strip: make repair.strip transactional to avoid repository corruption

Uses a transaction instance from the local repository to journal the
truncation of revlog files, such that if a strip only partially completes,
hg recover will be able to finish the truncate of all the files.

The potential unbundling of changes that have been backed up to be restored
later will, in case of an error, have to be unbundled manually. The
difference is that it will be possible to recover the repository state so
the unbundle can actually succeed.

tests/test-repair-strip

@@ -0,0 +1,36 b''
+#!/bin/sh
+
+echo "[extensions]" >> $HGRCPATH
+echo "mq=">> $HGRCPATH
+
+teststrip() {
+    hg -q up -C $1
+    echo % before update $1, strip $2
+    hg parents
+    chmod -$3 $4
+    hg strip $2 2>&1 | sed 's/\(saving bundle to \).*/\1/' | sed 's/Permission denied.*\.hg\/store\/\(.*\)/Permission denied \.hg\/store\/\1/'
+    echo % after update $1, strip $2
+    chmod +$3 $4
+    hg verify
+    echo % journal contents
+    cat .hg/store/journal | sed 's/\.i[^\n]*/\.i/'
+    ls .hg/store/journal >/dev/null 2>&1 && hg recover
+    ls .hg/strip-backup/* >/dev/null 2>&1 && hg unbundle -q .hg/strip-backup/*
+    rm -rf .hg/strip-backup
+}
+
+hg init test
+cd test
+
+echo a > a
+hg -q ci -m "a" -A
+
+echo b > b
+hg -q ci -m "b" -A
+
+echo c > c
+hg -q ci -m "c" -A
+
+teststrip 0 1 w .hg/store/data/b.i
+teststrip 0 1 r .hg/store/data/b.i
+teststrip 0 1 w .hg/store/00changelog.i

tests/test-repair-strip.out

@@ -0,0 +1,83 b''
+% before update 0, strip 1
+changeset:   0:cb9a9f314b8b
+user:        test
+date:        Thu Jan 01 00:00:00 1970 +0000
+summary:     a
+
+saving bundle to 
+transaction abort!
+failed to truncate data/b.i
+rollback failed - please run hg recover
+abort: Permission denied .hg/store/data/b.i
+% after update 0, strip 1
+checking changesets
+checking manifests
+crosschecking files in changesets and manifests
+checking files
+warning: orphan revlog 'data/b.i'
+1 files, 1 changesets, 1 total revisions
+1 warnings encountered!
+% journal contents
+00changelog.i
+00manifest.i
+data/b.i
+data/c.i
+rolling back interrupted transaction
+checking changesets
+checking manifests
+crosschecking files in changesets and manifests
+checking files
+1 files, 1 changesets, 1 total revisions
+% before update 0, strip 1
+changeset:   0:cb9a9f314b8b
+user:        test
+date:        Thu Jan 01 00:00:00 1970 +0000
+summary:     a
+
+abort: Permission denied .hg/store/data/b.i
+% after update 0, strip 1
+checking changesets
+checking manifests
+crosschecking files in changesets and manifests
+checking files
+3 files, 3 changesets, 3 total revisions
+% journal contents
+cat: .hg/store/journal: No such file or directory
+% before update 0, strip 1
+changeset:   0:cb9a9f314b8b
+user:        test
+date:        Thu Jan 01 00:00:00 1970 +0000
+summary:     a
+
+saving bundle to 
+transaction abort!
+failed to truncate 00changelog.i
+rollback failed - please run hg recover
+abort: Permission denied .hg/store/00changelog.i
+% after update 0, strip 1
+checking changesets
+checking manifests
+crosschecking files in changesets and manifests
+ 1: changeset refers to unknown manifest a539ce0c1a22
+ 2: changeset refers to unknown manifest e3738bf54399
+ b@1: in changeset but not in manifest
+ c@2: in changeset but not in manifest
+checking files
+ data/b.i@1: missing revlog!
+ 0: empty or missing b
+ data/c.i@2: missing revlog!
+ 0: empty or missing c
+3 files, 3 changesets, 1 total revisions
+8 integrity errors encountered!
+(first damaged changeset appears to be 0)
+% journal contents
+00changelog.i
+00manifest.i
+data/b.i
+data/c.i
+rolling back interrupted transaction
+checking changesets
+checking manifests
+crosschecking files in changesets and manifests
+checking files
+1 files, 1 changesets, 1 total revisions

mercurial/repair.py

@@ -118,11 +118,25 b' def strip(ui, repo, node, backup="all"):'
         chgrpfile = _bundle(repo, savebases, saveheads, node, 'temp',
                             extranodes)
 
-    cl.strip(striprev)
-    repo.manifest.strip(striprev)
-    for name in files:
-        f = repo.file(name)
-        f.strip(striprev)
+    fs = [repo.file(name) for name in files]
+    mfst = repo.manifest
+
+    tr = repo.transaction()
+    offset = len(tr.entries)
+
+    cl.strip(striprev, tr)
+    mfst.strip(striprev, tr)
+    for f in fs:
+        f.strip(striprev, tr)
+
+    try:
+        for i in xrange(offset, len(tr.entries)):
+            file, troffset, ignore = tr.entries[i]
+            repo.sopener(file, 'a').truncate(troffset)
+        tr.close()
+    except:
+        tr.abort()
+        raise
 
     if saveheads or extranodes:
         ui.status(_("adding branch\n"))

mercurial/revlog.py

@@ -1285,7 +1285,7 b' class revlog(object):'
 
         return node
 
-    def strip(self, minlink):
+    def strip(self, minlink, transaction):
         """truncate the revlog on the first revision with a linkrev >= minlink
 
         This function is called when we're stripping revision minlink and
@@ -1314,14 +1314,12 b' class revlog(object):'
         # first truncate the files on disk
         end = self.start(rev)
         if not self._inline:
-            df = self.opener(self.datafile, "a")
-            df.truncate(end)
+            transaction.add(self.datafile, end)
             end = rev * self._io.size
         else:
             end += rev * self._io.size
 
-        indexf = self.opener(self.indexfile, "a")
-        indexf.truncate(end)
+        transaction.add(self.indexfile, end)
 
         # then reset internal state in memory to forget those revisions
         self._cache = None