[PATCH 1 of 8 V2] phase: filter out non-draft item in "draft root"

[Boris Feld]

# HG changeset patch
# User Boris Feld <boris.feld at octobus.net>
# Date 1507745282 -7200
#      Wed Oct 11 20:08:02 2017 +0200
# Node ID 629de091478a249c97ce410733c8520aaec779f2
# Parent  a652b7763f669683eb5540c6d4b77ee18e55bc80
# EXP-Topic b2.phases.push
# Available At https://bitbucket.org/octobus/mercurial-devel/
#              hg pull https://bitbucket.org/octobus/mercurial-devel/ -r 629de091478a
phase: filter out non-draft item in "draft root"

The on-disk file can contain draft root that are descendants of secret root.
The resulting phase computation is correct, but the phases root content is
not. I will send another series to introduce code that remove some of the
cases where this can happens, but we first need to damage control the existing
case.

After this changeset, we can no longer advertise secret changeset as draft
root.

diff --git a/mercurial/phases.py b/mercurial/phases.py
--- a/mercurial/phases.py
+++ b/mercurial/phases.py
@@ -502,8 +502,10 @@
     # Use ordered dictionary so behavior is deterministic.
     keys = util.sortdict()
     value = '%i' % draft
+    cl = repo.unfiltered().changelog
     for root in repo._phasecache.phaseroots[draft]:
-        keys[hex(root)] = value
+        if repo._phasecache.phase(repo, cl.rev(root)) <= draft:
+            keys[hex(root)] = value
 
     if repo.publishing():
         # Add an extra data to let remote know we are a publishing