Delete the cookie DB when an unrecoverable error is detected.

chrome/browser/net/sqlite_persistent_cookie_store.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/net/sqlite_persistent_cookie_store.h"
 
 #include <list>
 #include <map>
 #include <set>
 #include <utility>
@@ skipping 14 matching lines @@
 #include "base/time.h"
 #include "chrome/browser/diagnostics/sqlite_diagnostics.h"
 #include "chrome/browser/net/clear_on_exit_policy.h"
 #include "content/public/browser/browser_thread.h"
 #include "googleurl/src/gurl.h"
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
 #include "net/cookies/canonical_cookie.h"
 #include "sql/meta_table.h"
 #include "sql/statement.h"
 #include "sql/transaction.h"
+#include "third_party/sqlite/sqlite3.h"
 
 using base::Time;
 using content::BrowserThread;
 
 // This class is designed to be shared between any calling threads and the
 // database thread. It batches operations and commits them on a timer.
 //
 // SQLitePersistentCookieStore::Load is called to load all cookies.  It
 // delegates to Backend::Load, which posts a Backend::LoadAndNotifyOnDBThread
 // task to the DB thread.  This task calls Backend::ChainLoadCookies(), which
@@ skipping 22 matching lines @@
       : path_(path),
         db_(NULL),
         num_pending_(0),
         force_keep_session_state_(false),
         initialized_(false),
         restore_old_session_cookies_(restore_old_session_cookies),
         clear_on_exit_policy_(clear_on_exit_policy),
         num_cookies_read_(0),
         num_priority_waiting_(0),
         total_priority_requests_(0) {
+    error_delegate_ =
+      new KillDatabaseErrorDelegate(this, GetErrorHandlerForCookieDb());
   }
 
   // Creates or loads the SQLite database.
   void Load(const LoadedCallback& loaded_callback);
 
   // Loads cookies for the domain key (eTLD+1).
   void LoadCookiesForKey(const std::string& domain,
       const LoadedCallback& loaded_callback);
 
   // Batch a cookie addition.
@@ skipping 10 matching lines @@
 
   // Commit any pending operations and close the database.  This must be called
   // before the object is destructed.
   void Close();
 
   void SetForceKeepSessionState();
 
  private:
   friend class base::RefCountedThreadSafe<SQLitePersistentCookieStore::Backend>;
 
+  class KillDatabaseErrorDelegate : public sql::ErrorDelegate {
+   public:
+    KillDatabaseErrorDelegate(Backend* backend,
+                              sql::ErrorDelegate* wrapped_delegate);
+    // ErrorDelegate implementation.
+    virtual int OnError(int error,
+                        sql::Connection* connection,
+                        sql::Statement* stmt) OVERRIDE;
+
+    void reset_backend() {
+      backend_ = NULL;
+    }
+
+   private:
+    // Do not increment the count on Backend, as that would create a circular
+    // reference (Backend -> Connection -> ErrorDelegate -> Backend). Instead,
+    // Backend will call reset_backend() when it is going away.
+    Backend* backend_;
+    scoped_refptr<sql::ErrorDelegate> wrapped_delegate_;
+
+    DISALLOW_COPY_AND_ASSIGN(KillDatabaseErrorDelegate);
+  };
+
   // You should call Close() before destructing this object.
   ~Backend() {
     DCHECK(!db_.get()) << "Close should have already been called.";
     DCHECK(num_pending_ == 0 && pending_.empty());
   }
 
   // Database upgrade statements.
   bool EnsureDatabaseVersion();
 
   class PendingOperation {
@@ skipping 65 matching lines @@
                       const net::CanonicalCookie& cc);
   // Commit our pending operations to the database.
   void Commit();
   // Close() executed on the background thread.
   void InternalBackgroundClose();
 
   void DeleteSessionCookiesOnStartup();
 
   void DeleteSessionCookiesOnShutdown();
 
+  void KillDatabase();
+
   FilePath path_;
   scoped_ptr<sql::Connection> db_;
+  scoped_refptr<KillDatabaseErrorDelegate> error_delegate_;
   sql::MetaTable meta_table_;
 
   typedef std::list<PendingOperation*> PendingOperationsList;
   PendingOperationsList pending_;
   PendingOperationsList::size_type num_pending_;
   // True if the persistent store should skip delete on exit rules.
   bool force_keep_session_state_;
   // Guard |cookies_|, |pending_|, |num_pending_|, |force_keep_session_state_|
   base::Lock lock_;
 
@@ skipping 36 matching lines @@
   int total_priority_requests_;
   // The time when |num_priority_waiting_| incremented to 1.
   base::Time current_priority_wait_start_;
   // The cumulative duration of time when |num_priority_waiting_| was greater
   // than 1.
   base::TimeDelta priority_wait_duration_;
 
   DISALLOW_COPY_AND_ASSIGN(Backend);
 };
 
+SQLitePersistentCookieStore::Backend::KillDatabaseErrorDelegate::
+KillDatabaseErrorDelegate(Backend* backend,
+                          sql::ErrorDelegate* wrapped_delegate)
+    : backend_(backend),
+      wrapped_delegate_(wrapped_delegate) {
+}
+
+int SQLitePersistentCookieStore::Backend::KillDatabaseErrorDelegate::OnError(
+    int error, sql::Connection* connection, sql::Statement* stmt) {
+  if (wrapped_delegate_.get())
+    error = wrapped_delegate_->OnError(error, connection, stmt);
+
+  bool delete_db = false;
+
+  switch (error) {
+    case SQLITE_DONE:
+    case SQLITE_OK:
+      // Theoretically, the wrapped delegate might have resolved the error, and
+      // we would end up here.
+      break;
+
+    case SQLITE_CORRUPT:
+    case SQLITE_NOTADB:
+      // Highly unlikely we would ever recover from these.
+      delete_db = true;
+      break;
+
+    case SQLITE_CANTOPEN:
+      // TODO(erikwright): Figure out what this means.
+      break;
+
+    case SQLITE_IOERR:
+      // This could be broken blocks, in which case deleting the DB would be a
+      // good idea. But it might also be transient.
+      // TODO(erikwright): Figure out if we can distinguish between the two,
+      // or determine through metrics analysis to what extent these failures are
+      // transient.
+      break;
+
+    case SQLITE_BUSY:
+      // Presumably transient.
+      break;
+
+    case SQLITE_TOOBIG:
+    case SQLITE_FULL:
+    case SQLITE_NOMEM:
+      // Not a problem with the database.
+      break;
+
+    case SQLITE_READONLY:
+      // Presumably either transient or we don't have the privileges to
+      // move/delete the file anyway.
+      break;
+
+    case SQLITE_CONSTRAINT:
+    case SQLITE_ERROR:
+      // These probably indicate a programming error or a migration failure that
+      // we prefer not to mask.
+      break;
+
+    case SQLITE_LOCKED:
+    case SQLITE_INTERNAL:
+    case SQLITE_PERM:
+    case SQLITE_ABORT:
+    case SQLITE_INTERRUPT:
+    case SQLITE_NOTFOUND:
+    case SQLITE_PROTOCOL:
+    case SQLITE_EMPTY:
+    case SQLITE_SCHEMA:
+    case SQLITE_MISMATCH:
+    case SQLITE_MISUSE:
+    case SQLITE_NOLFS:
+    case SQLITE_AUTH:
+    case SQLITE_FORMAT:
+    case SQLITE_RANGE:
+    case SQLITE_ROW:
+      // None of these appear in error reports, so for now let's not try to
+      // guess at how to handle them.
+      break;
+  }
+
+  if (delete_db && backend_) {
+    // Don't just do the close/delete here, as we are being called by |db| and
+    // that seems dangerous.
+    MessageLoop::current()->PostTask(
+        FROM_HERE, base::Bind(&Backend::KillDatabase, backend_));
+
+    // Avoid being called more than once. There should still be a reference to
+    // this ErrorDelegate in the backend, but just in case don't refer to any
+    // members from here forward.
+    connection->set_error_delegate(wrapped_delegate_.get());
+  }
+
+  return error;
+}
+
 // Version number of the database.
 //
 // Version 5 adds the columns has_expires and is_persistent, so that the
 // database can store session cookies as well as persistent cookies. Databases
 // of version 5 are incompatible with older versions of code. If a database of
 // version 5 is read by older code, session cookies will be treated as normal
 // cookies. Currently, these fields are written, but not read anymore.
 //
 // In version 4, we migrated the time epoch.  If you open the DB with an older
 // version on Mac or Linux, the times will look wonky, but the file will likely
@@ skipping 227 matching lines @@
     return false;
   }
 
   int64 db_size = 0;
   if (file_util::GetFileSize(path_, &db_size)) {
     base::ThreadRestrictions::ScopedAllowIO allow_io;
     UMA_HISTOGRAM_COUNTS("Cookie.DBSizeInKB", db_size / 1024 );
   }
 
   db_.reset(new sql::Connection);
+  db_->set_error_delegate(error_delegate_.get());
+
   if (!db_->Open(path_)) {
     NOTREACHED() << "Unable to open cookie DB.";
     db_.reset();
     return false;
   }
 
-  db_->set_error_delegate(GetErrorHandlerForCookieDb());
-
   if (!EnsureDatabaseVersion() || !InitTable(db_.get())) {
     NOTREACHED() << "Unable to open cookie DB.";
     db_.reset();
     return false;
   }
 
   UMA_HISTOGRAM_CUSTOM_TIMES(
     "Cookie.TimeInitializeDB",
     base::Time::Now() - start,
     base::TimeDelta::FromMilliseconds(1), base::TimeDelta::FromMinutes(1),
@@ skipping 403 matching lines @@
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::DB));
   // Commit any pending operations
   Commit();
 
   if (!force_keep_session_state_ && clear_on_exit_policy_.get() &&
       clear_on_exit_policy_->HasClearOnExitOrigins()) {
     DeleteSessionCookiesOnShutdown();
   }
 
   db_.reset();
+  if (error_delegate_.get()) {
+    error_delegate_->reset_backend();
+    error_delegate_ = NULL;
+  }
 }
 
 void SQLitePersistentCookieStore::Backend::DeleteSessionCookiesOnShutdown() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::DB));
 
   if (!db_.get())
     return;
 
   sql::Statement del_smt(db_->GetCachedStatement(
       SQL_FROM_HERE, "DELETE FROM cookies WHERE host_key=? AND secure=?"));
@@ skipping 23 matching lines @@
     del_smt.BindString(0, it->first.first);
     del_smt.BindInt(1, it->first.second);
     if (!del_smt.Run())
       NOTREACHED() << "Could not delete a cookie from the DB.";
   }
 
   if (!transaction.Commit())
     LOG(WARNING) << "Unable to delete cookies on shutdown.";
 }
 
+void SQLitePersistentCookieStore::Backend::KillDatabase() {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::DB));
+
+  if (db_.get()) {
+    // This Backend will now be in-memory only. In a future run we will recreate
+    // the database. Hopefully things go better then!
+    bool success = db_->Raze();
+    UMA_HISTOGRAM_BOOLEAN("Cookie.KillDatabaseResult", success);
+    db_->Close();
+    db_.reset();
+  }

[Scott Hess - ex-Googler, 2012/09/14 18:34:03]

Would it be worthwhile to document the no-db_ case?

Think about whether there will be additional related events to track, also.  I
usually just go directly to an enum histogram, because after the first version
rolls out and solves the 90% case, I find that I need additional data to figure
out what's up with the 10% case.

+}
+
 void SQLitePersistentCookieStore::Backend::SetForceKeepSessionState() {
   base::AutoLock locked(lock_);
   force_keep_session_state_ = true;
 }
 
 void SQLitePersistentCookieStore::Backend::DeleteSessionCookiesOnStartup() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::DB));
   if (!db_->Execute("DELETE FROM cookies WHERE persistent == 0"))
     LOG(WARNING) << "Unable to delete session cookies.";
 }
@@ skipping 45 matching lines @@
 }
 
 SQLitePersistentCookieStore::~SQLitePersistentCookieStore() {
   if (backend_.get()) {
     backend_->Close();
     // Release our reference, it will probably still have a reference if the
     // background thread has not run Close() yet.
     backend_ = NULL;
   }
 }