patchFix UX issue with commit-graph.lock

We use the lockfile API to avoid multiple Git processes from writing to the commit-graph file in the .git/objects/info directory. In some cases, this directory may not exist, so we check for its existence.

The existing code does the following when acquiring the lock:

1. Try to acquire the lock.
2. If it fails, try to create the .git/object/info directory.
3. Try to acquire the lock, failing if necessary.

The problem is that if the lockfile exists, then the mkdir fails, giving an error that doesn't help the user:

  "fatal: cannot mkdir .git/objects/info: File exists"

While technically this honors the lockfile, it does not help the user.

Instead, do the following:

1. Check for existence of .git/objects/info; create if necessary.
2. Try to acquire the lock, failing if necessary.

The new output looks like:

  fatal: Unable to create '/home/stolee/git/.git/objects/info/commit-graph.lock': File exists.

  Another git process seems to be running in this repository, e.g.
  an editor opened by 'git commit'. Please make sure all processes
  are terminated then try again. If it still fails, a git process
  may have crashed in this repository earlier:
  remove the file manually to continue.

This patch is based on ds/generation-numbers

Derrick Stolee (1):
  commit-graph: fix UX issue when .lock file exists

 commit-graph.c | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

base-commit: 7547b95b4fbb8591726b1d9381c176cc27fc6aea

The commit-graph file lives in the .git/objects/info directory. Previously, a failure to acquire the commit-graph.lock file was assumed to be due to the lack of the info directory, so a mkdir() was called. This gave incorrect messaging if instead the lockfile was open by another process:

  "fatal: cannot mkdir .git/objects/info: File exists"

Rearrange the expectations of this directory existing to avoid this error, and instead show the typical message when a lockfile already exists.

Signed-off-by: Derrick Stolee <dstolee@microsoft.com>
---
 commit-graph.c | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

On Wed, May 09, 2018 at 02:15:38PM +0000, Derrick Stolee wrote:

Sounds like a reasonable bug fix.

Your cover letter is way longer than this description. Should some of that background perhaps go in the commit message?

(I would go so far as to say that sending a cover letter for a single patch is an anti-pattern, because the commit message should be able to stand on its own).

The result is racy if somebody else is trying to create the directory at the same time. For that you'd want to notice EEXIST coming from mkdir and consider that a success.

I think you probably ought to be calling adjust_shared_perm() on the result, too, in case core.sharedrepository is configured.

If you use safe_create_leading_directories(), it should handle both. Something like:

  if (safe_create_leading_directories(graph_name))
	die_errno(_("unable to create leading directories of %s"),
		  graph_name));

I think I'm holding it right; that function is a little short on documentation, but it's the standard way to do this in Git's codebase, and you can find lots of example callers.

-Peff

On 5/9/2018 10:42 AM, Jeff King wrote:

I did want a place to include the full die() message in the new behavior, but that seemed like overkill for the commit message.

Thanks for this method. I was unfamiliar with it. Saves the effort of creating the strbuf, too.

Thanks, -Stolee

On Wed, May 09, 2018 at 10:53:56AM -0400, Derrick Stolee wrote:

I think it would be fine. In general, it's probably a good idea to err on the side of more information in the commit message than less. The one exception is that if your commit message grows very long, make sure it's organized well. I find there are two "modes" in which I read old commit messages:

  1. Skimming through log, etc, to try to get the gist of what the
     commit is doing and find out whether it might be related to my
     problem.

  2. Once I've identified it as a problem, I want to know every single
     thing in the mind of the writer that might help me.

(I'm not speaking to this particular message or your messages in general here; I just didn't want to claim that a blanket "longer is better" is without limitations).

-Peff

On Wed, May 9, 2018 at 4:15 PM, Derrick Stolee <dstolee@microsoft.com> wrote:

This to me is a much better description than the current commit message in 1/1 and probably should be the commit message of 1/1.

Derrick Stolee <dstolee@microsoft.com> writes:

Isn't a better immediate fix to make the second step pay attention to errno? If mkdir() failed due to EEXIST, then we know we tried to aquire the lock already, so we can die with an appropriate message.

That way, we can keep the "optimize for the normal case" that the approach to assume object/info/ directory is already there, instead of always checking its existence which is almost always true beforehand.

Also, can't we tell why we failed to acquire the lock at step #1? Do we only get a NULL that says "I am not telling you why, but we failed to lock"? What I am getting at is that the ideal sequence would be more like:

    1. Try to acquire the lock.
    2-a. if #1 succeeds, we are happy. ignore the rest and return
         the lock.
    2-b. if #1 failed because object/info/ did not exist,
         mkdir() it, and die if we cannot, saying "cannot mkdir".
	 if mkdir() succeeds, jump t 3.
    2-c. if #1 failed but that is not due to missing object/info/,
	 die saying "cannot lock".
    3. Try to acquire the lock.
    4-a. if #3 succeeds, we are happy.ignore the rest and return
         the lock.
    4-b. die saying "cannot lock".

On 5/10/2018 3:00 AM, Junio C Hamano wrote:

This "optimize for the normal case" is why the existing code is organized the way it is.

Since this code is only for writing a commit-graph file, this "check the directory first" option is a very small portion of the full time to write the file, so the "optimization" has very little effect, relatively. My personal opinion is to make the code cleaner when the performance difference is negligible.

I'm willing to concede this point and use the steps you suggest below, if we think this is the best way forward.

To tell why we failed to acquire the lock, we could inspect "errno". However, this requires whitebox knowledge of both the lockfile API and the tempfile API to know that the last system call to set errno was an open() or adjust_shared_perm(). To cleanly make decisions based on the reason the lock failed to acquire, I think we would need to modify the lockfile and tempfile APIs to return a failure reason. This could be done by passing an `int *reason`, but the extra noise in these APIs is likely not worth the change.

Thanks, -Stolee

Derrick Stolee <stolee@gmail.com> writes:

That depends on your viewpoint. We can make it a part of documented API so that we keep the promise of preserving errno in the error codepath when we update these APIs and then you do not have to worry about errno being whitebox knowledge ;-).

We use the lockfile API to avoid multiple Git processes from writing to the commit-graph file in the .git/objects/info directory. In some cases, this directory may not exist, so we check for its existence.

The existing code does the following when acquiring the lock:

1. Try to acquire the lock.
2. If it fails, try to create the .git/object/info directory.
3. Try to acquire the lock, failing if necessary.

The problem is that if the lockfile exists, then the mkdir fails, giving an error that doesn't help the user:

  "fatal: cannot mkdir .git/objects/info: File exists"

While technically this honors the lockfile, it does not help the user.

Instead, do the following:

1. Check for existence of .git/objects/info; create if necessary.
2. Try to acquire the lock, failing if necessary.

The new output looks like:

  fatal: Unable to create
  '<dir>/.git/objects/info/commit-graph.lock': File exists.

  Another git process seems to be running in this repository, e.g.
  an editor opened by 'git commit'. Please make sure all processes
  are terminated then try again. If it still fails, a git process
  may have crashed in this repository earlier:
  remove the file manually to continue.

Helped-by: Jeff King <peff@peff.net>
Signed-off-by: Derrick Stolee <dstolee@microsoft.com>
---
 commit-graph.c | 22 +++++-----------------
 1 file changed, 5 insertions(+), 17 deletions(-)

On Thu, May 10, 2018 at 05:42:52PM +0000, Derrick Stolee wrote:

This version looks good to me. Thanks!

-Peff