patchmv: refresh stat info for moved entry

From: Victoria Dye <vdye@github.com>

Add 'refresh_cache_entry()' after moving the index entry in 'rename_index_entry_at()'. Internally, 'git mv' uses 'rename_index_entry_at()' to move the source index entry to the destination, overwriting the old entry if '-f' is specified. However, it does not refresh the stat information on destination index entry, making its 'CE_UPTODATE' flag out-of-date until the index is refreshed (e.g., by 'git status').

Some commands, such as 'git reset', assume the 'CE_UPTODATE' information they read from the index is accurate, and use that information to determine whether the operation can be done successfully or not. In order to ensure the index is correct for commands such as these, explicitly refresh the destination index entry in 'git mv' before exiting.

Reported-by: Maximilian Reichel <reichemn@icloud.com>
Signed-off-by: Victoria Dye <vdye@github.com>
---
    mv: refresh stat info for moved entry
    
    This patch fixes a bug [1] encountered when executing 'git reset --merge
    HEAD' immediately after 'git mv -f' overwrites an existing index entry.
    Because the 'CE_UPTODATE' flag is not refreshed on the destination entry
    (and therefore incorrectly appeared to not be "up-to-date"), 'git reset
    --merge HEAD' fails when it should otherwise succeed.
    
    To avoid exiting 'git mv' with a stale index that may affect subsequent
    commands, 'rename_index_entry_at()' (used internally by 'git mv') is
    updated to refresh the destination index entry's stat information after
    the move is complete.
    
    [1]
    https://lore.kernel.org/git/84FF8F9A-3A9A-4F2A-8D8E-5D50F2F06203@icloud.com/

Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-1187%2Fvdye%2Freset%2Fmerge-inconsistency-v1
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-1187/vdye/reset/merge-inconsistency-v1
Pull-Request: https://github.com/gitgitgadget/git/pull/1187

 read-cache.c  |  1 +
 t/t7001-mv.sh | 11 +++++++++++
 2 files changed, 12 insertions(+)

On 3/24/2022 9:56 PM, Victoria Dye via GitGitGadget wrote:

Good find. Thanks for the fix!

Thanks for the report, Maximilian!

It certainly seems reasonable to add this line. I was unfamiliar with this method, and it is used only twice: when creating a new cache entry in make_cache_entry() and in merge-recursive.c's add_cache_info(). So, it is currently acting in the case of a newly-inserted cache entry in its existing cases, and here in 'git mv' that's essentially what we are doing (deleting the old and adding a new would be more appropriate than just moving the old one).

I took a brief detour thinking about performance, but this is
run only once per command-line argument, so any new overhead
is minimal.
  

Is there any post-condition on the index that we want to check here?

That is, is there anything that we could notice via 'git status' or similar that would break before this patch (assuming we put a test_might_fail in front of the 'git reset --merge HEAD' line)?

Thanks, -Stolee

Derrick Stolee wrote:

While looking into this, I realized 1) that I wasn't actually refreshing the cache entry because 'refresh_cache_entry' doesn't work in-place (will fix in the next version) and 2) the test was only passing because of a race condition that (as of right now) I can't quite figure out.

If I add a 'sleep 1' after the 'git add', the test behaves as I expect: fails when 'mv' doesn't refresh the entry, passes when it does. However, when the sleep *isn't* there and I'm testing 'git mv' without the refresh, most of the time the test *doesn't* fail (sometimes it does, but not reliably). I'm going to try finding the root cause of that before sending V2, in case I'm missing something else that should be fixed.

But to answer your question, yes - 'git diff-files' will produce an empty result if the cache is reset properly, and will be non-empty if it is not. I'll include that in the re-roll as well.

"Victoria Dye via GitGitGadget" <gitgitgadget@gmail.com> writes:

This is a bit unforunate.

If we are renaming "foo" to "bar", I wonder if we can grab the cached stat info before calling remove_index_entry_at() for "foo" and copy it to the new entry we create for "bar". After all, we would be making a corresponding change to rename from "foo" to "bar" at the filesystem level, too, no?

Well, we are already doing that by calling copy_cache_entry(). So why do we further need to refresh the cache entry in the first place? There is something fishy going on, isn't it?

Puzzling...

In any case, refresh_cache_entry() either returns ce or create a newly allocated entry, so you'd want to first refresh and then the add the cache entry returned from the function to the index, I think.

Thanks.

Junio C Hamano wrote:

After some more debugging, I found that the exact trigger for the "not uptodate" error is a mismatch between the 'ctime' logged in the index entry and the 'ctime' found on disk. Because we're copying stat information over directly from the original index entry in 'git mv', the 'ctime' does *not* reflect the time of file renaming, leading to the error later.

I think this explains all of the behavior we've seen so far:

1. Any index-refreshing operation run after 'git mv' would prevent the 'git
   reset --merge' error, since the ctime would be updated.
2. The error doesn't happen when the file is created within ~1 second of the
   'git mv' (noticed in the test earlier today [1]), since the 'ctime' would
   be seen as "matching" between the index and on-disk.
3. Adding 'refresh_cache_entry()' (and assigning the return value properly,
   unlike in V1 of this patch) avoids the error for the same reason as #1.

So, based on that, I think a "refresh" at the end of 'rename_index_entry_at()' is still needed, but only the stat info needs to be updated. If that sounds reasonable, I'll send V2 with that change and update the test to more appropriately test this scenario.

Thanks!

[1] https://lore.kernel.org/git/d03a34e6-d6a7-6ddb-5784-57078e32ab89@github.com/

From: Victoria Dye <vdye@github.com>

Update the stat info of the moved index entry in 'rename_index_entry_at()' if the entry is up-to-date with the index. Internally, 'git mv' uses 'rename_index_entry_at()' to move the source index entry to the destination. However, it directly copies the stat info of the original cache entry, which will not reflect the 'ctime' of the file renaming operation that happened as part of the move. If a file is otherwise up-to-date with the index, that difference in 'ctime' will make the entry appear out-of-date until the next index-refreshing operation (e.g., 'git status').

Some commands, such as 'git reset', use the cached stat information to determine whether a file is up-to-date; if this information is incorrect, the command will fail when it should pass. In order to ensure a moved entry is evaluated as 'up-to-date' when appropriate, refresh the destination index entry's stat info in 'git mv' if and only if the file is up-to-date.

Note that the test added in 't7001-mv.sh' requires a "sleep 1" to ensure the 'ctime' of the file creation will be definitively older than the 'ctime' of the renamed file in 'git mv'.

Reported-by: Maximilian Reichel <reichemn@icloud.com>
Signed-off-by: Victoria Dye <vdye@github.com>
---
    mv: refresh stat info for moved entry
    
    This patch fixes a bug [1] encountered when executing 'git reset --merge
    HEAD' immediately after 'git mv'. Because the stat info of the original
    entry is copied to the new one, including all cached stat information,
    the 'ctime' isn't updated corresponding to the rename. If the index
    entry is otherwise up-to-date with the contents on-disk, the incorrect
    'ctime' makes subsequent operations (e.g., 'git reset --merge') identify
    the index entry as out-of-date, failing when they should succeed.
    
    Note, however, that we use 'refresh_cache_entry()' to refresh the stat
    information rather than 'fill_stat_cache_info()' directly because the
    stat information should only be updated if the index entry is up-to-date
    with the file on-disk. If we ignored this distinction, the stat info
    would match the state of unstaged changes on-disk, not the entry in the
    index as it should.
    
    To avoid exiting 'git mv' with a stale index that may affect subsequent
    commands, 'rename_index_entry_at()' (used internally by 'git mv') is
    updated to refresh the destination index entry's stat information after
    the move is complete.
    
    [1]
    https://lore.kernel.org/git/84FF8F9A-3A9A-4F2A-8D8E-5D50F2F06203@icloud.com/
    
    
    Changes since V1
    ================
    
     * Determined the exact cause of the failure (the mismatched 'ctime'),
       as well as the reasoning for why the stat information cannot always
       be updated; revised the implementation accordingly.
     * Fixed usage of 'refresh_cache_entry()'; because it does not update
       cache entries in-place, insert its return value into the index (if
       valid), and discard the no-longer-needed 'new_entry' cache entry.
     * Updated the test for the bug report scenario to wait long enough such
       that the 'ctime' of the 'mv' is distinct from the original file
       creation time.

Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-1187%2Fvdye%2Freset%2Fmerge-inconsistency-v2
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-1187/vdye/reset/merge-inconsistency-v2
Pull-Request: https://github.com/gitgitgadget/git/pull/1187

Range-diff vs v1:

 1:  fe9f5f0d8ec ! 1:  bde58070eda mv: refresh stat info for moved entry
     @@ Metadata
       ## Commit message ##
          mv: refresh stat info for moved entry
      
     -    Add 'refresh_cache_entry()' after moving the index entry in
     -    'rename_index_entry_at()'. Internally, 'git mv' uses
     -    'rename_index_entry_at()' to move the source index entry to the destination,
     -    overwriting the old entry if '-f' is specified. However, it does not refresh
     -    the stat information on destination index entry, making its 'CE_UPTODATE'
     -    flag out-of-date until the index is refreshed (e.g., by 'git status').
     +    Update the stat info of the moved index entry in 'rename_index_entry_at()'
     +    if the entry is up-to-date with the index. Internally, 'git mv' uses
     +    'rename_index_entry_at()' to move the source index entry to the destination.
     +    However, it directly copies the stat info of the original cache entry, which
     +    will not reflect the 'ctime' of the file renaming operation that happened as
     +    part of the move. If a file is otherwise up-to-date with the index, that
     +    difference in 'ctime' will make the entry appear out-of-date until the next
     +    index-refreshing operation (e.g., 'git status').
      
     -    Some commands, such as 'git reset', assume the 'CE_UPTODATE' information
     -    they read from the index is accurate, and use that information to determine
     -    whether the operation can be done successfully or not. In order to ensure
     -    the index is correct for commands such as these, explicitly refresh the
     -    destination index entry in 'git mv' before exiting.
     +    Some commands, such as 'git reset', use the cached stat information to
     +    determine whether a file is up-to-date; if this information is incorrect,
     +    the command will fail when it should pass. In order to ensure a moved entry
     +    is evaluated as 'up-to-date' when appropriate, refresh the destination index
     +    entry's stat info in 'git mv' if and only if the file is up-to-date.
     +
     +    Note that the test added in 't7001-mv.sh' requires a "sleep 1" to ensure the
     +    'ctime' of the file creation will be definitively older than the 'ctime' of
     +    the renamed file in 'git mv'.
      
          Reported-by: Maximilian Reichel <reichemn@icloud.com>
          Signed-off-by: Victoria Dye <vdye@github.com>
      
       ## read-cache.c ##
     +@@ read-cache.c: static void replace_index_entry(struct index_state *istate, int nr, struct cache
     + 
     + void rename_index_entry_at(struct index_state *istate, int nr, const char *new_name)
     + {
     +-	struct cache_entry *old_entry = istate->cache[nr], *new_entry;
     ++	struct cache_entry *old_entry = istate->cache[nr], *new_entry, *refreshed;
     + 	int namelen = strlen(new_name);
     + 
     + 	new_entry = make_empty_cache_entry(istate, namelen);
      @@ read-cache.c: void rename_index_entry_at(struct index_state *istate, int nr, const char *new_n
     + 	cache_tree_invalidate_path(istate, old_entry->name);
       	untracked_cache_remove_from_index(istate, old_entry->name);
       	remove_index_entry_at(istate, nr);
     - 	add_index_entry(istate, new_entry, ADD_CACHE_OK_TO_ADD|ADD_CACHE_OK_TO_REPLACE);
     -+	refresh_cache_entry(istate, new_entry, CE_MATCH_REFRESH);
     +-	add_index_entry(istate, new_entry, ADD_CACHE_OK_TO_ADD|ADD_CACHE_OK_TO_REPLACE);
     ++
     ++	/*
     ++	 * Refresh the new index entry. Using 'refresh_cache_entry' ensures
     ++	 * we only update stat info if the entry is otherwise up-to-date (i.e.,
     ++	 * the contents/mode haven't changed). This ensures that we reflect the
     ++	 * 'ctime' of the rename in the index without (incorrectly) updating
     ++	 * the cached stat info to reflect unstaged changes on disk.
     ++	 */
     ++	refreshed = refresh_cache_entry(istate, new_entry, CE_MATCH_REFRESH);
     ++	if (refreshed && refreshed != new_entry) {
     ++		add_index_entry(istate, refreshed, ADD_CACHE_OK_TO_ADD|ADD_CACHE_OK_TO_REPLACE);
     ++		discard_cache_entry(new_entry);
     ++	} else
     ++		add_index_entry(istate, new_entry, ADD_CACHE_OK_TO_ADD|ADD_CACHE_OK_TO_REPLACE);
       }
       
       void fill_stat_data(struct stat_data *sd, struct stat *st)
     @@ t/t7001-mv.sh: test_description='git mv in subdirs'
      +
      +	echo foo >foo &&
      +	git add foo &&
     ++
     ++	# Wait one second to ensure ctime of rename will differ from original
     ++	# file creation ctime.
     ++	sleep 1 &&
      +	git mv -f foo bar &&
     -+	git reset --merge HEAD
     ++	git reset --merge HEAD &&
     ++
     ++	# Verify the index has been reset
     ++	git diff-files >out &&
     ++	test_must_be_empty out
      +'
      +
       test_expect_success 'prepare reference tree' '

 read-cache.c  | 17 +++++++++++++++--
 t/t7001-mv.sh | 19 +++++++++++++++++++
 2 files changed, 34 insertions(+), 2 deletions(-)

On 3/28/2022 9:07 PM, Victoria Dye via GitGitGadget wrote:

Unfortunate that this is necessary, but it seems to be the only way to handle this because of the interaction with the system clock and the filesystem. There are several sleeps like this in t1701-racy-split-index.sh, for example.

I'm glad you're checking that both refreshed is non-NULL and not equal to new_entry. Both are possible results from refresh_cache_entry().

New test looks good.

Thanks, -Stolee

Derrick Stolee <derrickstolee@github.com> writes:

Does "test-tool chmtime" to tweak the filesystem timestamp help? I didn't look at the specific step that uses sleep to work around.

;-)

On 3/29/2022 12:44 PM, Junio C Hamano wrote:

The issue here is related to ctime, which is not modified by that helper. It also uses utime() which does not seem to have a way to modify ctime (which makes sense).

Thanks, -Stolee

Derrick Stolee <derrickstolee@github.com> writes:

Ahh, silly me.  You're right.