc, NULL, NULL, NULL)
  PG_RMGR(RM_HEAP_ID, "Heap", heap_redo, heap_desc, NULL, NULL, NULL)
! PG_RMGR(RM_BTREE_ID, "Btree", btree_redo, btree_desc, btree_xlog_startup, btree_xlog_cleanup, btree_safe_restartpoint)
  PG_RMGR(RM_HASH_ID, "Hash", hash_redo, hash_desc, NULL, NULL, NULL)
  PG_RMGR(RM_GIN_ID, "Gin", gin_redo, gin_desc, gin_xlog_startup, gin_xlog_cleanup, gin_safe_restartpoint)
  PG_RMGR(RM_GIST_ID, "Gist", gist_redo, gist_desc, gist_xlog_startup, gist_xlog_cleanup, NULL)
--- 36,42 ----
  PG_RMGR(RM_STANDBY_ID, "Standby", standby_redo, standby_desc, NULL, NULL, NULL)
  PG_RMGR(RM_HEAP2_ID, "Heap2", heap2_redo, heap2_desc, NULL, NULL, NULL)
  PG_RMGR(RM_HEAP_ID, "Heap", heap_redo, heap_desc, NULL, NULL, NULL)
! PG_RMGR(RM_BTREE_ID, "Btree", btree_redo, btree_desc, NULL, NULL, NULL)
  PG_RMGR(RM_HASH_ID, "Hash", hash_redo, hash_desc, NULL, NULL, NULL)
  PG_RMGR(RM_GIN_ID, "Gin", gin_redo, gin_desc, gin_xlog_startup, gin_xlog_cleanup, gin_safe_restartpoint)
  PG_RMGR(RM_GIST_ID, "Gist", gist_redo, gist_desc, gist_xlog_startup, gist_xlog_cleanup, NULL)

diff --git a/src/backend/access/nbtree/README b/src/backend/access/nbtree/README
index e57c211..2945e1e 100644
--- a/src/backend/access/nbtree/README
+++ b/src/backend/access/nbtree/README
@@ -168,6 +168,33 @@ parent item does still exist and can't have been deleted.  Also, because
 we are matching downlink page numbers and not data keys, we don't have any
 problem with possibly misidentifying the parent item.
 
+VACUUM needs to do a linear scan of an index to search for deleted pages
+that can be reclaimed because they are older than all open transactions.
+For efficiency's sake, we'd like to use the same linear scan to search for
+deletable tuples.  Before Postgres 8.2, btbulkdelete scanned the leaf pages
+in index order, but it is possible to visit them in physical order instead.
+The tricky part of this is to avoid missing any deletable tuples in the
+presence of concurrent page splits: a page split could easily move some
+tuples from a page not yet passed over by the sequential scan to a
+lower-numbered page already passed over.  (This wasn't a concern for the
+index-order scan, because splits always split right.)  To implement this,
+we provide a "vacuum cycle ID" mechanism that makes it possible to
+determine whether a page has been split since the current btbulkdelete
+cycle started.  If btbulkdelete finds a page that has been split since
+it started, and has a right-link pointing to a lower page number, then
+it temporarily suspends its sequential scan and visits that page instead.
+It must continue to follow right-links and vacuum dead tuples until
+reaching a page that either hasn't been split since btbulkdelete started,
+or is above the location of the outer sequential scan.  Then it can resume
+the sequential scan.  This ensures that all tuples are visited.  It may be
+that some tuples are visited twice, but that has no worse effect than an
+inaccurate index tuple count (and we can't guarantee an accurate count
+anyway in the face of concurrent activity).  Note that this still works
+if the has-been-recently-split test has a small probability of false
+positives, so long as it never gives a false negative.  This makes it
+possible to implement the test with a small counter value stored on each
+index page.
+
 Page Deletion
 -------------
 
@@ -315,33 +342,6 @@ as part of the atomic update for the delete (either way, the metapage has
 to be the last page locked in the update to avoid deadlock risks).  This
 avoids race conditions if two such operations are executing concurrently.
 
-VACUUM needs to do a linear scan of an index to search for deleted pages
-that can be reclaimed because they are older than all open transactions.
-For efficiency's sake, we'd like to use the same linear scan to search for
-deletable tuples.  Before Postgres 8.2, btbulkdelete scanned the leaf pages
-in index order, but it is possible to visit them in physical order instead.
-The tricky part of this is to avoid missing any deletable tuples in the
-presence of concurrent page splits: a page split could easily move some
-tuples from a page not yet passed over by the sequential scan to a
-lower-numbered page already passed over.  (This wasn't a concern for the
-index-order scan, because splits always split right.)  To implement this,
-we provide a "vacuum cycle ID" mechanism that makes it possible to
-determine whether a page has been split since the current btbulkdelete
-cycle started.  If btbulkdelete finds a page that has been split since
-it started, and has a right-link pointing to a lower page number, then
-it temporarily suspends its sequential scan and visits that page instead.
-It must continue to follow right-links and vacuum dead tuples until
-reaching a page that either hasn't been split since btbulkdelete started,
-or is above the location of the outer sequential scan.  Then it can resume
-the sequential scan.  This ensures that all tuples are visited.  It may be
-that some tuples are visited twice, but that has no worse effect than an
-inaccurate index tuple count (and we can't guarantee an accurate count
-anyway in the face of concurrent activity).  Note that this still works
-if the has-been-recently-split test has a small probability of false
-positives, so long as it never gives a false negative.  This makes it
-possible to implement the test with a small counter value stored on each
-index page.
-
 On-the-Fly Deletion Of Index Tuples
 -----------------------------------
 
@@ -401,12 +401,34 @@ an additional insertion above that, etc).
 For a root split, the followon WAL entry is a "new root" entry rather than
 an "insertion" entry, but details are otherwise much the same.
 
-Because insertion involves multiple atomic actions, the WAL replay logic
-has to detect the case where a page split isn't followed by a matching
-insertion on the parent level, and then do that insertion on its own (and
-recursively for any subsequent parent insertion, of course).  This is
-feasible because the WAL entry for the split contains enough info to know
-what must be inserted in the parent level.
+Because splitting involves multiple atomic actions, it's possible that the
+system crashes between splitting a page and inserting the downlink for the
+new half to the parent. After recovery, the downlink for the new page will
+be missing. The search algorithm works correctly, as the page will be found
+by following the right-link from its left sibling, although if a lot of
+downlinks in the tree are missing, performance will suffer. A more serious
+consequence is that if the page without a downlink gets split again, the
+insertion algorithm will fail to find the location in the parent level to
+insert the downlink.
+
+Our approach is to create any missing downlinks on-they-fly, when
+searching the tree for a new insertion. It could be done during searches,
+too, but it seems best not to put any extra updates in what would otherwise
+be a read-only operation (updating is not possible in hot standby mode
+anyway). To identify missing downlinks, when a page is split, the left page
+is flagged to indicate that the split is not yet complete (INCOMPLETE_SPLIT).
+When the downlink is inserted to the parent, the flag is cleared atomically
+with the insertion. The child page is kept locked until the insertion in the
+parent is finished and the flag in the child cleared, but can be released
+immediately after that, before recursing up the tree, if the parent also
+needs to be split. This ensures that incompletely split pages should not be
+seen under normal circumstances; only when insertion to the parent fails
+for some reason.
+
+We flag the left page, even though it's the right page that's missing the
+downlink, beacuse it's more convenient to know already when following the
+right-link from the left page to the right page that it will need to have
+its downlink inserted to the parent.
 
 When splitting a non-root page that is alone on its level, the required
 metapage update (of the "fast root" link) is performed and logged as part
@@ -419,6 +441,14 @@ page is a second record. If vacuum is interrupted for some reason, or the
 system crashes, the tree is consistent for searches and insertions. The next
 VACUUM will find the half-dead leaf page and continue the deletion.
 
+Before 9.4, we used to keep track of incomplete splits and page deletions
+during recovery and finish them immediately at end of recovery, instead of
+doing it lazily at the next  insertion or vacuum. However, that made the
+recovery much more complicated, and only fixed the problem when crash
+recovery was performed. An incomplete split can also occur if an otherwise
+recoverable error, like out-of-memory or out-of-disk-space, happens while
+inserting the downlink to the parent.
+
 Scans during Recovery
 ---------------------
 
diff --git a/src/backend/access/nbtree/nbtinsert.c b/src/backend/access/nbtree/nbtinsert.c
index a452fea..0c8d079 100644
--- a/src/backend/access/nbtree/nbtinsert.c
+++ b/src/backend/access/nbtree/nbtinsert.c
@@ -58,15 +58,18 @@ static void _bt_findinsertloc(Relation rel,
 				  int keysz,
 				  ScanKey scankey,
 				  IndexTuple newtup,
+				  BTStack stack,
 				  Relation heapRel);
-static void _bt_insertonpg(Relation rel, Buffer buf,
+static void _bt_insertonpg(Relation rel, Buffer buf, Buffer cbuf,
 			   BTStack stack,
 			   IndexTuple itup,
 			   OffsetNumber newitemoff,
 			   bool split_only_page);
-static Buffer _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
-		  OffsetNumber newitemoff, Size newitemsz,
+static Buffer _bt_split(Relation rel, Buffer buf, Buffer cbuf,
+		  OffsetNumber firstright, OffsetNumber newitemoff, Size newitemsz,
 		  IndexTuple newitem, bool newitemonleft);
+static void _bt_insert_parent(Relation rel, Buffer buf, Buffer rbuf,
+				  BTStack stack, bool is_root, bool is_only);
 static OffsetNumber _bt_findsplitloc(Relation rel, Page page,
 				 OffsetNumber newitemoff,
 				 Size newitemsz,
@@ -130,7 +133,8 @@ top:
 	 * move right in the tree.	See Lehman and Yao for an excruciatingly
 	 * precise description.
 	 */
-	buf = _bt_moveright(rel, buf, natts, itup_scankey, false, BT_WRITE);
+	buf = _bt_moveright(rel, buf, natts, itup_scankey, false,
+						true, stack, BT_WRITE);
 
 	/*
 	 * If we're not allowing duplicates, make sure the key isn't already in
@@ -183,8 +187,9 @@ top:
 		 */
 		CheckForSerializableConflictIn(rel, NULL, buf);
 		/* do the insertion */
-		_bt_findinsertloc(rel, &buf, &offset, natts, itup_scankey, itup, heapRel);
-		_bt_insertonpg(rel, buf, stack, itup, offset, false);
+		_bt_findinsertloc(rel, &buf, &offset, natts, itup_scankey, itup,
+						  stack, heapRel);
+		_bt_insertonpg(rel, buf, InvalidBuffer, stack, itup, offset, false);
 	}
 	else
 	{
@@ -508,10 +513,11 @@ _bt_findinsertloc(Relation rel,
 				  int keysz,
 				  ScanKey scankey,
 				  IndexTuple newtup,
+				  BTStack stack,
 				  Relation heapRel)
 {
 	Buffer		buf = *bufptr;
-	Page		page = BufferGetPage(buf);
+	Page		page;
 	Size		itemsz;
 	BTPageOpaque lpageop;
 	bool		movedright,
@@ -519,6 +525,7 @@ _bt_findinsertloc(Relation rel,
 	OffsetNumber newitemoff;
 	OffsetNumber firstlegaloff = *offsetptr;
 
+	page = BufferGetPage(buf);
 	lpageop = (BTPageOpaque) PageGetSpecialPointer(page);
 
 	itemsz = IndexTupleDSize(*newtup);
@@ -570,6 +577,7 @@ _bt_findinsertloc(Relation rel,
 	while (PageGetFreeSpace(page) < itemsz)
 	{
 		Buffer		rbuf;
+		BlockNumber	rblkno;
 
 		/*
 		 * before considering moving right, see if we can obtain enough space
@@ -607,18 +615,33 @@ _bt_findinsertloc(Relation rel,
 		 */
 		rbuf = InvalidBuffer;
 
+		rblkno = lpageop->btpo_next;
 		for (;;)
 		{
-			BlockNumber rblkno = lpageop->btpo_next;
-
 			rbuf = _bt_relandgetbuf(rel, rbuf, rblkno, BT_WRITE);
 			page = BufferGetPage(rbuf);
 			lpageop = (BTPageOpaque) PageGetSpecialPointer(page);
+
+			/*
+			 * If this page was incompletely split, finish that now. We do
+			 * this while holding a lock on the left sibling, which is not
+			 * good because finishing the split could be a fairly lengthy
+			 * operation.  But this should happen very seldom.
+			 */
+			if (P_INCOMPLETE_SPLIT(lpageop))
+			{
+				_bt_finish_split(rel, rbuf, stack);
+				rbuf = InvalidBuffer;
+				continue;
+			}
+
 			if (!P_IGNORE(lpageop))
 				break;
 			if (P_RIGHTMOST(lpageop))
 				elog(ERROR, "fell off the end of index \"%s\"",
 					 RelationGetRelationName(rel));
+
+			rblkno = lpageop->btpo_next;
 		}
 		_bt_relbuf(rel, buf);
 		buf = rbuf;
@@ -664,6 +687,10 @@ _bt_findinsertloc(Relation rel,
  *		insertion, and the buffer must be pinned and write-locked.	On return,
  *		we will have dropped both the pin and the lock on the buffer.
  *
+ *		When inserting to a non-leaf page, 'cbuf' is the left-sibling of the
+ *		page we're inserting the downlink for. This function will clear the
+ *		INCOMPLETE_SPLIT flag on it, and release the buffer.
+ *
  *		The locking interactions in this code are critical.  You should
  *		grok Lehman and Yao's paper before making any changes.  In addition,
  *		you need to understand how we disambiguate duplicate keys in this
@@ -677,6 +704,7 @@ _bt_findinsertloc(Relation rel,
 static void
 _bt_insertonpg(Relation rel,
 			   Buffer buf,
+			   Buffer cbuf,
 			   BTStack stack,
 			   IndexTuple itup,
 			   OffsetNumber newitemoff,
@@ -690,6 +718,14 @@ _bt_insertonpg(Relation rel,
 	page = BufferGetPage(buf);
 	lpageop = (BTPageOpaque) PageGetSpecialPointer(page);
 
+	/*
+	 * The caller should've finished any incomplete splits and page deletions
+	 * already
+	 */
+	if (P_INCOMPLETE_SPLIT(lpageop))
+		elog(ERROR, "cannot insert to incompletely split page %u",
+			 BufferGetBlockNumber(buf));
+
 	itemsz = IndexTupleDSize(*itup);
 	itemsz = MAXALIGN(itemsz);	/* be safe, PageAddItem will do this but we
 								 * need to be consistent */
@@ -714,7 +750,7 @@ _bt_insertonpg(Relation rel,
 									  &newitemonleft);
 
 		/* split the buffer into left and right halves */
-		rbuf = _bt_split(rel, buf, firstright,
+		rbuf = _bt_split(rel, buf, cbuf, firstright,
 						 newitemoff, itemsz, itup, newitemonleft);
 		PredicateLockPageSplit(rel,
 							   BufferGetBlockNumber(buf),
@@ -788,11 +824,21 @@ _bt_insertonpg(Relation rel,
 			MarkBufferDirty(metabuf);
 		}
 
+		/* clear INCOMPLETE_SPLIT flag on child if this finishes a split */
+		if (!P_ISLEAF(lpageop))
+		{
+			Page		cpage = BufferGetPage(cbuf);
+			BTPageOpaque cpageop = (BTPageOpaque) PageGetSpecialPointer(cpage);
+			Assert(P_INCOMPLETE_SPLIT(cpageop));
+			cpageop->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+			MarkBufferDirty(cbuf);
+		}
+
 		/* XLOG stuff */
 		if (RelationNeedsWAL(rel))
 		{
 			xl_btree_insert xlrec;
-			BlockNumber xldownlink;
+			BlockNumber xlleftchild;
 			xl_btree_metadata xlmeta;
 			uint8		xlinfo;
 			XLogRecPtr	recptr;
@@ -812,12 +858,15 @@ _bt_insertonpg(Relation rel,
 				xlinfo = XLOG_BTREE_INSERT_LEAF;
 			else
 			{
-				xldownlink = ItemPointerGetBlockNumber(&(itup->t_tid));
-				Assert(ItemPointerGetOffsetNumber(&(itup->t_tid)) == P_HIKEY);
-
-				nextrdata->data = (char *) &xldownlink;
+				/*
+				 * Include the block number of the left child, whose
+				 * INCOMPLETE_SPLIT flag is cleared.
+				 */
+				xlleftchild = BufferGetBlockNumber(cbuf);
+				nextrdata->data = (char *) &xlleftchild;
 				nextrdata->len = sizeof(BlockNumber);
-				nextrdata->buffer = InvalidBuffer;
+				nextrdata->buffer = cbuf;
+				nextrdata->buffer_std = true;
 				nextrdata->next = nextrdata + 1;
 				nextrdata++;
 
@@ -870,6 +919,8 @@ _bt_insertonpg(Relation rel,
 		END_CRIT_SECTION();
 
 		/* release buffers; send out relcache inval if metapage changed */
+		if (!P_ISLEAF(lpageop))
+			_bt_relbuf(rel, cbuf);
 		if (BufferIsValid(metabuf))
 		{
 			if (!InRecovery)
@@ -889,11 +940,15 @@ _bt_insertonpg(Relation rel,
  *		new right page.  newitemoff etc. tell us about the new item that
  *		must be inserted along with the data from the old page.
  *
+ *		When splitting a non-leaf page, 'cbuf' is the left-sibling of the
+ *		page we're inserting the downlink for. This function will clear the
+ *		INCOMPLETE_SPLIT flag on it, and release the buffer.
+ *
  *		Returns the new right sibling of buf, pinned and write-locked.
  *		The pin and lock on buf are maintained.
  */
 static Buffer
-_bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
+_bt_split(Relation rel, Buffer buf, Buffer cbuf, OffsetNumber firstright,
 		  OffsetNumber newitemoff, Size newitemsz, IndexTuple newitem,
 		  bool newitemonleft)
 {
@@ -961,6 +1016,8 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 	lopaque->btpo_flags = oopaque->btpo_flags;
 	lopaque->btpo_flags &= ~(BTP_ROOT | BTP_SPLIT_END | BTP_HAS_GARBAGE);
 	ropaque->btpo_flags = lopaque->btpo_flags;
+	/* set flag in left page indicating that the right page has no downlink */
+	lopaque->btpo_flags |= BTP_INCOMPLETE_SPLIT;
 	lopaque->btpo_prev = oopaque->btpo_prev;
 	lopaque->btpo_next = rightpagenumber;
 	ropaque->btpo_prev = origpagenumber;
@@ -1184,6 +1241,18 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 		MarkBufferDirty(sbuf);
 	}
 
+	/*
+	 * Clear INCOMPLETE_SPLIT flag on child if inserting the new item finishes
+	 * a split.
+	 */
+	if (ropaque->btpo.level > 0)
+	{
+		Page		cpage = BufferGetPage(cbuf);
+		BTPageOpaque cpageop = (BTPageOpaque) PageGetSpecialPointer(cpage);
+		cpageop->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+		MarkBufferDirty(cbuf);
+	}
+
 	/* XLOG stuff */
 	if (RelationNeedsWAL(rel))
 	{
@@ -1206,34 +1275,6 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 
 		lastrdata = &rdata[0];
 
-		if (ropaque->btpo.level > 0)
-		{
-			/* Log downlink on non-leaf pages */
-			lastrdata->next = lastrdata + 1;
-			lastrdata++;
-
-			lastrdata->data = (char *) &newitem->t_tid.ip_blkid;
-			lastrdata->len = sizeof(BlockIdData);
-			lastrdata->buffer = InvalidBuffer;
-
-			/*
-			 * We must also log the left page's high key, because the right
-			 * page's leftmost key is suppressed on non-leaf levels.  Show it
-			 * as belonging to the left page buffer, so that it is not stored
-			 * if XLogInsert decides it needs a full-page image of the left
-			 * page.
-			 */
-			lastrdata->next = lastrdata + 1;
-			lastrdata++;
-
-			itemid = PageGetItemId(origpage, P_HIKEY);
-			item = (IndexTuple) PageGetItem(origpage, itemid);
-			lastrdata->data = (char *) item;
-			lastrdata->len = MAXALIGN(IndexTupleSize(item));
-			lastrdata->buffer = buf;	/* backup block 1 */
-			lastrdata->buffer_std = true;
-		}
-
 		/*
 		 * Log the new item and its offset, if it was inserted on the left
 		 * page. (If it was put on the right page, we don't need to explicitly
@@ -1260,17 +1301,40 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 			lastrdata->buffer = buf;	/* backup block 1 */
 			lastrdata->buffer_std = true;
 		}
-		else if (ropaque->btpo.level == 0)
+
+		/* Log left page */
+		if (ropaque->btpo.level > 0)
 		{
+			lastrdata->next = lastrdata + 1;
+			lastrdata++;
+
 			/*
-			 * Although we don't need to WAL-log the new item, we still need
-			 * XLogInsert to consider storing a full-page image of the left
-			 * page, so make an empty entry referencing that buffer. This also
-			 * ensures that the left page is always backup block 1.
+			 * We must also log the left page's high key, because the right
+			 * page's leftmost key is suppressed on non-leaf levels.  Show it
+			 * as belonging to the left page buffer, so that it is not stored
+			 * if XLogInsert decides it needs a full-page image of the left
+			 * page.
 			 */
+			itemid = PageGetItemId(origpage, P_HIKEY);
+			item = (IndexTuple) PageGetItem(origpage, itemid);
+			lastrdata->data = (char *) item;
+			lastrdata->len = MAXALIGN(IndexTupleSize(item));
+			lastrdata->buffer = buf;	/* backup block 1 */
+			lastrdata->buffer_std = true;
+		}
+
+		if (ropaque->btpo.level == 0 && !newitemonleft)
+		{
 			lastrdata->next = lastrdata + 1;
 			lastrdata++;
 
+			/*
+			 * Although we don't need to WAL-log anything on the left page,
+			 * the new item, we still need XLogInsert to consider storing a
+			 * full-page image of the left page, so make an empty entry
+			 * referencing that buffer. This also ensures that the left page
+			 * is always backup block 1.
+			 */
 			lastrdata->data = NULL;
 			lastrdata->len = 0;
 			lastrdata->buffer = buf;	/* backup block 1 */
@@ -1278,6 +1342,22 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 		}
 
 		/*
+		 * Log block number of left child, whose INCOMPLETE_SPLIT flag this
+		 * insertion clears.
+		 */
+		if (ropaque->btpo.level > 0)
+		{
+			BlockNumber cblkno = BufferGetBlockNumber(cbuf);
+			lastrdata->next = lastrdata + 1;
+			lastrdata++;
+
+			lastrdata->data = (char *) &cblkno;
+			lastrdata->len = sizeof(BlockNumber);
+			lastrdata->buffer = cbuf;	/* backup block 2 */
+			lastrdata->buffer_std = true;
+		}
+
+		/*
 		 * Log the contents of the right page in the format understood by
 		 * _bt_restore_page(). We set lastrdata->buffer to InvalidBuffer,
 		 * because we're going to recreate the whole page anyway, so it should
@@ -1306,7 +1386,7 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 
 			lastrdata->data = NULL;
 			lastrdata->len = 0;
-			lastrdata->buffer = sbuf;	/* backup block 2 */
+			lastrdata->buffer = sbuf;	/* bkp block 2 (leaf) or 3 (non-leaf) */
 			lastrdata->buffer_std = true;
 		}
 
@@ -1333,6 +1413,10 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 	if (!P_RIGHTMOST(ropaque))
 		_bt_relbuf(rel, sbuf);
 
+	/* release the child */
+	if (ropaque->btpo.level > 0)
+		_bt_relbuf(rel, cbuf);
+
 	/* split's done */
 	return rbuf;
 }
@@ -1603,10 +1687,8 @@ _bt_checksplitloc(FindSplitData *state,
  *			have to be efficient (concurrent ROOT split, WAL recovery)
  * is_root - we split the true root
  * is_only - we split a page alone on its level (might have been fast root)
- *
- * This is exported so it can be called by nbtxlog.c.
  */
-void
+static void
 _bt_insert_parent(Relation rel,
 				  Buffer buf,
 				  Buffer rbuf,
@@ -1685,12 +1767,13 @@ _bt_insert_parent(Relation rel,
 		 * 05/27/97
 		 */
 		ItemPointerSet(&(stack->bts_btentry.t_tid), bknum, P_HIKEY);
-
 		pbuf = _bt_getstackbuf(rel, stack, BT_WRITE);
 
-		/* Now we can unlock the children */
+		/*
+		 * Now we can unlock the right child. The left child will be unlocked
+		 * by _bt_insertonpg().
+		 */
 		_bt_relbuf(rel, rbuf);
-		_bt_relbuf(rel, buf);
 
 		/* Check for error only after writing children */
 		if (pbuf == InvalidBuffer)
@@ -1698,7 +1781,7 @@ _bt_insert_parent(Relation rel,
 				 RelationGetRelationName(rel), bknum, rbknum);
 
 		/* Recursively update the parent */
-		_bt_insertonpg(rel, pbuf, stack->bts_parent,
+		_bt_insertonpg(rel, pbuf, buf, stack->bts_parent,
 					   new_item, stack->bts_offset + 1,
 					   is_only);
 
@@ -1708,6 +1791,62 @@ _bt_insert_parent(Relation rel,
 }
 
 /*
+ * _bt_finish_split() -- Finish an incomplete split
+ *
+ * A crash or other failure can leave a split incomplete. The insertion
+ * routines won't allow to insert on a page that is incompletely split.
+ * Before inserting on such a page, call _bt_finish_split().
+ *
+ * On entry, we hold write-mode lock on it, and the lock is released on
+ * exit.
+ */
+void
+_bt_finish_split(Relation rel, Buffer lbuf, BTStack stack)
+{
+	Page		lpage = BufferGetPage(lbuf);
+	BTPageOpaque lpageop = (BTPageOpaque) PageGetSpecialPointer(lpage);
+	Buffer		rbuf;
+	Page		rpage;
+	BTPageOpaque rpageop;
+	bool		was_root;
+	bool		was_only;
+
+	Assert(P_INCOMPLETE_SPLIT(lpageop));
+
+	/* Lock right sibling, the one missing the downlink */
+	rbuf = _bt_getbuf(rel, lpageop->btpo_next, BT_WRITE);
+	rpage = BufferGetPage(rbuf);
+	rpageop = (BTPageOpaque) PageGetSpecialPointer(rpage);
+
+	/* Could this be a root split? */
+	if (!stack)
+	{
+		Buffer		metabuf;
+		Page		metapg;
+		BTMetaPageData *metad;
+
+		/* acquire lock on the metapage */
+		metabuf = _bt_getbuf(rel, BTREE_METAPAGE, BT_WRITE);
+		metapg = BufferGetPage(metabuf);
+		metad = BTPageGetMeta(metapg);
+
+		was_root = (metad->btm_root == BufferGetBlockNumber(lbuf));
+
+		_bt_relbuf(rel, metabuf);
+	}
+	else
+		was_root = false;
+
+	/* Was this the only page on the level before split? */
+	was_only = (P_LEFTMOST(lpageop) && P_RIGHTMOST(rpageop));
+
+	elog(DEBUG1, "finishing incomplete split of %u/%u",
+		 BufferGetBlockNumber(lbuf), BufferGetBlockNumber(rbuf));
+
+	_bt_insert_parent(rel, lbuf, rbuf, stack, was_root, was_only);
+}
+
+/*
  *	_bt_getstackbuf() -- Walk back up the tree one step, and find the item
  *						 we last looked at in the parent.
  *
@@ -1739,6 +1878,12 @@ _bt_getstackbuf(Relation rel, BTStack stack, int access)
 		page = BufferGetPage(buf);
 		opaque = (BTPageOpaque) PageGetSpecialPointer(page);
 
+		if (access == BT_WRITE && P_INCOMPLETE_SPLIT(opaque))
+		{
+			_bt_finish_split(rel, buf, stack->bts_parent);
+			continue;
+		}
+
 		if (!P_IGNORE(opaque))
 		{
 			OffsetNumber offnum,
@@ -1843,6 +1988,7 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 				rbkno;
 	BlockNumber rootblknum;
 	BTPageOpaque rootopaque;
+	BTPageOpaque lopaque;
 	ItemId		itemid;
 	IndexTuple	item;
 	Size		itemsz;
@@ -1854,6 +2000,7 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 	lbkno = BufferGetBlockNumber(lbuf);
 	rbkno = BufferGetBlockNumber(rbuf);
 	lpage = BufferGetPage(lbuf);
+	lopaque = (BTPageOpaque) PageGetSpecialPointer(lpage);
 
 	/* get a new root page */
 	rootbuf = _bt_getbuf(rel, P_NEW, BT_WRITE);
@@ -1927,6 +2074,11 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 			 BufferGetBlockNumber(lbuf), RelationGetRelationName(rel));
 	pfree(new_item);
 
+	/* Clear the incomplete-split flag in the left child */
+	Assert(P_INCOMPLETE_SPLIT(lopaque));
+	lopaque->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+	MarkBufferDirty(lbuf);
+
 	MarkBufferDirty(rootbuf);
 	MarkBufferDirty(metabuf);
 
@@ -1935,7 +2087,7 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 	{
 		xl_btree_newroot xlrec;
 		XLogRecPtr	recptr;
-		XLogRecData rdata[2];
+		XLogRecData rdata[3];
 
 		xlrec.node = rel->rd_node;
 		xlrec.rootblk = rootblknum;
@@ -1954,7 +2106,13 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 		rdata[1].len = ((PageHeader) rootpage)->pd_special -
 			((PageHeader) rootpage)->pd_upper;
 		rdata[1].buffer = InvalidBuffer;
-		rdata[1].next = NULL;
+		rdata[1].next = &(rdata[2]);
+
+		/* Make a full-page image of the left child if needed */
+		rdata[2].data = NULL;
+		rdata[2].len = 0;
+		rdata[2].buffer = lbuf;
+		rdata[2].next = NULL;
 
 		recptr = XLogInsert(RM_BTREE_ID, XLOG_BTREE_NEWROOT, rdata);
 
diff --git a/src/backend/access/nbtree/nbtpage.c b/src/backend/access/nbtree/nbtpage.c
index cf8dc47..bc718ea 100644
--- a/src/backend/access/nbtree/nbtpage.c
+++ b/src/backend/access/nbtree/nbtpage.c
@@ -1022,21 +1022,60 @@ _bt_lock_branch_parent(Relation rel, BlockNumber child, BTStack stack,
 		/* It's rightmost child... */
 		if (poffset == P_FIRSTDATAKEY(opaque))
 		{
+			BlockNumber leftsib;
+
 			/*
 			 * It's only child, so safe if parent would itself be removable.
 			 * We have to check the parent itself, and then recurse to test
 			 * the conditions at the parent's parent.
+			 *
+			 * Also check that the page, or its left sibling, isn't
+			 * incompletely split.  These are the same checks that we already
+			 * did for the leaf page, see comments in _bt_mark_page_halfdead().
 			 */
-			if (P_RIGHTMOST(opaque) || P_ISROOT(opaque))
+			if (P_RIGHTMOST(opaque) || P_ISROOT(opaque) ||
+				P_INCOMPLETE_SPLIT(opaque))
 			{
 				_bt_relbuf(rel, pbuf);
 				return false;
 			}
 
-			*target = child;
+			*target = parent;
 			*rightsib = opaque->btpo_next;
+			leftsib = opaque->btpo_prev;
 
 			_bt_relbuf(rel, pbuf);
+
+			if (leftsib != P_NONE)
+			{
+				Buffer lbuf = _bt_getbuf(rel, leftsib, BT_READ);
+				page = BufferGetPage(lbuf);
+				opaque = (BTPageOpaque) PageGetSpecialPointer(page);
+				while (P_ISDELETED(opaque) || opaque->btpo_next != parent)
+				{
+					/* step right one page */
+					leftsib = opaque->btpo_next;
+					_bt_relbuf(rel, lbuf);
+					if (leftsib == P_NONE)
+					{
+						elog(LOG, "no left sibling (concurrent deletion?) in \"%s\"",
+							 RelationGetRelationName(rel));
+						return false;
+					}
+					lbuf = _bt_getbuf(rel, leftsib, BT_READ);
+					page = BufferGetPage(lbuf);
+					opaque = (BTPageOpaque) PageGetSpecialPointer(page);
+				}
+
+				if (P_INCOMPLETE_SPLIT(opaque))
+				{
+					_bt_relbuf(rel, lbuf);
+					return false;
+				}
+				_bt_relbuf(rel, lbuf);
+			}
+
+			/* Ok, this page should have a downlink in the parent. Find it. */
 			return _bt_lock_branch_parent(rel, parent, stack->bts_parent,
 										  topparent, topoff, target, rightsib);
 		}
@@ -1124,6 +1163,7 @@ retry:
 	 * that page is not already deleted and is empty.
 	 */
 	if (P_RIGHTMOST(opaque) || P_ISROOT(opaque) || P_ISDELETED(opaque) ||
+		P_INCOMPLETE_SPLIT(opaque) ||
 		P_FIRSTDATAKEY(opaque) <= PageGetMaxOffsetNumber(page))
 	{
 		/* Should never fail to delete a half-dead page */
@@ -1142,7 +1182,7 @@ retry:
 	{
 		if (!_bt_mark_page_halfdead(rel, buf, stack))
 		{
-			_bt_relbuf(rel, buf);
+			/* _bt_mark_page_halfdead released the lock */
 			return 0;
 		}
 	}
@@ -1185,10 +1225,16 @@ retry:
 	return ndeleted;
 }
 
+/*
+ * On success, returns true. In that case we hold a write-lock on 'leafbuf'
+ * on return. If the page cannot be deleted, returns false, and the lock
+ * and pin on 'leafbuf' are released.
+ */
 static bool
 _bt_mark_page_halfdead(Relation rel, Buffer leafbuf, BTStack stack)
 {
 	BlockNumber	leafblkno;
+	BlockNumber leafleftsib;
 	BlockNumber leafrightsib;
 	BlockNumber	target;
 	BlockNumber rightsib;
@@ -1215,6 +1261,7 @@ _bt_mark_page_halfdead(Relation rel, Buffer leafbuf, BTStack stack)
 	leafblkno = BufferGetBlockNumber(leafbuf);
 	itemid = PageGetItemId(page, P_HIKEY);
 	targetkey = CopyIndexTuple((IndexTuple) PageGetItem(page, itemid));
+	leafleftsib = opaque->btpo_prev;
 
 	/*
 	 * To avoid deadlocks, we'd better drop the leaf page lock before going
@@ -1245,15 +1292,75 @@ _bt_mark_page_halfdead(Relation rel, Buffer leafbuf, BTStack stack)
 	}
 
 	/*
+	 * If we see any incompletely split pages in the branch, we punt. There
+	 * are two scenarios that matter:
+	 *
+	 * 1. The child page's left sibling was incompletely split. The child has
+	 * no downlink. We'd need to transfer the keyspace of the child to its
+	 * right sibling. We could do that by removing the downlink for the right
+	 * sibling, so that it would appear that the right sibling is the
+	 * incompletely split right half of the left sibling. But it would be a
+	 * lot more complicated.
+	 *
+	 * 2. The child page itself was incompletely split. Its right sibling has
+	 * no downlink. The child's key space can be transferred to its right
+	 * sibling by changing the child's  downlink to point to its right sibling
+	 * instead. We could do that quite easily, but it hasn't been implemented.
+	 *
+	 * We already checked the leaf page's incomplete-split flag above. Check
+	 * the left sibling. Note that _bt_lock_branch_parent() will perform this
+	 * same check for the left sibling of any parent pages we will delete.
+	 */
+	if (leafleftsib != P_NONE)
+	{
+		Buffer lbuf = _bt_getbuf(rel, leafleftsib, BT_READ);
+		page = BufferGetPage(lbuf);
+		opaque = (BTPageOpaque) PageGetSpecialPointer(page);
+		while (P_ISDELETED(opaque) || opaque->btpo_next != leafblkno)
+		{
+			/* step right one page */
+			leafleftsib = opaque->btpo_next;
+			_bt_relbuf(rel, lbuf);
+			if (leafleftsib == P_NONE)
+			{
+				elog(LOG, "no left sibling (concurrent deletion?) in \"%s\"",
+					 RelationGetRelationName(rel));
+				ReleaseBuffer(leafbuf);
+				return false;
+			}
+			lbuf = _bt_getbuf(rel, leafleftsib, BT_READ);
+			page = BufferGetPage(lbuf);
+			opaque = (BTPageOpaque) PageGetSpecialPointer(page);
+		}
+
+		/*
+		 * Found it. Check that it's not incompletely split. Note that it's
+		 * enough to check this once before locking the other pages, because
+		 * once a page split is complete, it cannot become incomplete later.
+		 */
+		if (P_INCOMPLETE_SPLIT(opaque))
+		{
+			_bt_relbuf(rel, lbuf);
+			ReleaseBuffer(leafbuf);
+			return false;
+		}
+		_bt_relbuf(rel, lbuf);
+	}
+
+	/*
 	 * Re-acquire lock on the leaf page, and check that it can still be
 	 * deleted.
 	 */
 	LockBuffer(leafbuf, BT_WRITE);
+	page = BufferGetPage(leafbuf);
+	opaque = (BTPageOpaque) PageGetSpecialPointer(page);
 
 	if (P_RIGHTMOST(opaque) || P_ISROOT(opaque) || P_ISDELETED(opaque) ||
 		P_ISHALFDEAD(opaque) || !P_ISLEAF(opaque) ||
+		P_INCOMPLETE_SPLIT(opaque) ||
 		P_FIRSTDATAKEY(opaque) <= PageGetMaxOffsetNumber(page))
 	{
+		UnlockReleaseBuffer(leafbuf);
 		return false;
 	}
 
@@ -1274,7 +1381,10 @@ _bt_mark_page_halfdead(Relation rel, Buffer leafbuf, BTStack stack)
 	target = leafblkno;
 	if (!_bt_lock_branch_parent(rel, leafblkno, stack,
 								&topparent, &topoff, &target, &rightsib))
+	{
+		UnlockReleaseBuffer(leafbuf);
 		return false;
+	}
 
 	/*
 	 * Check that the parent-page index items we're about to delete/overwrite
@@ -1282,10 +1392,9 @@ _bt_mark_page_halfdead(Relation rel, Buffer leafbuf, BTStack stack)
 	 * for some reason.  We want to throw any error before entering the
 	 * critical section --- otherwise it'd be a PANIC.
 	 *
-	 * The test on the target item is just an Assert because
-	 * _bt_lock_branch_parent should have guaranteed it has the expected
-	 * contents.  The test on the next-child downlink is known to sometimes
-	 * fail in the field, though.
+	 * The test on the target item is just an Assert because _bt_getstackbuf
+	 * should have guaranteed it has the expected contents.  The test on the
+	 * next-child downlink is known to sometimes fail in the field, though.
 	 */
 	page = BufferGetPage(topparent);
 	opaque = (BTPageOpaque) PageGetSpecialPointer(page);
@@ -1388,6 +1497,8 @@ _bt_mark_page_halfdead(Relation rel, Buffer leafbuf, BTStack stack)
 	END_CRIT_SECTION();
 
 	_bt_relbuf(rel, topparent);
+
+	/* keep the lock on leaf buffer */
 	return true;
 }
 
diff --git a/src/backend/access/nbtree/nbtsearch.c b/src/backend/access/nbtree/nbtsearch.c
index ac98589..ff8c714 100644
--- a/src/backend/access/nbtree/nbtsearch.c
+++ b/src/backend/access/nbtree/nbtsearch.c
@@ -29,7 +29,6 @@ static bool _bt_readpage(IndexScanDesc scan, ScanDirection dir,
 static void _bt_saveitem(BTScanOpaque so, int itemIndex,
 			 OffsetNumber offnum, IndexTuple itup);
 static bool _bt_steppage(IndexScanDesc scan, ScanDirection dir);
-static Buffer _bt_walk_left(Relation rel, Buffer buf);
 static bool _bt_endpoint(IndexScanDesc scan, ScanDirection dir);
 
 
@@ -51,7 +50,9 @@ static bool _bt_endpoint(IndexScanDesc scan, ScanDirection dir);
  * NOTE that the returned buffer is read-locked regardless of the access
  * parameter.  However, access = BT_WRITE will allow an empty root page
  * to be created and returned.	When access = BT_READ, an empty index
- * will result in *bufP being set to InvalidBuffer.
+ * will result in *bufP being set to InvalidBuffer. Also, in BT_WRITE mode,
+ * any incomplete splits or half-dead pages encountered during the search
+ * will be finished.
  */
 BTStack
 _bt_search(Relation rel, int keysz, ScanKey scankey, bool nextkey,
@@ -82,8 +83,13 @@ _bt_search(Relation rel, int keysz, ScanKey scankey, bool nextkey,
 		 * Race -- the page we just grabbed may have split since we read its
 		 * pointer in the parent (or metapage).  If it has, we may need to
 		 * move right to its new sibling.  Do that.
+		 *
+		 * In write-mode, allow _bt_moveright to finish any incomplete splits
+		 * along the way.
 		 */
-		*bufP = _bt_moveright(rel, *bufP, keysz, scankey, nextkey, BT_READ);
+		*bufP = _bt_moveright(rel, *bufP, keysz, scankey, nextkey,
+							  (access == BT_WRITE), stack_in,
+							  BT_READ);
 
 		/* if this is a leaf page, we're done */
 		page = BufferGetPage(*bufP);
@@ -148,6 +154,11 @@ _bt_search(Relation rel, int keysz, ScanKey scankey, bool nextkey,
  * item >= scankey.  When nextkey is true, we are looking for the first
  * item strictly greater than scankey.
  *
+ * If forupdate is true, we will attempt to finish any incomplete splits
+ * or half-dead pages that we encounter. This is required when searching for
+ * a target page for an insertion, because we don't allow inserting on a
+ * page with incomplete actions. 'stack' is only used if forupdate is true.
+ *
  * On entry, we have the buffer pinned and a lock of the type specified by
  * 'access'.  If we move right, we release the buffer and lock and acquire
  * the same on the right sibling.  Return value is the buffer we stop at.
@@ -158,6 +169,8 @@ _bt_moveright(Relation rel,
 			  int keysz,
 			  ScanKey scankey,
 			  bool nextkey,
+			  bool forupdate,
+			  BTStack stack,
 			  int access)
 {
 	Page		page;
@@ -186,14 +199,43 @@ _bt_moveright(Relation rel,
 
 	while (!P_RIGHTMOST(opaque) &&
 		   (P_IGNORE(opaque) ||
+			(forupdate && P_INCOMPLETE_SPLIT(opaque)) ||
 			_bt_compare(rel, keysz, scankey, page, P_HIKEY) >= cmpval))
 	{
-		/* step right one page */
-		BlockNumber rblkno = opaque->btpo_next;
+		/*
+		 * Finish any incomplete splits and remove any half-dead pages we
+		 * encounter along the way.
+		 */
+		if (forupdate && P_INCOMPLETE_SPLIT(opaque))
+		{
+			BlockNumber blkno = BufferGetBlockNumber(buf);
 
-		buf = _bt_relandgetbuf(rel, buf, rblkno, access);
-		page = BufferGetPage(buf);
-		opaque = (BTPageOpaque) PageGetSpecialPointer(page);
+			if (access == BT_READ)
+			{
+				/* upgrade the lock, and re-check */
+				LockBuffer(buf, BUFFER_LOCK_UNLOCK);
+				LockBuffer(buf, BT_WRITE);
+				if (P_INCOMPLETE_SPLIT(opaque))
+				{
+					_bt_finish_split(rel, buf, stack);
+					_bt_getbuf(rel, blkno, access);
+				}
+			}
+			else
+			{
+				_bt_finish_split(rel, buf, stack);
+				_bt_getbuf(rel, blkno, access);
+			}
+		}
+		else
+		{
+			/* step right one page */
+			BlockNumber rblkno = opaque->btpo_next;
+
+			buf = _bt_relandgetbuf(rel, buf, rblkno, access);
+			page = BufferGetPage(buf);
+			opaque = (BTPageOpaque) PageGetSpecialPointer(page);
+		}
 	}
 
 	if (P_IGNORE(opaque))
@@ -1314,7 +1356,7 @@ _bt_steppage(IndexScanDesc scan, ScanDirection dir)
  * to be half-dead; the caller should check that condition and step left
  * again if it's important.
  */
-static Buffer
+Buffer
 _bt_walk_left(Relation rel, Buffer buf)
 {
 	Page		page;
diff --git a/src/backend/access/nbtree/nbtxlog.c b/src/backend/access/nbtree/nbtxlog.c
index ebeb70a..1d0a2a4 100644
--- a/src/backend/access/nbtree/nbtxlog.c
+++ b/src/backend/access/nbtree/nbtxlog.c
@@ -21,61 +21,6 @@
 #include "miscadmin.h"
 
 /*
- * We must keep track of expected insertions due to page splits, and apply
- * them manually if they are not seen in the WAL log during replay.  This
- * makes it safe for page insertion to be a multiple-WAL-action process.
- *
- * The data structure is a simple linked list --- this should be good enough,
- * since we don't expect a page split to remain incomplete for long.  In any
- * case we need to respect the order of operations.
- */
-typedef struct bt_incomplete_split
-{
-	RelFileNode node;			/* the index */
-	bool		is_root;		/* we split the root */
-	BlockNumber leftblk;		/* left half of split */
-	BlockNumber rightblk;		/* right half of split */
-} bt_incomplete_split;
-
-static List *incomplete_splits;
-
-
-static void
-log_incomplete_split(RelFileNode node, BlockNumber leftblk,
-					 BlockNumber rightblk, bool is_root)
-{
-	bt_incomplete_split *action = palloc(sizeof(bt_incomplete_split));
-
-	action->node = node;
-	action->is_root = is_root;
-	action->leftblk = leftblk;
-	action->rightblk = rightblk;
-	incomplete_splits = lappend(incomplete_splits, action);
-}
-
-static void
-forget_matching_split(RelFileNode node, BlockNumber downlink, bool is_root)
-{
-	ListCell   *l;
-
-	foreach(l, incomplete_splits)
-	{
-		bt_incomplete_split *action = (bt_incomplete_split *) lfirst(l);
-
-		if (RelFileNodeEquals(node, action->node) &&
-			downlink == action->rightblk)
-		{
-			if (is_root != action->is_root)
-				elog(LOG, "forget_matching_split: fishy is_root data (expected %d, got %d)",
-					 action->is_root, is_root);
-			incomplete_splits = list_delete_ptr(incomplete_splits, action);
-			pfree(action);
-			break;				/* need not look further */
-		}
-	}
-}
-
-/*
  * _bt_restore_page -- re-enter all the index tuples on a page
  *
  * The page is freshly init'd, and *from (length len) is a copy of what
@@ -149,23 +94,60 @@ _bt_restore_meta(RelFileNode rnode, XLogRecPtr lsn,
 	UnlockReleaseBuffer(metabuf);
 }
 
+/*
+ * _bt_clear_incomplete_split -- clear INCOMPLETE_SPLIT flag on a page
+ *
+ * This is a common subroutine of the redo functions of all the WAL record
+ * types that can insert a downlink: insert, split, and newroot.
+ */
+static void
+_bt_clear_incomplete_split(XLogRecPtr lsn, XLogRecord *record,
+						   RelFileNode rnode, BlockNumber cblock)
+{
+	Buffer buf;
+
+	buf = XLogReadBuffer(rnode, cblock, false);
+	if (BufferIsValid(buf))
+	{
+		Page		page = (Page) BufferGetPage(buf);
+
+		if (lsn > PageGetLSN(page))
+		{
+			BTPageOpaque pageop = (BTPageOpaque) PageGetSpecialPointer(page);
+			Assert((pageop->btpo_flags & BTP_INCOMPLETE_SPLIT) != 0);
+			pageop->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+
+			PageSetLSN(page, lsn);
+			MarkBufferDirty(buf);
+		}
+		UnlockReleaseBuffer(buf);
+	}
+}
+
 static void
 btree_xlog_insert(bool isleaf, bool ismeta,
 				  XLogRecPtr lsn, XLogRecord *record)
 {
 	xl_btree_insert *xlrec = (xl_btree_insert *) XLogRecGetData(record);
 	Buffer		buffer;
+	Buffer		cbuffer = InvalidBuffer;
 	Page		page;
 	char	   *datapos;
 	int			datalen;
 	xl_btree_metadata md;
-	BlockNumber downlink = 0;
+	BlockNumber cblkno = 0;
+	int			main_blk_index;
 
 	datapos = (char *) xlrec + SizeOfBtreeInsert;
 	datalen = record->xl_len - SizeOfBtreeInsert;
-	if (!isleaf)
+	/*
+	 * if this insert finishes a split at lower level, extract the block
+	 * number of the (left) child.
+	 */
+	if (!isleaf && (record->xl_info & XLR_BKP_BLOCK(0)) == 0)
 	{
-		memcpy(&downlink, datapos, sizeof(BlockNumber));
+		memcpy(&cblkno, datapos, sizeof(BlockNumber));
+		Assert(cblkno != 0);
 		datapos += sizeof(BlockNumber);
 		datalen -= sizeof(BlockNumber);
 	}
@@ -176,8 +158,19 @@ btree_xlog_insert(bool isleaf, bool ismeta,
 		datalen -= sizeof(xl_btree_metadata);
 	}
 
-	if (record->xl_info & XLR_BKP_BLOCK(0))
-		(void) RestoreBackupBlock(lsn, record, 0, false, false);
+	if (!isleaf)
+	{
+		if (record->xl_info & XLR_BKP_BLOCK(0))
+			(void) RestoreBackupBlock(lsn, record, 0, false, false);
+		else
+			_bt_clear_incomplete_split(lsn, record, xlrec->target.node, cblkno);
+		main_blk_index = 1;
+	}
+	else
+		main_blk_index = 0;
+
+	if (record->xl_info & XLR_BKP_BLOCK(main_blk_index))
+		(void) RestoreBackupBlock(lsn, record, main_blk_index, false, false);
 	else
 	{
 		buffer = XLogReadBuffer(xlrec->target.node,
@@ -187,11 +180,7 @@ btree_xlog_insert(bool isleaf, bool ismeta,
 		{
 			page = (Page) BufferGetPage(buffer);
 
-			if (lsn <= PageGetLSN(page))
-			{
-				UnlockReleaseBuffer(buffer);
-			}
-			else
+			if (lsn > PageGetLSN(page))
 			{
 				if (PageAddItem(page, (Item) datapos, datalen,
 							ItemPointerGetOffsetNumber(&(xlrec->target.tid)),
@@ -200,11 +189,14 @@ btree_xlog_insert(bool isleaf, bool ismeta,
 
 				PageSetLSN(page, lsn);
 				MarkBufferDirty(buffer);
-				UnlockReleaseBuffer(buffer);
 			}
+			UnlockReleaseBuffer(buffer);
 		}
 	}
 
+	if (BufferIsValid(cbuffer))
+		UnlockReleaseBuffer(cbuffer);
+
 	/*
 	 * Note: in normal operation, we'd update the metapage while still holding
 	 * lock on the page we inserted into.  But during replay it's not
@@ -216,10 +208,6 @@ btree_xlog_insert(bool isleaf, bool ismeta,
 		_bt_restore_meta(xlrec->target.node, lsn,
 						 md.root, md.level,
 						 md.fastroot, md.fastlevel);
-
-	/* Forget any split this insertion completes */
-	if (!isleaf)
-		forget_matching_split(xlrec->target.node, downlink, false);
 }
 
 static void
@@ -227,6 +215,8 @@ btree_xlog_split(bool onleft, bool isroot,
 				 XLogRecPtr lsn, XLogRecord *record)
 {
 	xl_btree_split *xlrec = (xl_btree_split *) XLogRecGetData(record);
+	bool		isleaf = (xlrec->level == 0);
+	Buffer		lbuf;
 	Buffer		rbuf;
 	Page		rpage;
 	BTPageOpaque ropaque;
@@ -237,42 +227,18 @@ btree_xlog_split(bool onleft, bool isroot,
 	Size		newitemsz = 0;
 	Item		left_hikey = NULL;
 	Size		left_hikeysz = 0;
+	BlockNumber cblkno = InvalidBlockNumber;
 
 	datapos = (char *) xlrec + SizeOfBtreeSplit;
 	datalen = record->xl_len - SizeOfBtreeSplit;
 
-	/* Forget any split this insertion completes */
-	if (xlrec->level > 0)
-	{
-		/* we assume SizeOfBtreeSplit is at least 16-bit aligned */
-		BlockNumber downlink = BlockIdGetBlockNumber((BlockId) datapos);
-
-		datapos += sizeof(BlockIdData);
-		datalen -= sizeof(BlockIdData);
-
-		forget_matching_split(xlrec->node, downlink, false);
-
-		/* Extract left hikey and its size (still assuming 16-bit alignment) */
-		if (!(record->xl_info & XLR_BKP_BLOCK(0)))
-		{
-			/* We assume 16-bit alignment is enough for IndexTupleSize */
-			left_hikey = (Item) datapos;
-			left_hikeysz = MAXALIGN(IndexTupleSize(left_hikey));
-
-			datapos += left_hikeysz;
-			datalen -= left_hikeysz;
-		}
-	}
-
-	/* Extract newitem and newitemoff, if present */
+	/* Extract newitemoff and newitem, if present */
 	if (onleft)
 	{
-		/* Extract the offset (still assuming 16-bit alignment) */
 		memcpy(&newitemoff, datapos, sizeof(OffsetNumber));
 		datapos += sizeof(OffsetNumber);
 		datalen -= sizeof(OffsetNumber);
 	}
-
 	if (onleft && !(record->xl_info & XLR_BKP_BLOCK(0)))
 	{
 		/*
@@ -286,6 +252,37 @@ btree_xlog_split(bool onleft, bool isroot,
 		datalen -= newitemsz;
 	}
 
+	/* Extract left hikey and its size (still assuming 16-bit alignment) */
+	if (!isleaf && !(record->xl_info & XLR_BKP_BLOCK(0)))
+	{
+		left_hikey = (Item) datapos;
+		left_hikeysz = MAXALIGN(IndexTupleSize(left_hikey));
+		datapos += left_hikeysz;
+		datalen -= left_hikeysz;
+	}
+	/*
+	 * If this insertion finishes an incomplete split, get the block number
+	 * of the child.
+	 */
+	if (!isleaf && !(record->xl_info & XLR_BKP_BLOCK(1)))
+	{
+		memcpy(&cblkno, datapos, sizeof(BlockNumber));
+		datapos += sizeof(BlockNumber);
+		datalen -= sizeof(BlockNumber);
+	}
+
+	/*
+	 * Clear the incomplete split flag on the left sibling of the child page
+	 * this is a downlink for.
+	 */
+	if (!isleaf)
+	{
+		if (record->xl_info & XLR_BKP_BLOCK(2))
+			(void) RestoreBackupBlock(lsn, record, 2, false, false);
+		else
+			_bt_clear_incomplete_split(lsn, record, xlrec->node, cblkno);
+	}
+
 	/* Reconstruct right (new) sibling page from scratch */
 	rbuf = XLogReadBuffer(xlrec->node, xlrec->rightsib, true);
 	Assert(BufferIsValid(rbuf));
@@ -297,7 +294,7 @@ btree_xlog_split(bool onleft, bool isroot,
 	ropaque->btpo_prev = xlrec->leftsib;
 	ropaque->btpo_next = xlrec->rnext;
 	ropaque->btpo.level = xlrec->level;
-	ropaque->btpo_flags = (xlrec->level == 0) ? BTP_LEAF : 0;
+	ropaque->btpo_flags = isleaf ? BTP_LEAF : 0;
 	ropaque->btpo_cycleid = 0;
 
 	_bt_restore_page(rpage, datapos, datalen);
@@ -306,7 +303,7 @@ btree_xlog_split(bool onleft, bool isroot,
 	 * On leaf level, the high key of the left page is equal to the first key
 	 * on the right page.
 	 */
-	if (xlrec->level == 0)
+	if (isleaf)
 	{
 		ItemId		hiItemId = PageGetItemId(rpage, P_FIRSTDATAKEY(ropaque));
 
@@ -321,10 +318,10 @@ btree_xlog_split(bool onleft, bool isroot,
 
 	/* Now reconstruct left (original) sibling page */
 	if (record->xl_info & XLR_BKP_BLOCK(0))
-		(void) RestoreBackupBlock(lsn, record, 0, false, false);
+		lbuf = RestoreBackupBlock(lsn, record, 0, false, true);
 	else
 	{
-		Buffer		lbuf = XLogReadBuffer(xlrec->node, xlrec->leftsib, false);
+		lbuf = XLogReadBuffer(xlrec->node, xlrec->leftsib, false);
 
 		if (BufferIsValid(lbuf))
 		{
@@ -381,19 +378,21 @@ btree_xlog_split(bool onleft, bool isroot,
 					elog(PANIC, "failed to add high key to left page after split");
 
 				/* Fix opaque fields */
-				lopaque->btpo_flags = (xlrec->level == 0) ? BTP_LEAF : 0;
+				lopaque->btpo_flags = BTP_INCOMPLETE_SPLIT;
+				if (isleaf)
+					lopaque->btpo_flags |= BTP_LEAF;
 				lopaque->btpo_next = xlrec->rightsib;
 				lopaque->btpo_cycleid = 0;
 
 				PageSetLSN(lpage, lsn);
 				MarkBufferDirty(lbuf);
 			}
-
-			UnlockReleaseBuffer(lbuf);
 		}
 	}
 
-	/* We no longer need the right buffer */
+	/* We no longer need the buffers */
+	if (BufferIsValid(lbuf))
+		UnlockReleaseBuffer(lbuf);
 	UnlockReleaseBuffer(rbuf);
 
 	/*
@@ -404,32 +403,39 @@ btree_xlog_split(bool onleft, bool isroot,
 	 * replay, because no other index update can be in progress, and readers
 	 * will cope properly when following an obsolete left-link.
 	 */
-	if (record->xl_info & XLR_BKP_BLOCK(1))
-		(void) RestoreBackupBlock(lsn, record, 1, false, false);
-	else if (xlrec->rnext != P_NONE)
+	if (xlrec->rnext != P_NONE)
 	{
-		Buffer		buffer = XLogReadBuffer(xlrec->node, xlrec->rnext, false);
+		/*
+		 * the backup block containing right sibling is 2 or 3, depending
+		 * whether this was a leaf or internal page.
+		 */
+		int		rnext_index = isleaf ? 2 : 3;
 
-		if (BufferIsValid(buffer))
+		if (record->xl_info & XLR_BKP_BLOCK(rnext_index))
+			(void) RestoreBackupBlock(lsn, record, rnext_index, false, false);
+		else
 		{
-			Page		page = (Page) BufferGetPage(buffer);
+			Buffer		buffer;
 
-			if (lsn > PageGetLSN(page))
+			buffer = XLogReadBuffer(xlrec->node, xlrec->rnext, false);
+
+			if (BufferIsValid(buffer))
 			{
-				BTPageOpaque pageop = (BTPageOpaque) PageGetSpecialPointer(page);
+				Page		page = (Page) BufferGetPage(buffer);
 
-				pageop->btpo_prev = xlrec->rightsib;
+				if (lsn > PageGetLSN(page))
+				{
+					BTPageOpaque pageop = (BTPageOpaque) PageGetSpecialPointer(page);
 
-				PageSetLSN(page, lsn);
-				MarkBufferDirty(buffer);
+					pageop->btpo_prev = xlrec->rightsib;
+
+					PageSetLSN(page, lsn);
+					MarkBufferDirty(buffer);
+				}
+				UnlockReleaseBuffer(buffer);
 			}
-			UnlockReleaseBuffer(buffer);
 		}
 	}
-
-	/* The job ain't done till the parent link is inserted... */
-	log_incomplete_split(xlrec->node,
-						 xlrec->leftsib, xlrec->rightsib, isroot);
 }
 
 static void
@@ -938,10 +944,7 @@ btree_xlog_newroot(XLogRecPtr lsn, XLogRecord *record)
 	Buffer		buffer;
 	Page		page;
 	BTPageOpaque pageop;
-	BlockNumber downlink = 0;
-
-	/* Backup blocks are not used in newroot records */
-	Assert(!(record->xl_info & XLR_BKP_BLOCK_MASK));
+	BlockNumber cblkno;
 
 	buffer = XLogReadBuffer(xlrec->node, xlrec->rootblk, true);
 	Assert(BufferIsValid(buffer));
@@ -964,10 +967,16 @@ btree_xlog_newroot(XLogRecPtr lsn, XLogRecord *record)
 		_bt_restore_page(page,
 						 (char *) xlrec + SizeOfBtreeNewroot,
 						 record->xl_len - SizeOfBtreeNewroot);
-		/* extract downlink to the right-hand split page */
-		itup = (IndexTuple) PageGetItem(page, PageGetItemId(page, P_FIRSTKEY));
-		downlink = ItemPointerGetBlockNumber(&(itup->t_tid));
+		/* extract block number of the left-hand split page */
+		itup = (IndexTuple) PageGetItem(page, PageGetItemId(page, P_HIKEY));
+		cblkno = ItemPointerGetBlockNumber(&(itup->t_tid));
 		Assert(ItemPointerGetOffsetNumber(&(itup->t_tid)) == P_HIKEY);
+
+		/* Clear the incomplete-split flag in left child */
+		if (record->xl_info & XLR_BKP_BLOCK(0))
+			(void) RestoreBackupBlock(lsn, record, 0, false, false);
+		else
+			_bt_clear_incomplete_split(lsn, record, xlrec->node, cblkno);
 	}
 
 	PageSetLSN(page, lsn);
@@ -977,10 +986,6 @@ btree_xlog_newroot(XLogRecPtr lsn, XLogRecord *record)
 	_bt_restore_meta(xlrec->node, lsn,
 					 xlrec->rootblk, xlrec->level,
 					 xlrec->rootblk, xlrec->level);
-
-	/* Check to see if this satisfies any incomplete insertions */
-	if (record->xl_len > SizeOfBtreeNewroot)
-		forget_matching_split(xlrec->node, downlink, true);
 }
 
 static void
@@ -1060,59 +1065,3 @@ btree_redo(XLogRecPtr lsn, XLogRecord *record)
 			elog(PANIC, "btree_redo: unknown op code %u", info);
 	}
 }
-
-void
-btree_xlog_startup(void)
-{
-	incomplete_splits = NIL;
-}
-
-void
-btree_xlog_cleanup(void)
-{
-	ListCell   *l;
-
-	foreach(l, incomplete_splits)
-	{
-		/* finish an incomplete split */
-		bt_incomplete_split *action = (bt_incomplete_split *) lfirst(l);
-		Buffer		lbuf,
-					rbuf;
-		Page		lpage,
-					rpage;
-		BTPageOpaque lpageop,
-					rpageop;
-		bool		is_only;
-		Relation	reln;
-
-		lbuf = XLogReadBuffer(action->node, action->leftblk, false);
-		/* failure is impossible because we wrote this page earlier */
-		if (!BufferIsValid(lbuf))
-			elog(PANIC, "btree_xlog_cleanup: left block unfound");
-		lpage = (Page) BufferGetPage(lbuf);
-		lpageop = (BTPageOpaque) PageGetSpecialPointer(lpage);
-		rbuf = XLogReadBuffer(action->node, action->rightblk, false);
-		/* failure is impossible because we wrote this page earlier */
-		if (!BufferIsValid(rbuf))
-			elog(PANIC, "btree_xlog_cleanup: right block unfound");
-		rpage = (Page) BufferGetPage(rbuf);
-		rpageop = (BTPageOpaque) PageGetSpecialPointer(rpage);
-
-		/* if the pages are all of their level, it's a only-page split */
-		is_only = P_LEFTMOST(lpageop) && P_RIGHTMOST(rpageop);
-
-		reln = CreateFakeRelcacheEntry(action->node);
-		_bt_insert_parent(reln, lbuf, rbuf, NULL,
-						  action->is_root, is_only);
-		FreeFakeRelcacheEntry(reln);
-	}
-	incomplete_splits = NIL;
-}
-
-bool
-btree_safe_restartpoint(void)
-{
-	if (incomplete_splits)
-		return false;
-	return true;
-}
diff --git a/src/include/access/nbtree.h b/src/include/access/nbtree.h
index d9c39df..ef56212 100644
--- a/src/include/access/nbtree.h
+++ b/src/include/access/nbtree.h
@@ -73,6 +73,7 @@ typedef BTPageOpaqueData *BTPageOpaque;
 #define BTP_HALF_DEAD	(1 << 4)	/* empty, but still in tree */
 #define BTP_SPLIT_END	(1 << 5)	/* rightmost page of split group */
 #define BTP_HAS_GARBAGE (1 << 6)	/* page has LP_DEAD tuples */
+#define BTP_INCOMPLETE_SPLIT (1 << 7) /* right sibling's downlink is missing */
 
 /*
  * The max allowed value of a cycle ID is a bit less than 64K.	This is
@@ -178,6 +179,7 @@ typedef struct BTMetaPageData
 #define P_ISHALFDEAD(opaque)	((opaque)->btpo_flags & BTP_HALF_DEAD)
 #define P_IGNORE(opaque)		((opaque)->btpo_flags & (BTP_DELETED|BTP_HALF_DEAD))
 #define P_HAS_GARBAGE(opaque)	((opaque)->btpo_flags & BTP_HAS_GARBAGE)
+#define P_INCOMPLETE_SPLIT(opaque)	((opaque)->btpo_flags & BTP_INCOMPLETE_SPLIT)
 
 /*
  *	Lehman and Yao's algorithm requires a ``high key'' on every non-rightmost
@@ -253,7 +255,7 @@ typedef struct xl_btree_metadata
 typedef struct xl_btree_insert
 {
 	xl_btreetid target;			/* inserted tuple id */
-	/* BlockNumber downlink field FOLLOWS IF NOT XLOG_BTREE_INSERT_LEAF */
+	/* BlockNumber finishes_split field FOLLOWS IF NOT XLOG_BTREE_INSERT_LEAF */
 	/* xl_btree_metadata FOLLOWS IF XLOG_BTREE_INSERT_META */
 	/* INDEX TUPLE FOLLOWS AT END OF STRUCT */
 } xl_btree_insert;
@@ -286,19 +288,18 @@ typedef struct xl_btree_split
 	OffsetNumber firstright;	/* first item moved to right page */
 
 	/*
-	 * If level > 0, BlockIdData downlink follows.	(We use BlockIdData rather
-	 * than BlockNumber for alignment reasons: SizeOfBtreeSplit is only 16-bit
-	 * aligned.)
+	 * In the _L variants, next are OffsetNumber newitemoff and the new item.
+	 * (In the _R variants, the new item is one of the right page's tuples.)
+	 * The new item, but not newitemoff, is suppressed if XLogInsert chooses
+	 * to store the left page's whole page image.
 	 *
 	 * If level > 0, an IndexTuple representing the HIKEY of the left page
 	 * follows.  We don't need this on leaf pages, because it's the same as
 	 * the leftmost key in the new right page.	Also, it's suppressed if
 	 * XLogInsert chooses to store the left page's whole page image.
 	 *
-	 * In the _L variants, next are OffsetNumber newitemoff and the new item.
-	 * (In the _R variants, the new item is one of the right page's tuples.)
-	 * The new item, but not newitemoff, is suppressed if XLogInsert chooses
-	 * to store the left page's whole page image.
+	 * If level > 0, BlockNumber of the page whose incomplete-split flag
+	 * this insertion clears. (not aligned)
 	 *
 	 * Last are the right page's tuples in the form used by _bt_restore_page.
 	 */
@@ -635,8 +636,7 @@ extern Datum btoptions(PG_FUNCTION_ARGS);
 extern bool _bt_doinsert(Relation rel, IndexTuple itup,
 			 IndexUniqueCheck checkUnique, Relation heapRel);
 extern Buffer _bt_getstackbuf(Relation rel, BTStack stack, int access);
-extern void _bt_insert_parent(Relation rel, Buffer buf, Buffer rbuf,
-				  BTStack stack, bool is_root, bool is_only);
+extern void _bt_finish_split(Relation rel, Buffer bbuf, BTStack stack);
 
 /*
  * prototypes for functions in nbtpage.c
@@ -666,7 +666,8 @@ extern BTStack _bt_search(Relation rel,
 		   int keysz, ScanKey scankey, bool nextkey,
 		   Buffer *bufP, int access);
 extern Buffer _bt_moveright(Relation rel, Buffer buf, int keysz,
-			  ScanKey scankey, bool nextkey, int access);
+			  ScanKey scankey, bool nextkey,
+			  bool finishsplits, BTStack stack,  int access);
 extern OffsetNumber _bt_binsrch(Relation rel, Buffer buf, int keysz,
 			ScanKey scankey, bool nextkey);
 extern int32 _bt_compare(Relation rel, int keysz, ScanKey scankey,
@@ -674,6 +675,7 @@ extern int32 _bt_compare(Relation rel, int keysz, ScanKey scankey,
 extern bool _bt_first(IndexScanDesc scan, ScanDirection dir);
 extern bool _bt_next(IndexScanDesc scan, ScanDirection dir);
 extern Buffer _bt_get_endpoint(Relation rel, uint32 level, bool rightmost);
+extern Buffer _bt_walk_left(Relation rel, Buffer buf);
 
 /*
  * prototypes for functions in nbtutils.c
@@ -715,8 +717,5 @@ extern void _bt_leafbuild(BTSpool *btspool, BTSpool *spool2);
  */
 extern void btree_redo(XLogRecPtr lsn, XLogRecord *record);
 extern void btree_desc(StringInfo buf, uint8 xl_info, char *rec);
-extern void btree_xlog_startup(void);
-extern void btree_xlog_cleanup(void);
-extern bool btree_safe_restartpoint(void);
 
 #endif   /* NBTREE_H */
diff --git a/src/include/access/rmgrlist.h b/src/include/access/rmgrlist.h
index 7ad71b3..7de2a96 100644
--- a/src/include/access/rmgrlist.h
+++ b/src/include/access/rmgrlist.h
@@ -36,7 +36,7 @@ PG_RMGR(RM_RELMAP_ID, "RelMap", relmap_redo, relmap_desc, NULL, NULL, NULL)
 PG_RMGR(RM_STANDBY_ID, "Standby", standby_redo, standby_desc, NULL, NULL, NULL)
 PG_RMGR(RM_HEAP2_ID, "Heap2", heap2_redo, heap2_desc, NULL, NULL, NULL)
 PG_RMGR(RM_HEAP_ID, "Heap", heap_redo, heap_desc, NULL, NULL, NULL)
-PG_RMGR(RM_BTREE_ID, "Btree", btree_redo, btree_desc, btree_xlog_startup, btree_xlog_cleanup, btree_safe_restartpoint)
+PG_RMGR(RM_BTREE_ID, "Btree", btree_redo, btree_desc, NULL, NULL, NULL)
 PG_RMGR(RM_HASH_ID, "Hash", hash_redo, hash_desc, NULL, NULL, NULL)
 PG_RMGR(RM_GIN_ID, "Gin", gin_redo, gin_desc, gin_xlog_startup, gin_xlog_cleanup, gin_safe_restartpoint)
 PG_RMGR(RM_GIST_ID, "Gist", gist_redo, gist_desc, gist_xlog_startup, gist_xlog_cleanup, NULL)

diff --git a/src/backend/access/nbtree/README b/src/backend/access/nbtree/README
index 03efc29..43ee75f 100644
--- a/src/backend/access/nbtree/README
+++ b/src/backend/access/nbtree/README
@@ -404,12 +404,34 @@ an additional insertion above that, etc).
 For a root split, the followon WAL entry is a "new root" entry rather than
 an "insertion" entry, but details are otherwise much the same.
 
-Because insertion involves multiple atomic actions, the WAL replay logic
-has to detect the case where a page split isn't followed by a matching
-insertion on the parent level, and then do that insertion on its own (and
-recursively for any subsequent parent insertion, of course).  This is
-feasible because the WAL entry for the split contains enough info to know
-what must be inserted in the parent level.
+Because splitting involves multiple atomic actions, it's possible that the
+system crashes between splitting a page and inserting the downlink for the
+new half to the parent. After recovery, the downlink for the new page will
+be missing. The search algorithm works correctly, as the page will be found
+by following the right-link from its left sibling, although if a lot of
+downlinks in the tree are missing, performance will suffer. A more serious
+consequence is that if the page without a downlink gets split again, the
+insertion algorithm will fail to find the location in the parent level to
+insert the downlink.
+
+Our approach is to create any missing downlinks on-they-fly, when
+searching the tree for a new insertion. It could be done during searches,
+too, but it seems best not to put any extra updates in what would otherwise
+be a read-only operation (updating is not possible in hot standby mode
+anyway). To identify missing downlinks, when a page is split, the left page
+is flagged to indicate that the split is not yet complete (INCOMPLETE_SPLIT).
+When the downlink is inserted to the parent, the flag is cleared atomically
+with the insertion. The child page is kept locked until the insertion in the
+parent is finished and the flag in the child cleared, but can be released
+immediately after that, before recursing up the tree, if the parent also
+needs to be split. This ensures that incompletely split pages should not be
+seen under normal circumstances; only when insertion to the parent fails
+for some reason.
+
+We flag the left page, even though it's the right page that's missing the
+downlink, beacuse it's more convenient to know already when following the
+right-link from the left page to the right page that it will need to have
+its downlink inserted to the parent.
 
 When splitting a non-root page that is alone on its level, the required
 metapage update (of the "fast root" link) is performed and logged as part
@@ -422,6 +444,14 @@ page is a second record.  If vacuum is interrupted for some reason, or the
 system crashes, the tree is consistent for searches and insertions.  The next
 VACUUM will find the half-dead leaf page and continue the deletion.
 
+Before 9.4, we used to keep track of incomplete splits and page deletions
+during recovery and finish them immediately at end of recovery, instead of
+doing it lazily at the next  insertion or vacuum. However, that made the
+recovery much more complicated, and only fixed the problem when crash
+recovery was performed. An incomplete split can also occur if an otherwise
+recoverable error, like out-of-memory or out-of-disk-space, happens while
+inserting the downlink to the parent.
+
 Scans during Recovery
 ---------------------
 
diff --git a/src/backend/access/nbtree/nbtinsert.c b/src/backend/access/nbtree/nbtinsert.c
index 49c084a..4d60ae0 100644
--- a/src/backend/access/nbtree/nbtinsert.c
+++ b/src/backend/access/nbtree/nbtinsert.c
@@ -58,15 +58,18 @@ static void _bt_findinsertloc(Relation rel,
 				  int keysz,
 				  ScanKey scankey,
 				  IndexTuple newtup,
+				  BTStack stack,
 				  Relation heapRel);
-static void _bt_insertonpg(Relation rel, Buffer buf,
+static void _bt_insertonpg(Relation rel, Buffer buf, Buffer cbuf,
 			   BTStack stack,
 			   IndexTuple itup,
 			   OffsetNumber newitemoff,
 			   bool split_only_page);
-static Buffer _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
-		  OffsetNumber newitemoff, Size newitemsz,
+static Buffer _bt_split(Relation rel, Buffer buf, Buffer cbuf,
+		  OffsetNumber firstright, OffsetNumber newitemoff, Size newitemsz,
 		  IndexTuple newitem, bool newitemonleft);
+static void _bt_insert_parent(Relation rel, Buffer buf, Buffer rbuf,
+				  BTStack stack, bool is_root, bool is_only);
 static OffsetNumber _bt_findsplitloc(Relation rel, Page page,
 				 OffsetNumber newitemoff,
 				 Size newitemsz,
@@ -130,7 +133,8 @@ top:
 	 * move right in the tree.	See Lehman and Yao for an excruciatingly
 	 * precise description.
 	 */
-	buf = _bt_moveright(rel, buf, natts, itup_scankey, false, BT_WRITE);
+	buf = _bt_moveright(rel, buf, natts, itup_scankey, false,
+						true, stack, BT_WRITE);
 
 	/*
 	 * If we're not allowing duplicates, make sure the key isn't already in
@@ -183,8 +187,9 @@ top:
 		 */
 		CheckForSerializableConflictIn(rel, NULL, buf);
 		/* do the insertion */
-		_bt_findinsertloc(rel, &buf, &offset, natts, itup_scankey, itup, heapRel);
-		_bt_insertonpg(rel, buf, stack, itup, offset, false);
+		_bt_findinsertloc(rel, &buf, &offset, natts, itup_scankey, itup,
+						  stack, heapRel);
+		_bt_insertonpg(rel, buf, InvalidBuffer, stack, itup, offset, false);
 	}
 	else
 	{
@@ -508,6 +513,7 @@ _bt_findinsertloc(Relation rel,
 				  int keysz,
 				  ScanKey scankey,
 				  IndexTuple newtup,
+				  BTStack stack,
 				  Relation heapRel)
 {
 	Buffer		buf = *bufptr;
@@ -569,6 +575,7 @@ _bt_findinsertloc(Relation rel,
 	while (PageGetFreeSpace(page) < itemsz)
 	{
 		Buffer		rbuf;
+		BlockNumber	rblkno;
 
 		/*
 		 * before considering moving right, see if we can obtain enough space
@@ -606,18 +613,33 @@ _bt_findinsertloc(Relation rel,
 		 */
 		rbuf = InvalidBuffer;
 
+		rblkno = lpageop->btpo_next;
 		for (;;)
 		{
-			BlockNumber rblkno = lpageop->btpo_next;
-
 			rbuf = _bt_relandgetbuf(rel, rbuf, rblkno, BT_WRITE);
 			page = BufferGetPage(rbuf);
 			lpageop = (BTPageOpaque) PageGetSpecialPointer(page);
+
+			/*
+			 * If this page was incompletely split, finish that now. We do
+			 * this while holding a lock on the left sibling, which is not
+			 * good because finishing the split could be a fairly lengthy
+			 * operation.  But this should happen very seldom.
+			 */
+			if (P_INCOMPLETE_SPLIT(lpageop))
+			{
+				_bt_finish_split(rel, rbuf, stack);
+				rbuf = InvalidBuffer;
+				continue;
+			}
+
 			if (!P_IGNORE(lpageop))
 				break;
 			if (P_RIGHTMOST(lpageop))
 				elog(ERROR, "fell off the end of index \"%s\"",
 					 RelationGetRelationName(rel));
+
+			rblkno = lpageop->btpo_next;
 		}
 		_bt_relbuf(rel, buf);
 		buf = rbuf;
@@ -663,6 +685,10 @@ _bt_findinsertloc(Relation rel,
  *		insertion, and the buffer must be pinned and write-locked.	On return,
  *		we will have dropped both the pin and the lock on the buffer.
  *
+ *		When inserting to a non-leaf page, 'cbuf' is the left-sibling of the
+ *		page we're inserting the downlink for.  This function will clear the
+ *		INCOMPLETE_SPLIT flag on it, and release the buffer.
+ *
  *		The locking interactions in this code are critical.  You should
  *		grok Lehman and Yao's paper before making any changes.  In addition,
  *		you need to understand how we disambiguate duplicate keys in this
@@ -676,6 +702,7 @@ _bt_findinsertloc(Relation rel,
 static void
 _bt_insertonpg(Relation rel,
 			   Buffer buf,
+			   Buffer cbuf,
 			   BTStack stack,
 			   IndexTuple itup,
 			   OffsetNumber newitemoff,
@@ -689,6 +716,14 @@ _bt_insertonpg(Relation rel,
 	page = BufferGetPage(buf);
 	lpageop = (BTPageOpaque) PageGetSpecialPointer(page);
 
+	/*
+	 * The caller should've finished any incomplete splits and page deletions
+	 * already
+	 */
+	if (P_INCOMPLETE_SPLIT(lpageop))
+		elog(ERROR, "cannot insert to incompletely split page %u",
+			 BufferGetBlockNumber(buf));
+
 	itemsz = IndexTupleDSize(*itup);
 	itemsz = MAXALIGN(itemsz);	/* be safe, PageAddItem will do this but we
 								 * need to be consistent */
@@ -713,7 +748,7 @@ _bt_insertonpg(Relation rel,
 									  &newitemonleft);
 
 		/* split the buffer into left and right halves */
-		rbuf = _bt_split(rel, buf, firstright,
+		rbuf = _bt_split(rel, buf, cbuf, firstright,
 						 newitemoff, itemsz, itup, newitemonleft);
 		PredicateLockPageSplit(rel,
 							   BufferGetBlockNumber(buf),
@@ -787,11 +822,21 @@ _bt_insertonpg(Relation rel,
 			MarkBufferDirty(metabuf);
 		}
 
+		/* clear INCOMPLETE_SPLIT flag on child if this finishes a split */
+		if (!P_ISLEAF(lpageop))
+		{
+			Page		cpage = BufferGetPage(cbuf);
+			BTPageOpaque cpageop = (BTPageOpaque) PageGetSpecialPointer(cpage);
+			Assert(P_INCOMPLETE_SPLIT(cpageop));
+			cpageop->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+			MarkBufferDirty(cbuf);
+		}
+
 		/* XLOG stuff */
 		if (RelationNeedsWAL(rel))
 		{
 			xl_btree_insert xlrec;
-			BlockNumber xldownlink;
+			BlockNumber xlleftchild;
 			xl_btree_metadata xlmeta;
 			uint8		xlinfo;
 			XLogRecPtr	recptr;
@@ -811,12 +856,15 @@ _bt_insertonpg(Relation rel,
 				xlinfo = XLOG_BTREE_INSERT_LEAF;
 			else
 			{
-				xldownlink = ItemPointerGetBlockNumber(&(itup->t_tid));
-				Assert(ItemPointerGetOffsetNumber(&(itup->t_tid)) == P_HIKEY);
-
-				nextrdata->data = (char *) &xldownlink;
+				/*
+				 * Include the block number of the left child, whose
+				 * INCOMPLETE_SPLIT flag is cleared.
+				 */
+				xlleftchild = BufferGetBlockNumber(cbuf);
+				nextrdata->data = (char *) &xlleftchild;
 				nextrdata->len = sizeof(BlockNumber);
-				nextrdata->buffer = InvalidBuffer;
+				nextrdata->buffer = cbuf;
+				nextrdata->buffer_std = true;
 				nextrdata->next = nextrdata + 1;
 				nextrdata++;
 
@@ -869,6 +917,8 @@ _bt_insertonpg(Relation rel,
 		END_CRIT_SECTION();
 
 		/* release buffers; send out relcache inval if metapage changed */
+		if (!P_ISLEAF(lpageop))
+			_bt_relbuf(rel, cbuf);
 		if (BufferIsValid(metabuf))
 		{
 			if (!InRecovery)
@@ -888,11 +938,15 @@ _bt_insertonpg(Relation rel,
  *		new right page.  newitemoff etc. tell us about the new item that
  *		must be inserted along with the data from the old page.
  *
+ *		When splitting a non-leaf page, 'cbuf' is the left-sibling of the
+ *		page we're inserting the downlink for. This function will clear the
+ *		INCOMPLETE_SPLIT flag on it, and release the buffer.
+ *
  *		Returns the new right sibling of buf, pinned and write-locked.
  *		The pin and lock on buf are maintained.
  */
 static Buffer
-_bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
+_bt_split(Relation rel, Buffer buf, Buffer cbuf, OffsetNumber firstright,
 		  OffsetNumber newitemoff, Size newitemsz, IndexTuple newitem,
 		  bool newitemonleft)
 {
@@ -960,6 +1014,8 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 	lopaque->btpo_flags = oopaque->btpo_flags;
 	lopaque->btpo_flags &= ~(BTP_ROOT | BTP_SPLIT_END | BTP_HAS_GARBAGE);
 	ropaque->btpo_flags = lopaque->btpo_flags;
+	/* set flag in left page indicating that the right page has no downlink */
+	lopaque->btpo_flags |= BTP_INCOMPLETE_SPLIT;
 	lopaque->btpo_prev = oopaque->btpo_prev;
 	lopaque->btpo_next = rightpagenumber;
 	ropaque->btpo_prev = origpagenumber;
@@ -1183,6 +1239,18 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 		MarkBufferDirty(sbuf);
 	}
 
+	/*
+	 * Clear INCOMPLETE_SPLIT flag on child if inserting the new item finishes
+	 * a split.
+	 */
+	if (ropaque->btpo.level > 0)
+	{
+		Page		cpage = BufferGetPage(cbuf);
+		BTPageOpaque cpageop = (BTPageOpaque) PageGetSpecialPointer(cpage);
+		cpageop->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+		MarkBufferDirty(cbuf);
+	}
+
 	/* XLOG stuff */
 	if (RelationNeedsWAL(rel))
 	{
@@ -1205,34 +1273,6 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 
 		lastrdata = &rdata[0];
 
-		if (ropaque->btpo.level > 0)
-		{
-			/* Log downlink on non-leaf pages */
-			lastrdata->next = lastrdata + 1;
-			lastrdata++;
-
-			lastrdata->data = (char *) &newitem->t_tid.ip_blkid;
-			lastrdata->len = sizeof(BlockIdData);
-			lastrdata->buffer = InvalidBuffer;
-
-			/*
-			 * We must also log the left page's high key, because the right
-			 * page's leftmost key is suppressed on non-leaf levels.  Show it
-			 * as belonging to the left page buffer, so that it is not stored
-			 * if XLogInsert decides it needs a full-page image of the left
-			 * page.
-			 */
-			lastrdata->next = lastrdata + 1;
-			lastrdata++;
-
-			itemid = PageGetItemId(origpage, P_HIKEY);
-			item = (IndexTuple) PageGetItem(origpage, itemid);
-			lastrdata->data = (char *) item;
-			lastrdata->len = MAXALIGN(IndexTupleSize(item));
-			lastrdata->buffer = buf;	/* backup block 1 */
-			lastrdata->buffer_std = true;
-		}
-
 		/*
 		 * Log the new item and its offset, if it was inserted on the left
 		 * page. (If it was put on the right page, we don't need to explicitly
@@ -1259,17 +1299,40 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 			lastrdata->buffer = buf;	/* backup block 1 */
 			lastrdata->buffer_std = true;
 		}
-		else if (ropaque->btpo.level == 0)
+
+		/* Log left page */
+		if (ropaque->btpo.level > 0)
 		{
+			lastrdata->next = lastrdata + 1;
+			lastrdata++;
+
 			/*
-			 * Although we don't need to WAL-log the new item, we still need
-			 * XLogInsert to consider storing a full-page image of the left
-			 * page, so make an empty entry referencing that buffer. This also
-			 * ensures that the left page is always backup block 1.
+			 * We must also log the left page's high key, because the right
+			 * page's leftmost key is suppressed on non-leaf levels.  Show it
+			 * as belonging to the left page buffer, so that it is not stored
+			 * if XLogInsert decides it needs a full-page image of the left
+			 * page.
 			 */
+			itemid = PageGetItemId(origpage, P_HIKEY);
+			item = (IndexTuple) PageGetItem(origpage, itemid);
+			lastrdata->data = (char *) item;
+			lastrdata->len = MAXALIGN(IndexTupleSize(item));
+			lastrdata->buffer = buf;	/* backup block 1 */
+			lastrdata->buffer_std = true;
+		}
+
+		if (ropaque->btpo.level == 0 && !newitemonleft)
+		{
 			lastrdata->next = lastrdata + 1;
 			lastrdata++;
 
+			/*
+			 * Although we don't need to WAL-log anything on the left page,
+			 * the new item, we still need XLogInsert to consider storing a
+			 * full-page image of the left page, so make an empty entry
+			 * referencing that buffer. This also ensures that the left page
+			 * is always backup block 1.
+			 */
 			lastrdata->data = NULL;
 			lastrdata->len = 0;
 			lastrdata->buffer = buf;	/* backup block 1 */
@@ -1277,6 +1340,22 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 		}
 
 		/*
+		 * Log block number of left child, whose INCOMPLETE_SPLIT flag this
+		 * insertion clears.
+		 */
+		if (ropaque->btpo.level > 0)
+		{
+			BlockNumber cblkno = BufferGetBlockNumber(cbuf);
+			lastrdata->next = lastrdata + 1;
+			lastrdata++;
+
+			lastrdata->data = (char *) &cblkno;
+			lastrdata->len = sizeof(BlockNumber);
+			lastrdata->buffer = cbuf;	/* backup block 2 */
+			lastrdata->buffer_std = true;
+		}
+
+		/*
 		 * Log the contents of the right page in the format understood by
 		 * _bt_restore_page(). We set lastrdata->buffer to InvalidBuffer,
 		 * because we're going to recreate the whole page anyway, so it should
@@ -1305,7 +1384,7 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 
 			lastrdata->data = NULL;
 			lastrdata->len = 0;
-			lastrdata->buffer = sbuf;	/* backup block 2 */
+			lastrdata->buffer = sbuf;	/* bkp block 2 (leaf) or 3 (non-leaf) */
 			lastrdata->buffer_std = true;
 		}
 
@@ -1332,6 +1411,10 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 	if (!P_RIGHTMOST(ropaque))
 		_bt_relbuf(rel, sbuf);
 
+	/* release the child */
+	if (ropaque->btpo.level > 0)
+		_bt_relbuf(rel, cbuf);
+
 	/* split's done */
 	return rbuf;
 }
@@ -1602,10 +1685,8 @@ _bt_checksplitloc(FindSplitData *state,
  *			have to be efficient (concurrent ROOT split, WAL recovery)
  * is_root - we split the true root
  * is_only - we split a page alone on its level (might have been fast root)
- *
- * This is exported so it can be called by nbtxlog.c.
  */
-void
+static void
 _bt_insert_parent(Relation rel,
 				  Buffer buf,
 				  Buffer rbuf,
@@ -1624,8 +1705,7 @@ _bt_insert_parent(Relation rel,
 	 *
 	 * If we have to search for the parent level, we do so by re-descending
 	 * from the root.  This is not super-efficient, but it's rare enough not
-	 * to matter.  (This path is also taken when called from WAL recovery ---
-	 * we have no stack in that case.)
+	 * to matter.
 	 */
 	if (is_root)
 	{
@@ -1684,12 +1764,13 @@ _bt_insert_parent(Relation rel,
 		 * 05/27/97
 		 */
 		ItemPointerSet(&(stack->bts_btentry.t_tid), bknum, P_HIKEY);
-
 		pbuf = _bt_getstackbuf(rel, stack, BT_WRITE);
 
-		/* Now we can unlock the children */
+		/*
+		 * Now we can unlock the right child. The left child will be unlocked
+		 * by _bt_insertonpg().
+		 */
 		_bt_relbuf(rel, rbuf);
-		_bt_relbuf(rel, buf);
 
 		/* Check for error only after writing children */
 		if (pbuf == InvalidBuffer)
@@ -1697,7 +1778,7 @@ _bt_insert_parent(Relation rel,
 				 RelationGetRelationName(rel), bknum, rbknum);
 
 		/* Recursively update the parent */
-		_bt_insertonpg(rel, pbuf, stack->bts_parent,
+		_bt_insertonpg(rel, pbuf, buf, stack->bts_parent,
 					   new_item, stack->bts_offset + 1,
 					   is_only);
 
@@ -1707,6 +1788,62 @@ _bt_insert_parent(Relation rel,
 }
 
 /*
+ * _bt_finish_split() -- Finish an incomplete split
+ *
+ * A crash or other failure can leave a split incomplete. The insertion
+ * routines won't allow to insert on a page that is incompletely split.
+ * Before inserting on such a page, call _bt_finish_split().
+ *
+ * On entry, we hold write-mode lock on it, and the lock is released on
+ * exit.
+ */
+void
+_bt_finish_split(Relation rel, Buffer lbuf, BTStack stack)
+{
+	Page		lpage = BufferGetPage(lbuf);
+	BTPageOpaque lpageop = (BTPageOpaque) PageGetSpecialPointer(lpage);
+	Buffer		rbuf;
+	Page		rpage;
+	BTPageOpaque rpageop;
+	bool		was_root;
+	bool		was_only;
+
+	Assert(P_INCOMPLETE_SPLIT(lpageop));
+
+	/* Lock right sibling, the one missing the downlink */
+	rbuf = _bt_getbuf(rel, lpageop->btpo_next, BT_WRITE);
+	rpage = BufferGetPage(rbuf);
+	rpageop = (BTPageOpaque) PageGetSpecialPointer(rpage);
+
+	/* Could this be a root split? */
+	if (!stack)
+	{
+		Buffer		metabuf;
+		Page		metapg;
+		BTMetaPageData *metad;
+
+		/* acquire lock on the metapage */
+		metabuf = _bt_getbuf(rel, BTREE_METAPAGE, BT_WRITE);
+		metapg = BufferGetPage(metabuf);
+		metad = BTPageGetMeta(metapg);
+
+		was_root = (metad->btm_root == BufferGetBlockNumber(lbuf));
+
+		_bt_relbuf(rel, metabuf);
+	}
+	else
+		was_root = false;
+
+	/* Was this the only page on the level before split? */
+	was_only = (P_LEFTMOST(lpageop) && P_RIGHTMOST(rpageop));
+
+	elog(DEBUG1, "finishing incomplete split of %u/%u",
+		 BufferGetBlockNumber(lbuf), BufferGetBlockNumber(rbuf));
+
+	_bt_insert_parent(rel, lbuf, rbuf, stack, was_root, was_only);
+}
+
+/*
  *	_bt_getstackbuf() -- Walk back up the tree one step, and find the item
  *						 we last looked at in the parent.
  *
@@ -1738,6 +1875,12 @@ _bt_getstackbuf(Relation rel, BTStack stack, int access)
 		page = BufferGetPage(buf);
 		opaque = (BTPageOpaque) PageGetSpecialPointer(page);
 
+		if (access == BT_WRITE && P_INCOMPLETE_SPLIT(opaque))
+		{
+			_bt_finish_split(rel, buf, stack->bts_parent);
+			continue;
+		}
+
 		if (!P_IGNORE(opaque))
 		{
 			OffsetNumber offnum,
@@ -1842,6 +1985,7 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 				rbkno;
 	BlockNumber rootblknum;
 	BTPageOpaque rootopaque;
+	BTPageOpaque lopaque;
 	ItemId		itemid;
 	IndexTuple	item;
 	Size		itemsz;
@@ -1853,6 +1997,7 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 	lbkno = BufferGetBlockNumber(lbuf);
 	rbkno = BufferGetBlockNumber(rbuf);
 	lpage = BufferGetPage(lbuf);
+	lopaque = (BTPageOpaque) PageGetSpecialPointer(lpage);
 
 	/* get a new root page */
 	rootbuf = _bt_getbuf(rel, P_NEW, BT_WRITE);
@@ -1926,6 +2071,11 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 			 BufferGetBlockNumber(lbuf), RelationGetRelationName(rel));
 	pfree(new_item);
 
+	/* Clear the incomplete-split flag in the left child */
+	Assert(P_INCOMPLETE_SPLIT(lopaque));
+	lopaque->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+	MarkBufferDirty(lbuf);
+
 	MarkBufferDirty(rootbuf);
 	MarkBufferDirty(metabuf);
 
@@ -1934,7 +2084,7 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 	{
 		xl_btree_newroot xlrec;
 		XLogRecPtr	recptr;
-		XLogRecData rdata[2];
+		XLogRecData rdata[3];
 
 		xlrec.node = rel->rd_node;
 		xlrec.rootblk = rootblknum;
@@ -1953,7 +2103,13 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 		rdata[1].len = ((PageHeader) rootpage)->pd_special -
 			((PageHeader) rootpage)->pd_upper;
 		rdata[1].buffer = InvalidBuffer;
-		rdata[1].next = NULL;
+		rdata[1].next = &(rdata[2]);
+
+		/* Make a full-page image of the left child if needed */
+		rdata[2].data = NULL;
+		rdata[2].len = 0;
+		rdata[2].buffer = lbuf;
+		rdata[2].next = NULL;
 
 		recptr = XLogInsert(RM_BTREE_ID, XLOG_BTREE_NEWROOT, rdata);
 
diff --git a/src/backend/access/nbtree/nbtpage.c b/src/backend/access/nbtree/nbtpage.c
index 7ccbfd3..6bf1341 100644
--- a/src/backend/access/nbtree/nbtpage.c
+++ b/src/backend/access/nbtree/nbtpage.c
@@ -1026,8 +1026,13 @@ _bt_lock_branch_parent(Relation rel, BlockNumber child, BTStack stack,
 			 * It's only child, so safe if parent would itself be removable.
 			 * We have to check the parent itself, and then recurse to test
 			 * the conditions at the parent's parent.
+			 *
+			 * Also check that the page, or its left sibling, isn't
+			 * incompletely split.  These are the same checks that we already
+			 * did for the leaf page, see comments in _bt_mark_page_hlfdead().
 			 */
-			if (P_RIGHTMOST(opaque) || P_ISROOT(opaque))
+			if (P_RIGHTMOST(opaque) || P_ISROOT(opaque) ||
+				P_INCOMPLETE_SPLIT(opaque))
 			{
 				_bt_relbuf(rel, pbuf);
 				return false;
@@ -1128,7 +1133,8 @@ _bt_pagedel(Relation rel, Buffer buf)
 		 * check that page is not already deleted and is empty.
 		 */
 		if (P_RIGHTMOST(opaque) || P_ISROOT(opaque) || P_ISDELETED(opaque) ||
-			P_FIRSTDATAKEY(opaque) <= PageGetMaxOffsetNumber(page))
+			P_FIRSTDATAKEY(opaque) <= PageGetMaxOffsetNumber(page) ||
+			P_INCOMPLETE_SPLIT(opaque))
 		{
 			/* Should never fail to delete a half-dead page */
 			Assert(!P_ISHALFDEAD(opaque));
diff --git a/src/backend/access/nbtree/nbtsearch.c b/src/backend/access/nbtree/nbtsearch.c
index bc62fbc..d4220d9 100644
--- a/src/backend/access/nbtree/nbtsearch.c
+++ b/src/backend/access/nbtree/nbtsearch.c
@@ -51,7 +51,9 @@ static bool _bt_endpoint(IndexScanDesc scan, ScanDirection dir);
  * NOTE that the returned buffer is read-locked regardless of the access
  * parameter.  However, access = BT_WRITE will allow an empty root page
  * to be created and returned.	When access = BT_READ, an empty index
- * will result in *bufP being set to InvalidBuffer.
+ * will result in *bufP being set to InvalidBuffer.  Also, in BT_WRITE mode,
+ * any incomplete splits or half-dead pages encountered during the search
+ * will be finished.
  */
 BTStack
 _bt_search(Relation rel, int keysz, ScanKey scankey, bool nextkey,
@@ -82,8 +84,13 @@ _bt_search(Relation rel, int keysz, ScanKey scankey, bool nextkey,
 		 * Race -- the page we just grabbed may have split since we read its
 		 * pointer in the parent (or metapage).  If it has, we may need to
 		 * move right to its new sibling.  Do that.
+		 *
+		 * In write-mode, allow _bt_moveright to finish any incomplete splits
+		 * along the way.
 		 */
-		*bufP = _bt_moveright(rel, *bufP, keysz, scankey, nextkey, BT_READ);
+		*bufP = _bt_moveright(rel, *bufP, keysz, scankey, nextkey,
+							  (access == BT_WRITE), stack_in,
+							  BT_READ);
 
 		/* if this is a leaf page, we're done */
 		page = BufferGetPage(*bufP);
@@ -148,6 +155,11 @@ _bt_search(Relation rel, int keysz, ScanKey scankey, bool nextkey,
  * item >= scankey.  When nextkey is true, we are looking for the first
  * item strictly greater than scankey.
  *
+ * If forupdate is true, we will attempt to finish any incomplete splits
+ * that we encounter. This is required when searching for a target page for
+ * an insertion, because we don't allow inserting on a page with incomplete
+ * actions. 'stack' is only used if forupdate is true.
+ *
  * On entry, we have the buffer pinned and a lock of the type specified by
  * 'access'.  If we move right, we release the buffer and lock and acquire
  * the same on the right sibling.  Return value is the buffer we stop at.
@@ -158,15 +170,14 @@ _bt_moveright(Relation rel,
 			  int keysz,
 			  ScanKey scankey,
 			  bool nextkey,
+			  bool forupdate,
+			  BTStack stack,
 			  int access)
 {
 	Page		page;
 	BTPageOpaque opaque;
 	int32		cmpval;
 
-	page = BufferGetPage(buf);
-	opaque = (BTPageOpaque) PageGetSpecialPointer(page);
-
 	/*
 	 * When nextkey = false (normal case): if the scan key that brought us to
 	 * this page is > the high key stored on the page, then the page has split
@@ -184,16 +195,48 @@ _bt_moveright(Relation rel,
 	 */
 	cmpval = nextkey ? 0 : 1;
 
-	while (!P_RIGHTMOST(opaque) &&
-		   (P_IGNORE(opaque) ||
-			_bt_compare(rel, keysz, scankey, page, P_HIKEY) >= cmpval))
+	for (;;)
 	{
-		/* step right one page */
-		BlockNumber rblkno = opaque->btpo_next;
-
-		buf = _bt_relandgetbuf(rel, buf, rblkno, access);
 		page = BufferGetPage(buf);
 		opaque = (BTPageOpaque) PageGetSpecialPointer(page);
+
+		if (P_RIGHTMOST(opaque))
+			break;
+
+		/*
+		 * Finish any incomplete splits we encounter along the way.
+		 */
+		if (forupdate && P_INCOMPLETE_SPLIT(opaque))
+		{
+			BlockNumber blkno = BufferGetBlockNumber(buf);
+
+			if (access == BT_READ)
+			{
+				/* upgrade the lock, and re-check */
+				LockBuffer(buf, BUFFER_LOCK_UNLOCK);
+				LockBuffer(buf, BT_WRITE);
+				if (P_INCOMPLETE_SPLIT(opaque))
+				{
+					_bt_finish_split(rel, buf, stack);
+					_bt_getbuf(rel, blkno, access);
+				}
+			}
+			else
+			{
+				_bt_finish_split(rel, buf, stack);
+				_bt_getbuf(rel, blkno, access);
+			}
+			continue;
+		}
+
+		if (P_IGNORE(opaque) || _bt_compare(rel, keysz, scankey, page, P_HIKEY) >= cmpval)
+		{
+			/* step right one page */
+			buf = _bt_relandgetbuf(rel, buf, opaque->btpo_next, access);
+			continue;
+		}
+		else
+			break;
 	}
 
 	if (P_IGNORE(opaque))
diff --git a/src/backend/access/nbtree/nbtxlog.c b/src/backend/access/nbtree/nbtxlog.c
index e7317c4..8409bad 100644
--- a/src/backend/access/nbtree/nbtxlog.c
+++ b/src/backend/access/nbtree/nbtxlog.c
@@ -21,61 +21,6 @@
 #include "miscadmin.h"
 
 /*
- * We must keep track of expected insertions due to page splits, and apply
- * them manually if they are not seen in the WAL log during replay.  This
- * makes it safe for page insertion to be a multiple-WAL-action process.
- *
- * The data structure is a simple linked list --- this should be good enough,
- * since we don't expect a page split to remain incomplete for long.  In any
- * case we need to respect the order of operations.
- */
-typedef struct bt_incomplete_split
-{
-	RelFileNode node;			/* the index */
-	bool		is_root;		/* we split the root */
-	BlockNumber leftblk;		/* left half of split */
-	BlockNumber rightblk;		/* right half of split */
-} bt_incomplete_split;
-
-static List *incomplete_splits;
-
-
-static void
-log_incomplete_split(RelFileNode node, BlockNumber leftblk,
-					 BlockNumber rightblk, bool is_root)
-{
-	bt_incomplete_split *action = palloc(sizeof(bt_incomplete_split));
-
-	action->node = node;
-	action->is_root = is_root;
-	action->leftblk = leftblk;
-	action->rightblk = rightblk;
-	incomplete_splits = lappend(incomplete_splits, action);
-}
-
-static void
-forget_matching_split(RelFileNode node, BlockNumber downlink, bool is_root)
-{
-	ListCell   *l;
-
-	foreach(l, incomplete_splits)
-	{
-		bt_incomplete_split *action = (bt_incomplete_split *) lfirst(l);
-
-		if (RelFileNodeEquals(node, action->node) &&
-			downlink == action->rightblk)
-		{
-			if (is_root != action->is_root)
-				elog(LOG, "forget_matching_split: fishy is_root data (expected %d, got %d)",
-					 action->is_root, is_root);
-			incomplete_splits = list_delete_ptr(incomplete_splits, action);
-			pfree(action);
-			break;				/* need not look further */
-		}
-	}
-}
-
-/*
  * _bt_restore_page -- re-enter all the index tuples on a page
  *
  * The page is freshly init'd, and *from (length len) is a copy of what
@@ -149,23 +94,60 @@ _bt_restore_meta(RelFileNode rnode, XLogRecPtr lsn,
 	UnlockReleaseBuffer(metabuf);
 }
 
+/*
+ * _bt_clear_incomplete_split -- clear INCOMPLETE_SPLIT flag on a page
+ *
+ * This is a common subroutine of the redo functions of all the WAL record
+ * types that can insert a downlink: insert, split, and newroot.
+ */
+static void
+_bt_clear_incomplete_split(XLogRecPtr lsn, XLogRecord *record,
+						   RelFileNode rnode, BlockNumber cblock)
+{
+	Buffer buf;
+
+	buf = XLogReadBuffer(rnode, cblock, false);
+	if (BufferIsValid(buf))
+	{
+		Page		page = (Page) BufferGetPage(buf);
+
+		if (lsn > PageGetLSN(page))
+		{
+			BTPageOpaque pageop = (BTPageOpaque) PageGetSpecialPointer(page);
+			Assert((pageop->btpo_flags & BTP_INCOMPLETE_SPLIT) != 0);
+			pageop->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+
+			PageSetLSN(page, lsn);
+			MarkBufferDirty(buf);
+		}
+		UnlockReleaseBuffer(buf);
+	}
+}
+
 static void
 btree_xlog_insert(bool isleaf, bool ismeta,
 				  XLogRecPtr lsn, XLogRecord *record)
 {
 	xl_btree_insert *xlrec = (xl_btree_insert *) XLogRecGetData(record);
 	Buffer		buffer;
+	Buffer		cbuffer = InvalidBuffer;
 	Page		page;
 	char	   *datapos;
 	int			datalen;
 	xl_btree_metadata md;
-	BlockNumber downlink = 0;
+	BlockNumber cblkno = 0;
+	int			main_blk_index;
 
 	datapos = (char *) xlrec + SizeOfBtreeInsert;
 	datalen = record->xl_len - SizeOfBtreeInsert;
-	if (!isleaf)
+	/*
+	 * if this insert finishes a split at lower level, extract the block
+	 * number of the (left) child.
+	 */
+	if (!isleaf && (record->xl_info & XLR_BKP_BLOCK(0)) == 0)
 	{
-		memcpy(&downlink, datapos, sizeof(BlockNumber));
+		memcpy(&cblkno, datapos, sizeof(BlockNumber));
+		Assert(cblkno != 0);
 		datapos += sizeof(BlockNumber);
 		datalen -= sizeof(BlockNumber);
 	}
@@ -176,8 +158,19 @@ btree_xlog_insert(bool isleaf, bool ismeta,
 		datalen -= sizeof(xl_btree_metadata);
 	}
 
-	if (record->xl_info & XLR_BKP_BLOCK(0))
-		(void) RestoreBackupBlock(lsn, record, 0, false, false);
+	if (!isleaf)
+	{
+		if (record->xl_info & XLR_BKP_BLOCK(0))
+			(void) RestoreBackupBlock(lsn, record, 0, false, false);
+		else
+			_bt_clear_incomplete_split(lsn, record, xlrec->target.node, cblkno);
+		main_blk_index = 1;
+	}
+	else
+		main_blk_index = 0;
+
+	if (record->xl_info & XLR_BKP_BLOCK(main_blk_index))
+		(void) RestoreBackupBlock(lsn, record, main_blk_index, false, false);
 	else
 	{
 		buffer = XLogReadBuffer(xlrec->target.node,
@@ -187,11 +180,7 @@ btree_xlog_insert(bool isleaf, bool ismeta,
 		{
 			page = (Page) BufferGetPage(buffer);
 
-			if (lsn <= PageGetLSN(page))
-			{
-				UnlockReleaseBuffer(buffer);
-			}
-			else
+			if (lsn > PageGetLSN(page))
 			{
 				if (PageAddItem(page, (Item) datapos, datalen,
 							ItemPointerGetOffsetNumber(&(xlrec->target.tid)),
@@ -200,11 +189,14 @@ btree_xlog_insert(bool isleaf, bool ismeta,
 
 				PageSetLSN(page, lsn);
 				MarkBufferDirty(buffer);
-				UnlockReleaseBuffer(buffer);
 			}
+			UnlockReleaseBuffer(buffer);
 		}
 	}
 
+	if (BufferIsValid(cbuffer))
+		UnlockReleaseBuffer(cbuffer);
+
 	/*
 	 * Note: in normal operation, we'd update the metapage while still holding
 	 * lock on the page we inserted into.  But during replay it's not
@@ -216,10 +208,6 @@ btree_xlog_insert(bool isleaf, bool ismeta,
 		_bt_restore_meta(xlrec->target.node, lsn,
 						 md.root, md.level,
 						 md.fastroot, md.fastlevel);
-
-	/* Forget any split this insertion completes */
-	if (!isleaf)
-		forget_matching_split(xlrec->target.node, downlink, false);
 }
 
 static void
@@ -227,6 +215,8 @@ btree_xlog_split(bool onleft, bool isroot,
 				 XLogRecPtr lsn, XLogRecord *record)
 {
 	xl_btree_split *xlrec = (xl_btree_split *) XLogRecGetData(record);
+	bool		isleaf = (xlrec->level == 0);
+	Buffer		lbuf;
 	Buffer		rbuf;
 	Page		rpage;
 	BTPageOpaque ropaque;
@@ -237,42 +227,18 @@ btree_xlog_split(bool onleft, bool isroot,
 	Size		newitemsz = 0;
 	Item		left_hikey = NULL;
 	Size		left_hikeysz = 0;
+	BlockNumber cblkno = InvalidBlockNumber;
 
 	datapos = (char *) xlrec + SizeOfBtreeSplit;
 	datalen = record->xl_len - SizeOfBtreeSplit;
 
-	/* Forget any split this insertion completes */
-	if (xlrec->level > 0)
-	{
-		/* we assume SizeOfBtreeSplit is at least 16-bit aligned */
-		BlockNumber downlink = BlockIdGetBlockNumber((BlockId) datapos);
-
-		datapos += sizeof(BlockIdData);
-		datalen -= sizeof(BlockIdData);
-
-		forget_matching_split(xlrec->node, downlink, false);
-
-		/* Extract left hikey and its size (still assuming 16-bit alignment) */
-		if (!(record->xl_info & XLR_BKP_BLOCK(0)))
-		{
-			/* We assume 16-bit alignment is enough for IndexTupleSize */
-			left_hikey = (Item) datapos;
-			left_hikeysz = MAXALIGN(IndexTupleSize(left_hikey));
-
-			datapos += left_hikeysz;
-			datalen -= left_hikeysz;
-		}
-	}
-
-	/* Extract newitem and newitemoff, if present */
+	/* Extract newitemoff and newitem, if present */
 	if (onleft)
 	{
-		/* Extract the offset (still assuming 16-bit alignment) */
 		memcpy(&newitemoff, datapos, sizeof(OffsetNumber));
 		datapos += sizeof(OffsetNumber);
 		datalen -= sizeof(OffsetNumber);
 	}
-
 	if (onleft && !(record->xl_info & XLR_BKP_BLOCK(0)))
 	{
 		/*
@@ -286,6 +252,37 @@ btree_xlog_split(bool onleft, bool isroot,
 		datalen -= newitemsz;
 	}
 
+	/* Extract left hikey and its size (still assuming 16-bit alignment) */
+	if (!isleaf && !(record->xl_info & XLR_BKP_BLOCK(0)))
+	{
+		left_hikey = (Item) datapos;
+		left_hikeysz = MAXALIGN(IndexTupleSize(left_hikey));
+		datapos += left_hikeysz;
+		datalen -= left_hikeysz;
+	}
+	/*
+	 * If this insertion finishes an incomplete split, get the block number
+	 * of the child.
+	 */
+	if (!isleaf && !(record->xl_info & XLR_BKP_BLOCK(1)))
+	{
+		memcpy(&cblkno, datapos, sizeof(BlockNumber));
+		datapos += sizeof(BlockNumber);
+		datalen -= sizeof(BlockNumber);
+	}
+
+	/*
+	 * Clear the incomplete split flag on the left sibling of the child page
+	 * this is a downlink for.
+	 */
+	if (!isleaf)
+	{
+		if (record->xl_info & XLR_BKP_BLOCK(2))
+			(void) RestoreBackupBlock(lsn, record, 2, false, false);
+		else
+			_bt_clear_incomplete_split(lsn, record, xlrec->node, cblkno);
+	}
+
 	/* Reconstruct right (new) sibling page from scratch */
 	rbuf = XLogReadBuffer(xlrec->node, xlrec->rightsib, true);
 	Assert(BufferIsValid(rbuf));
@@ -297,7 +294,7 @@ btree_xlog_split(bool onleft, bool isroot,
 	ropaque->btpo_prev = xlrec->leftsib;
 	ropaque->btpo_next = xlrec->rnext;
 	ropaque->btpo.level = xlrec->level;
-	ropaque->btpo_flags = (xlrec->level == 0) ? BTP_LEAF : 0;
+	ropaque->btpo_flags = isleaf ? BTP_LEAF : 0;
 	ropaque->btpo_cycleid = 0;
 
 	_bt_restore_page(rpage, datapos, datalen);
@@ -306,7 +303,7 @@ btree_xlog_split(bool onleft, bool isroot,
 	 * On leaf level, the high key of the left page is equal to the first key
 	 * on the right page.
 	 */
-	if (xlrec->level == 0)
+	if (isleaf)
 	{
 		ItemId		hiItemId = PageGetItemId(rpage, P_FIRSTDATAKEY(ropaque));
 
@@ -321,10 +318,10 @@ btree_xlog_split(bool onleft, bool isroot,
 
 	/* Now reconstruct left (original) sibling page */
 	if (record->xl_info & XLR_BKP_BLOCK(0))
-		(void) RestoreBackupBlock(lsn, record, 0, false, false);
+		lbuf = RestoreBackupBlock(lsn, record, 0, false, true);
 	else
 	{
-		Buffer		lbuf = XLogReadBuffer(xlrec->node, xlrec->leftsib, false);
+		lbuf = XLogReadBuffer(xlrec->node, xlrec->leftsib, false);
 
 		if (BufferIsValid(lbuf))
 		{
@@ -381,19 +378,21 @@ btree_xlog_split(bool onleft, bool isroot,
 					elog(PANIC, "failed to add high key to left page after split");
 
 				/* Fix opaque fields */
-				lopaque->btpo_flags = (xlrec->level == 0) ? BTP_LEAF : 0;
+				lopaque->btpo_flags = BTP_INCOMPLETE_SPLIT;
+				if (isleaf)
+					lopaque->btpo_flags |= BTP_LEAF;
 				lopaque->btpo_next = xlrec->rightsib;
 				lopaque->btpo_cycleid = 0;
 
 				PageSetLSN(lpage, lsn);
 				MarkBufferDirty(lbuf);
 			}
-
-			UnlockReleaseBuffer(lbuf);
 		}
 	}
 
-	/* We no longer need the right buffer */
+	/* We no longer need the buffers */
+	if (BufferIsValid(lbuf))
+		UnlockReleaseBuffer(lbuf);
 	UnlockReleaseBuffer(rbuf);
 
 	/*
@@ -404,32 +403,39 @@ btree_xlog_split(bool onleft, bool isroot,
 	 * replay, because no other index update can be in progress, and readers
 	 * will cope properly when following an obsolete left-link.
 	 */
-	if (record->xl_info & XLR_BKP_BLOCK(1))
-		(void) RestoreBackupBlock(lsn, record, 1, false, false);
-	else if (xlrec->rnext != P_NONE)
+	if (xlrec->rnext != P_NONE)
 	{
-		Buffer		buffer = XLogReadBuffer(xlrec->node, xlrec->rnext, false);
+		/*
+		 * the backup block containing right sibling is 2 or 3, depending
+		 * whether this was a leaf or internal page.
+		 */
+		int		rnext_index = isleaf ? 2 : 3;
 
-		if (BufferIsValid(buffer))
+		if (record->xl_info & XLR_BKP_BLOCK(rnext_index))
+			(void) RestoreBackupBlock(lsn, record, rnext_index, false, false);
+		else
 		{
-			Page		page = (Page) BufferGetPage(buffer);
+			Buffer		buffer;
 
-			if (lsn > PageGetLSN(page))
+			buffer = XLogReadBuffer(xlrec->node, xlrec->rnext, false);
+
+			if (BufferIsValid(buffer))
 			{
-				BTPageOpaque pageop = (BTPageOpaque) PageGetSpecialPointer(page);
+				Page		page = (Page) BufferGetPage(buffer);
 
-				pageop->btpo_prev = xlrec->rightsib;
+				if (lsn > PageGetLSN(page))
+				{
+					BTPageOpaque pageop = (BTPageOpaque) PageGetSpecialPointer(page);
 
-				PageSetLSN(page, lsn);
-				MarkBufferDirty(buffer);
+					pageop->btpo_prev = xlrec->rightsib;
+
+					PageSetLSN(page, lsn);
+					MarkBufferDirty(buffer);
+				}
+				UnlockReleaseBuffer(buffer);
 			}
-			UnlockReleaseBuffer(buffer);
 		}
 	}
-
-	/* The job ain't done till the parent link is inserted... */
-	log_incomplete_split(xlrec->node,
-						 xlrec->leftsib, xlrec->rightsib, isroot);
 }
 
 static void
@@ -992,10 +998,7 @@ btree_xlog_newroot(XLogRecPtr lsn, XLogRecord *record)
 	Buffer		buffer;
 	Page		page;
 	BTPageOpaque pageop;
-	BlockNumber downlink = 0;
-
-	/* Backup blocks are not used in newroot records */
-	Assert(!(record->xl_info & XLR_BKP_BLOCK_MASK));
+	BlockNumber cblkno;
 
 	buffer = XLogReadBuffer(xlrec->node, xlrec->rootblk, true);
 	Assert(BufferIsValid(buffer));
@@ -1018,10 +1021,16 @@ btree_xlog_newroot(XLogRecPtr lsn, XLogRecord *record)
 		_bt_restore_page(page,
 						 (char *) xlrec + SizeOfBtreeNewroot,
 						 record->xl_len - SizeOfBtreeNewroot);
-		/* extract downlink to the right-hand split page */
-		itup = (IndexTuple) PageGetItem(page, PageGetItemId(page, P_FIRSTKEY));
-		downlink = ItemPointerGetBlockNumber(&(itup->t_tid));
+		/* extract block number of the left-hand split page */
+		itup = (IndexTuple) PageGetItem(page, PageGetItemId(page, P_HIKEY));
+		cblkno = ItemPointerGetBlockNumber(&(itup->t_tid));
 		Assert(ItemPointerGetOffsetNumber(&(itup->t_tid)) == P_HIKEY);
+
+		/* Clear the incomplete-split flag in left child */
+		if (record->xl_info & XLR_BKP_BLOCK(0))
+			(void) RestoreBackupBlock(lsn, record, 0, false, false);
+		else
+			_bt_clear_incomplete_split(lsn, record, xlrec->node, cblkno);
 	}
 
 	PageSetLSN(page, lsn);
@@ -1031,10 +1040,6 @@ btree_xlog_newroot(XLogRecPtr lsn, XLogRecord *record)
 	_bt_restore_meta(xlrec->node, lsn,
 					 xlrec->rootblk, xlrec->level,
 					 xlrec->rootblk, xlrec->level);
-
-	/* Check to see if this satisfies any incomplete insertions */
-	if (record->xl_len > SizeOfBtreeNewroot)
-		forget_matching_split(xlrec->node, downlink, true);
 }
 
 static void
@@ -1114,59 +1119,3 @@ btree_redo(XLogRecPtr lsn, XLogRecord *record)
 			elog(PANIC, "btree_redo: unknown op code %u", info);
 	}
 }
-
-void
-btree_xlog_startup(void)
-{
-	incomplete_splits = NIL;
-}
-
-void
-btree_xlog_cleanup(void)
-{
-	ListCell   *l;
-
-	foreach(l, incomplete_splits)
-	{
-		/* finish an incomplete split */
-		bt_incomplete_split *action = (bt_incomplete_split *) lfirst(l);
-		Buffer		lbuf,
-					rbuf;
-		Page		lpage,
-					rpage;
-		BTPageOpaque lpageop,
-					rpageop;
-		bool		is_only;
-		Relation	reln;
-
-		lbuf = XLogReadBuffer(action->node, action->leftblk, false);
-		/* failure is impossible because we wrote this page earlier */
-		if (!BufferIsValid(lbuf))
-			elog(PANIC, "btree_xlog_cleanup: left block unfound");
-		lpage = (Page) BufferGetPage(lbuf);
-		lpageop = (BTPageOpaque) PageGetSpecialPointer(lpage);
-		rbuf = XLogReadBuffer(action->node, action->rightblk, false);
-		/* failure is impossible because we wrote this page earlier */
-		if (!BufferIsValid(rbuf))
-			elog(PANIC, "btree_xlog_cleanup: right block unfound");
-		rpage = (Page) BufferGetPage(rbuf);
-		rpageop = (BTPageOpaque) PageGetSpecialPointer(rpage);
-
-		/* if the pages are all of their level, it's a only-page split */
-		is_only = P_LEFTMOST(lpageop) && P_RIGHTMOST(rpageop);
-
-		reln = CreateFakeRelcacheEntry(action->node);
-		_bt_insert_parent(reln, lbuf, rbuf, NULL,
-						  action->is_root, is_only);
-		FreeFakeRelcacheEntry(reln);
-	}
-	incomplete_splits = NIL;
-}
-
-bool
-btree_safe_restartpoint(void)
-{
-	if (incomplete_splits)
-		return false;
-	return true;
-}
diff --git a/src/include/access/nbtree.h b/src/include/access/nbtree.h
index a1fb948..f974ea2 100644
--- a/src/include/access/nbtree.h
+++ b/src/include/access/nbtree.h
@@ -73,6 +73,7 @@ typedef BTPageOpaqueData *BTPageOpaque;
 #define BTP_HALF_DEAD	(1 << 4)	/* empty, but still in tree */
 #define BTP_SPLIT_END	(1 << 5)	/* rightmost page of split group */
 #define BTP_HAS_GARBAGE (1 << 6)	/* page has LP_DEAD tuples */
+#define BTP_INCOMPLETE_SPLIT (1 << 7) /* right sibling's downlink is missing */
 
 /*
  * The max allowed value of a cycle ID is a bit less than 64K.	This is
@@ -178,6 +179,7 @@ typedef struct BTMetaPageData
 #define P_ISHALFDEAD(opaque)	((opaque)->btpo_flags & BTP_HALF_DEAD)
 #define P_IGNORE(opaque)		((opaque)->btpo_flags & (BTP_DELETED|BTP_HALF_DEAD))
 #define P_HAS_GARBAGE(opaque)	((opaque)->btpo_flags & BTP_HAS_GARBAGE)
+#define P_INCOMPLETE_SPLIT(opaque)	((opaque)->btpo_flags & BTP_INCOMPLETE_SPLIT)
 
 /*
  *	Lehman and Yao's algorithm requires a ``high key'' on every non-rightmost
@@ -253,7 +255,7 @@ typedef struct xl_btree_metadata
 typedef struct xl_btree_insert
 {
 	xl_btreetid target;			/* inserted tuple id */
-	/* BlockNumber downlink field FOLLOWS IF NOT XLOG_BTREE_INSERT_LEAF */
+	/* BlockNumber finishes_split field FOLLOWS IF NOT XLOG_BTREE_INSERT_LEAF */
 	/* xl_btree_metadata FOLLOWS IF XLOG_BTREE_INSERT_META */
 	/* INDEX TUPLE FOLLOWS AT END OF STRUCT */
 } xl_btree_insert;
@@ -286,19 +288,18 @@ typedef struct xl_btree_split
 	OffsetNumber firstright;	/* first item moved to right page */
 
 	/*
-	 * If level > 0, BlockIdData downlink follows.	(We use BlockIdData rather
-	 * than BlockNumber for alignment reasons: SizeOfBtreeSplit is only 16-bit
-	 * aligned.)
+	 * In the _L variants, next are OffsetNumber newitemoff and the new item.
+	 * (In the _R variants, the new item is one of the right page's tuples.)
+	 * The new item, but not newitemoff, is suppressed if XLogInsert chooses
+	 * to store the left page's whole page image.
 	 *
 	 * If level > 0, an IndexTuple representing the HIKEY of the left page
 	 * follows.  We don't need this on leaf pages, because it's the same as
 	 * the leftmost key in the new right page.	Also, it's suppressed if
 	 * XLogInsert chooses to store the left page's whole page image.
 	 *
-	 * In the _L variants, next are OffsetNumber newitemoff and the new item.
-	 * (In the _R variants, the new item is one of the right page's tuples.)
-	 * The new item, but not newitemoff, is suppressed if XLogInsert chooses
-	 * to store the left page's whole page image.
+	 * If level > 0, BlockNumber of the page whose incomplete-split flag
+	 * this insertion clears. (not aligned)
 	 *
 	 * Last are the right page's tuples in the form used by _bt_restore_page.
 	 */
@@ -642,8 +643,7 @@ extern Datum btoptions(PG_FUNCTION_ARGS);
 extern bool _bt_doinsert(Relation rel, IndexTuple itup,
 			 IndexUniqueCheck checkUnique, Relation heapRel);
 extern Buffer _bt_getstackbuf(Relation rel, BTStack stack, int access);
-extern void _bt_insert_parent(Relation rel, Buffer buf, Buffer rbuf,
-				  BTStack stack, bool is_root, bool is_only);
+extern void _bt_finish_split(Relation rel, Buffer bbuf, BTStack stack);
 
 /*
  * prototypes for functions in nbtpage.c
@@ -673,7 +673,8 @@ extern BTStack _bt_search(Relation rel,
 		   int keysz, ScanKey scankey, bool nextkey,
 		   Buffer *bufP, int access);
 extern Buffer _bt_moveright(Relation rel, Buffer buf, int keysz,
-			  ScanKey scankey, bool nextkey, int access);
+			  ScanKey scankey, bool nextkey,
+			  bool finishsplits, BTStack stack,  int access);
 extern OffsetNumber _bt_binsrch(Relation rel, Buffer buf, int keysz,
 			ScanKey scankey, bool nextkey);
 extern int32 _bt_compare(Relation rel, int keysz, ScanKey scankey,
@@ -722,8 +723,5 @@ extern void _bt_leafbuild(BTSpool *btspool, BTSpool *spool2);
  */
 extern void btree_redo(XLogRecPtr lsn, XLogRecord *record);
 extern void btree_desc(StringInfo buf, uint8 xl_info, char *rec);
-extern void btree_xlog_startup(void);
-extern void btree_xlog_cleanup(void);
-extern bool btree_safe_restartpoint(void);
 
 #endif   /* NBTREE_H */
diff --git a/src/include/access/rmgrlist.h b/src/include/access/rmgrlist.h
index c968101..d9ee57d 100644
--- a/src/include/access/rmgrlist.h
+++ b/src/include/access/rmgrlist.h
@@ -36,7 +36,7 @@ PG_RMGR(RM_RELMAP_ID, "RelMap", relmap_redo, relmap_desc, NULL, NULL, NULL)
 PG_RMGR(RM_STANDBY_ID, "Standby", standby_redo, standby_desc, NULL, NULL, NULL)
 PG_RMGR(RM_HEAP2_ID, "Heap2", heap2_redo, heap2_desc, NULL, NULL, NULL)
 PG_RMGR(RM_HEAP_ID, "Heap", heap_redo, heap_desc, NULL, NULL, NULL)
-PG_RMGR(RM_BTREE_ID, "Btree", btree_redo, btree_desc, btree_xlog_startup, btree_xlog_cleanup, btree_safe_restartpoint)
+PG_RMGR(RM_BTREE_ID, "Btree", btree_redo, btree_desc, NULL, NULL, NULL)
 PG_RMGR(RM_HASH_ID, "Hash", hash_redo, hash_desc, NULL, NULL, NULL)
 PG_RMGR(RM_GIN_ID, "Gin", gin_redo, gin_desc, gin_xlog_startup, gin_xlog_cleanup, NULL)
 PG_RMGR(RM_GIST_ID, "Gist", gist_redo, gist_desc, gist_xlog_startup, gist_xlog_cleanup, NULL)

btree-graphviz2.sql0000644000175000017500000000620612271523543014114 0ustar  heikkiheikkiCREATE OR REPLACE FUNCTION hex_to_int(hexval varchar) RETURNS integer AS $$
DECLARE
    result  int;
BEGIN
    EXECUTE 'SELECT x''' || hexval || '''::int' INTO result;
    RETURN result;
END;
$$ LANGUAGE 'plpgsql' IMMUTABLE STRICT;

create or replace function parsekey(data text) returns integer as $$
declare
  i int4;
  hitext text;
  hiint int4;
begin
    hitext := replace(data, ' ', '');
    hiint := 0;
    for i in 1..8 loop
      hiint := hiint * 256 + hex_to_int(right(hitext,2));
      hitext := left(hitext, -2);
    end loop;
    return hiint;
end;
$$ language plpgsql immutable strict;

create or replace function parsetid(tid) returns text as $$
  select (regexp_matches($1::text, '\((\d+),\d+\)'::text))[1];
$$ language sql immutable strict;

create or replace function getgraph(idxname text) returns text as $$
declare
  nblocks bigint;
  blkno bigint;
  i bigint;
  t text;
  downlink text;
  label text;
  statsr record;
  r record;
  hitext text;
  hiint int4;
  firstdatakey int4;
  rightlink int4;
begin
  nblocks = pg_relation_size(idxname) / 8192;

  t := E'digraph g {\n';
  t := t || E' node [shape = record,height=.1];\n  ratio="auto"\n';
  for blkno in 1..(nblocks-1) loop
    select  * into statsr from bt_page_stats(idxname, blkno::int4);

    -- ignore deleted pages
    continue when statsr.type = 'd';

    -- extract hikey
    if statsr.btpo_next <> 0 then
      select data into hitext from bt_page_items(idxname, blkno::int4) where itemoffset = 1;
      --hiint := parsekey(hitext);
      firstdatakey := 2;
    else
      -- rightmost
      hitext := '';
      firstdatakey := 1;
    end if;

    hitext = left(hitext, 20);

    -- print right-link
    if statsr.btpo_next <> 0 then
      t := t || format(E'  \"node%s\" -> \"node%s\" [constraint=false];\n', blkno, statsr.btpo_next);
    end if;

    label := '';
    if statsr.type = 'l' then
      label := 'LEAF|&lt;' || hitext;
    end if;
    if statsr.type = 'i' OR statsr.type = 'r' OR statsr.type = 'e' then
      i := 0;
      -- print downlinks
      for r in select * from bt_page_items(idxname, blkno) where itemoffset >= firstdatakey loop

        label := label || left(r.data, 20) || '|';

	downlink := parsetid(r.ctid);

        t := t || format(E'  \"node%s\":f%s -> \"node%s\":f0 [style=bold];\n', blkno, i, downlink);
        i := i + 1;
      end loop;
      label := label || '&lt;' || hiint;
    end if;

    if statsr.type = 'r' then
      label := label || ' (ROOT)';
    end if;
    if (statsr.btpo_flags & 16) <> 0 then
      label := label || ' (HALF_DEAD)';

      -- "uplink" to the top of the deleted branch
      downlink = parsetid((select ctid from bt_page_items(idxname, blkno::int4) where itemoffset = 1));
      if downlink <> '4294967295' then
        t := t || format(E'  \"node%s\" -> \"node%s\" [style=dotted];\n', blkno, downlink);
      end if;
 
    end if;

    t := t || format(E' node%s[label = "%s|%s"];\n', blkno, blkno, label);

  end loop;

  t := t || E'}\n';
  return t;
end;
$$ language plpgsql;

/*

\o ~/a.dot
\t on
\pset format unaligned
\pset border 0
select getgraph('i_foo');

\! sed -i 's/+//g' ~/a.dot
\! dot -Tpng -o /tmp/a.png ~/a.dot
\! eog /tmp/a.png

*/pageinspect-no-locking.patch0000644000175000017500000000255312271525577015753 0ustar  heikkiheikkidiff --git a/contrib/pageinspect/btreefuncs.c b/contrib/pageinspect/btreefuncs.c
index e3f3c28..a46d7f2 100644
--- a/contrib/pageinspect/btreefuncs.c
+++ b/contrib/pageinspect/btreefuncs.c
@@ -204,7 +204,7 @@ bt_page_stats(PG_FUNCTION_ARGS)
 	CHECK_RELATION_BLOCK_RANGE(rel, blkno);
 
 	buffer = ReadBuffer(rel, blkno);
-	LockBuffer(buffer, BUFFER_LOCK_SHARE);
+	//LockBuffer(buffer, BUFFER_LOCK_SHARE);
 
 	/* keep compiler quiet */
 	stat.btpo_prev = stat.btpo_next = InvalidBlockNumber;
@@ -212,7 +212,8 @@ bt_page_stats(PG_FUNCTION_ARGS)
 
 	GetBTPageStatistics(blkno, buffer, &stat);
 
-	UnlockReleaseBuffer(buffer);
+	//UnlockReleaseBuffer(buffer);
+	ReleaseBuffer(buffer);
 	relation_close(rel, AccessShareLock);
 
 	/* Build a tuple descriptor for our result type */
@@ -308,7 +309,7 @@ bt_page_items(PG_FUNCTION_ARGS)
 		CHECK_RELATION_BLOCK_RANGE(rel, blkno);
 
 		buffer = ReadBuffer(rel, blkno);
-		LockBuffer(buffer, BUFFER_LOCK_SHARE);
+		//LockBuffer(buffer, BUFFER_LOCK_SHARE);
 
 		/*
 		 * We copy the page into local storage to avoid holding pin on the
@@ -322,7 +323,8 @@ bt_page_items(PG_FUNCTION_ARGS)
 		uargs->page = palloc(BLCKSZ);
 		memcpy(uargs->page, BufferGetPage(buffer), BLCKSZ);
 
-		UnlockReleaseBuffer(buffer);
+		//UnlockReleaseBuffer(buffer);
+		ReleaseBuffer(buffer);
 		relation_close(rel, AccessShareLock);
 
 		uargs->offset = FirstOffsetNumber;
btree-snapshot.sh0000755000175000017500000000061212271525611013646 0ustar  heikkiheikki#!/bin/bash

rm -f /tmp/prev.dot
touch /tmp/prev.dot

CNT=1

while true
do
  ~/pgsql.master/bin/psql -t postgres  -c "select getgraph('i_foo')" | sed  's/+//g' > /tmp/a.dot
  diff -q /tmp/prev.dot /tmp/a.dot
  D=$?
  echo $D
  if [ $D -ne 0 ]; then
    dot -Tpng -o /tmp/g$CNT.png /tmp/a.dot
    CNT=$(($CNT + 1))
    cp /tmp/a.dot /tmp/prev.dot
  fi
  sleep 1
done

#| dot -Tpng -o /tmp/a.png

diff --git a/src/backend/access/nbtree/nbtinsert.c b/src/backend/access/nbtree/nbtinsert.c
index 4d60ae0..5262fbe 100644
--- a/src/backend/access/nbtree/nbtinsert.c
+++ b/src/backend/access/nbtree/nbtinsert.c
@@ -742,6 +742,8 @@ _bt_insertonpg(Relation rel,
 		bool		newitemonleft;
 		Buffer		rbuf;
 
+		sleep(2);
+
 		/* Choose the split point */
 		firstright = _bt_findsplitloc(rel, page,
 									  newitemoff, itemsz,
@@ -754,6 +756,8 @@ _bt_insertonpg(Relation rel,
 							   BufferGetBlockNumber(buf),
 							   BufferGetBlockNumber(rbuf));
 
+		sleep(2);
+
 		/*----------
 		 * By here,
 		 *

g1.png0000644000175000017500000000014112271524165011366 0ustar  heikkiheikki�PNG


IHDR&��qbKGD�������IDAT�c���?^��_zT*ih�p�%IEND�B`�g2.png0000644000175000017500000000206012271524170011365 0ustar  heikkiheikki�PNG


IHDR�-��5�bKGD��������IDATx���MH2]��A
W
���E?�R�B���Z������	\E��]�k-B����f��,�A��DR�"P
�[���N}���v��BF��s��{����B����������"�HLP��q:���� �����5*�ZBV����Y�����777���z�^�D�����q\kk��lV,���}$���(��d���
@8�;�2��a��|J&e��yFb�	D$&��@Db�	bD^__/,,X�V�J����"!����|�����X,�+�4w"?���|���M�:�������NOO��hGGG�+�13���}vv���R�j���-s����U�h4��o���r	#2������/���{0���%�ooo�.��Dbqq�d2���+��e����l�z�&����igg��E
������������������~�H~-���(�
��
��f�q8


^���������rU�����k���,>�R�����F��(
<������A2�4���}F�����C�����___
@�V���Q5<<��j+	��Ha�~>�w:�:�t:����0�@`ffF�J��4m�X(�r�\uuu��ai�Z���������x~u
�'�b-���TD
�q\<��^����v����)YL*�����x<Z�6�LNN655
����+m%`.R��Q��Q������`���q}}}pp!���7::Z__�v�Y�g��L&
!�noo���D"�R�B�P&�Q��������e��������������S���sH��%�<����s���f3�e1
��f��r4M�T�w��������n~~���St(�g$�r��9����A�7�EZZZ*<��P���D����>u��n�����qp���
"�HL "1���"�HL "1�������7�������(�L��K
����b����%��������B���~�#��<#1���"�HL�Y�M*~IEND�B`�g3.png0000644000175000017500000000551312271524172011376 0ustar  heikkiheikki�PNG


IHDR-D`�bKGD�������IDATx���{H���������w%��
�������!�%T
�D��cd���AO#�i��XYV��,TRI��r��G���?.�avG���]m�|��v�{��3�svfvW��� �B�'��
 ���`a@!�B!-XBi1�?��y�T�!�WY�bERR�D"`>1-�o����u�����R���}mmm~~�Z�6vG�C�V������N�@2�g��=}�t�A0�0��|�R�����6��@^^������jjj�������
��{�N�@2�R�T*'�	�)�'yyy:��1 ����
!��,!��`a@!�B!-XBia)��������/�J����c�H$����	�\�R"�,[�L�P��	������`�������q�B3���������+����/""���������"�~�:))������������}��=�����Ef�4�a�L��o�������
�B&�-Z�(>>����}a>����@��c�4��w<n|�y���|����Q]]}�qi��gdd�s��I�g�;���6OO�qW�!6�����3g�z�J���"��
����x8��9�Qw��Y�jkk){�|2q�������C�����k�NU����
@&�q��e���hnnNII
������������4HNNniia����R������^\\��hz{{���BBB���)F������P������������zg��6f��a��c


'N�x��M__�F�)--uss�����Q�iZ���Z�O*
#�0x�7������#�;w����B	����9==�����r��
����7����������[��������f`���#}��	����{���G?f����x8"gW�^����{�����x}�	���s�%��DH�O����|.))��������]�|}};;;���3�����:��������������{�GUUU�oO>x�������P(���w�����/����7
 !!����p�0��B������d������,�������������			$#O0&�����r�4,S�'��'
9���c�����$���W^^^dd�����]��������l��_^����������/�#P���W�...���S�����111�]�x����O�:�p�B�L���������9�I�bd>�F����-[��[E'��X���,�6A�\ww��������?~l�
A^�FDDL<���b>���
L�R���T*��3d2�Z�Q��2�L*������f:��~���w�^LL�B� �������rrrzzzt�����A����A��� ������{��AOOOUU�������U���8�����utt���S��oOxxx\�ti"��Gf3���i#N�R���gI|>pqqINNnhh�&��������3g*�����`>��'���KI�/_������mmm
���6**jxx���+�<�9s����_�v���w��eg���������yE����P(BCCO�>-����a���(,,$�%

\\\ZZZ:�0��,����w���j�����2/�J���������y��Q}�|��a��u��������7�(
a�-:U��D/X�***���`����a�Pc������|����L���������7����vptt$�����n�AWW��Df��UUU�����0w�\a{��b����{� ))��w��lc�Y4m�)�J�Q3������A����K�677��XSSCRmjj*M{��|"Nx�0��Kee%}����������m���O�H����\��������
`��U�!Ca �I���?�����=�n1��B���������Gf3���i#N�T�������;E
�T*%?]�d	dgg�tWZZjmm
���4��0���q���$��B�|��;l7n���a�D"!�~NNN[�n-))��Y�rrr�����P����
����>C`` �|�����_�={6��L3��$���c������,�6�rpp�<R)����%I``����U*�E�|K��+W������N�:E9�)a��Do�*
���������R"�od���J�RKKK��6�\F&������s���Z��;��~���Dn�>|��%���&����3�"���EEE$laa����XS��-�y���EEECCC��/))������0���#���fa��G��t�h����t�_4�|r��1��\��|��'�s)������@��%� ++��];j�u��
@VV?�����#G�x{{�7���\���N��8�6mw"			������KRl���"������������mo��0(��/R����
lmm���?~������Wb?~��*��Q����0�s����Q����@@@?�����&AAAr�\.��4hnn���������qqq}}}4���	

R(���?��7`>�����'��o�7o����\.�����o���_zg���7�]�m�"^
ElllYY����az�i�O�b���l��w#��)������4A0�0�K
��H�D!���$h�M�w%!���BZ�0 ����
!��,!��`a@!�B!-XBi������O��%������mmm��k��466����4�R�t���
�}MI>�0�?=i�@����JzS=������C!���Bi���BH�BZ�0 ���?T����&VIEND�B`�g4.png0000644000175000017500000001433512271524174011403 0ustar  heikkiheikki�PNG


IHDR����bKGD��������IDATx���kTSW���p'A�z)KT�T
(7�N���]VPg��:��������ZpF����Q������R�+��R�X�����B���-y?�y��������}��lv�~Nr�����#�	�����/H �
� 1�]��<6l`;U	wuue;
`f���������+**rss�B�J{���mhhPi�0cPDXX�����]JJJBB�Jw�9��
�HAb)H �
� 1�$����Bw��	���366644������l� �cP!GGG�����������o����W_e+*�0cP!gg����������PXXXhoo����s�N�Cf*t��m�����+W�����;wnyy9�Q
���Z���B�N��v �BbP�������o����v8���$��|8����g�}��?���x���
@��<yr�����^�
����b�XL]�$RRRv���vP�BbP���s��Brrr�`XHjED���`;�a!1��������?������������M���`;4�a��$******Thaa����J<L`��B���[�n��������x.���~��'[[[�Cf*�������v��HAb)H �
� 1�$���R�@
H�����u���������<'''KKK�w���CBHAAACC���#���
@�H��S��9sf���lG
,��$�QK
���o�S��I�<x V�/^X[[S�������C�]��� 1(L$���Z[[���b��������������WnG<����+������/233�������Q^^�����?P������-S]�"�(33���>���_��y��:t��w�Q]�01a�0:������TV044<|���?����@�r��������v�244$�TUU�_�������T�]�D��(|������������u��q������9r$%%����*qww���_�b��#
����H}}}PPP~~>�8u��c��m����������������'�������U=w
��CI#����������Oe.�RYY�nV ���5+;;�����(����X�b��M?��3���F��
@���2���
j���)33������d���%$$���z����x{{{vM��������������`bb���r���q�!...yyy�����!b�8??���q���UUUlG3�!dggGFF>}��Z���NMM}�������7nDGG����"�����>x����s�
4����������bjq���iiik��e7*\�re��=��=������?�1..n��9��%
�WOOO\\����ttt"##��gM�
�OO���o������*!������S������{��	�����!�\�z5  ���G����Kff����Q)u�!&&�>�nll�}����wO�6���`|Bb�����y��]����������o�r�j>-�������h�	���iff�nl0� 1��%�?��������6����711Q���{{{?�����7oO�<9<<<88������`�@b�	������%%%���y�222&�#%���N�>�o��������EDD�����H0�tvv���'##����b``idd�vhj������������L����������L�4����]H0��{����zzz���
�Q�������������T	����_��S�L���


�C#�L�r��___-~O's�����m��
�abBb�700������N�p8;v�8|�0��d��5}�tvcuBb-W^^���w��j���633s����F5�!=h���������t���</!!!00POO���4�lz�n�����1c����!1�v���


�������������lz000x���bcc��h������`�$���ezz��>�h�.=���WS�8�����������III]]]�������������6�������%o������u+���Ab-QVV���w��]j���)++�z�((�p�!&&������@Y�@�	����0�)x&&&���AAA���l����������S%H��
4��W����������ztuueee%&&����������~���4h�������k��Q�VVV���If���'9{��#��
���������C�������}}���wGDD������M������m��EFF��9���`��@�\�r%00P�UkYYY�-b7*�P���?�������o������
�Cb�1�Uk���x
�8D�-.&&����*�r�o����}�p��F������D������;u��|}}����e�d�q���n�����g���&
"�(??���i������l#��
����������q�Z������>A^��D"���������B<==/^�b` f0~uvv���:88PY��� 66���;�
���R��K�.9;;S�W�\Y�d���Gqq1����0c�q����


�o����LOO�������+����}�]����o���_���`��5}}}��������k��]�j��L�r�����"d-���YVVVRRBO�JKK====<<�����
���%������m__]������B?�����������$�NII�����p���v��%�H4d���|5G8a!1;���8��MJJ�Jn�����@���������
����d��5�����������Cee%�����d+�	�
X��7�p��=����_QQB?�����������&����7��Y#y���E�N�<900@Ux��w�\.����{7��N8��VSS�������HD���355mii���|�����%;1UTT$$$�������>��C''��Ru������F���@�:;;/^������>����p8�3f�Uk@�u�V|||AA
]2c����fz��r�aaaG�a)@����#���_��e��@�p8<����d����?��������
.�KMhg��]IIIl���p�*�Obb��K�eB�X,���INNf%*�^y�������r�@@�����������������0c5�z����+��I�r�����&
���Y[[�W��w�^5G��0cu���������;===�H���/'s����$g���qqq����i"��
T�������������.����������p8�������������V��
LL��=�������_���$''���S=QMx[:��X,��e��##����Hdbb�������d�����wl�	�QSSS```CCCMMM]]�P(�����tuuE"�3�bqXXu+��j������1�$����H�v�g;w�tuuUi�'O����/���mllT��z<|�0&&����z�����e�ikk+..�;w�@ 022b;`JY���m<����n����744Ti�*��xr�������A���3c�Mu(������H=n��I��s'��(����RfOF������3�r
��
�$���R�@
HAb)�$���������P/TRzL4�1�#V�le777��d��Q5��5Q�����.]jbbbbb�t��.��&awvv&$$������I�&�^���������O�Y-��s'<<���������P ���+��b-+�m0�0�x������ptt���s��

jhhPE_OFA��U���c9-0�����g�^b�������������T�u�C>������?5b�


���qKP�'������MMM������X��}L6�6���c��233���`����S�}���������S���0��������b``@��aS*�\������(B��Z[[[[[8@������U����
���*�@p������/^,_�\��?�&�������VYY���#
������%���wZV,f&��6���O�����������#����;;;������g���������r<�AA��NE��Pz�������^z����A�<yrOO�bM�RJ����;|�������>���y�f�j�7o&�DGG�iJ���={�baa����$0�_�&�,����bdd�p��[��<f&��M������|>��-}}}r�xB�����|Q�0���O���w>���=���������E---�.]b;(Bimm���Z�l��Y����~��'�O�����-[�H���]�F�����[����O�<9  ���K~���9!$88x��i�[MmY���!d���J�]�e�0�0n<
���:}���U��L�\ZZ*V�����-!���)�A����d�&Db��z��m��+g�����g��y����M����_RRbdd�i�&�������;;;�.Z���!D(.[��������B�033���W~���=!��7�LII���600�={vhhhKK�WJ[����~���M�6B������p-+������X���P�g���_?��333??�7n�=CP{��W�{�*�����IN�fJ��^���:::B�P,�B.�[__?bSLV����������������T����^^^����*S;����������}}}j1""�beeu����������3g���:*�c��Ak:{��g����g�=hb���)666�}��Xzg��b13�0���O��$��A���	!��O		�����J�w����)�����e��'L��&�����������9!���|��u"����j�d��o����S�^�x�d�����o������vT�=�c��-_�������k����?B�8��������i�s��YZZ�����������'O���{�C���l��\SS����dQ����t��qGGG{{{BH[[������o���=zt��Y�X	����D��,��39D"��9s!EEEtaQQ!d��9"��yS�a���V�c������<y2!������MMM���^z�Z�vf����
����W����R\\,Yx��UB��/�,[�����-K��rpp ����+�;���������|>>>S�Lr����r� ��`���555Lz�y�&5�����I}�&��|�3-O�����z�*���������+((x��w%�~T�������B
%	!�����u��o�B���d�3�Z4�eY�����MS�w�-+3�
�I�8�D�r�::::::�V����b8����BBCC�������x"��;�$����O�?��g�N�>�f��CM��N���?�)//���b�
BHvv�d��k��F-��=�RRRBW���o�����L)//�,���N�>]�u���eQ�C:::���l��a�a0��\������9==����_~���
~���������
��qFs��Q��D�fmmm���G�DV}}=��544�w�[���;nii�����������?~L��KHH��GI__����TN>SYd���.\��=�����p���k���W�\y���g�����=�<//o���///�{g��b13�0�����������mJJJ]]��J�8�$&&RM)0W�`<��O�S��$&9F����r��_!--����9d�o��!$--M�)�� IY7�:th����C>� 99�����B�P������"�����.X�@���b?���<d}������w�ZV��q�`XG���j���,((���T�����S�����f&�b<�5�x"��J������!���!�888H6�p$���&���sww��x<������s�*�������<���|�����LV$;;������������������~����O�Y-���n�����JWW���-\���>x����+�������:���N�<�y����/���Y�u�A���(���b��n�qNm�;�'c7�N>�h!1�$���R�@
HAb)H �
�p�7�s8�A��Q����G��X����B���P(,..��������\\\������'
`e<ill,++����������u�o��x�Y$���1�$���R�@��l��F����IEND�B`�g5.png0000644000175000017500000002515212271524176011405 0ustar  heikkiheikki�PNG


IHDR}���HtbKGD������� IDATx���{\L���g�i*3�J�������DSXZ�Z����%,
+I.C.�[H��E�V�_�����M
�-�[��)�t����|����e��f�����/���<�9s:�y�9�yh�
�t�z��y ������!����IU�2v����@2[���'�E2�>}���������3g�����������9�����9x<��3g?~Lu �LfffFF���9s��F/]�t��%�6Q\\L�����f{�����\�\�bEdd������+������������Au,��C_$�


��hbb������J���y �]�<�w
�@��y Ow�����i4�F�I4mtY3�s�;::�h4����+���s����555555��������q������}���
�����rss�~��p�������1c���t��r�������@kk�>}����������Oo����u�j��h�sbHq�(��;�@B(!!A �7n�+  !����e�.k�u	�'O�?�����.�LOOGtYRR��!������h���]�	%���w�o��<��u�j��h�sbHw�<<<<<<�,,+			�1�p�<x�`����D����w�,Y2{�l�k��_X�2G�A�����*�F.BAA���kB��m��������mB���J]mkk������OMMM��?_]]][[{������377�����5���GEE���766�x��W����TWW����.E���,��!��G��y�
PDmr����M�6iii�}��}=�����e=MMMzzz��"�tuu���=��w_�~jiiI�Y�~=Bh��Y��f�����a���D����D�������o�	L����5������������_�0�c�����!(~�=�G�3�������������-[����KW�.\�P^^nmm�x�b++��������B�������q���]���?�$~t��-���9s������o{
g���f�uuu�,Y���'�-�:u
!���'�7NknOUU!4p�@����f��sb�y��0�:����yw��%fff~~~��FN�����E5����>!!a�������/NMM�������4���3������/ZYY?B�x�q���?������:t���[t�YYY!WW����a�����/_������/JkV]]�����yt����~���,qNq��$�=���p��7���}�6�[H���*..VQQQSS��x����������7o�tY�8/G�q�����~������f����)S���kjj�������w655!��L&�\�f
Bh����o�����u���!CDG������i�J���������8(c���133��G�v�u�k�.fqNq���,������83 �������U�V��_�}_��8v�Xkk�w�}��������1c��?~�8��4�����_~���upp��o_III�L,�?�������l��	~��g�����B��];w���&))������088X�����JKKsrrp��m��k�G(
�$������?_SS���T�����W���MLLB��]#v^�v
!dbb������3��w��]��1c���/������z����N|�����]���*�@ee�������[��w��y!���~��2�,�kkk�
��u�k�.fqNq���,�]L�#����I��=v�XMM��A���,��L�w������������'O��*((����������+�g�f�������-<x�7�|��������)lff�z��������G�122B�5Jx���=B���\�j��fa����'ONJJB�8qB��wV�t�91�t�(,�a�M��+���V)������g.++;y����;�F������.\�@����B����5��	&�Mccc�Pjj*Q���;�c�	#;;[x'�u���@����5��G)kjjd�z���#��!N��GVG���"	��"~)�8sUU���:�F+,,l��7o���tuuub�V�WA����trrj?����/�L&Bh����S0���/_�2R�W����!C���q����344��%�X�����''''���577���_�p���!4e��[�f�b����h�?�,���3�)A��qAt���(����K��O�4	!%�� �j���;wZXX��p����p�@EEN��3gv�B:|����B�{b������ay���<I[��f��F�'��eDP��+���]@���w�}'N���r�=����t�� ���ARR��a�X,���$%%�)PPP0}�t�������SWW'�����p8l6��d���}��Q�����cjNKK�7o���C�����\�j��=���.]�R�.O1�tF������h�w
�h�?~��������wv9��+VDFF����;V�
�###���1   ""��X�
OOO������l411���K ��������b�5A������y �]�<�w
�@��y �]�<�w
�@���h����!�&�={��y�fQQ���"
~9��=KLL�:r���~��YZZjjjRK���������WR�����������������~�6m����l�������r��%��
�K�y")�8<<<(�'����D
� '������!���V55�q�����M�<y��TG��|~~~����������������bdd��7[[[


����*++W�XA,$lff������&��o������������X�x��u� ��
��] G�g�NLLlnn��4��`477������e����������jiiy����������������MLL8��������������� 66���~��
!�d2��[�v�Zuuu�6TXX���w��e��d2����e�}}}�6
�.��>XZZ�{��������t:>�F��������Qc�>~�����s��{����b�lll��6r�H�c���?���s���ioo��a+++95'����l������xO���W�\�|�r6�-�FAoy�Wzz���3�����Fspp�{���o�����R��<x������";99�����{����������O�>!�X,�����.]�`��T����bccw��QZZ��0`��5K�,a�X�n�*�w�����q���Ro�>}�������
Jz�����=#��_�E���N�`E������.\����7'N�3l�02chnn>v�XHHHII	������O?q�\�hd�.�;�@���v��
��^�F;|�����)	L&������p�����xl6����agggccc�cTt���������������������	����}������x<�GGG'00p��e��\P�w
���G�YYY)��UUU�����\�Ba`2WPP@Gggg766#�NNN���}���:F�����p����<�9s����(j�B566���m���yf�����_�n�u��. ��k�\]]���F�������y���;w���O�477���i���'***�#����tz��3���v�������������<==���455?~\x���b-X�`������(#���<k��	omm�����MMM�/���:~������
O���}����spZZZUU�����������8p �1����k�-z��B�F�������*�w��e_.�;h� jc�GY,--UUU�L���'�YZZ:u�T:�������@m��iii����������p8���!ww�������O�>Q����^�S;t��+W�P�X����g�TSS���-..�:4�L �R������0���;�|~tt4��9r���)�*555����������>,�ann���������Ju��Gt�UTT�\n]]�AI�}�e2����EEET���3�?~|����|�M��s����~PP���{��8����ptzz��O����,--���8����B�1"����%K�\�xo���>|x����F%����S�N����|���s]m�����>�66�� �����w��M�6���������R�Z[[����4���#>�����ix��Q2�=Q��|����������BL&3$$$00��+�����'O���^^^���$?y��]�prrr���_�x�c�X&KXMM����q�s�Nyy9��033�9������\�����O}||RSS������9baaAmT�U__�{�n��#


���WS��"Pd�w�"jhh��y��={&M�t��Q�e�3xDO���������}�����<v�X]]]�b��>n�����!�f�����p�������n�����x�N��?���_PP(�w��JKK�;w.������5k��(:�����������
����p=�<x�`������I�&EGG����>�k����b�GUUu���AAA��9��

y(��?�^�:&&������C���TG�4�/����jeeE�l(�i<V�w�^�������m6y���g����iS~~>�C�����6m�dooOml�r�w��|����UUU�;6q�D��QJ��T�����Q�pvtt����~+�n����%Z===����kgU����.]��y�����...[�n3f��
jA�����|��E������	�������xD�����
�=��dJTgMM��U�bcc�%��������M��+P&�����[�n���"vr8�-[�|����y(���O/Z�H__?>>~��QT��C|��!;;[xI%�eccC,0<r�H�5$''/]����'}��kW�~�H	_i��qc����B�!���r��Ioy(���_�������+W�		��[�$��RVVVSS��~hXx����/]�����x���,66v��q������e��7n{lmm��[����P�
�����@ ���]�b���#����!
����{������YR�������UUU!�U�V����d�����v�"f�BYYY�\�r��Y�y��^�.PVO�<�3gN^^����W�^�S�
U(��Jw�������2�!==�e����5�7<)$C�=��s��3g�����#��Y��g����Wr������?z�(��K>��g�����O�>!����C}}����[[[�G�����+^q�������8q�X"��������?��`P���@�����9�����{���/���d�����OZZ��0aBll,������?��������^��vrr����1	���v��u��I��3B���(  `��E
>�6��]����o��e��=�}���C�(���jjj��c��]�B���aaa>>>��
�~I%6�mmm�s��q��������]�v=z���C�	����/�{�����q��������bbb�O�Nu8=GVV���srr����~{��
�'��X�H���K*�4�����O���|^�z�?� �����-[���z����5k����x{{8p��fS�r���

:p��~���8p���>v������#`D!TTT��@���.]�4  �8Wj�wAt���%K������8x�Tj7o����-((�����aaazzz�m���J���VVV8;88��E�R^^~�������?�=ZZZK�,Y�f
LW�� �������������~~~�w�&m�����2  ��_����>����CS�N�w��-�Dt����z���QQQ?�����6�=��u��������]��������
:4>>�����p����g�����{����~~~[�n���"?����?���������
<"M�`9-���>~�x�����wWVV�=,k��\.��V"�wA����y�����m���#���d����$J_|�Ell����Q��T���nll�������ix��1�:F2���9r$446B�����;w��
��R��z>�@�o�>.����_������R���Sor�\<��d2��[�v�Z�}r��%�����Q�6x����;|���={JJJ�&�����q�F8��]�[���y{{?}�t������j|R���_/Z�����xs��QG�����6*��{�.++�������JUUUSS�?"���t���m���=������?��_?|�pjc���z�������o�����������XkkkXX1�#����}���K�}z��K*�������`GGG�c������'On������x�N�:ujHH���� ��^'33s���UUU��9s&��P&//���'##oN�81&&f��a�F%s�K*������LLLp�������������g�n��)??���hnnn����X�b��|��	5{zz�x<����;w�����������rUUU�E@KK+::���S!�JJJRRR�����������vvv���qqq���T�]���)))_~���u���%33����A�����W<d���7oR�\���N�>]xgff���qE�9sfii)UR���%777..������O���������������|~JJ����p��p87n���W.^�Hf���]��UUU��=�F�������R�,555������N�>-jjj|}}�)����S�������FFFzzz�6���x{{GFF���666R���_�>f��6�7%%�M���������WSdoyAbb�����#�����Ef|||��Qt:�_�~���������VVVR�B#F�]\\�$Y,������/_R�RSS]\\�����cSRR�/~��G:�N����YCm��
�]�����������655QNw9rD�"����W�E$%%Q��inn�#�������x����������:���������������/_�$FA�t����������������h6�moo��aPR���L&������r�uuuT�����SSSCCC����$Y***���xD:;;���U��[[[/]�$�h�������'
��G�&n���Kx���QXX8w�������7�^�Z����x���eee����N���{��9��(s�K*=x������f[[[�����%Z�����277www���:t��b���	;q����
��o����GDD���������iii	

e2�...o���:	������
�]�1����������&&�"F��_���x�����t������Zhh�\������8qb��������@�5��A��c999666}������:q���[�l�t:=;;��0{�>\�~?.����?����������#��-">91�!C�\�|YN������3�N��\�RNM�f�w
�T}}=��UQQ���x��=��t���["V[RSS�?�6m���^%%%������'<MMM|�tbbbYY�@ 077~���6u����_�<��� �s��h�U�V���^���s���������>}:��t���������������hL&���QEE��������p8zzz��
���������w�[^^N����������������y���+W�j���?���tYr��m����I��������f��U111���P�[����9NVV�NWSS���WQQ���?~��q�8N/Y�V�fff&'''&&vV�N��1"&&�����->z�����wQQ��W��������~���������;v�X�n]��}U�IHH���P���BXXXg��a�F���={��i��
�/!!�x��{������d�������9���._��u�V333�[onn}Y$_yyyff�_|1l�0���������������E�.~���_USS355��m�\B���g�6n�8q���'�x<KKK�%����������l���m��KBC�<x0	
�#  !���Nu HI��������YEEECCC��c6�maa1c�SSSy?�����
�k+d��z���
�����������������
32226Q%,�
IDAT6622222���?.����������H
�.(>������+�
��A������{��gS��g
�y �]�<�w�@~~~hh��1c�t��Y���F��������i4����DU���H���s���������������m
466r�\cccUUU����m�������fkii���]�~]�����r�������@kk�>}����������Oo��.���Y������f���}���K�.-**�~���c��v�f��%�;�R���H~�	�~��o����uY��'��'O�����_U�A���������DDD�i3Km��
>\�K��=U���W������D���������Q3Bh��	��Y��A����]����~����������w�(�����U���������T�_��X��9�������Y�\#���`����m��UVVVVV����\naa!Q������g�666vmkk������OMMM��?_]]][[{��������=U�����������y<���Wmll�����'���6,,���Guuu���/^466���.#]����	& ��������;�����O��zHL�\
�A�����e2��vYOSS^�O�������U�'������CCC---�=�#;k�,�b�f�Bm�����'b������'����y���8������^�x����Q���{]����W�^�h�>}�|��Q�5Kq4����'���y��z�z������"��.��.���[[[/^�������"%%���B���2::z��qFFFk�����?���u��	����o���R������:�>���S!???}}}���5��g�8p��2x
ZI�
�����x�@0c�MMM���\�;��Q��y
��] {xhh����"�HP__���0}�t}}������jhhxyy	�=?{�!dmm-��VVV�������ruu���6l����������+**��*��fa������;� >00PDI�tss�m�����j�Y�������d�v�@�]@$���6����3�>����UTT���x<�@ ��xjjjt:���R����3������o����r�c��)���555m
�>MSS�����&���l��F��R>>>m^���qYYY����pe�Y�<fffv��Q�sss����f�eXsZZB������E�1Kz4��3Ktx��W%���@���D��3�:v�Xkk�w�}��������1c��?~�8��4�����_~���upp��o_III�?$����]�v���s�����$CC��������Vs{���999�M{yyy�&M������022�a�qqq�Y�fI�T����Hw/9����z
�(iR����|>���!t��5b��k�B&&&��#I}�����wg`c������7LWW!���;��xq===�������uKx���7B��e�Y�7���!��@zz:��������~��!�rrrd[�@y���^2��"��!��z(�D4���]�����y_�;s��M�����y������+�g�&�`�9::"��^�*�����!'''�����6���!��������Akn?�����f�������Z�|�lk���fcc#��J�w�>�d�]�I��]@DC0��G�$�A������<y����F��a�����.\ 
��W���x��&~�SL������l�����6K�KJkn������<~���3>}����)��1<�,�Ub��drxI�PW$�D2�}T�����UUU���4��-o��������UUUb����<�[QQq��A'''� �G/_�d2��������d2_�|I�2���T���!C���q=���344D�t�?�X����������������/\�`aa��2e
Qf����B��b����{���`0�6_"t�fL�3����t��@Z�����{�������`�YAH=O����$��"�] **
!����a��&MBEEE	W%�K&�y3v��iaa!���y"���������_�z,,,���@��T�j�����N^^^��"��������{�"��N�*�HZ�G�@�<�]^��yW�1]����@v�f����� �*���w���'N����'N �lmm���%����� ))����X,���p����3���x��f��L���YPPP�9��~O������y��
:��`�X,KK�U�V����S-����a�:u��# Q�Rg
���
�s�(���4��i��$&&zyy�p���aqq��"��+"##�����Ku,HC&�������O�(��edd8::DDD��!�Pr=��h			��=�����@��y �]�<�w
�@��y �]�<�w
�0�������Uee%9
������������P���dI��������x�K�.��	��z�DR&##����
�A7�x����U0@���m!����w
�@��y �]�<������l(IEND�B`�g6.png0000644000175000017500000002254012271524200011370 0ustar  heikkiheikki�PNG


IHDRs�.��bKGD������� IDATx���y\g��'	�"�X/<�
DDn�����vu�����vy���Zmk�����]����W�.��x#� �A���"����1m6M L�I����/�<y��I��/��<#�(�t�����@e	�@e	�@e	�0�;��m��eee��^���GEE��	�,
z������lC��������o~~�^�����[+f��1K�^���/>>�`����
�={�������E���s`
c��
T��
T��
T��
T��
T��
T��������(OOOsssgg�U�V����
�g	����V�������8..����&L�+*0"����������������555)))^^^uuu���|��
c�����/+0`��3F�=f���W���Y@�LMM	!�
�;0�,
�uuuiii�/&�DEE�
�?��]\\v��������x��`�:�����������T��'EQE_����c��?�����8������>|��w8`PY@����r���@�8�������%$$TVV���UUU%''���K���� �C��k�
�w������j����m��K<`t0f	����X�b��#LLL,--�����������Y������,
��,
��,
��,
��,
��,
��,
��,
��,
��@�EQTmmmQQ�g�}���j����}������A�����|������P�w��������������������,\�0>>��(�O0f	�K����?���CG�}����C���W�^������_~�eB���3O�8A:t����G����@�����577�:u�������j#��G�^�p�K/����c�x�/_nkkW^^x��Y777������(����'O9r���c����=���tA)�J
�P(����(j��}S�N=w����c
	*Kcr��������������v�r�@�h��y��999� !��D�_~�E�P8p�..��=���/@e	��)�������������������W�������)!!����3f�8w���1c����%@������������XZZ���H$


����7o^�-�LMM���?w��S�N�����1���S���wCe	���d�������'N�d2��$IXX���sg��mgg�W�����'''���K������>>>���AAA|�����Eedd$'''%%��qC�QWW�y����3���_$�!kb����,HMM��d�f�:t��/��w\��,
x������������\\\�����gDD���s'N�(x����_�j�?� ��g���������[|��Ce	`hUUU'N�HNNNIIQ�0���|��)�g��QW�t�H$����5x���7����������111|�Ce	`O�>=q�����O�>�v}7Q9����gb�;3�@ ���O�{�=�B�y�����]�v����7a���rss�j2##���g�����N�<y��9�F��+H{��w���^�������w�d���X�D�w\�
T�kll�p����'SRRn����h���_x�����Y�f9::�!��-[6|��������9rD*�=z��������,
8�P(rss��9s��������&�G�T*
�9sf/>��\hh��3g,X���������������q�^��g7�Tvgff666�56l���3���3e��U���}���W_}555���6,,l���_~��P(�;4`�%�n*++��9CO��_�Q�H���MO�������4`�������G[�l�(j���7n���w���5��
K�,
�V[[K��^�-
�R�����O�`aa�K��H$�������Z����9)))$$$..�������
T�kjjJOO�����<�B���@ �0a]M���ZYY�g/��k�y{{/X����4??���k��u�1��T�������������<A��������O�>=88�o^��'������+V�HIIimm��q��k�~��G{{{�C�� eee���;}���3g=z�����epp��i��M������4=qtt<y�dll��U�233������C�PY@_�P(�����._�\YY�����:,,,000((H*���4�e��yzz.Y�������j�������}����%��
@�PY@_���|���������K�.��r�b�8$$�>u����N����3//��/���i�B���m��}�bbb�-[�wh��M�����rrr.^�������.����Bww���������P���C���~���'N|��7=z�������'''��������;:�*K�md2}�;###??���M����yPP�����R)��Xs��)..��e�W_}������5k��[�N,�t�%�����%8����n�jooWk`mmB������	�������Og����[o���566n�����c111��M�;:P���UUUUVV��.^��������������CBB���1������������_���jjj�^�:}�t??�/��r��)|G������g�222���srrrrr4�"����M�:�>������+��`��eS�N]�f��(�����6m��6m��{������
�cE��q#''�.(o���90I6lXhh(}�{��Q��!���/��2!�����-���rss?���S�N��D��K�FGG�;V���.a�z����k��eggggggee���v����������/88���c�}��	RSS/]�}������={����'000::z��9���
�(T��3��vvv���AAA�������O7����;w.>>~��
�o�&�ddd��;7((h����/
x��x�����/����+W���4��B�T�������I ����.<|���-[�\�BIOOOOO;v�����d��A��&@��,
�(��s���?���655i6�H$>>>�an???��
��<��������#..N9��P(���_�l��%K0q)�
���P(���+}wFF����[[[5���bzT200�W1^=������o��5>>^��{{�W_}��_�Y����8S[[{EE��Blll&M����
8N���SY�������~���3g��~�YXXL�:5""b����1B�^	�%�WUU�������JI���?``������~�:�{~~��?�LY�b���'����������h�����?��w����.777�6m��i�����R)2
8��t�������}�rB����T*�1�^/11q��y"�H(�=�P(���#""x�MM{{{zzzBB���G5�����
		�����<yBQT]]�B�P{�����������u9(��mZZZ


������rrr�]������L ���L�8������G*������������:88txi?!����������MB���������������H$3f��<==l� �������������^&������)���W(uuuE���'O!2�L�SWB�������Z"�XYYI$[[[���4������a����8��Be	RQQq���.p�BWWW��vPP��������C��`����w�niiQ[.����������%*�***���.\�p��������mll��pvv:t����D"1X����O�<��d2���E����j��?����l��ANNNNNN#G�trr1b�����a�z�#�*K�����&///77���s����/����rT���������B���6y���
6p<�UWW���eff������WUUu�333;V���������Ug�n�����rB=R�������������\������"������rysss}}=�/�B�����g�����OzR�l���Fe��<\���^__����\���S�\�"l�a���;���m���������666�}�`(�,
����rrr����C`�TG%�������G=EQC�U�8���s�����]p=zt���������������G���oL+++[[�������mll�_lmm��(�&���:�\^QQQQQQ]]]YY�������������{���E�vC���L�nWWW�gv~���s���������PY�\r����")��w������dg�1B�p��1R�T*�N�0A*����ws��DGG���C���X,�����y3�Qq������{���+--������RVHUUU555\��_�~���666fff����R,������������z�*7��;wJKK;��+������K���B���������a��m�W������Ae	�={�l��[�n}���X,���%%%EEE9997n�(**��6�D#;����\I`���kR�Tma^^^_%����
?}�T&�����v=�?����fffVVVb��}i---w���y���[�~��W���F7---���&O�:i�$�E����/���B��Y�bcc1������Y
���{��YS]]�P(
�����oll���U��Z�nB|}}�:���}���+8���r��������o��1��JKK�^����C��0���������2}}}��[�s�Nz@�.����f���T�=H|||tt��������B����W^yE�Mee%}�WAAAAAAQQ���@=<<<<<����R���?�R�a��M�6m�o�ijj����_�����7�(����t�y�����/kf�~��I$��
EQ������[q�FOPY��������^�*
��f����^�:<<\yt���;Z��������rss��$]\\0c���w����/�@P\\<j�(���>���-??�������iiit�TM��D"�����C�F�i�H{?T�<+))Y�f��#GD"��YY������%	!NNN���?~���������3�$�/&L�v�!D*������]


���OMM�~�:=�����T,������=p�X/%��<y��'��SIS�y�?EQ����?'N����N�J���Q�,YRXXH��w,��YZZ��1c���O���"���������'%%��������A�b��A[[����?��������v--�B�����R������#�wv@��?~<d�B�o���Y��w����
���J82�=J��o8@u���~�S ��).T}����GFF����5�={�?~|��M...z]�a��}{��
�f�Z�|9���qx���o��VVV�����������������D�����������������9���+W�$�|����^�a��|x��Y�@0e��
>��|r�����<z�y�Xlnnnbbbii)�������LLL���G���������>/�d���jK�+K}�����u���i�����5����
6����,``�������������Z������E"������7�
����(���0zY>�>}�@ 0�m�g�!�����?N��iSwV�s��O������
����������*����oEEEt�)
�
@��	�����2d��3f��0�@e	�@e	�@e	�`SY��y3&&���O(��� �@{���i6���:u��+a���#���VVVVVV���G�Uk���=r�HSSS-�644|��^^^����z����N�Rm��=5��sss���<==-,,������W�ZUVV�����kk������H$fffc��y��w<x���;��i���I���FO�t�R��hH ]&ML�6��^=3�7���]��������K�� ��@u�t�l�|-=0I���d�"��h������
�w�e���������.[�j��m��l��]��G}�e�<x����|�Y��F��f������mlmm�����3!$44��=��jO���:=�����\��Y�U�LZv�sg������@��C]1I �����z����;��o2Y;���m
&v���O:�P]�kU�'��p�B�{���tss���O
Y<W:|�jm~��'B�����w�]�5r-JJJ>��B���^[[[[[����B���KKK����:t�����h���.\x��-gg��������O��8qb�����X����������;o�����\SS������UWWG��4�T���#//������.99y���2�L�
��5?]����-�f������zhnn^�r���K���N�r��1�����kg�3���|0������w��=�b����W�������=0���e�����8��qG8{{{�c��&N�,���3~�x�z0r��%���,YBY�~�r	}*�B�Y�$����=z��I$���1��������_?-m.]��e=��wO XXX���s�3�����/���Ba``�w�}WUU��]�,?��ckk�G��0�c]�������I�1����|�������y�L>�?<��tVK����1b���EEEZz`q��k�F>���O��f���$%%UVVzzz����������|E!����v�
		qrr���


��;w�h�f��?��qF{{;!�>����0���OY�z���#��c��LMM	!�
������bii�m����E��?��������P(233��#<<|���O�>�f��n������q�
�����	�VZZ:�|�Dboo�r����F�k4����|�������|0~x�ikk�www77���7wxf*k���!c>��j�Iz����Y�!�|�
EQ_�5!$<<�]W�X�Y666���?""�N����'&&*����B?~��Dz�g���T'����6l!$++k����F���NNN���^g�O���1�����'.\���S~6:���?B�/_�m�������'Or3�����O��\I$	�B�P8u��={���reK���L�2n����V
~�A�	��'	�������C����/����b�{=��D��3��]�L>L�h�Y>�(*((H�y�g�����O>)))Q6c=f�k�F>a�O����
�e��m���E"���YMM
EQ555fffB�����������e[[���'����J$�������X�oh�����.lii!���b�����>���7�P{i#G�����l���c���i...�w���������F"����r�sFF!d���mmm�����P>�Ie�D�E �g��}�����f��{��!��?�]�>�^�	�y>�<��]��2b��������s��
>\{������Ot];����������G{�L*K%�@ ���I�v��QQQ����)]��O����be�i�&B�+���\�x�bB�g�}�eWL^���>�������7�h�,\U�t?#F�8r�}.���������~[�=�n�=���I$���H��\h����&��������7�|�����s3�����o����7�h��!����9s&�����888��/a���	��@��C����+!Dud���#�#7����|������.f�U���]�v�7N�~G��%�'M�Dijjb�:�����|B��zge���B�5j!$55U�055�2j�(�_���me������S���xD�a���B��;�����3��w'���{VE_q)�J	!QQQ�
233@Y�n�=755����r��un{��QYr">>^��^{�5++�����G��@�}p�@��4�L�lP[[����^�o>�u��{f����w����y>��a���u�F>a�O��s�%�w���3�����������K�.U|���_4�!)))�SRR!AAA�����Z�����SSS�����1����D���Qmyrr���!���;�=S�B����y�����������G��?>b	IDAT�|���L��}�_&����	�y>�<���,�q��7���v�=��������D���4��
���{7nd�.t']#�0�'���k�������S�m����3g�@ �Ot4h��������l<e�BHll�j���$����B�^������+���
k���&��Z����?��?���q���;v���g}���i,��l&&&��!C��[�������8::�������
��2r�HB����
.\��=c����'\��������o��3,����x������������>U�	N��ao>��j�Iz���L&377�'����	�Bsss����^���,��������� �;���{W,B�����j�b���w������>|���G�~�9B���a����1�<c���G�VTT���VVV&%%�'����)�l����P���L{��������������Lc�I�l�W�&��lll�}���/�����d}-��
l��0	�;��u3������z~���kg�3���|0~�h���P�Y�W��D��3g<x���Q��|�.]�B>Q��O���h8�� t�,��K{��;wB�O��a�/��!d����]1|	���)����7n������m�6�6L�^�z�f?���S=
��=5��;logg�:gog�B�L��g���[	!�f���t����P{���R$��Yvv���V�Z6���I \�l�"���u�2��^=w�^s�d�vv=��L�Y����e��,�����,;l���;����|���|�E��,�\���:�<..�"�JU�b�T����E>|800������200����j
�(�H�b�����u������=5��322V�X1b�KK���������W�h��hMULz�yxxB�������g��Y�����O�������R{���4L��}~�L %%%s�����0`�o��������^������]��]���F��m:C:�%V�X���h���U�� �t��+x������^+K���������o����!�|��RY��+x�`PY7PY7PY7PY7PY7PY7PY7PY7L����}{||�^W���O���������"����!�;v�����Xx�h�"}�����0+2�^�
8�|�+^�Ivv�����
�r��^�q
@WQQQ���������m�6�
��|�����GEE)��Se	���n��n��n��n�?���I�;�IEND�B`�g7.png0000644000175000017500000003007212271524202011372 0ustar  heikkiheikki�PNG


IHDR=�����bKGD������� IDATx���w\S���o�@�l� ��R�Z���z�mZ�h-��j�V��[�������pT�	N��"�
��
�7d��85�4�pIN>�?x����<�I�|�`�D"���L'�
�-������C��N��@�6m�����t*�t�
~�������`��h�[tYJJJjj�:�X^^~�����L��%55����z^��y����3g��9���=z���j^)}�o
�qAAA���j[]JJJHH��q�6o����L�>]u�A���
T��N����!��r	!,K���,����C��}h:�-������C��}�%===**������������c������L���-*ZKg�h��BBBX,����;J9�����[�/


�>~������|������
@3��������7srr�����@�a���m��477���_�p������z���L�����4$�6���s'!���P�;�P*�@��o
����ys��E���300���9r���G	!�o�f:5�����o�>B��-[!���kiia:)i�������}}}�N@9��@����	!�z�b:�_ZZ����`�__�W�^���1��_***����������_fee1��r�o
�6TWW_�vm������(�������������i���/_�d:�vQ;�}�����rvS������O�8���n�����=z��1c��4T]���
�o$�w����k�������Jff&!���p��g���y�������h��_�CS
/\�`hh8k�,B�����������/^8;;����[���8p�����:B�����Q�f��5e�.����
0�-������w�j����{&N�x�����������[[������������{�n�@0e�KKKB��������B��={������������WWW7x���[��?>22M��-�7�)����yxxl��e��L'����SC�122���WdddLL!�����$#�|b"�h�����>�@<��Ul��=��)�<���
}��:�����	!d:�v���	!eeeL'"���+yyy���#G�/%9r�HBH^^��+W��Oaa��s�f����rSSS�,Y���8f�����S��
��-�.j���Z��n'11�bgg�t"������������JJJ~�������X,j?�^�z��93>>^�)
�����Q�N�:UZZ������N�>=m�4BHXX����>|���G���[[[

������C�2e
���MUU����Y,���O�v���g�������b$7cc���{/>>�������kXXXcc��C�&N��H>J���
�_�ZYYm����|���|������0`��U�X�����p������#F���I����<|��?������-Rj��cee�`�����<x���&�D�o
��$%%��;���UOO���d��
��yVVV����N
t��k���4h��u7n����`:���v�<"_u�p�/�"�����N�.�|�%$$$$$��,�;R�k��3z����.���3g��9����S0��}h:�-������C��}h:�-������C��N��@UD"QEEENN������������B233�9���899�.>(QAA�J_���.77W�+R����3g�xyyyyy��Ikll$�h��
P�H$b:P����.����={�����tT��w����e:������=�t@�����}�]��h��������c���<y���X�������o�t�������Q�F]�p�baaq����� ��@�M�6������#���&O�<v��a��3��fA����������������I�������w��6mZ``����-8v��Q���d����'OV��
�Tuu���Oqq1����p8��������c���f��d�-��������'N�8s�LMM��M��������|�}��#G�N�:��]�vB�l��u�����e�]�]�!
eo�&alll&N�8n����'�X,�g�!p\>�6y����S����SSS�x9��
		�>}��I�����K�B8�o������v�Z�P�|�����;v���2��:t���+��['�ES�%eee;w������)S�H@S`�@�	����������O���I�$nW�L�����T����-��O����g��������~��9r�����$
4�P(OMM�6)�����������
@s`�@C���k��������=}�T�&�6a��I�&�����;4w���}����{���><x��5k�����>�$6�}��Aooo�@ ����:r���-����������������������5��������;%,,,##c���			MMM��-�����s�����
h''���wO�6Mj9��^�b���7#Y
h|��<�Ht���/��������r���7-^^^��/OLL���:z���9s��i�����;wn��M=z� �$&&0`������L��A�N����J^�R__���5::���s&�!p|cZ[[�]�v�����O?~�X�V??�	&L�8q��A��6�o�r��������[��NNN7n�E���������={���Y,���qJJ��m����w������L�����[YYYLL����kmm=b��-[���##�1c�l������w��Y�fM``��7-4���7n���w���!���`�����7n�`:5�`bbr��
�;e�H�y��
DGG9r����<����L���-�PWW��G�������������_wE�'Xmm���g?��cfO�:,k��9999�-�p8����o�����;���GLg��7�|s��5��q����7�Z8}����loo����O?������
����TE$���_�x����III��������6l���&Lpwwg*Ie�����G�}��gg����d�X���[�jU@@�
�x"�h����������Z�c�������{��������
��@��^�z���.<|�P���={�����G�;v,���nP�o���U����G��f�g�����_���_%�h����GFF����Z�j��e8�8t�[�@(���_�t������_ojj����b�x���G�3&((H�|A:C���"
>�f�����SK�l��	.\���o���=������]�v�����={�8991��:�o
P��n`���


R�����3~����.��H�j����"�N�>�z����4�B�������������9s�������/���L��r�[:������K�������n�p8


��J`` u�yw����":���?��{W��������[�p!}
�����b���[�N�>�������%�
����UTTP��������ne��<o��#F�		166f$If)�o�~������;���"^���?{���3g:88t}�����|������={�z�-��
P�-mkjj�~�:��ddd�B�[Y,����^e������L��!���P���>���?���DFF��9���VY��^����������7o�������'�����?>�����������	!...�G�1b��!Ct�l`]����"���v��������*^��G�I�&��9��������rW
�ubbb-Z�����~��t:J������_�r�����.]z�����&&&C�>|�������p��6��o���>u�Tll�����|�x9��	

�0a��)S<==U�v�����9s�����\���o��>��Aw���#�P���A���������R���F������tH=}�Xyy��c�bbb���������?a�����������nH ���O�~�m@@@LLL��}��@9��@w������x������7n���J
000:t(u�����N^eEu����egg�8q"...--M����e�k�����w�FFF>{�l��
���g:%@��������%&&^�v�������R�l���wxx���C�������S0������_�|9>>�����M���;5{6n�8GGG���~MMM�V���a�������Q�@��o
]SYYI�������)y���(,,l�����<�����<u�}�Xmm�������������b�[���
��W/F�P��/����lmm�������t:�C�����W�����_���@ �`ff6t�P�]������g$O�9}����"��pg��-((�`oo@�1�������O@�����,Yr���y��m��	_���B�����,%%�������m��<x��aC�
�
TJ3�1�@���~�����/'%%�����177


8p���{����<
T'66v��={����	

e:�NC�Z���1))����iiiiii�',&�XYY���[�>`^^^8��hx�"%//�z!%%%�^T���r������������������;wnbb�����5k�`����\"����{����������N�B�������}������'m�[$���$''������777�9�������[�����S�:�H�c���>����g��}��h�-�YZ[[����������������6����
2����*����ERkk��{�������322�����eKKKoo������������������@a����={����[��'��X,�3��`�I++���`��i???SSS��
r�F�"E ���fdd�����s����eeer����xxxxzzzzz������g��jK�����~�a���#F���k����
t}0���*11��Un��U]]-;��f�x���P�tO�
L��d�"���4++++++;;��������3!C������pwwwww���7������M���2g�����;vL�4��t����
@D"��G�n�������$;���R;�����?U9lmm�>|�p�O�P��������������>|�PjN������4))Ir������qssstttrrrvv�������N���iii��-�<yrdd�����\.�I
�
}��P(��>u������w�����300_@;*�va��}�����������G�Q=Lnn��G��<yRSS#9�����������
hgg������������������hkk���`nn�������Ytt��Q�>���
���2�������������6�SL177��7�^���Ts�*eaa���o��������������uuu���BaQQQQQ����������/����W���N�:o������?�����700`:)����-�����������kT�C�^����HMM�{�.�{ff��={!s���������1���kmm���/((�~�)..V ���-53cggggggoookkkiiieeE��I�C111�-�����o������?�-�	���)))���H166��x��K����M�4�����l���B�@ ����0a#�i;j~����������������%%%EEE�
3��}��l���H�.��XYY���)�N������3gNZZ��U��-[&��0}����������������v���6���b�<==
���z����lA�Z[[mll�<!������TO;$+��/)))..~�����)**�:��/_666vqzzzT3��g��={���S�XXXH-�~�&�c�|������������w;::2��������7ov����������
����I����?�x��]---R�
>������3����R33����O1�O�'Na����m�d�cbbbbbbjjjnnN�nffffffbb�nG���u+22���d��m�f�b:����tw����e��I�G�	��6GZ[[�gT�����*h�k��
6���pV"
WWW'���{�&������Z��
��f����MMM�~�g��\.����������J�.��"%�������_���/���Ntt4��B���H��8---''�������3*


>>>8�d�D"'''��_988���:C(VWWWVVV�VSSS-���RjI�W��:�	�F�����5sss�V�)��>����w����p���n
�h������(
�<yB��P�*R�c��}����x<o���<�����k��b�f���e��=�f����E���l�N}�.������jkk�������n�������������TVVRc�����2E� )pw

MMM���z��i*���B����<�s���5t���#���.\��[o-Y���444Ts�o
�D���[�l��qcQQQg�������IKK�w�^NNNnn.��os�������xF�������������fdd���3������P�Nmmm}}}CC��Rb�XT#�S�O+++�QPP0p����W��7���^���~��G����6j��@������/[����WB�0;;���[�������tq�"g�/B��������.�����������N@�������#��������?��������P-
��������VBUUUMMMmmm�gJT���������������ncc��W/��h<��??f�6�����y��I�&)1m��?>w�������W�,��N�O@����._��������l6;++K�o)--�{�nfffVVVVVVNN���[;;;______���_?4*�
���k��imm%������3�����R`6JKK5�S]]M�4���UUU�?%����@ (..�������TK��������������������W�6����,����g��M�2������n��*���z����[�._�<..n��}����L�-��h����O?�����l6[|:/CC����=Z����G�jjj�bmm�����j:�����
�x��������b�?~��1��D"�����j*++KJJ^�VRR��8�������w��nnn���nnnnnn�W������x�@ ���_|||�yi�����������a������v����0,//o��e'N��p8R��X,;;����Bqss0`��
���|}}=<<0�L8p��;w!</--��t4EKK�����I�4eee�^����C3���QSS��B>����~���j>C}SS��U�6l�0u�������;���o
`PUU�w�}G]���C����������
4�����Q�a��Q6n��b�
B��������N@�466����x���������������=������������p>����������%��$''GFF644���s����\5t+�[���w���b����j�t��l��_���|}}{������*..vtt$�����RYY�������{����p������w�}W�o555��-��c��y�6o�lll��UC7"��t.����������L���'�,��D�TK�.
V�����{���5k�xzz�tE������7��;����g:�����������n��?���%����q8����/X,�������T���3�G
�6>��cB�������������/�X����
&������'ccc%�+f��zzz|>_��X�~��x�
GGGgggGG��^
��Z[[�3(�T=��[����}�]�f���r��������AR����o�����S����������{��eeeefffggS����aKK��U��KY�3��PN����c�p������N��z�:qqq��:���b���S'e��������={�m��{�n��'�������*<<<<<\����0''�jfpI/����L�������-[Fu)o�����������g*1�@���]o���IDAT�K��9��D@Sl�������q
@��o
M��4��t��-<X�~}PP��V��XY,������		a�X��T(��E�8qb��!������C�9y�������������[___N����?�����?��5337n��!9@��T�"���GEE���yxx,\�0??_r��;w������.�khh��o�E��x�����{��?]���=�`������P@:, ����][��"��6��]��
?t^
�x�O�r����F������~��W^^^��������
;r��R"K��[�����j	�k���@���K	!���4WD?9Y��wO|Svv6�P&���LY�ti�#;k��M��l��Yr�W_}�a�/^����_�O����E�
H177OKK�?���"33S�	!���]����!��J��u��������H���3���a�����R]
�_;�N
��a�Z���.r�����Ig��EV�����P��#��z�I�T��Z�	M�'����3.��WTT���_v���+�YR����_O�[�����w�eggw��Sz�Bg�����!������>��+����oy��	u���k�VTTTTT�]��b``���'���N9v�Xsss�q�|>�������S���������;7l�0�a
<��900p��m<hnn.//�p����?!d��!�1<���~���������>}�t���	!]�,��`��]����[e{�>��������}KSS���GdddgV��:�TW@T�9�f
�%��h�V�l=��v"+�3���/����@ x��9�4��b�Z�	�'j�Lg����O!...'N�������;99�X������:���H=Q�o������������������B���e?�+\&���<�|���/�&Rf��%9l��Y�����Z����B�Ba{��	D++��/_��������e=~����G9cn����"?{���b���(1�b�F{�~mm-��

��}{YY����[���[33��/_v6a��Pi
Q����,�wD�zf�Ig�N?�$�9�ya(������z����b��������(���u�\���B=a$�,������r���a�.]"�,Y��+��:���H=������������-X�������WqqqL'E!���C�uss���/����7]�r�2g�������'y���@  �P;P��'��C�!�/���Sn��Y���>!�W�^r�P��R�%�z����H4y�dSSS�FV.�P���L=�G���]]]c>|�p����W�V�S�u:Y@(O�>�<y2�����������Q�zf������������G1"�(55u��%vvv#G���o_mmmcJR�\����6n������bB��A�$�BRSS�����ff�����ND�a�e������[��D����2z�h�B�R`�������C&L�^:�cc�3f�����X[[B���%����mmm�	�y6)Tw����y�fwww77�O>������?�YRUU���W����������o����_��=<<!���Wn��=�m�R)8��f��o�����{kkk�#;��hDD���Okk�	���Q��UJ
�D�^�rrr�|~�N�*��h�V�l=����GV,g:/:c�k��H}�������{�J�<+<���r�z�z�!�%�������v�[��������fF��.�-m�)((�p8������"���������fK��/?���>������H.�K����5jTLL���?
UAZZZ$���B����Rj�y��I����{��������1��x������K�������\���O�9))�boo�����sg
���[�����7���#����?g�������*�����Uu
�_�^@���B������Y[[{����k�V�l=����GV,g:/��>�3�������)\O$u�\SPOPO4$��x��V�?��?���'OR���8q�z�;�6�G)���H=���e��5����{O�d���������Pt�������2x���[��y�RV�B�quu�:���`������6F�O�r�K�.m�������;v�Pn����B>��s����VI�7o^���[����!�V���c�������r���
'����. �������!D�[�'N��\�zf�Ig�N?�b9��sF��d��mr6:"QOF���gA��rMA=!�'�Yr<Ev�/**�&|$Q����QW"+�������; 
�3n%$$�&$$B���%gW����[���~��9e���Z�i[XX�vf�,��m�,�:���#�DEE�HNN���$�aP��MMM={�$���{W��E]�[�"66V��>��SS���"�V�~j( �}�PJ
��8�������G�q�g��tv��#+�����P
�H.��'�D3"K���/Z����U__���m��
��P��DV����u:~��S{.]�D?T{��-�������={������������B.\� ��������0�iS�N��555�}}}���m�,�����;;;���O�666&�|�����,z�������#�������O�>������Cg���cE'Uu~�PC
�_�^@����[=����k�Y����0h���A:����'�������ff��K��r�z�z�!�e�������[B��i��Y��fF����Ol���
��t��PRR�����?��bQ;����k����������������E?h�N4q��m���n�"�PS�
������J�O�{���<yrCC�����l����j/R��k(%�z���BW�\����������S��tH���b�@�u����D���W���A�zf���������CY�>4Q����&***;;���'��/������J)���z"E�z�?�H)..��4��?������53SO��4tz ���-���FFF,K����|6�mdd$�n@��"���[^�z��������^�T|��~�A�J=O�<�0m��H�E���f��m�<r���'O���������������BF�%���?R
;�������b======�i��G�(�Jno���k��b���/Y�$11Q H�T��?�MXm�����t�z], 
G��[=����k�Y����0h����^=��oQJ=Q�\KB=C=a62��>"""!!������&..����"�)Y���'��-�tV/�|�"g]�P�#F�h3��o�M��m�d(�wA���;�n�:���6m��_�6m�C'�����������U�9���m��������0,!D��K�D�l���2v�X��@g#+�hH�������Po������}���E��e]'N���yKEZ���.r��e�M:kW,�b��w:c�?2���3j��6wI���'�=Dn���z"����m����{yyt=r��%��1QOt�o�vC<x�`��<H��x��h�IJ�[�s�����P�������K
��vLLLhh(��500���\�r��5�~N�+rRR���s]]]���LLL����K�&',��FH'2����r����NEV�q�{��~]]]HH��m�JKK�G���E=D)�3��a
����8q��������y���������U��V��������������v�Icccpp��C�)������G��z�E���'$$�3���������w��5������_�d���15��.�'��nW����@=���+��t��ZA��!���9�'�{H�:.t��t�[@��o
M��4��t�[@��o
M��4�����7o���U�*333	!_}�����JW������3g�0���O���UTTT�gE��c�@�PO:�tK$����M:+***88X�OII��i��
��z�"YO���h ��}h:�-�������?`����h>IEND�B`�g8.png0000644000175000017500000003010412271524204011371 0ustar  heikkiheikki�PNG


IHDR���U:mbKGD������� IDATx���y|u�?���j�&�m�z�P(�U,+`W�E�\����R+�������/- �W���D9",B[J)�oh�}&����9;���$M2I�z��G;��3����g>�J�V�!�;���J,*U�,�T
����x�a����4��0���G'$$��
�T
z����+W��s�UUU�|��o��f��\�r�V+p��s�@F����b�����EFFFGGo���tk���1]�`R8�
��*XT�`YP��eA�
��*XT���7n$$$2���A*�����������|�6�S=>��gNNNNN���{�����������*�a���[�l���jmm���:y����Ckkk����
l���~���w77���{�_�~������_y�
l��@���bBH��}�l*U0Pmm�����O�NIHH�;��z�(��=44t�������1�18�
=RZZz�����6�
��J��V��j5=�oHH��M�V�^�wP`;P�����SSS	!{���;��T
�G�q����|��*�a��	�~�mee�R�|����c�^|�EB���c�
l��=�:u���S���7l��K<`�pN�p����s��D"GG�A��\������;4�8�
z�������;
�q8�
��*XT�`YP��eA�
��*XT�`YP��eA�
�E�w������w����EEE-Y��<+���&�\�r�����[Kqq���������j5�1�YUUU���O'O������������M�����w�7�S�***�]�v���s������J�R��������G�m�`�r��-BEQ������fX)X�S�M555��_���_~���k��u������-[�b�P(4Ol���������|��RRR�����v�|�T
lDcc���7�]�F���������J�,HHH6[���������W��zzz�:uj�����,*U����~������[�nedd��};??���C��@ �J�MMM�����xxx�1�N��7o��]��EM�<y��M���|��*�hii�������������~�zYYYW�%���#�
���v����w�2�z����~�����[�P����j�������R�t���W�vvv�70�*U������������������������������������!C��92$$d��}��o���g��?>...::Z ����>������g�xyy����K�,�J�<|A�
������7offf����gM���e�������8p��
�������URR����������^"
g���b�����������q��%��������ccc����
x�J��ZZZ������222���233�����}��L&���4h����#""�����&33311���mmm����X���	�s������?z���P�P����,��d|f�J�T��������)�������(�4P4`��|������]]]u<�������;~�83���L�d����y������e2��Y��x����P^sB�
`*�����]�fdd����&
����Ei���9�$�V�O�<�~��3g�0���,X ��{�|x�R�6o��������k�K"���jDD/�
�y�R�[}}}NNNvv��{����������]SS��Qb�8(((444<<<<<|������...��������?��y3{
"K�0�0o����_MW���|i�(��C\\��I�l��*U]r������T$�����I����S���rAO��{����ZfE3g���	�����'$$dgg��D"�\S����/�����q��*U�����<==]�.�}Y)���R��KS???�Xl��rrr6m��k����Fz�������_�u�������_�^�����^"��sP999��7/66���<�F�Jz�������������{����w/''�������\.�����i�8�j��c���[w��%f������+������V�P[[���������D/qvvniiimme�>|����f��,���*�2�RYXX�1�niiiKK��
����`�
���O*��'����={�l�����[��A��\�r����<aX������7o����a����T*e�����S�Ly������S��S�T
�F�����_c�naa!���N	���������
�����<�k������WTT�K(����~������KH������?������������������U!��'�\�`��3�z&d��	�*X���J�)�rssKJJ���	�B��_�~�������k!�h����a���{�644�K�������|������z�����[�n����Cf�B�hoo���d����M�<y���QQQE�)�
�*X����{��i�&-**b�����2S�z>���\�xq��u��gN	������.[��o����f����>��������bf������NNNss3����o��Y������?��P��:::�������������ZEQ��T*������|��ufaxx�����O����ck���~�������={���F�P(�Jf5!���n��),�����X
,*U0�����w�jT������:�d���0������������}��;��������������Fe��w����c��]��"�(00����VMquu����3g���@�T
�$:::����������Y8����d�����������EEE�����k3{�H$�9sf||���?�ol6��������������{�<�b����������'<<|������JPP�@'P�@�0��1`�.!D$���33��|||�v3s���LJJ������'���_~���_=,,���lUmm���������O?�g�b��}/V�H4q��9s�L�<�&?~��*p�����(�4i^^^��&�I���� �&���&�g�^�������0�|�@�<<xp���\�pA�R��%
�K�R�/�0g��I�&�D"�G
��R
*�����}v���������]B���s���5�&�����577��WIII������������K���eee����~���s�t_���3m���s�6�l�

�*@/��n��E��������.G���}||�b�]S�����q��_~Y__O/�/F]�b������
h---/^<z���C�JJJ�jFQ���#������f�
z3T�6N�V����kQZII	�"=�3�������~�����$��Q]]]/^�d�L�c�T*��k�~�����O_�r��#5E������K�/���4s��
*U����XPP���_PPPPP�\MZYY���E����W�2�������������o�����7n0���f����Q�ECC������9s���7nt5�]�PL�8q���O<��5�$	���R�2��H�gJ��#���
��s�������y��;������3�
P*����������3g�0�5����=z����1b�������I�T
,TSSS^^��������r��H(�"5��������2��R��/��t�R��ccT*Uzz��S�RSSo����|�E
6l���C�4h���?EQf���R��R�,..��������r<GJ�������=|W&��4��I�V;v,99���3�n���c���K�.����7<0�k��m������EEE�[��������.,,,$$����<qX/T�f�1����G�8� ��CCC5�5�9Rsjnn����>�����lf���W�Z5}�t;;;c^>|x����n���(www�j�������� l�l�T
�����v]��pAm�����~AE�������7������������W�X���p���}��<x�����\&�I$���f.�����0���.00����taX,T��P*�����'H���T j� ������7u���/���~��o���yg.\�|����P~ct���={�<x�=�!������W(���YYY����S����.Y�����������������O�>}��(	�*T�����1�����777s������v���?00����H-�J�JMMMJJ�t�����766v�����&����v������;vLc�����i�����xyyeee��w�}s����R�q-"��O�>}���������B���WOOOwwwwww�+�J�?�}���]GG���p�������uihh���/6o�|��}f��O>��o��O��3A/*�*---%%�������������3fsjT�T����kW�Xcstttww�������kW��uwwwqqqvv��Bk�(�T
�ioo/)))**�������_
8v"�H����Yv�'H}}}Q�X����
6�������^"
�N�7v�X~ck�����;-Y�=|���������Y�RZZ�}�GW�R)�pu���D"qvv�����I$�L&��������{�jm�T
��tz�����,�"����_cB#\Dj�.]����x��qf��%K�,^�888������(Y}}}�N�)������.b+**>|X����zIcc�Q��H�R{{{ggg�D"���B���EQ...�������B�\.�D������{	!�]�_���_��@�
����>;;[{�nUU�9�!�������.G1d�f455988t�_�R�w��������3������/���#�Rmmm�O�NII����4�������_�:u�O<a�9�ZZZ�"���5����e���>��GtI�����V ����L��)��A�����c�%3�s�@$1)�>���C�wG"�`�j0*U�h�M_:�)��B�0  ���B�n��:u��k��'����NNN������?~|\\\tt����z�������))))))7�qww���cbb&L�`�3�*��.Y=zT[[������������ZSS������TWW���VWW���������������F�RY__�R�������g��#�yu�@���B�����r�\&���r�O�L&���*U�J������w�\�EEE555;�D
����������������T&��4~�@�.]�8qbCC�����o2�����i���{�2���b��3����q�� �����3g�|��7G����b��o��S�Ly���y�#>.\��������>^N�j5��kjj�ju]]�J�jhhhoo��[BHcc#=F��%����a��\����fs
r?�ki�r���'3�5��O�>�%&=���������J���iO� ��)�;����o��5k�J�������,))�D��KNN������Q���ccc�.]����o�l�����=�o����l��������bbb�L��=���o�������9t���Q��2X���z^.��a����������Z:�ry}��>*Q__�T*kkkU*UMM���0�m�o8L���}��C����1c��9s�0��J�w���,++2d��V�V���(��(��^�r�ryhh�v9�)v�[_|������j5������/_�r�
�&00���^[�`Ao�n
�ZFF=0833��\*��?��^�������w���)))j�����>�h���F������������WWW����G��K����
�����)888((��((((00��-����U*UTT�_|`X�*U�����d�����m[�|�'�|��U*UYY=@�F�^\\���������7}����u���}||D"Q����f����V�"�0;8�@���QYYI�(*::z��QQQ��%77����)))�/_f
��F����>��c��j�Badd�����y
�$Z[[����I���(��K��B�����{l��A~~~���93~�xB�P(���������``�B�
`����?���/����T*�M�������F�KaN�b�]0���~���?�t�foo�h���������?0#JOOOMM=t���[����������K�b�������'L�`�
x���\RRRVVVRRR^^^\\\^^�|���ruu�K���GDDDDD|��'���c�aaa�w�9r���M/�J��]�~��w�9q��X,fr��a�n���n��x�����j�`��LF���
������
����c��e��9s
*�X,������j��L�������G�=q��R�9r���75�6=v`��U|�
}g�^���%//�����������}�VTT���D�������?�w�1T���������N�8!��J%�_�����m+...,,,(((...**�Fr���B������B��	R�E{{����SSSU*UWm�Ba~~����90����C����{����6�G<x������
X����;w���};33������Ba���P������_FEE�1�^
�*��9s����k�^�*�;=JQ�6|WWW�S�����,JKK��i�N�8��L%���5k����0[`�t�����~ZGz$���{'M�d����Z����������8{����'�j)
;::f�����d97��
�T
l���G���k��i�G����c@@��x]ooo{{{S�s������.\�X.��B�Z�V�TL���YXX���`�V�\�����z
��(������v�Z��������Y�{�����s�N\n4j�c
�8p@�����@>
cA>�U�M��~�4�?z�h�F�{����������1�bvv�;���������+|���J�*((�������s�Nuu5EQvvv���j��PE����;�Y2}�t��a����e�!��m3�����������566:99��r���'����}������F����BO����@Q����@ �J�"�H"���b�X,�H�r9sV�d!�D�V��7���M$�T*��5{{{777ww��w�
�3f������xyy����^��l��Qc�f�:z�����/&
"--����QQQ�.��#--��w�	

5���]IIIZZ����/^�H�ioo�R���E"�B�`b��'0�V���`�����C�|�����M�6%''#�����|RTT4b�___///???///___ooo�B�$�����s����|?����f�
6@�PL�6m��i�����������]�p����������EEE|�`�����?�w�*U'�J��3f���+WBrss/_���
'
,*U�������(t��`YP��eA�
���J5+++11q��Q���(����(Jw�T��GFFR���O���q���>��SO��r�\��SO9rD�Akk�[o�$�uD�����:T&�999EGG�>}�������z�q�FBB��!C�RiHH����ZXX�ns���U�V
>\&�����������������>c����K�������^2����m��%l���M�3�m���
���W��������
�|�|b��9n����k��
���svv~���<h�����5�L>!]lz�[����R>����r��
uwt��E||<!����W�=Qeff2�JOO��U�A^�|��mK}m��A;��7���]���h�������}�
xO��g�	!�����_��������~3E���g�y��=�jh<����}Om����?2����
�B�������zG�e��=��K��m�V�����N�q�m9�=��IDAT���
���W����;0���N_�n�5�	G�'����w\c����0`�v�5k���g6�v���O�]�V�W�|�s��K�T��{��������^�rY�o�A���#�����=�J��*����K$B�?��������������D����4�'q=t�Pkkk��(�J�(KHH���~[[[�����?<����f�������#�l�������ZUUu����C�B�z�)���a���_������������cAAA��q����gm�<�!d���=���[eW��R�,,,�����jKKKHH��9sx�p��t	�D{�	D��'b�[=�����
�����|0��0��'*�����K��a��
���3��e����#����>|�~#RSS}}})������3C�]3��D�V���q�A�J�K�N!���q*Uv{���+����>}�B�m�F������~#�R�$&&4�YB�,�={6�����	!��_�%B������U���ww���2.�p��gm999�{{{m�^��mz����(��������=�jt������1c�|���<������������TVV�o����4�eO`p����X�V�o>�w��{f�3���v<�����&��F��u�V������D�	/=k������!g��e7;s�!���^�I��v����Z��3����������
W���Ot��T{��JG����2d���K����������!���z����?����o��}�����g	!/��2�=���?�L~w�R�!���:��?!$66������[c���b1!�o��:���m����={�j��)S�r�q{6������/�o�����������y����������fx�{�&-//o��)2����c��eMMM��h�[=���Xk7�V������c�Z}����^{��������������{�'�a����O�����O���	!#F�`79r$!���+=�������|�T*�Bh���X�n���om�5����Vb��T��yBHrr�Z�NJJ"�L�8����pN���i���/���,!��O�����6����r���\}��a��n��#piii7n�H$���qqq]���:Xc�l555���5j������Ny��W��sHH!�������W��m_�K�P(���g���{w}}=�R�s ������hoo7 `��4i1���Q�Z�~�����/���:u��'b�[=��D��s�����|0�����|�Q�0�d��q�w�f�.1��������Bzf�j����&]�Suww�I�4}w����Z=v�X��FQ�

}����C��=�:d��D�P(-ZTZZ���4�.�D7���)�Mqq�P(������R��UUUvvv�@��;�����RU*�'N��3g�L&���D&L��g�?�~��������!�D#l+�G�/Z�H��UTTh������gv{Zhh���D������e2��!��|��%B����R�4n������T�z�i�D}�����V�{���wB~��g�6���N ������U�!


?��s}}���g���uGn�[=��D��s�����|08�}tG��Re�D"��	�^���|�|b!=�������B����9B_�y��a�u�v������]3��D���*��(�PHQ�O<�i���������P(JJJ�<V�|�-���+����2c�f����	!���?������^��C�iO>�drr��o*��T�~4��'�,]�T�=�'n�=���d2Y|||W�Q�����0������=/^���r�J��l�VIY�h�-���:�2B}������I���������s��Yl�=���|h�Na�<|�����q��7���v�=���Yv�O�l��c�#�|2q�D�������|B�O,�gv{��V_ZZJ��e��W�T���
�5��Ov���c�����H$O<�!�����uM�<����������{���7��r�S�|B��Ot��JUG���zv�S�N1O�:E	fODd�sQZ��5j���:�H��%�
����t1V������`�=��3�
6����������nnn����
��������r��-����A�j)))�W4�|�\�N�o��]c�b���(	�>9���#�Auu��'b�[=��D��s�����6Z�(�!18]#�����M�V_^^�|�����X�������P���l����|����=����;\�U�'NB|||8�G>��Ot�u�*�>�r���]u�{������?���K���'N����hI9y�${���'	!c���6��4����#���b���_k�Y[^^!���Kc��c�!+V�0n���/�:t��{V�k�/�>V��_�����[�rY���Ms	��{3$����	��o������O�];��
������G���_�O������\���Y�F>A>����������.!��_�I������'�.F�2���(77�������������]���B>��Ot�us�~����������b��}��)��v���w���G�e�7��g�v���M89�'����_��]�F�J�{�FA���v��5e��������M�6�g}5��TxF��<D"!D�P�Y�&===''�������vKm��-f`�	�����������5n���c��X[=����>�����3!!!==����o���S%FI���|���z���h(//���5�'=�k��|B_�joo?}��S�NUVV&%%�C�
@�-�&��O��.[�m�S}���T*�(J{r���B�@ �J���=u�������m���;�9�����W�|�q�����3��
���4������4f���5���s�9r��������������E&L`�|���t�z���3���\$�D"��0=��f�'��m��'�w��������T*���su����Y�'���~e=L ��b�[=��D��s�����|08�}t�*����%�����O�'���q�7n��S����������PBHdd��d@�D�o>Q�����(	��I�&<x������c>y��gSRR����������o�N_S�%N5�	��|��qF��.pB�JU��t7���?������?B�l�����S`�I��(((����"""�7l����6l��n�%���X�~"""��t{O���N�������U��7���3��O>!�<����_
}{6���x��JU(�7S�j ��V�:^�
��@�ugm�
w�P[�Vo��;m��mrY�a=�jp��pi����]�
��	&��1�t�
���
�D�	/=w���V^\\���;}���B�k>Q�*���7S��YO���A����9��|���|�C��T��	����i�{��%�6�����f�J�+���c��qttttt3fLjj�F�a���g��12�L"�����Y��}�:u�S�����Ks��
�D����
Z�r����t|�t|���3m��������w�
�����3��N��������-[�TVV����*U�$��	��m����<y��������E��<���M�3���������F��m�B��'����G��2���U��']����t=s��O�:5i�$�\���0x�������Qw��3��S����W>Q��s��]�z����u��1��_(�L6b���>�H���n�'=g����37�V����m��JU_��V���!���?�'`{�O�b!�����V�*XT�`YP��eA�
��*XT�`YP��eA�
�E�����SRRL���~���v�Zwww���<���!��}qq1���,&&������6������!�!����+�'��%�\�re��Q�%�Z�f�������0z�h�����a�#������W=ztBB��U���u�`YP��eA�
��*X��u��l[��IEND�B`�

diff --git a/src/backend/access/nbtree/README b/src/backend/access/nbtree/README
index 03efc29..43ee75f 100644
--- a/src/backend/access/nbtree/README
+++ b/src/backend/access/nbtree/README
@@ -404,12 +404,34 @@ an additional insertion above that, etc).
 For a root split, the followon WAL entry is a "new root" entry rather than
 an "insertion" entry, but details are otherwise much the same.
 
-Because insertion involves multiple atomic actions, the WAL replay logic
-has to detect the case where a page split isn't followed by a matching
-insertion on the parent level, and then do that insertion on its own (and
-recursively for any subsequent parent insertion, of course).  This is
-feasible because the WAL entry for the split contains enough info to know
-what must be inserted in the parent level.
+Because splitting involves multiple atomic actions, it's possible that the
+system crashes between splitting a page and inserting the downlink for the
+new half to the parent. After recovery, the downlink for the new page will
+be missing. The search algorithm works correctly, as the page will be found
+by following the right-link from its left sibling, although if a lot of
+downlinks in the tree are missing, performance will suffer. A more serious
+consequence is that if the page without a downlink gets split again, the
+insertion algorithm will fail to find the location in the parent level to
+insert the downlink.
+
+Our approach is to create any missing downlinks on-they-fly, when
+searching the tree for a new insertion. It could be done during searches,
+too, but it seems best not to put any extra updates in what would otherwise
+be a read-only operation (updating is not possible in hot standby mode
+anyway). To identify missing downlinks, when a page is split, the left page
+is flagged to indicate that the split is not yet complete (INCOMPLETE_SPLIT).
+When the downlink is inserted to the parent, the flag is cleared atomically
+with the insertion. The child page is kept locked until the insertion in the
+parent is finished and the flag in the child cleared, but can be released
+immediately after that, before recursing up the tree, if the parent also
+needs to be split. This ensures that incompletely split pages should not be
+seen under normal circumstances; only when insertion to the parent fails
+for some reason.
+
+We flag the left page, even though it's the right page that's missing the
+downlink, beacuse it's more convenient to know already when following the
+right-link from the left page to the right page that it will need to have
+its downlink inserted to the parent.
 
 When splitting a non-root page that is alone on its level, the required
 metapage update (of the "fast root" link) is performed and logged as part
@@ -422,6 +444,14 @@ page is a second record.  If vacuum is interrupted for some reason, or the
 system crashes, the tree is consistent for searches and insertions.  The next
 VACUUM will find the half-dead leaf page and continue the deletion.
 
+Before 9.4, we used to keep track of incomplete splits and page deletions
+during recovery and finish them immediately at end of recovery, instead of
+doing it lazily at the next  insertion or vacuum. However, that made the
+recovery much more complicated, and only fixed the problem when crash
+recovery was performed. An incomplete split can also occur if an otherwise
+recoverable error, like out-of-memory or out-of-disk-space, happens while
+inserting the downlink to the parent.
+
 Scans during Recovery
 ---------------------
 
diff --git a/src/backend/access/nbtree/nbtinsert.c b/src/backend/access/nbtree/nbtinsert.c
index 49c084a..9d8ea10 100644
--- a/src/backend/access/nbtree/nbtinsert.c
+++ b/src/backend/access/nbtree/nbtinsert.c
@@ -58,15 +58,18 @@ static void _bt_findinsertloc(Relation rel,
 				  int keysz,
 				  ScanKey scankey,
 				  IndexTuple newtup,
+				  BTStack stack,
 				  Relation heapRel);
-static void _bt_insertonpg(Relation rel, Buffer buf,
+static void _bt_insertonpg(Relation rel, Buffer buf, Buffer cbuf,
 			   BTStack stack,
 			   IndexTuple itup,
 			   OffsetNumber newitemoff,
 			   bool split_only_page);
-static Buffer _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
-		  OffsetNumber newitemoff, Size newitemsz,
+static Buffer _bt_split(Relation rel, Buffer buf, Buffer cbuf,
+		  OffsetNumber firstright, OffsetNumber newitemoff, Size newitemsz,
 		  IndexTuple newitem, bool newitemonleft);
+static void _bt_insert_parent(Relation rel, Buffer buf, Buffer rbuf,
+				  BTStack stack, bool is_root, bool is_only);
 static OffsetNumber _bt_findsplitloc(Relation rel, Page page,
 				 OffsetNumber newitemoff,
 				 Size newitemsz,
@@ -130,7 +133,8 @@ top:
 	 * move right in the tree.	See Lehman and Yao for an excruciatingly
 	 * precise description.
 	 */
-	buf = _bt_moveright(rel, buf, natts, itup_scankey, false, BT_WRITE);
+	buf = _bt_moveright(rel, buf, natts, itup_scankey, false,
+						true, stack, BT_WRITE);
 
 	/*
 	 * If we're not allowing duplicates, make sure the key isn't already in
@@ -183,8 +187,9 @@ top:
 		 */
 		CheckForSerializableConflictIn(rel, NULL, buf);
 		/* do the insertion */
-		_bt_findinsertloc(rel, &buf, &offset, natts, itup_scankey, itup, heapRel);
-		_bt_insertonpg(rel, buf, stack, itup, offset, false);
+		_bt_findinsertloc(rel, &buf, &offset, natts, itup_scankey, itup,
+						  stack, heapRel);
+		_bt_insertonpg(rel, buf, InvalidBuffer, stack, itup, offset, false);
 	}
 	else
 	{
@@ -508,6 +513,7 @@ _bt_findinsertloc(Relation rel,
 				  int keysz,
 				  ScanKey scankey,
 				  IndexTuple newtup,
+				  BTStack stack,
 				  Relation heapRel)
 {
 	Buffer		buf = *bufptr;
@@ -569,6 +575,7 @@ _bt_findinsertloc(Relation rel,
 	while (PageGetFreeSpace(page) < itemsz)
 	{
 		Buffer		rbuf;
+		BlockNumber	rblkno;
 
 		/*
 		 * before considering moving right, see if we can obtain enough space
@@ -606,18 +613,33 @@ _bt_findinsertloc(Relation rel,
 		 */
 		rbuf = InvalidBuffer;
 
+		rblkno = lpageop->btpo_next;
 		for (;;)
 		{
-			BlockNumber rblkno = lpageop->btpo_next;
-
 			rbuf = _bt_relandgetbuf(rel, rbuf, rblkno, BT_WRITE);
 			page = BufferGetPage(rbuf);
 			lpageop = (BTPageOpaque) PageGetSpecialPointer(page);
+
+			/*
+			 * If this page was incompletely split, finish that now. We do
+			 * this while holding a lock on the left sibling, which is not
+			 * good because finishing the split could be a fairly lengthy
+			 * operation.  But this should happen very seldom.
+			 */
+			if (P_INCOMPLETE_SPLIT(lpageop))
+			{
+				_bt_finish_split(rel, rbuf, stack);
+				rbuf = InvalidBuffer;
+				continue;
+			}
+
 			if (!P_IGNORE(lpageop))
 				break;
 			if (P_RIGHTMOST(lpageop))
 				elog(ERROR, "fell off the end of index \"%s\"",
 					 RelationGetRelationName(rel));
+
+			rblkno = lpageop->btpo_next;
 		}
 		_bt_relbuf(rel, buf);
 		buf = rbuf;
@@ -663,6 +685,10 @@ _bt_findinsertloc(Relation rel,
  *		insertion, and the buffer must be pinned and write-locked.	On return,
  *		we will have dropped both the pin and the lock on the buffer.
  *
+ *		When inserting to a non-leaf page, 'cbuf' is the left-sibling of the
+ *		page we're inserting the downlink for.  This function will clear the
+ *		INCOMPLETE_SPLIT flag on it, and release the buffer.
+ *
  *		The locking interactions in this code are critical.  You should
  *		grok Lehman and Yao's paper before making any changes.  In addition,
  *		you need to understand how we disambiguate duplicate keys in this
@@ -676,6 +702,7 @@ _bt_findinsertloc(Relation rel,
 static void
 _bt_insertonpg(Relation rel,
 			   Buffer buf,
+			   Buffer cbuf,
 			   BTStack stack,
 			   IndexTuple itup,
 			   OffsetNumber newitemoff,
@@ -689,6 +716,14 @@ _bt_insertonpg(Relation rel,
 	page = BufferGetPage(buf);
 	lpageop = (BTPageOpaque) PageGetSpecialPointer(page);
 
+	/*
+	 * The caller should've finished any incomplete splits and page deletions
+	 * already
+	 */
+	if (P_INCOMPLETE_SPLIT(lpageop))
+		elog(ERROR, "cannot insert to incompletely split page %u",
+			 BufferGetBlockNumber(buf));
+
 	itemsz = IndexTupleDSize(*itup);
 	itemsz = MAXALIGN(itemsz);	/* be safe, PageAddItem will do this but we
 								 * need to be consistent */
@@ -713,7 +748,7 @@ _bt_insertonpg(Relation rel,
 									  &newitemonleft);
 
 		/* split the buffer into left and right halves */
-		rbuf = _bt_split(rel, buf, firstright,
+		rbuf = _bt_split(rel, buf, cbuf, firstright,
 						 newitemoff, itemsz, itup, newitemonleft);
 		PredicateLockPageSplit(rel,
 							   BufferGetBlockNumber(buf),
@@ -787,11 +822,21 @@ _bt_insertonpg(Relation rel,
 			MarkBufferDirty(metabuf);
 		}
 
+		/* clear INCOMPLETE_SPLIT flag on child if this finishes a split */
+		if (!P_ISLEAF(lpageop))
+		{
+			Page		cpage = BufferGetPage(cbuf);
+			BTPageOpaque cpageop = (BTPageOpaque) PageGetSpecialPointer(cpage);
+			Assert(P_INCOMPLETE_SPLIT(cpageop));
+			cpageop->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+			MarkBufferDirty(cbuf);
+		}
+
 		/* XLOG stuff */
 		if (RelationNeedsWAL(rel))
 		{
 			xl_btree_insert xlrec;
-			BlockNumber xldownlink;
+			BlockNumber xlleftchild;
 			xl_btree_metadata xlmeta;
 			uint8		xlinfo;
 			XLogRecPtr	recptr;
@@ -811,12 +856,15 @@ _bt_insertonpg(Relation rel,
 				xlinfo = XLOG_BTREE_INSERT_LEAF;
 			else
 			{
-				xldownlink = ItemPointerGetBlockNumber(&(itup->t_tid));
-				Assert(ItemPointerGetOffsetNumber(&(itup->t_tid)) == P_HIKEY);
-
-				nextrdata->data = (char *) &xldownlink;
+				/*
+				 * Include the block number of the left child, whose
+				 * INCOMPLETE_SPLIT flag is cleared.
+				 */
+				xlleftchild = BufferGetBlockNumber(cbuf);
+				nextrdata->data = (char *) &xlleftchild;
 				nextrdata->len = sizeof(BlockNumber);
-				nextrdata->buffer = InvalidBuffer;
+				nextrdata->buffer = cbuf;
+				nextrdata->buffer_std = true;
 				nextrdata->next = nextrdata + 1;
 				nextrdata++;
 
@@ -869,6 +917,8 @@ _bt_insertonpg(Relation rel,
 		END_CRIT_SECTION();
 
 		/* release buffers; send out relcache inval if metapage changed */
+		if (!P_ISLEAF(lpageop))
+			_bt_relbuf(rel, cbuf);
 		if (BufferIsValid(metabuf))
 		{
 			if (!InRecovery)
@@ -888,11 +938,15 @@ _bt_insertonpg(Relation rel,
  *		new right page.  newitemoff etc. tell us about the new item that
  *		must be inserted along with the data from the old page.
  *
+ *		When splitting a non-leaf page, 'cbuf' is the left-sibling of the
+ *		page we're inserting the downlink for. This function will clear the
+ *		INCOMPLETE_SPLIT flag on it, and release the buffer.
+ *
  *		Returns the new right sibling of buf, pinned and write-locked.
  *		The pin and lock on buf are maintained.
  */
 static Buffer
-_bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
+_bt_split(Relation rel, Buffer buf, Buffer cbuf, OffsetNumber firstright,
 		  OffsetNumber newitemoff, Size newitemsz, IndexTuple newitem,
 		  bool newitemonleft)
 {
@@ -960,6 +1014,8 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 	lopaque->btpo_flags = oopaque->btpo_flags;
 	lopaque->btpo_flags &= ~(BTP_ROOT | BTP_SPLIT_END | BTP_HAS_GARBAGE);
 	ropaque->btpo_flags = lopaque->btpo_flags;
+	/* set flag in left page indicating that the right page has no downlink */
+	lopaque->btpo_flags |= BTP_INCOMPLETE_SPLIT;
 	lopaque->btpo_prev = oopaque->btpo_prev;
 	lopaque->btpo_next = rightpagenumber;
 	ropaque->btpo_prev = origpagenumber;
@@ -1183,6 +1239,18 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 		MarkBufferDirty(sbuf);
 	}
 
+	/*
+	 * Clear INCOMPLETE_SPLIT flag on child if inserting the new item finishes
+	 * a split.
+	 */
+	if (ropaque->btpo.level > 0)
+	{
+		Page		cpage = BufferGetPage(cbuf);
+		BTPageOpaque cpageop = (BTPageOpaque) PageGetSpecialPointer(cpage);
+		cpageop->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+		MarkBufferDirty(cbuf);
+	}
+
 	/* XLOG stuff */
 	if (RelationNeedsWAL(rel))
 	{
@@ -1205,34 +1273,6 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 
 		lastrdata = &rdata[0];
 
-		if (ropaque->btpo.level > 0)
-		{
-			/* Log downlink on non-leaf pages */
-			lastrdata->next = lastrdata + 1;
-			lastrdata++;
-
-			lastrdata->data = (char *) &newitem->t_tid.ip_blkid;
-			lastrdata->len = sizeof(BlockIdData);
-			lastrdata->buffer = InvalidBuffer;
-
-			/*
-			 * We must also log the left page's high key, because the right
-			 * page's leftmost key is suppressed on non-leaf levels.  Show it
-			 * as belonging to the left page buffer, so that it is not stored
-			 * if XLogInsert decides it needs a full-page image of the left
-			 * page.
-			 */
-			lastrdata->next = lastrdata + 1;
-			lastrdata++;
-
-			itemid = PageGetItemId(origpage, P_HIKEY);
-			item = (IndexTuple) PageGetItem(origpage, itemid);
-			lastrdata->data = (char *) item;
-			lastrdata->len = MAXALIGN(IndexTupleSize(item));
-			lastrdata->buffer = buf;	/* backup block 1 */
-			lastrdata->buffer_std = true;
-		}
-
 		/*
 		 * Log the new item and its offset, if it was inserted on the left
 		 * page. (If it was put on the right page, we don't need to explicitly
@@ -1259,17 +1299,40 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 			lastrdata->buffer = buf;	/* backup block 1 */
 			lastrdata->buffer_std = true;
 		}
-		else if (ropaque->btpo.level == 0)
+
+		/* Log left page */
+		if (ropaque->btpo.level > 0)
 		{
+			lastrdata->next = lastrdata + 1;
+			lastrdata++;
+
 			/*
-			 * Although we don't need to WAL-log the new item, we still need
-			 * XLogInsert to consider storing a full-page image of the left
-			 * page, so make an empty entry referencing that buffer. This also
-			 * ensures that the left page is always backup block 1.
+			 * We must also log the left page's high key, because the right
+			 * page's leftmost key is suppressed on non-leaf levels.  Show it
+			 * as belonging to the left page buffer, so that it is not stored
+			 * if XLogInsert decides it needs a full-page image of the left
+			 * page.
 			 */
+			itemid = PageGetItemId(origpage, P_HIKEY);
+			item = (IndexTuple) PageGetItem(origpage, itemid);
+			lastrdata->data = (char *) item;
+			lastrdata->len = MAXALIGN(IndexTupleSize(item));
+			lastrdata->buffer = buf;	/* backup block 1 */
+			lastrdata->buffer_std = true;
+		}
+
+		if (ropaque->btpo.level == 0 && !newitemonleft)
+		{
 			lastrdata->next = lastrdata + 1;
 			lastrdata++;
 
+			/*
+			 * Although we don't need to WAL-log anything on the left page,
+			 * the new item, we still need XLogInsert to consider storing a
+			 * full-page image of the left page, so make an empty entry
+			 * referencing that buffer. This also ensures that the left page
+			 * is always backup block 1.
+			 */
 			lastrdata->data = NULL;
 			lastrdata->len = 0;
 			lastrdata->buffer = buf;	/* backup block 1 */
@@ -1277,6 +1340,22 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 		}
 
 		/*
+		 * Log block number of left child, whose INCOMPLETE_SPLIT flag this
+		 * insertion clears.
+		 */
+		if (ropaque->btpo.level > 0)
+		{
+			BlockNumber cblkno = BufferGetBlockNumber(cbuf);
+			lastrdata->next = lastrdata + 1;
+			lastrdata++;
+
+			lastrdata->data = (char *) &cblkno;
+			lastrdata->len = sizeof(BlockNumber);
+			lastrdata->buffer = cbuf;	/* backup block 2 */
+			lastrdata->buffer_std = true;
+		}
+
+		/*
 		 * Log the contents of the right page in the format understood by
 		 * _bt_restore_page(). We set lastrdata->buffer to InvalidBuffer,
 		 * because we're going to recreate the whole page anyway, so it should
@@ -1305,7 +1384,7 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 
 			lastrdata->data = NULL;
 			lastrdata->len = 0;
-			lastrdata->buffer = sbuf;	/* backup block 2 */
+			lastrdata->buffer = sbuf;	/* bkp block 2 (leaf) or 3 (non-leaf) */
 			lastrdata->buffer_std = true;
 		}
 
@@ -1332,6 +1411,10 @@ _bt_split(Relation rel, Buffer buf, OffsetNumber firstright,
 	if (!P_RIGHTMOST(ropaque))
 		_bt_relbuf(rel, sbuf);
 
+	/* release the child */
+	if (ropaque->btpo.level > 0)
+		_bt_relbuf(rel, cbuf);
+
 	/* split's done */
 	return rbuf;
 }
@@ -1602,10 +1685,8 @@ _bt_checksplitloc(FindSplitData *state,
  *			have to be efficient (concurrent ROOT split, WAL recovery)
  * is_root - we split the true root
  * is_only - we split a page alone on its level (might have been fast root)
- *
- * This is exported so it can be called by nbtxlog.c.
  */
-void
+static void
 _bt_insert_parent(Relation rel,
 				  Buffer buf,
 				  Buffer rbuf,
@@ -1624,8 +1705,7 @@ _bt_insert_parent(Relation rel,
 	 *
 	 * If we have to search for the parent level, we do so by re-descending
 	 * from the root.  This is not super-efficient, but it's rare enough not
-	 * to matter.  (This path is also taken when called from WAL recovery ---
-	 * we have no stack in that case.)
+	 * to matter.
 	 */
 	if (is_root)
 	{
@@ -1684,12 +1764,13 @@ _bt_insert_parent(Relation rel,
 		 * 05/27/97
 		 */
 		ItemPointerSet(&(stack->bts_btentry.t_tid), bknum, P_HIKEY);
-
 		pbuf = _bt_getstackbuf(rel, stack, BT_WRITE);
 
-		/* Now we can unlock the children */
+		/*
+		 * Now we can unlock the right child. The left child will be unlocked
+		 * by _bt_insertonpg().
+		 */
 		_bt_relbuf(rel, rbuf);
-		_bt_relbuf(rel, buf);
 
 		/* Check for error only after writing children */
 		if (pbuf == InvalidBuffer)
@@ -1697,7 +1778,7 @@ _bt_insert_parent(Relation rel,
 				 RelationGetRelationName(rel), bknum, rbknum);
 
 		/* Recursively update the parent */
-		_bt_insertonpg(rel, pbuf, stack->bts_parent,
+		_bt_insertonpg(rel, pbuf, buf, stack->bts_parent,
 					   new_item, stack->bts_offset + 1,
 					   is_only);
 
@@ -1707,6 +1788,62 @@ _bt_insert_parent(Relation rel,
 }
 
 /*
+ * _bt_finish_split() -- Finish an incomplete split
+ *
+ * A crash or other failure can leave a split incomplete. The insertion
+ * routines won't allow to insert on a page that is incompletely split.
+ * Before inserting on such a page, call _bt_finish_split().
+ *
+ * On entry, 'lbuf' must be locked in write-mode.  On exit, it is unlocked
+ * and unpinned.
+ */
+void
+_bt_finish_split(Relation rel, Buffer lbuf, BTStack stack)
+{
+	Page		lpage = BufferGetPage(lbuf);
+	BTPageOpaque lpageop = (BTPageOpaque) PageGetSpecialPointer(lpage);
+	Buffer		rbuf;
+	Page		rpage;
+	BTPageOpaque rpageop;
+	bool		was_root;
+	bool		was_only;
+
+	Assert(P_INCOMPLETE_SPLIT(lpageop));
+
+	/* Lock right sibling, the one missing the downlink */
+	rbuf = _bt_getbuf(rel, lpageop->btpo_next, BT_WRITE);
+	rpage = BufferGetPage(rbuf);
+	rpageop = (BTPageOpaque) PageGetSpecialPointer(rpage);
+
+	/* Could this be a root split? */
+	if (!stack)
+	{
+		Buffer		metabuf;
+		Page		metapg;
+		BTMetaPageData *metad;
+
+		/* acquire lock on the metapage */
+		metabuf = _bt_getbuf(rel, BTREE_METAPAGE, BT_WRITE);
+		metapg = BufferGetPage(metabuf);
+		metad = BTPageGetMeta(metapg);
+
+		was_root = (metad->btm_root == BufferGetBlockNumber(lbuf));
+
+		_bt_relbuf(rel, metabuf);
+	}
+	else
+		was_root = false;
+
+	/* Was this the only page on the level before split? */
+	was_only = (P_LEFTMOST(lpageop) && P_RIGHTMOST(rpageop));
+
+	elog(DEBUG1, "finishing incomplete split of %u/%u",
+		 BufferGetBlockNumber(lbuf), BufferGetBlockNumber(rbuf));
+
+	_bt_insert_parent(rel, lbuf, rbuf, stack, was_root, was_only);
+}
+
+/*
  *	_bt_getstackbuf() -- Walk back up the tree one step, and find the item
  *						 we last looked at in the parent.
  *
@@ -1738,6 +1875,12 @@ _bt_getstackbuf(Relation rel, BTStack stack, int access)
 		page = BufferGetPage(buf);
 		opaque = (BTPageOpaque) PageGetSpecialPointer(page);
 
+		if (access == BT_WRITE && P_INCOMPLETE_SPLIT(opaque))
+		{
+			_bt_finish_split(rel, buf, stack->bts_parent);
+			continue;
+		}
+
 		if (!P_IGNORE(opaque))
 		{
 			OffsetNumber offnum,
@@ -1842,6 +1985,7 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 				rbkno;
 	BlockNumber rootblknum;
 	BTPageOpaque rootopaque;
+	BTPageOpaque lopaque;
 	ItemId		itemid;
 	IndexTuple	item;
 	Size		itemsz;
@@ -1853,6 +1997,7 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 	lbkno = BufferGetBlockNumber(lbuf);
 	rbkno = BufferGetBlockNumber(rbuf);
 	lpage = BufferGetPage(lbuf);
+	lopaque = (BTPageOpaque) PageGetSpecialPointer(lpage);
 
 	/* get a new root page */
 	rootbuf = _bt_getbuf(rel, P_NEW, BT_WRITE);
@@ -1926,6 +2071,11 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 			 BufferGetBlockNumber(lbuf), RelationGetRelationName(rel));
 	pfree(new_item);
 
+	/* Clear the incomplete-split flag in the left child */
+	Assert(P_INCOMPLETE_SPLIT(lopaque));
+	lopaque->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+	MarkBufferDirty(lbuf);
+
 	MarkBufferDirty(rootbuf);
 	MarkBufferDirty(metabuf);
 
@@ -1934,7 +2084,7 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 	{
 		xl_btree_newroot xlrec;
 		XLogRecPtr	recptr;
-		XLogRecData rdata[2];
+		XLogRecData rdata[3];
 
 		xlrec.node = rel->rd_node;
 		xlrec.rootblk = rootblknum;
@@ -1953,7 +2103,13 @@ _bt_newroot(Relation rel, Buffer lbuf, Buffer rbuf)
 		rdata[1].len = ((PageHeader) rootpage)->pd_special -
 			((PageHeader) rootpage)->pd_upper;
 		rdata[1].buffer = InvalidBuffer;
-		rdata[1].next = NULL;
+		rdata[1].next = &(rdata[2]);
+
+		/* Make a full-page image of the left child if needed */
+		rdata[2].data = NULL;
+		rdata[2].len = 0;
+		rdata[2].buffer = lbuf;
+		rdata[2].next = NULL;
 
 		recptr = XLogInsert(RM_BTREE_ID, XLOG_BTREE_NEWROOT, rdata);
 
diff --git a/src/backend/access/nbtree/nbtpage.c b/src/backend/access/nbtree/nbtpage.c
index c38bc1c..d2832da 100644
--- a/src/backend/access/nbtree/nbtpage.c
+++ b/src/backend/access/nbtree/nbtpage.c
@@ -1026,8 +1026,13 @@ _bt_lock_branch_parent(Relation rel, BlockNumber child, BTStack stack,
 			 * It's only child, so safe if parent would itself be removable.
 			 * We have to check the parent itself, and then recurse to test
 			 * the conditions at the parent's parent.
+			 *
+			 * Also check that the page, or its left sibling, isn't
+			 * incompletely split.  These are the same checks that we already
+			 * did for the leaf page, see comments in _bt_mark_page_hlfdead().
 			 */
-			if (P_RIGHTMOST(opaque) || P_ISROOT(opaque))
+			if (P_RIGHTMOST(opaque) || P_ISROOT(opaque) ||
+				P_INCOMPLETE_SPLIT(opaque))
 			{
 				_bt_relbuf(rel, pbuf);
 				return false;
@@ -1128,7 +1133,8 @@ _bt_pagedel(Relation rel, Buffer buf)
 		 * check that page is not already deleted and is empty.
 		 */
 		if (P_RIGHTMOST(opaque) || P_ISROOT(opaque) || P_ISDELETED(opaque) ||
-			P_FIRSTDATAKEY(opaque) <= PageGetMaxOffsetNumber(page))
+			P_FIRSTDATAKEY(opaque) <= PageGetMaxOffsetNumber(page) ||
+			P_INCOMPLETE_SPLIT(opaque))
 		{
 			/* Should never fail to delete a half-dead page */
 			Assert(!P_ISHALFDEAD(opaque));
diff --git a/src/backend/access/nbtree/nbtsearch.c b/src/backend/access/nbtree/nbtsearch.c
index bc62fbc..0753420 100644
--- a/src/backend/access/nbtree/nbtsearch.c
+++ b/src/backend/access/nbtree/nbtsearch.c
@@ -51,7 +51,9 @@ static bool _bt_endpoint(IndexScanDesc scan, ScanDirection dir);
  * NOTE that the returned buffer is read-locked regardless of the access
  * parameter.  However, access = BT_WRITE will allow an empty root page
  * to be created and returned.	When access = BT_READ, an empty index
- * will result in *bufP being set to InvalidBuffer.
+ * will result in *bufP being set to InvalidBuffer.  Also, in BT_WRITE mode,
+ * any incomplete splits or half-dead pages encountered during the search
+ * will be finished.
  */
 BTStack
 _bt_search(Relation rel, int keysz, ScanKey scankey, bool nextkey,
@@ -82,8 +84,13 @@ _bt_search(Relation rel, int keysz, ScanKey scankey, bool nextkey,
 		 * Race -- the page we just grabbed may have split since we read its
 		 * pointer in the parent (or metapage).  If it has, we may need to
 		 * move right to its new sibling.  Do that.
+		 *
+		 * In write-mode, allow _bt_moveright to finish any incomplete splits
+		 * along the way.
 		 */
-		*bufP = _bt_moveright(rel, *bufP, keysz, scankey, nextkey, BT_READ);
+		*bufP = _bt_moveright(rel, *bufP, keysz, scankey, nextkey,
+							  (access == BT_WRITE), stack_in,
+							  BT_READ);
 
 		/* if this is a leaf page, we're done */
 		page = BufferGetPage(*bufP);
@@ -148,6 +155,11 @@ _bt_search(Relation rel, int keysz, ScanKey scankey, bool nextkey,
  * item >= scankey.  When nextkey is true, we are looking for the first
  * item strictly greater than scankey.
  *
+ * If forupdate is true, we will attempt to finish any incomplete splits
+ * that we encounter. This is required when searching for a target page for
+ * an insertion, because we don't allow inserting on a page with incomplete
+ * actions. 'stack' is only used if forupdate is true.
+ *
  * On entry, we have the buffer pinned and a lock of the type specified by
  * 'access'.  If we move right, we release the buffer and lock and acquire
  * the same on the right sibling.  Return value is the buffer we stop at.
@@ -158,15 +170,14 @@ _bt_moveright(Relation rel,
 			  int keysz,
 			  ScanKey scankey,
 			  bool nextkey,
+			  bool forupdate,
+			  BTStack stack,
 			  int access)
 {
 	Page		page;
 	BTPageOpaque opaque;
 	int32		cmpval;
 
-	page = BufferGetPage(buf);
-	opaque = (BTPageOpaque) PageGetSpecialPointer(page);
-
 	/*
 	 * When nextkey = false (normal case): if the scan key that brought us to
 	 * this page is > the high key stored on the page, then the page has split
@@ -184,16 +195,46 @@ _bt_moveright(Relation rel,
 	 */
 	cmpval = nextkey ? 0 : 1;
 
-	while (!P_RIGHTMOST(opaque) &&
-		   (P_IGNORE(opaque) ||
-			_bt_compare(rel, keysz, scankey, page, P_HIKEY) >= cmpval))
+	for (;;)
 	{
-		/* step right one page */
-		BlockNumber rblkno = opaque->btpo_next;
-
-		buf = _bt_relandgetbuf(rel, buf, rblkno, access);
 		page = BufferGetPage(buf);
 		opaque = (BTPageOpaque) PageGetSpecialPointer(page);
+
+		if (P_RIGHTMOST(opaque))
+			break;
+
+		/*
+		 * Finish any incomplete splits we encounter along the way.
+		 */
+		if (forupdate && P_INCOMPLETE_SPLIT(opaque))
+		{
+			BlockNumber blkno = BufferGetBlockNumber(buf);
+
+			/* upgrade our lock if necessary */
+			if (access == BT_READ)
+			{
+				LockBuffer(buf, BUFFER_LOCK_UNLOCK);
+				LockBuffer(buf, BT_WRITE);
+			}
+
+			if (P_INCOMPLETE_SPLIT(opaque))
+				_bt_finish_split(rel, buf, stack);
+			else
+				_bt_relbuf(rel, buf);
+
+			/* re-acquire the lock in the right mode, and re-check */
+			buf = _bt_getbuf(rel, blkno, access);
+			continue;
+		}
+
+		if (P_IGNORE(opaque) || _bt_compare(rel, keysz, scankey, page, P_HIKEY) >= cmpval)
+		{
+			/* step right one page */
+			buf = _bt_relandgetbuf(rel, buf, opaque->btpo_next, access);
+			continue;
+		}
+		else
+			break;
 	}
 
 	if (P_IGNORE(opaque))
diff --git a/src/backend/access/nbtree/nbtxlog.c b/src/backend/access/nbtree/nbtxlog.c
index bc376fd..8d395be 100644
--- a/src/backend/access/nbtree/nbtxlog.c
+++ b/src/backend/access/nbtree/nbtxlog.c
@@ -21,61 +21,6 @@
 #include "miscadmin.h"
 
 /*
- * We must keep track of expected insertions due to page splits, and apply
- * them manually if they are not seen in the WAL log during replay.  This
- * makes it safe for page insertion to be a multiple-WAL-action process.
- *
- * The data structure is a simple linked list --- this should be good enough,
- * since we don't expect a page split to remain incomplete for long.  In any
- * case we need to respect the order of operations.
- */
-typedef struct bt_incomplete_split
-{
-	RelFileNode node;			/* the index */
-	bool		is_root;		/* we split the root */
-	BlockNumber leftblk;		/* left half of split */
-	BlockNumber rightblk;		/* right half of split */
-} bt_incomplete_split;
-
-static List *incomplete_splits;
-
-
-static void
-log_incomplete_split(RelFileNode node, BlockNumber leftblk,
-					 BlockNumber rightblk, bool is_root)
-{
-	bt_incomplete_split *action = palloc(sizeof(bt_incomplete_split));
-
-	action->node = node;
-	action->is_root = is_root;
-	action->leftblk = leftblk;
-	action->rightblk = rightblk;
-	incomplete_splits = lappend(incomplete_splits, action);
-}
-
-static void
-forget_matching_split(RelFileNode node, BlockNumber downlink, bool is_root)
-{
-	ListCell   *l;
-
-	foreach(l, incomplete_splits)
-	{
-		bt_incomplete_split *action = (bt_incomplete_split *) lfirst(l);
-
-		if (RelFileNodeEquals(node, action->node) &&
-			downlink == action->rightblk)
-		{
-			if (is_root != action->is_root)
-				elog(LOG, "forget_matching_split: fishy is_root data (expected %d, got %d)",
-					 action->is_root, is_root);
-			incomplete_splits = list_delete_ptr(incomplete_splits, action);
-			pfree(action);
-			break;				/* need not look further */
-		}
-	}
-}
-
-/*
  * _bt_restore_page -- re-enter all the index tuples on a page
  *
  * The page is freshly init'd, and *from (length len) is a copy of what
@@ -149,23 +94,60 @@ _bt_restore_meta(RelFileNode rnode, XLogRecPtr lsn,
 	UnlockReleaseBuffer(metabuf);
 }
 
+/*
+ * _bt_clear_incomplete_split -- clear INCOMPLETE_SPLIT flag on a page
+ *
+ * This is a common subroutine of the redo functions of all the WAL record
+ * types that can insert a downlink: insert, split, and newroot.
+ */
+static void
+_bt_clear_incomplete_split(XLogRecPtr lsn, XLogRecord *record,
+						   RelFileNode rnode, BlockNumber cblock)
+{
+	Buffer buf;
+
+	buf = XLogReadBuffer(rnode, cblock, false);
+	if (BufferIsValid(buf))
+	{
+		Page		page = (Page) BufferGetPage(buf);
+
+		if (lsn > PageGetLSN(page))
+		{
+			BTPageOpaque pageop = (BTPageOpaque) PageGetSpecialPointer(page);
+			Assert((pageop->btpo_flags & BTP_INCOMPLETE_SPLIT) != 0);
+			pageop->btpo_flags &= ~BTP_INCOMPLETE_SPLIT;
+
+			PageSetLSN(page, lsn);
+			MarkBufferDirty(buf);
+		}
+		UnlockReleaseBuffer(buf);
+	}
+}
+
 static void
 btree_xlog_insert(bool isleaf, bool ismeta,
 				  XLogRecPtr lsn, XLogRecord *record)
 {
 	xl_btree_insert *xlrec = (xl_btree_insert *) XLogRecGetData(record);
 	Buffer		buffer;
+	Buffer		cbuffer = InvalidBuffer;
 	Page		page;
 	char	   *datapos;
 	int			datalen;
 	xl_btree_metadata md;
-	BlockNumber downlink = 0;
+	BlockNumber cblkno = 0;
+	int			main_blk_index;
 
 	datapos = (char *) xlrec + SizeOfBtreeInsert;
 	datalen = record->xl_len - SizeOfBtreeInsert;
-	if (!isleaf)
+	/*
+	 * if this insert finishes a split at lower level, extract the block
+	 * number of the (left) child.
+	 */
+	if (!isleaf && (record->xl_info & XLR_BKP_BLOCK(0)) == 0)
 	{
-		memcpy(&downlink, datapos, sizeof(BlockNumber));
+		memcpy(&cblkno, datapos, sizeof(BlockNumber));
+		Assert(cblkno != 0);
 		datapos += sizeof(BlockNumber);
 		datalen -= sizeof(BlockNumber);
 	}
@@ -176,8 +158,19 @@ btree_xlog_insert(bool isleaf, bool ismeta,
 		datalen -= sizeof(xl_btree_metadata);
 	}
 
-	if (record->xl_info & XLR_BKP_BLOCK(0))
-		(void) RestoreBackupBlock(lsn, record, 0, false, false);
+	if (!isleaf)
+	{
+		if (record->xl_info & XLR_BKP_BLOCK(0))
+			(void) RestoreBackupBlock(lsn, record, 0, false, false);
+		else
+			_bt_clear_incomplete_split(lsn, record, xlrec->target.node, cblkno);
+		main_blk_index = 1;
+	}
+	else
+		main_blk_index = 0;
+
+	if (record->xl_info & XLR_BKP_BLOCK(main_blk_index))
+		(void) RestoreBackupBlock(lsn, record, main_blk_index, false, false);
 	else
 	{
 		buffer = XLogReadBuffer(xlrec->target.node,
@@ -187,11 +180,7 @@ btree_xlog_insert(bool isleaf, bool ismeta,
 		{
 			page = (Page) BufferGetPage(buffer);
 
-			if (lsn <= PageGetLSN(page))
-			{
-				UnlockReleaseBuffer(buffer);
-			}
-			else
+			if (lsn > PageGetLSN(page))
 			{
 				if (PageAddItem(page, (Item) datapos, datalen,
 							ItemPointerGetOffsetNumber(&(xlrec->target.tid)),
@@ -200,11 +189,14 @@ btree_xlog_insert(bool isleaf, bool ismeta,
 
 				PageSetLSN(page, lsn);
 				MarkBufferDirty(buffer);
-				UnlockReleaseBuffer(buffer);
 			}
+			UnlockReleaseBuffer(buffer);
 		}
 	}
 
+	if (BufferIsValid(cbuffer))
+		UnlockReleaseBuffer(cbuffer);
+
 	/*
 	 * Note: in normal operation, we'd update the metapage while still holding
 	 * lock on the page we inserted into.  But during replay it's not
@@ -216,10 +208,6 @@ btree_xlog_insert(bool isleaf, bool ismeta,
 		_bt_restore_meta(xlrec->target.node, lsn,
 						 md.root, md.level,
 						 md.fastroot, md.fastlevel);
-
-	/* Forget any split this insertion completes */
-	if (!isleaf)
-		forget_matching_split(xlrec->target.node, downlink, false);
 }
 
 static void
@@ -227,6 +215,8 @@ btree_xlog_split(bool onleft, bool isroot,
 				 XLogRecPtr lsn, XLogRecord *record)
 {
 	xl_btree_split *xlrec = (xl_btree_split *) XLogRecGetData(record);
+	bool		isleaf = (xlrec->level == 0);
+	Buffer		lbuf;
 	Buffer		rbuf;
 	Page		rpage;
 	BTPageOpaque ropaque;
@@ -237,42 +227,18 @@ btree_xlog_split(bool onleft, bool isroot,
 	Size		newitemsz = 0;
 	Item		left_hikey = NULL;
 	Size		left_hikeysz = 0;
+	BlockNumber cblkno = InvalidBlockNumber;
 
 	datapos = (char *) xlrec + SizeOfBtreeSplit;
 	datalen = record->xl_len - SizeOfBtreeSplit;
 
-	/* Forget any split this insertion completes */
-	if (xlrec->level > 0)
-	{
-		/* we assume SizeOfBtreeSplit is at least 16-bit aligned */
-		BlockNumber downlink = BlockIdGetBlockNumber((BlockId) datapos);
-
-		datapos += sizeof(BlockIdData);
-		datalen -= sizeof(BlockIdData);
-
-		forget_matching_split(xlrec->node, downlink, false);
-
-		/* Extract left hikey and its size (still assuming 16-bit alignment) */
-		if (!(record->xl_info & XLR_BKP_BLOCK(0)))
-		{
-			/* We assume 16-bit alignment is enough for IndexTupleSize */
-			left_hikey = (Item) datapos;
-			left_hikeysz = MAXALIGN(IndexTupleSize(left_hikey));
-
-			datapos += left_hikeysz;
-			datalen -= left_hikeysz;
-		}
-	}
-
-	/* Extract newitem and newitemoff, if present */
+	/* Extract newitemoff and newitem, if present */
 	if (onleft)
 	{
-		/* Extract the offset (still assuming 16-bit alignment) */
 		memcpy(&newitemoff, datapos, sizeof(OffsetNumber));
 		datapos += sizeof(OffsetNumber);
 		datalen -= sizeof(OffsetNumber);
 	}
-
 	if (onleft && !(record->xl_info & XLR_BKP_BLOCK(0)))
 	{
 		/*
@@ -286,6 +252,37 @@ btree_xlog_split(bool onleft, bool isroot,
 		datalen -= newitemsz;
 	}
 
+	/* Extract left hikey and its size (still assuming 16-bit alignment) */
+	if (!isleaf && !(record->xl_info & XLR_BKP_BLOCK(0)))
+	{
+		left_hikey = (Item) datapos;
+		left_hikeysz = MAXALIGN(IndexTupleSize(left_hikey));
+		datapos += left_hikeysz;
+		datalen -= left_hikeysz;
+	}
+	/*
+	 * If this insertion finishes an incomplete split, get the block number
+	 * of the child.
+	 */
+	if (!isleaf && !(record->xl_info & XLR_BKP_BLOCK(1)))
+	{
+		memcpy(&cblkno, datapos, sizeof(BlockNumber));
+		datapos += sizeof(BlockNumber);
+		datalen -= sizeof(BlockNumber);
+	}
+
+	/*
+	 * Clear the incomplete split flag on the left sibling of the child page
+	 * this is a downlink for.
+	 */
+	if (!isleaf)
+	{
+		if (record->xl_info & XLR_BKP_BLOCK(2))
+			(void) RestoreBackupBlock(lsn, record, 2, false, false);
+		else
+			_bt_clear_incomplete_split(lsn, record, xlrec->node, cblkno);
+	}
+
 	/* Reconstruct right (new) sibling page from scratch */
 	rbuf = XLogReadBuffer(xlrec->node, xlrec->rightsib, true);
 	Assert(BufferIsValid(rbuf));
@@ -297,7 +294,7 @@ btree_xlog_split(bool onleft, bool isroot,
 	ropaque->btpo_prev = xlrec->leftsib;
 	ropaque->btpo_next = xlrec->rnext;
 	ropaque->btpo.level = xlrec->level;
-	ropaque->btpo_flags = (xlrec->level == 0) ? BTP_LEAF : 0;
+	ropaque->btpo_flags = isleaf ? BTP_LEAF : 0;
 	ropaque->btpo_cycleid = 0;
 
 	_bt_restore_page(rpage, datapos, datalen);
@@ -306,7 +303,7 @@ btree_xlog_split(bool onleft, bool isroot,
 	 * On leaf level, the high key of the left page is equal to the first key
 	 * on the right page.
 	 */
-	if (xlrec->level == 0)
+	if (isleaf)
 	{
 		ItemId		hiItemId = PageGetItemId(rpage, P_FIRSTDATAKEY(ropaque));
 
@@ -321,10 +318,10 @@ btree_xlog_split(bool onleft, bool isroot,
 
 	/* Now reconstruct left (original) sibling page */
 	if (record->xl_info & XLR_BKP_BLOCK(0))
-		(void) RestoreBackupBlock(lsn, record, 0, false, false);
+		lbuf = RestoreBackupBlock(lsn, record, 0, false, true);
 	else
 	{
-		Buffer		lbuf = XLogReadBuffer(xlrec->node, xlrec->leftsib, false);
+		lbuf = XLogReadBuffer(xlrec->node, xlrec->leftsib, false);
 
 		if (BufferIsValid(lbuf))
 		{
@@ -381,19 +378,21 @@ btree_xlog_split(bool onleft, bool isroot,
 					elog(PANIC, "failed to add high key to left page after split");
 
 				/* Fix opaque fields */
-				lopaque->btpo_flags = (xlrec->level == 0) ? BTP_LEAF : 0;
+				lopaque->btpo_flags = BTP_INCOMPLETE_SPLIT;
+				if (isleaf)
+					lopaque->btpo_flags |= BTP_LEAF;
 				lopaque->btpo_next = xlrec->rightsib;
 				lopaque->btpo_cycleid = 0;
 
 				PageSetLSN(lpage, lsn);
 				MarkBufferDirty(lbuf);
 			}
-
-			UnlockReleaseBuffer(lbuf);
 		}
 	}
 
-	/* We no longer need the right buffer */
+	/* We no longer need the buffers */
+	if (BufferIsValid(lbuf))
+		UnlockReleaseBuffer(lbuf);
 	UnlockReleaseBuffer(rbuf);
 
 	/*
@@ -404,32 +403,39 @@ btree_xlog_split(bool onleft, bool isroot,
 	 * replay, because no other index update can be in progress, and readers
 	 * will cope properly when following an obsolete left-link.
 	 */
-	if (record->xl_info & XLR_BKP_BLOCK(1))
-		(void) RestoreBackupBlock(lsn, record, 1, false, false);
-	else if (xlrec->rnext != P_NONE)
+	if (xlrec->rnext != P_NONE)
 	{
-		Buffer		buffer = XLogReadBuffer(xlrec->node, xlrec->rnext, false);
+		/*
+		 * the backup block containing right sibling is 2 or 3, depending
+		 * whether this was a leaf or internal page.
+		 */
+		int		rnext_index = isleaf ? 2 : 3;
 
-		if (BufferIsValid(buffer))
+		if (record->xl_info & XLR_BKP_BLOCK(rnext_index))
+			(void) RestoreBackupBlock(lsn, record, rnext_index, false, false);
+		else
 		{
-			Page		page = (Page) BufferGetPage(buffer);
+			Buffer		buffer;
 
-			if (lsn > PageGetLSN(page))
+			buffer = XLogReadBuffer(xlrec->node, xlrec->rnext, false);
+
+			if (BufferIsValid(buffer))
 			{
-				BTPageOpaque pageop = (BTPageOpaque) PageGetSpecialPointer(page);
+				Page		page = (Page) BufferGetPage(buffer);
 
-				pageop->btpo_prev = xlrec->rightsib;
+				if (lsn > PageGetLSN(page))
+				{
+					BTPageOpaque pageop = (BTPageOpaque) PageGetSpecialPointer(page);
 
-				PageSetLSN(page, lsn);
-				MarkBufferDirty(buffer);
+					pageop->btpo_prev = xlrec->rightsib;
+
+					PageSetLSN(page, lsn);
+					MarkBufferDirty(buffer);
+				}
+				UnlockReleaseBuffer(buffer);
 			}
-			UnlockReleaseBuffer(buffer);
 		}
 	}
-
-	/* The job ain't done till the parent link is inserted... */
-	log_incomplete_split(xlrec->node,
-						 xlrec->leftsib, xlrec->rightsib, isroot);
 }
 
 static void
@@ -1003,10 +1009,7 @@ btree_xlog_newroot(XLogRecPtr lsn, XLogRecord *record)
 	Buffer		buffer;
 	Page		page;
 	BTPageOpaque pageop;
-	BlockNumber downlink = 0;
-
-	/* Backup blocks are not used in newroot records */
-	Assert(!(record->xl_info & XLR_BKP_BLOCK_MASK));
+	BlockNumber cblkno;
 
 	buffer = XLogReadBuffer(xlrec->node, xlrec->rootblk, true);
 	Assert(BufferIsValid(buffer));
@@ -1029,10 +1032,16 @@ btree_xlog_newroot(XLogRecPtr lsn, XLogRecord *record)
 		_bt_restore_page(page,
 						 (char *) xlrec + SizeOfBtreeNewroot,
 						 record->xl_len - SizeOfBtreeNewroot);
-		/* extract downlink to the right-hand split page */
-		itup = (IndexTuple) PageGetItem(page, PageGetItemId(page, P_FIRSTKEY));
-		downlink = ItemPointerGetBlockNumber(&(itup->t_tid));
+		/* extract block number of the left-hand split page */
+		itup = (IndexTuple) PageGetItem(page, PageGetItemId(page, P_HIKEY));
+		cblkno = ItemPointerGetBlockNumber(&(itup->t_tid));
 		Assert(ItemPointerGetOffsetNumber(&(itup->t_tid)) == P_HIKEY);
+
+		/* Clear the incomplete-split flag in left child */
+		if (record->xl_info & XLR_BKP_BLOCK(0))
+			(void) RestoreBackupBlock(lsn, record, 0, false, false);
+		else
+			_bt_clear_incomplete_split(lsn, record, xlrec->node, cblkno);
 	}
 
 	PageSetLSN(page, lsn);
@@ -1042,10 +1051,6 @@ btree_xlog_newroot(XLogRecPtr lsn, XLogRecord *record)
 	_bt_restore_meta(xlrec->node, lsn,
 					 xlrec->rootblk, xlrec->level,
 					 xlrec->rootblk, xlrec->level);
-
-	/* Check to see if this satisfies any incomplete insertions */
-	if (record->xl_len > SizeOfBtreeNewroot)
-		forget_matching_split(xlrec->node, downlink, true);
 }
 
 static void
@@ -1125,59 +1130,3 @@ btree_redo(XLogRecPtr lsn, XLogRecord *record)
 			elog(PANIC, "btree_redo: unknown op code %u", info);
 	}
 }
-
-void
-btree_xlog_startup(void)
-{
-	incomplete_splits = NIL;
-}
-
-void
-btree_xlog_cleanup(void)
-{
-	ListCell   *l;
-
-	foreach(l, incomplete_splits)
-	{
-		/* finish an incomplete split */
-		bt_incomplete_split *action = (bt_incomplete_split *) lfirst(l);
-		Buffer		lbuf,
-					rbuf;
-		Page		lpage,
-					rpage;
-		BTPageOpaque lpageop,
-					rpageop;
-		bool		is_only;
-		Relation	reln;
-
-		lbuf = XLogReadBuffer(action->node, action->leftblk, false);
-		/* failure is impossible because we wrote this page earlier */
-		if (!BufferIsValid(lbuf))
-			elog(PANIC, "btree_xlog_cleanup: left block unfound");
-		lpage = (Page) BufferGetPage(lbuf);
-		lpageop = (BTPageOpaque) PageGetSpecialPointer(lpage);
-		rbuf = XLogReadBuffer(action->node, action->rightblk, false);
-		/* failure is impossible because we wrote this page earlier */
-		if (!BufferIsValid(rbuf))
-			elog(PANIC, "btree_xlog_cleanup: right block unfound");
-		rpage = (Page) BufferGetPage(rbuf);
-		rpageop = (BTPageOpaque) PageGetSpecialPointer(rpage);
-
-		/* if the pages are all of their level, it's a only-page split */
-		is_only = P_LEFTMOST(lpageop) && P_RIGHTMOST(rpageop);
-
-		reln = CreateFakeRelcacheEntry(action->node);
-		_bt_insert_parent(reln, lbuf, rbuf, NULL,
-						  action->is_root, is_only);
-		FreeFakeRelcacheEntry(reln);
-	}
-	incomplete_splits = NIL;
-}
-
-bool
-btree_safe_restartpoint(void)
-{
-	if (incomplete_splits)
-		return false;
-	return true;
-}
diff --git a/src/include/access/nbtree.h b/src/include/access/nbtree.h
index 7b26f98..3259179 100644
--- a/src/include/access/nbtree.h
+++ b/src/include/access/nbtree.h
@@ -73,6 +73,7 @@ typedef BTPageOpaqueData *BTPageOpaque;
 #define BTP_HALF_DEAD	(1 << 4)	/* empty, but still in tree */
 #define BTP_SPLIT_END	(1 << 5)	/* rightmost page of split group */
 #define BTP_HAS_GARBAGE (1 << 6)	/* page has LP_DEAD tuples */
+#define BTP_INCOMPLETE_SPLIT (1 << 7) /* right sibling's downlink is missing */
 
 /*
  * The max allowed value of a cycle ID is a bit less than 64K.	This is
@@ -178,6 +179,7 @@ typedef struct BTMetaPageData
 #define P_ISHALFDEAD(opaque)	((opaque)->btpo_flags & BTP_HALF_DEAD)
 #define P_IGNORE(opaque)		((opaque)->btpo_flags & (BTP_DELETED|BTP_HALF_DEAD))
 #define P_HAS_GARBAGE(opaque)	((opaque)->btpo_flags & BTP_HAS_GARBAGE)
+#define P_INCOMPLETE_SPLIT(opaque)	((opaque)->btpo_flags & BTP_INCOMPLETE_SPLIT)
 
 /*
  *	Lehman and Yao's algorithm requires a ``high key'' on every non-rightmost
@@ -253,7 +255,7 @@ typedef struct xl_btree_metadata
 typedef struct xl_btree_insert
 {
 	xl_btreetid target;			/* inserted tuple id */
-	/* BlockNumber downlink field FOLLOWS IF NOT XLOG_BTREE_INSERT_LEAF */
+	/* BlockNumber finishes_split field FOLLOWS IF NOT XLOG_BTREE_INSERT_LEAF */
 	/* xl_btree_metadata FOLLOWS IF XLOG_BTREE_INSERT_META */
 	/* INDEX TUPLE FOLLOWS AT END OF STRUCT */
 } xl_btree_insert;
@@ -286,19 +288,18 @@ typedef struct xl_btree_split
 	OffsetNumber firstright;	/* first item moved to right page */
 
 	/*
-	 * If level > 0, BlockIdData downlink follows.	(We use BlockIdData rather
-	 * than BlockNumber for alignment reasons: SizeOfBtreeSplit is only 16-bit
-	 * aligned.)
+	 * In the _L variants, next are OffsetNumber newitemoff and the new item.
+	 * (In the _R variants, the new item is one of the right page's tuples.)
+	 * The new item, but not newitemoff, is suppressed if XLogInsert chooses
+	 * to store the left page's whole page image.
 	 *
 	 * If level > 0, an IndexTuple representing the HIKEY of the left page
 	 * follows.  We don't need this on leaf pages, because it's the same as
 	 * the leftmost key in the new right page.	Also, it's suppressed if
 	 * XLogInsert chooses to store the left page's whole page image.
 	 *
-	 * In the _L variants, next are OffsetNumber newitemoff and the new item.
-	 * (In the _R variants, the new item is one of the right page's tuples.)
-	 * The new item, but not newitemoff, is suppressed if XLogInsert chooses
-	 * to store the left page's whole page image.
+	 * If level > 0, BlockNumber of the page whose incomplete-split flag
+	 * this insertion clears. (not aligned)
 	 *
 	 * Last are the right page's tuples in the form used by _bt_restore_page.
 	 */
@@ -642,8 +643,7 @@ extern Datum btoptions(PG_FUNCTION_ARGS);
 extern bool _bt_doinsert(Relation rel, IndexTuple itup,
 			 IndexUniqueCheck checkUnique, Relation heapRel);
 extern Buffer _bt_getstackbuf(Relation rel, BTStack stack, int access);
-extern void _bt_insert_parent(Relation rel, Buffer buf, Buffer rbuf,
-				  BTStack stack, bool is_root, bool is_only);
+extern void _bt_finish_split(Relation rel, Buffer bbuf, BTStack stack);
 
 /*
  * prototypes for functions in nbtpage.c
@@ -673,7 +673,8 @@ extern BTStack _bt_search(Relation rel,
 		   int keysz, ScanKey scankey, bool nextkey,
 		   Buffer *bufP, int access);
 extern Buffer _bt_moveright(Relation rel, Buffer buf, int keysz,
-			  ScanKey scankey, bool nextkey, int access);
+			  ScanKey scankey, bool nextkey,
+			  bool finishsplits, BTStack stack,  int access);
 extern OffsetNumber _bt_binsrch(Relation rel, Buffer buf, int keysz,
 			ScanKey scankey, bool nextkey);
 extern int32 _bt_compare(Relation rel, int keysz, ScanKey scankey,
@@ -722,8 +723,5 @@ extern void _bt_leafbuild(BTSpool *btspool, BTSpool *spool2);
  */
 extern void btree_redo(XLogRecPtr lsn, XLogRecord *record);
 extern void btree_desc(StringInfo buf, uint8 xl_info, char *rec);
-extern void btree_xlog_startup(void);
-extern void btree_xlog_cleanup(void);
-extern bool btree_safe_restartpoint(void);
 
 #endif   /* NBTREE_H */
diff --git a/src/include/access/rmgrlist.h b/src/include/access/rmgrlist.h
index c968101..d9ee57d 100644
--- a/src/include/access/rmgrlist.h
+++ b/src/include/access/rmgrlist.h
@@ -36,7 +36,7 @@ PG_RMGR(RM_RELMAP_ID, "RelMap", relmap_redo, relmap_desc, NULL, NULL, NULL)
 PG_RMGR(RM_STANDBY_ID, "Standby", standby_redo, standby_desc, NULL, NULL, NULL)
 PG_RMGR(RM_HEAP2_ID, "Heap2", heap2_redo, heap2_desc, NULL, NULL, NULL)
 PG_RMGR(RM_HEAP_ID, "Heap", heap_redo, heap_desc, NULL, NULL, NULL)
-PG_RMGR(RM_BTREE_ID, "Btree", btree_redo, btree_desc, btree_xlog_startup, btree_xlog_cleanup, btree_safe_restartpoint)
+PG_RMGR(RM_BTREE_ID, "Btree", btree_redo, btree_desc, NULL, NULL, NULL)
 PG_RMGR(RM_HASH_ID, "Hash", hash_redo, hash_desc, NULL, NULL, NULL)
 PG_RMGR(RM_GIN_ID, "Gin", gin_redo, gin_desc, gin_xlog_startup, gin_xlog_cleanup, NULL)
 PG_RMGR(RM_GIST_ID, "Gist", gist_redo, gist_desc, gist_xlog_startup, gist_xlog_cleanup, NULL)

commit 8437d7d23a4978923989aa2696268f7eefbfc034
Author: Heikki Linnakangas <heikki.linnakangas@iki.fi>
Date:   Wed Feb 5 09:46:10 2014 +0200

    Fix _bt_moveright again.
    
    Forgot to assign result of _bt_getbuf

diff --git a/src/backend/access/nbtree/nbtinsert.c b/src/backend/access/nbtree/nbtinsert.c
index 4d60ae0..9d8ea10 100644
--- a/src/backend/access/nbtree/nbtinsert.c
+++ b/src/backend/access/nbtree/nbtinsert.c
@@ -1794,8 +1794,8 @@ _bt_insert_parent(Relation rel,
  * routines won't allow to insert on a page that is incompletely split.
  * Before inserting on such a page, call _bt_finish_split().
  *
- * On entry, we hold write-mode lock on it, and the lock is released on
- * exit.
+ * On entry, 'lbuf' must be locked in write-mode.  On exit, it is unlocked
+ * and unpinned.
  */
 void
 _bt_finish_split(Relation rel, Buffer lbuf, BTStack stack)
diff --git a/src/backend/access/nbtree/nbtsearch.c b/src/backend/access/nbtree/nbtsearch.c
index d4220d9..0753420 100644
--- a/src/backend/access/nbtree/nbtsearch.c
+++ b/src/backend/access/nbtree/nbtsearch.c
@@ -210,22 +210,20 @@ _bt_moveright(Relation rel,
 		{
 			BlockNumber blkno = BufferGetBlockNumber(buf);
 
+			/* upgrade our lock if necessary */
 			if (access == BT_READ)
 			{
-				/* upgrade the lock, and re-check */
 				LockBuffer(buf, BUFFER_LOCK_UNLOCK);
 				LockBuffer(buf, BT_WRITE);
-				if (P_INCOMPLETE_SPLIT(opaque))
-				{
-					_bt_finish_split(rel, buf, stack);
-					_bt_getbuf(rel, blkno, access);
-				}
 			}
-			else
-			{
+
+			if (P_INCOMPLETE_SPLIT(opaque))
 				_bt_finish_split(rel, buf, stack);
-				_bt_getbuf(rel, blkno, access);
-			}
+			else
+				_bt_relbuf(rel, buf);
+
+			/* re-acquire the lock in the right mode, and re-check */
+			buf = _bt_getbuf(rel, blkno, access);
 			continue;
 		}