fix(trie): fail-closed on malformed tombstone (CodeRabbit follow-up to #798)#799
Conversation
…residual Follow-up to #798 addressing two CodeRabbit findings on the generational GC: - Major: a non-8-byte tombstone payload mapped to tv=0, making a corrupt entry immediately reapable (could delete live trie data). Now fail closed — skip reaping malformed tombstones (keep the entry) and warn, instead of defaulting to 0. - Critical (documentation): the reap still has a narrow content-addressed resurrection window inside its own scan+delete. Documented the caller contract (tree.rs re-augments `live` to the latest committed root immediately before each gc pass, collapsing the window from the old multi-minute walk to this method's ms-scale scan+delete) and that the complete elimination needs writer-coupling (walk+delete in one RW txn) — the tracked fix this PR-series deliberately defers to avoid a chain-blocking write lock. This series strictly narrows the race; verify_integrity remains the backstop. Regression test: a malformed tombstone must not authorise deletion (data survives). sentrix-trie: 83 passed.
|
Warning Review limit reached
More reviews will be available in 33 minutes and 4 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
1 participant
Addresses the two CodeRabbit findings on #798's generational GC.
tv=0→ instantly reapable (could delete live trie data). Now fail closed: skip reaping malformed tombstones + warn, never default to 0.tree.rsre-augmentsliveto the latest root immediately before each gc pass → window collapses from the old multi-minute walk to ms) and that full elimination needs writer-coupling (single RW txn) — the deferred complete fix. Strictly narrows the race;verify_integrityis the backstop.Regression test: malformed tombstone must not authorise deletion.
cargo test -p sentrix-trie: 83 passed.