[Downloads] Rework how hashes are calculated for download files.

content/browser/download/download_item_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // File method ordering: Methods in this file are in the same order as
 // in download_item_impl.h, with the following exception: The public
 // interface Start is placed in chronological order with the other
 // (private) routines that together define a DownloadItem's state
 // transitions as the download progresses.  See "Download progression
 // cascade" later in this file.
@@ skipping 22 matching lines @@
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
 #include "base/stl_util.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/browser/download/download_create_info.h"
 #include "content/browser/download/download_file.h"
 #include "content/browser/download/download_interrupt_reasons_impl.h"
 #include "content/browser/download/download_item_impl_delegate.h"
+#include "content/browser/download/download_net_log_parameters.h"
 #include "content/browser/download/download_request_handle.h"
 #include "content/browser/download/download_stats.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/download_danger_type.h"
 #include "content/public/browser/download_interrupt_reasons.h"
 #include "content/public/browser/download_url_parameters.h"
@@ skipping 40 matching lines @@
 }
 
 bool IsDownloadResumptionEnabled() {
   return base::FeatureList::IsEnabled(features::kDownloadResumption);
 }
 
 }  // namespace
 
 const uint32_t DownloadItem::kInvalidId = 0;
 
-const char DownloadItem::kEmptyFileHash[] = "";
-
 // The maximum number of attempts we will make to resume automatically.
 const int DownloadItemImpl::kMaxAutoResumeAttempts = 5;
 
 // Constructor for reading from the history service.
 DownloadItemImpl::DownloadItemImpl(DownloadItemImplDelegate* delegate,
                                    const std::string& guid,
                                    uint32_t download_id,
                                    const base::FilePath& current_path,
                                    const base::FilePath& target_path,
                                    const std::vector<GURL>& url_chain,
                                    const GURL& referrer_url,
                                    const std::string& mime_type,
                                    const std::string& original_mime_type,
                                    const base::Time& start_time,
                                    const base::Time& end_time,
                                    const std::string& etag,
                                    const std::string& last_modified,
                                    int64_t received_bytes,
                                    int64_t total_bytes,
+                                   const std::string& hash,
                                    DownloadItem::DownloadState state,
                                    DownloadDangerType danger_type,
                                    DownloadInterruptReason interrupt_reason,
                                    bool opened,
                                    const net::BoundNetLog& bound_net_log)
     : guid_(base::ToUpperASCII(guid)),
       download_id_(download_id),
-      current_path_(current_path),
       target_path_(target_path),
       url_chain_(url_chain),
       referrer_url_(referrer_url),
       mime_type_(mime_type),
       original_mime_type_(original_mime_type),
       total_bytes_(total_bytes),
-      received_bytes_(received_bytes),
-      last_modified_time_(last_modified),
-      etag_(etag),
       last_reason_(interrupt_reason),
       start_tick_(base::TimeTicks()),
       state_(ExternalToInternalState(state)),
       danger_type_(danger_type),
       start_time_(start_time),
       end_time_(end_time),
       delegate_(delegate),
+      opened_(opened),
+      current_path_(current_path),
+      received_bytes_(received_bytes),
       all_data_saved_(state == COMPLETE),
-      opened_(opened),
+      hash_(hash),
+      last_modified_time_(last_modified),
+      etag_(etag),
       bound_net_log_(bound_net_log),
       weak_ptr_factory_(this) {
   delegate_->Attach();
   DCHECK(state_ == COMPLETE_INTERNAL || state_ == INTERRUPTED_INTERNAL ||
          state_ == CANCELLED_INTERNAL);
   DCHECK(base::IsValidGUID(guid_));
   Init(false /* not actively downloading */, SRC_HISTORY_IMPORT);
 }
 
 // Constructing for a regular download:
@@ skipping 12 matching lines @@
       tab_referrer_url_(info.tab_referrer_url),
       suggested_filename_(base::UTF16ToUTF8(info.save_info->suggested_name)),
       forced_file_path_(info.save_info->file_path),
       transition_type_(info.transition_type),
       has_user_gesture_(info.has_user_gesture),
       content_disposition_(info.content_disposition),
       mime_type_(info.mime_type),
       original_mime_type_(info.original_mime_type),
       remote_address_(info.remote_address),
       total_bytes_(info.total_bytes),
-      last_modified_time_(info.last_modified),
-      etag_(info.etag),
       last_reason_(info.result),
       start_tick_(base::TimeTicks::Now()),
       state_(INITIAL_INTERNAL),
       start_time_(info.start_time),
       delegate_(delegate),
       is_temporary_(!info.save_info->file_path.empty()),
+      last_modified_time_(info.last_modified),
+      etag_(info.etag),
       bound_net_log_(bound_net_log),
       weak_ptr_factory_(this) {
   delegate_->Attach();
   Init(true /* actively downloading */, SRC_ACTIVE_DOWNLOAD);
 
   // Link the event sources.
   bound_net_log_.AddEvent(
       net::NetLog::TYPE_DOWNLOAD_URL_REQUEST,
       info.request_bound_net_log.source().ToEventParametersCallback());
 
   info.request_bound_net_log.AddEvent(
       net::NetLog::TYPE_DOWNLOAD_STARTED,
       bound_net_log_.source().ToEventParametersCallback());
 }
 
 // Constructing for the "Save Page As..." feature:
 DownloadItemImpl::DownloadItemImpl(
     DownloadItemImplDelegate* delegate,
     uint32_t download_id,
     const base::FilePath& path,
     const GURL& url,
     const std::string& mime_type,
     scoped_ptr<DownloadRequestHandleInterface> request_handle,
     const net::BoundNetLog& bound_net_log)
     : is_save_package_download_(true),
       request_handle_(std::move(request_handle)),
       guid_(base::ToUpperASCII(base::GenerateGUID())),
       download_id_(download_id),
-      current_path_(path),
       target_path_(path),
       url_chain_(1, url),
       mime_type_(mime_type),
       original_mime_type_(mime_type),
       start_tick_(base::TimeTicks::Now()),
       state_(IN_PROGRESS_INTERNAL),
       start_time_(base::Time::Now()),
       delegate_(delegate),
+      current_path_(path),
       bound_net_log_(bound_net_log),
       weak_ptr_factory_(this) {
   delegate_->Attach();
   Init(true /* actively downloading */, SRC_SAVE_PAGE_AS);
 }
 
 DownloadItemImpl::~DownloadItemImpl() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   // Should always have been nuked before now, at worst in
@@ skipping 134 matching lines @@
 
     case MAX_DOWNLOAD_INTERNAL_STATE:
     case TARGET_RESOLVED_INTERNAL:
       NOTREACHED();
   }
 }
 
 void DownloadItemImpl::Cancel(bool user_cancel) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DVLOG(20) << __FUNCTION__ << "() download = " << DebugString(true);
-  Interrupt(user_cancel ? DOWNLOAD_INTERRUPT_REASON_USER_CANCELED
-                        : DOWNLOAD_INTERRUPT_REASON_USER_SHUTDOWN);
+  InterruptAndDiscardPartialState(
+      user_cancel ? DOWNLOAD_INTERRUPT_REASON_USER_CANCELED
+                  : DOWNLOAD_INTERRUPT_REASON_USER_SHUTDOWN);
   UpdateObservers();
 }
 
 void DownloadItemImpl::Remove() {
   DVLOG(20) << __FUNCTION__ << "() download = " << DebugString(true);
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   delegate_->AssertStateConsistent(this);
-  Interrupt(DOWNLOAD_INTERRUPT_REASON_USER_CANCELED);
+  InterruptAndDiscardPartialState(DOWNLOAD_INTERRUPT_REASON_USER_CANCELED);
   UpdateObservers();
   delegate_->AssertStateConsistent(this);
 
   NotifyRemoved();
   delegate_->DownloadRemoved(this);
   // We have now been deleted.
 }
 
 void DownloadItemImpl::OpenDownload() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ skipping 192 matching lines @@
 }
 
 DownloadItem::TargetDisposition DownloadItemImpl::GetTargetDisposition() const {
   return target_disposition_;
 }
 
 const std::string& DownloadItemImpl::GetHash() const {
   return hash_;
 }
 
-const std::string& DownloadItemImpl::GetHashState() const {
-  return hash_state_;
-}
-
 bool DownloadItemImpl::GetFileExternallyRemoved() const {
   return file_externally_removed_;
 }
 
 void DownloadItemImpl::DeleteFile(const base::Callback<void(bool)>& callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   if (GetState() != DownloadItem::COMPLETE) {
     // Pass a null WeakPtr so it doesn't call OnDownloadedFileRemoved.
     BrowserThread::PostTask(
         BrowserThread::UI, FROM_HERE,
@@ skipping 171 matching lines @@
     ++iter;
     for ( ; verbose && (iter != last); ++iter) {
       url_list += " ->\n\t";
       const GURL& next_url = *iter;
       url_list += next_url.is_valid() ? next_url.spec() : "<invalid>";
     }
   }
 
   if (verbose) {
     description += base::StringPrintf(
-        " total = %" PRId64
-        " received = %" PRId64
+        " total = %" PRId64 " received = %" PRId64
         " reason = %s"
         " paused = %c"
         " resume_mode = %s"
         " auto_resume_count = %d"
         " danger = %d"
         " all_data_saved = %c"
         " last_modified = '%s'"
         " etag = '%s'"
         " has_download_file = %s"
         " url_chain = \n\t\"%s\"\n\t"
-        " full_path = \"%" PRFilePath "\"\n\t"
+        " current_path = \"%" PRFilePath
+        "\"\n\t"
         " target_path = \"%" PRFilePath "\"",
         GetTotalBytes(),
         GetReceivedBytes(),
         DownloadInterruptReasonToString(last_reason_).c_str(),
         IsPaused() ? 'T' : 'F',
         DebugResumeModeString(GetResumeMode()),
         auto_resume_count_,
         GetDangerType(),
         AllDataSaved() ? 'T' : 'F',
         GetLastModifiedTime().c_str(),
@@ skipping 33 matching lines @@
       (auto_resume_count_ >= kMaxAutoResumeAttempts || is_paused_);
 
   switch(last_reason_) {
     case DOWNLOAD_INTERRUPT_REASON_FILE_TRANSIENT_ERROR:
     case DOWNLOAD_INTERRUPT_REASON_NETWORK_TIMEOUT:
       break;
 
     case DOWNLOAD_INTERRUPT_REASON_SERVER_NO_RANGE:
     // The server disagreed with the file offset that we sent.
 
+    case DOWNLOAD_INTERRUPT_REASON_FILE_HASH_MISMATCH:
+    // The file on disk was found to not match the expected hash. Discard and
+    // start from beginning.
+
     case DOWNLOAD_INTERRUPT_REASON_FILE_TOO_SHORT:
       // The [possibly persisted] file offset disagreed with the file on disk.
 
-      // The intermediate stub is not usable and the server is resonding. Hence
+      // The intermediate stub is not usable and the server is responding. Hence
       // retrying the request from the beginning is likely to work.
       restart_required = true;
       break;
 
     case DOWNLOAD_INTERRUPT_REASON_NETWORK_FAILED:
     case DOWNLOAD_INTERRUPT_REASON_NETWORK_DISCONNECTED:
     case DOWNLOAD_INTERRUPT_REASON_NETWORK_SERVER_DOWN:
     case DOWNLOAD_INTERRUPT_REASON_SERVER_FAILED:
     case DOWNLOAD_INTERRUPT_REASON_SERVER_UNREACHABLE:
     case DOWNLOAD_INTERRUPT_REASON_USER_SHUTDOWN:
@@ skipping 71 matching lines @@
   // HTTP_PRECONDITION_FAILED), then the download will automatically retried as
   // a full request rather than a partial. Full restarts clobber validators.
   int origin_state = 0;
   if (chain_iter != new_create_info.url_chain.end())
     origin_state |= ORIGIN_STATE_ON_RESUMPTION_ADDITIONAL_REDIRECTS;
   if (etag_ != new_create_info.etag ||
       last_modified_time_ != new_create_info.last_modified)
     origin_state |= ORIGIN_STATE_ON_RESUMPTION_VALIDATORS_CHANGED;
   if (content_disposition_ != new_create_info.content_disposition)
     origin_state |= ORIGIN_STATE_ON_RESUMPTION_CONTENT_DISPOSITION_CHANGED;
-  RecordOriginStateOnResumption(new_create_info.save_info->offset != 0,
-                                origin_state);
+  RecordOriginStateOnResumption(received_bytes_ != 0, origin_state);
 
   url_chain_.insert(
       url_chain_.end(), chain_iter, new_create_info.url_chain.end());
   etag_ = new_create_info.etag;
   last_modified_time_ = new_create_info.last_modified;
   content_disposition_ = new_create_info.content_disposition;
 
   // Don't update observers. This method is expected to be called just before a
   // DownloadFile is created and Start() is called. The observers will be
   // notified when the download transitions to the IN_PROGRESS state.
@@ skipping 15 matching lines @@
 }
 
 const net::BoundNetLog& DownloadItemImpl::GetBoundNetLog() const {
   return bound_net_log_;
 }
 
 void DownloadItemImpl::SetTotalBytes(int64_t total_bytes) {
   total_bytes_ = total_bytes;
 }
 
-void DownloadItemImpl::OnAllDataSaved(const std::string& final_hash) {
+void DownloadItemImpl::OnAllDataSaved(
+    int64_t total_bytes,
+    scoped_ptr<crypto::SecureHash> hash_state) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK(!all_data_saved_);
   all_data_saved_ = true;
+  SetTotalBytes(total_bytes);
+  UpdateProgress(total_bytes, 0);
+  SetHashState(std::move(hash_state));
+  hash_state_.reset();  // No need to retain hash_state_ since we are done with
+                        // the download and don't expect to receive any more
+                        // data.
+
   DVLOG(20) << __FUNCTION__ << " download=" << DebugString(true);
-
-  // Store final hash and null out intermediate serialized hash state.
-  hash_ = final_hash;
-  hash_state_ = "";
-
   UpdateObservers();
 }
 
 void DownloadItemImpl::MarkAsComplete() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   DCHECK(all_data_saved_);
   end_time_ = base::Time::Now();
   TransitionTo(COMPLETE_INTERNAL);
   UpdateObservers();
 }
 
 void DownloadItemImpl::DestinationUpdate(int64_t bytes_so_far,
-                                         int64_t bytes_per_sec,
-                                         const std::string& hash_state) {
+                                         int64_t bytes_per_sec) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   // If the download is in any other state we don't expect any
   // DownloadDestinationObserver callbacks. An interruption or a cancellation
   // results in a call to ReleaseDownloadFile which invalidates the weak
   // reference held by the DownloadFile and hence cuts off any pending
   // callbacks.
   DCHECK(state_ == TARGET_PENDING_INTERNAL || state_ == IN_PROGRESS_INTERNAL);
+
+  // There must be no pending destination_error_.
+  DCHECK_EQ(destination_error_, DOWNLOAD_INTERRUPT_REASON_NONE);
+
   DVLOG(20) << __FUNCTION__ << " so_far=" << bytes_so_far
             << " per_sec=" << bytes_per_sec
             << " download=" << DebugString(true);
 
-  bytes_per_sec_ = bytes_per_sec;
-  hash_state_ = hash_state;
-  received_bytes_ = bytes_so_far;
-
-  // If we've received more data than we were expecting (bad server info?),
-  // revert to 'unknown size mode'.
-  if (received_bytes_ > total_bytes_)
-    total_bytes_ = 0;
-
+  UpdateProgress(bytes_so_far, bytes_per_sec);
   if (bound_net_log_.IsCapturing()) {
     bound_net_log_.AddEvent(
         net::NetLog::TYPE_DOWNLOAD_ITEM_UPDATED,
         net::NetLog::Int64Callback("bytes_so_far", received_bytes_));
   }
 
   UpdateObservers();
 }
 
-void DownloadItemImpl::DestinationError(DownloadInterruptReason reason) {
+void DownloadItemImpl::DestinationError(
+    DownloadInterruptReason reason,
+    int64_t bytes_so_far,
+    scoped_ptr<crypto::SecureHash> secure_hash) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   // If the download is in any other state we don't expect any
   // DownloadDestinationObserver callbacks. An interruption or a cancellation
   // results in a call to ReleaseDownloadFile which invalidates the weak
   // reference held by the DownloadFile and hence cuts off any pending
   // callbacks.
   DCHECK(state_ == TARGET_PENDING_INTERNAL || state_ == IN_PROGRESS_INTERNAL);
   DVLOG(20) << __FUNCTION__
             << "() reason:" << DownloadInterruptReasonToString(reason);
 
   // Postpone recognition of this error until after file name determination
   // has completed and the intermediate file has been renamed to simplify
   // resumption conditions.
   if (state_ == TARGET_PENDING_INTERNAL) {
+    received_bytes_ = bytes_so_far;
+    hash_state_ = std::move(secure_hash);
+    hash_.clear();
     destination_error_ = reason;
     return;
   }
-  Interrupt(reason);
+  InterruptWithPartialState(bytes_so_far, std::move(secure_hash), reason);
   UpdateObservers();
 }
 
-void DownloadItemImpl::DestinationCompleted(const std::string& final_hash) {
+void DownloadItemImpl::DestinationCompleted(
+    int64_t total_bytes,
+    scoped_ptr<crypto::SecureHash> secure_hash) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   // If the download is in any other state we don't expect any
   // DownloadDestinationObserver callbacks. An interruption or a cancellation
   // results in a call to ReleaseDownloadFile which invalidates the weak
   // reference held by the DownloadFile and hence cuts off any pending
   // callbacks.
   DCHECK(state_ == TARGET_PENDING_INTERNAL || state_ == IN_PROGRESS_INTERNAL);
   DVLOG(20) << __FUNCTION__ << " download=" << DebugString(true);
 
-  OnAllDataSaved(final_hash);
+  OnAllDataSaved(total_bytes, std::move(secure_hash));
   MaybeCompleteDownload();
 }
 
 // **** Download progression cascade
 
 void DownloadItemImpl::Init(bool active,
                             DownloadType download_type) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   if (active)
@@ skipping 58 matching lines @@
   DCHECK(state_ == INITIAL_INTERNAL || state_ == RESUMING_INTERNAL);
 
   // If the state_ is INITIAL_INTERNAL, then the target path must be empty.
   DCHECK(state_ != INITIAL_INTERNAL || target_path_.empty());
 
   // If a resumption attempted failed, or if the download was DOA, then the
   // download should go back to being interrupted.
   if (new_create_info.result != DOWNLOAD_INTERRUPT_REASON_NONE) {
     DCHECK(!download_file_.get());
 
+    // Download requests that are interrupted by Start() should result in a
+    // DownloadCreateInfo with an intact DownloadSaveInfo.
+    DCHECK(new_create_info.save_info);
+
+    int64_t offset = new_create_info.save_info->offset;
+    scoped_ptr<crypto::SecureHash> hash_state =
+        make_scoped_ptr(new_create_info.save_info->hash_state
+                            ? new_create_info.save_info->hash_state->Clone()
+                            : nullptr);
+
     // Interrupted downloads also need a target path.
     if (target_path_.empty()) {
+      received_bytes_ = offset;
+      hash_state_ = std::move(hash_state);
+      hash_.clear();
+      destination_error_ = new_create_info.result;
       TransitionTo(INTERRUPTED_TARGET_PENDING_INTERNAL);
-      destination_error_ = new_create_info.result;
       DetermineDownloadTarget();
       return;
     }
 
     // Otherwise, this was a resumption attempt which ended with an
     // interruption. Continue with current target path.
     TransitionTo(TARGET_RESOLVED_INTERNAL);
-    Interrupt(new_create_info.result);
+    InterruptWithPartialState(
+        offset, std::move(hash_state), new_create_info.result);
     UpdateObservers();
     return;
   }
 
   // Successful download start.
   DCHECK(download_file_.get());
   DCHECK(request_handle_.get());
 
   if (state_ == RESUMING_INTERNAL)
     UpdateValidatorsOnResumption(new_create_info);
 
   TransitionTo(TARGET_PENDING_INTERNAL);
 
   BrowserThread::PostTask(
       BrowserThread::FILE, FROM_HERE,
       base::Bind(&DownloadFile::Initialize,
                  // Safe because we control download file lifetime.
                  base::Unretained(download_file_.get()),
                  base::Bind(&DownloadItemImpl::OnDownloadFileInitialized,
                             weak_ptr_factory_.GetWeakPtr())));
 }
 
 void DownloadItemImpl::OnDownloadFileInitialized(
     DownloadInterruptReason result) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK_EQ(state_, TARGET_PENDING_INTERNAL);
   DVLOG(20) << __FUNCTION__
             << "() result:" << DownloadInterruptReasonToString(result);
   if (result != DOWNLOAD_INTERRUPT_REASON_NONE) {
-    // Whoops. That didn't work. Proceed as an interrupted download.
+    // Whoops. That didn't work. Proceed as an interrupted download, but reset
+    // the partial state. Currently, the partial stub cannot be recovered if the
+    // download file initialization fails.
+    received_bytes_ = 0;
+    hash_state_.reset();
+    hash_.clear();
     destination_error_ = result;
     TransitionTo(INTERRUPTED_TARGET_PENDING_INTERNAL);
   }
 
   DetermineDownloadTarget();
 }
 
 void DownloadItemImpl::DetermineDownloadTarget() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DVLOG(20) << __FUNCTION__ << "() " << DebugString(true);
@@ skipping 24 matching lines @@
             << " disposition:" << disposition << " danger_type:" << danger_type
             << " this:" << DebugString(true);
 
   target_path_ = target_path;
   target_disposition_ = disposition;
   SetDangerType(danger_type);
 
   // This was an interrupted download that was looking for a filename. Now that
   // it has one, transition to interrupted.
   if (state_ == INTERRUPTED_TARGET_PENDING_INTERNAL) {
-    Interrupt(destination_error_);
+    InterruptWithPartialState(
+        received_bytes_, std::move(hash_state_), destination_error_);
     destination_error_ = DOWNLOAD_INTERRUPT_REASON_NONE;
     UpdateObservers();
     return;
   }
 
   // We want the intermediate and target paths to refer to the same directory so
   // that they are both on the same device and subject to same
   // space/permission/availability constraints.
   DCHECK(intermediate_path.DirName() == target_path.DirName());
 
@@ skipping 27 matching lines @@
                  base::Unretained(download_file_.get()),
                  intermediate_path, callback));
 }
 
 void DownloadItemImpl::OnDownloadRenamedToIntermediateName(
     DownloadInterruptReason reason,
     const base::FilePath& full_path) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK_EQ(state_, TARGET_PENDING_INTERNAL);
   DVLOG(20) << __FUNCTION__ << " download=" << DebugString(true);
+
   TransitionTo(TARGET_RESOLVED_INTERNAL);
 
+  // If the intermediate rename fails while there's also a destination_error_,
+  // then the former is considered the critical error since it requires
+  // discarding the partial state.
+  if (DOWNLOAD_INTERRUPT_REASON_NONE != reason) {
+    // TODO(asanka): Even though the rename failed, it may still be possible to
+    // recover the partial state from the 'before' name.
+    InterruptAndDiscardPartialState(reason);
+    UpdateObservers();
+    return;
+  }
+
   if (DOWNLOAD_INTERRUPT_REASON_NONE != destination_error_) {
-    // Process destination error.  If both |reason| and |destination_error_|
-    // refer to actual errors, we want to use the |destination_error_| as the
-    // argument to the Interrupt() routine, as it happened first.
-    if (reason == DOWNLOAD_INTERRUPT_REASON_NONE)
-      SetFullPath(full_path);
-    Interrupt(destination_error_);
+    SetFullPath(full_path);
+    InterruptWithPartialState(
+        received_bytes_, std::move(hash_state_), destination_error_);
     destination_error_ = DOWNLOAD_INTERRUPT_REASON_NONE;
     UpdateObservers();
-  } else if (DOWNLOAD_INTERRUPT_REASON_NONE != reason) {
-    Interrupt(reason);
-    // All file errors result in file deletion above; no need to cleanup.  The
-    // current_path_ should be empty. Resuming this download will force a
-    // restart and a re-doing of filename determination.
-    DCHECK(current_path_.empty());
-    UpdateObservers();
-  } else {
-    SetFullPath(full_path);
-    TransitionTo(IN_PROGRESS_INTERNAL);
-    // TODO(asanka): Calling UpdateObservers() prior to MaybeCompleteDownload()
-    // is not safe. The download could be in an underminate state after invoking
-    // observers. http://crbug.com/586610
-    UpdateObservers();
-    MaybeCompleteDownload();
+    return;
   }
+
+  SetFullPath(full_path);
+  TransitionTo(IN_PROGRESS_INTERNAL);
+  // TODO(asanka): Calling UpdateObservers() prior to MaybeCompleteDownload() is
+  // not safe. The download could be in an underminate state after invoking
+  // observers. http://crbug.com/586610
+  UpdateObservers();
+  MaybeCompleteDownload();
 }
 
 // When SavePackage downloads MHTML to GData (see
 // SavePackageFilePickerChromeOS), GData calls MaybeCompleteDownload() like it
 // does for non-SavePackage downloads, but SavePackage downloads never satisfy
 // IsDownloadReadyForCompletion(). GDataDownloadObserver manually calls
 // DownloadItem::UpdateObservers() when the upload completes so that SavePackage
 // notices that the upload has completed and runs its normal Finish() pathway.
 // MaybeCompleteDownload() is never the mechanism by which SavePackage completes
 // downloads. SavePackage always uses its own Finish() to mark downloads
@@ skipping 39 matching lines @@
     return;
   }
 
   DCHECK(download_file_.get());
   // Unilaterally rename; even if it already has the right name,
   // we need theannotation.
   DownloadFile::RenameCompletionCallback callback =
       base::Bind(&DownloadItemImpl::OnDownloadRenamedToFinalName,
                  weak_ptr_factory_.GetWeakPtr());
   BrowserThread::PostTask(
-      BrowserThread::FILE, FROM_HERE,
+      BrowserThread::FILE,
+      FROM_HERE,
       base::Bind(&DownloadFile::RenameAndAnnotate,
                  base::Unretained(download_file_.get()),
-                 GetTargetFilePath(), callback));
+                 GetTargetFilePath(),
+                 delegate_->GetApplicationClientIdForFileScanning(),
+                 GetURL(),
+                 GetReferrerUrl(),
+                 callback));
 }
 
 void DownloadItemImpl::OnDownloadRenamedToFinalName(
     DownloadInterruptReason reason,
     const base::FilePath& full_path) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK(!is_save_package_download_);
 
   // If a cancel or interrupt hit, we'll cancel the DownloadFile, which
   // will result in deleting the file on the file thread.  So we don't
   // care about the name having been changed.
   if (state_ != IN_PROGRESS_INTERNAL)
     return;
 
   DVLOG(20) << __FUNCTION__ << "()"
             << " full_path = \"" << full_path.value() << "\""
             << " " << DebugString(false);
 
   if (DOWNLOAD_INTERRUPT_REASON_NONE != reason) {
-    Interrupt(reason);
-
-    // All file errors should have resulted in in file deletion above. On
-    // resumption we will need to re-do filename determination.
-    DCHECK(current_path_.empty());
+    // Failure to perform the final rename is considered fatal. TODO(asanka): It
+    // may not be, in which case we should figure out whether we can recover the
+    // state.
+    InterruptAndDiscardPartialState(reason);
     UpdateObservers();
     return;
   }
 
   DCHECK(target_path_ == full_path);
 
   if (full_path != current_path_) {
     // full_path is now the current and target file path.
     DCHECK(!full_path.empty());
     SetFullPath(full_path);
@@ skipping 47 matching lines @@
     if (!IsTemporary())
       OpenDownload();
 
     auto_opened_ = true;
   }
   UpdateObservers();
 }
 
 // **** End of Download progression cascade
 
-// An error occurred somewhere.
-void DownloadItemImpl::Interrupt(DownloadInterruptReason reason) {
+void DownloadItemImpl::InterruptAndDiscardPartialState(
+    DownloadInterruptReason reason) {
+  InterruptWithPartialState(0, scoped_ptr<crypto::SecureHash>(), reason);
+}
+
+void DownloadItemImpl::InterruptWithPartialState(
+    int64_t bytes_so_far,
+    scoped_ptr<crypto::SecureHash> hash_state,
+    DownloadInterruptReason reason) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK_NE(DOWNLOAD_INTERRUPT_REASON_NONE, reason);
   DVLOG(20) << __FUNCTION__
             << "() reason:" << DownloadInterruptReasonToString(reason)
+            << " bytes_so_far:" << bytes_so_far
+            << " hash_state:" << (hash_state ? "Valid" : "Invalid")
             << " this=" << DebugString(true);
 
   // Somewhat counter-intuitively, it is possible for us to receive an
   // interrupt after we've already been interrupted.  The generation of
   // interrupts from the file thread Renames and the generation of
   // interrupts from disk writes go through two different mechanisms (driven
   // by rename requests from UI thread and by write requests from IO thread,
   // respectively), and since we choose not to keep state on the File thread,
   // this is the place where the races collide.  It's also possible for
   // interrupts to race with cancels.
@@ skipping 20 matching lines @@
 
       if (download_file_) {
         ResumeMode resume_mode = GetResumeMode();
         ReleaseDownloadFile(resume_mode != RESUME_MODE_IMMEDIATE_CONTINUE &&
                             resume_mode != RESUME_MODE_USER_CONTINUE);
       }
       break;
 
     case RESUMING_INTERNAL:
     case INTERRUPTED_INTERNAL:
+      DCHECK(!download_file_);
       // The first non-cancel interrupt reason wins in cases where multiple
       // things go wrong.
       if (reason != DOWNLOAD_INTERRUPT_REASON_USER_CANCELED &&
           reason != DOWNLOAD_INTERRUPT_REASON_USER_SHUTDOWN)
         return;
 
       last_reason_ = reason;
       if (!current_path_.empty()) {
         // There is no download file and this is transitioning from INTERRUPTED
         // to CANCELLED. The intermediate file is no longer usable, and should
@@ skipping 11 matching lines @@
   // through another round of downloading when we resume. There's a potential
   // problem here in the abstract, as if we did download all the data and then
   // run into a continuable error, on resumption we won't download any more
   // data.  However, a) there are currently no continuable errors that can occur
   // after we download all the data, and b) if there were, that would probably
   // simply result in a null range request, which would generate a
   // DestinationCompleted() notification from the DownloadFile, which would
   // behave properly with setting all_data_saved_ to false here.
   all_data_saved_ = false;
 
+  if (current_path_.empty()) {
+    hash_state_.reset();
+    hash_.clear();
+    received_bytes_ = 0;
+  } else {
+    UpdateProgress(bytes_so_far, 0);
+    SetHashState(std::move(hash_state));
+  }
+
   if (request_handle_)
     request_handle_->CancelRequest();
 
   if (reason == DOWNLOAD_INTERRUPT_REASON_USER_CANCELED ||
       reason == DOWNLOAD_INTERRUPT_REASON_USER_SHUTDOWN) {
     if (IsDangerous()) {
       RecordDangerousDownloadDiscard(
           reason == DOWNLOAD_INTERRUPT_REASON_USER_CANCELED
               ? DOWNLOAD_DISCARD_DUE_TO_USER_ACTION
               : DOWNLOAD_DISCARD_DUE_TO_SHUTDOWN,
           GetDangerType(), GetTargetFilePath());
     }
 
     RecordDownloadCount(CANCELLED_COUNT);
     TransitionTo(CANCELLED_INTERNAL);
     return;
   }
 
   RecordDownloadInterrupted(reason, received_bytes_, total_bytes_);
   if (!GetWebContents())
     RecordDownloadCount(INTERRUPTED_WITHOUT_WEBCONTENTS);
 
   TransitionTo(INTERRUPTED_INTERNAL);
   AutoResumeIfValid();
 }
 
+void DownloadItemImpl::UpdateProgress(int64_t bytes_so_far,
+                                      int64_t bytes_per_sec) {
+  received_bytes_ = bytes_so_far;
+  bytes_per_sec_ = bytes_per_sec;
+
+  // If we've received more data than we were expecting (bad server info?),
+  // revert to 'unknown size mode'.
+  if (received_bytes_ > total_bytes_)
+    total_bytes_ = 0;
+}
+
+void DownloadItemImpl::SetHashState(scoped_ptr<crypto::SecureHash> hash_state) {
+  hash_state_ = std::move(hash_state);
+  if (!hash_state_) {
+    hash_.clear();
+    return;
+  }
+
+  scoped_ptr<crypto::SecureHash> clone_of_hash_state(hash_state_->Clone());
+  std::vector<char> hash_value(clone_of_hash_state->GetHashLength());
+  clone_of_hash_state->Finish(&hash_value.front(), hash_value.size());
+  hash_.assign(hash_value.begin(), hash_value.end());
+}
+
 void DownloadItemImpl::ReleaseDownloadFile(bool destroy_file) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DVLOG(20) << __FUNCTION__ << "() destroy_file:" << destroy_file;
 
   if (destroy_file) {
     BrowserThread::PostTask(
         BrowserThread::FILE, FROM_HERE,
         // Will be deleted at end of task execution.
         base::Bind(&DownloadFileCancel, base::Passed(&download_file_)));
     // Avoid attempting to reuse the intermediate file by clearing out
@@ skipping 97 matching lines @@
 
     case COMPLETE_INTERNAL:
       bound_net_log_.AddEvent(
           net::NetLog::TYPE_DOWNLOAD_ITEM_FINISHED,
           base::Bind(&ItemFinishedNetLogCallback, auto_opened_));
       break;
 
     case INTERRUPTED_INTERNAL:
       bound_net_log_.AddEvent(
           net::NetLog::TYPE_DOWNLOAD_ITEM_INTERRUPTED,
-          base::Bind(&ItemInterruptedNetLogCallback, last_reason_,
-                     received_bytes_, &hash_state_));
+          base::Bind(
+              &ItemInterruptedNetLogCallback, last_reason_, received_bytes_));
       break;
 
     case RESUMING_INTERNAL:
-      bound_net_log_.AddEvent(
-          net::NetLog::TYPE_DOWNLOAD_ITEM_RESUMED,
-          base::Bind(&ItemResumingNetLogCallback, false, last_reason_,
-                     received_bytes_, &hash_state_));
+      bound_net_log_.AddEvent(net::NetLog::TYPE_DOWNLOAD_ITEM_RESUMED,
+                              base::Bind(&ItemResumingNetLogCallback,
+                                         false,
+                                         last_reason_,
+                                         received_bytes_));
       break;
 
     case CANCELLED_INTERNAL:
       bound_net_log_.AddEvent(
           net::NetLog::TYPE_DOWNLOAD_ITEM_CANCELED,
-          base::Bind(&ItemCanceledNetLogCallback, received_bytes_,
-                     &hash_state_));
+          base::Bind(&ItemCanceledNetLogCallback, received_bytes_));
       break;
 
     case MAX_DOWNLOAD_INTERNAL_STATE:
       NOTREACHED();
       break;
   }
 
   DVLOG(20) << " " << __FUNCTION__ << "()"
             << " from:" << DebugDownloadStateString(old_state)
             << " to:" << DebugDownloadStateString(state_)
@@ skipping 80 matching lines @@
 
   // We are starting a new request. Shake off all pending operations.
   DCHECK(!download_file_);
   weak_ptr_factory_.InvalidateWeakPtrs();
 
   // Reset the appropriate state if restarting.
   ResumeMode mode = GetResumeMode();
   if (mode == RESUME_MODE_IMMEDIATE_RESTART ||
       mode == RESUME_MODE_USER_RESTART) {
     received_bytes_ = 0;
-    hash_state_ = "";
-    last_modified_time_ = "";
-    etag_ = "";
+    last_modified_time_.clear();
+    etag_.clear();
+    hash_.clear();
+    hash_state_.reset();
   }
 
   // Avoid using the WebContents even if it's still around. Resumption requests
   // are consistently routed through the no-renderer code paths so that the
   // request will not be dropped if the WebContents (and by extension, the
   // associated renderer) goes away before a response is received.
   scoped_ptr<DownloadUrlParameters> download_params(new DownloadUrlParameters(
       GetURL(), -1, -1, -1, GetBrowserContext()->GetResourceContext()));
   download_params->set_file_path(GetFullPath());
   download_params->set_offset(GetReceivedBytes());
-  download_params->set_hash_state(GetHashState());
   download_params->set_last_modified(GetLastModifiedTime());
   download_params->set_etag(GetETag());
+  download_params->set_hash_of_partial_file(hash_);
+  download_params->set_hash_state(std::move(hash_state_));
 
   TransitionTo(RESUMING_INTERNAL);
   delegate_->ResumeInterruptedDownload(std::move(download_params), GetId());
   // Just in case we were interrupted while paused.
   is_paused_ = false;
 }
 
 // static
 DownloadItem::DownloadState DownloadItemImpl::InternalToExternalState(
     DownloadInternalState internal_state) {
@@ skipping 164 matching lines @@
     case RESUME_MODE_USER_CONTINUE:
       return "USER_CONTINUE";
     case RESUME_MODE_USER_RESTART:
       return "USER_RESTART";
   }
   NOTREACHED() << "Unknown resume mode " << mode;
   return "unknown";
 }
 
 }  // namespace content