[PATCH 0/1] Fix UX issue with commit-graph.lock

[PATCH 0/1] Fix UX issue with commit-graph.lock

[Derrick Stolee]

We use the lockfile API to avoid multiple Git processes from writing to
the commit-graph file in the .git/objects/info directory. In some cases,
this directory may not exist, so we check for its existence.

The existing code does the following when acquiring the lock:

1. Try to acquire the lock.
2. If it fails, try to create the .git/object/info directory.
3. Try to acquire the lock, failing if necessary.

The problem is that if the lockfile exists, then the mkdir fails, giving
an error that doesn't help the user:

  "fatal: cannot mkdir .git/objects/info: File exists"

While technically this honors the lockfile, it does not help the user.

Instead, do the following:

1. Check for existence of .git/objects/info; create if necessary.
2. Try to acquire the lock, failing if necessary.

The new output looks like:

  fatal: Unable to create '/home/stolee/git/.git/objects/info/commit-graph.lock': File exists.

  Another git process seems to be running in this repository, e.g.
  an editor opened by 'git commit'. Please make sure all processes
  are terminated then try again. If it still fails, a git process
  may have crashed in this repository earlier:
  remove the file manually to continue.

This patch is based on ds/generation-numbers

Derrick Stolee (1):
  commit-graph: fix UX issue when .lock file exists

 commit-graph.c | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)


base-commit: 7547b95b4fbb8591726b1d9381c176cc27fc6aea
-- 
2.17.0.39.g685157f7fb

[PATCH 1/1] commit-graph: fix UX issue when .lock file exists

[Derrick Stolee]

The commit-graph file lives in the .git/objects/info directory.
Previously, a failure to acquire the commit-graph.lock file was
assumed to be due to the lack of the info directory, so a mkdir()
was called. This gave incorrect messaging if instead the lockfile
was open by another process:

  "fatal: cannot mkdir .git/objects/info: File exists"

Rearrange the expectations of this directory existing to avoid
this error, and instead show the typical message when a lockfile
already exists.

Signed-off-by: Derrick Stolee <dstolee@microsoft.com>
---
 commit-graph.c | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

diff --git a/commit-graph.c b/commit-graph.c
index a8c337dd77..8399194da1 100644
--- a/commit-graph.c
+++ b/commit-graph.c
@@ -1,5 +1,6 @@
 #include "cache.h"
 #include "config.h"
+#include "dir.h"
 #include "git-compat-util.h"
 #include "lockfile.h"
 #include "pack.h"
@@ -640,13 +641,13 @@ void write_commit_graph(const char *obj_dir,
 	struct hashfile *f;
 	uint32_t i, count_distinct = 0;
 	char *graph_name;
-	int fd;
 	struct lock_file lk = LOCK_INIT;
 	uint32_t chunk_ids[5];
 	uint64_t chunk_offsets[5];
 	int num_chunks;
 	int num_extra_edges;
 	struct commit_list *parent;
+	struct strbuf folder = STRBUF_INIT;
 
 	oids.nr = 0;
 	oids.alloc = approximate_object_count() / 4;
@@ -754,23 +755,14 @@ void write_commit_graph(const char *obj_dir,
 	compute_generation_numbers(&commits);
 
 	graph_name = get_commit_graph_filename(obj_dir);
-	fd = hold_lock_file_for_update(&lk, graph_name, 0);
 
-	if (fd < 0) {
-		struct strbuf folder = STRBUF_INIT;
-		strbuf_addstr(&folder, graph_name);
-		strbuf_setlen(&folder, strrchr(folder.buf, '/') - folder.buf);
-
-		if (mkdir(folder.buf, 0777) < 0)
-			die_errno(_("cannot mkdir %s"), folder.buf);
-		strbuf_release(&folder);
-
-		fd = hold_lock_file_for_update(&lk, graph_name, LOCK_DIE_ON_ERROR);
-
-		if (fd < 0)
-			die_errno("unable to create '%s'", graph_name);
-	}
+	strbuf_addstr(&folder, graph_name);
+	strbuf_setlen(&folder, strrchr(folder.buf, '/') - folder.buf);
+	if (!file_exists(folder.buf) && mkdir(folder.buf, 0777) < 0)
+		die_errno(_("cannot mkdir %s"), folder.buf);
+	strbuf_release(&folder);
 
+	hold_lock_file_for_update(&lk, graph_name, LOCK_DIE_ON_ERROR);
 	f = hashfd(lk.tempfile->fd, lk.tempfile->filename.buf);
 
 	hashwrite_be32(f, GRAPH_SIGNATURE);
-- 
2.17.0.39.g685157f7fb

Re: [PATCH 1/1] commit-graph: fix UX issue when .lock file exists

[Jeff King]

On Wed, May 09, 2018 at 02:15:38PM +0000, Derrick Stolee wrote:

> The commit-graph file lives in the .git/objects/info directory.
> Previously, a failure to acquire the commit-graph.lock file was
> assumed to be due to the lack of the info directory, so a mkdir()
> was called. This gave incorrect messaging if instead the lockfile
> was open by another process:
> 
>   "fatal: cannot mkdir .git/objects/info: File exists"
> 
> Rearrange the expectations of this directory existing to avoid
> this error, and instead show the typical message when a lockfile
> already exists.

Sounds like a reasonable bug fix.

Your cover letter is way longer than this description. Should some of
that background perhaps go in the commit message?

(I would go so far as to say that sending a cover letter for a single
patch is an anti-pattern, because the commit message should be able to
stand on its own).

> @@ -754,23 +755,14 @@ void write_commit_graph(const char *obj_dir,
>  	compute_generation_numbers(&commits);
>  
>  	graph_name = get_commit_graph_filename(obj_dir);
> -	fd = hold_lock_file_for_update(&lk, graph_name, 0);
>  
> -	if (fd < 0) {
> -		struct strbuf folder = STRBUF_INIT;
> -		strbuf_addstr(&folder, graph_name);
> -		strbuf_setlen(&folder, strrchr(folder.buf, '/') - folder.buf);
> -
> -		if (mkdir(folder.buf, 0777) < 0)
> -			die_errno(_("cannot mkdir %s"), folder.buf);
> -		strbuf_release(&folder);
> -
> -		fd = hold_lock_file_for_update(&lk, graph_name, LOCK_DIE_ON_ERROR);
> -
> -		if (fd < 0)
> -			die_errno("unable to create '%s'", graph_name);
> -	}
> +	strbuf_addstr(&folder, graph_name);
> +	strbuf_setlen(&folder, strrchr(folder.buf, '/') - folder.buf);
> +	if (!file_exists(folder.buf) && mkdir(folder.buf, 0777) < 0)
> +		die_errno(_("cannot mkdir %s"), folder.buf);
> +	strbuf_release(&folder);

The result is racy if somebody else is trying to create the directory at
the same time. For that you'd want to notice EEXIST coming from mkdir
and consider that a success.

I think you probably ought to be calling adjust_shared_perm() on the
result, too, in case core.sharedrepository is configured.

If you use safe_create_leading_directories(), it should handle both.
Something like:

  if (safe_create_leading_directories(graph_name))
	die_errno(_("unable to create leading directories of %s"),
		  graph_name));

I think I'm holding it right; that function is a little short on
documentation, but it's the standard way to do this in Git's codebase,
and you can find lots of example callers.

-Peff

Re: [PATCH 1/1] commit-graph: fix UX issue when .lock file exists

[Derrick Stolee]

On 5/9/2018 10:42 AM, Jeff King wrote:
> On Wed, May 09, 2018 at 02:15:38PM +0000, Derrick Stolee wrote:
>
>> The commit-graph file lives in the .git/objects/info directory.
>> Previously, a failure to acquire the commit-graph.lock file was
>> assumed to be due to the lack of the info directory, so a mkdir()
>> was called. This gave incorrect messaging if instead the lockfile
>> was open by another process:
>>
>>    "fatal: cannot mkdir .git/objects/info: File exists"
>>
>> Rearrange the expectations of this directory existing to avoid
>> this error, and instead show the typical message when a lockfile
>> already exists.
> Sounds like a reasonable bug fix.
>
> Your cover letter is way longer than this description. Should some of
> that background perhaps go in the commit message?

I did want a place to include the full die() message in the new 
behavior, but that seemed like overkill for the commit message.

> (I would go so far as to say that sending a cover letter for a single
> patch is an anti-pattern, because the commit message should be able to
> stand on its own).
>
>> @@ -754,23 +755,14 @@ void write_commit_graph(const char *obj_dir,
>>   	compute_generation_numbers(&commits);
>>   
>>   	graph_name = get_commit_graph_filename(obj_dir);
>> -	fd = hold_lock_file_for_update(&lk, graph_name, 0);
>>   
>> -	if (fd < 0) {
>> -		struct strbuf folder = STRBUF_INIT;
>> -		strbuf_addstr(&folder, graph_name);
>> -		strbuf_setlen(&folder, strrchr(folder.buf, '/') - folder.buf);
>> -
>> -		if (mkdir(folder.buf, 0777) < 0)
>> -			die_errno(_("cannot mkdir %s"), folder.buf);
>> -		strbuf_release(&folder);
>> -
>> -		fd = hold_lock_file_for_update(&lk, graph_name, LOCK_DIE_ON_ERROR);
>> -
>> -		if (fd < 0)
>> -			die_errno("unable to create '%s'", graph_name);
>> -	}
>> +	strbuf_addstr(&folder, graph_name);
>> +	strbuf_setlen(&folder, strrchr(folder.buf, '/') - folder.buf);
>> +	if (!file_exists(folder.buf) && mkdir(folder.buf, 0777) < 0)
>> +		die_errno(_("cannot mkdir %s"), folder.buf);
>> +	strbuf_release(&folder);
> The result is racy if somebody else is trying to create the directory at
> the same time. For that you'd want to notice EEXIST coming from mkdir
> and consider that a success.
>
> I think you probably ought to be calling adjust_shared_perm() on the
> result, too, in case core.sharedrepository is configured.
>
> If you use safe_create_leading_directories(), it should handle both.
> Something like:
>
>    if (safe_create_leading_directories(graph_name))
> 	die_errno(_("unable to create leading directories of %s"),
> 		  graph_name));
>
> I think I'm holding it right; that function is a little short on
> documentation, but it's the standard way to do this in Git's codebase,
> and you can find lots of example callers.

Thanks for this method. I was unfamiliar with it. Saves the effort of 
creating the strbuf, too.

Thanks,
-Stolee

Re: [PATCH 0/1] Fix UX issue with commit-graph.lock

[Duy Nguyen]

On Wed, May 9, 2018 at 4:15 PM, Derrick Stolee <dstolee@microsoft.com> wrote:
> We use the lockfile API to avoid multiple Git processes from writing to
> the commit-graph file in the .git/objects/info directory. In some cases,
> this directory may not exist, so we check for its existence.
>
> The existing code does the following when acquiring the lock:
>
> 1. Try to acquire the lock.
> 2. If it fails, try to create the .git/object/info directory.
> 3. Try to acquire the lock, failing if necessary.
>
> The problem is that if the lockfile exists, then the mkdir fails, giving
> an error that doesn't help the user:
>
>   "fatal: cannot mkdir .git/objects/info: File exists"
>
> While technically this honors the lockfile, it does not help the user.
>
> Instead, do the following:
>
> 1. Check for existence of .git/objects/info; create if necessary.
> 2. Try to acquire the lock, failing if necessary.
>
> The new output looks like:
>
>   fatal: Unable to create '/home/stolee/git/.git/objects/info/commit-graph.lock': File exists.
>
>   Another git process seems to be running in this repository, e.g.
>   an editor opened by 'git commit'. Please make sure all processes
>   are terminated then try again. If it still fails, a git process
>   may have crashed in this repository earlier:
>   remove the file manually to continue.

This to me is a much better description than the current commit
message in 1/1 and probably should be the commit message of 1/1.
-- 
Duy

Re: [PATCH 1/1] commit-graph: fix UX issue when .lock file exists

[Jeff King]

On Wed, May 09, 2018 at 10:53:56AM -0400, Derrick Stolee wrote:

> > Your cover letter is way longer than this description. Should some of
> > that background perhaps go in the commit message?
> 
> I did want a place to include the full die() message in the new behavior,
> but that seemed like overkill for the commit message.

I think it would be fine. In general, it's probably a good idea to err
on the side of more information in the commit message than less. The one
exception is that if your commit message grows very long, make sure it's
organized well. I find there are two "modes" in which I read old commit
messages:

  1. Skimming through log, etc, to try to get the gist of what the
     commit is doing and find out whether it might be related to my
     problem.

  2. Once I've identified it as a problem, I want to know every single
     thing in the mind of the writer that might help me.

(I'm not speaking to this particular message or your messages in general
here; I just didn't want to claim that a blanket "longer is better" is
without limitations).

-Peff

Re: [PATCH 0/1] Fix UX issue with commit-graph.lock

[Junio C Hamano]

Derrick Stolee <dstolee@microsoft.com> writes:

> We use the lockfile API to avoid multiple Git processes from writing to
> the commit-graph file in the .git/objects/info directory. In some cases,
> this directory may not exist, so we check for its existence.
>
> The existing code does the following when acquiring the lock:
>
> 1. Try to acquire the lock.
> 2. If it fails, try to create the .git/object/info directory.
> 3. Try to acquire the lock, failing if necessary.
>
> The problem is that if the lockfile exists, then the mkdir fails, giving
> an error that doesn't help the user:
>
>   "fatal: cannot mkdir .git/objects/info: File exists"

Isn't a better immediate fix to make the second step pay attention
to errno?  If mkdir() failed due to EEXIST, then we know we tried to
aquire the lock already, so we can die with an appropriate message.

That way, we can keep the "optimize for the normal case" that the
approach to assume object/info/ directory is already there, instead
of always checking its existence which is almost always true
beforehand.

Also, can't we tell why we failed to acquire the lock at step #1?
Do we only get a NULL that says "I am not telling you why, but we
failed to lock"?  What I am getting at is that the ideal sequence
would be more like:

    1. Try to acquire the lock.
    2-a. if #1 succeeds, we are happy. ignore the rest and return
         the lock.
    2-b. if #1 failed because object/info/ did not exist,
         mkdir() it, and die if we cannot, saying "cannot mkdir".
	 if mkdir() succeeds, jump t 3.
    2-c. if #1 failed but that is not due to missing object/info/,
	 die saying "cannot lock".
    3. Try to acquire the lock.
    4-a. if #3 succeeds, we are happy.ignore the rest and return
         the lock.
    4-b. die saying "cannot lock".

Re: [PATCH 0/1] Fix UX issue with commit-graph.lock

[Derrick Stolee]

On 5/10/2018 3:00 AM, Junio C Hamano wrote:
> Derrick Stolee <dstolee@microsoft.com> writes:
>
>> We use the lockfile API to avoid multiple Git processes from writing to
>> the commit-graph file in the .git/objects/info directory. In some cases,
>> this directory may not exist, so we check for its existence.
>>
>> The existing code does the following when acquiring the lock:
>>
>> 1. Try to acquire the lock.
>> 2. If it fails, try to create the .git/object/info directory.
>> 3. Try to acquire the lock, failing if necessary.
>>
>> The problem is that if the lockfile exists, then the mkdir fails, giving
>> an error that doesn't help the user:
>>
>>    "fatal: cannot mkdir .git/objects/info: File exists"
> Isn't a better immediate fix to make the second step pay attention
> to errno?  If mkdir() failed due to EEXIST, then we know we tried to
> aquire the lock already, so we can die with an appropriate message.
>
> That way, we can keep the "optimize for the normal case" that the
> approach to assume object/info/ directory is already there, instead
> of always checking its existence which is almost always true
> beforehand.

This "optimize for the normal case" is why the existing code is 
organized the way it is.

Since this code is only for writing a commit-graph file, this "check the 
directory first" option is a very small portion of the full time to 
write the file, so the "optimization" has very little effect, 
relatively. My personal opinion is to make the code cleaner when the 
performance difference is negligible.

I'm willing to concede this point and use the steps you suggest below, 
if we think this is the best way forward.

> Also, can't we tell why we failed to acquire the lock at step #1?
> Do we only get a NULL that says "I am not telling you why, but we
> failed to lock"?

To tell why we failed to acquire the lock, we could inspect "errno". 
However, this requires whitebox knowledge of both the lockfile API and 
the tempfile API to know that the last system call to set errno was an 
open() or adjust_shared_perm(). To cleanly make decisions based on the 
reason the lock failed to acquire, I think we would need to modify the 
lockfile and tempfile APIs to return a failure reason. This could be 
done by passing an `int *reason`, but the extra noise in these APIs is 
likely not worth the change.


> What I am getting at is that the ideal sequence
> would be more like:
>      1. Try to acquire the lock.
>      2-a. if #1 succeeds, we are happy. ignore the rest and return
>           the lock.
>      2-b. if #1 failed because object/info/ did not exist,
>           mkdir() it, and die if we cannot, saying "cannot mkdir".
> 	 if mkdir() succeeds, jump t 3.
>      2-c. if #1 failed but that is not due to missing object/info/,
> 	 die saying "cannot lock".
>      3. Try to acquire the lock.
>      4-a. if #3 succeeds, we are happy.ignore the rest and return
>           the lock.
>      4-b. die saying "cannot lock".
>

Thanks,
-Stolee

[PATCH v2] commit-graph: fix UX issue when .lock file exists

[Derrick Stolee]

We use the lockfile API to avoid multiple Git processes from writing to
the commit-graph file in the .git/objects/info directory. In some cases,
this directory may not exist, so we check for its existence.

The existing code does the following when acquiring the lock:

1. Try to acquire the lock.
2. If it fails, try to create the .git/object/info directory.
3. Try to acquire the lock, failing if necessary.

The problem is that if the lockfile exists, then the mkdir fails, giving
an error that doesn't help the user:

  "fatal: cannot mkdir .git/objects/info: File exists"

While technically this honors the lockfile, it does not help the user.

Instead, do the following:

1. Check for existence of .git/objects/info; create if necessary.
2. Try to acquire the lock, failing if necessary.

The new output looks like:

  fatal: Unable to create
  '<dir>/.git/objects/info/commit-graph.lock': File exists.

  Another git process seems to be running in this repository, e.g.
  an editor opened by 'git commit'. Please make sure all processes
  are terminated then try again. If it still fails, a git process
  may have crashed in this repository earlier:
  remove the file manually to continue.

Helped-by: Jeff King <peff@peff.net>
Signed-off-by: Derrick Stolee <dstolee@microsoft.com>
---
 commit-graph.c | 22 +++++-----------------
 1 file changed, 5 insertions(+), 17 deletions(-)

diff --git a/commit-graph.c b/commit-graph.c
index a8c337dd77..bb54c1214c 100644
--- a/commit-graph.c
+++ b/commit-graph.c
@@ -1,5 +1,6 @@
 #include "cache.h"
 #include "config.h"
+#include "dir.h"
 #include "git-compat-util.h"
 #include "lockfile.h"
 #include "pack.h"
@@ -640,7 +641,6 @@ void write_commit_graph(const char *obj_dir,
 	struct hashfile *f;
 	uint32_t i, count_distinct = 0;
 	char *graph_name;
-	int fd;
 	struct lock_file lk = LOCK_INIT;
 	uint32_t chunk_ids[5];
 	uint64_t chunk_offsets[5];
@@ -754,23 +754,11 @@ void write_commit_graph(const char *obj_dir,
 	compute_generation_numbers(&commits);
 
 	graph_name = get_commit_graph_filename(obj_dir);
-	fd = hold_lock_file_for_update(&lk, graph_name, 0);
-
-	if (fd < 0) {
-		struct strbuf folder = STRBUF_INIT;
-		strbuf_addstr(&folder, graph_name);
-		strbuf_setlen(&folder, strrchr(folder.buf, '/') - folder.buf);
-
-		if (mkdir(folder.buf, 0777) < 0)
-			die_errno(_("cannot mkdir %s"), folder.buf);
-		strbuf_release(&folder);
-
-		fd = hold_lock_file_for_update(&lk, graph_name, LOCK_DIE_ON_ERROR);
-
-		if (fd < 0)
-			die_errno("unable to create '%s'", graph_name);
-	}
+	if (safe_create_leading_directories(graph_name))
+		die_errno(_("unable to create leading directories of %s"),
+			  graph_name);
 
+	hold_lock_file_for_update(&lk, graph_name, LOCK_DIE_ON_ERROR);
 	f = hashfd(lk.tempfile->fd, lk.tempfile->filename.buf);
 
 	hashwrite_be32(f, GRAPH_SIGNATURE);

base-commit: 34fdd433396ee0e3ef4de02eb2189f8226eafe4e
-- 
2.16.2.329.gfb62395de6

Re: [PATCH 0/1] Fix UX issue with commit-graph.lock

[Junio C Hamano]

Derrick Stolee <stolee@gmail.com> writes:

>> Also, can't we tell why we failed to acquire the lock at step #1?
>> Do we only get a NULL that says "I am not telling you why, but we
>> failed to lock"?
>
> To tell why we failed to acquire the lock, we could inspect
> "errno". However, this requires whitebox knowledge of both the
> lockfile API and the tempfile API to know that the last system call to
> set errno was an open() or adjust_shared_perm().

That depends on your viewpoint.  We can make it a part of documented
API so that we keep the promise of preserving errno in the error
codepath when we update these APIs and then you do not have to worry
about errno being whitebox knowledge ;-).

Re: [PATCH v2] commit-graph: fix UX issue when .lock file exists

[Jeff King]

On Thu, May 10, 2018 at 05:42:52PM +0000, Derrick Stolee wrote:

> We use the lockfile API to avoid multiple Git processes from writing to
> the commit-graph file in the .git/objects/info directory. In some cases,
> this directory may not exist, so we check for its existence.
> [...]

This version looks good to me. Thanks!

-Peff