1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "sql/database.h"
12 #include "base/feature_list.h"
13 #include "base/files/file_path.h"
14 #include "base/files/file_util.h"
15 #include "base/format_macros.h"
16 #include "base/location.h"
17 #include "base/logging.h"
18 #include "base/metrics/histogram_functions.h"
19 #include "base/metrics/histogram_macros.h"
20 #include "base/metrics/sparse_histogram.h"
21 #include "base/no_destructor.h"
22 #include "base/numerics/safe_conversions.h"
23 #include "base/single_thread_task_runner.h"
24 #include "base/strings/string_split.h"
25 #include "base/strings/string_util.h"
26 #include "base/strings/stringprintf.h"
27 #include "base/strings/utf_string_conversions.h"
28 #include "base/synchronization/lock.h"
29 #include "base/threading/scoped_blocking_call.h"
30 #include "base/trace_event/memory_dump_manager.h"
31 #include "base/trace_event/trace_event.h"
32 #include "build/build_config.h"
33 #include "sql/database_memory_dump_provider.h"
34 #include "sql/initialization.h"
35 #include "sql/meta_table.h"
36 #include "sql/sql_features.h"
37 #include "sql/statement.h"
38 #include "sql/vfs_wrapper.h"
39 #include "third_party/sqlite/sqlite3.h"
43 // Spin for up to a second waiting for the lock to clear when setting
45 // TODO(shess): Better story on this. http://crbug.com/56559
46 const int kBusyTimeoutSeconds = 1;
48 class ScopedBusyTimeout {
50 explicit ScopedBusyTimeout(sqlite3* db) : db_(db) {}
51 ~ScopedBusyTimeout() { sqlite3_busy_timeout(db_, 0); }
53 int SetTimeout(base::TimeDelta timeout) {
54 DCHECK_LT(timeout.InMilliseconds(), INT_MAX);
55 return sqlite3_busy_timeout(db_,
56 static_cast<int>(timeout.InMilliseconds()));
63 // Helper to "safely" enable writable_schema. No error checking
64 // because it is reasonable to just forge ahead in case of an error.
65 // If turning it on fails, then most likely nothing will work, whereas
66 // if turning it off fails, it only matters if some code attempts to
67 // continue working with the database and tries to modify the
68 // sqlite_master table (none of our code does this).
69 class ScopedWritableSchema {
71 explicit ScopedWritableSchema(sqlite3* db) : db_(db) {
72 sqlite3_exec(db_, "PRAGMA writable_schema=1", nullptr, nullptr, nullptr);
74 ~ScopedWritableSchema() {
75 sqlite3_exec(db_, "PRAGMA writable_schema=0", nullptr, nullptr, nullptr);
82 // Helper to wrap the sqlite3_backup_*() step of Raze(). Return
83 // SQLite error code from running the backup step.
84 int BackupDatabase(sqlite3* src, sqlite3* dst, const char* db_name) {
86 sqlite3_backup* backup = sqlite3_backup_init(dst, db_name, src, db_name);
88 // Since this call only sets things up, this indicates a gross
90 DLOG(DCHECK) << "Unable to start sqlite3_backup(): " << sqlite3_errmsg(dst);
91 return sqlite3_errcode(dst);
94 // -1 backs up the entire database.
95 int rc = sqlite3_backup_step(backup, -1);
96 int pages = sqlite3_backup_pagecount(backup);
97 sqlite3_backup_finish(backup);
99 // If successful, exactly one page should have been backed up. If
100 // this breaks, check this function to make sure assumptions aren't
102 if (rc == SQLITE_DONE)
108 // Be very strict on attachment point. SQLite can handle a much wider
109 // character set with appropriate quoting, but Chromium code should
110 // just use clean names to start with.
111 bool ValidAttachmentPoint(const char* attachment_point) {
112 for (size_t i = 0; attachment_point[i]; ++i) {
113 if (!(base::IsAsciiDigit(attachment_point[i]) ||
114 base::IsAsciiAlpha(attachment_point[i]) ||
115 attachment_point[i] == '_')) {
122 // Helper to get the sqlite3_file* associated with the "main" database.
123 int GetSqlite3File(sqlite3* db, sqlite3_file** file) {
125 int rc = sqlite3_file_control(db, nullptr, SQLITE_FCNTL_FILE_POINTER, file);
129 // TODO(shess): null in file->pMethods has been observed on android_dbg
130 // content_unittests, even though it should not be possible.
131 // http://crbug.com/329982
132 if (!*file || !(*file)->pMethods)
138 // Convenience to get the sqlite3_file* and the size for the "main" database.
139 int GetSqlite3FileAndSize(sqlite3* db,
141 sqlite3_int64* db_size) {
142 int rc = GetSqlite3File(db, file);
146 return (*file)->pMethods->xFileSize(*file, db_size);
149 std::string AsUTF8ForSQL(const base::FilePath& path) {
151 return base::UTF16ToUTF8(path.value());
152 #elif defined(OS_POSIX) || defined(OS_FUCHSIA)
162 Database::ErrorExpecterCallback* Database::current_expecter_cb_ = nullptr;
165 bool Database::IsExpectedSqliteError(int error) {
166 if (!current_expecter_cb_)
168 return current_expecter_cb_->Run(error);
172 void Database::SetErrorExpecter(Database::ErrorExpecterCallback* cb) {
173 CHECK(!current_expecter_cb_);
174 current_expecter_cb_ = cb;
178 void Database::ResetErrorExpecter() {
179 CHECK(current_expecter_cb_);
180 current_expecter_cb_ = nullptr;
184 base::FilePath Database::JournalPath(const base::FilePath& db_path) {
185 return base::FilePath(db_path.value() + FILE_PATH_LITERAL("-journal"));
189 base::FilePath Database::WriteAheadLogPath(const base::FilePath& db_path) {
190 return base::FilePath(db_path.value() + FILE_PATH_LITERAL("-wal"));
194 base::FilePath Database::SharedMemoryFilePath(const base::FilePath& db_path) {
195 return base::FilePath(db_path.value() + FILE_PATH_LITERAL("-shm"));
198 Database::StatementRef::StatementRef(Database* database,
201 : database_(database), stmt_(stmt), was_valid_(was_valid) {
203 database_->StatementRefCreated(this);
206 Database::StatementRef::~StatementRef() {
208 database_->StatementRefDeleted(this);
212 void Database::StatementRef::Close(bool forced) {
214 // Call to InitScopedBlockingCall() cannot go at the beginning of the
215 // function because Close() is called unconditionally from destructor to
216 // clean database_. And if this is inactive statement this won't cause any
217 // disk access and destructor most probably will be called on thread not
218 // allowing disk access.
219 // TODO(paivanof@gmail.com): This should move to the beginning
220 // of the function. http://crbug.com/136655.
221 base::Optional<base::ScopedBlockingCall> scoped_blocking_call;
222 InitScopedBlockingCall(FROM_HERE, &scoped_blocking_call);
223 sqlite3_finalize(stmt_);
226 database_ = nullptr; // The Database may be getting deleted.
228 // Forced close is expected to happen from a statement error
229 // handler. In that case maintain the sense of |was_valid_| which
230 // previously held for this ref.
231 was_valid_ = was_valid_ && forced;
235 Database::kDefaultPageSize == SQLITE_DEFAULT_PAGE_SIZE,
236 "Database::kDefaultPageSize must match the value configured into SQLite");
238 constexpr int Database::kDefaultPageSize;
242 page_size_(kDefaultPageSize),
244 exclusive_locking_(false),
246 base::FeatureList::IsEnabled(features::kEnableWALModeByDefault)),
247 transaction_nesting_(0),
248 needs_rollback_(false),
251 mmap_alt_status_(false),
252 mmap_disabled_(false),
253 mmap_enabled_(false),
254 total_changes_at_last_release_(0),
255 stats_histogram_(nullptr) {}
257 Database::~Database() {
261 void Database::RecordEvent(Events event, size_t count) {
262 for (size_t i = 0; i < count; ++i) {
263 UMA_HISTOGRAM_ENUMERATION("Sqlite.Stats2", event, EVENT_MAX_VALUE);
266 if (stats_histogram_) {
267 for (size_t i = 0; i < count; ++i) {
268 stats_histogram_->Add(event);
273 bool Database::Open(const base::FilePath& path) {
274 TRACE_EVENT1("sql", "Database::Open", "path", path.MaybeAsASCII());
275 return OpenInternal(AsUTF8ForSQL(path), RETRY_ON_POISON);
278 bool Database::OpenInMemory() {
279 TRACE_EVENT0("sql", "Database::OpenInMemory");
281 return OpenInternal(":memory:", NO_RETRY);
284 bool Database::OpenTemporary() {
285 TRACE_EVENT0("sql", "Database::OpenTemporary");
286 return OpenInternal("", NO_RETRY);
289 void Database::CloseInternal(bool forced) {
290 TRACE_EVENT0("sql", "Database::CloseInternal");
291 // TODO(shess): Calling "PRAGMA journal_mode = DELETE" at this point
292 // will delete the -journal file. For ChromiumOS or other more
293 // embedded systems, this is probably not appropriate, whereas on
294 // desktop it might make some sense.
296 // sqlite3_close() needs all prepared statements to be finalized.
298 // Release cached statements.
299 statement_cache_.clear();
301 // With cached statements released, in-use statements will remain.
302 // Closing the database while statements are in use is an API
303 // violation, except for forced close (which happens from within a
304 // statement's error handler).
305 DCHECK(forced || open_statements_.empty());
307 // Deactivate any outstanding statements so sqlite3_close() works.
308 for (StatementRef* statement_ref : open_statements_)
309 statement_ref->Close(forced);
310 open_statements_.clear();
313 // Call to InitScopedBlockingCall() cannot go at the beginning of the
314 // function because Close() must be called from destructor to clean
315 // statement_cache_, it won't cause any disk access and it most probably
316 // will happen on thread not allowing disk access.
317 // TODO(paivanof@gmail.com): This should move to the beginning
318 // of the function. http://crbug.com/136655.
319 base::Optional<base::ScopedBlockingCall> scoped_blocking_call;
320 InitScopedBlockingCall(FROM_HERE, &scoped_blocking_call);
322 // Resetting acquires a lock to ensure no dump is happening on the database
323 // at the same time. Unregister takes ownership of provider and it is safe
324 // since the db is reset. memory_dump_provider_ could be null if db_ was
326 if (memory_dump_provider_) {
327 memory_dump_provider_->ResetDatabase();
328 base::trace_event::MemoryDumpManager::GetInstance()
329 ->UnregisterAndDeleteDumpProviderSoon(
330 std::move(memory_dump_provider_));
333 int rc = sqlite3_close(db_);
334 if (rc != SQLITE_OK) {
335 base::UmaHistogramSparse("Sqlite.CloseFailure", rc);
336 DLOG(DCHECK) << "sqlite3_close failed: " << GetErrorMessage();
342 void Database::Close() {
343 TRACE_EVENT0("sql", "Database::Close");
344 // If the database was already closed by RazeAndClose(), then no
345 // need to close again. Clear the |poisoned_| bit so that incorrect
346 // API calls are caught.
352 CloseInternal(false);
355 void Database::Preload() {
356 TRACE_EVENT0("sql", "Database::Preload");
357 if (base::FeatureList::IsEnabled(features::kSqlSkipPreload))
361 DCHECK(poisoned_) << "Cannot preload null db";
365 base::Optional<base::ScopedBlockingCall> scoped_blocking_call;
366 InitScopedBlockingCall(FROM_HERE, &scoped_blocking_call);
368 // Maximum number of bytes that will be prefetched from the database.
370 // This limit is very aggressive. Here are the trade-offs involved.
371 // 1) Accessing bytes that weren't preread is very expensive on
372 // performance-critical databases, so the limit must exceed the expected
373 // sizes of feature databases.
374 // 2) On some platforms (Windows 7 and, currently, macOS), base::PreReadFile()
375 // falls back to a synchronous read, and blocks until the entire file is
376 // read into memory. So, there's a tangible cost to reading data that would
377 // get evicted before base::PreReadFile() completes. This cost needs to be
378 // balanced with the benefit reading the entire database at once, and
379 // avoiding seeks on spinning disks.
380 constexpr int kPreReadSize = 128 * 1024 * 1024; // 128 MB
381 base::PreReadFile(DbPath(), /*is_executable=*/false, kPreReadSize);
384 // SQLite keeps unused pages associated with a database in a cache. It asks
385 // the cache for pages by an id, and if the page is present and the database is
386 // unchanged, it considers the content of the page valid and doesn't read it
387 // from disk. When memory-mapped I/O is enabled, on read SQLite uses page
388 // structures created from the memory map data before consulting the cache. On
389 // write SQLite creates a new in-memory page structure, copies the data from the
390 // memory map, and later writes it, releasing the updated page back to the
393 // This means that in memory-mapped mode, the contents of the cached pages are
394 // not re-used for reads, but they are re-used for writes if the re-written page
395 // is still in the cache. The implementation of sqlite3_db_release_memory() as
396 // of SQLite 3.8.7.4 frees all pages from pcaches associated with the
397 // database, so it should free these pages.
399 // Unfortunately, the zero page is also freed. That page is never accessed
400 // using memory-mapped I/O, and the cached copy can be re-used after verifying
401 // the file change counter on disk. Also, fresh pages from cache receive some
402 // pager-level initialization before they can be used. Since the information
403 // involved will immediately be accessed in various ways, it is unclear if the
404 // additional overhead is material, or just moving processor cache effects
407 // TODO(shess): It would be better to release the pages immediately when they
408 // are no longer needed. This would basically happen after SQLite commits a
409 // transaction. I had implemented a pcache wrapper to do this, but it involved
410 // layering violations, and it had to be setup before any other sqlite call,
411 // which was brittle. Also, for large files it would actually make sense to
412 // maintain the existing pcache behavior for blocks past the memory-mapped
413 // segment. I think drh would accept a reasonable implementation of the overall
414 // concept for upstreaming to SQLite core.
416 // TODO(shess): Another possibility would be to set the cache size small, which
417 // would keep the zero page around, plus some pre-initialized pages, and SQLite
418 // can manage things. The downside is that updates larger than the cache would
419 // spill to the journal. That could be compensated by setting cache_spill to
420 // false. The downside then is that it allows open-ended use of memory for
421 // large transactions.
422 void Database::ReleaseCacheMemoryIfNeeded(bool implicit_change_performed) {
423 TRACE_EVENT0("sql", "Database::ReleaseCacheMemoryIfNeeded");
424 // The database could have been closed during a transaction as part of error
427 DCHECK(poisoned_) << "Illegal use of Database without a db";
431 // If memory-mapping is not enabled, the page cache helps performance.
435 // On caller request, force the change comparison to fail. Done before the
436 // transaction-nesting test so that the signal can carry to transaction
438 if (implicit_change_performed)
439 --total_changes_at_last_release_;
441 // Cached pages may be re-used within the same transaction.
442 if (transaction_nesting())
445 // If no changes have been made, skip flushing. This allows the first page of
446 // the database to remain in cache across multiple reads.
447 const int total_changes = sqlite3_total_changes(db_);
448 if (total_changes == total_changes_at_last_release_)
451 total_changes_at_last_release_ = total_changes;
452 sqlite3_db_release_memory(db_);
455 base::FilePath Database::DbPath() const {
457 return base::FilePath();
459 const char* path = sqlite3_db_filename(db_, "main");
460 const base::StringPiece db_path(path);
462 return base::FilePath(base::UTF8ToUTF16(db_path));
463 #elif defined(OS_POSIX) || defined(OS_FUCHSIA)
464 return base::FilePath(db_path);
467 return base::FilePath();
471 std::string Database::CollectErrorInfo(int error, Statement* stmt) const {
472 TRACE_EVENT0("sql", "Database::CollectErrorInfo");
473 // Buffer for accumulating debugging info about the error. Place
474 // more-relevant information earlier, in case things overflow the
475 // fixed-size reporting buffer.
476 std::string debug_info;
478 // The error message from the failed operation.
479 base::StringAppendF(&debug_info, "db error: %d/%s\n", GetErrorCode(),
482 // TODO(shess): |error| and |GetErrorCode()| should always be the same, but
483 // reading code does not entirely convince me. Remove if they turn out to be
485 if (error != GetErrorCode())
486 base::StringAppendF(&debug_info, "reported error: %d\n", error);
488 // System error information. Interpretation of Windows errors is different
491 base::StringAppendF(&debug_info, "LastError: %d\n", GetLastErrno());
492 #elif defined(OS_POSIX) || defined(OS_FUCHSIA)
493 base::StringAppendF(&debug_info, "errno: %d\n", GetLastErrno());
495 NOTREACHED(); // Add appropriate log info.
499 base::StringAppendF(&debug_info, "statement: %s\n",
500 stmt->GetSQLStatement());
502 base::StringAppendF(&debug_info, "statement: NULL\n");
505 // SQLITE_ERROR often indicates some sort of mismatch between the statement
506 // and the schema, possibly due to a failed schema migration.
507 if (error == SQLITE_ERROR) {
508 static const char kVersionSql[] =
509 "SELECT value FROM meta WHERE key='version'";
510 sqlite3_stmt* sqlite_statement;
511 // When the number of bytes passed to sqlite3_prepare_v3() includes the null
512 // terminator, SQLite avoids a buffer copy.
513 int rc = sqlite3_prepare_v3(db_, kVersionSql, sizeof(kVersionSql),
514 SQLITE_PREPARE_NO_VTAB, &sqlite_statement,
515 /* pzTail= */ nullptr);
516 if (rc == SQLITE_OK) {
517 rc = sqlite3_step(sqlite_statement);
518 if (rc == SQLITE_ROW) {
519 base::StringAppendF(&debug_info, "version: %d\n",
520 sqlite3_column_int(sqlite_statement, 0));
521 } else if (rc == SQLITE_DONE) {
522 debug_info += "version: none\n";
524 base::StringAppendF(&debug_info, "version: error %d\n", rc);
526 sqlite3_finalize(sqlite_statement);
528 base::StringAppendF(&debug_info, "version: prepare error %d\n", rc);
531 debug_info += "schema:\n";
533 // sqlite_master has columns:
534 // type - "index" or "table".
535 // name - name of created element.
536 // tbl_name - name of element, or target table in case of index.
537 // rootpage - root page of the element in database file.
538 // sql - SQL to create the element.
539 // In general, the |sql| column is sufficient to derive the other columns.
540 // |rootpage| is not interesting for debugging, without the contents of the
541 // database. The COALESCE is because certain automatic elements will have a
542 // |name| but no |sql|,
543 static const char kSchemaSql[] =
544 "SELECT COALESCE(sql,name) FROM sqlite_master";
545 rc = sqlite3_prepare_v3(db_, kSchemaSql, sizeof(kSchemaSql),
546 SQLITE_PREPARE_NO_VTAB, &sqlite_statement,
547 /* pzTail= */ nullptr);
548 if (rc == SQLITE_OK) {
549 while ((rc = sqlite3_step(sqlite_statement)) == SQLITE_ROW) {
550 base::StringAppendF(&debug_info, "%s\n",
551 sqlite3_column_text(sqlite_statement, 0));
553 if (rc != SQLITE_DONE)
554 base::StringAppendF(&debug_info, "error %d\n", rc);
555 sqlite3_finalize(sqlite_statement);
557 base::StringAppendF(&debug_info, "prepare error %d\n", rc);
564 // TODO(shess): Since this is only called in an error situation, it might be
565 // prudent to rewrite in terms of SQLite API calls, and mark the function const.
566 std::string Database::CollectCorruptionInfo() {
567 TRACE_EVENT0("sql", "Database::CollectCorruptionInfo");
568 // If the file cannot be accessed it is unlikely that an integrity check will
569 // turn up actionable information.
570 const base::FilePath db_path = DbPath();
571 int64_t db_size = -1;
572 if (!base::GetFileSize(db_path, &db_size) || db_size < 0)
573 return std::string();
575 // Buffer for accumulating debugging info about the error. Place
576 // more-relevant information earlier, in case things overflow the
577 // fixed-size reporting buffer.
578 std::string debug_info;
579 base::StringAppendF(&debug_info, "SQLITE_CORRUPT, db size %" PRId64 "\n",
582 // Only check files up to 8M to keep things from blocking too long.
583 const int64_t kMaxIntegrityCheckSize = 8192 * 1024;
584 if (db_size > kMaxIntegrityCheckSize) {
585 debug_info += "integrity_check skipped due to size\n";
587 std::vector<std::string> messages;
589 // TODO(shess): FullIntegrityCheck() splits into a vector while this joins
590 // into a string. Probably should be refactored.
591 const base::TimeTicks before = base::TimeTicks::Now();
592 FullIntegrityCheck(&messages);
594 &debug_info, "integrity_check %" PRId64 " ms, %" PRIuS " records:\n",
595 (base::TimeTicks::Now() - before).InMilliseconds(), messages.size());
597 // SQLite returns up to 100 messages by default, trim deeper to
598 // keep close to the 2000-character size limit for dumping.
599 const size_t kMaxMessages = 20;
600 for (size_t i = 0; i < kMaxMessages && i < messages.size(); ++i) {
601 base::StringAppendF(&debug_info, "%s\n", messages[i].c_str());
608 bool Database::GetMmapAltStatus(int64_t* status) {
609 TRACE_EVENT0("sql", "Database::GetMmapAltStatus");
611 // The [meta] version uses a missing table as a signal for a fresh database.
612 // That will not work for the view, which would not exist in either a new or
613 // an existing database. A new database _should_ be only one page long, so
614 // just don't bother optimizing this case (start at offset 0).
615 // TODO(shess): Could the [meta] case also get simpler, then?
616 if (!DoesViewExist("MmapStatus")) {
621 const char* kMmapStatusSql = "SELECT * FROM MmapStatus";
622 Statement s(GetUniqueStatement(kMmapStatusSql));
624 *status = s.ColumnInt64(0);
625 return s.Succeeded();
628 bool Database::SetMmapAltStatus(int64_t status) {
629 if (!BeginTransaction())
632 // View may not exist on first run.
633 if (!Execute("DROP VIEW IF EXISTS MmapStatus")) {
634 RollbackTransaction();
638 // Views live in the schema, so they cannot be parameterized. For an integer
639 // value, this construct should be safe from SQL injection, if the value
640 // becomes more complicated use "SELECT quote(?)" to generate a safe quoted
642 const std::string create_view_sql = base::StringPrintf(
643 "CREATE VIEW MmapStatus (value) AS SELECT %" PRId64, status);
644 if (!Execute(create_view_sql.c_str())) {
645 RollbackTransaction();
649 return CommitTransaction();
652 size_t Database::GetAppropriateMmapSize() {
653 TRACE_EVENT0("sql", "Database::GetAppropriateMmapSize");
655 base::Optional<base::ScopedBlockingCall> scoped_blocking_call;
656 InitScopedBlockingCall(FROM_HERE, &scoped_blocking_call);
658 // How much to map if no errors are found. 50MB encompasses the 99th
659 // percentile of Chrome databases in the wild, so this should be good.
660 const size_t kMmapEverything = 256 * 1024 * 1024;
662 // Progress information is tracked in the [meta] table for databases which use
663 // sql::MetaTable, otherwise it is tracked in a special view.
664 // TODO(shess): Move all cases to the view implementation.
665 int64_t mmap_ofs = 0;
666 if (mmap_alt_status_) {
667 if (!GetMmapAltStatus(&mmap_ofs)) {
668 RecordOneEvent(EVENT_MMAP_STATUS_FAILURE_READ);
672 // If [meta] doesn't exist, yet, it's a new database, assume the best.
673 // sql::MetaTable::Init() will preload kMmapSuccess.
674 if (!MetaTable::DoesTableExist(this)) {
675 RecordOneEvent(EVENT_MMAP_META_MISSING);
676 return kMmapEverything;
679 if (!MetaTable::GetMmapStatus(this, &mmap_ofs)) {
680 RecordOneEvent(EVENT_MMAP_META_FAILURE_READ);
685 // Database read failed in the past, don't memory map.
686 if (mmap_ofs == MetaTable::kMmapFailure) {
687 RecordOneEvent(EVENT_MMAP_FAILED);
691 if (mmap_ofs != MetaTable::kMmapSuccess) {
692 // Continue reading from previous offset.
693 DCHECK_GE(mmap_ofs, 0);
695 // TODO(shess): Could this reading code be shared with Preload()? It would
696 // require locking twice (this code wouldn't be able to access |db_size| so
697 // the helper would have to return amount read).
699 // Read more of the database looking for errors. The VFS interface is used
700 // to assure that the reads are valid for SQLite. |g_reads_allowed| is used
701 // to limit checking to 20MB per run of Chromium.
702 sqlite3_file* file = nullptr;
703 sqlite3_int64 db_size = 0;
704 if (SQLITE_OK != GetSqlite3FileAndSize(db_, &file, &db_size)) {
705 RecordOneEvent(EVENT_MMAP_VFS_FAILURE);
709 // Read the data left, or |g_reads_allowed|, whichever is smaller.
710 // |g_reads_allowed| limits the total amount of I/O to spend verifying data
711 // in a single Chromium run.
712 sqlite3_int64 amount = db_size - mmap_ofs;
716 static base::NoDestructor<base::Lock> lock;
717 base::AutoLock auto_lock(*lock);
718 static sqlite3_int64 g_reads_allowed = 20 * 1024 * 1024;
719 if (g_reads_allowed < amount)
720 amount = g_reads_allowed;
721 g_reads_allowed -= amount;
724 // |amount| can be <= 0 if |g_reads_allowed| ran out of quota, or if the
725 // database was truncated after a previous pass.
726 if (amount <= 0 && mmap_ofs < db_size) {
727 DCHECK_EQ(0, amount);
729 static const int kPageSize = 4096;
732 int rc = file->pMethods->xRead(file, buf, sizeof(buf), mmap_ofs);
733 if (rc == SQLITE_OK) {
734 mmap_ofs += sizeof(buf);
735 amount -= sizeof(buf);
736 } else if (rc == SQLITE_IOERR_SHORT_READ) {
737 // Reached EOF for a database with page size < |kPageSize|.
741 // TODO(shess): Consider calling OnSqliteError().
742 mmap_ofs = MetaTable::kMmapFailure;
747 // Log these events after update to distinguish meta update failure.
748 if (mmap_ofs >= db_size) {
749 mmap_ofs = MetaTable::kMmapSuccess;
751 DCHECK(mmap_ofs > 0 || mmap_ofs == MetaTable::kMmapFailure);
754 if (mmap_alt_status_) {
755 if (!SetMmapAltStatus(mmap_ofs)) {
756 RecordOneEvent(EVENT_MMAP_STATUS_FAILURE_UPDATE);
760 if (!MetaTable::SetMmapStatus(this, mmap_ofs)) {
761 RecordOneEvent(EVENT_MMAP_META_FAILURE_UPDATE);
766 if (mmap_ofs == MetaTable::kMmapFailure)
767 RecordOneEvent(EVENT_MMAP_FAILED_NEW);
771 if (mmap_ofs == MetaTable::kMmapFailure)
773 if (mmap_ofs == MetaTable::kMmapSuccess)
774 return kMmapEverything;
778 void Database::TrimMemory() {
779 TRACE_EVENT0("sql", "Database::TrimMemory");
784 sqlite3_db_release_memory(db_);
786 // It is tempting to use sqlite3_release_memory() here as well. However, the
787 // API is documented to be a no-op unless SQLite is built with
788 // SQLITE_ENABLE_MEMORY_MANAGEMENT. We do not use this option, because it is
789 // incompatible with per-database page cache pools. Behind the scenes,
790 // SQLITE_ENABLE_MEMORY_MANAGEMENT causes SQLite to use a global page cache
791 // pool, and sqlite3_release_memory() releases unused pages from this global
795 // Create an in-memory database with the existing database's page
796 // size, then backup that database over the existing database.
797 bool Database::Raze() {
798 TRACE_EVENT0("sql", "Database::Raze");
800 base::Optional<base::ScopedBlockingCall> scoped_blocking_call;
801 InitScopedBlockingCall(FROM_HERE, &scoped_blocking_call);
804 DCHECK(poisoned_) << "Cannot raze null db";
808 if (transaction_nesting_ > 0) {
809 DLOG(DCHECK) << "Cannot raze within a transaction";
813 sql::Database null_db;
814 if (!null_db.OpenInMemory()) {
815 DLOG(DCHECK) << "Unable to open in-memory database.";
819 const std::string page_size_sql =
820 base::StringPrintf("PRAGMA page_size=%d", page_size_);
821 if (!null_db.Execute(page_size_sql.c_str()))
824 #if defined(OS_ANDROID)
825 // Android compiles with SQLITE_DEFAULT_AUTOVACUUM. Unfortunately,
826 // in-memory databases do not respect this define.
827 // TODO(shess): Figure out a way to set this without using platform
828 // specific code. AFAICT from sqlite3.c, the only way to do it
829 // would be to create an actual filesystem database, which is
831 if (!null_db.Execute("PRAGMA auto_vacuum = 1"))
835 // The page size doesn't take effect until a database has pages, and
836 // at this point the null database has none. Changing the schema
837 // version will create the first page. This will not affect the
838 // schema version in the resulting database, as SQLite's backup
839 // implementation propagates the schema version from the original
840 // database to the new version of the database, incremented by one
841 // so that other readers see the schema change and act accordingly.
842 if (!null_db.Execute("PRAGMA schema_version = 1"))
845 // SQLite tracks the expected number of database pages in the first
846 // page, and if it does not match the total retrieved from a
847 // filesystem call, treats the database as corrupt. This situation
848 // breaks almost all SQLite calls. "PRAGMA writable_schema" can be
849 // used to hint to SQLite to soldier on in that case, specifically
850 // for purposes of recovery. [See SQLITE_CORRUPT_BKPT case in
851 // sqlite3.c lockBtree().]
852 // TODO(shess): With this, "PRAGMA auto_vacuum" and "PRAGMA
853 // page_size" can be used to query such a database.
854 ScopedWritableSchema writable_schema(db_);
857 // On Windows, truncate silently fails when applied to memory-mapped files.
858 // Disable memory-mapping so that the truncate succeeds. Note that other
859 // Database connections may have memory-mapped the file, so this may not
860 // entirely prevent the problem.
861 // [Source: <https://sqlite.org/mmap.html> plus experiments.]
862 ignore_result(Execute("PRAGMA mmap_size = 0"));
865 const char* kMain = "main";
866 int rc = BackupDatabase(null_db.db_, db_, kMain);
867 base::UmaHistogramSparse("Sqlite.RazeDatabase", rc);
869 // The destination database was locked.
870 if (rc == SQLITE_BUSY) {
874 // SQLITE_NOTADB can happen if page 1 of db_ exists, but is not
875 // formatted correctly. SQLITE_IOERR_SHORT_READ can happen if db_
876 // isn't even big enough for one page. Either way, reach in and
877 // truncate it before trying again.
878 // TODO(shess): Maybe it would be worthwhile to just truncate from
880 if (rc == SQLITE_NOTADB || rc == SQLITE_IOERR_SHORT_READ) {
881 sqlite3_file* file = nullptr;
882 rc = GetSqlite3File(db_, &file);
883 if (rc != SQLITE_OK) {
884 DLOG(DCHECK) << "Failure getting file handle.";
888 rc = file->pMethods->xTruncate(file, 0);
889 if (rc != SQLITE_OK) {
890 base::UmaHistogramSparse("Sqlite.RazeDatabaseTruncate", rc);
891 DLOG(DCHECK) << "Failed to truncate file.";
895 rc = BackupDatabase(null_db.db_, db_, kMain);
896 base::UmaHistogramSparse("Sqlite.RazeDatabase2", rc);
898 DCHECK_EQ(rc, SQLITE_DONE) << "Failed retrying Raze().";
901 // Page size of |db_| and |null_db| differ.
902 if (rc == SQLITE_READONLY) {
903 // Enter TRUNCATE mode to change page size.
904 // TODO(shuagga@microsoft.com): Need a guarantee here that there is no other
905 // database connection open.
906 ignore_result(Execute("PRAGMA journal_mode=TRUNCATE;"));
907 if (!Execute(page_size_sql.c_str())) {
910 // Page size isn't changed until the database is vacuumed.
911 ignore_result(Execute("VACUUM"));
912 // Re-enter WAL mode.
914 ignore_result(Execute("PRAGMA journal_mode=WAL;"));
917 rc = BackupDatabase(null_db.db_, db_, kMain);
918 base::UmaHistogramSparse("Sqlite.RazeDatabase2", rc);
920 DCHECK_EQ(rc, SQLITE_DONE) << "Failed retrying Raze().";
923 // TODO(shess): Figure out which other cases can happen.
924 DCHECK_EQ(rc, SQLITE_DONE) << "Unable to copy entire null database.";
926 // Checkpoint to propagate transactions to the database file and empty the WAL
928 // The database can still contain old data if the Checkpoint fails so fail the
930 if (!CheckpointDatabase()) {
934 // The entire database should have been backed up.
935 return rc == SQLITE_DONE;
938 bool Database::RazeAndClose() {
939 TRACE_EVENT0("sql", "Database::RazeAndClose");
942 DCHECK(poisoned_) << "Cannot raze null db";
946 // Raze() cannot run in a transaction.
947 RollbackAllTransactions();
949 bool result = Raze();
953 // Mark the database so that future API calls fail appropriately,
954 // but don't DCHECK (because after calling this function they are
955 // expected to fail).
961 void Database::Poison() {
962 TRACE_EVENT0("sql", "Database::Poison");
965 DCHECK(poisoned_) << "Cannot poison null db";
969 RollbackAllTransactions();
972 // Mark the database so that future API calls fail appropriately,
973 // but don't DCHECK (because after calling this function they are
974 // expected to fail).
978 // TODO(shess): To the extent possible, figure out the optimal
979 // ordering for these deletes which will prevent other Database connections
980 // from seeing odd behavior. For instance, it may be necessary to
981 // manually lock the main database file in a SQLite-compatible fashion
982 // (to prevent other processes from opening it), then delete the
983 // journal files, then delete the main database file. Another option
984 // might be to lock the main database file and poison the header with
985 // junk to prevent other processes from opening it successfully (like
986 // Gears "SQLite poison 3" trick).
989 bool Database::Delete(const base::FilePath& path) {
990 TRACE_EVENT1("sql", "Database::Delete", "path", path.MaybeAsASCII());
992 base::ScopedBlockingCall scoped_blocking_call(FROM_HERE,
993 base::BlockingType::MAY_BLOCK);
995 base::FilePath journal_path = Database::JournalPath(path);
996 base::FilePath wal_path = Database::WriteAheadLogPath(path);
998 std::string journal_str = AsUTF8ForSQL(journal_path);
999 std::string wal_str = AsUTF8ForSQL(wal_path);
1000 std::string path_str = AsUTF8ForSQL(path);
1002 EnsureSqliteInitialized();
1004 sqlite3_vfs* vfs = sqlite3_vfs_find(nullptr);
1006 CHECK(vfs->xDelete);
1007 CHECK(vfs->xAccess);
1009 // We only work with unix, win32 and mojo filesystems. If you're trying to
1010 // use this code with any other VFS, you're not in a good place.
1011 CHECK(strncmp(vfs->zName, "unix", 4) == 0 ||
1012 strncmp(vfs->zName, "win32", 5) == 0 ||
1013 strcmp(vfs->zName, "mojo") == 0);
1015 vfs->xDelete(vfs, journal_str.c_str(), 0);
1016 vfs->xDelete(vfs, wal_str.c_str(), 0);
1017 vfs->xDelete(vfs, path_str.c_str(), 0);
1019 int journal_exists = 0;
1020 vfs->xAccess(vfs, journal_str.c_str(), SQLITE_ACCESS_EXISTS, &journal_exists);
1023 vfs->xAccess(vfs, wal_str.c_str(), SQLITE_ACCESS_EXISTS, &wal_exists);
1025 int path_exists = 0;
1026 vfs->xAccess(vfs, path_str.c_str(), SQLITE_ACCESS_EXISTS, &path_exists);
1028 return !journal_exists && !wal_exists && !path_exists;
1031 bool Database::BeginTransaction() {
1032 TRACE_EVENT0("sql", "Database::BeginTransaction");
1034 if (needs_rollback_) {
1035 DCHECK_GT(transaction_nesting_, 0);
1037 // When we're going to rollback, fail on this begin and don't actually
1038 // mark us as entering the nested transaction.
1042 bool success = true;
1043 if (!transaction_nesting_) {
1044 needs_rollback_ = false;
1046 Statement begin(GetCachedStatement(SQL_FROM_HERE, "BEGIN TRANSACTION"));
1050 transaction_nesting_++;
1054 void Database::RollbackTransaction() {
1055 TRACE_EVENT0("sql", "Database::RollbackTransaction");
1057 if (!transaction_nesting_) {
1058 DCHECK(poisoned_) << "Rolling back a nonexistent transaction";
1062 transaction_nesting_--;
1064 if (transaction_nesting_ > 0) {
1065 // Mark the outermost transaction as needing rollback.
1066 needs_rollback_ = true;
1073 bool Database::CommitTransaction() {
1074 TRACE_EVENT0("sql", "Database::CommitTransaction");
1076 if (!transaction_nesting_) {
1077 DCHECK(poisoned_) << "Committing a nonexistent transaction";
1080 transaction_nesting_--;
1082 if (transaction_nesting_ > 0) {
1083 // Mark any nested transactions as failing after we've already got one.
1084 return !needs_rollback_;
1087 if (needs_rollback_) {
1092 Statement commit(GetCachedStatement(SQL_FROM_HERE, "COMMIT"));
1094 bool succeeded = commit.Run();
1096 // Release dirty cache pages after the transaction closes.
1097 ReleaseCacheMemoryIfNeeded(false);
1102 void Database::RollbackAllTransactions() {
1103 TRACE_EVENT0("sql", "Database::RollbackAllTransactions");
1105 if (transaction_nesting_ > 0) {
1106 transaction_nesting_ = 0;
1111 bool Database::AttachDatabase(const base::FilePath& other_db_path,
1112 const char* attachment_point,
1114 TRACE_EVENT0("sql", "Database::AttachDatabase");
1116 DCHECK(ValidAttachmentPoint(attachment_point));
1118 Statement s(GetUniqueStatement("ATTACH DATABASE ? AS ?"));
1120 s.BindString16(0, other_db_path.value());
1121 #elif defined(OS_POSIX) || defined(OS_FUCHSIA)
1122 s.BindString(0, other_db_path.value());
1124 #error Unsupported platform
1126 s.BindString(1, attachment_point);
1130 bool Database::DetachDatabase(const char* attachment_point, InternalApiToken) {
1131 TRACE_EVENT0("sql", "Database::DetachDatabase");
1133 DCHECK(ValidAttachmentPoint(attachment_point));
1135 Statement s(GetUniqueStatement("DETACH DATABASE ?"));
1136 s.BindString(0, attachment_point);
1140 // TODO(shess): Consider changing this to execute exactly one statement. If a
1141 // caller wishes to execute multiple statements, that should be explicit, and
1142 // perhaps tucked into an explicit transaction with rollback in case of error.
1143 int Database::ExecuteAndReturnErrorCode(const char* sql) {
1144 TRACE_EVENT0("sql", "Database::ExecuteAndReturnErrorCode");
1149 DCHECK(poisoned_) << "Illegal use of Database without a db";
1150 return SQLITE_ERROR;
1153 base::Optional<base::ScopedBlockingCall> scoped_blocking_call;
1154 InitScopedBlockingCall(FROM_HERE, &scoped_blocking_call);
1157 while ((rc == SQLITE_OK) && *sql) {
1158 sqlite3_stmt* sqlite_statement;
1159 const char* leftover_sql;
1160 rc = sqlite3_prepare_v3(db_, sql, /* nByte= */ -1, /* prepFlags= */ 0,
1161 &sqlite_statement, &leftover_sql);
1162 // Stop if an error is encountered.
1163 if (rc != SQLITE_OK)
1168 // This happens if |sql| originally only contained comments or whitespace.
1169 // TODO(shess): Audit to see if this can become a DCHECK(). Having
1170 // extraneous comments and whitespace in the SQL statements increases
1171 // runtime cost and can easily be shifted out to the C++ layer.
1172 if (!sqlite_statement)
1175 while ((rc = sqlite3_step(sqlite_statement)) == SQLITE_ROW) {
1176 // TODO(shess): Audit to see if this can become a DCHECK. I think PRAGMA
1177 // is the only legitimate case for this. Previously recorded histograms
1178 // show significant use of this code path.
1181 // sqlite3_finalize() returns SQLITE_OK if the most recent sqlite3_step()
1182 // returned SQLITE_DONE or SQLITE_ROW, otherwise the error code.
1183 rc = sqlite3_finalize(sqlite_statement);
1185 // sqlite3_exec() does this, presumably to avoid spinning the parser for
1186 // trailing whitespace.
1187 // TODO(shess): Audit to see if this can become a DCHECK.
1188 while (base::IsAsciiWhitespace(*sql)) {
1193 // Most calls to Execute() modify the database. The main exceptions would be
1194 // calls such as CREATE TABLE IF NOT EXISTS which could modify the database
1195 // but sometimes don't.
1196 ReleaseCacheMemoryIfNeeded(true);
1201 bool Database::Execute(const char* sql) {
1202 TRACE_EVENT1("sql", "Database::Execute", "query", TRACE_STR_COPY(sql));
1205 DCHECK(poisoned_) << "Illegal use of Database without a db";
1209 int error = ExecuteAndReturnErrorCode(sql);
1210 if (error != SQLITE_OK)
1211 error = OnSqliteError(error, nullptr, sql);
1213 // This needs to be a FATAL log because the error case of arriving here is
1214 // that there's a malformed SQL statement. This can arise in development if
1215 // a change alters the schema but not all queries adjust. This can happen
1216 // in production if the schema is corrupted.
1217 DCHECK_NE(error, SQLITE_ERROR)
1218 << "SQL Error in " << sql << ", " << GetErrorMessage();
1219 return error == SQLITE_OK;
1222 bool Database::ExecuteWithTimeout(const char* sql, base::TimeDelta timeout) {
1223 TRACE_EVENT0("sql", "Database::ExecuteWithTimeout");
1226 DCHECK(poisoned_) << "Illegal use of Database without a db";
1230 ScopedBusyTimeout busy_timeout(db_);
1231 busy_timeout.SetTimeout(timeout);
1232 return Execute(sql);
1235 scoped_refptr<Database::StatementRef> Database::GetCachedStatement(
1238 auto it = statement_cache_.find(id);
1239 if (it != statement_cache_.end()) {
1240 // Statement is in the cache. It should still be valid. We're the only
1241 // entity invalidating cached statements, and we remove them from the cache
1243 DCHECK(it->second->is_valid());
1244 DCHECK_EQ(std::string(sqlite3_sql(it->second->stmt())), std::string(sql))
1245 << "GetCachedStatement used with same ID but different SQL";
1247 // Reset the statement so it can be reused.
1248 sqlite3_reset(it->second->stmt());
1252 scoped_refptr<StatementRef> statement = GetUniqueStatement(sql);
1253 if (statement->is_valid()) {
1254 statement_cache_[id] = statement; // Only cache valid statements.
1255 DCHECK_EQ(std::string(sqlite3_sql(statement->stmt())), std::string(sql))
1256 << "Input SQL does not match SQLite's normalized version";
1261 scoped_refptr<Database::StatementRef> Database::GetUniqueStatement(
1263 return GetStatementImpl(this, sql);
1266 scoped_refptr<Database::StatementRef> Database::GetStatementImpl(
1267 sql::Database* tracking_db,
1268 const char* sql) const {
1270 DCHECK(!tracking_db || tracking_db == this);
1272 // Return inactive statement.
1274 return base::MakeRefCounted<StatementRef>(nullptr, nullptr, poisoned_);
1276 base::Optional<base::ScopedBlockingCall> scoped_blocking_call;
1277 InitScopedBlockingCall(FROM_HERE, &scoped_blocking_call);
1279 // TODO(pwnall): Cached statements (but not unique statements) should be
1280 // prepared with prepFlags set to SQLITE_PREPARE_PERSISTENT.
1281 sqlite3_stmt* sqlite_statement;
1282 int rc = sqlite3_prepare_v3(db_, sql, /* nByte= */ -1, /* prepFlags= */ 0,
1283 &sqlite_statement, /* pzTail= */ nullptr);
1284 if (rc != SQLITE_OK) {
1285 // This is evidence of a syntax error in the incoming SQL.
1286 DCHECK_NE(rc, SQLITE_ERROR) << "SQL compile error " << GetErrorMessage();
1288 // It could also be database corruption.
1289 OnSqliteError(rc, nullptr, sql);
1290 return base::MakeRefCounted<StatementRef>(nullptr, nullptr, false);
1292 return base::MakeRefCounted<StatementRef>(tracking_db, sqlite_statement,
1296 scoped_refptr<Database::StatementRef> Database::GetUntrackedStatement(
1297 const char* sql) const {
1298 return GetStatementImpl(nullptr, sql);
1301 std::string Database::GetSchema() const {
1302 // The ORDER BY should not be necessary, but relying on organic
1303 // order for something like this is questionable.
1304 static const char kSql[] =
1305 "SELECT type, name, tbl_name, sql "
1306 "FROM sqlite_master ORDER BY 1, 2, 3, 4";
1307 Statement statement(GetUntrackedStatement(kSql));
1310 while (statement.Step()) {
1311 schema += statement.ColumnString(0);
1313 schema += statement.ColumnString(1);
1315 schema += statement.ColumnString(2);
1317 schema += statement.ColumnString(3);
1324 bool Database::IsSQLValid(const char* sql) {
1325 base::Optional<base::ScopedBlockingCall> scoped_blocking_call;
1326 InitScopedBlockingCall(FROM_HERE, &scoped_blocking_call);
1328 DCHECK(poisoned_) << "Illegal use of Database without a db";
1332 sqlite3_stmt* sqlite_statement = nullptr;
1333 if (sqlite3_prepare_v3(db_, sql, /* nByte= */ -1, /* prepFlags= */ 0,
1335 /* pzTail= */ nullptr) != SQLITE_OK) {
1339 sqlite3_finalize(sqlite_statement);
1343 bool Database::DoesIndexExist(const char* index_name) const {
1344 return DoesSchemaItemExist(index_name, "index");
1347 bool Database::DoesTableExist(const char* table_name) const {
1348 return DoesSchemaItemExist(table_name, "table");
1351 bool Database::DoesViewExist(const char* view_name) const {
1352 return DoesSchemaItemExist(view_name, "view");
1355 bool Database::DoesSchemaItemExist(const char* name, const char* type) const {
1356 static const char kSql[] =
1357 "SELECT 1 FROM sqlite_master WHERE type=? AND name=?";
1358 Statement statement(GetUntrackedStatement(kSql));
1360 if (!statement.is_valid()) {
1361 // The database is corrupt.
1365 statement.BindString(0, type);
1366 statement.BindString(1, name);
1368 return statement.Step(); // Table exists if any row was returned.
1371 bool Database::DoesColumnExist(const char* table_name,
1372 const char* column_name) const {
1373 // sqlite3_table_column_metadata uses out-params to return column definition
1374 // details, such as the column type and whether it allows NULL values. These
1375 // aren't needed to compute the current method's result, so we pass in nullptr
1376 // for all the out-params.
1377 int error = sqlite3_table_column_metadata(
1378 db_, "main", table_name, column_name, /* pzDataType= */ nullptr,
1379 /* pzCollSeq= */ nullptr, /* pNotNull= */ nullptr,
1380 /* pPrimaryKey= */ nullptr, /* pAutoinc= */ nullptr);
1381 return error == SQLITE_OK;
1384 int64_t Database::GetLastInsertRowId() const {
1386 DCHECK(poisoned_) << "Illegal use of Database without a db";
1389 return sqlite3_last_insert_rowid(db_);
1392 int Database::GetLastChangeCount() const {
1394 DCHECK(poisoned_) << "Illegal use of Database without a db";
1397 return sqlite3_changes(db_);
1400 int Database::GetErrorCode() const {
1402 return SQLITE_ERROR;
1403 return sqlite3_errcode(db_);
1406 int Database::GetLastErrno() const {
1411 if (SQLITE_OK != sqlite3_file_control(db_, nullptr, SQLITE_LAST_ERRNO, &err))
1417 const char* Database::GetErrorMessage() const {
1419 return "sql::Database is not opened.";
1420 return sqlite3_errmsg(db_);
1423 bool Database::OpenInternal(const std::string& file_name,
1424 Database::Retry retry_flag) {
1425 TRACE_EVENT1("sql", "Database::OpenInternal", "path", file_name);
1428 DLOG(DCHECK) << "sql::Database is already open.";
1432 base::Optional<base::ScopedBlockingCall> scoped_blocking_call;
1433 InitScopedBlockingCall(FROM_HERE, &scoped_blocking_call);
1435 EnsureSqliteInitialized();
1437 // Setup the stats histograms immediately rather than allocating lazily.
1438 // Databases which won't exercise all of these probably shouldn't exist.
1439 if (!histogram_tag_.empty()) {
1440 stats_histogram_ = base::LinearHistogram::FactoryGet(
1441 "Sqlite.Stats2." + histogram_tag_, 1, EVENT_MAX_VALUE,
1442 EVENT_MAX_VALUE + 1, base::HistogramBase::kUmaTargetedHistogramFlag);
1445 // If |poisoned_| is set, it means an error handler called
1446 // RazeAndClose(). Until regular Close() is called, the caller
1447 // should be treating the database as open, but is_open() currently
1448 // only considers the sqlite3 handle's state.
1449 // TODO(shess): Revise is_open() to consider poisoned_, and review
1450 // to see if any non-testing code even depends on it.
1451 DCHECK(!poisoned_) << "sql::Database is already open.";
1454 // Custom memory-mapping VFS which reads pages using regular I/O on first hit.
1455 sqlite3_vfs* vfs = VFSWrapper();
1456 const char* vfs_name = (vfs ? vfs->zName : nullptr);
1458 // The flags are documented at https://www.sqlite.org/c3ref/open.html.
1460 // Chrome uses SQLITE_OPEN_PRIVATECACHE because SQLite is used by many
1461 // disparate features with their own databases, and having separate page
1462 // caches makes it easier to reason about each feature's performance in
1464 int err = sqlite3_open_v2(
1465 file_name.c_str(), &db_,
1466 SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_PRIVATECACHE,
1468 if (err != SQLITE_OK) {
1469 // Extended error codes cannot be enabled until a handle is
1470 // available, fetch manually.
1471 err = sqlite3_extended_errcode(db_);
1473 // Histogram failures specific to initial open for debugging
1475 base::UmaHistogramSparse("Sqlite.OpenFailure", err);
1477 OnSqliteError(err, nullptr, "-- sqlite3_open()");
1478 bool was_poisoned = poisoned_;
1481 if (was_poisoned && retry_flag == RETRY_ON_POISON)
1482 return OpenInternal(file_name, NO_RETRY);
1486 // If indicated, lock up the database before doing anything else, so
1487 // that the following code doesn't have to deal with locking.
1489 // Needs to happen before any other operation is performed in WAL mode so that
1490 // no operation relies on shared memory if exclusive locking is turned on.
1492 // TODO(shess): This code is brittle. Find the cases where code
1493 // doesn't request |exclusive_locking_| and audit that it does the
1494 // right thing with SQLITE_BUSY, and that it doesn't make
1495 // assumptions about who might change things in the database.
1496 // http://crbug.com/56559
1497 if (exclusive_locking_) {
1498 // TODO(shess): This should probably be a failure. Code which
1499 // requests exclusive locking but doesn't get it is almost certain
1500 // to be ill-tested.
1501 ignore_result(Execute("PRAGMA locking_mode=EXCLUSIVE"));
1504 // Enable extended result codes to provide more color on I/O errors.
1505 // Not having extended result codes is not a fatal problem, as
1506 // Chromium code does not attempt to handle I/O errors anyhow. The
1507 // current implementation always returns SQLITE_OK, the DCHECK is to
1508 // quickly notify someone if SQLite changes.
1509 err = sqlite3_extended_result_codes(db_, 1);
1510 DCHECK_EQ(err, SQLITE_OK) << "Could not enable extended result codes";
1512 // sqlite3_open() does not actually read the database file (unless a hot
1513 // journal is found). Successfully executing this pragma on an existing
1514 // database requires a valid header on page 1. ExecuteAndReturnErrorCode() to
1515 // get the error code before error callback (potentially) overwrites.
1516 // TODO(shess): For now, just probing to see what the lay of the
1517 // land is. If it's mostly SQLITE_NOTADB, then the database should
1519 err = ExecuteAndReturnErrorCode("PRAGMA auto_vacuum");
1520 if (err != SQLITE_OK) {
1521 base::UmaHistogramSparse("Sqlite.OpenProbeFailure", err);
1522 OnSqliteError(err, nullptr, "PRAGMA auto_vacuum");
1524 // Retry or bail out if the error handler poisoned the handle.
1525 // TODO(shess): Move this handling to one place (see also sqlite3_open).
1526 // Possibly a wrapper function?
1529 if (retry_flag == RETRY_ON_POISON)
1530 return OpenInternal(file_name, NO_RETRY);
1535 const base::TimeDelta kBusyTimeout =
1536 base::TimeDelta::FromSeconds(kBusyTimeoutSeconds);
1538 // Needs to happen before entering WAL mode. Will only work if this the first
1539 // time the database is being opened in WAL mode.
1540 const std::string page_size_sql =
1541 base::StringPrintf("PRAGMA page_size=%d", page_size_);
1542 ignore_result(ExecuteWithTimeout(page_size_sql.c_str(), kBusyTimeout));
1544 // http://www.sqlite.org/pragma.html#pragma_journal_mode
1545 // WAL - Use a write-ahead log instead of a journal file.
1546 // DELETE (default) - delete -journal file to commit.
1547 // TRUNCATE - truncate -journal file to commit.
1548 // PERSIST - zero out header of -journal file to commit.
1549 // TRUNCATE should be faster than DELETE because it won't need directory
1550 // changes for each transaction. PERSIST may break the spirit of using
1553 // Needs to be performed after setting exclusive locking mode. Otherwise can
1554 // fail if underlying VFS doesn't support shared memory.
1556 // Set the synchronous flag to NORMAL. This means that writers don't flush
1557 // the WAL file after every write. The WAL file is only flushed on a
1558 // checkpoint. In this case, transcations might lose durability on a power
1559 // loss (but still durable after an application crash).
1560 // TODO(shuagga@microsoft.com): Evaluate if this loss of durability is a
1562 ignore_result(Execute("PRAGMA synchronous=NORMAL"));
1564 // Opening the db in WAL mode can fail (eg if the underlying VFS doesn't
1565 // support shared memory and we are not in exclusive locking mode).
1567 // TODO(shuagga@microsoft.com): We should probably catch a failure here.
1568 ignore_result(Execute("PRAGMA journal_mode=WAL"));
1570 ignore_result(Execute("PRAGMA journal_mode=TRUNCATE"));
1573 if (cache_size_ != 0) {
1574 const std::string cache_size_sql =
1575 base::StringPrintf("PRAGMA cache_size=%d", cache_size_);
1576 ignore_result(ExecuteWithTimeout(cache_size_sql.c_str(), kBusyTimeout));
1579 static_assert(SQLITE_SECURE_DELETE == 1,
1580 "Chrome assumes secure_delete is on by default.");
1582 // Set a reasonable chunk size for larger files. This reduces churn from
1583 // remapping memory on size changes. It also reduces filesystem
1585 // TODO(shess): It may make sense to have this be hinted by the client.
1586 // Database sizes seem to be bimodal, some clients have consistently small
1587 // databases (<20k) while other clients have a broad distribution of sizes
1588 // (hundreds of kilobytes to many megabytes).
1589 sqlite3_file* file = nullptr;
1590 sqlite3_int64 db_size = 0;
1591 int rc = GetSqlite3FileAndSize(db_, &file, &db_size);
1592 if (rc == SQLITE_OK && db_size > 16 * 1024) {
1593 int chunk_size = 4 * 1024;
1594 if (db_size > 128 * 1024)
1595 chunk_size = 32 * 1024;
1596 sqlite3_file_control(db_, nullptr, SQLITE_FCNTL_CHUNK_SIZE, &chunk_size);
1599 // Enable memory-mapped access. The explicit-disable case is because SQLite
1600 // can be built to default-enable mmap. GetAppropriateMmapSize() calculates a
1601 // safe range to memory-map based on past regular I/O. This value will be
1602 // capped by SQLITE_MAX_MMAP_SIZE, which could be different between 32-bit and
1603 // 64-bit platforms.
1604 size_t mmap_size = mmap_disabled_ ? 0 : GetAppropriateMmapSize();
1605 std::string mmap_sql =
1606 base::StringPrintf("PRAGMA mmap_size=%" PRIuS, mmap_size);
1607 ignore_result(Execute(mmap_sql.c_str()));
1609 // Determine if memory-mapping has actually been enabled. The Execute() above
1610 // can succeed without changing the amount mapped.
1611 mmap_enabled_ = false;
1613 Statement s(GetUniqueStatement("PRAGMA mmap_size"));
1614 if (s.Step() && s.ColumnInt64(0) > 0)
1615 mmap_enabled_ = true;
1618 DCHECK(!memory_dump_provider_);
1619 memory_dump_provider_.reset(
1620 new DatabaseMemoryDumpProvider(db_, histogram_tag_));
1621 base::trace_event::MemoryDumpManager::GetInstance()->RegisterDumpProvider(
1622 memory_dump_provider_.get(), "sql::Database", nullptr);
1627 void Database::DoRollback() {
1628 TRACE_EVENT0("sql", "Database::DoRollback");
1630 Statement rollback(GetCachedStatement(SQL_FROM_HERE, "ROLLBACK"));
1634 // The cache may have been accumulating dirty pages for commit. Note that in
1635 // some cases sql::Transaction can fire rollback after a database is closed.
1637 ReleaseCacheMemoryIfNeeded(false);
1639 needs_rollback_ = false;
1642 void Database::StatementRefCreated(StatementRef* ref) {
1643 DCHECK(!open_statements_.count(ref))
1644 << __func__ << " already called with this statement";
1645 open_statements_.insert(ref);
1648 void Database::StatementRefDeleted(StatementRef* ref) {
1649 DCHECK(open_statements_.count(ref))
1650 << __func__ << " called with non-existing statement";
1651 open_statements_.erase(ref);
1654 void Database::set_histogram_tag(const std::string& tag) {
1657 histogram_tag_ = tag;
1660 void Database::AddTaggedHistogram(const std::string& name, int sample) const {
1661 if (histogram_tag_.empty())
1664 // TODO(shess): The histogram macros create a bit of static storage
1665 // for caching the histogram object. This code shouldn't execute
1666 // often enough for such caching to be crucial. If it becomes an
1667 // issue, the object could be cached alongside histogram_prefix_.
1668 std::string full_histogram_name = name + "." + histogram_tag_;
1669 base::HistogramBase* histogram = base::SparseHistogram::FactoryGet(
1670 full_histogram_name, base::HistogramBase::kUmaTargetedHistogramFlag);
1672 histogram->Add(sample);
1675 int Database::OnSqliteError(int err,
1676 sql::Statement* stmt,
1677 const char* sql) const {
1678 TRACE_EVENT0("sql", "Database::OnSqliteError");
1680 base::UmaHistogramSparse("Sqlite.Error", err);
1681 AddTaggedHistogram("Sqlite.Error", err);
1683 // Always log the error.
1685 sql = stmt->GetSQLStatement();
1689 std::string id = histogram_tag_;
1691 id = DbPath().BaseName().AsUTF8Unsafe();
1692 LOG(ERROR) << id << " sqlite error " << err << ", errno " << GetLastErrno()
1693 << ": " << GetErrorMessage() << ", sql: " << sql;
1695 if (!error_callback_.is_null()) {
1696 // Fire from a copy of the callback in case of reentry into
1697 // re/set_error_callback().
1698 // TODO(shess): <http://crbug.com/254584>
1699 ErrorCallback(error_callback_).Run(err, stmt);
1703 // The default handling is to assert on debug and to ignore on release.
1704 if (!IsExpectedSqliteError(err))
1705 DLOG(DCHECK) << GetErrorMessage();
1709 bool Database::FullIntegrityCheck(std::vector<std::string>* messages) {
1710 return IntegrityCheckHelper("PRAGMA integrity_check", messages);
1713 bool Database::QuickIntegrityCheck() {
1714 std::vector<std::string> messages;
1715 if (!IntegrityCheckHelper("PRAGMA quick_check", &messages))
1717 return messages.size() == 1 && messages[0] == "ok";
1720 std::string Database::GetDiagnosticInfo(int extended_error,
1721 Statement* statement) {
1722 // Prevent reentrant calls to the error callback.
1723 ErrorCallback original_callback = std::move(error_callback_);
1724 reset_error_callback();
1726 // Trim extended error codes.
1727 const int error = (extended_error & 0xFF);
1728 // CollectCorruptionInfo() is implemented in terms of sql::Database,
1729 // TODO(shess): Rewrite IntegrityCheckHelper() in terms of raw SQLite.
1730 std::string result = (error == SQLITE_CORRUPT)
1731 ? CollectCorruptionInfo()
1732 : CollectErrorInfo(extended_error, statement);
1734 // The following queries must be executed after CollectErrorInfo() above, so
1735 // if they result in their own errors, they don't interfere with
1736 // CollectErrorInfo().
1737 const bool has_valid_header =
1738 (ExecuteAndReturnErrorCode("PRAGMA auto_vacuum") == SQLITE_OK);
1739 const bool select_sqlite_master_result =
1740 (ExecuteAndReturnErrorCode("SELECT COUNT(*) FROM sqlite_master") ==
1743 // Restore the original error callback.
1744 error_callback_ = std::move(original_callback);
1746 base::StringAppendF(&result, "Has valid header: %s\n",
1747 (has_valid_header ? "Yes" : "No"));
1748 base::StringAppendF(&result, "Has valid schema: %s\n",
1749 (select_sqlite_master_result ? "Yes" : "No"));
1754 // TODO(shess): Allow specifying maximum results (default 100 lines).
1755 bool Database::IntegrityCheckHelper(const char* pragma_sql,
1756 std::vector<std::string>* messages) {
1759 // This has the side effect of setting SQLITE_RecoveryMode, which
1760 // allows SQLite to process through certain cases of corruption.
1761 // Failing to set this pragma probably means that the database is
1763 static const char kWritableSchemaSql[] = "PRAGMA writable_schema=ON";
1764 if (!Execute(kWritableSchemaSql))
1769 sql::Statement stmt(GetUniqueStatement(pragma_sql));
1771 // The pragma appears to return all results (up to 100 by default)
1772 // as a single string. This doesn't appear to be an API contract,
1773 // it could return separate lines, so loop _and_ split.
1774 while (stmt.Step()) {
1775 std::string result(stmt.ColumnString(0));
1776 *messages = base::SplitString(result, "\n", base::TRIM_WHITESPACE,
1777 base::SPLIT_WANT_ALL);
1779 ret = stmt.Succeeded();
1782 // Best effort to put things back as they were before.
1783 static const char kNoWritableSchemaSql[] = "PRAGMA writable_schema=OFF";
1784 ignore_result(Execute(kNoWritableSchemaSql));
1789 bool Database::ReportMemoryUsage(base::trace_event::ProcessMemoryDump* pmd,
1790 const std::string& dump_name) {
1791 return memory_dump_provider_ &&
1792 memory_dump_provider_->ReportMemoryUsage(pmd, dump_name);
1795 bool Database::UseWALMode() const {
1796 #if defined(OS_FUCHSIA)
1797 // WAL mode is only enabled on Fuchsia for databases with exclusive
1798 // locking, because this case does not require shared memory support.
1799 // At the time this was implemented (May 2020), Fuchsia's shared
1800 // memory support was insufficient for SQLite's needs.
1801 return want_wal_mode_ && exclusive_locking_;
1803 return want_wal_mode_;
1804 #endif // defined(OS_FUCHSIA)
1807 bool Database::CheckpointDatabase() {
1808 base::Optional<base::ScopedBlockingCall> scoped_blocking_call;
1809 InitScopedBlockingCall(FROM_HERE, &scoped_blocking_call);
1811 static const char* kMainDb = "main";
1812 int rc = sqlite3_wal_checkpoint_v2(db_, kMainDb, SQLITE_CHECKPOINT_PASSIVE,
1814 /*pnCkpt=*/nullptr);
1816 return rc == SQLITE_OK;