If I understand correctly, it's intended that GetSharedSecurityLabel()should be callable before the shared relcaches are built. If so, thesystable_beginscan can't pass an unconditional 'true' for indexOK.
Patch attached.
Regards, Jeff Davis