mirror of
https://github.com/git/git.git
synced 2026-08-08 17:11:48 +00:00
The provider chain so far holds the diff-hunks store in front of the terminal builtin computation. Open it to external processes: a pair on a path whose driver configures diff.<driver>.process is answered by a long-running process speaking a pkt-line protocol (following the filter process protocol), registered at the head of the chain and consulted before the store and before any blob is loaded. The protocol starts with the smallest request that can carry an answer: object names alone. A request is the pathname and the pair's old-oid/new-oid, with no content. The process answers with hunk lines, with a zero-hunk success that asserts the blobs equivalent (trailing newlines included), or with status=need-content, on which the pair falls through to the builtin answer. This serves the two shapes that need no content pushed to them: a cache keyed on the blob pair, and a process that fetches the blobs itself (for example over "git cat-file --batch"). A pair whose side is not a stored blob carries a NULL id; the provider sends no request and passes it. Because Git holds no content for the exchange, the answer is used as sent: hunks are validated for order, overlap, lockstep alignment, and magnitude, then replayed without the normalization xdiff applies to diffs it computes itself. The magnitude bound is the blobs' sizes, read from the object database without loading content: a blob of N bytes holds at most N lines. Because the process's answer is authoritative, it outranks the store, and its head-of-chain position says so. A pair the process answers never reaches the store and is never recorded, so nothing it produces enters the store, which holds the builtin answer only. A request it does not answer, whether need-content, a missing capability, or a missing id, passes down the chain to the builtin answer, which is what the store serves, so the store may serve such a pair and a warming run may record it. Entries recorded before a process was configured are not purged; a pair the process answers ignores them, and "git diff-hunks clear" discards them. The provider gates itself per request. The driver is looked up by the old-side path, so a renamed file resolves to the same driver, and by the repository-relative path, so a diff.relative run from a subdirectory names the pair the same way. Options the process is never told about select no process: the whitespace-ignoring options, -I, --anchored, and an algorithm forced by option or configuration (blame routes its algorithm through xdl_opts, so --histogram is covered). The request gains its last field, the path; the consumers change only by filling it, and neither names the process. The provider's state is its repository's pool of running processes, keyed by the configured command, so drivers sharing a command share a process, a submodule speaks to its own, and releasing the provider (from repo_clear()) stops them. The pool owns a copy of each command string, so an entry outlives a config re-read. A command that fails stays as an entry that is not retried: its request and every later one pass, so the store may serve the path for the rest of the command. A protocol error in a response never kills the command. The response is read through a packet reader gentle about framing, so an error takes one path: a single warning, the process stopped and marked failed, and the builtin diff for the rest of the command. That covers garbage bytes, a truncated response, an empty packet, a bare status, and an unrecognized status. Semantically invalid coordinates cost only their pair: the response is drained, the pair is computed, and the process stays alive. A path the protocol cannot carry (an embedded newline, or one too long for a packet) falls back per path rather than costing the command its process. The handshake keeps one fatal check: a process that announces a capability Git did not request aborts the command, as the long-running filter protocol does. Consulting is allowed per command, following the allow_textconv precedent. "git diff", "git log" and "git show", and "git blame" set allow_diff_process; the plumbing diff commands and the interactive-patch machinery never set it, so scripted and staging output stays builtin. The options adjust the flag: - --no-ext-diff clears it and --ext-diff sets it; - --diff-process and --no-diff-process set and clear it alone, leaving external diff drivers as they were; - format-patch clears it unconditionally, so a generated patch applies for recipients without the process; - range-diff passes --no-ext-diff to the "git log" it compares. git blame and the summary formats consult the process. For blame, a pair reported equivalent emits no hunks, so the whole commit passes to its parent. In the stat formats such a pair sums to a zero-count entry, which the "nothing changed" rule omits, as under -w. The subprocess is long-running: one startup cost across a traversal, one round-trip per consulted pair. Answers travel in struct xdl_hunk, new in xdiff-interface.h, holding xdiff's 1-based coordinates; nothing feeds them back to xdiff, since only coordinate consumers consult. A content-carrying request is the natural extension: it would serve sides that are not stored blobs and processes that want content pushed to them, and bring patch output and log -L's range tracking to the same answer. As it stands, a process's answers show in blame and the summary formats while patch output stays builtin. t4080 exercises the protocol, the per-command gate, and the error paths: - each adversarial response shape warns and falls back to builtin, the request log proving which failures disable the process and which keep it alive (a malformed hunk line, coordinates past the blob size, a count overflowing strtol(), overlapping or misaligned hunks, an unrecognized status, a bare status, an empty packet, a mid-response crash, and raw garbage); - a capability-less process and status=abort degrade without noise, and a failed start warns once and returns the path to the store; - a trailing token on a hunk line is ignored, pinning field appendability; - positive consults for git diff, git show, and diff-tree under --ext-diff and --diff-process; textconv output and gitlink sides are never identified; a diff.relative run consults by the repo-relative path; - the equivalence answer is pinned from both consumers, and a warming run past a deferring process records the pair for a later read. Helped-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Michael Montalbo <mmontalbo@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
191 lines
6.3 KiB
C
191 lines
6.3 KiB
C
#include "git-compat-util.h"
|
|
#include "diff.h"
|
|
#include "diff-provider-internal.h"
|
|
#include "replace-object.h"
|
|
#include "repository.h"
|
|
|
|
/*
|
|
* The terminal provider: the builtin computation. A request that
|
|
* carries a fill callback is answered by loading the pair's content
|
|
* and running xdiff, so a walk that reaches it never falls through
|
|
* to the consumer. On a consult-only walk it passes, and the walk's
|
|
* fall-through outcome tells the consumer to compute.
|
|
*/
|
|
static enum diff_provider_disposition
|
|
builtin_consult(struct diff_provider *provider UNUSED,
|
|
const struct diff_provider_request *req,
|
|
diff_provider_fill_fn fill, void *fill_data,
|
|
xdl_emit_hunk_consume_func_t hunk_cb, void *cb_data)
|
|
{
|
|
xdemitconf_t xecfg = { .hunk_func = hunk_cb };
|
|
xdemitcb_t ecb = { .priv = cb_data };
|
|
mmfile_t old_file, new_file;
|
|
|
|
if (!fill)
|
|
return DIFF_PROVIDER_DISP_PASS;
|
|
if (fill(fill_data, &old_file, &new_file) < 0)
|
|
return DIFF_PROVIDER_DISP_ERROR;
|
|
if (xdi_diff(&old_file, &new_file, req->xpp, &xecfg, &ecb) < 0)
|
|
return DIFF_PROVIDER_DISP_ERROR;
|
|
return DIFF_PROVIDER_DISP_ANSWERED;
|
|
}
|
|
|
|
static struct diff_provider *builtin_provider_new(void)
|
|
{
|
|
struct diff_provider *p = xcalloc(1, sizeof(*p));
|
|
|
|
p->consult = builtin_consult;
|
|
p->computes = 1;
|
|
return p;
|
|
}
|
|
|
|
/*
|
|
* The repository's chain, assembled on first walk. The composition
|
|
* is fixed, and the order is the authority resolution: the process
|
|
* outranks the store, and the builtin computation is the terminal
|
|
* provider, so the chain always ends in an implementor that can
|
|
* answer. Nothing is decided per repository here; each provider
|
|
* gates itself per request.
|
|
*/
|
|
static struct diff_provider *provider_chain(struct repository *r)
|
|
{
|
|
struct diff_provider **tail = &r->diff_providers;
|
|
|
|
if (*tail)
|
|
return *tail;
|
|
*tail = diff_process_provider_new();
|
|
tail = &(*tail)->next;
|
|
*tail = diff_hunks_store_provider_new();
|
|
tail = &(*tail)->next;
|
|
*tail = builtin_provider_new();
|
|
return r->diff_providers;
|
|
}
|
|
|
|
void diff_providers_clear(struct repository *r)
|
|
{
|
|
struct diff_provider *p = r->diff_providers;
|
|
|
|
while (p) {
|
|
struct diff_provider *next = p->next;
|
|
|
|
if (p->release)
|
|
p->release(p);
|
|
free(p);
|
|
p = next;
|
|
}
|
|
r->diff_providers = NULL;
|
|
}
|
|
|
|
/*
|
|
* The walk shared by diff_provider_consult() and
|
|
* diff_provider_emit_hunks(): consult the chain in order and map its
|
|
* dispositions onto the outcome set. The first answer ends the
|
|
* walk. A stop-no-record disposition (diff-provider-internal.h)
|
|
* is a refusal, not a pass: the provider does not answer, but rules
|
|
* the pair out of identity service and out of recording, so from
|
|
* then on the walk consults only the computing provider, and a walk
|
|
* that ends unanswered carries the no-record verdict. With a fill
|
|
* callback the terminal provider computes instead of passing, so an
|
|
* emit walk returns only answered or error.
|
|
*/
|
|
static enum diff_provider_outcome
|
|
walk_providers(const struct diff_provider_request *req,
|
|
diff_provider_fill_fn fill, void *fill_data,
|
|
xdl_emit_hunk_consume_func_t hunk_cb, void *cb_data)
|
|
{
|
|
struct diff_provider *p;
|
|
int no_record = 0;
|
|
|
|
if (req->diffopt && req->diffopt->repo != req->repo)
|
|
BUG("diff provider request walks one repository's chain "
|
|
"with another repository's diff options");
|
|
|
|
/*
|
|
* An object replacement redirects a blob's content
|
|
* (OBJECT_INFO_LOOKUP_REPLACE) while leaving the id that names it
|
|
* unchanged, so an answer keyed on the raw id would be the
|
|
* pre-replacement diff. A replacement is therefore a parameter
|
|
* outside the recording key: no provider may serve a replaced pair
|
|
* from its identity, and a result computed for it must not be
|
|
* recorded under the raw id. Mark the walk no-record so the
|
|
* identity providers step aside and the builtin computes from the
|
|
* replaced content. The check is a no-op when the repository has
|
|
* no replace refs.
|
|
*/
|
|
if ((req->old_oid &&
|
|
lookup_replace_object(req->repo, req->old_oid) != req->old_oid) ||
|
|
(req->new_oid &&
|
|
lookup_replace_object(req->repo, req->new_oid) != req->new_oid))
|
|
no_record = 1;
|
|
|
|
for (p = provider_chain(req->repo); p; p = p->next) {
|
|
enum diff_provider_disposition disp;
|
|
|
|
if (no_record && !p->computes)
|
|
continue;
|
|
disp = p->consult(p, req, fill, fill_data,
|
|
hunk_cb, cb_data);
|
|
if (disp == DIFF_PROVIDER_DISP_ERROR && !p->computes)
|
|
BUG("only the computing provider may return the "
|
|
"error disposition");
|
|
if (p->computes && !fill && disp != DIFF_PROVIDER_DISP_PASS)
|
|
BUG("the computing provider must pass on a "
|
|
"fill-less walk");
|
|
switch (disp) {
|
|
case DIFF_PROVIDER_DISP_ANSWERED:
|
|
return DIFF_PROVIDER_ANSWERED;
|
|
case DIFF_PROVIDER_DISP_PASS:
|
|
continue;
|
|
case DIFF_PROVIDER_DISP_STOP_NO_RECORD:
|
|
no_record = 1;
|
|
continue;
|
|
case DIFF_PROVIDER_DISP_ERROR:
|
|
return DIFF_PROVIDER_ERROR;
|
|
}
|
|
}
|
|
return no_record ? DIFF_PROVIDER_UNANSWERED_NO_RECORD :
|
|
DIFF_PROVIDER_UNANSWERED;
|
|
}
|
|
|
|
enum diff_provider_outcome
|
|
diff_provider_consult(const struct diff_provider_request *req,
|
|
xdl_emit_hunk_consume_func_t hunk_cb, void *cb_data)
|
|
{
|
|
return walk_providers(req, NULL, NULL, hunk_cb, cb_data);
|
|
}
|
|
|
|
enum diff_provider_hunks_error
|
|
diff_provider_check_hunk(struct diff_provider_hunks_check *c,
|
|
long old_start, long old_count,
|
|
long new_start, long new_count)
|
|
{
|
|
if (old_start < 0 || old_count < 0 ||
|
|
new_start < 0 || new_count < 0 ||
|
|
old_start > INT32_MAX || old_count > INT32_MAX ||
|
|
new_start > INT32_MAX || new_count > INT32_MAX ||
|
|
(int64_t)old_start + old_count > INT32_MAX ||
|
|
(int64_t)new_start + new_count > INT32_MAX)
|
|
return DIFF_PROVIDER_HUNKS_RANGE;
|
|
if (old_start < c->prev_old_end || new_start < c->prev_new_end)
|
|
return DIFF_PROVIDER_HUNKS_OVERLAP;
|
|
if (old_start - c->prev_old_end != new_start - c->prev_new_end)
|
|
return DIFF_PROVIDER_HUNKS_MISALIGNED;
|
|
/*
|
|
* With each field bounded to int32 above, the int64 sums cannot
|
|
* overflow even where long is 32-bit, and the range rule has
|
|
* already capped them at INT32_MAX.
|
|
*/
|
|
c->prev_old_end = (int64_t)old_start + old_count;
|
|
c->prev_new_end = (int64_t)new_start + new_count;
|
|
return DIFF_PROVIDER_HUNKS_OK;
|
|
}
|
|
|
|
enum diff_provider_outcome
|
|
diff_provider_emit_hunks(const struct diff_provider_request *req,
|
|
diff_provider_fill_fn fill, void *fill_data,
|
|
xdl_emit_hunk_consume_func_t hunk_cb,
|
|
void *cb_data)
|
|
{
|
|
return walk_providers(req, fill, fill_data, hunk_cb, cb_data);
|
|
}
|