crashinject-helper

Overview ¶

Command crashinject-helper is the child process spawned by the crashinject harness during crash-injection tests. It should never be run directly; it is always invoked by crashinject.Run with the environment variables GOGRAPH_CRASH_AT and GOGRAPH_CRASH_DIR set.

Each scenario writes a specific artefact (WAL file, snapshot, …) to GOGRAPH_CRASH_DIR and then calls crashinject.Breakpoint at the named execution point. crashinject.Breakpoint sends SIGKILL to the process when GOGRAPH_CRASH_AT matches the breakpoint name, leaving the artefact in a deterministically torn state.

Registered scenarios:

wal.mid-frame  — writes one complete WAL frame, appends a partial
                 second-frame header, then crashes. The resulting
                 WAL file has a torn tail that wal.Reader must
                 detect as ErrTornFrame.

checkpoint.p2-snapshot-published-pre-truncate
               — commits an int64-keyed workload, then triggers a
                 non-blocking codec-aware checkpoint that crashes AFTER
                 the self-sufficient snapshot is published and durable
                 but BEFORE the WAL prefix is truncated. Recovery must
                 reconstruct the full state from the snapshot plus the
                 still-intact full WAL (idempotent whole-WAL replay).

checkpoint.truncprefix.tmp-written-pre-rename
checkpoint.truncprefix.post-rename-pre-dirfsync
checkpoint.truncprefix.post-rename-pre-bookkeeping
               — commits the seed, runs ONE complete checkpoint
                 (prefix-truncating to a self-sufficient snapshot),
                 commits one more "post" edge so the WAL carries a real
                 non-empty suffix, then triggers a SECOND checkpoint
                 whose prefix-truncate crashes at the named point in
                 wal.Writer.TruncatePrefix's atomic copy-then-rename.
                 Recovery must reconstruct the full committed state
                 (seed + post edge) from the snapshot plus whichever WAL
                 — original full or suffix-only — survives the crash.

recovery.snapshot-promote-post-rename-pre-fsync
               — builds the interrupted-publish on-disk state (a
                 stranded snapshot.bak with the live snapshot name
                 absent) and then runs recovery, which crashes AFTER
                 it renames the backup back onto the live name but
                 BEFORE it fsyncs the parent directory. Recovery from
                 the resulting artefacts must reconstruct the full
                 committed state — the promotion is idempotent and
                 crash-safe across a second crash at this point.