cmdutil: add class to restore dirstate during unexpected failure

Before this patch, after "dirstate.write()" execution, there was no way to
restore dirstate to the original status before "dirstate.write()".

In some code paths, "dirstate.invalidate()" is used as a kind of "restore
.hg/dirstate to the original status", but it just avoids writing changes in
memory out, and doesn't actually restore the ".hg/dirstate" file.

To fix the issue that the recent (in memory) dirstate isn't visible to external
processes (e.g. "precommit" hooks), "dirstate.write()" should be invoked before
invocation of external processes. But at the same time, ".hg/dirstate" should be
restored to its content before "dirstate.write()" during an unexpected failure
in some cases.

This patch adds the class "dirstateguard" to easily restore ".hg/dirstate"
during unexpected failures. Typical usecase of it is:

    # (1) build dirstate up
    ....

    # (2) write dirstate out, and backup ".hg/dirstate"
    dsguard = dirstateguard(repo, 'scopename')
    try:
        # (3) execute somethig to do:
        #     this may imply making some additional changes on dirstate
        ....

        # (4) unlink backed-up dirstate file at the end of dsguard scope
        dsguard.close()
    finally:
        # (5) if execution is aborted before "dsguard.close()",
        #     ".hg/dirstate" is restored from the backup
        dsguard.release()

For this kind of issue, an "extending transaction" approach (in
https://titanpad.com/mercurial32-sprint) seems to not be suitable, because:

  - transaction nesting occurs in some cases (e.g. "shelve => rebase"), and

  - "dirstate" may be already modified since the beginning of OUTER
    transaction scope, then

  - dirstate should be backed up into the file other than
    "dirstate.journal" at the beginning of INNER transaction scope, but

  - such alternative backup files are useless for transaction itself,
    and increases complication of its implementation

"transaction" and "dirstateguard" differ from each other also in "what
it should do for .hg/dirstate" in cases other than success.

  ============== ======= ======== =============
  type           success fail     "hg rollback"
  ============== ======= ======== =============
  transaction    keep     keep     restore
  dirstateguard  keep     restore  (not implied)
  ============== ======= ======== =============

Some collaboration between transaction and dirstate will probably be introduced
in the future. But this layer is needed in all cases.

mercurial/cmdutil.py

@@ -3259,3 +3259,59 b' def clearunfinished(repo):'
     for f, clearable, allowcommit, msg, hint in unfinishedstates:
         if clearable and repo.vfs.exists(f):
             util.unlink(repo.join(f))
+
+class dirstateguard(object):
+    '''Restore dirstate at unexpected failure.
+
+    At the construction, this class does:
+
+    - write current ``repo.dirstate`` out, and
+    - save ``.hg/dirstate`` into the backup file
+
+    This restores ``.hg/dirstate`` from backup file, if ``release()``
+    is invoked before ``close()``.
+
+    This just removes the backup file at ``close()`` before ``release()``.
+    '''
+
+    def __init__(self, repo, name):
+        repo.dirstate.write()
+        self._repo = repo
+        self._filename = 'dirstate.backup.%s.%d' % (name, id(self))
+        repo.vfs.write(self._filename, repo.vfs.tryread('dirstate'))
+        self._active = True
+        self._closed = False
+
+    def __del__(self):
+        if self._active: # still active
+            # this may occur, even if this class is used correctly:
+            # for example, releasing other resources like transaction
+            # may raise exception before ``dirstateguard.release`` in
+            # ``release(tr, ....)``.
+            self._abort()
+
+    def close(self):
+        if not self._active: # already inactivated
+            msg = (_("can't close already inactivated backup: %s")
+                   % self._filename)
+            raise util.Abort(msg)
+
+        self._repo.vfs.unlink(self._filename)
+        self._active = False
+        self._closed = True
+
+    def _abort(self):
+        # this "invalidate()" prevents "wlock.release()" from writing
+        # changes of dirstate out after restoring to original status
+        self._repo.dirstate.invalidate()
+
+        self._repo.vfs.rename(self._filename, 'dirstate')
+        self._active = False
+
+    def release(self):
+        if not self._closed:
+            if not self._active: # already inactivated
+                msg = (_("can't release already inactivated backup: %s")
+                       % self._filename)
+                raise util.Abort(msg)
+            self._abort()