Re: [PATCH] setup: copy repository_format using helper

From: Glen Choo <chooglen@google.com>
Date: Jun 13, 2023, 18:25 UTC
Message-ID: <kl6llegnfccw.fsf@chooglen-macbookpro.roam.corp.google.com>
In-Reply-To: <9fb6d7b1-00b6-93ee-efec-9dd0ab91a66d@github.com>

Victoria Dye <vdye@github.com> writes:

Show 33 quoted lines

>> - All of them 'copy' .partial_clone. Most perform a shallow copy of the
>>   pointer, then set the .partial_clone = NULL so that it doesn't get
>>   cleared by clear_repository_format(). However,
>>   check_repository_format() copies the string deeply because the
>>   repository_format is sometimes read back (it is an "out" parameter).
>>   To accomodate both shallow copying and deep copying, toggle this
>>   behavior using the "modify_fmt_ok" parameter.
>
> Do you have a specific example of this happening? I see two uses of
> 'check_repository_format()' in the codebase:
>
> 1. in 'enter_repo()' ('path.c')
> 2. in 'init_db()' ('init-db.c')
>
> The first one calls 'check_repository_format()' with 'NULL', which causes
> the function to create a temporary 'struct repository_format' that is then
> discarded at the end of the function - no need to worry about the value
> being cleared there.
>
> The second one does call 'check_repository_format()' with a 'struct
> repository_format' instance, but the 'partial_clone' field field is not
> accessed again after that. The only subsequent usages of the 'repo_fmt'
> variable in 'init_db()' are:
>
> - in 'validate_hash_algorithm()', where only the 'version' and 'hash_algo'
>   fields are accessed.
> - in 'create_default_files()', where only 'hash_algo' is accessed.
>
> So, shouldn't it be safe to shallow-copy-and-NULL? But as I noted earlier
> [1], if you do that it'll make the name 'check_repository_format()' a bit
> misleading (since it's actually modifying its arg in place). So, if you
> update to always shallow copy, 'check_repository_format()' should be renamed
> to reflect its side effects.

My understanding of check_repository_format() is that it serves double duty of doing a) setup of the_repository and b) populating an "out" parameter with the appropriate values. IMO a) is the side effect that could warrant the rename, and b) is the expected, "read-only" use case. From that perspective, doing a shallow copy here isn't really introducing a weird side-effect (because the arg to an "out" parameter should be zero-ed out to begin with), but it's returning a 'wrong' value. You're right that it's safe because the NULL-ed value isn't read back right now, but it's not any good if this function gains more callers.

Your point about not having side effects in check_*() is a good one though, and I'm starting to feel doubtful that we should be doing setup there either....

Show 10 quoted lines

>> If you're comfortable with it, I would prefer for you to squash this
>> into your patches so that we don't just end up changing the same few
>> lines. If not, I'll Reviewed-by your patches (if I don't find any other
>> concerns on a re-read) and send this as a 1-patch on top.
>
> Reading through the commit message & patch, I'm still not convinced this
> refactor is a good idea - to me, it doesn't leave the code in a clearly
> better state. If you feel strongly that it does, though, I'm happy to leave
> it to others to review/decide but I would prefer that you keep it a separate
> patch submission on top.

Okay. Given how weird check_repository_format() and discover_git_directory() are, I think we haven't done enough investigation to properly consolidate this logic, and doing that introduces quite a lot of scope creep. It feels very unsatisfactory that we are propagating a pattern that is suspicious in some places and outright wrong in others instead of cleaning up as we go and leaving it in a better state for future authors, but this series does leave some _other_ parts in a better state (removing the global), and I think it's still a net positive.

The helper function might not be a good idea yet, but I'm convinced that removing the setup from discover_git_directory() is a good idea. I think this series would be in a better state if we get rid of the wrong pattern instead of extending it. Unfortunately, I forgot to include that change in the patch I sent (ugh) but here's a patch that _just_ includes the discover_git_directory() change that I hope you can squash into your series (and you can use whatever bits of my commit message you see fit).

----- >8 --------- >8 --------- >8 --------- >8 --------- >8 ----

  diff --git a/setup.c b/setup.c
  index 33ce58676f..b172ffd48a 100644
  --- a/setup.c
  +++ b/setup.c
  @@ -1422,14 +1422,6 @@ int discover_git_directory(struct strbuf *commondir,
      return -1;
    }

  -	the_repository->repository_format_worktree_config =
  -		candidate.worktree_config;
  -
  -	/* take ownership of candidate.partial_clone */
  -	the_repository->repository_format_partial_clone =
  -		candidate.partial_clone;
  -	candidate.partial_clone = NULL;
  -
    clear_repository_format(&candidate);
    return 0;
  }

----- >8 --------- >8 --------- >8 --------- >8 --------- >8 ----

You can see that this patch based on top of yours passes CI

  https://github.com/git/git/commit/9469fe3a6b0efbe89d26ef096a2eebabea59c55f
  https://github.com/chooglen/git/actions/runs/5258672473

> I think you may be missing changes to 'discover_git_directory()'? Like I
> mentioned above, though, if you don't think 'discover_git_directory()' needs
> to set up 'the_repository', then those assignments should just be removed
> (not replaced with 'setup_repository_from_format()').

Ah sorry, yes they were meant to be removed. I somehow missed those as I was preparing the patch.