refactor/search: panic at corrupt offset source

Once corruption deliberately uses the crashed-shard recovery path, retaining mutable provider errors and later checkpoints only creates opportunities to forget propagation. Panic with shard, repository, document, and invariant context at detection so recovery remains immediate and valid searches carry no error-state bookkeeping.

Amp-Thread-ID: https://ampcode.com/threads/T-019fd1ab-1ad4-77f5-9b59-c65232f5b3f1

Author: keegancsmith

index/contentprovider.go

@@ -37,7 +37,6 @@ type contentProvider struct {
 	stats *zoekt.Stats
 
 	// mutable
-	err      error
 	idx      uint32
 	_data    []byte
 	_nl      []uint32
@@ -51,7 +50,6 @@ type contentProvider struct {
 func (p *contentProvider) setDocument(docID uint32) {
 	fileStart := p.id.boundaries[docID]
 
-	p.err = nil
 	p.idx = docID
 	p.fileSize = p.id.boundaries[docID+1] - fileStart
 
@@ -60,18 +58,34 @@ func (p *contentProvider) setDocument(docID uint32) {
 	p._data = nil
 }
 
-func (p *contentProvider) setError(err error) {
-	if p.err == nil {
-		p.err = err
+// panicCorrupt stops a search as soon as it detects a corrupt shard invariant.
+// searchOneShard recovers the panic at the shard boundary, logs the error with
+// the query and stack trace, and increments Stats.Crashes. Callers therefore get
+// partial results with an explicit crashed-shard signal rather than a silent
+// non-match.
+func (p *contentProvider) panicCorrupt(err error) {
+	shard := "unknown"
+	if p.id.file != nil {
+		shard = p.id.file.Name()
+	}
+	repo := "unknown"
+	if p.idx < uint32(len(p.id.repos)) {
+		repoID := p.id.repos[p.idx]
+		if int(repoID) < len(p.id.repoMetaData) {
+			repo = p.id.repoMetaData[repoID].Name
+		}
 	}
+	panic(fmt.Errorf("corrupt shard %q while searching repository %q, document %d: %w", shard, repo, p.idx, err))
 }
 
 func (p *contentProvider) docSections() []DocumentSection {
 	if p._sects == nil {
 		var sz uint32
 		var err error
 		p._sects, sz, err = p.id.readDocSections(p.idx, p._sectBuf)
-		p.setError(err)
+		if err != nil {
+			p.panicCorrupt(fmt.Errorf("reading document sections: %w", err))
+		}
 		p.stats.ContentBytesLoaded += int64(sz)
 		p._sectBuf = p._sects
 	}
@@ -83,7 +97,9 @@ func (p *contentProvider) newlines() newlines {
 		var sz uint32
 		var err error
 		p._nl, sz, err = p.id.readNewlines(p.idx, p._nlBuf)
-		p.setError(err)
+		if err != nil {
+			p.panicCorrupt(fmt.Errorf("reading newline offsets: %w", err))
+		}
 		p._nlBuf = p._nl
 		p.stats.ContentBytesLoaded += int64(sz)
 	}
@@ -98,7 +114,9 @@ func (p *contentProvider) data(fileName bool) []byte {
 	if p._data == nil {
 		var err error
 		p._data, err = p.id.readContents(p.idx)
-		p.setError(err)
+		if err != nil {
+			p.panicCorrupt(fmt.Errorf("reading content: %w", err))
+		}
 		p.stats.FilesLoaded++
 		p.stats.ContentBytesLoaded += int64(len(p._data))
 	}
@@ -128,7 +146,7 @@ func (p *contentProvider) findOffset(filename bool, r uint32) uint32 {
 
 	if p.id.metaData.PlainASCII {
 		if r > fileEndByte-fileStartByte {
-			p.setError(fmt.Errorf("corrupt index: document %d %s rune offset %d is after file size %d", p.idx, kind, r, fileEndByte-fileStartByte))
+			p.panicCorrupt(fmt.Errorf("%s rune offset %d is after file size %d", kind, r, fileEndByte-fileStartByte))
 			return 0
 		}
 		return r
@@ -139,7 +157,7 @@ func (p *contentProvider) findOffset(filename bool, r uint32) uint32 {
 		absR64 += uint64(runeEnds[p.idx-1])
 	}
 	if absR64 > uint64(^uint32(0)) {
-		p.setError(fmt.Errorf("corrupt index: document %d %s rune offset %d overflows the corpus rune offset", p.idx, kind, r))
+		p.panicCorrupt(fmt.Errorf("%s rune offset %d overflows the corpus rune offset", kind, r))
 		return 0
 	}
 	absR := uint32(absR64)
@@ -150,26 +168,26 @@ func (p *contentProvider) findOffset(filename bool, r uint32) uint32 {
 
 	if filename {
 		if byteOff > uint64(len(p.id.fileNameContent)) {
-			p.setError(fmt.Errorf("corrupt index: document %d filename rune offset %d maps to byte offset %d past filename data size %d", p.idx, absR, byteOff, len(p.id.fileNameContent)))
+			p.panicCorrupt(fmt.Errorf("filename rune offset %d maps to byte offset %d past filename data size %d", absR, byteOff, len(p.id.fileNameContent)))
 			return 0
 		}
 		data = p.id.fileNameContent[uint32(byteOff):]
 	} else {
 		corpusEnd := p.id.boundaries[len(p.id.boundaries)-1]
 		if byteOff > uint64(corpusEnd) {
-			p.setError(fmt.Errorf("corrupt index: document %d content rune offset %d maps to byte offset %d past content data size %d", p.idx, absR, byteOff, corpusEnd))
+			p.panicCorrupt(fmt.Errorf("content rune offset %d maps to byte offset %d past content data size %d", absR, byteOff, corpusEnd))
 			return 0
 		}
 		var err error
 		data, err = p.id.readContentSlice(uint32(byteOff), 3*runeOffsetFrequency)
 		if err != nil {
-			p.setError(fmt.Errorf("corrupt index: document %d content rune offset %d cannot load bytes at offset %d: %w", p.idx, absR, byteOff, err))
+			p.panicCorrupt(fmt.Errorf("content rune offset %d cannot load bytes at offset %d: %w", absR, byteOff, err))
 			return 0
 		}
 	}
 	for left > 0 {
 		if len(data) == 0 {
-			p.setError(fmt.Errorf("corrupt index: document %d %s rune offset %d has no decode bytes at byte offset %d", p.idx, kind, absR, byteOff))
+			p.panicCorrupt(fmt.Errorf("%s rune offset %d has no decode bytes at byte offset %d", kind, absR, byteOff))
 			return 0
 		}
 		_, sz := utf8.DecodeRune(data)
@@ -179,11 +197,11 @@ func (p *contentProvider) findOffset(filename bool, r uint32) uint32 {
 	}
 
 	if byteOff < uint64(fileStartByte) {
-		p.setError(fmt.Errorf("corrupt index: document %d %s rune offset %d maps to byte offset %d before file start %d", p.idx, kind, absR, byteOff, fileStartByte))
+		p.panicCorrupt(fmt.Errorf("%s rune offset %d maps to byte offset %d before file start %d", kind, absR, byteOff, fileStartByte))
 		return 0
 	}
 	if byteOff > uint64(fileEndByte) {
-		p.setError(fmt.Errorf("corrupt index: document %d %s rune offset %d maps to byte offset %d after file end %d", p.idx, kind, absR, byteOff, fileEndByte))
+		p.panicCorrupt(fmt.Errorf("%s rune offset %d maps to byte offset %d after file end %d", kind, absR, byteOff, fileEndByte))
 		return 0
 	}
 

index/eval.go

@@ -275,9 +275,6 @@ nextFileMatch:
 
 		for cost := costMin; cost <= costMax; cost++ {
 			state := evalMatchTree(cp, cost, known, mt)
-			if cp.err != nil {
-				panic(fmt.Errorf("corrupt shard %q while searching repository %q, document %d (%q): %w", d.file.Name(), md.Name, nextDoc, d.fileName(nextDoc), cp.err))
-			}
 			switch state {
 			case matchesRequiresHigherCost:
 				if cost == costMax {
@@ -343,9 +340,6 @@ nextFileMatch:
 		if opts.Whole {
 			fileMatch.Content = cp.data(false)
 		}
-		if cp.err != nil {
-			panic(fmt.Errorf("corrupt shard %q while searching repository %q, document %d (%q): %w", d.file.Name(), md.Name, nextDoc, d.fileName(nextDoc), cp.err))
-		}
 
 		matchedChunkRanges := 0
 		for _, cm := range fileMatch.ChunkMatches {

index/matchiter_test.go

@@ -13,6 +13,7 @@
 package index
 
 import (
+	"fmt"
 	"reflect"
 	"strings"
 	"testing"
@@ -161,9 +162,14 @@ func TestFindOffsetReportsInvalidMappings(t *testing.T) {
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			cp := contentProvider{id: &tc.id, idx: tc.idx}
-			cp.findOffset(true, tc.r)
-			if cp.err == nil || !strings.Contains(cp.err.Error(), tc.want) {
-				t.Fatalf("findOffset error = %v, want error containing %q", cp.err, tc.want)
+			var recovered any
+			func() {
+				defer func() { recovered = recover() }()
+				cp.findOffset(true, tc.r)
+			}()
+			panicText := fmt.Sprint(recovered)
+			if recovered == nil || !strings.Contains(panicText, tc.want) {
+				t.Fatalf("findOffset panic = %q, want panic containing %q", panicText, tc.want)
 			}
 		})
 	}

index/matchtree.go

@@ -740,9 +740,6 @@ nextLine:
 			for len(children[j]) > 0 {
 				candidate := children[j][0]
 				bo := int(cp.findOffset(false, candidate.runeOffset))
-				if cp.err != nil {
-					return matchesNone
-				}
 				if bo < lines[i].start {
 					children[j] = children[j][1:]
 					continue nextCandidate
@@ -979,18 +976,11 @@ func (t *substrMatchTree) matches(cp *contentProvider, cost int, known map[match
 	for _, m := range t.current {
 		if m.byteOffset == 0 && m.runeOffset > 0 {
 			m.byteOffset = cp.findOffset(m.fileName, m.runeOffset)
-			if cp.err != nil {
-				return matchesNone
-			}
 		}
 		content := cp.data(m.fileName)
-		if cp.err != nil {
-			return matchesNone
-		}
 		matched, err := m.matchContent(content)
 		if err != nil {
-			cp.setError(err)
-			return matchesNone
+			cp.panicCorrupt(err)
 		}
 		if matched {
 			pruned = append(pruned, m)