Nuke from orbit corrupt websql databases.

webkit/database/database_tracker.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/database/database_tracker.h"
 
 #include <algorithm>
 #include <vector>
 
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/file_util.h"
 #include "base/message_loop_proxy.h"
 #include "base/platform_file.h"
 #include "base/string_number_conversions.h"
 #include "base/utf_string_conversions.h"
 #include "net/base/net_errors.h"
 #include "sql/connection.h"
 #include "sql/diagnostic_error_delegate.h"
 #include "sql/meta_table.h"
 #include "sql/transaction.h"
+#include "third_party/sqlite/sqlite3.h"
 #include "webkit/database/database_quota_client.h"
 #include "webkit/database/database_util.h"
 #include "webkit/database/databases_table.h"
 #include "webkit/quota/quota_manager.h"
 #include "webkit/quota/special_storage_policy.h"
 
 namespace {
 
 class HistogramUniquifier {
  public:
@@ skipping 140 matching lines @@
     quota_manager_proxy_->NotifyStorageAccessed(
         quota::QuotaClient::kDatabase,
         DatabaseUtil::GetOriginFromIdentifier(origin_identifier),
         quota::kStorageTypeTemporary);
 
   UpdateOpenDatabaseSizeAndNotify(origin_identifier, database_name);
   if (database_connections_.RemoveConnection(origin_identifier, database_name))
     DeleteDatabaseIfNeeded(origin_identifier, database_name);
 }
 
+void DatabaseTracker::HandleSqliteError(
+    const string16& origin_identifier,
+    const string16& database_name,
+    int error) {
+  // We only handle errors that indicate corruption and we
+  // do sp with a heavy hand, we delete it. Any renderers/workers
+  // with this database open will receive a message to close it
+  // immediately, once all have closed, the files will be deleted.
+  // In the interim, all attempts to open a new connection to that
+  // database will fail.

[Scott Hess - ex-Googler, 2012/02/10 23:34:07]

I guess that DeleteDatabase() implements all that message-and-delete-when-done
magic?

[michaeln, 2012/02/11 00:34:20]

Yes

+  if (error == SQLITE_CORRUPT || error == SQLITE_NOTADB) {

[Scott Hess - ex-Googler, 2012/02/10 23:34:07]

The sender also has this guard.  It is definitely needed here, but maybe it
would make sense to not have the check in the sender (forward all errors, and
let the policy decision be made in one place).

[michaeln, 2012/02/11 00:34:20]

That could be, but i'm avoiding necessary messaging with the test in the
renderer. This stuff is called per statement in the renderer.

[Scott Hess - ex-Googler, 2012/02/11 19:48:24]

OK.  In that case, perhaps document that this is security filtering but
otherwise redundant, so that someone doesn't accidentally expect to see other
errors, here.  I'm mixed as to whether that would be better as else
{NOTREACHED();} though.

Another option might be to forward only for error != SQLITE_OK.

Can the client schedule deletes already?  It might make sense to just have the
client do it, then.

+    DeleteDatabase(origin_identifier, database_name,
+                   net::CompletionCallback());
+  }
+}
+
 void DatabaseTracker::CloseDatabases(const DatabaseConnections& connections) {
   if (database_connections_.IsEmpty()) {
     DCHECK(!is_initialized_ || connections.IsEmpty());
     return;
   }
 
   // When being closed by this route, there's a chance that
   // the tracker missed some DatabseModified calls. This method is used
   // when a renderer crashes to cleanup it's open resources.
   // We need to examine what we have in connections for the
@@ skipping 684 matching lines @@
   if (!db_tracker_thread_->BelongsToCurrentThread()) {
     db_tracker_thread_->PostTask(
         FROM_HERE,
         base::Bind(&DatabaseTracker::SaveSessionState, this));
     return;
   }
   save_session_state_ = true;
 }
 
 }  // namespace webkit_database