Good points. On Thu, Aug 21, 2014 at 12:19 AM, Junio C Hamano <gitster@xxxxxxxxx> wrote: > After looking at what you did in 1/4, I started to wonder if we can > solve this in add_index_entry_with_check() in a less intrusive way. > When we call the function with a stage #0 entry, we are telling the > index that any entry in higher stage for the same path must > disappear. Since the current implementation of the function assumes > that the index is not corrupt in this particular way to have both > merged and unmerged entries for the same path, it fails to remove > the higher stage entries. If we fix the function, wouldn't it make > your 1/4 unnecessary? Read-only operations such as "ls-files -s" > would not call add_index_entry() so diagnostic tools would not be > affected even with such a fix. > Another thing that is done in 1/4 is to get rid of the call to index_name_pos, that can lead to infinite loops depending on what the previous add_index_entry call does as we have seen, and I wonder why is it really needed, specially if we guarantee the order in the index. > ... which may look something like the one attached at the end. > And it would be more in the line of my first patch. > But then it made me wonder even more. > > There are other ways a piece of software can leave a corrupt index > for us to read from. Your fix, or the simpler one I suggested for > that matter, would still assume that the index entries are in the > sorted order, and a corrupt index that does not sort its entries > correctly will cause us to behave in an undefined way. At some > point we should draw a line and say "Your index is hopelessly > corrupt.", send it back to whatever broken software that originally > wrote such a mess and have the user use that software to fix the > corrupt index up before talking to us. > True. > For that, we need to catch an index whose entries are not sorted and > error out, perhaps when read_index_from() iterates over the mmapped > index entries. We can even draw that "hopelessly corrupt" line > above the breakage you are addressing and add a check to make sure > no path has both merged and unmerged entries to the same check to > make it error out. > > I suspect that such a "detect and error out" may be sufficient and > also may be more robust than the approach that assumes that a > breakage is only to have both merged and unmerged entries for the > same path, the entries are still correctly sorted. > Agree. I have prepared an initial patch for this to discuss, but adding checks in read_index_from() can add a small(?) penalization to all git operations, specially with big indexes. And it wouldn't probably allow the user to fix the repository using git commands (unless we only warn instead of die depending on the thing that is broken). -- To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html