[sqlite] Pull out recent recover.c changes into new patch.

third_party/sqlite/patches/0005-Virtual-table-supporting-recovery-of-corrupted-datab.patch

-From 29b8ad9263dbc700c002e9044c7c712a566a26d7 Mon Sep 17 00:00:00 2001
+From 31dd2fd1cdeba87223f6a46cc19bcea9eb8b2f38 Mon Sep 17 00:00:00 2001
 From: Scott Hess <shess@chromium.org>
 Date: Sat, 20 Jul 2013 11:42:21 -0700
-Subject: [PATCH 05/10] Virtual table supporting recovery of corrupted
+Subject: [PATCH 05/13] Virtual table supporting recovery of corrupted
  databases.
 
 "recover" implements a virtual table which uses the SQLite pager layer
 to read table pages and pull out the data which is structurally sound
 (at least at the storage layer).
 
 BUG=109482
 
 Since this implements a new feature for SQLite, the review URLs aren't
 listed.  This patch and the top of recover.c should be considered
 authoritative.  The history is mostly under
 third_party/sqlite/src/src/{recover,recover-alt}.c .
 ---
  third_party/sqlite/src/Makefile.in         |    1 +
  third_party/sqlite/src/Makefile.linux-gcc  |    4 +
  third_party/sqlite/src/main.mk             |    5 +-
  third_party/sqlite/src/src/main.c          |    8 +
- third_party/sqlite/src/src/recover.c       | 2167 ++++++++++++++++++++++++++++
+ third_party/sqlite/src/src/recover.c       | 2281 ++++++++++++++++++++++++++++
  third_party/sqlite/src/src/sqlite.h.in     |   16 +
- third_party/sqlite/src/test/recover.test   |  147 ++
+ third_party/sqlite/src/test/recover.test   |  164 ++
  third_party/sqlite/src/test/recover0.test  |  532 +++++++
  third_party/sqlite/src/test/recover1.test  |  429 ++++++
  third_party/sqlite/src/test/recover2.test  |  157 ++
  third_party/sqlite/src/tool/mksqlite3c.tcl |    2 +
- 11 files changed, 3467 insertions(+), 1 deletion(-)
+ 11 files changed, 3598 insertions(+), 1 deletion(-)
  create mode 100644 third_party/sqlite/src/src/recover.c
  create mode 100644 third_party/sqlite/src/test/recover.test
  create mode 100644 third_party/sqlite/src/test/recover0.test
  create mode 100644 third_party/sqlite/src/test/recover1.test
  create mode 100644 third_party/sqlite/src/test/recover2.test
 
 diff --git a/third_party/sqlite/src/Makefile.in b/third_party/sqlite/src/Makefile.in
 index 1fe49d6..8b965c7 100644
 --- a/third_party/sqlite/src/Makefile.in
 +++ b/third_party/sqlite/src/Makefile.in
@@ skipping 64 matching lines @@
 +  if( !db->mallocFailed && rc==SQLITE_OK ){
 +    rc = recoverVtableInit(db);
 +  }
 +#endif
 +
  #ifdef SQLITE_ENABLE_ICU
    if( !db->mallocFailed && rc==SQLITE_OK ){
      rc = sqlite3IcuInit(db);
 diff --git a/third_party/sqlite/src/src/recover.c b/third_party/sqlite/src/src/recover.c
 new file mode 100644
-index 0000000..8e3929d
+index 0000000..5ff6f78
 --- /dev/null
 +++ b/third_party/sqlite/src/src/recover.c
-@@ -0,0 +1,2167 @@
+@@ -0,0 +1,2281 @@
 +/*
 +** 2012 Jan 11
 +**
 +** The author disclaims copyright to this source code.  In place of
 +** a legal notice, here is a blessing:
 +**
 +**    May you do good and not evil.
 +**    May you find forgiveness for yourself and forgive others.
 +**    May you share freely, never taking more than you give.
 +*/
@@ skipping 219 matching lines @@
 +#define FNENTRY() fprintf(stderr, "In %s\n", __FUNCTION__)
 +#else
 +#define FNENTRY()
 +#endif
 +
 +/* Generic constants and helper functions. */
 +
 +static const unsigned char kTableLeafPage = 0x0D;
 +static const unsigned char kTableInteriorPage = 0x05;
 +
++/* From section 1.2. */
++static const unsigned kiHeaderPageSizeOffset = 16;
++static const unsigned kiHeaderReservedSizeOffset = 20;
++static const unsigned kiHeaderEncodingOffset = 56;
++/* TODO(shess) |static const unsigned| fails creating the header in GetPager()
++** because |knHeaderSize| isn't |constexpr|.  But this isn't C++, either.
++*/
++enum { knHeaderSize = 100};
++
 +/* From section 1.5. */
 +static const unsigned kiPageTypeOffset = 0;
 +static const unsigned kiPageFreeBlockOffset = 1;
 +static const unsigned kiPageCellCountOffset = 3;
 +static const unsigned kiPageCellContentOffset = 5;
 +static const unsigned kiPageFragmentedBytesOffset = 7;
 +static const unsigned knPageLeafHeaderBytes = 8;
 +/* Interior pages contain an additional field. */
 +static const unsigned kiPageRightChildOffset = 8;
 +static const unsigned kiPageInteriorHeaderBytes = 12;
@@ skipping 113 matching lines @@
 +  }
 +  return n ? ascii_tolower(*us1)-ascii_tolower(*us2) : 0;
 +}
 +static int ascii_strcasecmp(const char *s1, const char *s2){
 +  /* If s2 is equal through strlen(s1), will exit while() due to s1's
 +   * trailing NUL, and return NUL-s2[strlen(s1)].
 +   */
 +  return ascii_strncasecmp(s1, s2, strlen(s1)+1);
 +}
 +
++/* Provide access to the pages of a SQLite database in a way similar to SQLite's
++** Pager.
++*/
++typedef struct RecoverPager RecoverPager;
++struct RecoverPager {
++  sqlite3_file *pSqliteFile;      /* Reference to database's file handle */
++  u32 nPageSize;                  /* Size of pages in pSqliteFile */
++};
++
++static void pagerDestroy(RecoverPager *pPager){
++  pPager->pSqliteFile->pMethods->xUnlock(pPager->pSqliteFile, SQLITE_LOCK_NONE);
++  memset(pPager, 0xA5, sizeof(*pPager));
++  sqlite3_free(pPager);
++}
++
++/* pSqliteFile should already have a SHARED lock. */
++static int pagerCreate(sqlite3_file *pSqliteFile, u32 nPageSize,
++                       RecoverPager **ppPager){
++  RecoverPager *pPager = sqlite3_malloc(sizeof(RecoverPager));
++  if( !pPager ){
++    return SQLITE_NOMEM;
++  }
++
++  memset(pPager, 0, sizeof(*pPager));
++  pPager->pSqliteFile = pSqliteFile;
++  pPager->nPageSize = nPageSize;
++  *ppPager = pPager;
++  return SQLITE_OK;
++}
++
++/* Matches DbPage (aka PgHdr) from SQLite internals. */
++/* TODO(shess): SQLite by default allocates page metadata in a single allocation
++** such that the page's data and metadata are contiguous, see pcache1AllocPage
++** in pcache1.c.  I believe this was intended to reduce malloc churn.  It means
++** that Chromium's automated tooling would be unlikely to see page-buffer
++** overruns.  I believe that this code is safe, but for now replicate SQLite's
++** approach with kExcessSpace.
++*/
++const int kExcessSpace = 128;
++typedef struct RecoverPage RecoverPage;
++struct RecoverPage {
++  Pgno pgno;                     /* Page number for this page */
++  void *pData;                   /* Page data for pgno */
++  RecoverPager *pPager;          /* The pager this page is part of */
++};
++
++static void pageDestroy(RecoverPage *pPage){
++  sqlite3_free(pPage->pData);
++  memset(pPage, 0xA5, sizeof(*pPage));
++  sqlite3_free(pPage);
++}
++
++static int pageCreate(RecoverPager *pPager, u32 pgno, RecoverPage **ppPage){
++  RecoverPage *pPage = sqlite3_malloc(sizeof(RecoverPage));
++  if( !pPage ){
++    return SQLITE_NOMEM;
++  }
++
++  memset(pPage, 0, sizeof(*pPage));
++  pPage->pPager = pPager;
++  pPage->pgno = pgno;
++  pPage->pData = sqlite3_malloc(pPager->nPageSize + kExcessSpace);
++  if( pPage->pData==NULL ){
++    pageDestroy(pPage);
++    return SQLITE_NOMEM;
++  }
++  memset((u8 *)pPage->pData + pPager->nPageSize, 0, kExcessSpace);
++
++  *ppPage = pPage;
++  return SQLITE_OK;
++}
++
++static int pagerGetPage(RecoverPager *pPager, u32 iPage, RecoverPage **ppPage) {
++  sqlite3_int64 iOfst;
++  sqlite3_file *pFile = pPager->pSqliteFile;
++  RecoverPage *pPage;
++  int rc = pageCreate(pPager, iPage, &pPage);
++  if( rc!=SQLITE_OK ){
++    return rc;
++  }
++
++  /* xRead() can return SQLITE_IOERR_SHORT_READ, which should be treated as
++  ** SQLITE_OK plus an EOF indicator.  The excess space is zero-filled.
++  */
++  iOfst = ((sqlite3_int64)iPage - 1) * pPager->nPageSize;
++  rc = pFile->pMethods->xRead(pFile, pPage->pData, pPager->nPageSize, iOfst);
++  if( rc!=SQLITE_OK && rc!=SQLITE_IOERR_SHORT_READ ){
++    pageDestroy(pPage);
++    return rc;
++  }
++
++  *ppPage = pPage;
++  return SQLITE_OK;
++}
++
 +/* For some reason I kept making mistakes with offset calculations. */
-+static const unsigned char *PageData(DbPage *pPage, unsigned iOffset){
-+  assert( iOffset<=pPage->nPageSize );
++static const unsigned char *PageData(RecoverPage *pPage, unsigned iOffset){
++  assert( iOffset<=pPage->pPager->nPageSize );
 +  return (unsigned char *)pPage->pData + iOffset;
 +}
 +
 +/* The first page in the file contains a file header in the first 100
 + * bytes.  The page's header information comes after that.  Note that
 + * the offsets in the page's header information are relative to the
 + * beginning of the page, NOT the end of the page header.
 + */
-+static const unsigned char *PageHeader(DbPage *pPage){
++static const unsigned char *PageHeader(RecoverPage *pPage){
 +  if( pPage->pgno==1 ){
-+    const unsigned nDatabaseHeader = 100;
-+    return PageData(pPage, nDatabaseHeader);
++    return PageData(pPage, knHeaderSize);
 +  }else{
 +    return PageData(pPage, 0);
 +  }
 +}
 +
 +/* Helper to fetch the pager and page size for the named database. */
 +static int GetPager(sqlite3 *db, const char *zName,
-+                    Pager **pPager, unsigned *pnPageSize){
-+  Btree *pBt = NULL;
-+  int i;
-+  for( i=0; i<db->nDb; ++i ){
-+    if( ascii_strcasecmp(db->aDb[i].zName, zName)==0 ){
-+      pBt = db->aDb[i].pBt;
-+      break;
-+    }
-+  }
-+  if( !pBt ){
-+    return SQLITE_ERROR;
++                    RecoverPager **ppPager, unsigned *pnPageSize,
++                    int *piEncoding){
++  int rc, iEncoding;
++  unsigned nPageSize, nReservedSize;
++  unsigned char header[knHeaderSize];
++  sqlite3_file *pFile = NULL;
++  RecoverPager *pPager;
++
++  rc = sqlite3_file_control(db, zName, SQLITE_FCNTL_FILE_POINTER, &pFile);
++  if( rc!=SQLITE_OK ) {
++    return rc;
++  } else if( pFile==NULL ){
++    /* The documentation for sqlite3PagerFile() indicates it can return NULL if
++    ** the file has not yet been opened.  That should not be possible here...
++    */
++    return SQLITE_MISUSE;
 +  }
 +
-+  *pPager = sqlite3BtreePager(pBt);
-+  *pnPageSize =
-+      sqlite3BtreeGetPageSize(pBt) - sqlite3BtreeGetOptimalReserve(pBt);
++  /* Get a shared lock to make sure the on-disk version of the file is truth. */
++  rc = pFile->pMethods->xLock(pFile, SQLITE_LOCK_SHARED);
++  if( rc != SQLITE_OK ){
++    return rc;
++  }
++
++  /* Read the Initial header information.  In case of SQLITE_IOERR_SHORT_READ,
++  ** the header is incomplete, which means no data could be recovered anyhow.
++  */
++  rc = pFile->pMethods->xRead(pFile, header, sizeof(header), 0);
++  if( rc != SQLITE_OK ){
++    pFile->pMethods->xUnlock(pFile, SQLITE_LOCK_NONE);
++    if( rc==SQLITE_IOERR_SHORT_READ ){
++      return SQLITE_CORRUPT;
++    }
++    return rc;
++  }
++
++  /* Page size must be a power of two between 512 and 32768 inclusive. */
++  nPageSize = decodeUnsigned16(header + kiHeaderPageSizeOffset);
++  if( (nPageSize&(nPageSize-1)) || nPageSize>32768 || nPageSize<512 ){
++    pFile->pMethods->xUnlock(pFile, SQLITE_LOCK_NONE);
++    return rc;
++  }
++
++  /* Space reserved a the end of the page for extensions.  Usually 0. */
++  nReservedSize = header[kiHeaderReservedSizeOffset];
++
++  /* 1 for UTF-8, 2 for UTF-16le, 3 for UTF-16be. */
++  iEncoding = decodeUnsigned32(header + kiHeaderEncodingOffset);
++  if( iEncoding==3 ){
++    *piEncoding = SQLITE_UTF16BE;
++  } else if( iEncoding==2 ){
++    *piEncoding = SQLITE_UTF16LE;
++  } else if( iEncoding==1 ){
++    *piEncoding = SQLITE_UTF8;
++  } else {
++    /* This case should not be possible. */
++    *piEncoding = SQLITE_UTF8;
++  }
++
++  rc = pagerCreate(pFile, nPageSize, &pPager);
++  if( rc!=SQLITE_OK ){
++    pFile->pMethods->xUnlock(pFile, SQLITE_LOCK_NONE);
++    return rc;
++  }
++
++  *ppPager = pPager;
++  *pnPageSize = nPageSize - nReservedSize;
++  *piEncoding = iEncoding;
 +  return SQLITE_OK;
 +}
 +
 +/* iSerialType is a type read from a record header.  See "2.1 Record Format".
 + */
 +
 +/* Storage size of iSerialType in bytes.  My interpretation of SQLite
 + * documentation is that text and blob fields can have 32-bit length.
 + * Values past 2^31-12 will need more than 32 bits to encode, which is
 + * why iSerialType is u64.
 + */
 +static u32 SerialTypeLength(u64 iSerialType){
 +  switch( iSerialType ){
 +    case 0 : return 0;  /* NULL */
 +    case 1 : return 1;  /* Various integers. */
 +    case 2 : return 2;
 +    case 3 : return 3;
 +    case 4 : return 4;
 +    case 5 : return 6;
 +    case 6 : return 8;
 +    case 7 : return 8;  /* 64-bit float. */
 +    case 8 : return 0;  /* Constant 0. */
 +    case 9 : return 0;  /* Constant 1. */
-+    case 10 : case 11 : assert( !"RESERVED TYPE"); return 0;
++    case 10 : case 11 : assert( "RESERVED TYPE"==NULL ); return 0;
 +  }
 +  return (u32)((iSerialType>>1) - 6);
 +}
 +
 +/* True if iSerialType refers to a blob. */
 +static int SerialTypeIsBlob(u64 iSerialType){
 +  assert( iSerialType>=12 );
 +  return (iSerialType%2)==0;
 +}
 +
 +/* Returns true if the serialized type represented by iSerialType is
 + * compatible with the given type mask.
 + */
 +static int SerialTypeIsCompatible(u64 iSerialType, unsigned char mask){
 +  switch( iSerialType ){
 +    case 0  : return (mask&MASK_NULL)!=0;
 +    case 1  : return (mask&MASK_INTEGER)!=0;
 +    case 2  : return (mask&MASK_INTEGER)!=0;
 +    case 3  : return (mask&MASK_INTEGER)!=0;
 +    case 4  : return (mask&MASK_INTEGER)!=0;
 +    case 5  : return (mask&MASK_INTEGER)!=0;
 +    case 6  : return (mask&MASK_INTEGER)!=0;
 +    case 7  : return (mask&MASK_FLOAT)!=0;
 +    case 8  : return (mask&MASK_INTEGER)!=0;
 +    case 9  : return (mask&MASK_INTEGER)!=0;
-+    case 10 : assert( !"RESERVED TYPE"); return 0;
-+    case 11 : assert( !"RESERVED TYPE"); return 0;
++    case 10 : assert( "RESERVED TYPE"==NULL ); return 0;
++    case 11 : assert( "RESERVED TYPE"==NULL ); return 0;
 +  }
 +  return (mask&(SerialTypeIsBlob(iSerialType) ? MASK_BLOB : MASK_TEXT));
 +}
 +
 +/* Versions of strdup() with return values appropriate for
 + * sqlite3_free().  malloc.c has sqlite3DbStrDup()/NDup(), but those
 + * need sqlite3DbFree(), which seems intrusive.
 + */
 +static char *sqlite3_strndup(const char *z, unsigned n){
 +  char *zNew;
@@ skipping 55 matching lines @@
 +    if( rc==SQLITE_DONE ){
 +      rc = SQLITE_OK;
 +    }else if( rc==SQLITE_ROW ){
 +      rc = SQLITE_CORRUPT;
 +    }
 +  }
 +  sqlite3_finalize(pStmt);
 +  return rc;
 +}
 +
-+static int getEncoding(sqlite3 *db, const char *zDb, int* piEncoding){
-+  sqlite3_stmt *pStmt;
-+  int rc;
-+  char *zSql = sqlite3_mprintf("PRAGMA %s.encoding", zDb);
-+  if( !zSql ){
-+    return SQLITE_NOMEM;
-+  }
-+
-+  rc = sqlite3_prepare_v2(db, zSql, -1, &pStmt, 0);
-+  sqlite3_free(zSql);
-+  if( rc!=SQLITE_OK ){
-+    return rc;
-+  }
-+
-+  /* Require a result. */
-+  rc = sqlite3_step(pStmt);
-+  if( rc==SQLITE_DONE ){
-+    /* This case should not be possible. */
-+    rc = SQLITE_CORRUPT;
-+  }else if( rc==SQLITE_ROW ){
-+    if( sqlite3_column_type(pStmt, 0)==SQLITE_TEXT ){
-+      const char* z = (const char *)sqlite3_column_text(pStmt, 0);
-+      /* These strings match the literals in pragma.c. */
-+      if( !strcmp(z, "UTF-16le") ){
-+        *piEncoding = SQLITE_UTF16LE;
-+      }else if( !strcmp(z, "UTF-16be") ){
-+        *piEncoding = SQLITE_UTF16BE;
-+      }else if( !strcmp(z, "UTF-8") ){
-+        *piEncoding = SQLITE_UTF8;
-+      }else{
-+        /* This case should not be possible. */
-+        *piEncoding = SQLITE_UTF8;
-+      }
-+    }else{
-+      /* This case should not be possible. */
-+      *piEncoding = SQLITE_UTF8;
-+    }
-+
-+    /* Require only one result. */
-+    rc = sqlite3_step(pStmt);
-+    if( rc==SQLITE_DONE ){
-+      rc = SQLITE_OK;
-+    }else if( rc==SQLITE_ROW ){
-+      /* This case should not be possible. */
-+      rc = SQLITE_CORRUPT;
-+    }
-+  }
-+  sqlite3_finalize(pStmt);
-+  return rc;
-+}
-+
 +/* Cursor for iterating interior nodes.  Interior page cells contain a
 + * child page number and a rowid.  The child page contains items left
 + * of the rowid (less than).  The rightmost page of the subtree is
 + * stored in the page header.
 + *
 + * interiorCursorDestroy - release all resources associated with the
 + *                         cursor and any parent cursors.
 + * interiorCursorCreate - create a cursor with the given parent and page.
 + * interiorCursorEOF - returns true if neither the cursor nor the
 + *                     parent cursors can return any more data.
@@ skipping 15 matching lines @@
 + * preventing duplication.
 + *
 + * Note that interiorCursorEOF() could return false (not at EOF), and
 + * interiorCursorNextPage() could still return SQLITE_DONE.  This
 + * could happen if there are more cells to iterate in an interior
 + * page, but those cells refer to invalid pages.
 + */
 +typedef struct RecoverInteriorCursor RecoverInteriorCursor;
 +struct RecoverInteriorCursor {
 +  RecoverInteriorCursor *pParent; /* Parent node to this node. */
-+  DbPage *pPage;                  /* Reference to leaf page. */
++  RecoverPage *pPage;             /* Reference to leaf page. */
 +  unsigned nPageSize;             /* Size of page. */
 +  unsigned nChildren;             /* Number of children on the page. */
 +  unsigned iChild;                /* Index of next child to return. */
 +};
 +
 +static void interiorCursorDestroy(RecoverInteriorCursor *pCursor){
 +  /* Destroy all the cursors to the root. */
 +  while( pCursor ){
 +    RecoverInteriorCursor *p = pCursor;
 +    pCursor = pCursor->pParent;
 +
 +    if( p->pPage ){
-+      sqlite3PagerUnref(p->pPage);
++      pageDestroy(p->pPage);
 +      p->pPage = NULL;
 +    }
 +
 +    memset(p, 0xA5, sizeof(*p));
 +    sqlite3_free(p);
 +  }
 +}
 +
 +/* Internal helper.  Reset storage in preparation for iterating pPage. */
 +static void interiorCursorSetPage(RecoverInteriorCursor *pCursor,
-+                                  DbPage *pPage){
++                                  RecoverPage *pPage){
 +  const unsigned knMinCellLength = 2 + 4 + 1;
 +  unsigned nMaxChildren;
 +  assert( PageHeader(pPage)[kiPageTypeOffset]==kTableInteriorPage );
 +
 +  if( pCursor->pPage ){
-+    sqlite3PagerUnref(pCursor->pPage);
++    pageDestroy(pCursor->pPage);
 +    pCursor->pPage = NULL;
 +  }
 +  pCursor->pPage = pPage;
 +  pCursor->iChild = 0;
 +
 +  /* A child for each cell, plus one in the header. */
 +  pCursor->nChildren = decodeUnsigned16(PageHeader(pPage) +
 +                                        kiPageCellCountOffset) + 1;
 +
 +  /* Each child requires a 16-bit offset from an array after the header,
@@ skipping 10 matching lines @@
 +   * a very large database.
 +   */
 +  nMaxChildren =
 +      (pCursor->nPageSize - kiPageInteriorHeaderBytes) / knMinCellLength + 1;
 +  if (pCursor->nChildren > nMaxChildren) {
 +    pCursor->nChildren = nMaxChildren;
 +  }
 +}
 +
 +static int interiorCursorCreate(RecoverInteriorCursor *pParent,
-+                                DbPage *pPage, int nPageSize,
++                                RecoverPage *pPage, int nPageSize,
 +                                RecoverInteriorCursor **ppCursor){
 +  RecoverInteriorCursor *pCursor =
 +    sqlite3_malloc(sizeof(RecoverInteriorCursor));
 +  if( !pCursor ){
 +    return SQLITE_NOMEM;
 +  }
 +
 +  memset(pCursor, 0, sizeof(*pCursor));
 +  pCursor->pParent = pParent;
 +  pCursor->nPageSize = nPageSize;
@@ skipping 64 matching lines @@
 + * updated to point to the parent cursor (this cursor is freed).
 + */
 +/* TODO(shess): I've tried to avoid recursion in most of this code,
 + * but this case is more challenging because the recursive call is in
 + * the middle of operation.  One option for converting it without
 + * adding memory management would be to retain the head pointer and
 + * use a helper to "back up" as needed.  Another option would be to
 + * reverse the list during traversal.
 + */
 +static int interiorCursorNextPage(RecoverInteriorCursor **ppCursor,
-+                                  DbPage **ppPage){
++                                  RecoverPage **ppPage){
 +  RecoverInteriorCursor *pCursor = *ppCursor;
 +  while( 1 ){
 +    int rc;
 +    const unsigned char *pPageHeader;  /* Header of found page. */
 +
 +    /* Find a valid child page which isn't on the stack. */
 +    while( pCursor->iChild<pCursor->nChildren ){
 +      const unsigned iPage = interiorCursorChildPage(pCursor);
 +      pCursor->iChild++;
 +      if( interiorCursorPageInUse(pCursor, iPage) ){
 +        fprintf(stderr, "Loop detected at %d\n", iPage);
 +      }else{
-+        int rc = sqlite3PagerGet(pCursor->pPage->pPager, iPage, ppPage, 0);
++        int rc = pagerGetPage(pCursor->pPage->pPager, iPage, ppPage);
 +        if( rc==SQLITE_OK ){
 +          return SQLITE_ROW;
 +        }
 +      }
 +    }
 +
 +    /* This page has no more children.  Get next page from parent. */
 +    if( !pCursor->pParent ){
 +      return SQLITE_DONE;
 +    }
@@ skipping 33 matching lines @@
 + * overflowMaybeCreate - create the overflow structure if it is needed
 + *                       to represent the given record.  See function comment.
 + * overflowGetSegment - fetch a segment from the record, accounting
 + *                      for overflow pages.  Segments which are not
 + *                      entirely contained with a page are constructed
 + *                      into a buffer which is returned.  See function comment.
 + */
 +typedef struct RecoverOverflow RecoverOverflow;
 +struct RecoverOverflow {
 +  RecoverOverflow *pNextOverflow;
-+  DbPage *pPage;
++  RecoverPage *pPage;
 +  unsigned nPageSize;
 +};
 +
 +static void overflowDestroy(RecoverOverflow *pOverflow){
 +  while( pOverflow ){
 +    RecoverOverflow *p = pOverflow;
 +    pOverflow = p->pNextOverflow;
 +
 +    if( p->pPage ){
-+      sqlite3PagerUnref(p->pPage);
++      pageDestroy(p->pPage);
 +      p->pPage = NULL;
 +    }
 +
 +    memset(p, 0xA5, sizeof(*p));
 +    sqlite3_free(p);
 +  }
 +}
 +
 +/* Internal helper.  Used to detect if iPage would cause a loop. */
 +static int overflowPageInUse(RecoverOverflow *pOverflow, unsigned iPage){
 +  while( pOverflow && pOverflow->pPage->pgno!=iPage ){
 +    pOverflow = pOverflow->pNextOverflow;
 +  }
 +  return pOverflow!=NULL;
 +}
 +
 +/* Setup to access an nRecordBytes record beginning at iRecordOffset
 + * in pPage.  If nRecordBytes can be satisfied entirely from pPage,
 + * then no overflow pages are needed an *pnLocalRecordBytes is set to
 + * nRecordBytes.  Otherwise, *ppOverflow is set to the head of a list
 + * of overflow pages, and *pnLocalRecordBytes is set to the number of
 + * bytes local to pPage.
 + *
 + * overflowGetSegment() will do the right thing regardless of whether
 + * those values are set to be in-page or not.
 + */
-+static int overflowMaybeCreate(DbPage *pPage, unsigned nPageSize,
++static int overflowMaybeCreate(RecoverPage *pPage, unsigned nPageSize,
 +                               unsigned iRecordOffset, unsigned nRecordBytes,
 +                               unsigned *pnLocalRecordBytes,
 +                               RecoverOverflow **ppOverflow){
 +  unsigned nLocalRecordBytes;  /* Record bytes in the leaf page. */
 +  unsigned iNextPage;          /* Next page number for record data. */
 +  unsigned nBytes;             /* Maximum record bytes as of current page. */
 +  int rc;
 +  RecoverOverflow *pFirstOverflow;  /* First in linked list of pages. */
 +  RecoverOverflow *pLastOverflow;   /* End of linked list. */
 +
@@ skipping 32 matching lines @@
 +  nBytes = nLocalRecordBytes;
 +
 +  /* While there are more pages to read, and more bytes are needed,
 +   * get another page.
 +   */
 +  pFirstOverflow = pLastOverflow = NULL;
 +  rc = SQLITE_OK;
 +  while( iNextPage && nBytes<nRecordBytes ){
 +    RecoverOverflow *pOverflow;  /* New overflow page for the list. */
 +
-+    rc = sqlite3PagerGet(pPage->pPager, iNextPage, &pPage, 0);
++    rc = pagerGetPage(pPage->pPager, iNextPage, &pPage);
 +    if( rc!=SQLITE_OK ){
 +      break;
 +    }
 +
 +    pOverflow = sqlite3_malloc(sizeof(RecoverOverflow));
 +    if( !pOverflow ){
-+      sqlite3PagerUnref(pPage);
++      pageDestroy(pPage);
 +      rc = SQLITE_NOMEM;
 +      break;
 +    }
 +    memset(pOverflow, 0, sizeof(*pOverflow));
 +    pOverflow->pPage = pPage;
 +    pOverflow->nPageSize = nPageSize;
 +
 +    if( !pFirstOverflow ){
 +      pFirstOverflow = pOverflow;
 +    }else{
@@ skipping 43 matching lines @@
 + * sqlite3_malloc() is returned with the data.  *pbFree is set true if
 + * sqlite3_free() should be called on *ppBase.
 + */
 +/* Operation of this function is subtle.  At any time, pPage is the
 + * current page, with iRecordOffset and nLocalRecordBytes being record
 + * data within pPage, and pOverflow being the overflow page after
 + * pPage.  This allows the code to handle both the initial leaf page
 + * and overflow pages consistently by adjusting the values
 + * appropriately.
 + */
-+static int overflowGetSegment(DbPage *pPage, unsigned iRecordOffset,
++static int overflowGetSegment(RecoverPage *pPage, unsigned iRecordOffset,
 +                              unsigned nLocalRecordBytes,
 +                              RecoverOverflow *pOverflow,
 +                              unsigned iRequestOffset, unsigned nRequestBytes,
 +                              unsigned char **ppBase, int *pbFree){
 +  unsigned nBase;         /* Amount of data currently collected. */
 +  unsigned char *pBase;   /* Buffer to collect record data into. */
 +
 +  /* Skip to the page containing the start of the data. */
 +  while( iRequestOffset>=nLocalRecordBytes && pOverflow ){
 +    /* Factor out current page's contribution. */
@@ skipping 86 matching lines @@
 + * impossible offsets, or where header data doesn't correctly describe
 + * payload data.  Returns SQLITE_ROW if a valid cell is found,
 + * SQLITE_DONE if all pages in the tree were exhausted.
 + *
 + * leafCursorCellColInfo() accounts for overflow pages in the style of
 + * overflowGetSegment().
 + */
 +typedef struct RecoverLeafCursor RecoverLeafCursor;
 +struct RecoverLeafCursor {
 +  RecoverInteriorCursor *pParent;  /* Parent node to this node. */
-+  DbPage *pPage;                   /* Reference to leaf page. */
++  RecoverPager *pPager;            /* Page provider. */
++  RecoverPage *pPage;              /* Current leaf page. */
 +  unsigned nPageSize;              /* Size of pPage. */
 +  unsigned nCells;                 /* Number of cells in pPage. */
 +  unsigned iCell;                  /* Current cell. */
 +
 +  /* Info parsed from data in iCell. */
 +  i64 iRowid;                      /* rowid parsed. */
 +  unsigned nRecordCols;            /* how many items in the record. */
 +  u64 iRecordOffset;               /* offset to record data. */
 +  /* TODO(shess): nRecordBytes and nRecordHeaderBytes are used in
 +   * leafCursorCellColInfo() to prevent buffer overruns.
@@ skipping 14 matching lines @@
 + *
 + * If pPage is an interior page, a new parent cursor is created and
 + * injected on the stack.  This is necessary to handle trees with
 + * uneven depth, but also is used during initial setup.
 + *
 + * If pPage is not a table page at all, it is discarded.
 + *
 + * If SQLITE_OK is returned, the caller no longer owns pPage,
 + * otherwise the caller is responsible for discarding it.
 + */
-+static int leafCursorLoadPage(RecoverLeafCursor *pCursor, DbPage *pPage){
++static int leafCursorLoadPage(RecoverLeafCursor *pCursor, RecoverPage *pPage){
 +  const unsigned char *pPageHeader;  /* Header of *pPage */
++  unsigned nCells;                   /* Number of cells in the page */
 +
 +  /* Release the current page. */
 +  if( pCursor->pPage ){
-+    sqlite3PagerUnref(pCursor->pPage);
++    pageDestroy(pCursor->pPage);
 +    pCursor->pPage = NULL;
 +    pCursor->iCell = pCursor->nCells = 0;
 +  }
 +
 +  /* If the page is an unexpected interior node, inject a new stack
 +   * layer and try again from there.
 +   */
 +  pPageHeader = PageHeader(pPage);
 +  if( pPageHeader[kiPageTypeOffset]==kTableInteriorPage ){
 +    RecoverInteriorCursor *pParent;
 +    int rc = interiorCursorCreate(pCursor->pParent, pPage, pCursor->nPageSize,
 +                                  &pParent);
 +    if( rc!=SQLITE_OK ){
 +      return rc;
 +    }
 +    pCursor->pParent = pParent;
 +    return SQLITE_OK;
 +  }
 +
 +  /* Not a leaf page, skip it. */
 +  if( pPageHeader[kiPageTypeOffset]!=kTableLeafPage ){
-+    sqlite3PagerUnref(pPage);
++    pageDestroy(pPage);
++    return SQLITE_OK;
++  }
++
++  /* Leaf contains no data, skip it.  Empty tables, for instance. */
++  nCells = decodeUnsigned16(pPageHeader + kiPageCellCountOffset);;
++  if( nCells<1 ){
++    pageDestroy(pPage);
 +    return SQLITE_OK;
 +  }
 +
 +  /* Take ownership of the page and start decoding. */
 +  pCursor->pPage = pPage;
 +  pCursor->iCell = 0;
-+  pCursor->nCells = decodeUnsigned16(pPageHeader + kiPageCellCountOffset);
++  pCursor->nCells = nCells;
 +  return SQLITE_OK;
 +}
 +
 +/* Get the next leaf-level page in the tree.  Returns SQLITE_ROW when
 + * a leaf page is found, SQLITE_DONE when no more leaves exist, or any
 + * error which occurred.
 + */
 +static int leafCursorNextPage(RecoverLeafCursor *pCursor){
 +  if( !pCursor->pParent ){
 +    return SQLITE_DONE;
 +  }
 +
 +  /* Repeatedly load the parent's next child page until a leaf is found. */
 +  do {
-+    DbPage *pNextPage;
++    RecoverPage *pNextPage;
 +    int rc = interiorCursorNextPage(&pCursor->pParent, &pNextPage);
 +    if( rc!=SQLITE_ROW ){
 +      assert( rc==SQLITE_DONE );
 +      return rc;
 +    }
 +
 +    rc = leafCursorLoadPage(pCursor, pNextPage);
 +    if( rc!=SQLITE_OK ){
-+      sqlite3PagerUnref(pNextPage);
++      pageDestroy(pNextPage);
 +      return rc;
 +    }
 +  } while( !pCursor->pPage );
 +
 +  return SQLITE_ROW;
 +}
 +
 +static void leafCursorDestroyCellData(RecoverLeafCursor *pCursor){
 +  if( pCursor->bFreeRecordHeader ){
 +    sqlite3_free(pCursor->pRecordHeader);
 +  }
 +  pCursor->bFreeRecordHeader = 0;
 +  pCursor->pRecordHeader = NULL;
 +
 +  if( pCursor->pOverflow ){
 +    overflowDestroy(pCursor->pOverflow);
 +    pCursor->pOverflow = NULL;
 +  }
 +}
 +
 +static void leafCursorDestroy(RecoverLeafCursor *pCursor){
 +  leafCursorDestroyCellData(pCursor);
 +
 +  if( pCursor->pParent ){
 +    interiorCursorDestroy(pCursor->pParent);
 +    pCursor->pParent = NULL;
 +  }
 +
 +  if( pCursor->pPage ){
-+    sqlite3PagerUnref(pCursor->pPage);
++    pageDestroy(pCursor->pPage);
 +    pCursor->pPage = NULL;
 +  }
 +
++  if( pCursor->pPager ){
++    pagerDestroy(pCursor->pPager);
++    pCursor->pPager = NULL;
++  }
++
 +  memset(pCursor, 0xA5, sizeof(*pCursor));
 +  sqlite3_free(pCursor);
 +}
 +
 +/* Create a cursor to iterate the rows from the leaf pages of a table
 + * rooted at iRootPage.
 + */
 +/* TODO(shess): recoverOpen() calls this to setup the cursor, and I
 + * think that recoverFilter() may make a hard assumption that the
 + * cursor returned will turn up at least one valid cell.
 + *
 + * The cases I can think of which break this assumption are:
 + * - pPage is a valid leaf page with no valid cells.
 + * - pPage is a valid interior page with no valid leaves.
 + * - pPage is a valid interior page who's leaves contain no valid cells.
 + * - pPage is not a valid leaf or interior page.
 + */
-+static int leafCursorCreate(Pager *pPager, unsigned nPageSize,
++static int leafCursorCreate(RecoverPager *pPager, unsigned nPageSize,
 +                            u32 iRootPage, RecoverLeafCursor **ppCursor){
-+  DbPage *pPage;               /* Reference to page at iRootPage. */
++  RecoverPage *pPage;          /* Reference to page at iRootPage. */
 +  RecoverLeafCursor *pCursor;  /* Leaf cursor being constructed. */
 +  int rc;
 +
 +  /* Start out with the root page. */
-+  rc = sqlite3PagerGet(pPager, iRootPage, &pPage, 0);
++  rc = pagerGetPage(pPager, iRootPage, &pPage);
 +  if( rc!=SQLITE_OK ){
 +    return rc;
 +  }
 +
 +  pCursor = sqlite3_malloc(sizeof(RecoverLeafCursor));
 +  if( !pCursor ){
-+    sqlite3PagerUnref(pPage);
++    pageDestroy(pPage);
 +    return SQLITE_NOMEM;
 +  }
 +  memset(pCursor, 0, sizeof(*pCursor));
 +
 +  pCursor->nPageSize = nPageSize;
++  pCursor->pPager = pPager;
 +
 +  rc = leafCursorLoadPage(pCursor, pPage);
 +  if( rc!=SQLITE_OK ){
-+    sqlite3PagerUnref(pPage);
++    pageDestroy(pPage);
 +    leafCursorDestroy(pCursor);
 +    return rc;
 +  }
 +
 +  /* pPage wasn't a leaf page, find the next leaf page. */
 +  if( !pCursor->pPage ){
 +    rc = leafCursorNextPage(pCursor);
 +    if( rc!=SQLITE_DONE && rc!=SQLITE_ROW ){
 +      leafCursorDestroy(pCursor);
 +      return rc;
@@ skipping 322 matching lines @@
 +  RecoverLeafCursor *pLeafCursor;
 +  int iEncoding;
 +  int bEOF;
 +};
 +
 +static int recoverOpen(sqlite3_vtab *pVTab, sqlite3_vtab_cursor **ppCursor){
 +  Recover *pRecover = (Recover*)pVTab;
 +  u32 iRootPage;                   /* Root page of the backing table. */
 +  int iEncoding;                   /* UTF encoding for backing database. */
 +  unsigned nPageSize;              /* Size of pages in backing database. */
-+  Pager *pPager;                   /* Backing database pager. */
++  RecoverPager *pPager;            /* Backing database pager. */
 +  RecoverLeafCursor *pLeafCursor;  /* Cursor to read table's leaf pages. */
 +  RecoverCursor *pCursor;          /* Cursor to read rows from leaves. */
 +  int rc;
 +
 +  FNENTRY();
 +
 +  iRootPage = 0;
 +  rc = getRootPage(pRecover->db, pRecover->zDb, pRecover->zTable,
 +                   &iRootPage);
 +  if( rc!=SQLITE_OK ){
 +    return rc;
 +  }
 +
-+  iEncoding = 0;
-+  rc = getEncoding(pRecover->db, pRecover->zDb, &iEncoding);
-+  if( rc!=SQLITE_OK ){
-+    return rc;
-+  }
-+
-+  rc = GetPager(pRecover->db, pRecover->zDb, &pPager, &nPageSize);
++  rc = GetPager(pRecover->db, pRecover->zDb, &pPager, &nPageSize, &iEncoding);
 +  if( rc!=SQLITE_OK ){
 +    return rc;
 +  }
 +
 +  rc = leafCursorCreate(pPager, nPageSize, iRootPage, &pLeafCursor);
 +  if( rc!=SQLITE_OK ){
++    pagerDestroy(pPager);
 +    return rc;
 +  }
 +
 +  pCursor = sqlite3_malloc(sizeof(RecoverCursor));
 +  if( !pCursor ){
 +    leafCursorDestroy(pLeafCursor);
 +    return SQLITE_NOMEM;
 +  }
 +  memset(pCursor, 0, sizeof(*pCursor));
 +  pCursor->base.pVtab = pVTab;
@@ skipping 536 matching lines @@
 +*/
 +CHROMIUM_SQLITE_API
 +int recoverVtableInit(sqlite3 *db);
 +/* End recover virtual table patch for Chromium */
 +
  /* Begin WebDatabase patch for Chromium */
  /* Expose some SQLite internals for the WebDatabase vfs.
  ** DO NOT EXTEND THE USE OF THIS.
 diff --git a/third_party/sqlite/src/test/recover.test b/third_party/sqlite/src/test/recover.test
 new file mode 100644
-index 0000000..b5aa182
+index 0000000..bfb7888
 --- /dev/null
 +++ b/third_party/sqlite/src/test/recover.test
-@@ -0,0 +1,147 @@
+@@ -0,0 +1,164 @@
 +# 2012 January 11 {}
 +#
 +# The author disclaims copyright to this source code.  In place of
 +# a legal notice, here is a blessing:
 +#
 +#    May you do good and not evil.
 +#    May you find forgiveness for yourself and forgive others.
 +#    May you share freely, never taking more than you give.
 +#
 +#***********************************************************************
@@ skipping 92 matching lines @@
 +    DROP TABLE IF EXISTS temp.leaf_recover;
 +    CREATE VIRTUAL TABLE temp.leaf_recover USING recover(
 +      leaf,
 +      t TEXT,
 +      n INTEGER
 +    );
 +  }
 +  execsql {SELECT t, n FROM leaf_recover ORDER BY rowid}
 +} {{Leaf-node-generating line 0} 0 {Leaf-node-generating line 1} 1 {Leaf-node-generating line 2} 2 {Leaf-node-generating line 3} 3 {Leaf-node-generating line 4} 4 {Leaf-node-generating line 5} 5 {Leaf-node-generating line 6} 6 {Leaf-node-generating line 7} 7 {Leaf-node-generating line 8} 8 {Leaf-node-generating line 9} 9}
 +
++# Empty table gives empty results.
++do_test recover-leaf-2.0 {
++  db close
++  sqlite3 db test.db
++  generate "empty" "Leaf-node-generating line " 0
++
++  db eval {
++    DROP TABLE IF EXISTS temp.leaf_recover;
++    CREATE VIRTUAL TABLE temp.leaf_recover USING recover(
++      empty,
++      t TEXT,
++      n INTEGER
++    );
++  }
++  execsql {SELECT t, n FROM leaf_recover ORDER BY rowid}
++} {}
++
 +# Single level of interior node.
 +do_test recover-interior-1.0 {
 +  db close
 +  sqlite3 db test.db
 +  generate "interior" "Interior-node-generating line " 100
 +
 +  db eval {
 +    DROP TABLE IF EXISTS temp.interior_recover;
 +    CREATE VIRTUAL TABLE temp.interior_recover USING recover(
 +      interior,
@@ skipping 1167 matching lines @@
     notify.c
  
 +   recover.c
 +
     fts3.c
     fts3_aux.c
     fts3_expr.c
 -- 
 2.7.0