imbajin commented on code in PR #3418:
URL: https://github.com/apache/hugegraph/pull/3418#discussion_r4393533634
##########
hugegraph-pd/hg-pd-core/src/main/java/org/apache/hugegraph/pd/TaskScheduleService.java:
##########
@@ -298,7 +298,8 @@ public synchronized Map<Integer, KVPair<Long, Long>>
balancePartitionShard() thr
return null;
}
- int activeStores = storeService.getActiveStores().size();
+ List<Metapb.Store> placementStores = storeService.getPlacementStores();
Review Comment:
**[P2] Fence migration submission against destination state changes**
This filters destinations when planning, but the list is only a snapshot. A
destination can become `Exiting` after this read and before [the migration is
submitted](https://github.com/apache/hugegraph/blob/b84bf81b8962507027d811206d8fa8a590e8b9d0/hugegraph-pd/hg-pd-core/src/main/java/org/apache/hugegraph/pd/TaskScheduleService.java#L453-L460).
[`movePartitionsShard()`](https://github.com/apache/hugegraph/blob/b84bf81b8962507027d811206d8fa8a590e8b9d0/hugegraph-pd/hg-pd-core/src/main/java/org/apache/hugegraph/pd/PartitionService.java#L591-L616)
appends `toStore` as a follower and sends `ChangeShard` without checking its
current state.
A deterministic regression can pause balancing after selecting an `Up`
destination, complete that destination's transition to `Exiting` on another
thread, then resume submission. The old plan should not send a replica to that
Store. The synchronized methods here, in `PartitionService`, and in
`StoreNodeService` lock different objects, so they do not establish this
ordering.
Please make the final eligibility check and migration submission use a
consistent synchronization/state-version contract with Store state transitions.
An additional unprotected list read still leaves the check-to-use window.
This is **pre-existing incomplete protection**, not a newly introduced P1:
the baseline also planned from a snapshot and used the unchecked submission
path. It is separate from the blocked-drain retry finding. The new filtering
fixes stale-state selection at planning time but does not fully establish the
documented exclusion of draining destinations.
Validation: independent static cross-check at
`b84bf81b8962507027d811206d8fa8a590e8b9d0`; no live-cluster race reproduction
or data-loss claim. Related source-PR observation: [🔗 hugegraph/hugegraph
#343](https://github.com/hugegraph/hugegraph/pull/343#discussion_r4393481520).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
