[sql] Database recovery system for Shortcuts.

sql/recovery.h

Index: sql/recovery.h
diff --git a/sql/recovery.h b/sql/recovery.h
index 8efd71877318b04f1df5486f135257038717918d..13a3551d1490580ba9e49e8fcdf2dbea20ea81e9 100644
--- a/sql/recovery.h
+++ b/sql/recovery.h
@@ -18,13 +18,17 @@ class FilePath;
 
 namespace sql {
 
-// Recovery module for sql/.  The basic idea is to create a fresh
-// database and populate it with the recovered contents of the
-// original database.  If recovery is successful, the recovered
-// database is backed up over the original database.  If recovery is
-// not successful, the original database is razed.  In either case,
-// the original handle is poisoned so that operations on the stack do
-// not accidentally disrupt the restored data.
+// Recovery module for sql/.  The basic idea is to create a fresh database and
+// populate it with the recovered contents of the original database.  If
+// recovery is successful, the recovered database is backed up over the original
+// database.  If recovery is not successful, the original database is razed.  In
+// either case, the original handle is poisoned so that operations on the stack
+// do not accidentally disrupt the restored data.
+//
+// RecoverDatabaseOrRaze() automates this, including recoverying the schema of
+// from the suspect database.  If a database requires special handling, such as
+// recovering between different schema, or tables requiring post-processing,
+// then the module can be used manually like:
 //
 // {
 //   std::unique_ptr<sql::Recovery> r =
@@ -151,6 +155,24 @@ class SQL_EXPORT Recovery {
   // Only valid to call after successful SetupMeta().
   bool GetMetaVersionNumber(int* version_number);
 
+  // Attempt to recover the database by creating a new database with schema from
+  // |db|, then copying over as much data as possible.  After this call, the
+  // |db| handle will be poisoned so that future calls will return errors until
+  // the handle is re-opened.
+  //
+  // If a corrupt database contains tables without unique indices, the resulting
+  // table may contain duplication.  If this is not acceptable, the client
+  // should use the manual process as described in the example at the top of the
+  // file, cleaning up data at the appropriate points.
+  static void RecoverDatabase(Connection* db, const base::FilePath& db_path);
+
+  // Returns true for SQLite errors which RecoverDatabase() could plausibly fix.
+  // This does not guarantee that RecoverDatabase() will successfully recover
+  // the database.  Returning false means the error is not related to the
+  // contents of the database (such as SQLITE_BUSY or SQLITE_MISUSE), or is not
+  // verified to be recovered correctly (such as SQLITE_IOERR or SQLITE_FULL).

[Mark P, 2016/06/27 23:20:13]

nit: recovered -> recoverable ?

[Scott Hess - ex-Googler, 2016/06/29 21:39:30]

I'm just going to remove the entire "why false" case, and just let the "why
true" case stand alone.

I intentionally avoided language like "Do not call RecoverDatabase() unless this
returns true", because it actually doesn't matter.  The code doesn't work better
or worse based on this error code, the caller just shouldn't dump all errors
into recovery because of the goal of strongly flagging newly-introduced errors
like SQLITE_ERROR or SQLITE_MISUSE.

[Mark P, 2016/07/01 22:40:55]

Good move.
Acknowledged.

+  static bool ShouldRecover(int extended_error);
+
  private:
   explicit Recovery(Connection* connection);