[sql] Convert thumbnails and top-sites databases to auto-recovery.

sql/recovery.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "sql/recovery.h"
 
 #include <stddef.h>
 
 #include "base/files/file_path.h"
 #include "base/format_macros.h"
@@ skipping 108 matching lines @@
   RECOVERY_FAILED_AUTORECOVERDB_NOTADB_REOPEN,
 
   // After SQLITE_NOTADB failure setting up for recovery, Delete() and Open()
   // succeeded, then querying the database failed.
   RECOVERY_FAILED_AUTORECOVERDB_NOTADB_QUERY,
 
   // After SQLITE_NOTADB failure setting up for recovery, the database was
   // successfully deleted.
   RECOVERY_SUCCESS_AUTORECOVERDB_NOTADB_DELETE,
 
+  // Failed to find required [meta.version] information.
+  RECOVERY_FAILED_AUTORECOVERDB_META_VERSION,
+
   // Add new items before this one, always keep this one at the end.
   RECOVERY_EVENT_MAX,
 };
 
 void RecordRecoveryEvent(RecoveryEventType recovery_event) {
   UMA_HISTOGRAM_ENUMERATION("Sqlite.RecoveryEvents",
                             recovery_event, RECOVERY_EVENT_MAX);
 }
 
 }  // namespace
@@ skipping 456 matching lines @@
 // This method is derived from SQLite's vacuum.c.  VACUUM operates very
 // similarily, creating a new database, populating the schema, then copying the
 // data.
 //
 // TODO(shess): This conservatively uses Rollback() rather than Unrecoverable().
 // With Rollback(), it is expected that the database will continue to generate
 // errors.  Change the failure cases to Unrecoverable() if/when histogram
 // results indicate that everything is working reasonably.
 //
 // static
-void Recovery::RecoverDatabase(Connection* db,
-                               const base::FilePath& db_path) {
+std::unique_ptr<Recovery> Recovery::BeginRecoverDatabase(
+    Connection* db,
+    const base::FilePath& db_path) {
   std::unique_ptr<sql::Recovery> recovery = sql::Recovery::Begin(db, db_path);
   if (!recovery) {
     // Close the underlying sqlite* handle.  Windows does not allow deleting
     // open files, and all platforms block opening a second sqlite3* handle
     // against a database when exclusive locking is set.
     db->Poison();
 
     // Histograms from Recovery::Begin() show all current failures are in
     // attaching the corrupt database, with 2/3 being SQLITE_NOTADB.  Don't
     // delete the database except for that specific failure case.
     {
       Connection probe_db;
       if (!probe_db.OpenInMemory() ||
           probe_db.AttachDatabase(db_path, "corrupt") ||
           probe_db.GetErrorCode() != SQLITE_NOTADB) {
         RecordRecoveryEvent(RECOVERY_FAILED_AUTORECOVERDB_BEGIN);
-        return;
+        return nullptr;
       }
     }
 
     // The database has invalid data in the SQLite header, so it is almost
     // certainly not recoverable without manual intervention (and likely not
     // recoverable _with_ manual intervention).  Clear away the broken database.
     if (!sql::Connection::Delete(db_path)) {
       RecordRecoveryEvent(RECOVERY_FAILED_AUTORECOVERDB_NOTADB_DELETE);
-      return;
+      return nullptr;
     }
 
     // Windows deletion is complicated by file scanners and malware - sometimes
     // Delete() appears to succeed, even though the file remains.  The following
     // attempts to track if this happens often enough to cause concern.
     {
       Connection probe_db;
       if (!probe_db.Open(db_path)) {
         RecordRecoveryEvent(RECOVERY_FAILED_AUTORECOVERDB_NOTADB_REOPEN);
-        return;
+        return nullptr;
       }
       if (!probe_db.Execute("PRAGMA auto_vacuum")) {
         RecordRecoveryEvent(RECOVERY_FAILED_AUTORECOVERDB_NOTADB_QUERY);
-        return;
+        return nullptr;
       }
     }
 
     // The rest of the recovery code could be run on the re-opened database, but
     // the database is empty, so there would be no point.
     RecordRecoveryEvent(RECOVERY_SUCCESS_AUTORECOVERDB_NOTADB_DELETE);
-    return;
+    return nullptr;
   }
 
 #if DCHECK_IS_ON()
   // This code silently fails to recover fts3 virtual tables.  At this time no
   // browser database contain fts3 tables.  Just to be safe, complain loudly if
   // the database contains virtual tables.
   //
   // fts3 has an [x_segdir] table containing a column [end_block INTEGER].  But
   // it actually stores either an integer or a text containing a pair of
   // integers separated by a space.  AutoRecoverTable() trusts the INTEGER tag
@@ skipping 11 matching lines @@
   // TODO(shess): vacuum.c turns synchronous=OFF for the target.  I do not fully
   // understand this, as the temporary db should not have a journal file at all.
   // Perhaps it does in case of cache spill?
 
   // Copy table schema from [corrupt] to [main].
   if (!SchemaCopyHelper(recovery->db(), "CREATE TABLE ") ||
       !SchemaCopyHelper(recovery->db(), "CREATE INDEX ") ||
       !SchemaCopyHelper(recovery->db(), "CREATE UNIQUE INDEX ")) {
     // No RecordRecoveryEvent() here because SchemaCopyHelper() already did.
     Recovery::Rollback(std::move(recovery));
-    return;
+    return nullptr;
   }
 
   // Run auto-recover against each table, skipping the sequence table.  This is
   // necessary because table recovery can create the sequence table as a side
   // effect, so recovering that table inline could lead to duplicate data.
   {
     sql::Statement s(recovery->db()->GetUniqueStatement(
         "SELECT name FROM sqlite_master WHERE sql LIKE 'CREATE TABLE %' "
         "AND name!='sqlite_sequence'"));
     while (s.Step()) {
       const std::string name = s.ColumnString(0);
       size_t rows_recovered;
       if (!recovery->AutoRecoverTable(name.c_str(), &rows_recovered)) {
         RecordRecoveryEvent(RECOVERY_FAILED_AUTORECOVERDB_TABLE);
         Recovery::Rollback(std::move(recovery));
-        return;
+        return nullptr;
       }
     }
     if (!s.Succeeded()) {
       RecordRecoveryEvent(RECOVERY_FAILED_AUTORECOVERDB_NAMESELECT);
       Recovery::Rollback(std::move(recovery));
-      return;
+      return nullptr;
     }
   }
 
   // Overwrite any sequences created.
   if (recovery->db()->DoesTableExist("corrupt.sqlite_sequence")) {
     ignore_result(recovery->db()->Execute("DELETE FROM main.sqlite_sequence"));
     size_t rows_recovered;
     if (!recovery->AutoRecoverTable("sqlite_sequence", &rows_recovered)) {
       RecordRecoveryEvent(RECOVERY_FAILED_AUTORECOVERDB_SEQUENCE);
       Recovery::Rollback(std::move(recovery));
-      return;
+      return nullptr;
     }
   }
 
   // Copy triggers and views directly to sqlite_master.  Any tables they refer
   // to should already exist.
   char kCreateMetaItems[] =
       "INSERT INTO main.sqlite_master "
       "SELECT type, name, tbl_name, rootpage, sql "
       "FROM corrupt.sqlite_master WHERE type='view' OR type='trigger'";
   if (!recovery->db()->Execute(kCreateMetaItems)) {
     RecordRecoveryEvent(RECOVERY_FAILED_AUTORECOVERDB_AUX);
     Recovery::Rollback(std::move(recovery));
+    return nullptr;
+  }
+
+  RecordRecoveryEvent(RECOVERY_SUCCESS_AUTORECOVERDB);
+  return recovery;
+}
+
+void Recovery::RecoverDatabase(Connection* db, const base::FilePath& db_path) {
+  std::unique_ptr<sql::Recovery> recovery = BeginRecoverDatabase(db, db_path);
+
+  // ignore_result() because BeginRecoverDatabase() and Recovered() already
+  // provide suitable histogram coverage.
+  if (recovery)
+    ignore_result(Recovery::Recovered(std::move(recovery)));
+}
+
+void Recovery::RecoverDatabaseWithMetaVersion(Connection* db,
+                                              const base::FilePath& db_path) {
+  std::unique_ptr<sql::Recovery> recovery = BeginRecoverDatabase(db, db_path);
+  if (!recovery)
+    return;
+
+  int version = 0;
+  if (!recovery->SetupMeta() || !recovery->GetMetaVersionNumber(&version)) {
+    sql::Recovery::Unrecoverable(std::move(recovery));
+    RecordRecoveryEvent(RECOVERY_FAILED_AUTORECOVERDB_META_VERSION);
     return;
   }
 
-  RecordRecoveryEvent(RECOVERY_SUCCESS_AUTORECOVERDB);
+  // ignore_result() because BeginRecoverDatabase() and Recovered() already
+  // provide suitable histogram coverage.
   ignore_result(Recovery::Recovered(std::move(recovery)));
 }
 
 // static
 bool Recovery::ShouldRecover(int extended_error) {
   // Trim extended error codes.
   int error = extended_error & 0xFF;
   switch (error) {
     case SQLITE_NOTADB:
       // SQLITE_NOTADB happens if the SQLite header is broken.  Some earlier
@@ skipping 20 matching lines @@
       // - SQLITE_READONLY - permissions could be fixed.
       // - SQLITE_IOERR - rewrite using new blocks.
       // - SQLITE_FULL - recover in memory and rewrite subset of data.
 
     default:
       return false;
   }
 }
 
 }  // namespace sql