Nuke from orbit corrupt websql databases.

webkit/database/database_tracker.cc

Index: webkit/database/database_tracker.cc
===================================================================
--- webkit/database/database_tracker.cc	(revision 121034)
+++ webkit/database/database_tracker.cc	(working copy)
@@ -19,6 +19,7 @@
 #include "sql/diagnostic_error_delegate.h"
 #include "sql/meta_table.h"
 #include "sql/transaction.h"
+#include "third_party/sqlite/sqlite3.h"
 #include "webkit/database/database_quota_client.h"
 #include "webkit/database/database_util.h"
 #include "webkit/database/databases_table.h"
@@ -179,6 +180,22 @@
     DeleteDatabaseIfNeeded(origin_identifier, database_name);
 }
 
+void DatabaseTracker::HandleSqliteError(
+    const string16& origin_identifier,
+    const string16& database_name,
+    int error) {
+  // We only handle errors that indicate corruption and we
+  // do sp with a heavy hand, we delete it. Any renderers/workers
+  // with this database open will receive a message to close it
+  // immediately, once all have closed, the files will be deleted.
+  // In the interim, all attempts to open a new connection to that
+  // database will fail.

[Scott Hess - ex-Googler, 2012/02/10 23:34:07]

I guess that DeleteDatabase() implements all that message-and-delete-when-done
magic?

[michaeln, 2012/02/11 00:34:20]

Yes

+  if (error == SQLITE_CORRUPT || error == SQLITE_NOTADB) {

[Scott Hess - ex-Googler, 2012/02/10 23:34:07]

The sender also has this guard.  It is definitely needed here, but maybe it
would make sense to not have the check in the sender (forward all errors, and
let the policy decision be made in one place).

[michaeln, 2012/02/11 00:34:20]

That could be, but i'm avoiding necessary messaging with the test in the
renderer. This stuff is called per statement in the renderer.

[Scott Hess - ex-Googler, 2012/02/11 19:48:24]

OK.  In that case, perhaps document that this is security filtering but
otherwise redundant, so that someone doesn't accidentally expect to see other
errors, here.  I'm mixed as to whether that would be better as else
{NOTREACHED();} though.

Another option might be to forward only for error != SQLITE_OK.

Can the client schedule deletes already?  It might make sense to just have the
client do it, then.

+    DeleteDatabase(origin_identifier, database_name,
+                   net::CompletionCallback());
+  }
+}
+
 void DatabaseTracker::CloseDatabases(const DatabaseConnections& connections) {
   if (database_connections_.IsEmpty()) {
     DCHECK(!is_initialized_ || connections.IsEmpty());