Improve tracing on OSX and Windows

Improve tracing on OSX and Windows

OSX:
- Make the execve more strict to be able to extract more arguments later.
- Fix the initial trace to be less hacky, add strict handling of the initial
  process.

Windows:
- Only handle files that were opened by the relevant processes. Keep a
  threadid->processid map to be able to figure which process generated the
  Create event.
- Only handle files that were actually opened. Detect this implicitly by
  looking if the file has a Cleanup event and tracking the kernel file object
  instances.
- Add strict handling of the initial process.
- Properly process \\?\ header.

NOTRY=true
R=mad@chromium.org
BUG=98636
TEST=


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=139546

[MAD, 2012-05-30 15:39:00]

LGTM with a small nit on comment language...

https://chromiumcodereview.appspot.com/10448034/diff/3001/tools/isolate/trace...
File tools/isolate/trace_inputs.py (right):

https://chromiumcodereview.appspot.com/10448034/diff/3001/tools/isolate/trace...
tools/isolate/trace_inputs.py:1170: """General wisdom: if a file is closed, it's
because it was opened.
:-)

https://chromiumcodereview.appspot.com/10448034/diff/3001/tools/isolate/trace...
tools/isolate/trace_inputs.py:1198: succeeded so keep track of the file_object
and look if it is closed.
add a coma "," after succeeded please...

"look if it is" -> "check that is is"

[M-A Ruel, 2012-05-30 15:57:16]

https://chromiumcodereview.appspot.com/10448034/diff/3001/tools/isolate/trace...
File tools/isolate/trace_inputs.py (right):

https://chromiumcodereview.appspot.com/10448034/diff/3001/tools/isolate/trace...
tools/isolate/trace_inputs.py:1170: """General wisdom: if a file is closed, it's
because it was opened.
On 2012/05/30 15:39:00, MAD wrote:
> :-)

Note that it is a reference to line 1197, which doesn't return the result code.
:(

https://chromiumcodereview.appspot.com/10448034/diff/3001/tools/isolate/trace...
tools/isolate/trace_inputs.py:1198: succeeded so keep track of the file_object
and look if it is closed.
On 2012/05/30 15:39:00, MAD wrote:
> add a coma "," after succeeded please...
> 
> "look if it is" -> "check that is is"

Changed the wording a little.

[commit-bot: I haz the power, 2012-05-30 15:57:28]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/maruel@chromium.org/10448034/8001

[commit-bot: I haz the power, 2012-05-30 15:58:05]

Change committed as 139546