If a transaction includes a non-NODEREF update to a symbolic reference,
we don't have to look it up in lock_ref_for_update(). The reference will
be dereferenced anyway when the split-off update is processed.

This change requires that we store a backpointer from the split-off
update to its parent update, for two reasons:

* We still want to report the original reference name in error messages.
  So if an error occurs when checking the split-off update's old_sha1,
  walk the parent_update pointers back to find the original reference
  name, and report that one.

* We still need to write the old_sha1 of the symref to its reflog. So
  after we read the split-off update's reference value, walk the
  parent_update pointers back and fill in their old_sha1 fields.

Aside from eliminating unnecessary reads, this change fixes a
subtle (though not very serious) race condition: in the old code, the
old_sha1 of the symref was resolved before the reference that it pointed
at was locked. So it was possible that the old_sha1 value logged to the
symref's reflog could be wrong if another process changed the downstream
reference before it was locked.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

Before the previous patch, our first read of the reference happened
before the reference was locked, so we couldn't trust its value and had
to read it again. But now that our first read of the reference happens
after acquiring the lock, there is no need to read it a second time. So
move the read_ref_full() call into the (update->type & REF_ISSYMREF)
block.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

Before committing ref updates, split symbolic ref updates into two
parts: an update to the underlying ref, and a log-only update to the
symbolic ref. This ensures that both references are locked correctly
during the transaction, including while their reflogs are updated.

Similarly, if the reference pointed to by HEAD is modified directly, add
a separate log-only update to HEAD, rather than leaving the job of
updating HEAD's reflog to commit_ref_update(). This change ensures that
HEAD is locked correctly while its reflog is being modified, as well as
being cheaper (HEAD only needs to be resolved once).

This makes use of a new function, lock_raw_ref(), which is analogous to
read_raw_ref(), but acquires a lock on the reference before reading it.

This change still has two problems:

* There are redundant read_ref_full() reference lookups.

* It is still possible to get incorrect reflogs for symbolic references
  if there is a concurrent update by another process, since the old_oid
  of a symref is determined before the lock on the pointed-to ref is
  held.

Both problems will soon be fixed.
Signed-off-by: NDavid Turner <dturner@twopensource.com>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

WIP

If the user has asked that a new value be set for a reference, we use
check_refname_format() to verify that the reference name satisfies all
of the rules. But in other cases, at least check that refname_is_safe().
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

This avoids the need for a forward declaration in the next patch.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

Extract a new function, lock_ref_for_update(), from
ref_transaction_commit().
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

Change add_update() to initialize all of the fields in the new
ref_update object. Rename the function to ref_transaction_add_update(),
and increase its visibility to all of the refs-related code.

All of this makes the function more useful for other future callers.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

The two string_list arguments can be const.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

When renaming refs, don't dereference either the origin or the destination
before renaming.

The origin does not need to be dereferenced because it is presently
forbidden to rename symbolic refs.

Not dereferencing the destination fixes a bug where renaming on top of
a broken symref would use the pointed-to ref name for the moved
reflog.

Add a test for the reflog bug.
Signed-off-by: NDavid Turner <dturner@twopensource.com>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

The refs infrastructure learns about log-only ref updates, which only
update the reflog.  Later, we will use this to separate symbolic
reference resolution from ref updating.
Signed-off-by: NDavid Turner <dturner@twopensource.com>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

The return value of resolve_ref_unsafe() is not guaranteed to stay
around as long as we need it, so use resolve_refdup() instead.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

It is nonsensical (and a little bit dangerous) to use REF_ISPRUNING
without REF_NODEREF. Forbid it explicitly. Change the one REF_ISPRUNING
caller to pass REF_NODEREF too.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

* Always start error messages with a lower-case letter.

* Always enclose reference names in single quotes.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

resolve_ref_unsafe() can cope with being called with NULL passed to its
flags argument. So lock_ref_sha1_basic() can just hand its own type
parameter through.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

Among other things, document the (important!) requirement that input
refname be checked for safety before calling this function.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

After all, it doesn't hold the symbolic reference, but rather the
reference referred to.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

This is more convenient and less error-prone for callers.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

This will hopefully reduce confusion with the "flags" arguments that are
used in many functions in this module as an input parameter to choose
how the function should operate.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

These microoptimizations don't make a significant difference in speed.
And they cause problems if somebody ever wants to modify the function to
add updates to a transaction as part of processing it, as will happen
shortly.

Make the same changes in initial_ref_transaction_commit().
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

The reference name is going to be compared to other reference names, so
it should be in its normalized form.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

Add a docstring for the remove_dir_recursively() function and the
REMOVE_DIR_* flags that can be passed to it.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

Document the difference between this function and
safe_create_leading_directories_const(), and that the former restores
path before returning.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

Even if there is an empty directory where we look for the loose version
of a reference, check for a packed reference before giving up. This
fixes the failing test that was introduced two commits ago.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

Part of the bug revealed in the last commit is that resolve_ref_unsafe()
incorrectly returns EISDIR if it finds a directory in the place where it
is looking for a loose reference, even if the corresponding packed
reference exists. lock_ref_sha1_basic() notices the bogus EISDIR, and
use it as an indication that it should call remove_empty_directories()
and call resolve_ref_unsafe() again.

But resolve_ref_unsafe() shouldn't report EISDIR in this case. If we
would simply make that change, then remove_empty_directories() wouldn't
get called anymore, and the empty directory would get in the way when
commit_ref() calls commit_lock_file() to rename the lockfile into place.

So instead of relying on lock_ref_sha1_basic() to delete empty
directories, teach commit_ref(), just before calling commit_lock_file(),
to check whether a directory is in the way, and if so, try to delete it.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

Add some tests checking that it is possible to work with a reference
even if there is an empty directory where the loose ref would be stored.

One of the new tests demonstrates a bug that has been with us since at
least 2.5.0--single reference lookup gives up when it sees the
directory, even if the reference exists as a packed ref. This probably
hasn't been reported before because Git usually cleans up empty
directories when packing references.

This bug will be fixed shortly.
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>

* maint:
  l10n: fr: don't translate "merge" as a parameter
  l10n: fr: change "id de clé" to match "id-clé"
  l10n: fr: fix wrongly translated option name
  l10n: fr: fix transcation of "dir"

Signed-off-by: NJunio C Hamano <gitster@pobox.com>

"git submodule" reports the paths of submodules the command
recurses into, but this was incorrect when the command was not run
from the root level of the superproject.

* sb/submodule-path-misc-bugs:
  t7407: make expectation as clear as possible
  submodule update: test recursive path reporting from subdirectory
  submodule update: align reporting path for custom command execution
  submodule status: correct path handling in recursive submodules
  submodule update --init: correct path handling in recursive submodules
  submodule foreach: correct path display in recursive submodules

When "git merge" notices that the merge can be resolved purely at
the tree level (without having to merge blobs) and the resulting
tree happens to already exist in the object store, it forgot to
update the index, which lead to an inconsistent state for later
operations.

* en/merge-trivial-fix:
  builtin/merge.c: fix a bug with trivial merges
  t7605: add a testcase demonstrating a bug with trivial merges

"merge-octopus" strategy did not ensure that the index is clean
when merge begins.

* en/merge-octopus-fix:
  merge-octopus: abort if index does not match HEAD
  t6044: new merge testcases for when index doesn't match HEAD

Code restructuring around the "refs" area to prepare for pluggable
refs backends.

* dt/pre-refs-backend: (24 commits)
  refs: on symref reflog expire, lock symref not referrent
  refs: move resolve_ref_unsafe into common code
  show_head_ref(): check the result of resolve_ref_namespace()
  check_aliased_update(): check that dst_name is non-NULL
  checkout_paths(): remove unneeded flag variable
  cmd_merge(): remove unneeded flag variable
  fsck_head_link(): remove unneeded flag variable
  read_raw_ref(): change flags parameter to unsigned int
  files-backend: inline resolve_ref_1() into resolve_ref_unsafe()
  read_raw_ref(): manage own scratch space
  files-backend: break out ref reading
  resolve_ref_1(): eliminate local variable "bad_name"
  resolve_ref_1(): reorder code
  resolve_ref_1(): eliminate local variable
  resolve_ref_unsafe(): ensure flags is always set
  resolve_ref_unsafe(): use for loop to count up to MAXDEPTH
  resolve_missing_loose_ref(): simplify semantics
  t1430: improve test coverage of deletion of badly-named refs
  t1430: test for-each-ref in the presence of badly-named refs
  t1430: don't rely on symbolic-ref for creating broken symrefs
  ...

"git rerere" can encounter two or more files with the same conflict
signature that have to be resolved in different ways, but there was
no way to record these separate resolutions.

* jc/rerere-multi:
  rerere: adjust 'forget' to multi-variant world order
  rerere: split code to call ll_merge() further
  rerere: move code related to "forget" together
  rerere: gc and clear
  rerere: do use multiple variants
  t4200: rerere a merge with two identical conflicts
  rerere: allow multiple variants to exist
  rerere: delay the recording of preimage
  rerere: handle leftover rr-cache/$ID directory and postimage files
  rerere: scan $GIT_DIR/rr-cache/$ID when instantiating a rerere_id
  rerere: split conflict ID further

l10n-2.8.0-rnd3-fr

* tag 'l10n-2.8.0-rnd3-fr' of git://github.com/git-l10n/git-po:
  l10n: fr: don't translate "merge" as a parameter
  l10n: fr: change "id de clé" to match "id-clé"
  l10n: fr: fix wrongly translated option name
  l10n: fr: fix transcation of "dir"

* 'fr_v2.8.0_r3' of git://github.com/jnavila/git:
  l10n: fr: don't translate "merge" as a parameter
  l10n: fr: change "id de clé" to match "id-clé"
  l10n: fr: fix wrongly translated option name
  l10n: fr: fix transcation of "dir"