Skip to content

refs/reftable: fail when initializing a broken stack - #2485

Open
huntharo wants to merge 1 commit into
git:masterfrom
huntharo:fix/reftable-init-errors
Open

refs/reftable: fail when initializing a broken stack#2485
huntharo wants to merge 1 commit into
git:masterfrom
huntharo:fix/reftable-init-errors

Conversation

@huntharo

@huntharo huntharo commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Background

For the not-yet-default reftable mode: when tables.list names a missing table, reftable_be_init() saves the error but returns an unusable ref store with a NULL stack. for-each-ref silently succeeds because callers discard the iterator error; refs verify dereferences the NULL stack, and for-each-ref --start-after can also segfault.

Fix Summary

Stop with the underlying reftable diagnostic when initialization fails. The three-line backend change makes ref listing, individual lookups, reflog reads, verification, and fsck fail visibly. Add seven missing-table regression cases and update the existing worktree verification diagnostic for the earlier failure.

Note: I chose to leave the assert that checks library misuse above the die on any other error, to preserve behavior for that case. I chose to make this a die because callers are expecting a usable store and there does not appear to be a good way to propagate errors to callers with the existing pattern, and some callers were reporting false success while others were dereferencing NULL and crashing.

Reproduction

Reproduction using Git built from the base commit (these commands deliberately remove one table from a freshly created temporary repository):

# Setup a test repo
repro_dir=$(mktemp -d)
git init --ref-format=reftable --initial-branch=main "$repro_dir"
git -C "$repro_dir" -c user.name=Repro -c user.email=repro@example.com \
    commit --allow-empty -m one
git -C "$repro_dir" branch side

# Get first table in list
table=$(head -n 1 "$repro_dir/.git/reftable/tables.list")
# Drop the table file to simulate corruption
rm "$repro_dir/.git/reftable/$table"

# exit status: 0
git -C "$repro_dir" for-each-ref
printf 'exit status: %s\n' "$?"

# exit status: 128
git -C "$repro_dir" rev-parse --verify refs/heads/side
printf 'exit status: %s\n' "$?"

# exit status: 139
git -C "$repro_dir" refs verify
printf 'exit status: %s\n' "$?"

# error: refs died of signal 11
# exit status: 8
git -C "$repro_dir" fsck
printf 'exit status: %s\n' "$?"

Before this fix, for-each-ref produces no output and exits 0; rev-parse reports Needed a single revision; refs verify crashes with SIGSEGV; and fsck reports refs died of signal 11. With this fix, all four commands fail with fatal: could not initialize reftable backend: file does not exist and no signal crash.

This demonstrates handling of an already-corrupted stack; it does not establish that normal operations on current Git create this corruption.

Fix Validation

  • Before the fix: all seven new cases fail. for-each-ref exits 0 with empty output, refs verify and for-each-ref --start-after die with SIGSEGV, and fsck reports refs died of signal 11.
  • After the fix: all seven cases pass; failures report could not initialize reftable backend: file does not exist without a signal crash.
  • make -j8 succeeds.
  • Full scripts pass: t0610-reftable-basics.sh (97 tests), t0611-reftable-httpd.sh (1 test), t0613-reftable-write-options.sh (12 tests), and t0614-reftable-fsck.sh (9 tests): 119 tests total. The HTTP script was rerun outside the sandbox so Apache could bind to localhost.
  • t0612-reftable-jgit-compatibility.sh was invoked and skipped because JGit is not installed.
  • Chain lint, grep lint, and git diff --check pass.

Commit includes Signed-off-by: Harold Hunt <harold@pwrdrvr.com>.

CC: Patrick Steinhardt <ps@pks.im>, Karthik Nayak <karthik.188@gmail.com>, Junio C Hamano <gitster@pobox.com>

@huntharo
refs/reftable: fail when initializing a broken stack
706bed8 
When tables.list names a table that no longer exists, initializing the
reftable stack fails. However, reftable_be_init() only records the error
and returns a partially initialized ref store with a NULL stack.

Read operations then return the saved error, which some callers ignore.
For example, for-each-ref silently succeeds without listing any refs.
Other paths dereference the missing stack or an uninitialized iterator,
so refs verify and for-each-ref --start-after can segfault.

The ref-store initializer cannot return an error to its callers. Die
with the underlying reftable error instead of returning an unusable
store. This also makes individual ref lookups and reflog reads report
the storage failure rather than treating refs as missing.

Add regression coverage for missing tables and adjust the worktree
verification test to expect the earlier initialization failure.

Signed-off-by: Harold Hunt <harold@pwrdrvr.com>
@gitgitgadget-git

gitgitgadget-git Bot commented Nov 9, 2026

Copy link
Copy Markdown

Welcome to GitGitGadget

Hi @huntharo, and welcome to GitGitGadget, the GitHub App to send patch series to the Git mailing list from GitHub Pull Requests.

Please make sure that either:

  • Your Pull Request has a good description, if it consists of multiple commits, as it will be used as cover letter.
  • Your Pull Request description is empty, if it consists of a single commit, as the commit message should be descriptive enough by itself.

You can CC potential reviewers by adding a footer to the PR description with the following syntax:

CC: Revi Ewer <revi.ewer@example.com>, Ill Takalook <ill.takalook@example.net>

NOTE: DO NOT copy/paste your CC list from a previous GGG PR's description,
because it will result in a malformed CC list on the mailing list. See
example.

Also, it is a good idea to review the commit messages one last time, as the Git project expects them in a quite specific form:

  • the lines should not exceed 76 columns,
  • the first line should be like a header and typically start with a prefix like "tests:" or "revisions:" to state which subsystem the change is about, and
  • the commit messages' body should be describing the "why?" of the change.
  • Finally, the commit messages should end in a Signed-off-by: line matching the commits' author.

It is in general a good idea to await the automated test ("Checks") in this Pull Request before contributing the patches, e.g. to avoid trivial issues such as unportable code.

Contributing the patches

Before you can contribute the patches, your GitHub username needs to be added to the list of permitted users. Any already-permitted user can do that, by adding a comment to your PR of the form /allow. A good way to find other contributors is to locate recent pull requests where someone has been /allowed:

Both the person who commented /allow and the PR author are able to /allow you.

An alternative is the channel #git-devel on the Libera Chat IRC network:

<newcontributor> I've just created my first PR, could someone please /allow me? https://github.com/gitgitgadget/git/pull/12345
<veteran> newcontributor: it is done
<newcontributor> thanks!

Once on the list of permitted usernames, you can contribute the patches to the Git mailing list by adding a PR comment /submit.

If you want to see what email(s) would be sent for a /submit request, add a PR comment /preview to have the email(s) sent to you. You must have a public GitHub email address for this. Note that any reviewers CC'd via the list in the PR description will not actually be sent emails.

After you submit, GitGitGadget will respond with another comment that contains the link to the cover letter mail in the Git mailing list archive. Please make sure to monitor the discussion in that thread and to address comments and suggestions (while the comments and suggestions will be mirrored into the PR by GitGitGadget, you will still want to reply via mail).

If you do not want to subscribe to the Git mailing list just to be able to respond to a mail, you can download the mbox from the Git mailing list archive (click the (raw) link), then import it into your mail program. If you use GMail, you can do this via:

curl -g --user "<EMailAddress>:<Password>" \
    --url "imaps://imap.gmail.com/INBOX" -T /path/to/raw.txt

To iterate on your change, i.e. send a revised patch or patch series, you will first want to (force-)push to the same branch. You probably also want to modify your Pull Request description (or title). It is a good idea to summarize the revision by adding something like this to the cover letter (read: by editing the first comment on the PR, i.e. the PR description):

Changes since v1:
- Fixed a typo in the commit message (found by ...)
- Added a code comment to ... as suggested by ...
...

To send a new iteration, just add another PR comment with the contents: /submit.

Need help?

New contributors who want advice are encouraged to join git-mentoring@googlegroups.com, where volunteers who regularly contribute to Git are willing to answer newbie questions, give advice, or otherwise provide mentoring to interested contributors. You must join in order to post or view messages, but anyone can join.

You may also be able to find help in real time in the developer IRC channel, #git-devel on Libera Chat. Remember that IRC does not support offline messaging, so if you send someone a private message and log out, they cannot respond to you. The scrollback of #git-devel is archived, though.

@huntharo huntharo mentioned this pull request Nov 9, 2026
Open
@dscho

dscho commented Nov 10, 2026

Copy link
Copy Markdown
Member

/allow

@gitgitgadget-git

gitgitgadget-git Bot commented Nov 10, 2026

Copy link
Copy Markdown

User huntharo is now allowed to use GitGitGadget.

@dscho

dscho commented Nov 10, 2026

Copy link
Copy Markdown
Member

@huntharo please note that the cover letter screams "I was written by AI", and note also that there is at least one highly vocal opponent of AI-generated work on the Git mailing list. You might want to edit or even rewrite this to be more similar to other contributions (have a look at https://lore.kernel.org/git/ to see how cover letters usually look, e.g. lacking headers like "Background" and completely lacking the "Validation" part because that is assumed for high-quality contributions).

@huntharo

huntharo commented Nov 11, 2026

Copy link
Copy Markdown
Author

@huntharo please note that the cover letter screams "I was written by AI", and note also that there is at least one highly vocal opponent of AI-generated work on the Git mailing list. You might want to edit or even rewrite this to be more similar to other contributions (have a look at https://lore.kernel.org/git/ to see how cover letters usually look, e.g. lacking headers like "Background" and completely lacking the "Validation" part because that is assumed for high-quality contributions).

Thanks. The headers and reproduction steps are mine as is the verbose explanation. That's just who I am... the detailed links were collected by my agent. But the biggest problem is my writing style 😂. My biggest fear is that there is not enough info in the write up to trust the patch, but it seems the preference is for less. I'm looking through some examples and will update.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

new user

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@huntharo @dscho