That case involves a subtransaction that has already subcommitted being forced to abort. This reminded me of what Tomas said about it being weird that the TOAST table's entry appears to be for a committing transaction, yet other evidence suggests that the same XID aborted.
I asked Opus 5 to build a test case (based on one from Andrey Borodin on that other thread) that produces symptoms consistent with Pavel's report. It succeeded in doing so -- see the attached patch adding these tests.
These tests fail, demonstrating the same symptoms (you might have to comment-out an assertion in clog.c to allow the script to get as far as executing the pageinspect steps that show those specific details). With Bryan Green's bug fix patch from the other thread applied, the tests all pass.
Of course, I'm not claiming that this is incontrovertible proof that Pavel's case was an example of this bug causing corruption in the field; other bugs have had similar symptoms. For example, the snapshot export bug I'm working on [1] can make committed subxacts temporarily appear to have aborted, albeit on a standby (that one doesn't fit Pavel's reported symptoms but isn't too far off). I still think this explanation has a decent chance of being the correct one.
With that said, Pavel should look at this test case and try to find any factor that might rule this explanation out. It would be worth working out which ERROR actually happened. We simulate an OOM or other error using the test's subxact-after-childxids-transfer injection point; we don't know what ERROR actually occurred in the field (if we assume this really was the bug involved, then some specific error must have triggered it).
Question for Pavel: When I run the failing test, I see "WARNING: AbortSubTransaction while in COMMIT state" in the test server logs. Do any of the logs that you collected show that? If they do, then this diagnosis is almost certainly correct.
I'll ask the customer - now he it out of office, but I afraid so logs from this time are already thrown
but I remember so on same server we found a vaccum errors "cannot to freeze commtted xmax" - I don't know if this is related to this bug, but it was few weeks after problem with broken TOAST
