fix(core): store gap snapshot before writeHeadBlock to close crash window - #2482
Closed
gzliudan wants to merge 1 commit into
Closed
fix(core): store gap snapshot before writeHeadBlock to close crash window#2482gzliudan wants to merge 1 commit into
gzliudan wants to merge 1 commit into
Conversation
gzliudan
requested review from
AnilChinchawale,
anunay-xin,
benjamin202410,
liam-lai and
wanwiset25
July 22, 2026 04:21
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…ndow
UpdateMasternodes (called via UpdateM1) ran after writeHeadBlock, leaving a
window in which the persisted head pointed at a gap block while no matching
snapshot existed in the database. A kill or restart during the lengthy
per-candidate EVM calls in UpdateM1 made that snapshot permanently missing, and
on the next boot the node failed with "Cannot find snapshot from last gap block"
on every block of the following epoch, silently dropping out of consensus.
Add storeGapSnapshot(header), which derives candidates and stakes from the
committed state trie of the given block the same way downloader.generateSnapshot
does, instead of depending on bc.CurrentBlock() or bc.CurrentHeader(). The
canonical path calls it before writeHeadBlock; the reorg path derives the
snapshots of the whole new chain up front, so a failure aborts the reorg before
it mutates anything instead of leaving it half applied.
Both paths report a failure as an error instead of log.Crit: the head is left on
a block that has a snapshot and the import is retried later, rather than taking
the node down.
UpdateM1 becomes a thin wrapper that resolves the current head and its state and
delegates to updateM1ForBlock. It no longer queries the validator contract
through bc.GetClient(), which drops the IPC dependency. The snapshot is
unchanged: getCandidateCap() returns validatorsState[_candidate].cap, the very
slot StateDB.GetCandidateCap reads, and the old "latest" resolved to the same gap
block because the call ran after writeHeadBlock under chainmu.
This closes the crash window only, two holes remain and both need getSnapshot to
rebuild a missing snapshot on demand:
- Fast sync leaves no gap snapshots below the pivot, because
commitFastSyncData bypasses writeBlockWithState.
- A reorg only gives up on the new head when the masternode set cannot be
derived. An older block of the new chain whose tries are already pruned is
skipped with a warning, because aborting there would strand the node on the
old chain forever, so that block keeps the very hole this change prevents.
Tests record the raw database write order through an ethdb wrapper and assert
that the gap snapshot is persisted before the head markers on the canonical path,
on the reorg path and under the v2 engine, that neither path advances the head
when the masternode set cannot be derived, that an aborted reorg leaves the old
chain untouched, and that UpdateM1 works without a client.
gzliudan
force-pushed
the
fix-leveldb-not-found-v28
branch
from
August 7, 2026 02:41
eac783b to
c556c9c
Compare
Collaborator
Author
|
replaced by #2508 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
UpdateMasternodes (called via UpdateM1) was invoked after writeHeadBlock, leaving a window where the node head pointed to a gap block but no corresponding snapshot existed in the database. If the process was killed or restarted during the lengthy per-candidate EVM calls in UpdateM1, the snapshot would never be written. On the next boot the node would load the gap block as its head, then fail with:
Cannot find snapshot from last gap block err="leveldb: not found"
on every block in the following epoch, silently dropping out of consensus.
Fix: add updateM1ForBlock(block, statedb) which reads candidates and stakes directly from the committed state trie (same as downloader.generateSnapshot) without depending on bc.CurrentBlock() or bc.CurrentHeader(). Both the canonical-chain path (writeBlockWithState) and the reorg path (reorg) now call updateM1ForBlock with bc.StateAt(block.Root()) before writeHeadBlock, so the snapshot is durable before the head markers are persisted.
The original UpdateM1 is retained unchanged for external callers and tests.
Types of changes
What types of changes does your code introduce to XDC network?
Put an
✅in the boxes that applyImpacted Components
Which parts of the codebase does this PR touch?
Put an
✅in the boxes that applyChecklist
Put an
✅in the boxes once you have confirmed below actions (or provide reasons on not doing so) that