[svn-r8876]

Purpose:
Bug Fix

Description:
If an HDF5 file grows larger than its address space, it dies and is unable to
write any data.  This is more likely to happen since users are able to change
the number of bytes used to store addresses in the file.

Solution:
HDF5 now throws an error instead of dying.  In addition, it "reserves" address
space for the local heap and for object headers (which do not allocate space
immediately).  This ensures that after the error occurs, there is enough address
space left to flush the entire file to disk, so no data is lost.
A more complete explanation is at /doc/html/TechNotes/ReservedFileSpace.html

Platforms tested:
sleipnir, copper (parallel), verbena, arabica, Windows (Visual Studio 7)

Misc. update:

9 files changed, 202 insertions, 13 deletions

diff --git a/src/H5B.c b/src/H5B.c
index ed773f2..2b74a29 100644
--- a/src/H5B.c
+++ b/src/H5B.c
@@ -231,7 +231,7 @@ H5B_create(H5F_t *f, hid_t dxpl_id, const H5B_class_t *type, void *udata,
     bt->right = HADDR_UNDEF;
     bt->nchildren = 0;
     if((bt->rc_shared=(type->get_shared)(f, udata))==NULL)
-	HGOTO_ERROR (H5E_RESOURCE, H5E_NOSPACE, NULL, "can't retrieve B-tree node buffer")
+	HGOTO_ERROR (H5E_RESOURCE, H5E_NOSPACE, FAIL, "can't retrieve B-tree node buffer")
     shared=H5RC_GET_OBJ(bt->rc_shared);
     HDassert(shared);
     if (NULL==(bt->native=H5FL_BLK_MALLOC(native_block,shared->sizeof_keys)) ||
@@ -538,9 +538,6 @@ H5B_dest(H5F_t UNUSED *f, H5B_t *bt)
      */
     assert(bt);
 
-    /* Verify that node is clean */
-    assert(bt->cache_info.dirty==0);
-
     H5FL_SEQ_FREE(haddr_t,bt->child);
     H5FL_BLK_FREE(native_block,bt->native);
     H5RC_DEC(bt->rc_shared);
diff --git a/src/H5FD.c b/src/H5FD.c
index fb76a9f..d8f7e93 100644
--- a/src/H5FD.c
+++ b/src/H5FD.c
@@ -968,6 +968,7 @@ H5FD_open(const char *name, unsigned flags, hid_t fapl_id, haddr_t maxaddr)
         HGOTO_ERROR(H5E_VFL, H5E_CANTINC, NULL, "unable to increment ref count on VFL driver")
     file->cls = driver;
     file->maxaddr = maxaddr;
+    file->reserved_alloc = 0;
     HDmemset(file->fl, 0, sizeof(file->fl));
     if(H5P_get(plist, H5F_ACS_META_BLOCK_SIZE_NAME, &(meta_block_size)) < 0)
         HGOTO_ERROR(H5E_PLIST, H5E_CANTGET, NULL, "can't get meta data block size")
diff --git a/src/H5FDpublic.h b/src/H5FDpublic.h
index 0f541f9..ba762db 100644
--- a/src/H5FDpublic.h
+++ b/src/H5FDpublic.h
@@ -187,6 +187,7 @@ struct H5FD_t {
     unsigned long       feature_flags;  /* VFL Driver feature Flags */
     hsize_t             threshold;      /* Threshold for alignment  */
     hsize_t             alignment;      /* Allocation alignment     */
+    hsize_t             reserved_alloc; /* Space reserved for later alloc calls */
 
     /* Metadata aggregation fields */
     hsize_t             def_meta_block_size;  /* Metadata allocation
diff --git a/src/H5HG.c b/src/H5HG.c
index 8541be9..e55f276 100644
--- a/src/H5HG.c
+++ b/src/H5HG.c
@@ -889,7 +889,13 @@ H5HG_insert (H5F_t *f, hid_t dxpl_id, size_t size, void *obj, H5HG_t *hobj/*out*
      * we can extend any of the collections to make enough room.
      */
     if (!found) {
+        size_t new_need;
+
         for (cwfsno=0; cwfsno<f->shared->ncwfs; cwfsno++) {
+            new_need = need;
+            new_need -= f->shared->cwfs[cwfsno]->obj[0].size;
+            new_need = MAX(f->shared->cwfs[cwfsno]->size, new_need);
+
             if((f->shared->cwfs[cwfsno]->size+need)<=H5HG_MAXSIZE && H5MF_can_extend(f,H5FD_MEM_GHEAP,f->shared->cwfs[cwfsno]->addr,(hsize_t)f->shared->cwfs[cwfsno]->size,(hsize_t)need)) {
                 if(H5HG_extend(f,f->shared->cwfs[cwfsno],size)<0)
                     HGOTO_ERROR (H5E_HEAP, H5E_CANTINIT, FAIL, "unable to extend global heap collection");
diff --git a/src/H5HL.c b/src/H5HL.c
index 2ca4c08..40350ce 100644
--- a/src/H5HL.c
+++ b/src/H5HL.c
@@ -71,6 +71,7 @@ typedef struct H5HL_t {
     haddr_t		    addr;	/*address of data		*/
     size_t		    disk_alloc;	/*data bytes allocated on disk	*/
     size_t		    mem_alloc;	/*data bytes allocated in mem	*/
+    size_t                  disk_resrv; /*data bytes "reserved" on disk */
     uint8_t		   *chunk;	/*the chunk, including header	*/
     H5HL_free_t		   *freelist;	/*the free list			*/
 } H5HL_t;
@@ -175,6 +176,7 @@ H5HL_create(H5F_t *f, hid_t dxpl_id, size_t size_hint, haddr_t *addr_p/*out*/)
     heap->addr = *addr_p + (hsize_t)sizeof_hdr;
     heap->disk_alloc = size_hint;
     heap->mem_alloc = size_hint;
+    heap->disk_resrv = 0;
     if (NULL==(heap->chunk = H5FL_BLK_CALLOC(heap_chunk,(sizeof_hdr + size_hint))))
 	HGOTO_ERROR (H5E_RESOURCE, H5E_NOSPACE, FAIL, "memory allocation failed");
 
@@ -370,6 +372,13 @@ H5HL_flush(H5F_t *f, hid_t dxpl_id, hbool_t destroy, haddr_t addr, H5HL_t *heap)
         sizeof_hdr= H5HL_SIZEOF_HDR(f);
 
         /*
+         * Since the file is being flushed to disk, release the file space reserved
+         * for it.
+         */
+        H5MF_free_reserved(f, heap->disk_resrv);
+        heap->disk_resrv = 0;
+
+        /*
          * Check to see if we can reduce the size of the heap in memory by
          * eliminating free blocks at the tail of the buffer before flushing the
          * buffer out.
@@ -772,6 +781,7 @@ H5HL_insert(H5F_t *f, hid_t dxpl_id, haddr_t addr, size_t buf_size, const void *
     size_t	offset = 0;
     size_t	need_size, old_size, need_more;
     hbool_t	found;
+    size_t      disk_resrv;     /* Amount of additional space to reserve in file */
     size_t      sizeof_hdr;     /* Cache H5HL header size for file */
     size_t	ret_value;      /* Return value */
 
@@ -880,6 +890,18 @@ H5HL_insert(H5F_t *f, hid_t dxpl_id, haddr_t addr, size_t buf_size, const void *
 	    }
 	}
 
+        /* Reserve space in file to hold the increased heap size */
+        if( heap->disk_resrv == heap->mem_alloc)
+            disk_resrv = need_more;
+        else
+            disk_resrv = heap->mem_alloc + need_more - heap->disk_resrv;
+
+        if( H5MF_reserve(f, disk_resrv) < 0)
+            HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, (size_t) (-1), "unable to reserve space for heap");
+
+        /* Update heap's record of how much space it has reserved */
+        heap->disk_resrv += disk_resrv;
+
 #ifdef H5HL_DEBUG
 	if (H5DEBUG(HL)) {
 	    fprintf(H5DEBUG(HL),
diff --git a/src/H5MF.c b/src/H5MF.c
index d4ab9d8..2877882 100644
--- a/src/H5MF.c
+++ b/src/H5MF.c
@@ -80,6 +80,9 @@ H5MF_alloc(H5F_t *f, H5FD_mem_t type, hid_t dxpl_id, hsize_t size)
     /* Fail if we don't have write access */
     if (0==(f->intent & H5F_ACC_RDWR))
 	HGOTO_ERROR(H5E_RESOURCE, H5E_CANTINIT, HADDR_UNDEF, "file is read-only");
+    /* Check that the file can address the new space */
+    if( H5MF_alloc_overflow(f, size) != 0 )
+        HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, FAIL, "not enough address space in file");
 
     /* Allocate space from the virtual file layer */
     if (HADDR_UNDEF==(ret_value=H5FD_alloc(f->shared->lf, type, dxpl_id, size)))
@@ -210,6 +213,132 @@ done:
     FUNC_LEAVE_NOAPI(ret_value);
 }
 
+/*-------------------------------------------------------------------------
+ * Function:    H5MF_reserve
+ *
+ * Purpose:     Sets aside file space that has not yet been allocated, but will
+ *                      be (or might be in the worst case).  This number is used to
+ *                      ensure that there is room in the file when it is flushed to disk.
+ *
+ *                      Nothing changes (and no error is generated) if the file is opened
+ *                      as read-only.
+ *
+ * Return:      Success:        0
+ *
+ *              Failure:        negative
+ *
+ * Programmer:  James Laird
+ *                              Nat Furrer
+ *              Thursday, May 27, 2004
+ *
+ * Modifications:
+ *-------------------------------------------------------------------------
+ */
+herr_t H5MF_reserve(H5F_t *f, hsize_t size)
+{
+        herr_t ret_value = SUCCEED;
+    FUNC_ENTER_NOAPI(H5MF_reserve, FAIL);
+
+        /* Check arguments */
+        assert(f);
+
+        /* Check that there is room in the file to reserve this space */
+        if( H5MF_alloc_overflow( f, size ) != 0)
+                HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, FAIL, "not enough address space in file");
+
+        f->shared->lf->reserved_alloc += size;
+
+done:
+        FUNC_LEAVE_NOAPI(ret_value);
+}
+
+/*-------------------------------------------------------------------------
+ * Function:    H5MF_free_reserved
+ *
+ * Purpose:     Releases the file space set aside by H5MF_reserve.  This should
+ *                      be called immediately before allocating the file space for which
+ *                      the space was reserved.
+ *
+ * Return:      None
+ *
+ * Programmer:  James Laird
+ *                              Nat Furrer
+ *              Thursday, May 27, 2004
+ *
+ * Modifications:
+ *-------------------------------------------------------------------------
+ */
+void H5MF_free_reserved(H5F_t *f, hsize_t size)
+{
+        /* Check arguments */
+        assert(f);
+
+        /* If this assert breaks, it means that HDF5 is trying to free file space
+         * that was never reserved.
+         */
+        assert(size <= f->shared->lf->reserved_alloc);
+
+        f->shared->lf->reserved_alloc -= size;
+}
+
+/*-------------------------------------------------------------------------
+ * Function:    H5MF_alloc_overflow
+ *
+ * Purpose:     Checks if an allocation of file space would cause an overflow.
+ *          F is the file whose space is being allocated, SIZE is the amount
+ *          of space needed.
+ *
+ * Return:      0 if no overflow would result
+ *          1 if overflow would result (the allocation should not be allowed)
+ *
+ * Programmer:  James Laird
+ *                              Nat Furrer
+ *              Tuesday, June 1, 2004
+ *
+ * Modifications:
+ *-------------------------------------------------------------------------
+ */
+int H5MF_alloc_overflow(H5F_t *f, hsize_t size)
+{
+    unsigned long long space_needed;    /* Accumulator variable */
+    hsize_t c;
+
+    /* Start with the current end of the file's address. */
+    space_needed = f->shared->lf->cls->get_eoa(f->shared->lf);
+
+    /* Subtract the file's base address to get the actual amount of
+     * space being used:
+     * (end of allocated space - beginning of allocated space)
+     */
+    assert(f->shared->base_addr < space_needed);
+    space_needed -= f->shared->base_addr;
+
+    /* Add the amount of space requested for this allocation */
+    space_needed += size;
+
+    /* Also add space that is "reserved" for data to be flushed
+     * to disk (e.g., for object headers and the heap).
+     * This is the total amount of file space that will be 
+     * allocated.
+     */
+    space_needed += f->shared->lf->reserved_alloc;
+
+    /* Ensure that this final number is less than the file's
+     * address space.  We do this by shifting in multiples
+     * of 16 bits because some systems will do nothing if
+     * we shift by the size of a long long (64 bits) all at
+     * once (<cough> Linux <cough>).  Thus, we break one shift
+     * into several smaller shifts.
+     */
+    for(c=0; c < H5F_SIZEOF_ADDR(f); c += 2)
+        space_needed = space_needed >> 16;
+
+    if(space_needed != 0)
+        return 1;
+    else
+        return 0;
+}
+
 
 /*-------------------------------------------------------------------------
  * Function:	H5MF_can_extend
@@ -246,6 +375,10 @@ H5MF_can_extend(H5F_t *f, H5FD_mem_t type, haddr_t addr, hsize_t size, hsize_t e
     if((ret_value=H5FD_can_extend(f->shared->lf, type, addr, size, extra_requested))<0)
 	HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, FAIL, "unable to allocate new file memory");
 
+    /* Make sure there is enough addressable space to satisfy the request */
+    if (ret_value == TRUE)
+        ret_value = !H5MF_alloc_overflow(f, extra_requested);
+
 done:
     FUNC_LEAVE_NOAPI(ret_value);
 } /* end H5MF_can_extend() */
@@ -277,6 +410,10 @@ H5MF_extend(H5F_t *f, H5FD_mem_t type, haddr_t addr, hsize_t size, hsize_t extra
     /* Convert old relative address to absolute address */
     addr += f->shared->base_addr;
 
+    /* Make sure there is enough addressable space to satisfy the request */
+    if ( H5MF_alloc_overflow(f, extra_requested) )
+        HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, FAIL, "unable to allocate new file memory: out of address space");
+
     /* Pass the request down to the virtual file layer */
     if((ret_value=H5FD_extend(f->shared->lf, type, addr, size, extra_requested))<0)
 	HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, FAIL, "unable to allocate new file memory");
diff --git a/src/H5MFprivate.h b/src/H5MFprivate.h
index 14b2761..2a129ea 100644
--- a/src/H5MFprivate.h
+++ b/src/H5MFprivate.h
@@ -48,6 +48,9 @@ H5_DLL herr_t H5MF_xfree(H5F_t *f, H5FD_mem_t type, hid_t dxpl_id, haddr_t addr,
 			  hsize_t size);
 H5_DLL haddr_t H5MF_realloc(H5F_t *f, H5FD_mem_t type, hid_t dxpl_id, haddr_t old_addr,
 			     hsize_t old_size, hsize_t new_size);
+H5_DLL herr_t H5MF_reserve(H5F_t *f, hsize_t size);
+H5_DLL void H5MF_free_reserved(H5F_t *f, hsize_t size);
+H5_DLL int H5MF_alloc_overflow(H5F_t *f, hsize_t size);
 H5_DLL htri_t H5MF_can_extend(H5F_t *f, H5FD_mem_t type, haddr_t addr,
     hsize_t size, hsize_t extra_requested);
 H5_DLL htri_t H5MF_extend(H5F_t *f, H5FD_mem_t type, haddr_t addr, hsize_t size,
diff --git a/src/H5O.c b/src/H5O.c
index b7ef425..f318b92 100644
--- a/src/H5O.c
+++ b/src/H5O.c
@@ -72,7 +72,7 @@ static herr_t H5O_remove_real(H5G_entry_t *ent, const H5O_class_t *type,
     int sequence, hid_t dxpl_id);
 static unsigned H5O_alloc(H5F_t *f, H5O_t *oh, const H5O_class_t *type,
 		      size_t size);
-static unsigned H5O_alloc_extend_chunk(H5O_t *oh, unsigned chunkno, size_t size);
+static unsigned H5O_alloc_extend_chunk(H5F_t *f, H5O_t *oh, unsigned chunkno, size_t size);
 static unsigned H5O_alloc_new_chunk(H5F_t *f, H5O_t *oh, size_t size);
 static herr_t H5O_delete_oh(H5F_t *f, hid_t dxpl_id, H5O_t *oh);
 static herr_t H5O_delete_mesg(H5F_t *f, hid_t dxpl_id, H5O_mesg_t *mesg);
@@ -715,6 +715,10 @@ H5O_flush(H5F_t *f, hid_t dxpl_id, hbool_t destroy, haddr_t addr, H5O_t *oh)
                         assert(cont->chunkno < oh->nchunks);
                         assert(!H5F_addr_defined(oh->chunk[cont->chunkno].addr));
                         cont->size = oh->chunk[cont->chunkno].size;
+
+                        /* Free the space we'd previously reserved to hold this chunk */
+                        H5MF_free_reserved(f, cont->size);
+
                         if (HADDR_UNDEF==(cont->addr=H5MF_alloc(f,
                                             H5FD_MEM_OHDR, dxpl_id, (hsize_t)cont->size)))
                             HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, FAIL, "unable to allocate space for object header data");
@@ -2536,6 +2540,10 @@ done:
  *		that message will be extended with the chunk.  Otherwise a
  *		new null message is created.
  *
+ *              F is the file into which the new chunk will be written.  It is
+ *              included to ensure that there is enough space to extend this
+ *              chunk.
+ *
  * Return:	Success:	Message index for null message which
  *				is large enough to hold SIZE bytes.
  *
@@ -2554,7 +2562,7 @@ done:
  *-------------------------------------------------------------------------
  */
 static unsigned
-H5O_alloc_extend_chunk(H5O_t *oh, unsigned chunkno, size_t size)
+H5O_alloc_extend_chunk(H5F_t *f, H5O_t *oh, unsigned chunkno, size_t size)
 {
     unsigned	u;
     unsigned	idx;
@@ -2582,6 +2590,11 @@ H5O_alloc_extend_chunk(H5O_t *oh, unsigned chunkno, size_t size)
 
                 delta = MAX (H5O_MIN_SIZE, aligned_size - oh->mesg[idx].raw_size);
                 assert (delta=H5O_ALIGN (delta));
+
+                /* Reserve space in the file to hold the increased chunk size */
+                if( H5MF_reserve(f, delta) < 0 )
+                    HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, UFAIL, "unable to reserve space for chunk");
+
                 oh->mesg[idx].dirty = TRUE;
                 oh->mesg[idx].raw_size += delta;
 
@@ -2609,6 +2622,13 @@ H5O_alloc_extend_chunk(H5O_t *oh, unsigned chunkno, size_t size)
         } /* end if */
     }
 
+    /* Reserve space in the file */
+    delta = MAX(H5O_MIN_SIZE, aligned_size+H5O_SIZEOF_MSGHDR(f));
+    delta = H5O_ALIGN(delta);
+
+    if( H5MF_reserve(f, delta) < 0 )
+        HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, UFAIL, "unable to reserve space in file");
+
     /* create a new null message */
     if (oh->nmesgs >= oh->alloc_nmesgs) {
         unsigned na = oh->alloc_nmesgs + H5O_NMESGS;
@@ -2619,8 +2639,6 @@ H5O_alloc_extend_chunk(H5O_t *oh, unsigned chunkno, size_t size)
         oh->alloc_nmesgs = na;
         oh->mesg = x;
     }
-    delta = MAX(H5O_MIN_SIZE, aligned_size+H5O_SIZEOF_MSGHDR(f));
-    delta = H5O_ALIGN(delta);
     idx = oh->nmesgs++;
     oh->mesg[idx].type = H5O_NULL;
     oh->mesg[idx].dirty = TRUE;
@@ -2749,6 +2767,10 @@ H5O_alloc_new_chunk(H5F_t *f, H5O_t *oh, size_t size)
     size = MAX(H5O_MIN_SIZE, size + H5O_SIZEOF_MSGHDR(f));
     assert (size == H5O_ALIGN (size));
 
+    /* Reserve space in the file to hold the new chunk */
+    if( H5MF_reserve(f, size) < 0 )
+        HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, UFAIL, "unable to reserve space in file for new chunk");
+
     /*
      * Create the new chunk without giving it a file address.
      */
@@ -2913,7 +2935,7 @@ H5O_alloc(H5F_t *f, H5O_t *oh, const H5O_class_t *type, size_t size)
 	 * since we can just increase the size of that chunk.
 	 */
 	for (chunkno = 0; chunkno < oh->nchunks; chunkno++) {
-	    if ((idx = H5O_alloc_extend_chunk(oh, chunkno, size)) != UFAIL) {
+	    if ((idx = H5O_alloc_extend_chunk(f, oh, chunkno, size)) != UFAIL) {
 		break;
 	    }
 	    H5E_clear();
diff --git a/src/H5Tconv.c b/src/H5Tconv.c
index ece4341..8f3e77c 100644
--- a/src/H5Tconv.c
+++ b/src/H5Tconv.c
@@ -2487,10 +2487,6 @@ H5T_conv_vlen(hid_t src_id, hid_t dst_id, H5T_cdata_t *cdata, size_t nelmts,
                 nelmts-=safe;
             } /* end while */
 
-            /* Reset the conversion buffer pointer, so it doesn't get freed */
-            if(write_to_file && noop_conv)
-                conv_buf=NULL;
-
             /* Release the temporary datatype IDs used */
             if (tsrc_id >= 0)
                 H5I_dec_ref(tsrc_id);
@@ -2503,6 +2499,10 @@ H5T_conv_vlen(hid_t src_id, hid_t dst_id, H5T_cdata_t *cdata, size_t nelmts,
     }   /* end switch */
     
 done:
+    /* If the conversion buffer doesn't need to be freed, reset its pointer */
+    if(write_to_file && noop_conv)
+        conv_buf = NULL;
+
     /* Release the conversion buffer (always allocated, except on errors) */
     if(conv_buf!=NULL)
         H5FL_BLK_FREE(vlen_seq,conv_buf);