win: Implementation of CrashReportDatabase for Windows

client/crash_report_database_win.cc

+// Copyright 2015 The Crashpad Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "client/crash_report_database.h"
+
+#include <rpc.h>
+#include <time.h>
+#include <windows.h>
+
+#include <limits>
+
+#include "base/logging.h"
+#include "base/numerics/safe_math.h"
+#include "base/strings/stringprintf.h"
+#include "base/strings/utf_string_conversions.h"
+
+namespace crashpad {
+
+namespace {
+
+const wchar_t kDatabaseDirectoryName[] = L"Crashpad";
+
+const wchar_t kReportsDirectory[] = L"reports";
+const wchar_t kMetadataFileName[] = L"metadata";
+
+const wchar_t kCrashReportFileExtension[] = L"dmp";
+
+enum class ReportState : int {
+  //! \brief Created and filled out by caller, owned by database.
+  kPending,
+  //! \brief In the process of uploading, owned by caller.
+  kUploading,
+  //! \brief Upload completed or skipped, owned by database.
+  kCompleted,
+};
+
+using OperationStatus = CrashReportDatabase::OperationStatus;
+
+//! \brief Ensures that the node at path is a directory, and creates it if it
+//!     does not exist.
+//!
+//! \return If the path points to a file, rather than a directory, or the
+//!     directory could not be created, returns false. Otherwise, returns true,
+//!     indicating that path already was or now is a directory.
+bool CreateOrEnsureDirectoryExists(const base::FilePath& path) {
+  if (CreateDirectory(path.value().c_str(), nullptr)) {
+    return true;
+  } else if (GetLastError() == ERROR_ALREADY_EXISTS) {
+    DWORD fileattr = GetFileAttributes(path.value().c_str());
+    if (fileattr == INVALID_FILE_ATTRIBUTES) {
+      PLOG(ERROR) << "GetFileAttributes";
+      return false;
+    }
+    if ((fileattr & FILE_ATTRIBUTE_DIRECTORY) != 0)
+      return true;
+    LOG(ERROR) << "not a directory";
+    return false;
+  } else {
+    PLOG(ERROR) << "CreateDirectory";
+    return false;
+  }
+}
+
+//! \brief A private extension of the Report class that includes additional data
+//!     that's stored on disk in the metadata file.
+struct ReportDisk : public CrashReportDatabase::Report {
+  //! \brief The current state of the report.
+  ReportState state;
+};
+
+//! \brief A private extension of the NewReport class to hold the UUID during
+//!     initial write. We don't store metadata in dump's file attributes, and
+//!     use the UUID to identify the dump on write completion.
+struct NewReportDisk : public CrashReportDatabase::NewReport {
+  //! \brief The UUID for this crash report.
+  UUID uuid;
+};
+
+//! \brief Manages the metadata for the set of reports, handling serialization
+//!     to disk, and queries. Instances of this class should be created by using
+//!     CrashReportDatabaseWin::AcquireMetadata().
+class Metadata {
+ public:
+  //! \brief Writes any changes if necessary, unlocks and closes the file
+  //!     handle.
+  ~Metadata();
+
+  //! \brief Adds a new report to the set.
+  //!
+  //! \param[in] new_report_disk The record to add. The #state field must be set
+  //!     to kPending.
+  void AddNewRecord(const ReportDisk& new_report_disk);
+
+  //! \brief Finds all reports in a given state. The \a reports vector is only
+  //!     valid when CrashReportDatabase::kNoError is returned.
+  //!
+  //! \param[in] desired_state The state to match.
+  //! \param[out] reports Matching reports, must be empty on entry.
+  OperationStatus FindReports(
+      ReportState desired_state,
+      std::vector<const CrashReportDatabase::Report>* reports);
+
+  //! \brief Finds the report matching the given UUID.
+  //!
+  //! The returned report is only valid if CrashReportDatabase::kNoError is
+  //! returned.
+  //!
+  //! \param[in] uuid The report identifier.
+  //! \param[out] report_disk The found report, valid only if
+  //!     CrashReportDatabase::kNoError is returned. Ownership is not
+  //!     transferred to the caller, and the report may not be modified.
+  OperationStatus FindSingleReport(const UUID& uuid,
+                                   const ReportDisk** report_disk);
+
+  //! \brief Finds a single report matching the given UUID and in the desired
+  //!     state and calls the client-supplied mutator to modify the report.
+  //!
+  //! The mutator object must have an operator()(ReportDisk*) which makes the
+  //! desired changes.
+  //!
+  //! \return #kNoError on success. #kReportNotFound if there was no report with
+  //!     the specified UUID. #kBusyError if the report was not in the specified
+  //!     state.
+  template <class T>
+  OperationStatus MutateSingleReport(const UUID& uuid,
+                                     ReportState desired_state,
+                                     const T& mutator);
+
+ private:
+  Metadata(FileHandle handle, const base::FilePath& report_dir);
+
+  static scoped_ptr<Metadata> Create(const base::FilePath& metadata_file,
+                                     const base::FilePath& report_dir);
+  friend class CrashReportDatabaseWin;
+
+  void Read();
+  void Write();
+
+  //! \brief Confirms that the corresponding report actually exists on disk
+  //!     (that is, the dump file has not been removed), that the report is in
+  //!     the given state.
+  static OperationStatus VerifyReport(const ReportDisk& report_disk,
+                                      ReportState desired_state);
+  //! \brief Confirms that the corresponding report actually exists on disk
+  //!     (that is, the dump file has not been removed).
+  static OperationStatus VerifyReportAnyState(const ReportDisk& report_disk);
+
+  ScopedFileHandle handle_;
+  const base::FilePath report_dir_;
+  bool dirty_;  //! \brief Is a Write() required on destruction?
+  std::vector<ReportDisk> reports_;
+
+  DISALLOW_COPY_AND_ASSIGN(Metadata);
+};
+
+Metadata::Metadata(FileHandle handle, const base::FilePath& report_dir)
+    : handle_(handle), report_dir_(report_dir), dirty_(false), reports_() {
+}
+
+Metadata::~Metadata() {
+  if (dirty_)
+    Write();
+  OVERLAPPED overlapped = {0};
+  if (!UnlockFileEx(handle_.get(), 0, MAXDWORD, MAXDWORD, &overlapped))
+    PLOG(ERROR) << "UnlockFileEx";
+}
+
+// The format of the metadata file is a MetadataFileHeader, followed by a
+// number of fixed size records of MetadataFileReportRecord, followed by a
+// string table in UTF8 format, where each string is \0 terminated.
+
+#pragma pack(push, 1)
+
+struct MetadataFileHeader {
+  uint32_t magic;
+  uint32_t version;
+  uint32_t num_records;
+};
+
+struct MetadataFileReportRecord {
+  UUID uuid;  // UUID is a 16 byte, standard layout structure.
+  uint32_t file_path_index;  // Index into string table. File name is relative
+                             // to the reports directory when on disk.
+  uint32_t id_index;  // Index into string table.
+  int64_t creation_time;  // Holds a time_t.
+  int64_t last_upload_attempt_time;  // Holds a time_t.
+  int32_t upload_attempts;
+  int32_t state;  // A ReportState.
+  uint8_t uploaded;  // Boolean, 0 or 1.
+};
+
+const uint32_t kMetadataFileHeaderMagic = 'CPAD';
+const uint32_t kMetadataFileVersion = 1;
+
+#pragma pack(pop)
+
+// Reads from the current file position to EOF and returns as uint8_t[].
+std::vector<uint8_t> ReadRestOfFile(FileHandle file) {
+  FileOffset read_from = LoggingSeekFile(file, 0, SEEK_CUR);
+  FileOffset end = LoggingSeekFile(file, 0, SEEK_END);
+  FileOffset original = LoggingSeekFile(file, read_from, SEEK_SET);
+  if (read_from == -1 || end == -1 || original == -1)
+    return std::vector<uint8_t>();
+  DCHECK(read_from == original);
+  size_t data_length = static_cast<size_t>(end - read_from);
+  std::vector<uint8_t> buffer;
+  buffer.resize(data_length);
+  if (!LoggingReadFile(file, &buffer[0], data_length))
+    return std::vector<uint8_t>();
+  return buffer;
+}
+
+uint32_t AddStringToTable(std::string* string_table, const std::string& str) {
+  uint32_t offset = base::checked_cast<uint32_t>(string_table->size());
+  *string_table += str;
+  *string_table += '\0';
+  return offset;
+}
+
+uint32_t AddStringToTable(std::string* string_table, const std::wstring& str) {
+  return AddStringToTable(string_table, base::UTF16ToUTF8(str));
+}
+
+// static
+scoped_ptr<Metadata> Metadata::Create(const base::FilePath& metadata_file,
+                                      const base::FilePath& report_dir) {
+  FileHandle handle = LoggingOpenFileForWrite(metadata_file,
+                                              FileWriteMode::kReuseOrCreate,
+                                              FilePermissions::kOwnerOnly);
+  if (handle == kInvalidFileHandle)
+    return scoped_ptr<Metadata>();
+  // Not actually async, LockFileEx requires the Offset fields.
+  OVERLAPPED overlapped = {0};
+  if (!LockFileEx(handle,

[Mark Mentovai, 2015/02/10 22:16:29]

If two threads in the same process try to get the metadata simultaneously, will
there be a problem?

I anticipate that the handler thread that writes dumps and the uploader thread
will both want access to the metadata.

[scottmg, 2015/02/10 22:44:01]

Hmm, I had only been considering separate processes, assuming a single process
would coordinate above.

I guess a critical section here is sufficient. Could switch back to a mutex (but
has the problem with multiple crashpad instances), and the LockFileEx seems to
better match what's being guarded. The CS should almost never be contended.

[Mark Mentovai, 2015/02/10 22:49:29]

scottmg wrote:
A critical section that’s held for the same duration that the file’s locked?
That could work.

[scottmg, 2015/02/10 23:28:37]

Done in ps#21.

Er, wait! Writing the comment below I realized the CS is unnecessary. The
specific handle holds the lock, so a second in-process LockFileEx will block --
it's only accessible through this handle.

So, reverted the critical section change.

[Mark Mentovai, 2015/02/10 23:37:03]

scottmg wrote:
Sorry, maybe I should have framed the question better. Really, I was trying to
get at whether LockFileEx() guards threads against other threads, or if it just
guards processes against other processes. As long as it guards threads in the
same process against one another, LockFileEx() alone is ideal.

[scottmg, 2015/02/10 23:42:16]

Oh dear. And in writing a test for this, I realized that the dwShareMode that
LoggingOpenFileForWrite uses (no sharing) means that the LockFileEx is
unnecessary, because other attempts to open the file will fail and return
kBusyError (before they even get to LockFileEx).

This might be OK (in which case we can delete the LockFileEx code) but it's
differently granular than Mac because kBusyError only applies to concurrent
access to a single report.

OTOH, on Windows, the lock is not outstanding for any "long" operations like
writing the crash dump or uploading it, only for operations inside the Metadata
which are of the form read/change state/write.

[scottmg, 2015/02/10 23:54:40]

Got it. LockFileEx doesn't strictly protect access amongst threads. It does in
this usage though because the lock is attached to the handle, not the file, and
we always (attempt) to open a fresh handle here. So, if the open were to
succeed, this LockFileEx would block vs. all other users (whether in different
threads or different processes).

[Mark Mentovai, 2015/02/11 00:31:35]

scottmg wrote:
I’m not sure if you’re suggesting just allowing this to fail. I think it would
be pretty bad if an attempt to operate on metadata could result in a failure to
do so because someone else has the lock. Whatever will be doing the dump-writing
and uploading will be expecting to be able to do metadata operations, and I
think that in both cases, if there’s any lock contention, we’d want for them to
block.
Yeah, it’s good that we’re not expecting anyone to hold the lock for very long.

[Mark Mentovai, 2015/02/11 00:31:36]

scottmg wrote:
OK, so the lock isn’t really process-based or thread-based, it’s handle-based.
That makes sense.

[scottmg, 2015/02/11 01:13:40]

That makes sense.

I dithered a little on this, but rather than switch LoggingOpenFileForWrite to a
shared mode (it feels unusual to have a generic writing function do that), I
used CreateFile directly here.

This means that the file open will succeed now, and a second concurrent access
will block until the lock is released.

[[
Does that mean CrashReportDatabaseMac::ObtainReportLock's open shouldn't be
O_NONBLOCK? e.g. Would concurrent LookUpCrashReport()s would fail with
kBusyError currently?
]]

[Robert Sesek, 2015/02/11 03:16:07]

It would only return kBusyError if the concurrent accesses were for the same
report, since the metadata is stored per-report rather than in aggregate as a
single file. If we think this is a problem, then ObtainReportLock could have an
option to use either O_SHLOCK or O_EXLOCK to control reader vs reader/writer
semantics in the database.

+                  LOCKFILE_EXCLUSIVE_LOCK,
+                  0,
+                  MAXDWORD,
+                  MAXDWORD,
+                  &overlapped)) {
+    PLOG(ERROR) << "LockFileEx";
+    return scoped_ptr<Metadata>();
+  }
+
+  scoped_ptr<Metadata> metadata(new Metadata(handle, report_dir));
+  // If Read() fails, for whatever reason (corruption, etc.) metadata will not
+  // have been modified and will be in a clean empty state. We continue on and
+  // return an empty database to hopefully recover. This means that existing
+  // crash reports have been lost.
+  metadata->Read();
+  return metadata;
+}
+
+void Metadata::Read() {
+  if (LoggingSeekFile(handle_.get(), 0, SEEK_SET) == -1)
+    return;
+
+  MetadataFileHeader header;
+  if (!LoggingReadFile(handle_.get(), &header, sizeof(header)))
+    return;
+  if (header.magic != kMetadataFileHeaderMagic ||
+      header.version != kMetadataFileVersion) {
+    return;
+  }
+
+  auto records_size = base::CheckedNumeric<uint32_t>(header.num_records) *
+                      sizeof(MetadataFileReportRecord);
+  if (!records_size.IsValid())
+    return;
+
+  scoped_ptr<MetadataFileReportRecord[]> records(
+      new MetadataFileReportRecord[header.num_records]);
+  if (!LoggingReadFile(handle_.get(), records.get(), records_size.ValueOrDie()))
+    return;
+
+  std::vector<uint8_t> string_buffer = ReadRestOfFile(handle_.get());
+  if (string_buffer.empty() || string_buffer.back() != 0)
+    return;
+  const char* string_table = reinterpret_cast<const char*>(&string_buffer[0]);
+
+  for (uint32_t i = 0; i < header.num_records; ++i) {
+    ReportDisk r;
+    const MetadataFileReportRecord* record = &records[i];
+    r.uuid = record->uuid;
+    if (record->file_path_index >= string_buffer.size() ||
+        record->id_index >= string_buffer.size()) {
+      reports_.clear();
+      return;
+    }
+    r.file_path = report_dir_.Append(
+        base::UTF8ToUTF16(&string_table[record->file_path_index]));
+    r.id = &string_table[record->id_index];
+    r.creation_time = record->creation_time;
+    r.uploaded = record->uploaded;
+    r.last_upload_attempt_time = record->last_upload_attempt_time;
+    r.upload_attempts = record->upload_attempts;
+    r.state = static_cast<ReportState>(record->state);
+    reports_.push_back(r);
+  }
+}
+
+void Metadata::Write() {
+  if (LoggingSeekFile(handle_.get(), SEEK_SET, 0) == -1)
+    return;
+
+  size_t num_records = reports_.size();
+
+  // Fill and write out the header.
+  MetadataFileHeader header;
+  header.magic = kMetadataFileHeaderMagic;
+  header.version = kMetadataFileVersion;
+  header.num_records = base::checked_cast<uint32_t>(num_records);
+  if (!LoggingWriteFile(handle_.get(), &header, sizeof(header)))
+    return;
+
+  // Build the records and string table we're going to write.
+  std::string string_table;
+  scoped_ptr<MetadataFileReportRecord[]> records(
+      new MetadataFileReportRecord[num_records]);
+  for (size_t i = 0; i < num_records; ++i) {
+    const ReportDisk& report = reports_[i];
+    MetadataFileReportRecord& record = records[i];
+    record.uuid = report.uuid;
+    const std::wstring& path = report.file_path.value();
+    if (path.substr(0, report_dir_.value().size()) != report_dir_.value()) {
+      LOG(ERROR) << path.c_str() << " expected to start with "
+                 << report_dir_.value().c_str() << " and does not";
+      return;
+    }
+    record.file_path_index = AddStringToTable(
+        &string_table, path.substr(report_dir_.value().size() + 1));
+    record.id_index = AddStringToTable(&string_table, report.id);
+    record.creation_time = report.creation_time;
+    record.uploaded = report.uploaded;
+    record.last_upload_attempt_time = report.last_upload_attempt_time;
+    record.upload_attempts = report.upload_attempts;
+    record.state = static_cast<uint32_t>(report.state);
+  }
+
+  if (!LoggingWriteFile(handle_.get(),
+                        records.get(),
+                        num_records * sizeof(MetadataFileReportRecord))) {
+    return;
+  }
+  if (!LoggingWriteFile(
+          handle_.get(), string_table.c_str(), string_table.size())) {
+    return;
+  }
+}
+
+void Metadata::AddNewRecord(const ReportDisk& new_report_disk) {
+  DCHECK(new_report_disk.state == ReportState::kPending);
+  reports_.push_back(new_report_disk);
+  dirty_ = true;
+}
+
+OperationStatus Metadata::FindReports(
+    ReportState desired_state,
+    std::vector<const CrashReportDatabase::Report>* reports) {
+  DCHECK(reports->empty());
+  for (const auto& report : reports_) {
+    if (report.state == desired_state) {
+      if (VerifyReport(report, desired_state) != CrashReportDatabase::kNoError)
+        continue;
+      reports->push_back(report);
+    }
+  }
+  return CrashReportDatabase::kNoError;
+}
+
+OperationStatus Metadata::FindSingleReport(const UUID& uuid,
+                                           const ReportDisk** out_report) {
+  for (size_t i = 0; i < reports_.size(); ++i) {
+    if (reports_[i].uuid == uuid) {
+      OperationStatus os = VerifyReportAnyState(reports_[i]);
+      if (os != CrashReportDatabase::kNoError)
+        return os;
+      *out_report = &reports_[i];
+      return CrashReportDatabase::kNoError;
+    }
+  }
+  return CrashReportDatabase::kReportNotFound;
+}
+
+template <class T>
+OperationStatus Metadata::MutateSingleReport(
+    const UUID& uuid,
+    ReportState desired_state,
+    const T& mutator) {
+  for (size_t i = 0; i < reports_.size(); ++i) {
+    if (reports_[i].uuid == uuid) {
+      OperationStatus os = VerifyReport(reports_[i], desired_state);
+      if (os != CrashReportDatabase::kNoError)
+        return os;
+      mutator(&reports_[i]);
+      dirty_ = true;
+      return CrashReportDatabase::kNoError;
+    }
+  }
+  return CrashReportDatabase::kReportNotFound;
+}
+
+// static
+OperationStatus Metadata::VerifyReportAnyState(const ReportDisk& report_disk) {
+  DWORD fileattr = GetFileAttributes(report_disk.file_path.value().c_str());
+  if (fileattr == INVALID_FILE_ATTRIBUTES ||
+      (fileattr & FILE_ATTRIBUTE_DIRECTORY) != 0) {
+    return CrashReportDatabase::kReportNotFound;
+  }
+  return CrashReportDatabase::kNoError;
+}
+
+// static
+OperationStatus Metadata::VerifyReport(const ReportDisk& report_disk,
+                                       ReportState desired_state) {
+  if (report_disk.state != desired_state)
+    return CrashReportDatabase::kBusyError;
+  return VerifyReportAnyState(report_disk);
+}
+
+class CrashReportDatabaseWin : public CrashReportDatabase {
+ public:
+  explicit CrashReportDatabaseWin(const base::FilePath& path);
+  ~CrashReportDatabaseWin() override;
+
+  bool Initialize();
+
+  // CrashReportDatabase:
+  OperationStatus PrepareNewCrashReport(NewReport** report) override;
+  OperationStatus FinishedWritingCrashReport(NewReport* report,
+                                             UUID* uuid) override;
+  OperationStatus ErrorWritingCrashReport(NewReport* report) override;
+  OperationStatus LookUpCrashReport(const UUID& uuid, Report* report) override;
+  OperationStatus GetPendingReports(
+      std::vector<const Report>* reports) override;
+  OperationStatus GetCompletedReports(
+      std::vector<const Report>* reports) override;
+  OperationStatus GetReportForUploading(const UUID& uuid,
+                                        const Report** report) override;
+  OperationStatus RecordUploadAttempt(const Report* report,
+                                      bool successful,
+                                      const std::string& id) override;
+  OperationStatus SkipReportUpload(const UUID& uuid) override;
+
+ private:
+  scoped_ptr<Metadata> AcquireMetadata();
+
+  base::FilePath base_dir_;
+
+  DISALLOW_COPY_AND_ASSIGN(CrashReportDatabaseWin);
+};
+
+CrashReportDatabaseWin::CrashReportDatabaseWin(const base::FilePath& path)
+    : CrashReportDatabase(), base_dir_(path) {
+}
+
+CrashReportDatabaseWin::~CrashReportDatabaseWin() {
+}
+
+bool CrashReportDatabaseWin::Initialize() {
+  // Check if the database already exists.
+  if (!CreateOrEnsureDirectoryExists(base_dir_))
+    return false;
+
+  // Create our reports subdirectory.
+  if (!CreateOrEnsureDirectoryExists(base_dir_.Append(kReportsDirectory)))
+    return false;
+
+  // TODO(scottmg): When are completed reports pruned from disk? Delete here or
+  // maybe on AcquireMetadata().
+
+  return true;
+}
+
+OperationStatus CrashReportDatabaseWin::PrepareNewCrashReport(
+    NewReport** out_report) {
+  scoped_ptr<NewReportDisk> report(new NewReportDisk());
+
+  ::UUID system_uuid;
+  if (UuidCreate(&system_uuid) != RPC_S_OK) {
+    return kFileSystemError;
+  }
+  static_assert(sizeof(system_uuid) == 16, "unexpected system uuid size");
+  static_assert(offsetof(::UUID, Data1) == 0, "unexpected uuid layout");
+  UUID uuid(reinterpret_cast<const uint8_t*>(&system_uuid.Data1));
+
+  report->uuid = uuid;
+  report->path =
+      base_dir_.Append(kReportsDirectory)
+          .Append(uuid.ToWideString() + L"." + kCrashReportFileExtension);
+  report->handle = LoggingOpenFileForWrite(
+      report->path, FileWriteMode::kCreateOrFail, FilePermissions::kOwnerOnly);
+  if (report->handle == INVALID_HANDLE_VALUE)
+    return kFileSystemError;
+
+  *out_report = report.release();
+  return kNoError;
+}
+
+OperationStatus CrashReportDatabaseWin::FinishedWritingCrashReport(
+    NewReport* report,
+    UUID* uuid) {
+  // Take ownership of the report, and cast to our private version with UUID.
+  scoped_ptr<NewReportDisk> scoped_report(static_cast<NewReportDisk*>(report));
+  // Take ownership of the file handle.
+  ScopedFileHandle handle(report->handle);
+
+  scoped_ptr<Metadata> metadata(AcquireMetadata());
+  if (!metadata)
+    return kDatabaseError;
+  ReportDisk report_disk;
+  report_disk.uuid = scoped_report->uuid;
+  report_disk.file_path = scoped_report->path;
+  report_disk.creation_time = time(nullptr);
+  report_disk.state = ReportState::kPending;
+  metadata->AddNewRecord(report_disk);
+  *uuid = report_disk.uuid;
+  return kNoError;
+}
+
+OperationStatus CrashReportDatabaseWin::ErrorWritingCrashReport(
+    NewReport* report) {
+  // Close the outstanding handle.
+  LoggingCloseFile(report->handle);
+
+  // Take ownership of the report, and cast to our private version with UUID.
+  scoped_ptr<NewReportDisk> scoped_report(static_cast<NewReportDisk*>(report));
+
+  // We failed to write, so remove the dump file. There's no entry in the
+  // metadata table yet.
+  if (!DeleteFile(scoped_report->path.value().c_str())) {
+    PLOG(ERROR) << "DeleteFile " << scoped_report->path.value().c_str();
+    return CrashReportDatabase::kFileSystemError;
+  }
+
+  return kNoError;
+}
+
+OperationStatus CrashReportDatabaseWin::LookUpCrashReport(const UUID& uuid,
+                                                          Report* report) {
+  scoped_ptr<Metadata> metadata(AcquireMetadata());
+  if (!metadata)
+    return kDatabaseError;
+  // Find and return a copy of the matching report.
+  const ReportDisk* report_disk;
+  OperationStatus os = metadata->FindSingleReport(uuid, &report_disk);
+  if (os != kNoError)
+    return os;
+  *report = *report_disk;
+  return kNoError;
+}
+
+OperationStatus CrashReportDatabaseWin::GetPendingReports(
+    std::vector<const Report>* reports) {
+  scoped_ptr<Metadata> metadata(AcquireMetadata());
+  if (!metadata)
+    return kDatabaseError;
+  return metadata->FindReports(ReportState::kPending, reports);
+}
+
+OperationStatus CrashReportDatabaseWin::GetCompletedReports(
+    std::vector<const Report>* reports) {
+  scoped_ptr<Metadata> metadata(AcquireMetadata());
+  if (!metadata)
+    return kDatabaseError;
+  return metadata->FindReports(ReportState::kCompleted, reports);
+}
+
+OperationStatus CrashReportDatabaseWin::GetReportForUploading(

[Mark Mentovai, 2015/02/10 22:16:29]

If two handlers wind up running out of the same directory, what protects against
two processes trying to upload the same report? The Mac database deals with this
with a lock on the report file.

[scottmg, 2015/02/10 22:44:01]

If understand the situation you're describing, the metadata file is protected by
the LockFileEx, and only a report that is in state=kPending here will be
returned (with its state then changed to kUploading). So the second requestor
would fail to find a report here and return kBusyError.

[Mark Mentovai, 2015/02/10 22:49:29]

scottmg wrote:
OK, that’s good. Next question: what happens if the uploader crashes? Is there
any way to reap reports that say they’re being uploaded but really aren’t?

[scottmg, 2015/02/10 23:28:37]

Not at the moment. If there's only one uploader it could use a
(not-yet-existing) GetUploadingReports() to either retry or blindly
SkipReportUpload. Similarly, the CrashReportDatabase could do this itself at a
"startup point" by resetting kUploading to kPending, or dropping reports in that
state.

LockFileEx on the report to make it similar to Mac doesn't directly work here
because the handle holds the lock (i.e. a second handle in the same process
doesn't have access). So the uploader would have to be in process and use only
that handle, rather than the current file_path interface.

[Mark Mentovai, 2015/02/10 23:37:03]

I’d actually like to change to an interface where we pass around a FileHandle.
We may still need a FilePath too, so that the uploader can know the filename. I
don’t think that the various parts of the system should have to open the same
file multiple times, and I’m happy for the interface to be a FileHandle instead
of a FilePath.

That’s a lot of churn to tack on to this already-big change, so let’s save it
for now, as long as a broad picture of how this should change is captured here
in a comment.

[scottmg, 2015/02/10 23:54:40]

OK. Attempted to describe what we will need to do here.

[Mark Mentovai, 2015/02/11 00:31:35]

scottmg wrote:
The new comment is good.

+    const UUID& uuid,
+    const Report** report) {
+  scoped_ptr<Metadata> metadata(AcquireMetadata());
+  if (!metadata)
+    return kDatabaseError;
+  return metadata->MutateSingleReport(
+      uuid, ReportState::kPending, [report](ReportDisk* report_disk) {
+        report_disk->state = ReportState::kUploading;
+        // Create a copy for passing back to client. This will be freed in
+        // RecordUploadAttempt.
+        *report = new Report(*report_disk);
+      });
+}
+
+OperationStatus CrashReportDatabaseWin::RecordUploadAttempt(
+    const Report* report,
+    bool successful,
+    const std::string& id) {
+  // Take ownership, allocated in GetReportForUploading.
+  scoped_ptr<const Report> upload_report(report);
+  scoped_ptr<Metadata> metadata(AcquireMetadata());
+  if (!metadata)
+    return kDatabaseError;
+  return metadata->MutateSingleReport(
+      report->uuid,
+      ReportState::kUploading,
+      [successful, id](ReportDisk* report_disk) {
+        report_disk->uploaded = successful;
+        report_disk->id = id;
+        report_disk->last_upload_attempt_time = time(nullptr);
+        report_disk->upload_attempts++;
+        report_disk->state =
+            successful ? ReportState::kCompleted : ReportState::kPending;
+      });
+}
+
+OperationStatus CrashReportDatabaseWin::SkipReportUpload(const UUID& uuid) {
+  scoped_ptr<Metadata> metadata(AcquireMetadata());
+  if (!metadata)
+    return kDatabaseError;
+  return metadata->MutateSingleReport(
+      uuid, ReportState::kPending, [](ReportDisk* report_disk) {
+        report_disk->state = ReportState::kCompleted;
+      });
+}
+
+scoped_ptr<Metadata> CrashReportDatabaseWin::AcquireMetadata() {
+  base::FilePath metadata_file = base_dir_.Append(kMetadataFileName);
+  return Metadata::Create(metadata_file, base_dir_.Append(kReportsDirectory));
+}
+
+}  // namespace
+
+// static
+scoped_ptr<CrashReportDatabase> CrashReportDatabase::Initialize(
+    const base::FilePath& path) {
+  scoped_ptr<CrashReportDatabaseWin> database_win(
+      new CrashReportDatabaseWin(path.Append(kDatabaseDirectoryName)));
+  if (!database_win->Initialize())
+    database_win.reset();
+
+  return scoped_ptr<CrashReportDatabase>(database_win.release());
+}
+
+}  // namespace crashpad