tree 267ce554418af206a48e1924200b08a6d1516e27
parent 7b5756577f6fdcd39916aabbb3c30e518d039b49
author Will Thompson <wjt@endlessm.com> 1511351035 +0000
committer Philip Withnall <withnall@endlessm.com> 1538562619 +0100

gfileutils: make g_file_set_contents() always fsync()

Previously, this function only called fsync() if @filename exists and is
non-empty. This behaviour was introduced when the function was first
written (6cff88ba18b3bc0d118308f109840cb163dcea03) and shortly
afterwards (d20a188b1250ab3cf211d684429127d99378e886) respectively, with
the latter justified as a performance optimisation.

This meant that g_file_set_contents() does not provide the guarantee
that developers assume it has, namely that after a call and a crash,
@filename will either contain its previous contents or its new
@contents. In practice, when it was previously non-existent or empty on
a bog-standard ext4 filesystem, it would often contain NUL bytes
matching the @length of @contents, requiring application developers to
explicitly handle this third case.

Given the documentation includes the word "atomic", we make this
function provide the guarantee that was previously implied but untrue,
and document it. If applications require higher performance at the cost
of correctness, they can open-code the old behaviour, or we can add a
new function to glib providing weaker guarantees.

https://gitlab.gnome.org/GNOME/glib/issues/1302