rust-dirstate: panic if the DirstateMap counters go below 0 When modifying the API I hit some... interesting errors (trying to allocate 178GB of RAM, for example) because I failed to keep the counters correctly updated. This counter underflow is likely to happen when code is changed around and can have up to eat-your-dirstate level of consequences, which is not nice. The very small runtime cost of checking these counters should really not be an issue and will help us uncover bugs when/if they do appear in the future. Differential Revision: https://phab.mercurial-scm.org/D12430

rust: fix unsound `OwningDirstateMap` As per the previous patch, `OwningDirstateMap` is unsound. Self-referential structs are difficult to implement correctly in Rust since the compiler is free to move structs around as much as it wants to. They are also very rarely needed in practice, so the state-of-the-art on how they should be done within the Rust rules is still a bit new. The crate `ouroboros` is an attempt at providing a safe way (in the Rust sense) of declaring self-referential structs. It is getting a lot attention and was improved very quickly when soundness issues were found in the past: rather than relying on our own (limited) review circle, we might as well use the de-facto common crate to fix this problem. This will give us a much better chance of finding issues should any new ones be discovered as well as the benefit of fewer `unsafe` APIs of our own. I was starting to think about how I would present a safe API to the old struct but soon realized that the callback-based approach was already done in `ouroboros`, along with a lot more care towards refusing incorrect structs. In short: we don't return a mutable reference to the `DirstateMap` anymore, we expect users of its API to pass a `FnOnce` that takes the map as an argument. This allows our `OwningDirstateMap` to control the input and output lifetimes of the code that modifies it to prevent such issues. Changing to `ouroboros` meant changing every API with it, but it is relatively low churn in the end. It correctly identified the example buggy modification of `copy_map_insert` outlined in the previous patch as violating the borrow rules. Differential Revision: https://phab.mercurial-scm.org/D12429

rust: explain why the current `OwningDirstateMap` is unsound See inline comments. Differential Revision: https://phab.mercurial-scm.org/D12428

dispatch: fix silly blackbox entries when hg is interrupted When hg is interrupted, it creates ui.log like this: 1970/01/01 00:00:00 user @0000000000000000000000000000000000000000 (62488)> killed! exited 255 after 1.78 seconds This is due to a scoping problem: two different uses of the name "msg" collide. So rename one of them. Differential Revision: https://phab.mercurial-scm.org/D12427

precheck: fix false warning about content-divergence creation Before this patch, if we try to `hg prune` (without any successors) an already obsoleted cset which has at least one successor, it would false warn about new content-divergence. As we know, pruning cset without any successors can not create any divergence. Differential Revision: https://phab.mercurial-scm.org/D12002

streamclone: avoid some obscure error in a corner case I don't really know how, but I ran into this error: $ hg clone --stream ssh://user@dummy/empty-repo local-empty-repo streaming all changes abort: unable to apply stream clone: unsupported format: [255] I think you need an empty list of requirements for this to happen, which is weird, but an obscure error like this is not exactly helpful either. Since this is the result of an encoding bug anyway, just fix it. Differential Revision: https://phab.mercurial-scm.org/D12402

tags: fix typo in fast path detection of fnode resolution (issue6673) If I understand it, mctx.readfast() is unreliable here if p1/p2 .hgtags nodes differ, and tags on that branch would be randomly discarded depending on which parent were picked. The test case added by this patch would fail only on zstd-compressed repository. I didn't try hard to stabilize the failure case.

dirstate-cext: properly invalidate mtime and data in `set_untracked` This was forgotten about in the initial implementation and was revealed while adding the `dirstate-v2` variant of `test-issue660.t`. Neither the existing Python implementation nor the upcoming Rust implementation suffer from this bug since they respectively have `None` and `Option<T>` to represent the lack of information. Differential Revision: https://phab.mercurial-scm.org/D12414

pullbundle: fix file name in the help text It is pullbundles.manifest and not pullbundle.manifest. Differential Revision: https://phab.mercurial-scm.org/D12391

unamend: abort if commit was not created by `hg [un]amend` `hg unamend` can currently undo any kind of rewrite, as long as it has an obsmarker. However, that has quite unexpected results if you run it after e.g. `hg rebase` (expecting it to behave like a generic `hg undo` command), because it updates to the predecessor and leaves the old changes in the working copy. I think it's better to allow `hg unamend` only after `hg amend` (and after `hg unamend` because that's documented as being supported). Differential Revision: https://phab.mercurial-scm.org/D12390