Try to reset quota database which is suspected to be corrupted

storage/browser/quota/quota_database.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "storage/browser/quota/quota_database.h"
 
 #include <vector>
 
 #include "base/auto_reset.h"
 #include "base/bind.h"
@@ skipping 435 matching lines @@
   meta_table_.reset(new sql::MetaTable);
 
   db_->set_histogram_tag("Quota");
 
   bool opened = false;
   if (in_memory_only) {
     opened = db_->OpenInMemory();
   } else if (!base::CreateDirectory(db_file_path_.DirName())) {
       LOG(ERROR) << "Failed to create quota database directory.";
   } else {
     opened = db_->Open(db_file_path_);

[michaeln, 2015/07/23 19:54:18]

It looks like the DLOG(FATAL) happens inside of the Open method but 'true' is
returned since the result of PRAGMA journal_mode is ignored.

     if (opened)
       db_->Preload();
   }
 
   if (!opened || !EnsureDatabaseVersion()) {

[michaeln, 2015/07/23 19:54:18]

It looks like there are other ways in which a borken db file could get be
forever borken? I'd vote to move the retry logic higher up in the stack to catch
more of those ways. For example, if open fails due to outright corruption
noticed upon open, we probably should retry in that case too.

Take a look at appcache_database.cc and its unittests for an example of  more
aggresive retry logic.

  if (!opened || !db_->QuickIntegrityCheck() || !EnsureDatabaseVersion())
    ... delete and retry if not using an in-memory db ...

     LOG(ERROR) << "Failed to open the quota database.";
     is_disabled_ = true;
     db_.reset();
     meta_table_.reset();
     return false;
   }
 
   // Start a long-running transaction.
   db_->BeginTransaction();
 
   return true;
 }
 
 bool QuotaDatabase::EnsureDatabaseVersion() {
   static const size_t kTableCount = arraysize(kTables);
   static const size_t kIndexCount = arraysize(kIndexes);
-  if (!sql::MetaTable::DoesTableExist(db_.get()))
-    return CreateSchema(db_.get(), meta_table_.get(),
+  if (!sql::MetaTable::DoesTableExist(db_.get())) {
+    if (CreateSchema(db_.get(), meta_table_.get(),
                         kCurrentVersion, kCompatibleVersion,
                         kTables, kTableCount,
-                        kIndexes, kIndexCount);
+                        kIndexes, kIndexCount))
+      return true;
+
+    LOG(ERROR) << "Failed to create schema: probably database is currupted.";
+    return ResetSchema();

[michaeln, 2015/07/23 19:54:18]

I was wondering how this fixed a crash? Its not really a crash in release
builds. A corrupt DB runs afoul a DLOG(FATAL) statement when being opened and
crashes debug builds.

A new unittest quota_database_unittest.cc would be good. That file is in
content\browser\quota. The crashing in debug builds behavior can probably be
avoided with a ScopedErrorIgnorer. CorruptSizeInHeader() can help create corrupt
dbs.

+  }
 
   if (!meta_table_->Init(db_.get(), kCurrentVersion, kCompatibleVersion))
     return false;
 
   if (meta_table_->GetCompatibleVersionNumber() > kCurrentVersion) {
     LOG(WARNING) << "Quota database is too new.";
     return false;
   }
 
   if (meta_table_->GetVersionNumber() < kCurrentVersion) {
@@ skipping 152 matching lines @@
   if (lhs.origin < rhs.origin) return true;
   if (rhs.origin < lhs.origin) return false;
   if (lhs.type < rhs.type) return true;
   if (rhs.type < lhs.type) return false;
   if (lhs.used_count < rhs.used_count) return true;
   if (rhs.used_count < lhs.used_count) return false;
   return lhs.last_access_time < rhs.last_access_time;
 }
 
 }  // namespace storage