BTW, now that I've wrapped my head around what's happening here, I believe that -DREALLOCATE_BITMAPSETS is introducing a bug where there was none before. The changes that left-join removal makes won't cause any of these sets to go to empty, so the bms_del_member calls won't free the sets but just modify them in-place. And the same change will/should be made in every relevant relid set, so the fact that the sets may be shared isn't hurting anything.
This is, of course, pretty fragile and I'm totally on board with making it safer. But there's no live bug in released branches, and not in HEAD either unless you add -DREALLOCATE_BITMAPSETS. That accounts for the lack of related field reports, and it means we don't really need to back-patch anything. This conclusion also reinforces my previously-vague feeling that we should not consider making -DREALLOCATE_BITMAPSETS the default in debug builds, as was proposed upthread. It's really a fundamentally different behavior, and I strongly suspect that it can mask bugs as well as introduce them (by hiding sharing in cases that'd be less benign than this turns out to be). I'd rather not do development on top of bitmapset infrastructure that acts entirely different from production bitmapset infrastructure. regards, tom lane