It's reduced to a flag which means we stop processing the module.  We have
to enhance our dependencies a bit, but they've always been quite good.

This simplifies things quite a bit.

Parsing options like --verbose and --debug can be a pain.  You need to
have everything set up before invoking parse_args(), but that may be a
significant amount of work, for which you may want verbose or
debugging enabled.

Thus the concept of "early" args: you can nominate arguments to be
parse before anything else, using opt_early_parse().

Make a false return abort the iteration, not true.

The old way makes sense for search functions (true == I found it), but
other kinds of iteration are more common (brute force search is
probably dumb).

strset_set -> strset_add
strset_clear -> strset_del
strset_test -> strset_get
strset_destroy -> strset_clear

Testing code still using it.

With the type canary, it's unnecessary.  Though the implementation is
a bit more awkward since they longer map directly through to list_top/tail.

Just like container_of() (with typechecking, etc), but return the offset
to the enclosing structure.

This means we know they're there in future, and what restrictions they
carry.

This allows even more extensibility in future: in particular, the top
bits of each capability tell us what to do if we don't understand it:
fail the open, fail to open for write, or don't try to check the
format.

tdb_check needs to understand the capability list so it can know to
skip over it: each element in the list is prefixed with the type tag
and the length.

Neater API.

This will be used shortly to indicate that a TDB2 file indicates it
cannot be checked.

The current mix of writing to an fd doesn't mix as well with
stderr/stdout.  And writing to a FILE * is more portable.

This gives a much deeper insight into what failtest is doing; good for
debugging failtest itself.

We currently save all files in the parent, and restore them once
the child is gone.  That doesn't work in a case where the child
manipulates a file the parent doesn't currently have open, so
switch to a model where the child cleans itself up, using the
already-existing cleanup callbacks.

This means that we need to undo much more, especially restoring
file offsets.  We also need to handle the case where we've already
closed the file, and now we're cleaning up.  As a bonus, we now
handle open() with O_TRUNC properly.

The cleanup function now has two modes: one simply frees (so valgrind
doesn't complain about failtest leaking so the user can see real leaks
in their programs), the other restores things so the parent sees no
changes.

The argument is wrong, so the return was -1.  That currently works,
but it will beak with the next patch.  Fix the typo.

And separate out the code which follows --failpath so failtest_close()
can use it too.

It was the wrong way around, and also it's better to show the whole
remaining failpath rather than the current letter.

Don't continue when we report a leak: tell the parent it's a failure.

Now we test failing mmap, ccanlint -v time has increased from 200 to
330 seconds.  Worse, tests no time out on my laptop.

Fix this, by preventing us from going down that particular rabbit hole.
ccanlint -v now takes 201 seconds again.

mmap can also fail on out-of-memory, and for the coming change to the
way we save and restore files we want to know about them anyway.

failtest now culls duplicates for itself (and more efficiently), so
don't replicate the logic here.  It changes things a bit, because
failtest uses backtraces rather than a simple call point to find
duplicates.

Also, fix one case (in run-11-simple-fetch.c) where we simply exited
rather than using failtest_exit().  We got away with it before, because
we never hit that particular failure pattern.

Calling failpath_string() here leaves the final letter randomly upper or
lower-cased, since call->fail is uninitialized.  This means we sometimes
don't match the debug string.

1) Initialize call->fail here so it will match the debug string.
2) If our calls don't match --debugpath, abort.
3) Don't match the final letter (which may be upper or lower case) 
   when checking we're still on the path.  We could do better, but this is
   only a sanity-check anyway.

If we can get a backtrace, we can automatically eliminate identical
failures.  Surprisingly backtrace() is quite fast, but the savings for
the (naively-written) rbtree tests are impressive.  ccanlint -v time
drops from 43 seconds to 6 seconds.

When a failtest_hook returns fail_probe(), we start a counter to
continue for a little way.  Replace this hack with a simple flag,
which disables further failures.

Interestingly, this doesn't reduce coverage on the current modules
which use failtest.

This is useful for debugging failtest itself, as well as for things
like tracing.

We use file descriptors inside failtest; use dup2 to try to avoid
changing the file descriptor numbers used in the program (particularly
when programs mess with invalid file descriptors, they're likely to
still be invalid).

This avoids a silly realloc, but more importantly it gets us closer to
being runtime extensible, as each history element can be a different
size.

Less cut & paste means less patching as failtest changes.

failtest_malloc should use p->u.malloc not p->u.calloc.  The layouts
are identical, so it doesn't matter, but it's confusing and leaves us
open to weird bugs in future should one change.

This depends on reduce_features; currently it tends to run before
that, so it doesn't think there are any features to reduce and doesn't
build or run the tests with reduced features.

Saves me doing it manually.