Import wiredtiger: 8edcffb096846d3cf685f7ab7a41338d767a5c45 from branch mongodb-master

ref: 000b195e57..8edcffb096
for: 6.0.0

WT-8745       Restrict prepare_timestamp to be > stable, not >= oldest

13 files changed, 433 insertions, 69 deletions

diff --git a/src/third_party/wiredtiger/dist/api_data.py b/src/third_party/wiredtiger/dist/api_data.py
index a4895e5c017..6a22c454b9d 100644
--- a/src/third_party/wiredtiger/dist/api_data.py
+++ b/src/third_party/wiredtiger/dist/api_data.py
@@ -1765,13 +1765,18 @@ methods = {
         timestamp_roundup''',
         type='category', subconfig= [
         Config('prepared', 'false', r'''
-            applicable only for prepared transactions. Indicates if the prepare
-            timestamp and the commit timestamp of this transaction can be
-            rounded up. If the prepare timestamp is less than the stable
-            timestamp, the prepare timestamp will be rounded to the stable
-            timestamp. If the commit timestamp is less than the prepare
-            timestamp, the commit timestamp will be rounded up to the prepare
-            timestamp''', type='boolean'),
+            applicable only for prepared transactions, and intended only for special-purpose
+            use. (See @ref timestamp_roundup_prepare.) Allows the prepare timestamp and the
+            commit timestamp of this transaction to be rounded up to be no older than the
+            oldest timestamp, and allows violating the usual restriction that the prepare
+            timestamp must be newer than the stable timestamp. Specifically: at transaction
+            prepare, if the prepare
+            timestamp is less than or equal to the oldest timestamp, the prepare timestamp
+            will be rounded to the oldest timestamp. Subsequently, at commit time, if the
+            commit timestamp is less than the (now rounded) prepare timestamp, the commit
+            timestamp will be rounded up to it and thus to at least oldest.
+            Neither timestamp will be checked against the stable timestamp''',
+            type='boolean'),
         Config('read', 'false', r'''
             if the read timestamp is less than the oldest timestamp, the
             read timestamp will be rounded up to the oldest timestamp''',
@@ -1795,7 +1800,7 @@ methods = {
         set the durable timestamp for the current transaction. Required for the
         commit of a prepared transaction, and otherwise not permitted. The
         supplied value must not be older than the commit timestamp set for the
-        current transaction. The value must also not be older than the current
+        current transaction. The value must also be newer than the current
         oldest and stable timestamps. See @ref timestamp_prepare'''),
     Config('operation_timeout_ms', '0', r'''
         when non-zero, a requested limit on the time taken to complete operations in this
@@ -1816,7 +1821,7 @@ methods = {
     Config('prepare_timestamp', '', r'''
         set the prepare timestamp for the updates of the current transaction.
         The supplied value must not be older than any active read timestamps, and must
-        not be older than the current stable timestamp. See @ref timestamp_prepare'''),
+        be newer than the current stable timestamp. See @ref timestamp_prepare'''),
 ]),
 
 'WT_SESSION.timestamp_transaction' : Method([
@@ -1833,12 +1838,12 @@ methods = {
         commit of a prepared transaction, and otherwise not permitted. Can only
         be set once the current transaction has been prepared, and a commit
         timestamp has been set. The supplied value must not be older than the
-        commit timestamp. The value must also not be older than the current
+        commit timestamp. The value must also be newer than the current
         oldest and stable timestamps. See @ref timestamp_prepare'''),
     Config('prepare_timestamp', '', r'''
         set the prepare timestamp for the updates of the current transaction.
         The supplied value must not be older than any active read timestamps,
-        and must not be older than the current stable timestamp. Can be set only
+        and must be newer than the current stable timestamp. Can be set only
         once per transaction. Setting the prepare timestamp does not by itself
         prepare the transaction, but does oblige the application to eventually
         prepare the transaction before committing it. See @ref timestamp_prepare'''),
diff --git a/src/third_party/wiredtiger/import.data b/src/third_party/wiredtiger/import.data
index 7a96e02f352..71fd4ba5931 100644
--- a/src/third_party/wiredtiger/import.data
+++ b/src/third_party/wiredtiger/import.data
@@ -2,5 +2,5 @@
     "vendor": "wiredtiger",
     "github": "wiredtiger/wiredtiger.git",
     "branch": "mongodb-master",
-    "commit": "000b195e57cabb95acad583905f8f90fe8a4502d"
+    "commit": "8edcffb096846d3cf685f7ab7a41338d767a5c45"
 }
diff --git a/src/third_party/wiredtiger/src/include/wiredtiger.in b/src/third_party/wiredtiger/src/include/wiredtiger.in
index 2088d7301a4..fbe3c8033e5 100644
--- a/src/third_party/wiredtiger/src/include/wiredtiger.in
+++ b/src/third_party/wiredtiger/src/include/wiredtiger.in
@@ -1724,15 +1724,19 @@ struct __wt_session {
 	 * alters the visibility expected in a transaction.  See @ref timestamp_roundup., a set of
 	 * related configuration options defined below.}
 	 * @config{    prepared,
-	 * applicable only for prepared transactions.  Indicates if the prepare timestamp and the
-	 * commit timestamp of this transaction can be rounded up.  If the prepare timestamp is less
-	 * than the stable timestamp\, the prepare timestamp will be rounded to the stable
-	 * timestamp.  If the commit timestamp is less than the prepare timestamp\, the commit
-	 * timestamp will be rounded up to the prepare timestamp., a boolean flag; default \c
-	 * false.}
-	 * @config{    read, if the read timestamp is less than the
-	 * oldest timestamp\, the read timestamp will be rounded up to the oldest timestamp., a
-	 * boolean flag; default \c false.}
+	 * applicable only for prepared transactions\, and intended only for special-purpose use.
+	 * (See @ref timestamp_roundup_prepare.) Allows the prepare timestamp and the commit
+	 * timestamp of this transaction to be rounded up to be no older than the oldest timestamp\,
+	 * and allows violating the usual restriction that the prepare timestamp must be newer than
+	 * the stable timestamp.  Specifically: at transaction prepare\, if the prepare timestamp is
+	 * less than or equal to the oldest timestamp\, the prepare timestamp will be rounded to the
+	 * oldest timestamp.  Subsequently\, at commit time\, if the commit timestamp is less than
+	 * the (now rounded) prepare timestamp\, the commit timestamp will be rounded up to it and
+	 * thus to at least oldest.  Neither timestamp will be checked against the stable
+	 * timestamp., a boolean flag; default \c false.}
+	 * @config{    read, if
+	 * the read timestamp is less than the oldest timestamp\, the read timestamp will be rounded
+	 * up to the oldest timestamp., a boolean flag; default \c false.}
 	 * @config{ ),,}
 	 * @config{sync, whether to sync log records when the transaction commits\, inherited from
 	 * ::wiredtiger_open \c transaction_sync., a boolean flag; default empty.}
@@ -1764,8 +1768,8 @@ struct __wt_session {
 	 * @config{durable_timestamp, set the durable timestamp for the current transaction.
 	 * Required for the commit of a prepared transaction\, and otherwise not permitted.  The
 	 * supplied value must not be older than the commit timestamp set for the current
-	 * transaction.  The value must also not be older than the current oldest and stable
-	 * timestamps.  See @ref timestamp_prepare., a string; default empty.}
+	 * transaction.  The value must also be newer than the current oldest and stable timestamps.
+	 * See @ref timestamp_prepare., a string; default empty.}
 	 * @config{operation_timeout_ms, when non-zero\, a requested limit on the time taken to
 	 * complete operations in this transaction.  Time is measured in real time milliseconds from
 	 * the start of each WiredTiger API call.  There is no guarantee any operation will not take
@@ -1801,8 +1805,8 @@ struct __wt_session {
 	 * @configstart{WT_SESSION.prepare_transaction, see dist/api_data.py}
 	 * @config{prepare_timestamp, set the prepare timestamp for the updates of the current
 	 * transaction.  The supplied value must not be older than any active read timestamps\, and
-	 * must not be older than the current stable timestamp.  See @ref timestamp_prepare., a
-	 * string; default empty.}
+	 * must be newer than the current stable timestamp.  See @ref timestamp_prepare., a string;
+	 * default empty.}
 	 * @configend
 	 * @errors
 	 */
@@ -1883,14 +1887,14 @@ struct __wt_session {
 	 * Required for the commit of a prepared transaction\, and otherwise not permitted.  Can
 	 * only be set once the current transaction has been prepared\, and a commit timestamp has
 	 * been set.  The supplied value must not be older than the commit timestamp.  The value
-	 * must also not be older than the current oldest and stable timestamps.  See @ref
+	 * must also be newer than the current oldest and stable timestamps.  See @ref
 	 * timestamp_prepare., a string; default empty.}
 	 * @config{prepare_timestamp, set the prepare timestamp for the updates of the current
 	 * transaction.  The supplied value must not be older than any active read timestamps\, and
-	 * must not be older than the current stable timestamp.  Can be set only once per
-	 * transaction.  Setting the prepare timestamp does not by itself prepare the transaction\,
-	 * but does oblige the application to eventually prepare the transaction before committing
-	 * it.  See @ref timestamp_prepare., a string; default empty.}
+	 * must be newer than the current stable timestamp.  Can be set only once per transaction.
+	 * Setting the prepare timestamp does not by itself prepare the transaction\, but does
+	 * oblige the application to eventually prepare the transaction before committing it.  See
+	 * @ref timestamp_prepare., a string; default empty.}
 	 * @config{read_timestamp, read using the specified timestamp.  The supplied value must not
 	 * be older than the current oldest timestamp.  This can only be set once for a transaction.
 	 * See @ref timestamp_txn_api., a string; default empty.}
diff --git a/src/third_party/wiredtiger/src/txn/txn_timestamp.c b/src/third_party/wiredtiger/src/txn/txn_timestamp.c
index 7336690b084..0b9b99509f2 100644
--- a/src/third_party/wiredtiger/src/txn/txn_timestamp.c
+++ b/src/third_party/wiredtiger/src/txn/txn_timestamp.c
@@ -695,7 +695,7 @@ __wt_txn_set_prepare_timestamp(WT_SESSION_IMPL *session, wt_timestamp_t prepare_
 {
     WT_TXN *txn;
     WT_TXN_GLOBAL *txn_global;
-    wt_timestamp_t oldest_ts;
+    wt_timestamp_t oldest_ts, stable_ts;
     char ts_string[2][WT_TS_INT_STRING_SIZE];
 
     txn = session->txn;
@@ -713,25 +713,53 @@ __wt_txn_set_prepare_timestamp(WT_SESSION_IMPL *session, wt_timestamp_t prepare_
     WT_RET(__txn_assert_after_reads(session, "prepare", prepare_ts));
 
     /*
-     * Check whether the prepare timestamp is less than the oldest timestamp.
+     * Check whether the prepare timestamp is less than the stable timestamp.
      */
-    oldest_ts = txn_global->oldest_timestamp;
-    if (prepare_ts < oldest_ts) {
+    stable_ts = txn_global->stable_timestamp;
+    if (prepare_ts <= stable_ts) {
         /*
-         * Check whether the prepare timestamp needs to be rounded up to the oldest timestamp.
+         * Check whether the application is using the "prepared" roundup mode. This rounds up to
+         * _oldest_, not stable, and permits preparing before stable, because it is meant to be used
+         * during application recovery to replay a transaction that was successfully prepared (and
+         * possibly committed) before a crash but had not yet become durable. In general it is
+         * important to replay such transactions at the same time they had before the crash; in a
+         * distributed setting they might have already committed in the network, in which case
+         * replaying them at a different time is very likely to be inconsistent. Meanwhile, once a
+         * transaction prepares we allow stable to move forward past it, so replaying may require
+         * preparing and even committing prior to stable.
+         *
+         * Such a replay is safe provided that it happens during application-level recovery before
+         * resuming ordinary operations: between the time the transaction prepares and the crash,
+         * operations intersecting with the prepared transaction fail with WT_PREPARE_CONFLICT, and
+         * after the crash, the replay recreates this state before any ordinary operations can
+         * intersect with it. Application recovery code is responsible for making sure that any
+         * other operations it does before the replay that might intersect with the prepared
+         * transaction are consistent with it.
+         *
+         * (There is a slight extra wrinkle at the moment, because it is possible for a transaction
+         * to prepare and commit and be interacted with before it becomes durable. Currently such
+         * transactions _must_ be replayed identically by the application to avoid inconsistency,
+         * or avoided. FIXME-WT-8747: remove this note when WT-8747 fixes this.)
+         *
+         * Under other circumstances, that is, not during application-level recovery when ordinary
+         * operations are excluded, use of "roundup=prepared" (for replaying transactions or
+         * otherwise) is not safe and can cause data inconsistency. There is currently no roundup
+         * mode for commit timestamps that is suitable for use during ordinary operation.
          */
         if (F_ISSET(txn, WT_TXN_TS_ROUND_PREPARED)) {
-            __wt_verbose(session, WT_VERB_TIMESTAMP,
-              "prepare timestamp %s rounded to oldest timestamp %s",
-              __wt_timestamp_to_string(prepare_ts, ts_string[0]),
-              __wt_timestamp_to_string(oldest_ts, ts_string[1]));
-
-            prepare_ts = oldest_ts;
+            oldest_ts = txn_global->oldest_timestamp;
+            if (prepare_ts < oldest_ts) {
+                __wt_verbose(session, WT_VERB_TIMESTAMP,
+                  "prepare timestamp %s rounded to oldest timestamp %s",
+                  __wt_timestamp_to_string(prepare_ts, ts_string[0]),
+                  __wt_timestamp_to_string(oldest_ts, ts_string[1]));
+                prepare_ts = oldest_ts;
+            }
         } else
             WT_RET_MSG(session, EINVAL,
-              "prepare timestamp %s is older than the oldest timestamp %s",
+              "prepare timestamp %s is not newer than the stable timestamp %s",
               __wt_timestamp_to_string(prepare_ts, ts_string[0]),
-              __wt_timestamp_to_string(oldest_ts, ts_string[1]));
+              __wt_timestamp_to_string(stable_ts, ts_string[1]));
     }
     txn->prepare_timestamp = prepare_ts;
     F_SET(txn, WT_TXN_HAS_TS_PREPARE);
diff --git a/src/third_party/wiredtiger/test/suite/test_durable_rollback_to_stable.py b/src/third_party/wiredtiger/test/suite/test_durable_rollback_to_stable.py
index e34f1843c3e..c6002b97b91 100644
--- a/src/third_party/wiredtiger/test/suite/test_durable_rollback_to_stable.py
+++ b/src/third_party/wiredtiger/test/suite/test_durable_rollback_to_stable.py
@@ -115,9 +115,6 @@ class test_durable_rollback_to_stable(wttest.WiredTigerTestCase, suite_subproces
             self.assertEquals(cursor.next(), 0)
         session.commit_transaction()
 
-        # Set a stable timestamp so that first update value is durable.
-        self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(250))
-
         # Update all values with value 222 i.e. second update value.
         self.assertEquals(cursor.reset(), 0)
         session.begin_transaction()
@@ -129,6 +126,10 @@ class test_durable_rollback_to_stable(wttest.WiredTigerTestCase, suite_subproces
 
         session.prepare_transaction('prepare_timestamp=' + self.timestamp_str(200))
 
+        # Set a stable timestamp so that first update value is durable.
+        # (Must be done after preparing since preparing before stable is prohibited.)
+        self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(250))
+
         # Commit timestamp is earlier to stable timestamp but durable timestamp
         # is later than stable timestamp. Hence second update value is not durable.
         session.timestamp_transaction('commit_timestamp=' + self.timestamp_str(240))
diff --git a/src/third_party/wiredtiger/test/suite/test_durable_ts01.py b/src/third_party/wiredtiger/test/suite/test_durable_ts01.py
index 4864ebc1d8d..30832ee04b5 100644
--- a/src/third_party/wiredtiger/test/suite/test_durable_ts01.py
+++ b/src/third_party/wiredtiger/test/suite/test_durable_ts01.py
@@ -114,9 +114,6 @@ class test_durable_ts01(wttest.WiredTigerTestCase):
             self.assertEquals(cursor.next(), 0)
         session.commit_transaction()
 
-        # Set a stable timestamp so that first update value is durable.
-        self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(250))
-
         # Update all values with value 222 i.e. second update value.
         self.assertEquals(cursor.reset(), 0)
         session.begin_transaction()
@@ -128,6 +125,10 @@ class test_durable_ts01(wttest.WiredTigerTestCase):
 
         session.prepare_transaction('prepare_timestamp=' + self.timestamp_str(200))
 
+        # Set a stable timestamp so that first update value is durable.
+        # (Must be done after preparing since preparing before stable is prohibited.)
+        self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(250))
+
         # Commit timestamp is earlier to stable timestamp but durable timestamp
         # is later than stable timestamp. Hence second update value is not durable.
         session.timestamp_transaction('commit_timestamp=' + self.timestamp_str(240))
diff --git a/src/third_party/wiredtiger/test/suite/test_prepare05.py b/src/third_party/wiredtiger/test/suite/test_prepare05.py
index 74c2f7ecd03..27beb9e14e0 100644
--- a/src/third_party/wiredtiger/test/suite/test_prepare05.py
+++ b/src/third_party/wiredtiger/test/suite/test_prepare05.py
@@ -51,18 +51,27 @@ class test_prepare05(wttest.WiredTigerTestCase, suite_subprocess):
         self.session.create(self.uri, format)
         c = self.session.open_cursor(self.uri)
 
-        # It is illegal to set a prepare timestamp older than oldest timestamp.
-        self.conn.set_timestamp('oldest_timestamp=' + self.timestamp_str(2))
+        # It is illegal to set a prepare timestamp older than the stable timestamp.
+        self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(2))
         self.session.begin_transaction()
         self.assertRaisesWithMessage(wiredtiger.WiredTigerError,
             lambda: self.session.prepare_transaction(
             'prepare_timestamp=' + self.timestamp_str(1)),
-            "/older than the oldest timestamp/")
+            "/not newer than the stable timestamp/")
         self.session.rollback_transaction()
 
-        # Check setting the prepare timestamp same as oldest timestamp is valid.
+        # It is also illegal to set a prepare timestamp the same as the stable timestamp.
+        self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(2))
         self.session.begin_transaction()
-        self.session.prepare_transaction('prepare_timestamp=' + self.timestamp_str(2))
+        self.assertRaisesWithMessage(wiredtiger.WiredTigerError,
+            lambda: self.session.prepare_transaction(
+            'prepare_timestamp=' + self.timestamp_str(2)),
+            "/not newer than the stable timestamp/")
+        self.session.rollback_transaction()
+
+        # Check setting the prepare timestamp immediately after the stable timestamp is valid.
+        self.session.begin_transaction()
+        self.session.prepare_transaction('prepare_timestamp=' + self.timestamp_str(3))
         self.session.timestamp_transaction('commit_timestamp=' + self.timestamp_str(3))
         self.session.timestamp_transaction('durable_timestamp=' + self.timestamp_str(3))
         self.session.commit_transaction()
@@ -82,7 +91,7 @@ class test_prepare05(wttest.WiredTigerTestCase, suite_subprocess):
 
         # This is also true even if the prepare timestamp was set first.
         self.session.begin_transaction()
-        self.session.timestamp_transaction('prepare_timestamp=' + self.timestamp_str(2))
+        self.session.timestamp_transaction('prepare_timestamp=' + self.timestamp_str(3))
         self.assertRaisesWithMessage(wiredtiger.WiredTigerError,
             lambda:
                 self.session.timestamp_transaction('commit_timestamp=' + self.timestamp_str(3)),
diff --git a/src/third_party/wiredtiger/test/suite/test_prepare06.py b/src/third_party/wiredtiger/test/suite/test_prepare06.py
index 2079b64f501..9ac060c6c7b 100644
--- a/src/third_party/wiredtiger/test/suite/test_prepare06.py
+++ b/src/third_party/wiredtiger/test/suite/test_prepare06.py
@@ -51,19 +51,28 @@ class test_prepare06(wttest.WiredTigerTestCase, suite_subprocess):
         self.session.create(self.uri, format)
         c = self.session.open_cursor(self.uri)
 
-        # It is illegal to set the prepare timestamp older than the oldest
-        # timestamp.
         self.conn.set_timestamp('oldest_timestamp=' + self.timestamp_str(20))
         self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(30))
+
+        # It is illegal to set the prepare timestamp older than the stable
+        # timestamp.
         self.session.begin_transaction()
         self.assertRaisesWithMessage(wiredtiger.WiredTigerError,
             lambda: self.session.prepare_transaction(
             'prepare_timestamp=' + self.timestamp_str(10)),
-            "/older than the oldest timestamp/")
+            "/not newer than the stable timestamp/")
         self.session.rollback_transaction()
 
         # Check setting a prepared transaction timestamps earlier than the
-        # oldest timestamp is valid with roundup_timestamps settings.
+        # stable timestamp is valid with roundup_timestamps settings.
+        self.session.begin_transaction('roundup_timestamps=(prepared=true)')
+        self.session.prepare_transaction('prepare_timestamp=' + self.timestamp_str(20))
+        self.session.timestamp_transaction('commit_timestamp=' + self.timestamp_str(25))
+        self.session.timestamp_transaction('durable_timestamp=' + self.timestamp_str(35))
+        self.session.commit_transaction()
+
+        # Check setting a prepared transaction timestamps earlier than the
+        # *oldest* timestamp is also accepted with roundup_timestamps settings.
         self.session.begin_transaction('roundup_timestamps=(prepared=true)')
         self.session.prepare_transaction('prepare_timestamp=' + self.timestamp_str(10))
         self.session.timestamp_transaction('commit_timestamp=' + self.timestamp_str(15))
@@ -74,11 +83,11 @@ class test_prepare06(wttest.WiredTigerTestCase, suite_subprocess):
         Commented out for now: the system panics if we fail after preparing a transaction.
 
         # Check setting a prepared transaction timestamps earlier than the
-        # oldest timestamp is invalid, if durable timestamp is less than the
-        # stable timestamp.
+        # stable timestamp is invalid even with roundup_timestamps, if the
+        # durable timestamp is less than the stable timestamp.
         self.session.begin_transaction('roundup_timestamps=(prepared=true)')
-        self.session.prepare_transaction('prepare_timestamp=' + self.timestamp_str(10))
-        self.session.timestamp_transaction('commit_timestamp=' + self.timestamp_str(15))
+        self.session.prepare_transaction('prepare_timestamp=' + self.timestamp_str(20))
+        self.session.timestamp_transaction('commit_timestamp=' + self.timestamp_str(25))
         self.assertRaisesWithMessage(wiredtiger.WiredTigerError,
             lambda: self.session.timestamp_transaction(
             'durable_timestamp=' + self.timestamp_str(25)),
diff --git a/src/third_party/wiredtiger/test/suite/test_prepare16.py b/src/third_party/wiredtiger/test/suite/test_prepare16.py
index 975bbfb9c4e..ff0b8d8f80f 100644
--- a/src/third_party/wiredtiger/test/suite/test_prepare16.py
+++ b/src/third_party/wiredtiger/test/suite/test_prepare16.py
@@ -90,7 +90,7 @@ class test_prepare16(wttest.WiredTigerTestCase):
 
         cursor.reset()
         cursor.close()
-        self.session.prepare_transaction('prepare_timestamp=' + self.timestamp_str(10))
+        self.session.prepare_transaction('prepare_timestamp=' + self.timestamp_str(11))
 
         s = self.conn.open_session()
         s.begin_transaction('ignore_prepare = true')
diff --git a/src/third_party/wiredtiger/test/suite/test_prepare20.py b/src/third_party/wiredtiger/test/suite/test_prepare20.py
new file mode 100644
index 00000000000..0b541d40730
--- /dev/null
+++ b/src/third_party/wiredtiger/test/suite/test_prepare20.py
@@ -0,0 +1,303 @@
+#!/usr/bin/env python
+#
+# Public Domain 2014-present MongoDB, Inc.
+# Public Domain 2008-2014 WiredTiger, Inc.
+#
+# This is free and unencumbered software released into the public domain.
+#
+# Anyone is free to copy, modify, publish, use, compile, sell, or
+# distribute this software, either in source code form or as a compiled
+# binary, for any purpose, commercial or non-commercial, and by any
+# means.
+#
+# In jurisdictions that recognize copyright laws, the author or authors
+# of this software dedicate any and all copyright interest in the
+# software to the public domain. We make this dedication for the benefit
+# of the public at large and to the detriment of our heirs and
+# successors. We intend this dedication to be an overt act of
+# relinquishment in perpetuity of all present and future rights to this
+# software under copyright law.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+# IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+# OTHER DEALINGS IN THE SOFTWARE.
+
+
+# test_prepare19.py
+# Check that we can use an application-level log to replay unstable transactions.
+
+import wiredtiger, wttest
+from wtscenario import make_scenarios
+from helper import simulate_crash_restart
+
+class test_prepare19(wttest.WiredTigerTestCase):
+    # Do write the logs immediately, but don't waste time fsyncing them.
+    conn_config = 'log=(enabled),transaction_sync=(enabled=true,method=none)'
+
+    format_values = [
+        ('integer-row', dict(key_format='i', usestrings=True, value_format='S')),
+        ('column', dict(key_format='r', usestrings=False, value_format='S')),
+        ('column-fix', dict(key_format='r', usestrings=False, value_format='8t')),
+    ]
+    ckpt_values = [
+        ('none', dict(first_ckpt=None, second_ckpt=None)),
+        ('1-21', dict(first_ckpt=21, second_ckpt=None)),
+        ('1-23', dict(first_ckpt=23, second_ckpt=None)),
+        ('1-26', dict(first_ckpt=26, second_ckpt=None)),
+        ('2-21', dict(first_ckpt=None, second_ckpt=21)),
+        ('2-23', dict(first_ckpt=None, second_ckpt=23)),
+        ('2-26', dict(first_ckpt=None, second_ckpt=26)),
+        ('2-31', dict(first_ckpt=None, second_ckpt=31)),
+        ('2-33', dict(first_ckpt=None, second_ckpt=33)),
+        ('2-36', dict(first_ckpt=None, second_ckpt=36)),
+    ]
+    commit_values = [
+        ('commit', dict(commit_before_crash=True)),
+        ('nocommit', dict(commit_before_crash=False)),
+    ]
+    scenarios = make_scenarios(format_values, ckpt_values, commit_values)
+
+    # Application-level log infrastructure. This is real simpleminded and not
+    # expected to do very much other than make sure the basic premise works.
+
+    nullvalue = None
+
+    # Some operation codes for the application log.
+    BEGIN=1
+    WRITE=2
+    PREPARETIME=3
+    PREPARE=4
+    COMMITTIME=5
+    DURABLETIME=6
+    COMMIT=7
+
+    lsession = None
+    lcursor = None
+    lsn = 1
+    txnid = 1
+
+    log_replays = 0
+
+    def log_open(self, log_uri):
+        self.lsession = self.conn.open_session()
+        self.lcursor = self.lsession.open_cursor(log_uri)
+
+    def log_begin(self):
+        self.session.begin_transaction()
+        self.lsession.begin_transaction()
+        self.lcursor[self.lsn] = (self.BEGIN, self.txnid, self.nullvalue, self.nullvalue)
+        self.lsn += 1
+
+    def log_write(self, dcursor, k, newv):
+        oldv = dcursor[k]
+        self.lcursor[self.lsn] = (self.WRITE, k, oldv, newv)
+        self.lsn += 1
+        dcursor[k] = newv
+
+    def log_prepare(self, prepare_ts):
+        self.lcursor[self.lsn] = (self.PREPARETIME, prepare_ts, self.nullvalue, self.nullvalue)
+        self.lsn += 1
+        self.lsession.commit_transaction()
+        self.session.prepare_transaction('prepare_timestamp=' + self.timestamp_str(prepare_ts))
+        self.lsession.begin_transaction()
+        self.lcursor[self.lsn] = (self.PREPARE, self.txnid, self.nullvalue, self.nullvalue)
+        self.lsn += 1
+        self.lsession.commit_transaction()
+
+    def log_precommit(self, commit_ts, durable_ts):
+        self.lsession.begin_transaction()
+        self.lcursor[self.lsn] = (self.COMMITTIME, commit_ts, self.nullvalue, self.nullvalue)
+        self.lsn += 1
+        self.lcursor[self.lsn] = (self.DURABLETIME, durable_ts, self.nullvalue, self.nullvalue)
+        self.lsn += 1
+        self.lsession.commit_transaction()
+
+    def log_commit(self, commit_ts, durable_ts):
+        self.session.commit_transaction('commit_timestamp=' + self.timestamp_str(commit_ts) +
+            ',durable_timestamp=' + self.timestamp_str(durable_ts))
+        self.lsession.begin_transaction()
+        self.lcursor[self.lsn] = (self.COMMIT, self.txnid, self.nullvalue, self.nullvalue)
+        self.lsn += 1
+        self.lsession.commit_transaction()
+        self.txnid += 1
+
+    def log_replay(self, dcursor):
+        stabletime = int('0x' + self.conn.query_timestamp('get=stable_timestamp'), 16)
+        #self.prout("stable {}".format(stabletime))
+        # First pass: find prepared txns. Ignore (thus abort) any that didn't even prepare.
+        txns = {}
+        self.lcursor.reset()
+        for lsn, op, k, oldv, newv in self.lcursor:
+            if op == self.BEGIN:
+                # "key" is the txnid
+                txns[k] = False
+            elif op == self.PREPARE or op == self.COMMIT:
+                # "key" is the txnid
+                txns[k] = True
+        # Second pass: replay values from non-aborted txns.
+        self.lcursor.reset()
+        writing = False
+        committime = None
+        durabletime = None
+        for lsn, op, k, oldv, newv in self.lcursor:
+            if op == self.BEGIN:
+                # "key" is the txnid
+                if txns[k]:
+                    self.session.begin_transaction('roundup_timestamps=(prepared=true)')
+                    writing = True
+                    #self.prout("begin {}".format(k))
+                else:
+                    writing = False
+            elif op == self.WRITE:
+                if writing and dcursor[k] == oldv:
+                    dcursor[k] = newv
+                    self.log_replays += 1
+                    #self.prout("write {} {}".format(k, str(newv)[0:2]))
+            elif op == self.PREPARETIME:
+                if writing:
+                    preparetime = k
+                    #self.prout("preparetime {}".format(k))
+            elif op == self.PREPARE:
+                if writing:
+                    self.session.prepare_transaction(
+                        'prepare_timestamp=' + self.timestamp_str(preparetime))
+                    #self.prout("prepare {}".format(k))
+            elif op == self.COMMITTIME:
+                if writing:
+                    committime = k
+                    #self.prout("committime {}".format(k))
+            elif op == self.DURABLETIME:
+                if writing:
+                    durabletime = k
+                    if durabletime <= stabletime:
+                        durabletime = stabletime + 1
+                    #self.prout("durabletime {} -> {}".format(k, durabletime))
+            elif op == self.COMMIT:
+                if writing:
+                    self.session.commit_transaction(
+                        'commit_timestamp=' + self.timestamp_str(committime) +
+                        ',durable_timestamp=' + self.timestamp_str(durabletime))
+                    #self.prout("commit {}".format(k))
+                writing = False
+                committime = None
+                durabletime = None
+            else:
+                self.assertTrue(False)
+        # If we have a prepared and uncommitted transaction, commit it.
+        # (Note that we don't handle the case where we write values and don't finish preparing.)
+        if committime is not None and durabletime is not None:
+            self.assertTrue(writing)
+            self.session.commit_transaction(
+                'commit_timestamp=' + self.timestamp_str(committime) +
+                ',durable_timestamp=' + self.timestamp_str(durabletime))
+            #self.prout("final commit")
+
+    # Now the test.
+
+    def test_prepare19(self):
+        data_uri = 'file:prepare19data'
+        log_uri = 'file:prepare19log'
+
+        # Create one table for data and another to be an application-level log.
+        # The log's format is application-lsn -> operation, key, oldvalue, newvalue
+
+        self.session.create(data_uri, 'log=(enabled=false),key_format={},value_format={}'.format(
+            self.key_format, self.value_format))
+
+        self.session.create(log_uri, 'key_format=r,value_format=ii{}{}'.format(
+            self.value_format, self.value_format))
+
+        nrows = 1000
+        if self.value_format == '8t':
+            value_a = 97
+            value_b = 98
+            value_c = 99
+            self.nullvalue = 255
+        else:
+            value_a = 'aaaaa' * 100
+            value_b = 'bbbbb' * 100
+            value_c = 'ccccc' * 100
+            self.nullvalue = ''
+
+        dcursor = self.session.open_cursor(data_uri)
+
+        # Write some baseline data first and make it stable.
+        self.session.begin_transaction()
+        for i in range(1, nrows + 1):
+            dcursor[i] = value_a
+        self.session.commit_transaction('commit_timestamp=' + self.timestamp_str(10))
+        self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(10))
+        self.conn.set_timestamp('oldest_timestamp=' + self.timestamp_str(10))
+        self.session.checkpoint()
+
+        self.log_open(log_uri)
+
+        # Write and log a transaction.
+        self.log_begin()
+        for i in range(1, nrows + 1):
+            self.log_write(dcursor, i, value_b)
+        self.log_prepare(20)
+        self.log_precommit(22, 25)
+        self.log_commit(22, 25)
+
+        # Optionally checkpoint here.
+        if self.first_ckpt is not None:
+            self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(self.first_ckpt))
+            self.session.checkpoint()
+
+        # Write and log another transaction.
+        self.log_begin()
+        for i in range(1, nrows + 1):
+            self.log_write(dcursor, i, value_c)
+        self.log_prepare(30)
+
+        # Optionally commit now.
+        self.log_precommit(32, 35)
+        if self.commit_before_crash:
+            self.log_commit(32, 35)
+
+        # Optionally checkpoint here.
+        if self.second_ckpt is not None:
+            self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(self.second_ckpt))
+            # Use the log session to checkpoint: checkpointing from the main session
+            # will fail if we just prepared without committing.
+            self.lsession.checkpoint()
+
+        # Now crash.
+        simulate_crash_restart(self, ".", "RESTART")
+        dcursor = self.session.open_cursor(data_uri)
+        self.log_open(log_uri)
+
+        # Replay the application log.
+        self.log_replay(dcursor)
+
+        # Make everything stable.
+        self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(100))
+        self.session.checkpoint()
+
+        # We should now see all the data.
+        self.session.begin_transaction('read_timestamp=' + self.timestamp_str(15))
+        for i in range(1, nrows + 1):
+            self.assertEqual(dcursor[i], value_a)
+        self.session.rollback_transaction()
+        self.session.begin_transaction('read_timestamp=' + self.timestamp_str(25))
+        for i in range(1, nrows + 1):
+            self.assertEqual(dcursor[i], value_b)
+        self.session.rollback_transaction()
+        self.session.begin_transaction('read_timestamp=' + self.timestamp_str(35))
+        for i in range(1, nrows + 1):
+            self.assertEqual(dcursor[i], value_c)
+        self.session.rollback_transaction()
+
+        # Assert we replayed the right number of writes from the application log.
+        ckpt = self.first_ckpt if self.second_ckpt is None else self.second_ckpt
+        if ckpt is None or ckpt < 25:
+            self.assertEqual(self.log_replays, nrows * 2)
+        elif ckpt < 35 or not self.commit_before_crash:
+            self.assertEqual(self.log_replays, nrows)
+        else:
+            self.assertEqual(self.log_replays, 0)
diff --git a/src/third_party/wiredtiger/test/suite/test_rollback_to_stable11.py b/src/third_party/wiredtiger/test/suite/test_rollback_to_stable11.py
index 0ebd1513194..8362688c1bc 100755
--- a/src/third_party/wiredtiger/test/suite/test_rollback_to_stable11.py
+++ b/src/third_party/wiredtiger/test/suite/test_rollback_to_stable11.py
@@ -85,9 +85,11 @@ class test_rollback_to_stable11(test_rollback_to_stable_base):
         # Verify data is visible and correct.
         self.check(value_b, uri, nrows, None, 20)
 
-        # Pin stable to timestamp 30 if prepare otherwise 20.
+        # Pin stable to timestamp 28 if prepare otherwise 20.
+        # large_updates() prepares at 1 before the timestamp passed (so 29)
+        # and this is required to be strictly greater than (not >=) stable.
         if self.prepare:
-            self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(30))
+            self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(28))
         else:
             self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(20))
 
diff --git a/src/third_party/wiredtiger/test/suite/test_rollback_to_stable12.py b/src/third_party/wiredtiger/test/suite/test_rollback_to_stable12.py
index 1fb3809605d..3eb56b574c6 100755
--- a/src/third_party/wiredtiger/test/suite/test_rollback_to_stable12.py
+++ b/src/third_party/wiredtiger/test/suite/test_rollback_to_stable12.py
@@ -85,9 +85,11 @@ class test_rollback_to_stable12(test_rollback_to_stable_base):
         # Verify data is visible and correct.
         self.check(value_a, uri, nrows, None, 20)
 
-        # Pin stable to timestamp 30 if prepare otherwise 20.
+        # Pin stable to timestamp 28 if prepare otherwise 20.
+        # We prepare at commit_ts - 1 (so 29) and this is required to be strictly
+        # greater than (not >=) stable.
         if self.prepare:
-            self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(30))
+            self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(28))
         else:
             self.conn.set_timestamp('stable_timestamp=' + self.timestamp_str(20))
 
diff --git a/src/third_party/wiredtiger/test/suite/test_timestamp22.py b/src/third_party/wiredtiger/test/suite/test_timestamp22.py
index 90223277191..16ac84b727c 100755
--- a/src/third_party/wiredtiger/test/suite/test_timestamp22.py
+++ b/src/third_party/wiredtiger/test/suite/test_timestamp22.py
@@ -225,7 +225,7 @@ class test_timestamp22(wttest.WiredTigerTestCase):
         if do_prepare:
             if commit_ts < prepare_ts:
                 ok_commit = False
-            if prepare_ts < self.oldest_ts:
+            if prepare_ts <= self.stable_ts:
                 ok_prepare = False
 
         # If the final commit is too old, we'll fail.