reftable: fix quadratic behavior when re-creating deleted refs

This series fixes quadratic behavior in update-ref when many refs are deleted (tombstoned) and then new refs are created with the reftable backend.

The root cause is the merged iterator's suppress_deletions flag, which silently consumes tombstone records in a tight internal loop. This prevents higher-level code from checking iteration bounds until after all tombstones have been scanned, making both refs_verify_refnames_available() and reftable_backend_read_ref() O(n) per call in the presence of tombstones.

The fix removes suppress_deletions from the merged iterator and instead handles deletion records at each call site in the reftable backend, where prefix and refname bounds are available. This lets existing bounds checks terminate iteration early when encountering tombstones past the relevant bound.

The first patch adds tests for tombstone scenarios: a perf test (p1401) exercising two patterns with 8000 refs, and a correctness test (t0610) verifying that deleted-then-recreated refs are visible.

The second patch is the pure optimization. Both p1401 tests go from ~14s to ~0.2s with the fix.

Note that auto-compaction typically merges tombstones before they accumulate to this degree, so the quadratic behavior may not show up in every workflow. But the fix ensures correct time complexity regardless of compaction state, and the change is fairly contained.

Previous discussion:
https://lore.kernel.org/git/[email protected]/

Kristofer Karlsson (2):
t: add tests for ref tombstone scenarios
reftable: fix quadratic behavior when re-creating deleted refs

 refs/reftable-backend.c              | 54 ++++++++++++++++++++++------
 reftable/merged.c                    | 12 +------
 reftable/merged.h                    |  4 ---
 reftable/stack.c                     |  1 -
 t/perf/p1401-ref-store-tombstones.sh | 44 +++++++++++++++++++++++
 t/t0610-reftable-basics.sh           | 22 ++++++++++++
 6 files changed, 110 insertions(+), 27 deletions(-)
 create mode 100755 t/perf/p1401-ref-store-tombstones.sh

base-commit: e9019fcafe0040228b8631c30f97ae1adb61bcdc
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-2166%2Fspkrka%2Freftable-tombstone-perf-v1
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-2166/spkrka/reftable-tombstone-perf-v1
Pull-Request: https://github.com/gitgitgadget/git/pull/2166

gitgitgadget

From: Kristofer Karlsson <[email protected]>

Add a performance test and a correctness test for update-ref when many tombstones are present in a reftable.

The performance test (p1401) exercises two scenarios:

- All refs are deleted (creating tombstones) and then re-created with the same names, which currently exhibits quadratic behavior.

- An asymmetric variant where refs are deleted and then new, differently-named refs are created. When the tombstones sort after the new refs, every create scans all tombstones, making this case even worse than re-creating the same refs.

The correctness test (t0610) verifies that refs deleted and then re-created with the same names are visible afterwards.

---
 t/perf/p1401-ref-store-tombstones.sh | 44 ++++++++++++++++++++++++++++
 t/t0610-reftable-basics.sh           | 22 ++++++++++++++
 2 files changed, 66 insertions(+)
 create mode 100755 t/perf/p1401-ref-store-tombstones.sh

new file mode 100755
index 0000000000..e40a6dcbf4
@@ -0,0 +1,44 @@
+#!/bin/sh
+
+test_description="Tests performance of ref operations with many tombstones"
+
+. ./perf-lib.sh
+
+test_expect_success "setup" '
+	git init --ref-format=reftable repo &&
+	blob=$(echo foo | git -C repo hash-object -w --stdin) &&
+	for i in $(test_seq 8000)
+	do
+		printf "create refs/tags/tag-%d %s\n" "$i" "$blob" ||
+		return 1
+	done >repo/input &&
+	git -C repo update-ref --stdin <repo/input &&
+	git -C repo for-each-ref --format="delete %(refname)" |
+	git -C repo update-ref --stdin
+'
+
+test_perf "recreate refs after mass delete" '
+	git -C repo update-ref --stdin <repo/input &&
+	git -C repo for-each-ref --format="delete %(refname)" |
+	git -C repo update-ref --stdin
+'
+
+test_expect_success "setup asymmetric" '
+	for i in $(test_seq 8000)
+	do
+		printf "create refs/tags/old-%d %s\n" "$i" "$blob" ||
+		return 1
+	done >repo/input-old &&
+	sed "s/old-/new-/" <repo/input-old >repo/input-new &&
+	git -C repo update-ref --stdin <repo/input-old &&
+	git -C repo for-each-ref --format="delete %(refname)" |
+	git -C repo update-ref --stdin
+'
+
+test_perf "create new refs after deleting differently-named refs" '
+	git -C repo update-ref --stdin <repo/input-new &&
+	git -C repo for-each-ref --format="delete %(refname)" |
+	git -C repo update-ref --stdin
+'
+
+test_done

index e19e036898..4b7cfe38e4 100755
@@ -1163,4 +1163,26 @@ test_expect_success 'writes do not persist peeled value for invalid tags' '
 	)
 '
 
+test_expect_success 'delete and re-create refs with tombstones' '
+	test_when_finished "rm -rf repo" &&
+	git init repo &&
+	test_commit -C repo A &&
+	A=$(git -C repo rev-parse HEAD) &&
+	cat >input <<-EOF &&
+	create refs/tags/a $A
+	create refs/tags/b $A
+	create refs/tags/c $A
+	EOF
+	git -C repo update-ref --stdin <input &&
+
+	# delete all tags, leaving tombstones
+	git -C repo for-each-ref --format="delete %(refname)" refs/tags/ |
+	git -C repo update-ref --stdin &&
+
+	# re-create the same refs and verify they are visible
+	git -C repo update-ref --stdin <input &&
+	git -C repo tag -l >actual &&
+	test_line_count = 3 actual
+'
+
 test_done

gitgitgadget

From: Kristofer Karlsson <[email protected]>

When many refs are deleted and then re-created, update-ref exhibits quadratic behavior. With 8000 refs deleted and re-created, the runtime is ~15s, quadrupling for each doubling of input size.

The root cause is the merged iterator's suppress_deletions flag. When set, merged_iter_next_void() silently consumes tombstone records in a tight internal loop before returning to the caller. This prevents higher-level code from checking iteration bounds (such as prefix or refname comparisons) until after all tombstones have been scanned.

This affects two code paths during ref creation:

- refs_verify_refnames_available() seeks to "refs/tags/foo-1/" to check for D/F conflicts and must scan through all subsequent tombstones before the caller can see that they are past the prefix of interest.

- reftable_backend_read_ref() seeks to a specific refname and must scan through all subsequent tombstones before returning "not found", because the merged iterator skips the matching tombstone and searches for the next live record.

Fix this by removing suppress_deletions from the merged iterator and instead handling deletion records at each call site in the reftable backend, where prefix and refname bounds are available. Tombstones are now returned to callers, which skip them after their existing bounds checks. This allows iteration to terminate as soon as a tombstone past the relevant bound is encountered.

This also requires adding deletion checks to the log iteration paths, since suppress_deletions applied to both ref and log iterators.

Both tests in p1401 go from ~14s to ~0.2s with this change.

---
 refs/reftable-backend.c | 54 ++++++++++++++++++++++++++++++++---------
 reftable/merged.c       | 12 +--------
 reftable/merged.h       |  4 ---
 reftable/stack.c        |  1 -
 4 files changed, 44 insertions(+), 27 deletions(-)

index 4ae22922de..8c4f119ff1 100644
@@ -86,7 +86,8 @@ static int reftable_backend_read_ref(struct reftable_backend *be,
 	if (ret)
 		goto done;
 
-	if (strcmp(ref.refname, refname)) {
+	if (strcmp(ref.refname, refname) ||
+	    reftable_ref_record_is_deletion(&ref)) {
 		ret = 1;
 		goto done;
 	}

@@ -112,7 +113,6 @@ static int reftable_backend_read_ref(struct reftable_backend *be,
 		oidread(oid, reftable_ref_record_val1(&ref),
 			&hash_algos[hash_id]);
 	} else {
-		/* We got a tombstone, which should not happen. */
 		BUG("unhandled reference value type %d", ref.value_type);
 	}
 

@@ -633,6 +633,9 @@ static int reftable_ref_iterator_advance(struct ref_iterator *ref_iterator)
 			break;
 		}
 
+		if (iter->ref.value_type == REFTABLE_REF_DELETION)
+			continue;
+
 		if (iter->exclude_patterns && should_exclude_current_ref(iter))
 			continue;
 

@@ -1492,6 +1495,8 @@ static int write_transaction_table(struct reftable_writer *writer, void *cb_data
 					ret = 0;
 					break;
 				}
+				if (reftable_log_record_is_deletion(&log))
+					continue;
 
 				ALLOC_GROW(logs, logs_nr + 1, logs_alloc);
 				tombstone = &logs[logs_nr++];

@@ -1889,6 +1894,8 @@ static int write_copy_table(struct reftable_writer *writer, void *cb_data)
 			ret = 0;
 			break;
 		}
+		if (reftable_log_record_is_deletion(&old_log))
+			continue;
 
 		free(old_log.refname);
 

@@ -2019,6 +2026,9 @@ static int reftable_reflog_iterator_advance(struct ref_iterator *ref_iterator)
 		if (iter->err)
 			break;
 
+		if (reftable_log_record_is_deletion(&iter->log))
+			continue;
+
 		/*
 		 * We want the refnames that we have reflogs for, so we skip if
 		 * we've already produced this name. This could be faster by

@@ -2178,6 +2188,8 @@ static int reftable_be_for_each_reflog_ent_reverse(struct ref_store *ref_store,
 			ret = 0;
 			break;
 		}
+		if (reftable_log_record_is_deletion(&log))
+			continue;
 
 		ret = yield_log_record(refs, &log, fn, cb_data);
 		if (ret)

@@ -2230,6 +2242,10 @@ static int reftable_be_for_each_reflog_ent(struct ref_store *ref_store,
 			ret = 0;
 			break;
 		}
+		if (reftable_log_record_is_deletion(&log)) {
+			reftable_log_record_release(&log);
+			continue;
+		}
 
 		ALLOC_GROW(logs, logs_nr + 1, logs_alloc);
 		logs[logs_nr++] = log;

@@ -2276,18 +2292,26 @@ static int reftable_be_reflog_exists(struct ref_store *ref_store,
 		goto done;
 
 	/*
-	 * Check whether we get at least one log record for the given ref name.
-	 * If so, the reflog exists, otherwise it doesn't.
+	 * Check whether we get at least one non-deleted log record for the
+	 * given ref name.  If so, the reflog exists, otherwise it doesn't.
 	 */
-	ret = reftable_iterator_next_log(&it, &log);
-	if (ret < 0)
-		goto done;
-	if (ret > 0) {
-		ret = 0;
-		goto done;
+	while (1) {
+		ret = reftable_iterator_next_log(&it, &log);
+		if (ret < 0)
+			goto done;
+		if (ret > 0) {
+			ret = 0;
+			goto done;
+		}
+		if (strcmp(log.refname, refname)) {
+			ret = 0;
+			goto done;
+		}
+		if (!reftable_log_record_is_deletion(&log))
+			break;
 	}
 
-	ret = strcmp(log.refname, refname) == 0;
+	ret = 1;
 
 done:
 	reftable_iterator_destroy(&it);

@@ -2399,6 +2423,8 @@ static int write_reflog_delete_table(struct reftable_writer *writer, void *cb_da
 			ret = 0;
 			break;
 		}
+		if (reftable_log_record_is_deletion(&log))
+			continue;
 
 		tombstone.refname = (char *)arg->refname;
 		tombstone.value_type = REFTABLE_LOG_DELETION;

@@ -2580,6 +2606,10 @@ static int reftable_be_reflog_expire(struct ref_store *ref_store,
 			reftable_log_record_release(&log);
 			break;
 		}
+		if (reftable_log_record_is_deletion(&log)) {
+			reftable_log_record_release(&log);
+			continue;
+		}
 
 		oidread(&old_oid, log.value.update.old_hash,
 			ref_store->repo->hash_algo);

@@ -2746,6 +2776,8 @@ static int reftable_be_fsck(struct ref_store *ref_store, struct fsck_options *o,
 		report.path = refname.buf;
 
 		switch (ref.value_type) {
+		case REFTABLE_REF_DELETION:
+			continue;
 		case REFTABLE_REF_VAL1:
 		case REFTABLE_REF_VAL2: {
 			struct object_id oid;

index 733de07454..2f9a361234 100644
@@ -26,7 +26,6 @@ struct merged_iter {
 	struct merged_subiter *subiters;
 	struct merged_iter_pqueue pq;
 	size_t subiters_len;
-	int suppress_deletions;
 	ssize_t advance_index;
 };
 

@@ -166,15 +165,7 @@ static int merged_iter_seek_void(void *it, struct reftable_record *want)
 
 static int merged_iter_next_void(void *p, struct reftable_record *rec)
 {
-	struct merged_iter *mi = p;
-	while (1) {
-		int err = merged_iter_next_entry(mi, rec);
-		if (err)
-			return err;
-		if (mi->suppress_deletions && reftable_record_is_deletion(rec))
-			continue;
-		return 0;
-	}
+	return merged_iter_next_entry(p, rec);
 }
 
 static struct reftable_iterator_vtable merged_iter_vtable = {

@@ -278,7 +269,6 @@ int merged_table_init_iter(struct reftable_merged_table *mt,
 		goto out;
 	}
 	mi->advance_index = -1;
-	mi->suppress_deletions = mt->suppress_deletions;
 	mi->subiters = subiters;
 	mi->subiters_len = mt->tables_len;
 

index 4317e5f5f6..6fafd1d080 100644
@@ -17,10 +17,6 @@ struct reftable_merged_table {
 	size_t tables_len;
 	enum reftable_hash hash_id;
 
-	/* If unset, produce deletions. This is useful for compaction. For the
-	 * full stack, deletions should be produced. */
-	int suppress_deletions;
-
 	uint64_t min;
 	uint64_t max;
 };

index 1fba96ddb3..77aeac4715 100644
@@ -337,7 +337,6 @@ static int reftable_stack_reload_once(struct reftable_stack *st,
 	/* Update the stack to point to the new tables. */
 	if (st->merged)
 		reftable_merged_table_free(st->merged);
-	new_merged->suppress_deletions = 1;
 	st->merged = new_merged;
 
 	if (st->tables)

gitgitgadget

It probably not only impacts reference creation, but also every reader that wants to search for a specific reference that doesn't exist.

This option is still used by downstream users of the reftable library, like libgit2. So we shouldn't just delete it outright.

	if (iter->prefix_len &&
	    strncmp(iter->prefix, iter->ref.refname, iter->prefix_len)) {
		iter->err = 1;
		break;
	}

Hm good point, I will try to rephrase this better.

Good catch! I can keep suppress_deletions as-is and just stop setting it from stack.c. That way libgit2 is unchanged, while we still optimize it at the other call sites. The reftable library diff then shrinks to a single removed line.

Indeed, this is the primary win.

Thanks! Appreciate the review (and spotting the libgit breakage!) Kristofer

I don't think measuring the full create+delete cycle is wrong per se, but you are right that if we can benchmark something more isolated is even more useful. I will try to split this up better.

Agreed, I can use a fresh repo for each scenario.

I could not find an existing test that covers the delete-then-recreate flow (where tombstones are present when the new refs are created). The existing tests cover creation and deletion separately but not the interaction with tombstones.
(But perhaps such a test exists and I just can't find it.)

Thanks,
Kristofer

In t1400 we definitely have some tests where we exercise this implicitly. In any case, if we want to retain this test I'd rather add it to t1400 itself, as the functionality that we're testing is itself not specific to the backend.

Patrick

Thanks, you are right about the placement -- the contract is valid regardless of backend.
You are also right about it already being tested this is implicitly tested between multiple test runs since they have shared state (the repo). Multiple tests delete the ref as clean up and multiple tests also create a ref and verifies it.

So it is technically covered but it depends on multiple tests being executed. I think this is simply exposing my personal preference to have more self-contained and explicit tests, but I am happy to drop the added tests -- it is perhaps more important to avoid bloating the test code.

I will drop the added correctness test for the next iteration.

Thanks,
Kristofer

[…]

I had hit this before when doing some benchmarks for using reftable at $DAYJOB. We had discussed it on the list and decided that it was synthetic at the time, but I'm glad to see that this is being fixed now.

I don't have comments on the patches themselves because I haven't spent enough time in the reftable code to be familiar with it, but I do definitely appreciate the performance improvement.

brian m. carlson (they/them)
Toronto, Ontario, CA

This series fixes quadratic behavior in the reftable backend when many tombstones are present. Any operation that seeks into a range containing tombstones is affected, including ref lookups and D/F conflict checks.

The root cause is the merged iterator's suppress_deletions flag, which silently consumes tombstone records in a tight internal loop. This prevents higher-level code from checking iteration bounds until after all tombstones have been scanned, making both refs_verify_refnames_available() and reftable_backend_read_ref() O(n) per call in the presence of tombstones.

The fix stops setting suppress_deletions on the stack's merged table and instead handles deletion records at each call site in the reftable backend, where prefix and refname bounds are available. This lets existing bounds checks terminate iteration early when encountering tombstones past the relevant bound.

The suppress_deletions flag and its logic are retained in the merged iterator for downstream users of the reftable library (e.g. libgit2).

The first patch adds a perf test (p1401) exercising two tombstone scenarios with 8000 refs. The second patch is the optimization. Both p1401 tests go from ~13s to ~0.2s with the fix.

Note that auto-compaction typically merges tombstones before they accumulate to this degree, so the quadratic behavior may not show up in every workflow. But the fix ensures correct time complexity regardless of compaction state, and the change is fairly contained.

Changes since v1:

* Keep suppress_deletions in the reftable library for downstream users; only stop setting it in stack.c
* Broaden scope description to cover all readers, not just ref creation
* Use separate repositories in perf test to avoid cross-scenario state
* Drop correctness test (implicitly covered by t1400)

Previous discussion:
https://lore.kernel.org/git/[email protected]/

Kristofer Karlsson (2):
t/perf: add perf test for ref tombstone scenarios
reftable: fix quadratic behavior in the presence of tombstones

 refs/reftable-backend.c              | 54 ++++++++++++++++++++++------
 reftable/stack.c                     |  1 -
 t/perf/p1401-ref-store-tombstones.sh | 46 ++++++++++++++++++++++++
 3 files changed, 89 insertions(+), 12 deletions(-)
 create mode 100755 t/perf/p1401-ref-store-tombstones.sh

base-commit: f85a7e662054a7b0d9070e432508831afa214b47
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-2166%2Fspkrka%2Freftable-tombstone-perf-v2
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-2166/spkrka/reftable-tombstone-perf-v2
Pull-Request: https://github.com/gitgitgadget/git/pull/2166

Range-diff vs v1:

1: d8ffdcb4f8 ! 1: 889d0d38bc t: add tests for ref tombstone scenarios

     @@ Metadata
      Author: Kristofer Karlsson <[email protected]>
      
       ## Commit message ##
     -    t: add tests for ref tombstone scenarios
     +    t/perf: add perf test for ref tombstone scenarios
      
     -    Add a performance test and a correctness test for update-ref when
     -    many tombstones are present in a reftable.
     +    Add performance tests for update-ref when many tombstones are present
     +    in a reftable.
      
     -    The performance test (p1401) exercises two scenarios:
     +    The first test exercises the scenario where all refs are deleted
     +    (creating tombstones) and then re-created with the same names, which
     +    currently exhibits quadratic behavior.
      
     -     - All refs are deleted (creating tombstones) and then re-created
     -       with the same names, which currently exhibits quadratic behavior.
     -
     -     - An asymmetric variant where refs are deleted and then new,
     -       differently-named refs are created.  When the tombstones sort
     -       after the new refs, every create scans all tombstones, making
     -       this case even worse than re-creating the same refs.
     -
     -    The correctness test (t0610) verifies that refs deleted and then
     -    re-created with the same names are visible afterwards.
     +    The second test uses a separate repository with an asymmetric variant
     +    where refs are deleted and then new, differently-named refs are
     +    created.  When the tombstones sort after the new refs, every create
     +    scans all tombstones, making this case even worse than re-creating
     +    the same refs.
      
          Helped-by: Jeff King <[email protected]>
          Signed-off-by: Kristofer Karlsson <[email protected]>
     @@ t/perf/p1401-ref-store-tombstones.sh (new)
      +'
      +
      +test_expect_success "setup asymmetric" '
     ++	git init --ref-format=reftable repo2 &&
     ++	blob=$(echo foo | git -C repo2 hash-object -w --stdin) &&
      +	for i in $(test_seq 8000)
      +	do
      +		printf "create refs/tags/old-%d %s\n" "$i" "$blob" ||
      +		return 1
     -+	done >repo/input-old &&
     -+	sed "s/old-/new-/" <repo/input-old >repo/input-new &&
     -+	git -C repo update-ref --stdin <repo/input-old &&
     -+	git -C repo for-each-ref --format="delete %(refname)" |
     -+	git -C repo update-ref --stdin
     ++	done >repo2/input-old &&
     ++	sed "s/old-/new-/" <repo2/input-old >repo2/input-new &&
     ++	git -C repo2 update-ref --stdin <repo2/input-old &&
     ++	git -C repo2 for-each-ref --format="delete %(refname)" |
     ++	git -C repo2 update-ref --stdin
      +'
      +
      +test_perf "create new refs after deleting differently-named refs" '
     -+	git -C repo update-ref --stdin <repo/input-new &&
     -+	git -C repo for-each-ref --format="delete %(refname)" |
     -+	git -C repo update-ref --stdin
     ++	git -C repo2 update-ref --stdin <repo2/input-new &&
     ++	git -C repo2 for-each-ref --format="delete %(refname)" refs/tags/ |
     ++	git -C repo2 update-ref --stdin
      +'
      +
      +test_done
     -
     - ## t/t0610-reftable-basics.sh ##
     -@@ t/t0610-reftable-basics.sh: test_expect_success 'writes do not persist peeled value for invalid tags' '
     - 	)
     - '
     - 
     -+test_expect_success 'delete and re-create refs with tombstones' '
     -+	test_when_finished "rm -rf repo" &&
     -+	git init repo &&
     -+	test_commit -C repo A &&
     -+	A=$(git -C repo rev-parse HEAD) &&
     -+	cat >input <<-EOF &&
     -+	create refs/tags/a $A
     -+	create refs/tags/b $A
     -+	create refs/tags/c $A
     -+	EOF
     -+	git -C repo update-ref --stdin <input &&
     -+
     -+	# delete all tags, leaving tombstones
     -+	git -C repo for-each-ref --format="delete %(refname)" refs/tags/ |
     -+	git -C repo update-ref --stdin &&
     -+
     -+	# re-create the same refs and verify they are visible
     -+	git -C repo update-ref --stdin <input &&
     -+	git -C repo tag -l >actual &&
     -+	test_line_count = 3 actual
     -+'
     -+
     - test_done

2: 1459371d3a ! 2: c13f15ddc2 reftable: fix quadratic behavior when re-creating deleted refs
@@ Metadata
Author: Kristofer Karlsson <[email protected]>

## Commit message ##
- reftable: fix quadratic behavior when re-creating deleted refs
+ reftable: fix quadratic behavior in the presence of tombstones

- When many refs are deleted and then re-created, update-ref exhibits
- quadratic behavior. With 8000 refs deleted and re-created, the
- runtime is ~15s, quadrupling for each doubling of input size.
+ When many tombstones are present in a reftable, operations that need
+ to look up or iterate over refs exhibit quadratic behavior. With
+ 8000 refs deleted and re-created, update-ref takes ~15s, quadrupling
+ for each doubling of input size.

The root cause is the merged iterator's suppress_deletions flag. When set, merged_iter_next_void() silently consumes tombstone records
@@ Commit message
prefix or refname comparisons) until after all tombstones have been scanned.

- This affects two code paths during ref creation:
+ This affects any code path that seeks into a range containing
+ tombstones, including:

- refs_verify_refnames_available() seeks to "refs/tags/foo-1/" to check for D/F conflicts and must scan through all subsequent
@@ Commit message
found", because the merged iterator skips the matching tombstone and searches for the next live record.

- Fix this by removing suppress_deletions from the merged iterator and
- instead handling deletion records at each call site in the reftable
- backend, where prefix and refname bounds are available. Tombstones
- are now returned to callers, which skip them after their existing
- bounds checks. This allows iteration to terminate as soon as a
- tombstone past the relevant bound is encountered.
+ Fix this by no longer setting suppress_deletions on the stack's
+ merged table and instead handling deletion records at each call site
+ in the reftable backend, where prefix and refname bounds are
+ available. Tombstones are now returned to callers, which skip them
+ after their existing bounds checks. This allows iteration to
+ terminate as soon as a tombstone past the relevant bound is
+ encountered.
+
+ The suppress_deletions flag and its logic in the merged iterator are
+ retained for downstream users of the reftable library (e.g. libgit2).

This also requires adding deletion checks to the log iteration paths, since suppress_deletions applied to both ref and log iterators.
@@ refs/reftable-backend.c: static int reftable_be_fsck(struct ref_store *ref_store
case REFTABLE_REF_VAL2: {
struct object_id oid;

- ## reftable/merged.c ##
-@@ reftable/merged.c: struct merged_iter {
- struct merged_subiter *subiters;
- struct merged_iter_pqueue pq;
- size_t subiters_len;
-- int suppress_deletions;
- ssize_t advance_index;
- };
-
-@@ reftable/merged.c: static int merged_iter_seek_void(void *it, struct reftable_record *want) -
- static int merged_iter_next_void(void *p, struct reftable_record *rec)
- {
-- struct merged_iter *mi = p;
-- while (1) {
-- int err = merged_iter_next_entry(mi, rec);
-- if (err)
-- return err;
-- if (mi->suppress_deletions && reftable_record_is_deletion(rec))
-- continue;
-- return 0;
-- }
-+ return merged_iter_next_entry(p, rec);
- }
-
- static struct reftable_iterator_vtable merged_iter_vtable = {
-@@ reftable/merged.c: int merged_table_init_iter(struct reftable_merged_table *mt,
- goto out;
- }
- mi->advance_index = -1;
-- mi->suppress_deletions = mt->suppress_deletions;
- mi->subiters = subiters;
- mi->subiters_len = mt->tables_len;
-
-
- ## reftable/merged.h ##
-@@ reftable/merged.h: struct reftable_merged_table {
- size_t tables_len;
- enum reftable_hash hash_id;
-
-- /* If unset, produce deletions. This is useful for compaction. For the
-- * full stack, deletions should be produced. */
-- int suppress_deletions;
--
- uint64_t min;
- uint64_t max;
- };
-
## reftable/stack.c ##
@@ reftable/stack.c: static int reftable_stack_reload_once(struct reftable_stack *st,
/* Update the stack to point to the new tables. */

gitgitgadget

From: Kristofer Karlsson <[email protected]>

Add performance tests for update-ref when many tombstones are present in a reftable.

The first test exercises the scenario where all refs are deleted (creating tombstones) and then re-created with the same names, which currently exhibits quadratic behavior.

The second test uses a separate repository with an asymmetric variant where refs are deleted and then new, differently-named refs are created. When the tombstones sort after the new refs, every create scans all tombstones, making this case even worse than re-creating the same refs.

---
 t/perf/p1401-ref-store-tombstones.sh | 46 ++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100755 t/perf/p1401-ref-store-tombstones.sh

new file mode 100755
index 0000000000..9e3d8031aa
@@ -0,0 +1,46 @@
+#!/bin/sh
+
+test_description="Tests performance of ref operations with many tombstones"
+
+. ./perf-lib.sh
+
+test_expect_success "setup" '
+	git init --ref-format=reftable repo &&
+	blob=$(echo foo | git -C repo hash-object -w --stdin) &&
+	for i in $(test_seq 8000)
+	do
+		printf "create refs/tags/tag-%d %s\n" "$i" "$blob" ||
+		return 1
+	done >repo/input &&
+	git -C repo update-ref --stdin <repo/input &&
+	git -C repo for-each-ref --format="delete %(refname)" |
+	git -C repo update-ref --stdin
+'
+
+test_perf "recreate refs after mass delete" '
+	git -C repo update-ref --stdin <repo/input &&
+	git -C repo for-each-ref --format="delete %(refname)" |
+	git -C repo update-ref --stdin
+'
+
+test_expect_success "setup asymmetric" '
+	git init --ref-format=reftable repo2 &&
+	blob=$(echo foo | git -C repo2 hash-object -w --stdin) &&
+	for i in $(test_seq 8000)
+	do
+		printf "create refs/tags/old-%d %s\n" "$i" "$blob" ||
+		return 1
+	done >repo2/input-old &&
+	sed "s/old-/new-/" <repo2/input-old >repo2/input-new &&
+	git -C repo2 update-ref --stdin <repo2/input-old &&
+	git -C repo2 for-each-ref --format="delete %(refname)" |
+	git -C repo2 update-ref --stdin
+'
+
+test_perf "create new refs after deleting differently-named refs" '
+	git -C repo2 update-ref --stdin <repo2/input-new &&
+	git -C repo2 for-each-ref --format="delete %(refname)" refs/tags/ |
+	git -C repo2 update-ref --stdin
+'
+
+test_done

gitgitgadget

From: Kristofer Karlsson <[email protected]>

When many tombstones are present in a reftable, operations that need to look up or iterate over refs exhibit quadratic behavior. With 8000 refs deleted and re-created, update-ref takes ~15s, quadrupling for each doubling of input size.

The root cause is the merged iterator's suppress_deletions flag. When set, merged_iter_next_void() silently consumes tombstone records in a tight internal loop before returning to the caller. This prevents higher-level code from checking iteration bounds (such as prefix or refname comparisons) until after all tombstones have been scanned.

This affects any code path that seeks into a range containing tombstones, including:

- refs_verify_refnames_available() seeks to "refs/tags/foo-1/" to check for D/F conflicts and must scan through all subsequent tombstones before the caller can see that they are past the prefix of interest.

- reftable_backend_read_ref() seeks to a specific refname and must scan through all subsequent tombstones before returning "not found", because the merged iterator skips the matching tombstone and searches for the next live record.

Fix this by no longer setting suppress_deletions on the stack's merged table and instead handling deletion records at each call site in the reftable backend, where prefix and refname bounds are available. Tombstones are now returned to callers, which skip them after their existing bounds checks. This allows iteration to terminate as soon as a tombstone past the relevant bound is encountered.

The suppress_deletions flag and its logic in the merged iterator are retained for downstream users of the reftable library (e.g. libgit2).

This also requires adding deletion checks to the log iteration paths, since suppress_deletions applied to both ref and log iterators.

Both tests in p1401 go from ~14s to ~0.2s with this change.

---
 refs/reftable-backend.c | 54 ++++++++++++++++++++++++++++++++---------
 reftable/stack.c        |  1 -
 2 files changed, 43 insertions(+), 12 deletions(-)

index 212408c769..028f0211af 100644
@@ -84,7 +84,8 @@ static int reftable_backend_read_ref(struct reftable_backend *be,
 	if (ret)
 		goto done;
 
-	if (strcmp(ref.refname, refname)) {
+	if (strcmp(ref.refname, refname) ||
+	    reftable_ref_record_is_deletion(&ref)) {
 		ret = 1;
 		goto done;
 	}

@@ -110,7 +111,6 @@ static int reftable_backend_read_ref(struct reftable_backend *be,
 		oidread(oid, reftable_ref_record_val1(&ref),
 			&hash_algos[hash_id]);
 	} else {
-		/* We got a tombstone, which should not happen. */
 		BUG("unhandled reference value type %d", ref.value_type);
 	}
 

@@ -652,6 +652,9 @@ static int reftable_ref_iterator_advance(struct ref_iterator *ref_iterator)
 			break;
 		}
 
+		if (iter->ref.value_type == REFTABLE_REF_DELETION)
+			continue;
+
 		if (iter->exclude_patterns && should_exclude_current_ref(iter))
 			continue;
 

@@ -1532,6 +1535,8 @@ static int write_transaction_table(struct reftable_writer *writer, void *cb_data
 					ret = 0;
 					break;
 				}
+				if (reftable_log_record_is_deletion(&log))
+					continue;
 
 				ALLOC_GROW(logs, logs_nr + 1, logs_alloc);
 				tombstone = &logs[logs_nr++];

@@ -1929,6 +1934,8 @@ static int write_copy_table(struct reftable_writer *writer, void *cb_data)
 			ret = 0;
 			break;
 		}
+		if (reftable_log_record_is_deletion(&old_log))
+			continue;
 
 		free(old_log.refname);
 

@@ -2061,6 +2068,9 @@ static int reftable_reflog_iterator_advance(struct ref_iterator *ref_iterator)
 		if (iter->err)
 			break;
 
+		if (reftable_log_record_is_deletion(&iter->log))
+			continue;
+
 		/*
 		 * We want the refnames that we have reflogs for, so we skip if
 		 * we've already produced this name. This could be faster by

@@ -2220,6 +2230,8 @@ static int reftable_be_for_each_reflog_ent_reverse(struct ref_store *ref_store,
 			ret = 0;
 			break;
 		}
+		if (reftable_log_record_is_deletion(&log))
+			continue;
 
 		ret = yield_log_record(refs, &log, fn, cb_data);
 		if (ret)

@@ -2272,6 +2284,10 @@ static int reftable_be_for_each_reflog_ent(struct ref_store *ref_store,
 			ret = 0;
 			break;
 		}
+		if (reftable_log_record_is_deletion(&log)) {
+			reftable_log_record_release(&log);
+			continue;
+		}
 
 		ALLOC_GROW(logs, logs_nr + 1, logs_alloc);
 		logs[logs_nr++] = log;

@@ -2318,18 +2334,26 @@ static int reftable_be_reflog_exists(struct ref_store *ref_store,
 		goto done;
 
 	/*
-	 * Check whether we get at least one log record for the given ref name.
-	 * If so, the reflog exists, otherwise it doesn't.
+	 * Check whether we get at least one non-deleted log record for the
+	 * given ref name.  If so, the reflog exists, otherwise it doesn't.
 	 */
-	ret = reftable_iterator_next_log(&it, &log);
-	if (ret < 0)
-		goto done;
-	if (ret > 0) {
-		ret = 0;
-		goto done;
+	while (1) {
+		ret = reftable_iterator_next_log(&it, &log);
+		if (ret < 0)
+			goto done;
+		if (ret > 0) {
+			ret = 0;
+			goto done;
+		}
+		if (strcmp(log.refname, refname)) {
+			ret = 0;
+			goto done;
+		}
+		if (!reftable_log_record_is_deletion(&log))
+			break;
 	}
 
-	ret = strcmp(log.refname, refname) == 0;
+	ret = 1;
 
 done:
 	reftable_iterator_destroy(&it);

@@ -2442,6 +2466,8 @@ static int write_reflog_delete_table(struct reftable_writer *writer, void *cb_da
 			ret = 0;
 			break;
 		}
+		if (reftable_log_record_is_deletion(&log))
+			continue;
 
 		tombstone.refname = (char *)arg->refname;
 		tombstone.value_type = REFTABLE_LOG_DELETION;

@@ -2625,6 +2651,10 @@ static int reftable_be_reflog_expire(struct ref_store *ref_store,
 			reftable_log_record_release(&log);
 			break;
 		}
+		if (reftable_log_record_is_deletion(&log)) {
+			reftable_log_record_release(&log);
+			continue;
+		}
 
 		oidread(&old_oid, log.value.update.old_hash,
 			ref_store->repo->hash_algo);

@@ -2791,6 +2821,8 @@ static int reftable_be_fsck(struct ref_store *ref_store, struct fsck_options *o,
 		report.path = refname.buf;
 
 		switch (ref.value_type) {
+		case REFTABLE_REF_DELETION:
+			continue;
 		case REFTABLE_REF_VAL1:
 		case REFTABLE_REF_VAL2: {
 			struct object_id oid;

index ab12926708..fd7d8f3f1e 100644
@@ -337,7 +337,6 @@ static int reftable_stack_reload_once(struct reftable_stack *st,
 	/* Update the stack to point to the new tables. */
 	if (st->merged)
 		reftable_merged_table_free(st->merged);
-	new_merged->suppress_deletions = 1;
 	st->merged = new_merged;
 
 	if (st->tables)

gitgitgadget

You are right, I (still) missed the compatibility problem here.

I started thinking about a way to make it fully backwards compatible, but then I looked at the libgit2 repo and realized it will need updating anyway since it predates the reftable_stack_options split.

I will add suppress_deletions to reftable_stack_options as you suggested.

Thanks,
Kristofer

Yeah, that's something I'll handle soon(ish).

Thanks!

Patrick

This series fixes quadratic behavior in the reftable backend when many tombstones are present. Any operation that seeks into a range containing tombstones is affected, including ref lookups and D/F conflict checks.

The root cause is the merged iterator's suppress_deletions flag, which silently consumes tombstone records in a tight internal loop. This prevents higher-level code from checking iteration bounds until after all tombstones have been scanned, making both refs_verify_refnames_available() and reftable_backend_read_ref() O(n) per call in the presence of tombstones.

The fix makes suppress_deletions configurable via reftable_stack_options (defaulting to off) and handles deletion records at each call site in the reftable backend, where prefix and refname bounds are available. This lets existing bounds checks terminate iteration early when encountering tombstones past the relevant bound.

Downstream users of the reftable library (e.g. libgit2) can enable suppress_deletions through the stack options to retain the previous behavior.

The first patch adds a perf test (p1401) exercising two tombstone scenarios with 8000 refs. The second patch is the optimization. Both p1401 tests go from ~13s to ~0.2s with the fix.

Note that auto-compaction typically merges tombstones before they accumulate to this degree, so the quadratic behavior may not show up in every workflow. But the fix ensures correct time complexity regardless of compaction state, and the change is fairly contained.

Changes since v2:

* Add suppress_deletions to reftable_stack_options so downstream callers can control it at stack creation time (suggested by Patrick)

Changes since v1:

* Keep suppress_deletions in the reftable library for downstream users; only stop setting it in stack.c
* Broaden scope description to cover all readers, not just ref creation
* Use separate repositories in perf test to avoid cross-scenario state
* Drop correctness test (implicitly covered by t1400)

Previous discussion:
https://lore.kernel.org/git/[email protected]/

Kristofer Karlsson (2):
t/perf: add perf test for ref tombstone scenarios
reftable: fix quadratic behavior in the presence of tombstones

 refs/reftable-backend.c              | 54 ++++++++++++++++++++++------
 reftable/reftable-stack.h            |  2 ++
 reftable/stack.c                     |  2 +-
 t/perf/p1401-ref-store-tombstones.sh | 46 ++++++++++++++++++++++++
 4 files changed, 92 insertions(+), 12 deletions(-)
 create mode 100755 t/perf/p1401-ref-store-tombstones.sh

base-commit: f85a7e662054a7b0d9070e432508831afa214b47
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-2166%2Fspkrka%2Freftable-tombstone-perf-v3
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-2166/spkrka/reftable-tombstone-perf-v3
Pull-Request: https://github.com/gitgitgadget/git/pull/2166

Range-diff vs v2:

 1:  889d0d38bc = 1:  889d0d38bc t/perf: add perf test for ref tombstone scenarios
 2:  c13f15ddc2 ! 2:  4fdcec8440 reftable: fix quadratic behavior in the presence of tombstones

@@ Commit message
found", because the merged iterator skips the matching tombstone and searches for the next live record.

- Fix this by no longer setting suppress_deletions on the stack's
- merged table and instead handling deletion records at each call site
- in the reftable backend, where prefix and refname bounds are
- available. Tombstones are now returned to callers, which skip them
- after their existing bounds checks. This allows iteration to
- terminate as soon as a tombstone past the relevant bound is
- encountered.
+ Fix this by making suppress_deletions configurable via
+ reftable_stack_options instead of unconditionally enabling it. Git
+ no longer sets the flag, so tombstones are now returned to callers in
+ the reftable backend, which skip them after their existing bounds
+ checks. This allows iteration to terminate as soon as a tombstone
+ past the relevant bound is encountered.

- The suppress_deletions flag and its logic in the merged iterator are
- retained for downstream users of the reftable library (e.g. libgit2).
+ Downstream users of the reftable library (e.g. libgit2) can still
+ enable suppress_deletions through the stack options to retain the
+ previous behavior.

This also requires adding deletion checks to the log iteration paths, since suppress_deletions applied to both ref and log iterators.

- Both tests in p1401 go from ~14s to ~0.2s with this change.
+ Both tests in p1401 go from ~13s to ~0.2s with this change.

@@ refs/reftable-backend.c: static int reftable_be_fsck(struct ref_store *ref_store
case REFTABLE_REF_VAL2: {
struct object_id oid;

+ ## reftable/reftable-stack.h ##
+@@ reftable/reftable-stack.h: struct reftable_stack_options {
+ */
+ void (*on_reload)(void *payload);
+ void *on_reload_payload;
++
++ int suppress_deletions;
+ };
+
+ /* open a new reftable stack. The tables along with the table list will be +
## reftable/stack.c ##
@@ reftable/stack.c: static int reftable_stack_reload_once(struct reftable_stack *st,
/* Update the stack to point to the new tables. */
if (st->merged)
reftable_merged_table_free(st->merged);
- new_merged->suppress_deletions = 1;
++ new_merged->suppress_deletions = st->opts.suppress_deletions;
st->merged = new_merged;

if (st->tables)

gitgitgadget

From: Kristofer Karlsson <[email protected]>

Add performance tests for update-ref when many tombstones are present in a reftable.

The first test exercises the scenario where all refs are deleted (creating tombstones) and then re-created with the same names, which currently exhibits quadratic behavior.

The second test uses a separate repository with an asymmetric variant where refs are deleted and then new, differently-named refs are created. When the tombstones sort after the new refs, every create scans all tombstones, making this case even worse than re-creating the same refs.

---
 t/perf/p1401-ref-store-tombstones.sh | 46 ++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100755 t/perf/p1401-ref-store-tombstones.sh

new file mode 100755
index 0000000000..9e3d8031aa
@@ -0,0 +1,46 @@
+#!/bin/sh
+
+test_description="Tests performance of ref operations with many tombstones"
+
+. ./perf-lib.sh
+
+test_expect_success "setup" '
+	git init --ref-format=reftable repo &&
+	blob=$(echo foo | git -C repo hash-object -w --stdin) &&
+	for i in $(test_seq 8000)
+	do
+		printf "create refs/tags/tag-%d %s\n" "$i" "$blob" ||
+		return 1
+	done >repo/input &&
+	git -C repo update-ref --stdin <repo/input &&
+	git -C repo for-each-ref --format="delete %(refname)" |
+	git -C repo update-ref --stdin
+'
+
+test_perf "recreate refs after mass delete" '
+	git -C repo update-ref --stdin <repo/input &&
+	git -C repo for-each-ref --format="delete %(refname)" |
+	git -C repo update-ref --stdin
+'
+
+test_expect_success "setup asymmetric" '
+	git init --ref-format=reftable repo2 &&
+	blob=$(echo foo | git -C repo2 hash-object -w --stdin) &&
+	for i in $(test_seq 8000)
+	do
+		printf "create refs/tags/old-%d %s\n" "$i" "$blob" ||
+		return 1
+	done >repo2/input-old &&
+	sed "s/old-/new-/" <repo2/input-old >repo2/input-new &&
+	git -C repo2 update-ref --stdin <repo2/input-old &&
+	git -C repo2 for-each-ref --format="delete %(refname)" |
+	git -C repo2 update-ref --stdin
+'
+
+test_perf "create new refs after deleting differently-named refs" '
+	git -C repo2 update-ref --stdin <repo2/input-new &&
+	git -C repo2 for-each-ref --format="delete %(refname)" refs/tags/ |
+	git -C repo2 update-ref --stdin
+'
+
+test_done

gitgitgadget

From: Kristofer Karlsson <[email protected]>

When many tombstones are present in a reftable, operations that need to look up or iterate over refs exhibit quadratic behavior. With 8000 refs deleted and re-created, update-ref takes ~15s, quadrupling for each doubling of input size.

The root cause is the merged iterator's suppress_deletions flag. When set, merged_iter_next_void() silently consumes tombstone records in a tight internal loop before returning to the caller. This prevents higher-level code from checking iteration bounds (such as prefix or refname comparisons) until after all tombstones have been scanned.

This affects any code path that seeks into a range containing tombstones, including:

- refs_verify_refnames_available() seeks to "refs/tags/foo-1/" to check for D/F conflicts and must scan through all subsequent tombstones before the caller can see that they are past the prefix of interest.

- reftable_backend_read_ref() seeks to a specific refname and must scan through all subsequent tombstones before returning "not found", because the merged iterator skips the matching tombstone and searches for the next live record.

Fix this by making suppress_deletions configurable via reftable_stack_options instead of unconditionally enabling it. Git no longer sets the flag, so tombstones are now returned to callers in the reftable backend, which skip them after their existing bounds checks. This allows iteration to terminate as soon as a tombstone past the relevant bound is encountered.

Downstream users of the reftable library (e.g. libgit2) can still enable suppress_deletions through the stack options to retain the previous behavior.

This also requires adding deletion checks to the log iteration paths, since suppress_deletions applied to both ref and log iterators.

Both tests in p1401 go from ~13s to ~0.2s with this change.

---
 refs/reftable-backend.c   | 54 +++++++++++++++++++++++++++++++--------
 reftable/reftable-stack.h |  2 ++
 reftable/stack.c          |  2 +-
 3 files changed, 46 insertions(+), 12 deletions(-)

index 212408c769..028f0211af 100644
@@ -84,7 +84,8 @@ static int reftable_backend_read_ref(struct reftable_backend *be,
 	if (ret)
 		goto done;
 
-	if (strcmp(ref.refname, refname)) {
+	if (strcmp(ref.refname, refname) ||
+	    reftable_ref_record_is_deletion(&ref)) {
 		ret = 1;
 		goto done;
 	}

@@ -110,7 +111,6 @@ static int reftable_backend_read_ref(struct reftable_backend *be,
 		oidread(oid, reftable_ref_record_val1(&ref),
 			&hash_algos[hash_id]);
 	} else {
-		/* We got a tombstone, which should not happen. */
 		BUG("unhandled reference value type %d", ref.value_type);
 	}
 

@@ -652,6 +652,9 @@ static int reftable_ref_iterator_advance(struct ref_iterator *ref_iterator)
 			break;
 		}
 
+		if (iter->ref.value_type == REFTABLE_REF_DELETION)
+			continue;
+
 		if (iter->exclude_patterns && should_exclude_current_ref(iter))
 			continue;
 

@@ -1532,6 +1535,8 @@ static int write_transaction_table(struct reftable_writer *writer, void *cb_data
 					ret = 0;
 					break;
 				}
+				if (reftable_log_record_is_deletion(&log))
+					continue;
 
 				ALLOC_GROW(logs, logs_nr + 1, logs_alloc);
 				tombstone = &logs[logs_nr++];

@@ -1929,6 +1934,8 @@ static int write_copy_table(struct reftable_writer *writer, void *cb_data)
 			ret = 0;
 			break;
 		}
+		if (reftable_log_record_is_deletion(&old_log))
+			continue;
 
 		free(old_log.refname);
 

@@ -2061,6 +2068,9 @@ static int reftable_reflog_iterator_advance(struct ref_iterator *ref_iterator)
 		if (iter->err)
 			break;
 
+		if (reftable_log_record_is_deletion(&iter->log))
+			continue;
+
 		/*
 		 * We want the refnames that we have reflogs for, so we skip if
 		 * we've already produced this name. This could be faster by

@@ -2220,6 +2230,8 @@ static int reftable_be_for_each_reflog_ent_reverse(struct ref_store *ref_store,
 			ret = 0;
 			break;
 		}
+		if (reftable_log_record_is_deletion(&log))
+			continue;
 
 		ret = yield_log_record(refs, &log, fn, cb_data);
 		if (ret)

@@ -2272,6 +2284,10 @@ static int reftable_be_for_each_reflog_ent(struct ref_store *ref_store,
 			ret = 0;
 			break;
 		}
+		if (reftable_log_record_is_deletion(&log)) {
+			reftable_log_record_release(&log);
+			continue;
+		}
 
 		ALLOC_GROW(logs, logs_nr + 1, logs_alloc);
 		logs[logs_nr++] = log;

@@ -2318,18 +2334,26 @@ static int reftable_be_reflog_exists(struct ref_store *ref_store,
 		goto done;
 
 	/*
-	 * Check whether we get at least one log record for the given ref name.
-	 * If so, the reflog exists, otherwise it doesn't.
+	 * Check whether we get at least one non-deleted log record for the
+	 * given ref name.  If so, the reflog exists, otherwise it doesn't.
 	 */
-	ret = reftable_iterator_next_log(&it, &log);
-	if (ret < 0)
-		goto done;
-	if (ret > 0) {
-		ret = 0;
-		goto done;
+	while (1) {
+		ret = reftable_iterator_next_log(&it, &log);
+		if (ret < 0)
+			goto done;
+		if (ret > 0) {
+			ret = 0;
+			goto done;
+		}
+		if (strcmp(log.refname, refname)) {
+			ret = 0;
+			goto done;
+		}
+		if (!reftable_log_record_is_deletion(&log))
+			break;
 	}
 
-	ret = strcmp(log.refname, refname) == 0;
+	ret = 1;
 
 done:
 	reftable_iterator_destroy(&it);

@@ -2442,6 +2466,8 @@ static int write_reflog_delete_table(struct reftable_writer *writer, void *cb_da
 			ret = 0;
 			break;
 		}
+		if (reftable_log_record_is_deletion(&log))
+			continue;
 
 		tombstone.refname = (char *)arg->refname;
 		tombstone.value_type = REFTABLE_LOG_DELETION;

@@ -2625,6 +2651,10 @@ static int reftable_be_reflog_expire(struct ref_store *ref_store,
 			reftable_log_record_release(&log);
 			break;
 		}
+		if (reftable_log_record_is_deletion(&log)) {
+			reftable_log_record_release(&log);
+			continue;
+		}
 
 		oidread(&old_oid, log.value.update.old_hash,
 			ref_store->repo->hash_algo);

@@ -2791,6 +2821,8 @@ static int reftable_be_fsck(struct ref_store *ref_store, struct fsck_options *o,
 		report.path = refname.buf;
 
 		switch (ref.value_type) {
+		case REFTABLE_REF_DELETION:
+			continue;
 		case REFTABLE_REF_VAL1:
 		case REFTABLE_REF_VAL2: {
 			struct object_id oid;

index 11f9963f4f..5d22d84e80 100644
@@ -42,6 +42,8 @@ struct reftable_stack_options {
 	 */
 	void (*on_reload)(void *payload);
 	void *on_reload_payload;
+
+	int suppress_deletions;
 };
 
 /* open a new reftable stack. The tables along with the table list will be

index ab12926708..caaedf24d6 100644
@@ -337,7 +337,7 @@ static int reftable_stack_reload_once(struct reftable_stack *st,
 	/* Update the stack to point to the new tables. */
 	if (st->merged)
 		reftable_merged_table_free(st->merged);
-	new_merged->suppress_deletions = 1;
+	new_merged->suppress_deletions = st->opts.suppress_deletions;
 	st->merged = new_merged;
 
 	if (st->tables)

gitgitgadget

Nit: s/applied/applies/

Language and using correct tense is always the tricky part -- will fix if a reroll is needed for other reasons.

Agreed, the field name felt self-documenting to me, but I will add a short comment if there is a reroll.
Something like this?
"boolean: filters out tombstoned/deleted refs early if true"

Thanks for the quick review.

Another thing I have been thinking about: should we consider suppress_deletions a temporary stopgap, with the goal of eventually removing it?

I took a look at libgit2's refdb_reftable.c to see what it would look like. It doesn't seem _too_ complicated (but I have been wrong about complexity before):

reftable_stack_read_ref() and reftable_stack_read_log() already check is_deletion() after the seek+next, so the call sites that use those would work correctly without suppress_deletions too. (I think?)

The other call sites that iterate would need the same type of filter as we have in this patch series.

So the total cost for libgit2 to stop relying on suppress_deletions would be fairly small and it would maybe also got a nice performance boost for the edge cases, though I have not attempted to verify that.

That said, it does not affect this patch - regardless of the future we will need this flag now.

Thanks,
Kristofer

I'd drop the "boolean: " prefix, but other than that this looks sensible to me.

Maybe? I'll update libgit2 as soon as both ps/reftable-hardening and kk/reftable-tombstone-quadratic-fix have been merged to "master". Once done, feel free to create a pull request against libgit2 to deactivate suppress_deletions there, and once that's happened we can also drop the code in Git itself.

Thanks!

Patrick