From: Junio C Hamano <gitster@pobox.com>
Date: Tue, 3 Oct 2017 06:42:50 +0000 (+0900)
Subject: Merge branch 'mh/mmap-packed-refs'
X-Git-Tag: v2.15.0-rc0~13
X-Git-Url: https://git.lorimer.id.au/gitweb.git/diff_plain/1a2e1a76ec2cbbafe60ffd124f673f62045fb0d3?ds=inline;hp=-c

Merge branch 'mh/mmap-packed-refs'

Operations that do not touch (majority of) packed refs have been
optimized by making accesses to packed-refs file lazy; we no longer
pre-parse everything, and an access to a single ref in the
packed-refs does not touch majority of irrelevant refs, either.

* mh/mmap-packed-refs: (21 commits)
packed-backend.c: rename a bunch of things and update comments
mmapped_ref_iterator: inline into `packed_ref_iterator`
ref_cache: remove support for storing peeled values
packed_ref_store: get rid of the `ref_cache` entirely
ref_store: implement `refs_peel_ref()` generically
packed_read_raw_ref(): read the reference from the mmapped buffer
packed_ref_iterator_begin(): iterate using `mmapped_ref_iterator`
read_packed_refs(): ensure that references are ordered when read
packed_ref_cache: keep the `packed-refs` file mmapped if possible
packed-backend.c: reorder some definitions
mmapped_ref_iterator_advance(): no peeled value for broken refs
mmapped_ref_iterator: add iterator over a packed-refs file
packed_ref_cache: remember the file-wide peeling state
read_packed_refs(): read references with minimal copying
read_packed_refs(): make parsing of the header line more robust
read_packed_refs(): only check for a header at the top of the file
read_packed_refs(): use mmap to read the `packed-refs` file
die_unterminated_line(), die_invalid_line(): new functions
packed_ref_cache: add a backlink to the associated `packed_ref_store`
prefix_ref_iterator: break when we leave the prefix
...
---

1a2e1a76ec2cbbafe60ffd124f673f62045fb0d3
diff --combined Makefile
index ed4ca438bd,d34c3dfe69..b143e4eea3
--- a/Makefile
+++ b/Makefile
@@@ -162,11 -162,6 +162,11 @@@ all:
  # algorithm. This is slower, but may detect attempted collision attacks.
  # Takes priority over other *_SHA1 knobs.
  #
 +# Define DC_SHA1_EXTERNAL in addition to DC_SHA1 if you want to build / link
 +# git with the external SHA1 collision-detect library.
 +# Without this option, i.e. the default behavior is to build git with its
 +# own built-in code (or submodule).
 +#
  # Define DC_SHA1_SUBMODULE in addition to DC_SHA1 to use the
  # sha1collisiondetection shipped as a submodule instead of the
  # non-submodule copy in sha1dc/. This is an experimental option used
@@@ -205,6 -200,9 +205,9 @@@
  #
  # Define NO_MMAP if you want to avoid mmap.
  #
+ # Define MMAP_PREVENTS_DELETE if a file that is currently mmapped cannot be
+ # deleted or cannot be replaced using rename().
+ #
  # Define NO_SYS_POLL_H if you don't have sys/poll.h.
  #
  # Define NO_POLL if you do not have or don't want to use poll().
@@@ -1041,9 -1039,6 +1044,9 @@@ BASIC_CFLAGS += -fno-omit-frame-pointe
  ifneq ($(filter undefined,$(SANITIZERS)),)
  BASIC_CFLAGS += -DNO_UNALIGNED_LOADS
  endif
 +ifneq ($(filter leak,$(SANITIZERS)),)
 +BASIC_CFLAGS += -DSUPPRESS_ANNOTATED_LEAKS
 +endif
  endif
  
  ifndef sysconfdir
@@@ -1391,6 -1386,9 +1394,9 @@@ els
  		COMPAT_OBJS += compat/win32mmap.o
  	endif
  endif
+ ifdef MMAP_PREVENTS_DELETE
+ 	BASIC_CFLAGS += -DMMAP_PREVENTS_DELETE
+ endif
  ifdef OBJECT_CREATION_USES_RENAMES
  	COMPAT_CFLAGS += -DOBJECT_CREATION_MODE=1
  endif
@@@ -1483,15 -1481,6 +1489,15 @@@ ifdef APPLE_COMMON_CRYPT
  	BASIC_CFLAGS += -DSHA1_APPLE
  else
  	DC_SHA1 := YesPlease
 +	BASIC_CFLAGS += -DSHA1_DC
 +	LIB_OBJS += sha1dc_git.o
 +ifdef DC_SHA1_EXTERNAL
 +	ifdef DC_SHA1_SUBMODULE
 +$(error Only set DC_SHA1_EXTERNAL or DC_SHA1_SUBMODULE, not both)
 +	endif
 +	BASIC_CFLAGS += -DDC_SHA1_EXTERNAL
 +	EXTLIBS += -lsha1detectcoll
 +else
  ifdef DC_SHA1_SUBMODULE
  	LIB_OBJS += sha1collisiondetection/lib/sha1.o
  	LIB_OBJS += sha1collisiondetection/lib/ubc_check.o
@@@ -1501,15 -1490,17 +1507,15 @@@ els
  	LIB_OBJS += sha1dc/ubc_check.o
  endif
  	BASIC_CFLAGS += \
 -		-DSHA1_DC \
  		-DSHA1DC_NO_STANDARD_INCLUDES \
  		-DSHA1DC_INIT_SAFE_HASH_DEFAULT=0 \
  		-DSHA1DC_CUSTOM_INCLUDE_SHA1_C="\"cache.h\"" \
 -		-DSHA1DC_CUSTOM_TRAILING_INCLUDE_SHA1_C="\"sha1dc_git.c\"" \
 -		-DSHA1DC_CUSTOM_TRAILING_INCLUDE_SHA1_H="\"sha1dc_git.h\"" \
  		-DSHA1DC_CUSTOM_INCLUDE_UBC_CHECK_C="\"git-compat-util.h\""
  endif
  endif
  endif
  endif
 +endif
  
  ifdef SHA1_MAX_BLOCK_SIZE
  	LIB_OBJS += compat/sha1-chunked.o
@@@ -2457,10 -2448,6 +2463,10 @@@ $(SP_OBJ): %.sp: %.c GIT-CFLAGS FORC
  .PHONY: sparse $(SP_OBJ)
  sparse: $(SP_OBJ)
  
 +.PHONY: style
 +style:
 +	git clang-format --style file --diff --extensions c,h
 +
  check: common-cmds.h
  	@if sparse; \
  	then \
diff --combined refs.c
index 6cfd88ff6b,c5e6f79c77..df075fcd06
--- a/refs.c
+++ b/refs.c
@@@ -239,7 -239,8 +239,7 @@@ int read_ref(const char *refname, unsig
  
  int ref_exists(const char *refname)
  {
 -	unsigned char sha1[20];
 -	return !!resolve_ref_unsafe(refname, RESOLVE_REF_READING, sha1, NULL);
 +	return !!resolve_ref_unsafe(refname, RESOLVE_REF_READING, NULL, NULL);
  }
  
  static int filter_refs(const char *refname, const struct object_id *oid,
@@@ -285,11 -286,12 +285,11 @@@ static int warn_if_dangling_symref(cons
  {
  	struct warn_if_dangling_data *d = cb_data;
  	const char *resolves_to;
 -	struct object_id junk;
  
  	if (!(flags & REF_ISSYMREF))
  		return 0;
  
 -	resolves_to = resolve_ref_unsafe(refname, 0, junk.hash, NULL);
 +	resolves_to = resolve_ref_unsafe(refname, 0, NULL, NULL);
  	if (!resolves_to
  	    || (d->refname
  		? strcmp(resolves_to, d->refname)
@@@ -334,6 -336,12 +334,6 @@@ int for_each_tag_ref(each_ref_fn fn, vo
  	return refs_for_each_tag_ref(get_main_ref_store(), fn, cb_data);
  }
  
 -int for_each_tag_ref_submodule(const char *submodule, each_ref_fn fn, void *cb_data)
 -{
 -	return refs_for_each_tag_ref(get_submodule_ref_store(submodule),
 -				     fn, cb_data);
 -}
 -
  int refs_for_each_branch_ref(struct ref_store *refs, each_ref_fn fn, void *cb_data)
  {
  	return refs_for_each_ref_in(refs, "refs/heads/", fn, cb_data);
@@@ -344,6 -352,12 +344,6 @@@ int for_each_branch_ref(each_ref_fn fn
  	return refs_for_each_branch_ref(get_main_ref_store(), fn, cb_data);
  }
  
 -int for_each_branch_ref_submodule(const char *submodule, each_ref_fn fn, void *cb_data)
 -{
 -	return refs_for_each_branch_ref(get_submodule_ref_store(submodule),
 -					fn, cb_data);
 -}
 -
  int refs_for_each_remote_ref(struct ref_store *refs, each_ref_fn fn, void *cb_data)
  {
  	return refs_for_each_ref_in(refs, "refs/remotes/", fn, cb_data);
@@@ -354,6 -368,12 +354,6 @@@ int for_each_remote_ref(each_ref_fn fn
  	return refs_for_each_remote_ref(get_main_ref_store(), fn, cb_data);
  }
  
 -int for_each_remote_ref_submodule(const char *submodule, each_ref_fn fn, void *cb_data)
 -{
 -	return refs_for_each_remote_ref(get_submodule_ref_store(submodule),
 -					fn, cb_data);
 -}
 -
  int head_ref_namespaced(each_ref_fn fn, void *cb_data)
  {
  	struct strbuf buf = STRBUF_INIT;
@@@ -592,7 -612,7 +592,7 @@@ static int write_pseudoref(const char *
  	if (fd < 0) {
  		strbuf_addf(err, "could not open '%s' for writing: %s",
  			    filename, strerror(errno));
 -		return -1;
 +		goto done;
  	}
  
  	if (old_sha1) {
@@@ -607,7 -627,7 +607,7 @@@
  		}
  	}
  
 -	if (write_in_full(fd, buf.buf, buf.len) != buf.len) {
 +	if (write_in_full(fd, buf.buf, buf.len) < 0) {
  		strbuf_addf(err, "could not write to '%s'", filename);
  		rollback_lock_file(&lock);
  		goto done;
@@@ -937,8 -957,6 +937,8 @@@ int ref_transaction_update(struct ref_t
  		return -1;
  	}
  
 +	flags &= REF_TRANSACTION_UPDATE_ALLOWED_FLAGS;
 +
  	flags |= (new_sha1 ? REF_HAVE_NEW : 0) | (old_sha1 ? REF_HAVE_OLD : 0);
  
  	ref_transaction_add_update(transaction, refname, flags,
@@@ -1248,13 -1266,19 +1248,13 @@@ int refs_rename_ref_available(struct re
  	return ok;
  }
  
 -int head_ref_submodule(const char *submodule, each_ref_fn fn, void *cb_data)
 +int refs_head_ref(struct ref_store *refs, each_ref_fn fn, void *cb_data)
  {
  	struct object_id oid;
  	int flag;
  
 -	if (submodule) {
 -		if (resolve_gitlink_ref(submodule, "HEAD", oid.hash) == 0)
 -			return fn("HEAD", &oid, 0, cb_data);
 -
 -		return 0;
 -	}
 -
 -	if (!read_ref_full("HEAD", RESOLVE_REF_READING, oid.hash, &flag))
 +	if (!refs_read_ref_full(refs, "HEAD", RESOLVE_REF_READING,
 +				oid.hash, &flag))
  		return fn("HEAD", &oid, flag, cb_data);
  
  	return 0;
@@@ -1262,7 -1286,7 +1262,7 @@@
  
  int head_ref(each_ref_fn fn, void *cb_data)
  {
 -	return head_ref_submodule(NULL, fn, cb_data);
 +	return refs_head_ref(get_main_ref_store(), fn, cb_data);
  }
  
  struct ref_iterator *refs_ref_iterator_begin(
@@@ -1285,6 -1309,10 +1285,10 @@@
  	if (trim)
  		iter = prefix_ref_iterator_begin(iter, "", trim);
  
+ 	/* Sanity check for subclasses: */
+ 	if (!iter->ordered)
+ 		BUG("reference iterator is not ordered");
+ 
  	return iter;
  }
  
@@@ -1320,6 -1348,11 +1324,6 @@@ int for_each_ref(each_ref_fn fn, void *
  	return refs_for_each_ref(get_main_ref_store(), fn, cb_data);
  }
  
 -int for_each_ref_submodule(const char *submodule, each_ref_fn fn, void *cb_data)
 -{
 -	return refs_for_each_ref(get_submodule_ref_store(submodule), fn, cb_data);
 -}
 -
  int refs_for_each_ref_in(struct ref_store *refs, const char *prefix,
  			 each_ref_fn fn, void *cb_data)
  {
@@@ -1341,15 -1374,23 +1345,15 @@@ int for_each_fullref_in(const char *pre
  			       prefix, fn, 0, flag, cb_data);
  }
  
 -int for_each_ref_in_submodule(const char *submodule, const char *prefix,
 -			      each_ref_fn fn, void *cb_data)
 -{
 -	return refs_for_each_ref_in(get_submodule_ref_store(submodule),
 -				    prefix, fn, cb_data);
 -}
 -
 -int for_each_fullref_in_submodule(const char *submodule, const char *prefix,
 -				  each_ref_fn fn, void *cb_data,
 -				  unsigned int broken)
 +int refs_for_each_fullref_in(struct ref_store *refs, const char *prefix,
 +			     each_ref_fn fn, void *cb_data,
 +			     unsigned int broken)
  {
  	unsigned int flag = 0;
  
  	if (broken)
  		flag = DO_FOR_EACH_INCLUDE_BROKEN;
 -	return do_for_each_ref(get_submodule_ref_store(submodule),
 -			       prefix, fn, 0, flag, cb_data);
 +	return do_for_each_ref(refs, prefix, fn, 0, flag, cb_data);
  }
  
  int for_each_replace_ref(each_ref_fn fn, void *cb_data)
@@@ -1357,7 -1398,7 +1361,7 @@@
  	return do_for_each_ref(get_main_ref_store(),
  			       git_replace_ref_base, fn,
  			       strlen(git_replace_ref_base),
 -			       0, cb_data);
 +			       DO_FOR_EACH_INCLUDE_BROKEN, cb_data);
  }
  
  int for_each_namespaced_ref(each_ref_fn fn, void *cb_data)
@@@ -1396,12 -1437,9 +1400,12 @@@ const char *refs_resolve_ref_unsafe(str
  				    unsigned char *sha1, int *flags)
  {
  	static struct strbuf sb_refname = STRBUF_INIT;
 +	struct object_id unused_oid;
  	int unused_flags;
  	int symref_count;
  
 +	if (!sha1)
 +		sha1 = unused_oid.hash;
  	if (!flags)
  		flags = &unused_flags;
  
@@@ -1487,10 -1525,25 +1491,10 @@@ const char *resolve_ref_unsafe(const ch
  int resolve_gitlink_ref(const char *submodule, const char *refname,
  			unsigned char *sha1)
  {
 -	size_t len = strlen(submodule);
  	struct ref_store *refs;
  	int flags;
  
 -	while (len && submodule[len - 1] == '/')
 -		len--;
 -
 -	if (!len)
 -		return -1;
 -
 -	if (submodule[len]) {
 -		/* We need to strip off one or more trailing slashes */
 -		char *stripped = xmemdupz(submodule, len);
 -
 -		refs = get_submodule_ref_store(stripped);
 -		free(stripped);
 -	} else {
 -		refs = get_submodule_ref_store(submodule);
 -	}
 +	refs = get_submodule_ref_store(submodule);
  
  	if (!refs)
  		return -1;
@@@ -1605,32 -1658,31 +1609,32 @@@ struct ref_store *get_submodule_ref_sto
  {
  	struct strbuf submodule_sb = STRBUF_INIT;
  	struct ref_store *refs;
 -	int ret;
 +	char *to_free = NULL;
 +	size_t len;
  
 -	if (!submodule || !*submodule) {
 -		/*
 -		 * FIXME: This case is ideally not allowed. But that
 -		 * can't happen until we clean up all the callers.
 -		 */
 -		return get_main_ref_store();
 -	}
 +	if (!submodule)
 +		return NULL;
 +
 +	len = strlen(submodule);
 +	while (len && is_dir_sep(submodule[len - 1]))
 +		len--;
 +	if (!len)
 +		return NULL;
 +
 +	if (submodule[len])
 +		/* We need to strip off one or more trailing slashes */
 +		submodule = to_free = xmemdupz(submodule, len);
  
  	refs = lookup_ref_store_map(&submodule_ref_stores, submodule);
  	if (refs)
 -		return refs;
 +		goto done;
  
  	strbuf_addstr(&submodule_sb, submodule);
 -	ret = is_nonbare_repository_dir(&submodule_sb);
 -	strbuf_release(&submodule_sb);
 -	if (!ret)
 -		return NULL;
 +	if (!is_nonbare_repository_dir(&submodule_sb))
 +		goto done;
  
 -	ret = submodule_to_gitdir(&submodule_sb, submodule);
 -	if (ret) {
 -		strbuf_release(&submodule_sb);
 -		return NULL;
 -	}
 +	if (submodule_to_gitdir(&submodule_sb, submodule))
 +		goto done;
  
  	/* assume that add_submodule_odb() has been called */
  	refs = ref_store_init(submodule_sb.buf,
@@@ -1638,10 -1690,7 +1642,10 @@@
  	register_ref_store_map(&submodule_ref_stores, "submodule",
  			       refs, submodule);
  
 +done:
  	strbuf_release(&submodule_sb);
 +	free(to_free);
 +
  	return refs;
  }
  
@@@ -1686,7 -1735,23 +1690,23 @@@ int refs_pack_refs(struct ref_store *re
  int refs_peel_ref(struct ref_store *refs, const char *refname,
  		  unsigned char *sha1)
  {
- 	return refs->be->peel_ref(refs, refname, sha1);
+ 	int flag;
+ 	unsigned char base[20];
+ 
+ 	if (current_ref_iter && current_ref_iter->refname == refname) {
+ 		struct object_id peeled;
+ 
+ 		if (ref_iterator_peel(current_ref_iter, &peeled))
+ 			return -1;
+ 		hashcpy(sha1, peeled.hash);
+ 		return 0;
+ 	}
+ 
+ 	if (refs_read_ref_full(refs, refname,
+ 			       RESOLVE_REF_READING, base, &flag))
+ 		return -1;
+ 
+ 	return peel_object(base, sha1);
  }
  
  int peel_ref(const char *refname, unsigned char *sha1)
@@@ -2036,14 -2101,3 +2056,14 @@@ int rename_ref(const char *oldref, cons
  {
  	return refs_rename_ref(get_main_ref_store(), oldref, newref, logmsg);
  }
 +
 +int refs_copy_existing_ref(struct ref_store *refs, const char *oldref,
 +		    const char *newref, const char *logmsg)
 +{
 +	return refs->be->copy_ref(refs, oldref, newref, logmsg);
 +}
 +
 +int copy_existing_ref(const char *oldref, const char *newref, const char *logmsg)
 +{
 +	return refs_copy_existing_ref(get_main_ref_store(), oldref, newref, logmsg);
 +}
diff --combined refs/files-backend.c
index 4b46cd2e26,7d12de88d0..1b6141e718
--- a/refs/files-backend.c
+++ b/refs/files-backend.c
@@@ -12,7 -12,7 +12,7 @@@
  
  struct ref_lock {
  	char *ref_name;
 -	struct lock_file *lk;
 +	struct lock_file lk;
  	struct object_id old_oid;
  };
  
@@@ -106,6 -106,15 +106,6 @@@ static void files_reflog_path(struct fi
  			      struct strbuf *sb,
  			      const char *refname)
  {
 -	if (!refname) {
 -		/*
 -		 * FIXME: of course this is wrong in multi worktree
 -		 * setting. To be fixed real soon.
 -		 */
 -		strbuf_addf(sb, "%s/logs", refs->gitcommondir);
 -		return;
 -	}
 -
  	switch (ref_type(refname)) {
  	case REF_TYPE_PER_WORKTREE:
  	case REF_TYPE_PSEUDOREF:
@@@ -409,7 -418,9 +409,7 @@@ out
  
  static void unlock_ref(struct ref_lock *lock)
  {
 -	/* Do not free lock->lk -- atexit() still looks at them */
 -	if (lock->lk)
 -		rollback_lock_file(lock->lk);
 +	rollback_lock_file(&lock->lk);
  	free(lock->ref_name);
  	free(lock);
  }
@@@ -523,8 -534,11 +523,8 @@@ retry
  		goto error_return;
  	}
  
 -	if (!lock->lk)
 -		lock->lk = xcalloc(1, sizeof(struct lock_file));
 -
  	if (hold_lock_file_for_update_timeout(
 -			    lock->lk, ref_file.buf, LOCK_NO_DEREF,
 +			    &lock->lk, ref_file.buf, LOCK_NO_DEREF,
  			    get_files_ref_lock_timeout_ms()) < 0) {
  		if (errno == ENOENT && --attempts_remaining > 0) {
  			/*
@@@ -641,43 -655,6 +641,6 @@@ out
  	return ret;
  }
  
- static int files_peel_ref(struct ref_store *ref_store,
- 			  const char *refname, unsigned char *sha1)
- {
- 	struct files_ref_store *refs =
- 		files_downcast(ref_store, REF_STORE_READ | REF_STORE_ODB,
- 			       "peel_ref");
- 	int flag;
- 	unsigned char base[20];
- 
- 	if (current_ref_iter && current_ref_iter->refname == refname) {
- 		struct object_id peeled;
- 
- 		if (ref_iterator_peel(current_ref_iter, &peeled))
- 			return -1;
- 		hashcpy(sha1, peeled.hash);
- 		return 0;
- 	}
- 
- 	if (refs_read_ref_full(ref_store, refname,
- 			       RESOLVE_REF_READING, base, &flag))
- 		return -1;
- 
- 	/*
- 	 * If the reference is packed, read its ref_entry from the
- 	 * cache in the hope that we already know its peeled value.
- 	 * We only try this optimization on packed references because
- 	 * (a) forcing the filling of the loose reference cache could
- 	 * be expensive and (b) loose references anyway usually do not
- 	 * have REF_KNOWS_PEELED.
- 	 */
- 	if (flag & REF_ISPACKED &&
- 	    !refs_peel_ref(refs->packed_ref_store, refname, sha1))
- 		return 0;
- 
- 	return peel_object(base, sha1);
- }
- 
  struct files_ref_iterator {
  	struct ref_iterator base;
  
@@@ -748,7 -725,7 +711,7 @@@ static struct ref_iterator *files_ref_i
  		const char *prefix, unsigned int flags)
  {
  	struct files_ref_store *refs;
- 	struct ref_iterator *loose_iter, *packed_iter;
+ 	struct ref_iterator *loose_iter, *packed_iter, *overlay_iter;
  	struct files_ref_iterator *iter;
  	struct ref_iterator *ref_iterator;
  	unsigned int required_flags = REF_STORE_READ;
@@@ -758,10 -735,6 +721,6 @@@
  
  	refs = files_downcast(ref_store, required_flags, "ref_iterator_begin");
  
- 	iter = xcalloc(1, sizeof(*iter));
- 	ref_iterator = &iter->base;
- 	base_ref_iterator_init(ref_iterator, &files_ref_iterator_vtable);
- 
  	/*
  	 * We must make sure that all loose refs are read before
  	 * accessing the packed-refs file; this avoids a race
@@@ -797,7 -770,13 +756,13 @@@
  			refs->packed_ref_store, prefix, 0,
  			DO_FOR_EACH_INCLUDE_BROKEN);
  
- 	iter->iter0 = overlay_ref_iterator_begin(loose_iter, packed_iter);
+ 	overlay_iter = overlay_ref_iterator_begin(loose_iter, packed_iter);
+ 
+ 	iter = xcalloc(1, sizeof(*iter));
+ 	ref_iterator = &iter->base;
+ 	base_ref_iterator_init(ref_iterator, &files_ref_iterator_vtable,
+ 			       overlay_iter->ordered);
+ 	iter->iter0 = overlay_iter;
  	iter->flags = flags;
  
  	return ref_iterator;
@@@ -935,9 -914,11 +900,9 @@@ static struct ref_lock *lock_ref_sha1_b
  		goto error_return;
  	}
  
 -	lock->lk = xcalloc(1, sizeof(struct lock_file));
 -
  	lock->ref_name = xstrdup(refname);
  
 -	if (raceproof_create_file(ref_file.buf, create_reflock, lock->lk)) {
 +	if (raceproof_create_file(ref_file.buf, create_reflock, &lock->lk)) {
  		last_errno = errno;
  		unable_to_lock_message(ref_file.buf, errno, err);
  		goto error_return;
@@@ -1258,9 -1239,9 +1223,9 @@@ static int commit_ref_update(struct fil
  			     const struct object_id *oid, const char *logmsg,
  			     struct strbuf *err);
  
 -static int files_rename_ref(struct ref_store *ref_store,
 +static int files_copy_or_rename_ref(struct ref_store *ref_store,
  			    const char *oldrefname, const char *newrefname,
 -			    const char *logmsg)
 +			    const char *logmsg, int copy)
  {
  	struct files_ref_store *refs =
  		files_downcast(ref_store, REF_STORE_WRITE, "rename_ref");
@@@ -1292,12 -1273,8 +1257,12 @@@
  	}
  
  	if (flag & REF_ISSYMREF) {
 -		ret = error("refname %s is a symbolic ref, renaming it is not supported",
 -			    oldrefname);
 +		if (copy)
 +			ret = error("refname %s is a symbolic ref, copying it is not supported",
 +				    oldrefname);
 +		else
 +			ret = error("refname %s is a symbolic ref, renaming it is not supported",
 +				    oldrefname);
  		goto out;
  	}
  	if (!refs_rename_ref_available(&refs->base, oldrefname, newrefname)) {
@@@ -1305,19 -1282,13 +1270,19 @@@
  		goto out;
  	}
  
 -	if (log && rename(sb_oldref.buf, tmp_renamed_log.buf)) {
 +	if (!copy && log && rename(sb_oldref.buf, tmp_renamed_log.buf)) {
  		ret = error("unable to move logfile logs/%s to logs/"TMP_RENAMED_LOG": %s",
  			    oldrefname, strerror(errno));
  		goto out;
  	}
  
 -	if (refs_delete_ref(&refs->base, logmsg, oldrefname,
 +	if (copy && log && copy_file(tmp_renamed_log.buf, sb_oldref.buf, 0644)) {
 +		ret = error("unable to copy logfile logs/%s to logs/"TMP_RENAMED_LOG": %s",
 +			    oldrefname, strerror(errno));
 +		goto out;
 +	}
 +
 +	if (!copy && refs_delete_ref(&refs->base, logmsg, oldrefname,
  			    orig_oid.hash, REF_NODEREF)) {
  		error("unable to delete old %s", oldrefname);
  		goto rollback;
@@@ -1330,7 -1301,7 +1295,7 @@@
  	 * the safety anyway; we want to delete the reference whatever
  	 * its current value.
  	 */
 -	if (!refs_read_ref_full(&refs->base, newrefname,
 +	if (!copy && !refs_read_ref_full(&refs->base, newrefname,
  				RESOLVE_REF_READING | RESOLVE_REF_NO_RECURSE,
  				oid.hash, NULL) &&
  	    refs_delete_ref(&refs->base, NULL, newrefname,
@@@ -1361,10 -1332,7 +1326,10 @@@
  	lock = lock_ref_sha1_basic(refs, newrefname, NULL, NULL, NULL,
  				   REF_NODEREF, NULL, &err);
  	if (!lock) {
 -		error("unable to rename '%s' to '%s': %s", oldrefname, newrefname, err.buf);
 +		if (copy)
 +			error("unable to copy '%s' to '%s': %s", oldrefname, newrefname, err.buf);
 +		else
 +			error("unable to rename '%s' to '%s': %s", oldrefname, newrefname, err.buf);
  		strbuf_release(&err);
  		goto rollback;
  	}
@@@ -1415,32 -1383,16 +1380,32 @@@
  	return ret;
  }
  
 -static int close_ref(struct ref_lock *lock)
 +static int files_rename_ref(struct ref_store *ref_store,
 +			    const char *oldrefname, const char *newrefname,
 +			    const char *logmsg)
 +{
 +	return files_copy_or_rename_ref(ref_store, oldrefname,
 +				 newrefname, logmsg, 0);
 +}
 +
 +static int files_copy_ref(struct ref_store *ref_store,
 +			    const char *oldrefname, const char *newrefname,
 +			    const char *logmsg)
 +{
 +	return files_copy_or_rename_ref(ref_store, oldrefname,
 +				 newrefname, logmsg, 1);
 +}
 +
 +static int close_ref_gently(struct ref_lock *lock)
  {
 -	if (close_lock_file(lock->lk))
 +	if (close_lock_file_gently(&lock->lk))
  		return -1;
  	return 0;
  }
  
  static int commit_ref(struct ref_lock *lock)
  {
 -	char *path = get_locked_file_path(lock->lk);
 +	char *path = get_locked_file_path(&lock->lk);
  	struct stat st;
  
  	if (!lstat(path, &st) && S_ISDIR(st.st_mode)) {
@@@ -1464,7 -1416,7 +1429,7 @@@
  		free(path);
  	}
  
 -	if (commit_lock_file(lock->lk))
 +	if (commit_lock_file(&lock->lk))
  		return -1;
  	return 0;
  }
@@@ -1578,7 -1530,7 +1543,7 @@@ static int log_ref_write_fd(int fd, con
  
  	written = len <= maxlen ? write_in_full(fd, logrec, len) : -1;
  	free(logrec);
 -	if (written != len)
 +	if (written < 0)
  		return -1;
  
  	return 0;
@@@ -1656,12 -1608,12 +1621,12 @@@ static int write_ref_to_lockfile(struc
  		unlock_ref(lock);
  		return -1;
  	}
 -	fd = get_lock_file_fd(lock->lk);
 -	if (write_in_full(fd, oid_to_hex(oid), GIT_SHA1_HEXSZ) != GIT_SHA1_HEXSZ ||
 -	    write_in_full(fd, &term, 1) != 1 ||
 -	    close_ref(lock) < 0) {
 +	fd = get_lock_file_fd(&lock->lk);
 +	if (write_in_full(fd, oid_to_hex(oid), GIT_SHA1_HEXSZ) < 0 ||
 +	    write_in_full(fd, &term, 1) < 0 ||
 +	    close_ref_gently(lock) < 0) {
  		strbuf_addf(err,
 -			    "couldn't write '%s'", get_lock_file_path(lock->lk));
 +			    "couldn't write '%s'", get_lock_file_path(&lock->lk));
  		unlock_ref(lock);
  		return -1;
  	}
@@@ -1705,12 -1657,13 +1670,12 @@@ static int commit_ref_update(struct fil
  		 * check with HEAD only which should cover 99% of all usage
  		 * scenarios (even 100% of the default ones).
  		 */
 -		struct object_id head_oid;
  		int head_flag;
  		const char *head_ref;
  
  		head_ref = refs_resolve_ref_unsafe(&refs->base, "HEAD",
  						   RESOLVE_REF_READING,
 -						   head_oid.hash, &head_flag);
 +						   NULL, &head_flag);
  		if (head_ref && (head_flag & REF_ISSYMREF) &&
  		    !strcmp(head_ref, lock->ref_name)) {
  			struct strbuf log_err = STRBUF_INIT;
@@@ -1737,7 -1690,7 +1702,7 @@@ static int create_ref_symlink(struct re
  {
  	int ret = -1;
  #ifndef NO_SYMLINK_HEAD
 -	char *ref_path = get_locked_file_path(lock->lk);
 +	char *ref_path = get_locked_file_path(&lock->lk);
  	unlink(ref_path);
  	ret = symlink(target, ref_path);
  	free(ref_path);
@@@ -1773,14 -1726,14 +1738,14 @@@ static int create_symref_locked(struct 
  		return 0;
  	}
  
 -	if (!fdopen_lock_file(lock->lk, "w"))
 +	if (!fdopen_lock_file(&lock->lk, "w"))
  		return error("unable to fdopen %s: %s",
 -			     lock->lk->tempfile.filename.buf, strerror(errno));
 +			     lock->lk.tempfile->filename.buf, strerror(errno));
  
  	update_symref_reflog(refs, lock, refname, target, logmsg);
  
  	/* no error check; commit_ref will check ferror */
 -	fprintf(lock->lk->tempfile.fp, "ref: %s\n", target);
 +	fprintf(lock->lk.tempfile->fp, "ref: %s\n", target);
  	if (commit_ref(lock) < 0)
  		return error("unable to write symref for %s: %s", refname,
  			     strerror(errno));
@@@ -2087,63 -2040,23 +2052,64 @@@ static struct ref_iterator_vtable files
  	files_reflog_iterator_abort
  };
  
 -static struct ref_iterator *files_reflog_iterator_begin(struct ref_store *ref_store)
 +static struct ref_iterator *reflog_iterator_begin(struct ref_store *ref_store,
 +						  const char *gitdir)
  {
 -	struct files_ref_store *refs =
 -		files_downcast(ref_store, REF_STORE_READ,
 -			       "reflog_iterator_begin");
  	struct files_reflog_iterator *iter = xcalloc(1, sizeof(*iter));
  	struct ref_iterator *ref_iterator = &iter->base;
  	struct strbuf sb = STRBUF_INIT;
  
- 	base_ref_iterator_init(ref_iterator, &files_reflog_iterator_vtable);
+ 	base_ref_iterator_init(ref_iterator, &files_reflog_iterator_vtable, 0);
 -	files_reflog_path(refs, &sb, NULL);
 +	strbuf_addf(&sb, "%s/logs", gitdir);
  	iter->dir_iterator = dir_iterator_begin(sb.buf);
  	iter->ref_store = ref_store;
  	strbuf_release(&sb);
 +
  	return ref_iterator;
  }
  
 +static enum iterator_selection reflog_iterator_select(
 +	struct ref_iterator *iter_worktree,
 +	struct ref_iterator *iter_common,
 +	void *cb_data)
 +{
 +	if (iter_worktree) {
 +		/*
 +		 * We're a bit loose here. We probably should ignore
 +		 * common refs if they are accidentally added as
 +		 * per-worktree refs.
 +		 */
 +		return ITER_SELECT_0;
 +	} else if (iter_common) {
 +		if (ref_type(iter_common->refname) == REF_TYPE_NORMAL)
 +			return ITER_SELECT_1;
 +
 +		/*
 +		 * The main ref store may contain main worktree's
 +		 * per-worktree refs, which should be ignored
 +		 */
 +		return ITER_SKIP_1;
 +	} else
 +		return ITER_DONE;
 +}
 +
 +static struct ref_iterator *files_reflog_iterator_begin(struct ref_store *ref_store)
 +{
 +	struct files_ref_store *refs =
 +		files_downcast(ref_store, REF_STORE_READ,
 +			       "reflog_iterator_begin");
 +
 +	if (!strcmp(refs->gitdir, refs->gitcommondir)) {
 +		return reflog_iterator_begin(ref_store, refs->gitcommondir);
 +	} else {
 +		return merge_ref_iterator_begin(
++			0,
 +			reflog_iterator_begin(ref_store, refs->gitdir),
 +			reflog_iterator_begin(ref_store, refs->gitcommondir),
 +			reflog_iterator_select, refs);
 +	}
 +}
 +
  /*
   * If update is a direct update of head_ref (the reference pointed to
   * by HEAD), then add an extra REF_LOG_ONLY update for HEAD.
@@@ -2167,10 -2080,11 +2133,10 @@@ static int split_head_update(struct ref
  
  	/*
  	 * First make sure that HEAD is not already in the
 -	 * transaction. This insertion is O(N) in the transaction
 +	 * transaction. This check is O(lg N) in the transaction
  	 * size, but it happens at most once per transaction.
  	 */
 -	item = string_list_insert(affected_refnames, "HEAD");
 -	if (item->util) {
 +	if (string_list_has_string(affected_refnames, "HEAD")) {
  		/* An entry already existed */
  		strbuf_addf(err,
  			    "multiple updates for 'HEAD' (including one "
@@@ -2185,14 -2099,6 +2151,14 @@@
  			update->new_oid.hash, update->old_oid.hash,
  			update->msg);
  
 +	/*
 +	 * Add "HEAD". This insertion is O(N) in the transaction
 +	 * size, but it happens at most once per transaction.
 +	 * Add new_update->refname instead of a literal "HEAD".
 +	 */
 +	if (strcmp(new_update->refname, "HEAD"))
 +		BUG("%s unexpectedly not 'HEAD'", new_update->refname);
 +	item = string_list_insert(affected_refnames, new_update->refname);
  	item->util = new_update;
  
  	return 0;
@@@ -2219,12 -2125,13 +2185,12 @@@ static int split_symref_update(struct f
  
  	/*
  	 * First make sure that referent is not already in the
 -	 * transaction. This insertion is O(N) in the transaction
 +	 * transaction. This check is O(lg N) in the transaction
  	 * size, but it happens at most once per symref in a
  	 * transaction.
  	 */
 -	item = string_list_insert(affected_refnames, referent);
 -	if (item->util) {
 -		/* An entry already existed */
 +	if (string_list_has_string(affected_refnames, referent)) {
 +		/* An entry already exists */
  		strbuf_addf(err,
  			    "multiple updates for '%s' (including one "
  			    "via symref '%s') are not allowed",
@@@ -2259,17 -2166,6 +2225,17 @@@
  	update->flags |= REF_LOG_ONLY | REF_NODEREF;
  	update->flags &= ~REF_HAVE_OLD;
  
 +	/*
 +	 * Add the referent. This insertion is O(N) in the transaction
 +	 * size, but it happens at most once per symref in a
 +	 * transaction. Make sure to add new_update->refname, which will
 +	 * be valid as long as affected_refnames is in use, and NOT
 +	 * referent, which might soon be freed by our caller.
 +	 */
 +	item = string_list_insert(affected_refnames, new_update->refname);
 +	if (item->util)
 +		BUG("%s unexpectedly found in affected_refnames",
 +		    new_update->refname);
  	item->util = new_update;
  
  	return 0;
@@@ -2341,7 -2237,7 +2307,7 @@@ static int lock_ref_for_update(struct f
  	struct strbuf referent = STRBUF_INIT;
  	int mustexist = (update->flags & REF_HAVE_OLD) &&
  		!is_null_oid(&update->old_oid);
 -	int ret;
 +	int ret = 0;
  	struct ref_lock *lock;
  
  	files_assert_main_repository(refs, "lock_ref_for_update");
@@@ -2353,7 -2249,7 +2319,7 @@@
  		ret = split_head_update(update, transaction, head_ref,
  					affected_refnames, err);
  		if (ret)
 -			return ret;
 +			goto out;
  	}
  
  	ret = lock_raw_ref(refs, update->refname, mustexist,
@@@ -2367,7 -2263,7 +2333,7 @@@
  		strbuf_addf(err, "cannot lock ref '%s': %s",
  			    original_update_refname(update), reason);
  		free(reason);
 -		return ret;
 +		goto out;
  	}
  
  	update->backend_data = lock;
@@@ -2386,12 -2282,10 +2352,12 @@@
  					strbuf_addf(err, "cannot lock ref '%s': "
  						    "error reading reference",
  						    original_update_refname(update));
 -					return -1;
 +					ret = TRANSACTION_GENERIC_ERROR;
 +					goto out;
  				}
  			} else if (check_old_oid(update, &lock->old_oid, err)) {
 -				return TRANSACTION_GENERIC_ERROR;
 +				ret = TRANSACTION_GENERIC_ERROR;
 +				goto out;
  			}
  		} else {
  			/*
@@@ -2405,15 -2299,13 +2371,15 @@@
  						  referent.buf, transaction,
  						  affected_refnames, err);
  			if (ret)
 -				return ret;
 +				goto out;
  		}
  	} else {
  		struct ref_update *parent_update;
  
 -		if (check_old_oid(update, &lock->old_oid, err))
 -			return TRANSACTION_GENERIC_ERROR;
 +		if (check_old_oid(update, &lock->old_oid, err)) {
 +			ret = TRANSACTION_GENERIC_ERROR;
 +			goto out;
 +		}
  
  		/*
  		 * If this update is happening indirectly because of a
@@@ -2450,8 -2342,7 +2416,8 @@@
  				    "cannot update ref '%s': %s",
  				    update->refname, write_err);
  			free(write_err);
 -			return TRANSACTION_GENERIC_ERROR;
 +			ret = TRANSACTION_GENERIC_ERROR;
 +			goto out;
  		} else {
  			update->flags |= REF_NEEDS_COMMIT;
  		}
@@@ -2462,17 -2353,13 +2428,17 @@@
  		 * the lockfile is still open. Close it to
  		 * free up the file descriptor:
  		 */
 -		if (close_ref(lock)) {
 +		if (close_ref_gently(lock)) {
  			strbuf_addf(err, "couldn't close '%s.lock'",
  				    update->refname);
 -			return TRANSACTION_GENERIC_ERROR;
 +			ret = TRANSACTION_GENERIC_ERROR;
 +			goto out;
  		}
  	}
 -	return 0;
 +
 +out:
 +	strbuf_release(&referent);
 +	return ret;
  }
  
  struct files_transaction_backend_data {
@@@ -3028,17 -2915,16 +2994,17 @@@ static int files_reflog_expire(struct r
  			!(type & REF_ISSYMREF) &&
  			!is_null_oid(&cb.last_kept_oid);
  
 -		if (close_lock_file(&reflog_lock)) {
 +		if (close_lock_file_gently(&reflog_lock)) {
  			status |= error("couldn't write %s: %s", log_file,
  					strerror(errno));
 +			rollback_lock_file(&reflog_lock);
  		} else if (update &&
 -			   (write_in_full(get_lock_file_fd(lock->lk),
 -				oid_to_hex(&cb.last_kept_oid), GIT_SHA1_HEXSZ) != GIT_SHA1_HEXSZ ||
 -			    write_str_in_full(get_lock_file_fd(lock->lk), "\n") != 1 ||
 -			    close_ref(lock) < 0)) {
 +			   (write_in_full(get_lock_file_fd(&lock->lk),
 +				oid_to_hex(&cb.last_kept_oid), GIT_SHA1_HEXSZ) < 0 ||
 +			    write_str_in_full(get_lock_file_fd(&lock->lk), "\n") < 0 ||
 +			    close_ref_gently(lock) < 0)) {
  			status |= error("couldn't write %s",
 -					get_lock_file_path(lock->lk));
 +					get_lock_file_path(&lock->lk));
  			rollback_lock_file(&reflog_lock);
  		} else if (commit_lock_file(&reflog_lock)) {
  			status |= error("unable to write reflog '%s' (%s)",
@@@ -3089,11 -2975,9 +3055,10 @@@ struct ref_storage_be refs_be_files = 
  	files_initial_transaction_commit,
  
  	files_pack_refs,
- 	files_peel_ref,
  	files_create_symref,
  	files_delete_refs,
  	files_rename_ref,
 +	files_copy_ref,
  
  	files_ref_iterator_begin,
  	files_read_raw_ref,
diff --combined refs/packed-backend.c
index 9c0d685c7f,d500ebfaa5..6e85b0bf0b
--- a/refs/packed-backend.c
+++ b/refs/packed-backend.c
@@@ -2,53 -2,121 +2,121 @@@
  #include "../config.h"
  #include "../refs.h"
  #include "refs-internal.h"
- #include "ref-cache.h"
  #include "packed-backend.h"
  #include "../iterator.h"
  #include "../lockfile.h"
  
- struct packed_ref_cache {
- 	struct ref_cache *cache;
+ enum mmap_strategy {
+ 	/*
+ 	 * Don't use mmap() at all for reading `packed-refs`.
+ 	 */
+ 	MMAP_NONE,
  
  	/*
- 	 * Count of references to the data structure in this instance,
- 	 * including the pointer from files_ref_store::packed if any.
- 	 * The data will not be freed as long as the reference count
- 	 * is nonzero.
+ 	 * Can use mmap() for reading `packed-refs`, but the file must
+ 	 * not remain mmapped. This is the usual option on Windows,
+ 	 * where you cannot rename a new version of a file onto a file
+ 	 * that is currently mmapped.
  	 */
- 	unsigned int referrers;
+ 	MMAP_TEMPORARY,
  
- 	/* The metadata from when this packed-refs cache was read */
- 	struct stat_validity validity;
+ 	/*
+ 	 * It is OK to leave the `packed-refs` file mmapped while
+ 	 * arbitrary other code is running.
+ 	 */
+ 	MMAP_OK
  };
  
- /*
-  * Increment the reference count of *packed_refs.
-  */
- static void acquire_packed_ref_cache(struct packed_ref_cache *packed_refs)
- {
- 	packed_refs->referrers++;
- }
+ #if defined(NO_MMAP)
+ static enum mmap_strategy mmap_strategy = MMAP_NONE;
+ #elif defined(MMAP_PREVENTS_DELETE)
+ static enum mmap_strategy mmap_strategy = MMAP_TEMPORARY;
+ #else
+ static enum mmap_strategy mmap_strategy = MMAP_OK;
+ #endif
+ 
+ struct packed_ref_store;
  
  /*
-  * Decrease the reference count of *packed_refs.  If it goes to zero,
-  * free *packed_refs and return true; otherwise return false.
+  * A `snapshot` represents one snapshot of a `packed-refs` file.
+  *
+  * Normally, this will be a mmapped view of the contents of the
+  * `packed-refs` file at the time the snapshot was created. However,
+  * if the `packed-refs` file was not sorted, this might point at heap
+  * memory holding the contents of the `packed-refs` file with its
+  * records sorted by refname.
+  *
+  * `snapshot` instances are reference counted (via
+  * `acquire_snapshot()` and `release_snapshot()`). This is to prevent
+  * an instance from disappearing while an iterator is still iterating
+  * over it. Instances are garbage collected when their `referrers`
+  * count goes to zero.
+  *
+  * The most recent `snapshot`, if available, is referenced by the
+  * `packed_ref_store`. Its freshness is checked whenever
+  * `get_snapshot()` is called; if the existing snapshot is obsolete, a
+  * new snapshot is taken.
   */
- static int release_packed_ref_cache(struct packed_ref_cache *packed_refs)
- {
- 	if (!--packed_refs->referrers) {
- 		free_ref_cache(packed_refs->cache);
- 		stat_validity_clear(&packed_refs->validity);
- 		free(packed_refs);
- 		return 1;
- 	} else {
- 		return 0;
- 	}
- }
+ struct snapshot {
+ 	/*
+ 	 * A back-pointer to the packed_ref_store with which this
+ 	 * snapshot is associated:
+ 	 */
+ 	struct packed_ref_store *refs;
+ 
+ 	/* Is the `packed-refs` file currently mmapped? */
+ 	int mmapped;
+ 
+ 	/*
+ 	 * The contents of the `packed-refs` file. If the file was
+ 	 * already sorted, this points at the mmapped contents of the
+ 	 * file. If not, this points at heap-allocated memory
+ 	 * containing the contents, sorted. If there were no contents
+ 	 * (e.g., because the file didn't exist), `buf` and `eof` are
+ 	 * both NULL.
+ 	 */
+ 	char *buf, *eof;
+ 
+ 	/* The size of the header line, if any; otherwise, 0: */
+ 	size_t header_len;
+ 
+ 	/*
+ 	 * What is the peeled state of the `packed-refs` file that
+ 	 * this snapshot represents? (This is usually determined from
+ 	 * the file's header.)
+ 	 */
+ 	enum { PEELED_NONE, PEELED_TAGS, PEELED_FULLY } peeled;
+ 
+ 	/*
+ 	 * Count of references to this instance, including the pointer
+ 	 * from `packed_ref_store::snapshot`, if any. The instance
+ 	 * will not be freed as long as the reference count is
+ 	 * nonzero.
+ 	 */
+ 	unsigned int referrers;
+ 
+ 	/*
+ 	 * The metadata of the `packed-refs` file from which this
+ 	 * snapshot was created, used to tell if the file has been
+ 	 * replaced since we read it.
+ 	 */
+ 	struct stat_validity validity;
+ };
  
  /*
-  * A container for `packed-refs`-related data. It is not (yet) a
-  * `ref_store`.
+  * A `ref_store` representing references stored in a `packed-refs`
+  * file. It implements the `ref_store` interface, though it has some
+  * limitations:
+  *
+  * - It cannot store symbolic references.
+  *
+  * - It cannot store reflogs.
+  *
+  * - It does not support reference renaming (though it could).
+  *
+  * On the other hand, it can be locked outside of a reference
+  * transaction. In that case, it remains locked even after the
+  * transaction is done and the new `packed-refs` file is activated.
   */
  struct packed_ref_store {
  	struct ref_store base;
@@@ -59,10 -127,10 +127,10 @@@
  	char *path;
  
  	/*
- 	 * A cache of the values read from the `packed-refs` file, if
- 	 * it might still be current; otherwise, NULL.
+ 	 * A snapshot of the values read from the `packed-refs` file,
+ 	 * if it might still be current; otherwise, NULL.
  	 */
- 	struct packed_ref_cache *cache;
+ 	struct snapshot *snapshot;
  
  	/*
  	 * Lock used for the "packed-refs" file. Note that this (and
@@@ -75,9 -143,52 +143,52 @@@
  	 * "packed-refs" file. Note that this (and thus the enclosing
  	 * `packed_ref_store`) must not be freed.
  	 */
 -	struct tempfile tempfile;
 +	struct tempfile *tempfile;
  };
  
+ /*
+  * Increment the reference count of `*snapshot`.
+  */
+ static void acquire_snapshot(struct snapshot *snapshot)
+ {
+ 	snapshot->referrers++;
+ }
+ 
+ /*
+  * If the buffer in `snapshot` is active, then either munmap the
+  * memory and close the file, or free the memory. Then set the buffer
+  * pointers to NULL.
+  */
+ static void clear_snapshot_buffer(struct snapshot *snapshot)
+ {
+ 	if (snapshot->mmapped) {
+ 		if (munmap(snapshot->buf, snapshot->eof - snapshot->buf))
+ 			die_errno("error ummapping packed-refs file %s",
+ 				  snapshot->refs->path);
+ 		snapshot->mmapped = 0;
+ 	} else {
+ 		free(snapshot->buf);
+ 	}
+ 	snapshot->buf = snapshot->eof = NULL;
+ 	snapshot->header_len = 0;
+ }
+ 
+ /*
+  * Decrease the reference count of `*snapshot`. If it goes to zero,
+  * free `*snapshot` and return true; otherwise return false.
+  */
+ static int release_snapshot(struct snapshot *snapshot)
+ {
+ 	if (!--snapshot->referrers) {
+ 		stat_validity_clear(&snapshot->validity);
+ 		clear_snapshot_buffer(snapshot);
+ 		free(snapshot);
+ 		return 1;
+ 	} else {
+ 		return 0;
+ 	}
+ }
+ 
  struct ref_store *packed_ref_store_create(const char *path,
  					  unsigned int store_flags)
  {
@@@ -116,64 -227,369 +227,369 @@@ static struct packed_ref_store *packed_
  	return refs;
  }
  
- static void clear_packed_ref_cache(struct packed_ref_store *refs)
+ static void clear_snapshot(struct packed_ref_store *refs)
+ {
+ 	if (refs->snapshot) {
+ 		struct snapshot *snapshot = refs->snapshot;
+ 
+ 		refs->snapshot = NULL;
+ 		release_snapshot(snapshot);
+ 	}
+ }
+ 
+ static NORETURN void die_unterminated_line(const char *path,
+ 					   const char *p, size_t len)
  {
- 	if (refs->cache) {
- 		struct packed_ref_cache *cache = refs->cache;
+ 	if (len < 80)
+ 		die("unterminated line in %s: %.*s", path, (int)len, p);
+ 	else
+ 		die("unterminated line in %s: %.75s...", path, p);
+ }
  
- 		refs->cache = NULL;
- 		release_packed_ref_cache(cache);
+ static NORETURN void die_invalid_line(const char *path,
+ 				      const char *p, size_t len)
+ {
+ 	const char *eol = memchr(p, '\n', len);
+ 
+ 	if (!eol)
+ 		die_unterminated_line(path, p, len);
+ 	else if (eol - p < 80)
+ 		die("unexpected line in %s: %.*s", path, (int)(eol - p), p);
+ 	else
+ 		die("unexpected line in %s: %.75s...", path, p);
+ 
+ }
+ 
+ struct snapshot_record {
+ 	const char *start;
+ 	size_t len;
+ };
+ 
+ static int cmp_packed_ref_records(const void *v1, const void *v2)
+ {
+ 	const struct snapshot_record *e1 = v1, *e2 = v2;
+ 	const char *r1 = e1->start + GIT_SHA1_HEXSZ + 1;
+ 	const char *r2 = e2->start + GIT_SHA1_HEXSZ + 1;
+ 
+ 	while (1) {
+ 		if (*r1 == '\n')
+ 			return *r2 == '\n' ? 0 : -1;
+ 		if (*r1 != *r2) {
+ 			if (*r2 == '\n')
+ 				return 1;
+ 			else
+ 				return (unsigned char)*r1 < (unsigned char)*r2 ? -1 : +1;
+ 		}
+ 		r1++;
+ 		r2++;
  	}
  }
  
- /* The length of a peeled reference line in packed-refs, including EOL: */
- #define PEELED_LINE_LENGTH 42
+ /*
+  * Compare a snapshot record at `rec` to the specified NUL-terminated
+  * refname.
+  */
+ static int cmp_record_to_refname(const char *rec, const char *refname)
+ {
+ 	const char *r1 = rec + GIT_SHA1_HEXSZ + 1;
+ 	const char *r2 = refname;
+ 
+ 	while (1) {
+ 		if (*r1 == '\n')
+ 			return *r2 ? -1 : 0;
+ 		if (!*r2)
+ 			return 1;
+ 		if (*r1 != *r2)
+ 			return (unsigned char)*r1 < (unsigned char)*r2 ? -1 : +1;
+ 		r1++;
+ 		r2++;
+ 	}
+ }
  
  /*
-  * Parse one line from a packed-refs file.  Write the SHA1 to sha1.
-  * Return a pointer to the refname within the line (null-terminated),
-  * or NULL if there was a problem.
+  * `snapshot->buf` is not known to be sorted. Check whether it is, and
+  * if not, sort it into new memory and munmap/free the old storage.
   */
- static const char *parse_ref_line(struct strbuf *line, struct object_id *oid)
+ static void sort_snapshot(struct snapshot *snapshot)
  {
- 	const char *ref;
+ 	struct snapshot_record *records = NULL;
+ 	size_t alloc = 0, nr = 0;
+ 	int sorted = 1;
+ 	const char *pos, *eof, *eol;
+ 	size_t len, i;
+ 	char *new_buffer, *dst;
  
- 	if (parse_oid_hex(line->buf, oid, &ref) < 0)
- 		return NULL;
- 	if (!isspace(*ref++))
- 		return NULL;
+ 	pos = snapshot->buf + snapshot->header_len;
+ 	eof = snapshot->eof;
+ 	len = eof - pos;
  
- 	if (isspace(*ref))
- 		return NULL;
+ 	if (!len)
+ 		return;
  
- 	if (line->buf[line->len - 1] != '\n')
- 		return NULL;
- 	line->buf[--line->len] = 0;
+ 	/*
+ 	 * Initialize records based on a crude estimate of the number
+ 	 * of references in the file (we'll grow it below if needed):
+ 	 */
+ 	ALLOC_GROW(records, len / 80 + 20, alloc);
+ 
+ 	while (pos < eof) {
+ 		eol = memchr(pos, '\n', eof - pos);
+ 		if (!eol)
+ 			/* The safety check should prevent this. */
+ 			BUG("unterminated line found in packed-refs");
+ 		if (eol - pos < GIT_SHA1_HEXSZ + 2)
+ 			die_invalid_line(snapshot->refs->path,
+ 					 pos, eof - pos);
+ 		eol++;
+ 		if (eol < eof && *eol == '^') {
+ 			/*
+ 			 * Keep any peeled line together with its
+ 			 * reference:
+ 			 */
+ 			const char *peeled_start = eol;
+ 
+ 			eol = memchr(peeled_start, '\n', eof - peeled_start);
+ 			if (!eol)
+ 				/* The safety check should prevent this. */
+ 				BUG("unterminated peeled line found in packed-refs");
+ 			eol++;
+ 		}
+ 
+ 		ALLOC_GROW(records, nr + 1, alloc);
+ 		records[nr].start = pos;
+ 		records[nr].len = eol - pos;
+ 		nr++;
+ 
+ 		if (sorted &&
+ 		    nr > 1 &&
+ 		    cmp_packed_ref_records(&records[nr - 2],
+ 					   &records[nr - 1]) >= 0)
+ 			sorted = 0;
  
- 	return ref;
+ 		pos = eol;
+ 	}
+ 
+ 	if (sorted)
+ 		goto cleanup;
+ 
+ 	/* We need to sort the memory. First we sort the records array: */
+ 	QSORT(records, nr, cmp_packed_ref_records);
+ 
+ 	/*
+ 	 * Allocate a new chunk of memory, and copy the old memory to
+ 	 * the new in the order indicated by `records` (not bothering
+ 	 * with the header line):
+ 	 */
+ 	new_buffer = xmalloc(len);
+ 	for (dst = new_buffer, i = 0; i < nr; i++) {
+ 		memcpy(dst, records[i].start, records[i].len);
+ 		dst += records[i].len;
+ 	}
+ 
+ 	/*
+ 	 * Now munmap the old buffer and use the sorted buffer in its
+ 	 * place:
+ 	 */
+ 	clear_snapshot_buffer(snapshot);
+ 	snapshot->buf = new_buffer;
+ 	snapshot->eof = new_buffer + len;
+ 	snapshot->header_len = 0;
+ 
+ cleanup:
+ 	free(records);
  }
  
  /*
-  * Read from `packed_refs_file` into a newly-allocated
-  * `packed_ref_cache` and return it. The return value will already
-  * have its reference count incremented.
+  * Return a pointer to the start of the record that contains the
+  * character `*p` (which must be within the buffer). If no other
+  * record start is found, return `buf`.
+  */
+ static const char *find_start_of_record(const char *buf, const char *p)
+ {
+ 	while (p > buf && (p[-1] != '\n' || p[0] == '^'))
+ 		p--;
+ 	return p;
+ }
+ 
+ /*
+  * Return a pointer to the start of the record following the record
+  * that contains `*p`. If none is found before `end`, return `end`.
+  */
+ static const char *find_end_of_record(const char *p, const char *end)
+ {
+ 	while (++p < end && (p[-1] != '\n' || p[0] == '^'))
+ 		;
+ 	return p;
+ }
+ 
+ /*
+  * We want to be able to compare mmapped reference records quickly,
+  * without totally parsing them. We can do so because the records are
+  * LF-terminated, and the refname should start exactly (GIT_SHA1_HEXSZ
+  * + 1) bytes past the beginning of the record.
+  *
+  * But what if the `packed-refs` file contains garbage? We're willing
+  * to tolerate not detecting the problem, as long as we don't produce
+  * totally garbled output (we can't afford to check the integrity of
+  * the whole file during every Git invocation). But we do want to be
+  * sure that we never read past the end of the buffer in memory and
+  * perform an illegal memory access.
+  *
+  * Guarantee that minimum level of safety by verifying that the last
+  * record in the file is LF-terminated, and that it has at least
+  * (GIT_SHA1_HEXSZ + 1) characters before the LF. Die if either of
+  * these checks fails.
+  */
+ static void verify_buffer_safe(struct snapshot *snapshot)
+ {
+ 	const char *buf = snapshot->buf + snapshot->header_len;
+ 	const char *eof = snapshot->eof;
+ 	const char *last_line;
+ 
+ 	if (buf == eof)
+ 		return;
+ 
+ 	last_line = find_start_of_record(buf, eof - 1);
+ 	if (*(eof - 1) != '\n' || eof - last_line < GIT_SHA1_HEXSZ + 2)
+ 		die_invalid_line(snapshot->refs->path,
+ 				 last_line, eof - last_line);
+ }
+ 
+ /*
+  * Depending on `mmap_strategy`, either mmap or read the contents of
+  * the `packed-refs` file into the snapshot. Return 1 if the file
+  * existed and was read, or 0 if the file was absent. Die on errors.
+  */
+ static int load_contents(struct snapshot *snapshot)
+ {
+ 	int fd;
+ 	struct stat st;
+ 	size_t size;
+ 	ssize_t bytes_read;
+ 
+ 	fd = open(snapshot->refs->path, O_RDONLY);
+ 	if (fd < 0) {
+ 		if (errno == ENOENT) {
+ 			/*
+ 			 * This is OK; it just means that no
+ 			 * "packed-refs" file has been written yet,
+ 			 * which is equivalent to it being empty,
+ 			 * which is its state when initialized with
+ 			 * zeros.
+ 			 */
+ 			return 0;
+ 		} else {
+ 			die_errno("couldn't read %s", snapshot->refs->path);
+ 		}
+ 	}
+ 
+ 	stat_validity_update(&snapshot->validity, fd);
+ 
+ 	if (fstat(fd, &st) < 0)
+ 		die_errno("couldn't stat %s", snapshot->refs->path);
+ 	size = xsize_t(st.st_size);
+ 
+ 	switch (mmap_strategy) {
+ 	case MMAP_NONE:
+ 		snapshot->buf = xmalloc(size);
+ 		bytes_read = read_in_full(fd, snapshot->buf, size);
+ 		if (bytes_read < 0 || bytes_read != size)
+ 			die_errno("couldn't read %s", snapshot->refs->path);
+ 		snapshot->eof = snapshot->buf + size;
+ 		snapshot->mmapped = 0;
+ 		break;
+ 	case MMAP_TEMPORARY:
+ 	case MMAP_OK:
+ 		snapshot->buf = xmmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0);
+ 		snapshot->eof = snapshot->buf + size;
+ 		snapshot->mmapped = 1;
+ 		break;
+ 	}
+ 	close(fd);
+ 
+ 	return 1;
+ }
+ 
+ /*
+  * Find the place in `snapshot->buf` where the start of the record for
+  * `refname` starts. If `mustexist` is true and the reference doesn't
+  * exist, then return NULL. If `mustexist` is false and the reference
+  * doesn't exist, then return the point where that reference would be
+  * inserted. In the latter mode, `refname` doesn't have to be a proper
+  * reference name; for example, one could search for "refs/replace/"
+  * to find the start of any replace references.
+  *
+  * The record is sought using a binary search, so `snapshot->buf` must
+  * be sorted.
+  */
+ static const char *find_reference_location(struct snapshot *snapshot,
+ 					   const char *refname, int mustexist)
+ {
+ 	/*
+ 	 * This is not *quite* a garden-variety binary search, because
+ 	 * the data we're searching is made up of records, and we
+ 	 * always need to find the beginning of a record to do a
+ 	 * comparison. A "record" here is one line for the reference
+ 	 * itself and zero or one peel lines that start with '^'. Our
+ 	 * loop invariant is described in the next two comments.
+ 	 */
+ 
+ 	/*
+ 	 * A pointer to the character at the start of a record whose
+ 	 * preceding records all have reference names that come
+ 	 * *before* `refname`.
+ 	 */
+ 	const char *lo = snapshot->buf + snapshot->header_len;
+ 
+ 	/*
+ 	 * A pointer to a the first character of a record whose
+ 	 * reference name comes *after* `refname`.
+ 	 */
+ 	const char *hi = snapshot->eof;
+ 
+ 	while (lo < hi) {
+ 		const char *mid, *rec;
+ 		int cmp;
+ 
+ 		mid = lo + (hi - lo) / 2;
+ 		rec = find_start_of_record(lo, mid);
+ 		cmp = cmp_record_to_refname(rec, refname);
+ 		if (cmp < 0) {
+ 			lo = find_end_of_record(mid, hi);
+ 		} else if (cmp > 0) {
+ 			hi = rec;
+ 		} else {
+ 			return rec;
+ 		}
+ 	}
+ 
+ 	if (mustexist)
+ 		return NULL;
+ 	else
+ 		return lo;
+ }
+ 
+ /*
+  * Create a newly-allocated `snapshot` of the `packed-refs` file in
+  * its current state and return it. The return value will already have
+  * its reference count incremented.
   *
   * A comment line of the form "# pack-refs with: " may contain zero or
   * more traits. We interpret the traits as follows:
   *
-  *   No traits:
+  *   Neither `peeled` nor `fully-peeled`:
   *
   *      Probably no references are peeled. But if the file contains a
   *      peeled value for a reference, we will use it.
   *
-  *   peeled:
+  *   `peeled`:
   *
   *      References under "refs/tags/", if they *can* be peeled, *are*
   *      peeled in this file. References outside of "refs/tags/" are
   *      probably not peeled even if they could have been, but if we find
   *      a peeled value for such a reference we will use it.
   *
-  *   fully-peeled:
+  *   `fully-peeled`:
   *
   *      All references in the file that can be peeled are peeled.
   *      Inversely (and this is more important), any references in the
@@@ -181,141 -597,122 +597,122 @@@
   *      trait should typically be written alongside "peeled" for
   *      compatibility with older clients, but we do not require it
   *      (i.e., "peeled" is a no-op if "fully-peeled" is set).
+  *
+  *   `sorted`:
+  *
+  *      The references in this file are known to be sorted by refname.
   */
- static struct packed_ref_cache *read_packed_refs(const char *packed_refs_file)
+ static struct snapshot *create_snapshot(struct packed_ref_store *refs)
  {
- 	FILE *f;
- 	struct packed_ref_cache *packed_refs = xcalloc(1, sizeof(*packed_refs));
- 	struct ref_entry *last = NULL;
- 	struct strbuf line = STRBUF_INIT;
- 	enum { PEELED_NONE, PEELED_TAGS, PEELED_FULLY } peeled = PEELED_NONE;
- 	struct ref_dir *dir;
- 
- 	acquire_packed_ref_cache(packed_refs);
- 	packed_refs->cache = create_ref_cache(NULL, NULL);
- 	packed_refs->cache->root->flag &= ~REF_INCOMPLETE;
- 
- 	f = fopen(packed_refs_file, "r");
- 	if (!f) {
- 		if (errno == ENOENT) {
- 			/*
- 			 * This is OK; it just means that no
- 			 * "packed-refs" file has been written yet,
- 			 * which is equivalent to it being empty.
- 			 */
- 			return packed_refs;
- 		} else {
- 			die_errno("couldn't read %s", packed_refs_file);
- 		}
- 	}
+ 	struct snapshot *snapshot = xcalloc(1, sizeof(*snapshot));
+ 	int sorted = 0;
  
- 	stat_validity_update(&packed_refs->validity, fileno(f));
+ 	snapshot->refs = refs;
+ 	acquire_snapshot(snapshot);
+ 	snapshot->peeled = PEELED_NONE;
  
- 	dir = get_ref_dir(packed_refs->cache->root);
- 	while (strbuf_getwholeline(&line, f, '\n') != EOF) {
- 		struct object_id oid;
- 		const char *refname;
- 		const char *traits;
+ 	if (!load_contents(snapshot))
+ 		return snapshot;
  
- 		if (!line.len || line.buf[line.len - 1] != '\n')
- 			die("unterminated line in %s: %s", packed_refs_file, line.buf);
+ 	/* If the file has a header line, process it: */
+ 	if (snapshot->buf < snapshot->eof && *snapshot->buf == '#') {
+ 		struct strbuf tmp = STRBUF_INIT;
+ 		char *p;
+ 		const char *eol;
+ 		struct string_list traits = STRING_LIST_INIT_NODUP;
  
- 		if (skip_prefix(line.buf, "# pack-refs with:", &traits)) {
- 			if (strstr(traits, " fully-peeled "))
- 				peeled = PEELED_FULLY;
- 			else if (strstr(traits, " peeled "))
- 				peeled = PEELED_TAGS;
- 			/* perhaps other traits later as well */
- 			continue;
- 		}
+ 		eol = memchr(snapshot->buf, '\n',
+ 			     snapshot->eof - snapshot->buf);
+ 		if (!eol)
+ 			die_unterminated_line(refs->path,
+ 					      snapshot->buf,
+ 					      snapshot->eof - snapshot->buf);
  
- 		refname = parse_ref_line(&line, &oid);
- 		if (refname) {
- 			int flag = REF_ISPACKED;
+ 		strbuf_add(&tmp, snapshot->buf, eol - snapshot->buf);
  
- 			if (check_refname_format(refname, REFNAME_ALLOW_ONELEVEL)) {
- 				if (!refname_is_safe(refname))
- 					die("packed refname is dangerous: %s", refname);
- 				oidclr(&oid);
- 				flag |= REF_BAD_NAME | REF_ISBROKEN;
- 			}
- 			last = create_ref_entry(refname, &oid, flag);
- 			if (peeled == PEELED_FULLY ||
- 			    (peeled == PEELED_TAGS && starts_with(refname, "refs/tags/")))
- 				last->flag |= REF_KNOWS_PEELED;
- 			add_ref_entry(dir, last);
- 		} else if (last &&
- 		    line.buf[0] == '^' &&
- 		    line.len == PEELED_LINE_LENGTH &&
- 		    line.buf[PEELED_LINE_LENGTH - 1] == '\n' &&
- 		    !get_oid_hex(line.buf + 1, &oid)) {
- 			oidcpy(&last->u.value.peeled, &oid);
- 			/*
- 			 * Regardless of what the file header said,
- 			 * we definitely know the value of *this*
- 			 * reference:
- 			 */
- 			last->flag |= REF_KNOWS_PEELED;
- 		} else {
- 			strbuf_setlen(&line, line.len - 1);
- 			die("unexpected line in %s: %s", packed_refs_file, line.buf);
- 		}
+ 		if (!skip_prefix(tmp.buf, "# pack-refs with:", (const char **)&p))
+ 			die_invalid_line(refs->path,
+ 					 snapshot->buf,
+ 					 snapshot->eof - snapshot->buf);
+ 
+ 		string_list_split_in_place(&traits, p, ' ', -1);
+ 
+ 		if (unsorted_string_list_has_string(&traits, "fully-peeled"))
+ 			snapshot->peeled = PEELED_FULLY;
+ 		else if (unsorted_string_list_has_string(&traits, "peeled"))
+ 			snapshot->peeled = PEELED_TAGS;
+ 
+ 		sorted = unsorted_string_list_has_string(&traits, "sorted");
+ 
+ 		/* perhaps other traits later as well */
+ 
+ 		/* The "+ 1" is for the LF character. */
+ 		snapshot->header_len = eol + 1 - snapshot->buf;
+ 
+ 		string_list_clear(&traits, 0);
+ 		strbuf_release(&tmp);
  	}
  
- 	fclose(f);
- 	strbuf_release(&line);
+ 	verify_buffer_safe(snapshot);
  
- 	return packed_refs;
+ 	if (!sorted) {
+ 		sort_snapshot(snapshot);
+ 
+ 		/*
+ 		 * Reordering the records might have moved a short one
+ 		 * to the end of the buffer, so verify the buffer's
+ 		 * safety again:
+ 		 */
+ 		verify_buffer_safe(snapshot);
+ 	}
+ 
+ 	if (mmap_strategy != MMAP_OK && snapshot->mmapped) {
+ 		/*
+ 		 * We don't want to leave the file mmapped, so we are
+ 		 * forced to make a copy now:
+ 		 */
+ 		size_t size = snapshot->eof -
+ 			(snapshot->buf + snapshot->header_len);
+ 		char *buf_copy = xmalloc(size);
+ 
+ 		memcpy(buf_copy, snapshot->buf + snapshot->header_len, size);
+ 		clear_snapshot_buffer(snapshot);
+ 		snapshot->buf = buf_copy;
+ 		snapshot->eof = buf_copy + size;
+ 	}
+ 
+ 	return snapshot;
  }
  
  /*
-  * Check that the packed refs cache (if any) still reflects the
-  * contents of the file. If not, clear the cache.
+  * Check that `refs->snapshot` (if present) still reflects the
+  * contents of the `packed-refs` file. If not, clear the snapshot.
   */
- static void validate_packed_ref_cache(struct packed_ref_store *refs)
+ static void validate_snapshot(struct packed_ref_store *refs)
  {
- 	if (refs->cache &&
- 	    !stat_validity_check(&refs->cache->validity, refs->path))
- 		clear_packed_ref_cache(refs);
+ 	if (refs->snapshot &&
+ 	    !stat_validity_check(&refs->snapshot->validity, refs->path))
+ 		clear_snapshot(refs);
  }
  
  /*
-  * Get the packed_ref_cache for the specified packed_ref_store,
-  * creating and populating it if it hasn't been read before or if the
-  * file has been changed (according to its `validity` field) since it
-  * was last read. On the other hand, if we hold the lock, then assume
-  * that the file hasn't been changed out from under us, so skip the
-  * extra `stat()` call in `stat_validity_check()`.
+  * Get the `snapshot` for the specified packed_ref_store, creating and
+  * populating it if it hasn't been read before or if the file has been
+  * changed (according to its `validity` field) since it was last read.
+  * On the other hand, if we hold the lock, then assume that the file
+  * hasn't been changed out from under us, so skip the extra `stat()`
+  * call in `stat_validity_check()`. This function does *not* increase
+  * the snapshot's reference count on behalf of the caller.
   */
- static struct packed_ref_cache *get_packed_ref_cache(struct packed_ref_store *refs)
+ static struct snapshot *get_snapshot(struct packed_ref_store *refs)
  {
  	if (!is_lock_file_locked(&refs->lock))
- 		validate_packed_ref_cache(refs);
+ 		validate_snapshot(refs);
  
- 	if (!refs->cache)
- 		refs->cache = read_packed_refs(refs->path);
- 
- 	return refs->cache;
- }
+ 	if (!refs->snapshot)
+ 		refs->snapshot = create_snapshot(refs);
  
- static struct ref_dir *get_packed_ref_dir(struct packed_ref_cache *packed_ref_cache)
- {
- 	return get_ref_dir(packed_ref_cache->cache->root);
- }
- 
- static struct ref_dir *get_packed_refs(struct packed_ref_store *refs)
- {
- 	return get_packed_ref_dir(get_packed_ref_cache(refs));
- }
- 
- /*
-  * Return the ref_entry for the given refname from the packed
-  * references.  If it does not exist, return NULL.
-  */
- static struct ref_entry *get_packed_ref(struct packed_ref_store *refs,
- 					const char *refname)
- {
- 	return find_ref_entry(get_packed_refs(refs), refname);
+ 	return refs->snapshot;
  }
  
  static int packed_read_raw_ref(struct ref_store *ref_store,
@@@ -324,69 -721,147 +721,147 @@@
  {
  	struct packed_ref_store *refs =
  		packed_downcast(ref_store, REF_STORE_READ, "read_raw_ref");
- 
- 	struct ref_entry *entry;
+ 	struct snapshot *snapshot = get_snapshot(refs);
+ 	const char *rec;
  
  	*type = 0;
  
- 	entry = get_packed_ref(refs, refname);
- 	if (!entry) {
+ 	rec = find_reference_location(snapshot, refname, 1);
+ 
+ 	if (!rec) {
+ 		/* refname is not a packed reference. */
  		errno = ENOENT;
  		return -1;
  	}
  
- 	hashcpy(sha1, entry->u.value.oid.hash);
+ 	if (get_sha1_hex(rec, sha1))
+ 		die_invalid_line(refs->path, rec, snapshot->eof - rec);
+ 
  	*type = REF_ISPACKED;
  	return 0;
  }
  
- static int packed_peel_ref(struct ref_store *ref_store,
- 			   const char *refname, unsigned char *sha1)
- {
- 	struct packed_ref_store *refs =
- 		packed_downcast(ref_store, REF_STORE_READ | REF_STORE_ODB,
- 				"peel_ref");
- 	struct ref_entry *r = get_packed_ref(refs, refname);
- 
- 	if (!r || peel_entry(r, 0))
- 		return -1;
- 
- 	hashcpy(sha1, r->u.value.peeled.hash);
- 	return 0;
- }
+ /*
+  * This value is set in `base.flags` if the peeled value of the
+  * current reference is known. In that case, `peeled` contains the
+  * correct peeled value for the reference, which might be `null_sha1`
+  * if the reference is not a tag or if it is broken.
+  */
+ #define REF_KNOWS_PEELED 0x40
  
+ /*
+  * An iterator over a snapshot of a `packed-refs` file.
+  */
  struct packed_ref_iterator {
  	struct ref_iterator base;
  
- 	struct packed_ref_cache *cache;
- 	struct ref_iterator *iter0;
+ 	struct snapshot *snapshot;
+ 
+ 	/* The current position in the snapshot's buffer: */
+ 	const char *pos;
+ 
+ 	/* The end of the part of the buffer that will be iterated over: */
+ 	const char *eof;
+ 
+ 	/* Scratch space for current values: */
+ 	struct object_id oid, peeled;
+ 	struct strbuf refname_buf;
+ 
  	unsigned int flags;
  };
  
+ /*
+  * Move the iterator to the next record in the snapshot, without
+  * respect for whether the record is actually required by the current
+  * iteration. Adjust the fields in `iter` and return `ITER_OK` or
+  * `ITER_DONE`. This function does not free the iterator in the case
+  * of `ITER_DONE`.
+  */
+ static int next_record(struct packed_ref_iterator *iter)
+ {
+ 	const char *p = iter->pos, *eol;
+ 
+ 	strbuf_reset(&iter->refname_buf);
+ 
+ 	if (iter->pos == iter->eof)
+ 		return ITER_DONE;
+ 
+ 	iter->base.flags = REF_ISPACKED;
+ 
+ 	if (iter->eof - p < GIT_SHA1_HEXSZ + 2 ||
+ 	    parse_oid_hex(p, &iter->oid, &p) ||
+ 	    !isspace(*p++))
+ 		die_invalid_line(iter->snapshot->refs->path,
+ 				 iter->pos, iter->eof - iter->pos);
+ 
+ 	eol = memchr(p, '\n', iter->eof - p);
+ 	if (!eol)
+ 		die_unterminated_line(iter->snapshot->refs->path,
+ 				      iter->pos, iter->eof - iter->pos);
+ 
+ 	strbuf_add(&iter->refname_buf, p, eol - p);
+ 	iter->base.refname = iter->refname_buf.buf;
+ 
+ 	if (check_refname_format(iter->base.refname, REFNAME_ALLOW_ONELEVEL)) {
+ 		if (!refname_is_safe(iter->base.refname))
+ 			die("packed refname is dangerous: %s",
+ 			    iter->base.refname);
+ 		oidclr(&iter->oid);
+ 		iter->base.flags |= REF_BAD_NAME | REF_ISBROKEN;
+ 	}
+ 	if (iter->snapshot->peeled == PEELED_FULLY ||
+ 	    (iter->snapshot->peeled == PEELED_TAGS &&
+ 	     starts_with(iter->base.refname, "refs/tags/")))
+ 		iter->base.flags |= REF_KNOWS_PEELED;
+ 
+ 	iter->pos = eol + 1;
+ 
+ 	if (iter->pos < iter->eof && *iter->pos == '^') {
+ 		p = iter->pos + 1;
+ 		if (iter->eof - p < GIT_SHA1_HEXSZ + 1 ||
+ 		    parse_oid_hex(p, &iter->peeled, &p) ||
+ 		    *p++ != '\n')
+ 			die_invalid_line(iter->snapshot->refs->path,
+ 					 iter->pos, iter->eof - iter->pos);
+ 		iter->pos = p;
+ 
+ 		/*
+ 		 * Regardless of what the file header said, we
+ 		 * definitely know the value of *this* reference. But
+ 		 * we suppress it if the reference is broken:
+ 		 */
+ 		if ((iter->base.flags & REF_ISBROKEN)) {
+ 			oidclr(&iter->peeled);
+ 			iter->base.flags &= ~REF_KNOWS_PEELED;
+ 		} else {
+ 			iter->base.flags |= REF_KNOWS_PEELED;
+ 		}
+ 	} else {
+ 		oidclr(&iter->peeled);
+ 	}
+ 
+ 	return ITER_OK;
+ }
+ 
  static int packed_ref_iterator_advance(struct ref_iterator *ref_iterator)
  {
  	struct packed_ref_iterator *iter =
  		(struct packed_ref_iterator *)ref_iterator;
  	int ok;
  
- 	while ((ok = ref_iterator_advance(iter->iter0)) == ITER_OK) {
+ 	while ((ok = next_record(iter)) == ITER_OK) {
  		if (iter->flags & DO_FOR_EACH_PER_WORKTREE_ONLY &&
- 		    ref_type(iter->iter0->refname) != REF_TYPE_PER_WORKTREE)
+ 		    ref_type(iter->base.refname) != REF_TYPE_PER_WORKTREE)
  			continue;
  
  		if (!(iter->flags & DO_FOR_EACH_INCLUDE_BROKEN) &&
- 		    !ref_resolves_to_object(iter->iter0->refname,
- 					    iter->iter0->oid,
- 					    iter->iter0->flags))
+ 		    !ref_resolves_to_object(iter->base.refname, &iter->oid,
+ 					    iter->flags))
  			continue;
  
- 		iter->base.refname = iter->iter0->refname;
- 		iter->base.oid = iter->iter0->oid;
- 		iter->base.flags = iter->iter0->flags;
  		return ITER_OK;
  	}
  
- 	iter->iter0 = NULL;
  	if (ref_iterator_abort(ref_iterator) != ITER_DONE)
  		ok = ITER_ERROR;
  
@@@ -399,7 -874,14 +874,14 @@@ static int packed_ref_iterator_peel(str
  	struct packed_ref_iterator *iter =
  		(struct packed_ref_iterator *)ref_iterator;
  
- 	return ref_iterator_peel(iter->iter0, peeled);
+ 	if ((iter->base.flags & REF_KNOWS_PEELED)) {
+ 		oidcpy(peeled, &iter->peeled);
+ 		return is_null_oid(&iter->peeled) ? -1 : 0;
+ 	} else if ((iter->base.flags & (REF_ISBROKEN | REF_ISSYMREF))) {
+ 		return -1;
+ 	} else {
+ 		return !!peel_object(iter->oid.hash, peeled->hash);
+ 	}
  }
  
  static int packed_ref_iterator_abort(struct ref_iterator *ref_iterator)
@@@ -408,10 -890,8 +890,8 @@@
  		(struct packed_ref_iterator *)ref_iterator;
  	int ok = ITER_DONE;
  
- 	if (iter->iter0)
- 		ok = ref_iterator_abort(iter->iter0);
- 
- 	release_packed_ref_cache(iter->cache);
+ 	strbuf_release(&iter->refname_buf);
+ 	release_snapshot(iter->snapshot);
  	base_ref_iterator_free(ref_iterator);
  	return ok;
  }
@@@ -427,6 -907,8 +907,8 @@@ static struct ref_iterator *packed_ref_
  		const char *prefix, unsigned int flags)
  {
  	struct packed_ref_store *refs;
+ 	struct snapshot *snapshot;
+ 	const char *start;
  	struct packed_ref_iterator *iter;
  	struct ref_iterator *ref_iterator;
  	unsigned int required_flags = REF_STORE_READ;
@@@ -435,22 -917,40 +917,40 @@@
  		required_flags |= REF_STORE_ODB;
  	refs = packed_downcast(ref_store, required_flags, "ref_iterator_begin");
  
+ 	/*
+ 	 * Note that `get_snapshot()` internally checks whether the
+ 	 * snapshot is up to date with what is on disk, and re-reads
+ 	 * it if not.
+ 	 */
+ 	snapshot = get_snapshot(refs);
+ 
+ 	if (!snapshot->buf)
+ 		return empty_ref_iterator_begin();
+ 
  	iter = xcalloc(1, sizeof(*iter));
  	ref_iterator = &iter->base;
- 	base_ref_iterator_init(ref_iterator, &packed_ref_iterator_vtable);
+ 	base_ref_iterator_init(ref_iterator, &packed_ref_iterator_vtable, 1);
  
- 	/*
- 	 * Note that get_packed_ref_cache() internally checks whether
- 	 * the packed-ref cache is up to date with what is on disk,
- 	 * and re-reads it if not.
- 	 */
+ 	iter->snapshot = snapshot;
+ 	acquire_snapshot(snapshot);
+ 
+ 	if (prefix && *prefix)
+ 		start = find_reference_location(snapshot, prefix, 0);
+ 	else
+ 		start = snapshot->buf + snapshot->header_len;
  
- 	iter->cache = get_packed_ref_cache(refs);
- 	acquire_packed_ref_cache(iter->cache);
- 	iter->iter0 = cache_ref_iterator_begin(iter->cache->cache, prefix, 0);
+ 	iter->pos = start;
+ 	iter->eof = snapshot->eof;
+ 	strbuf_init(&iter->refname_buf, 0);
+ 
+ 	iter->base.oid = &iter->oid;
  
  	iter->flags = flags;
  
+ 	if (prefix && *prefix)
+ 		/* Stop iteration after we've gone *past* prefix: */
+ 		ref_iterator = prefix_ref_iterator_begin(ref_iterator, prefix, 0);
+ 
  	return ref_iterator;
  }
  
@@@ -497,27 -997,26 +997,27 @@@ int packed_refs_lock(struct ref_store *
  		return -1;
  	}
  
 -	if (close_lock_file(&refs->lock)) {
 +	if (close_lock_file_gently(&refs->lock)) {
  		strbuf_addf(err, "unable to close %s: %s", refs->path, strerror(errno));
 +		rollback_lock_file(&refs->lock);
  		return -1;
  	}
  
  	/*
  	 * Now that we hold the `packed-refs` lock, make sure that our
- 	 * cache matches the current version of the file. Normally
- 	 * `get_packed_ref_cache()` does that for us, but that
- 	 * function assumes that when the file is locked, any existing
- 	 * cache is still valid. We've just locked the file, but it
- 	 * might have changed the moment *before* we locked it.
+ 	 * snapshot matches the current version of the file. Normally
+ 	 * `get_snapshot()` does that for us, but that function
+ 	 * assumes that when the file is locked, any existing snapshot
+ 	 * is still valid. We've just locked the file, but it might
+ 	 * have changed the moment *before* we locked it.
  	 */
- 	validate_packed_ref_cache(refs);
+ 	validate_snapshot(refs);
  
  	/*
  	 * Now make sure that the packed-refs file as it exists in the
- 	 * locked state is loaded into the cache:
+ 	 * locked state is loaded into the snapshot:
  	 */
- 	get_packed_ref_cache(refs);
+ 	get_snapshot(refs);
  	return 0;
  }
  
@@@ -544,11 -1043,15 +1044,15 @@@ int packed_refs_is_locked(struct ref_st
  }
  
  /*
-  * The packed-refs header line that we write out.  Perhaps other
-  * traits will be added later.  The trailing space is required.
+  * The packed-refs header line that we write out. Perhaps other traits
+  * will be added later.
+  *
+  * Note that earlier versions of Git used to parse these traits by
+  * looking for " trait " in the line. For this reason, the space after
+  * the colon and the trailing space are required.
   */
  static const char PACKED_REFS_HEADER[] =
- 	"# pack-refs with: peeled fully-peeled \n";
+ 	"# pack-refs with: peeled fully-peeled sorted \n";
  
  static int packed_init_db(struct ref_store *ref_store, struct strbuf *err)
  {
@@@ -557,9 -1060,9 +1061,9 @@@
  }
  
  /*
-  * Write the packed-refs from the cache to the packed-refs tempfile,
-  * incorporating any changes from `updates`. `updates` must be a
-  * sorted string list whose keys are the refnames and whose util
+  * Write the packed refs from the current snapshot to the packed-refs
+  * tempfile, incorporating any changes from `updates`. `updates` must
+  * be a sorted string list whose keys are the refnames and whose util
   * values are `struct ref_update *`. On error, rollback the tempfile,
   * write an error message to `err`, and return a nonzero value.
   *
@@@ -588,8 -1091,7 +1092,8 @@@ static int write_with_updates(struct pa
  	packed_refs_path = get_locked_file_path(&refs->lock);
  	strbuf_addf(&sb, "%s.new", packed_refs_path);
  	free(packed_refs_path);
 -	if (create_tempfile(&refs->tempfile, sb.buf) < 0) {
 +	refs->tempfile = create_tempfile(sb.buf);
 +	if (!refs->tempfile) {
  		strbuf_addf(err, "unable to create file %s: %s",
  			    sb.buf, strerror(errno));
  		strbuf_release(&sb);
@@@ -597,7 -1099,7 +1101,7 @@@
  	}
  	strbuf_release(&sb);
  
 -	out = fdopen_tempfile(&refs->tempfile, "w");
 +	out = fdopen_tempfile(refs->tempfile, "w");
  	if (!out) {
  		strbuf_addf(err, "unable to fdopen packed-refs tempfile: %s",
  			    strerror(errno));
@@@ -734,12 -1236,11 +1238,12 @@@
  		goto error;
  	}
  
 -	if (close_tempfile(&refs->tempfile)) {
 +	if (close_tempfile_gently(refs->tempfile)) {
  		strbuf_addf(err, "error closing file %s: %s",
 -			    get_tempfile_path(&refs->tempfile),
 +			    get_tempfile_path(refs->tempfile),
  			    strerror(errno));
  		strbuf_release(&sb);
 +		delete_tempfile(&refs->tempfile);
  		return -1;
  	}
  
@@@ -747,7 -1248,7 +1251,7 @@@
  
  write_error:
  	strbuf_addf(err, "error writing to %s: %s",
 -		    get_tempfile_path(&refs->tempfile), strerror(errno));
 +		    get_tempfile_path(refs->tempfile), strerror(errno));
  
  error:
  	if (iter)
@@@ -772,7 -1273,7 +1276,7 @@@ static void packed_transaction_cleanup(
  	if (data) {
  		string_list_clear(&data->updates, 0);
  
 -		if (is_tempfile_active(&refs->tempfile))
 +		if (is_tempfile_active(refs->tempfile))
  			delete_tempfile(&refs->tempfile);
  
  		if (data->own_lock && is_lock_file_locked(&refs->lock)) {
@@@ -802,9 -1303,10 +1306,10 @@@ static int packed_transaction_prepare(s
  	/*
  	 * Note that we *don't* skip transactions with zero updates,
  	 * because such a transaction might be executed for the side
- 	 * effect of ensuring that all of the references are peeled.
- 	 * If the caller wants to optimize away empty transactions, it
- 	 * should do so itself.
+ 	 * effect of ensuring that all of the references are peeled or
+ 	 * ensuring that the `packed-refs` file is sorted. If the
+ 	 * caller wants to optimize away empty transactions, it should
+ 	 * do so itself.
  	 */
  
  	data = xcalloc(1, sizeof(*data));
@@@ -870,6 -1372,8 +1375,8 @@@ static int packed_transaction_finish(st
  	int ret = TRANSACTION_GENERIC_ERROR;
  	char *packed_refs_path;
  
+ 	clear_snapshot(refs);
+ 
  	packed_refs_path = get_locked_file_path(&refs->lock);
  	if (rename_tempfile(&refs->tempfile, packed_refs_path)) {
  		strbuf_addf(err, "error replacing %s: %s",
@@@ -877,7 -1381,6 +1384,6 @@@
  		goto cleanup;
  	}
  
- 	clear_packed_ref_cache(refs);
  	ret = 0;
  
  cleanup:
@@@ -966,13 -1469,6 +1472,13 @@@ static int packed_rename_ref(struct ref
  	die("BUG: packed reference store does not support renaming references");
  }
  
 +static int packed_copy_ref(struct ref_store *ref_store,
 +			   const char *oldrefname, const char *newrefname,
 +			   const char *logmsg)
 +{
 +	die("BUG: packed reference store does not support copying references");
 +}
 +
  static struct ref_iterator *packed_reflog_iterator_begin(struct ref_store *ref_store)
  {
  	return empty_ref_iterator_begin();
@@@ -1034,11 -1530,9 +1540,10 @@@ struct ref_storage_be refs_be_packed = 
  	packed_initial_transaction_commit,
  
  	packed_pack_refs,
- 	packed_peel_ref,
  	packed_create_symref,
  	packed_delete_refs,
  	packed_rename_ref,
 +	packed_copy_ref,
  
  	packed_ref_iterator_begin,
  	packed_read_raw_ref,
diff --combined refs/refs-internal.h
index 8821e27ed9,cc6c373f59..448de4bccb
--- a/refs/refs-internal.h
+++ b/refs/refs-internal.h
@@@ -329,6 -329,13 +329,13 @@@ int refs_rename_ref_available(struct re
   */
  struct ref_iterator {
  	struct ref_iterator_vtable *vtable;
+ 
+ 	/*
+ 	 * Does this `ref_iterator` iterate over references in order
+ 	 * by refname?
+ 	 */
+ 	unsigned int ordered : 1;
+ 
  	const char *refname;
  	const struct object_id *oid;
  	unsigned int flags;
@@@ -374,7 -381,7 +381,7 @@@ int is_empty_ref_iterator(struct ref_it
   * which the refname begins with prefix. If trim is non-zero, then
   * trim that many characters off the beginning of each refname. flags
   * can be DO_FOR_EACH_INCLUDE_BROKEN to include broken references in
-  * the iteration.
+  * the iteration. The output is ordered by refname.
   */
  struct ref_iterator *refs_ref_iterator_begin(
  		struct ref_store *refs,
@@@ -400,9 -407,11 +407,11 @@@ typedef enum iterator_selection ref_ite
   * Iterate over the entries from iter0 and iter1, with the values
   * interleaved as directed by the select function. The iterator takes
   * ownership of iter0 and iter1 and frees them when the iteration is
-  * over.
+  * over. A derived class should set `ordered` to 1 or 0 based on
+  * whether it generates its output in order by reference name.
   */
  struct ref_iterator *merge_ref_iterator_begin(
+ 		int ordered,
  		struct ref_iterator *iter0, struct ref_iterator *iter1,
  		ref_iterator_select_fn *select, void *cb_data);
  
@@@ -431,6 -440,8 +440,8 @@@ struct ref_iterator *overlay_ref_iterat
   * As an convenience to callers, if prefix is the empty string and
   * trim is zero, this function returns iter0 directly, without
   * wrapping it.
+  *
+  * The resulting ref_iterator is ordered if iter0 is.
   */
  struct ref_iterator *prefix_ref_iterator_begin(struct ref_iterator *iter0,
  					       const char *prefix,
@@@ -441,11 -452,14 +452,14 @@@
  /*
   * Base class constructor for ref_iterators. Initialize the
   * ref_iterator part of iter, setting its vtable pointer as specified.
+  * `ordered` should be set to 1 if the iterator will iterate over
+  * references in order by refname; otherwise it should be set to 0.
   * This is meant to be called only by the initializers of derived
   * classes.
   */
  void base_ref_iterator_init(struct ref_iterator *iter,
- 			    struct ref_iterator_vtable *vtable);
+ 			    struct ref_iterator_vtable *vtable,
+ 			    int ordered);
  
  /*
   * Base class destructor for ref_iterators. Destroy the ref_iterator
@@@ -548,8 -562,6 +562,6 @@@ typedef int ref_transaction_commit_fn(s
  				      struct strbuf *err);
  
  typedef int pack_refs_fn(struct ref_store *ref_store, unsigned int flags);
- typedef int peel_ref_fn(struct ref_store *ref_store,
- 			const char *refname, unsigned char *sha1);
  typedef int create_symref_fn(struct ref_store *ref_store,
  			     const char *ref_target,
  			     const char *refs_heads_master,
@@@ -559,15 -571,13 +571,16 @@@ typedef int delete_refs_fn(struct ref_s
  typedef int rename_ref_fn(struct ref_store *ref_store,
  			  const char *oldref, const char *newref,
  			  const char *logmsg);
 +typedef int copy_ref_fn(struct ref_store *ref_store,
 +			  const char *oldref, const char *newref,
 +			  const char *logmsg);
  
  /*
   * Iterate over the references in `ref_store` whose names start with
   * `prefix`. `prefix` is matched as a literal string, without regard
   * for path separators. If prefix is NULL or the empty string, iterate
-  * over all references in `ref_store`.
+  * over all references in `ref_store`. The output is ordered by
+  * refname.
   */
  typedef struct ref_iterator *ref_iterator_begin_fn(
  		struct ref_store *ref_store,
@@@ -656,11 -666,9 +669,10 @@@ struct ref_storage_be 
  	ref_transaction_commit_fn *initial_transaction_commit;
  
  	pack_refs_fn *pack_refs;
- 	peel_ref_fn *peel_ref;
  	create_symref_fn *create_symref;
  	delete_refs_fn *delete_refs;
  	rename_ref_fn *rename_ref;
 +	copy_ref_fn *copy_ref;
  
  	ref_iterator_begin_fn *iterator_begin;
  	read_raw_ref_fn *read_raw_ref;