capnproto

filesystem-disk-win32.c++ (59218B)

---

 // Copyright (c) 2015 Sandstorm Development Group, Inc. and contributors
 // Licensed under the MIT License:
 //
 // Permission is hereby granted, free of charge, to any person obtaining a copy
 // of this software and associated documentation files (the "Software"), to deal
 // in the Software without restriction, including without limitation the rights
 // to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 // copies of the Software, and to permit persons to whom the Software is
 // furnished to do so, subject to the following conditions:
 //
 // The above copyright notice and this permission notice shall be included in
 // all copies or substantial portions of the Software.
 //
 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 // FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 // AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 // LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 // THE SOFTWARE.
 
 #if _WIN32
 // For Unix implementation, see filesystem-disk-unix.c++.
 
 // Request Vista-level APIs.
 #include "win32-api-version.h"
 
 #include "filesystem.h"
 #include "debug.h"
 #include "encoding.h"
 #include "vector.h"
 #include <algorithm>
 #include <wchar.h>
 
 #include <windows.h>
 #include <winioctl.h>
 #include "windows-sanity.h"
 
 namespace kj {
 
 static Own<ReadableDirectory> newDiskReadableDirectory(AutoCloseHandle fd, Path&& path);
 static Own<Directory> newDiskDirectory(AutoCloseHandle fd, Path&& path);
 
 static AutoCloseHandle* getHandlePointerHack(File& file) { return nullptr; }
 static AutoCloseHandle* getHandlePointerHack(Directory& dir);
 static Path* getPathPointerHack(File& file) { return nullptr; }
 static Path* getPathPointerHack(Directory& dir);
 
 namespace {
 
 struct REPARSE_DATA_BUFFER {
   // From ntifs.h, which is part of the driver development kit so not necessarily available I
   // guess.
   ULONG ReparseTag;
   USHORT ReparseDataLength;
   USHORT Reserved;
   union {
     struct {
       USHORT SubstituteNameOffset;
       USHORT SubstituteNameLength;
       USHORT PrintNameOffset;
       USHORT PrintNameLength;
       ULONG Flags;
       WCHAR PathBuffer[1];
     } SymbolicLinkReparseBuffer;
     struct {
       USHORT SubstituteNameOffset;
       USHORT SubstituteNameLength;
       USHORT PrintNameOffset;
       USHORT PrintNameLength;
       WCHAR PathBuffer[1];
     } MountPointReparseBuffer;
     struct {
       UCHAR DataBuffer[1];
     } GenericReparseBuffer;
   };
 };
 
 #define HIDDEN_PREFIX ".kj-tmp."
 // Prefix for temp files which should be hidden when listing a directory.
 //
 // If you change this, make sure to update the unit test.
 
 static constexpr int64_t WIN32_EPOCH_OFFSET = 116444736000000000ull;
 // Number of 100ns intervals from Jan 1, 1601 to Jan 1, 1970.
 
 static Date toKjDate(FILETIME t) {
   int64_t value = (static_cast<uint64_t>(t.dwHighDateTime) << 32) | t.dwLowDateTime;
   return (value - WIN32_EPOCH_OFFSET) * (100 * kj::NANOSECONDS) + UNIX_EPOCH;
 }
 
 static FsNode::Type modeToType(DWORD attrs, DWORD reparseTag) {
   if ((attrs & FILE_ATTRIBUTE_REPARSE_POINT) &&
       reparseTag == IO_REPARSE_TAG_SYMLINK) {
     return FsNode::Type::SYMLINK;
   }
   if (attrs & FILE_ATTRIBUTE_DIRECTORY) return FsNode::Type::DIRECTORY;
   return FsNode::Type::FILE;
 }
 
 static FsNode::Metadata statToMetadata(const BY_HANDLE_FILE_INFORMATION& stats) {
   uint64_t size = (implicitCast<uint64_t>(stats.nFileSizeHigh) << 32) | stats.nFileSizeLow;
 
   // Assume file index is usually a small number, i.e. nFileIndexHigh is usually 0. So we try to
   // put the serial number in the upper 32 bits and the index in the lower.
   uint64_t hash = ((uint64_t(stats.dwVolumeSerialNumber) << 32)
                  ^ (uint64_t(stats.nFileIndexHigh) << 32))
                 | (uint64_t(stats.nFileIndexLow));
 
   return FsNode::Metadata {
     modeToType(stats.dwFileAttributes, 0),
     size,
     // In theory, spaceUsed should be based on GetCompressedFileSize(), but requiring an extra
     // syscall for something rarely used would be sad.
     size,
     toKjDate(stats.ftLastWriteTime),
     stats.nNumberOfLinks,
     hash
   };
 }
 
 static FsNode::Metadata statToMetadata(const WIN32_FIND_DATAW& stats) {
   uint64_t size = (implicitCast<uint64_t>(stats.nFileSizeHigh) << 32) | stats.nFileSizeLow;
 
   return FsNode::Metadata {
     modeToType(stats.dwFileAttributes, stats.dwReserved0),
     size,
     // In theory, spaceUsed should be based on GetCompressedFileSize(), but requiring an extra
     // syscall for something rarely used would be sad.
     size,
     toKjDate(stats.ftLastWriteTime),
     // We can't get the number of links without opening the file, apparently. Meh.
     1,
     // We can't produce a reliable hashCode without opening the file.
     0
   };
 }
 
 static Array<wchar_t> join16(ArrayPtr<const wchar_t> path, const wchar_t* file) {
   // Assumes `path` ends with a NUL terminator (and `file` is of course NUL terminated as well).
 
   size_t len = wcslen(file) + 1;
   auto result = kj::heapArray<wchar_t>(path.size() + len);
   memcpy(result.begin(), path.begin(), path.asBytes().size() - sizeof(wchar_t));
   result[path.size() - 1] = '\\';
   memcpy(result.begin() + path.size(), file, len * sizeof(wchar_t));
   return result;
 }
 
 static String dbgStr(ArrayPtr<const wchar_t> wstr) {
   if (wstr.size() > 0 && wstr[wstr.size() - 1] == L'\0') {
     wstr = wstr.slice(0, wstr.size() - 1);
   }
   return decodeWideString(wstr);
 }
 
 static void rmrfChildren(ArrayPtr<const wchar_t> path) {
   auto glob = join16(path, L"*");
 
   WIN32_FIND_DATAW data;
   HANDLE handle = FindFirstFileW(glob.begin(), &data);
   if (handle == INVALID_HANDLE_VALUE) {
     auto error = GetLastError();
     if (error == ERROR_FILE_NOT_FOUND) return;
     KJ_FAIL_WIN32("FindFirstFile", error, dbgStr(glob)) { return; }
   }
   KJ_DEFER(KJ_WIN32(FindClose(handle)) { break; });
 
   do {
     // Ignore "." and "..", ugh.
     if (data.cFileName[0] == L'.') {
       if (data.cFileName[1] == L'\0' ||
           (data.cFileName[1] == L'.' && data.cFileName[2] == L'\0')) {
         continue;
       }
     }
 
     auto child = join16(path, data.cFileName);
     // For rmrf purposes, we assume any "reparse points" are symlink-like, even if they aren't
     // actually the "symbolic link" reparse type, because we don't want to recursively delete any
     // shared content.
     if ((data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) &&
         !(data.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)) {
       rmrfChildren(child);
       uint retryCount = 0;
     retry:
       KJ_WIN32_HANDLE_ERRORS(RemoveDirectoryW(child.begin())) {
         case ERROR_DIR_NOT_EMPTY:
           // On Windows, deleting a file actually only schedules it for deletion. Under heavy
           // load it may take a bit for the deletion to go through. Or, if another process has
           // the file open, it may not be deleted until that process closes it.
           //
           // We'll repeatedly retry for up to 100ms, then give up. This is awful but there's no
           // way to tell for sure if the system is just being slow or if someone has the file
           // open.
           if (retryCount++ < 10) {
             Sleep(10);
             goto retry;
           }
           KJ_FALLTHROUGH;
         default:
           KJ_FAIL_WIN32("RemoveDirectory", error, dbgStr(child)) { break; }
       }
     } else {
       KJ_WIN32(DeleteFileW(child.begin()));
     }
   } while (FindNextFileW(handle, &data));
 
   auto error = GetLastError();
   if (error != ERROR_NO_MORE_FILES) {
     KJ_FAIL_WIN32("FindNextFile", error, dbgStr(path)) { return; }
   }
 }
 
 static bool rmrf(ArrayPtr<const wchar_t> path) {
   // Figure out whether this is a file or a directory.
   //
   // We use FindFirstFileW() because in the case of symlinks it will return info about the
   // symlink rather than info about the target.
   WIN32_FIND_DATAW data;
   HANDLE handle = FindFirstFileW(path.begin(), &data);
   if (handle == INVALID_HANDLE_VALUE) {
     auto error = GetLastError();
     if (error == ERROR_FILE_NOT_FOUND) return false;
     KJ_FAIL_WIN32("FindFirstFile", error, dbgStr(path));
   }
   KJ_WIN32(FindClose(handle));
 
   // For remove purposes, we assume any "reparse points" are symlink-like, even if they aren't
   // actually the "symbolic link" reparse type, because we don't want to recursively delete any
   // shared content.
   if ((data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) &&
       !(data.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)) {
     // directory
     rmrfChildren(path);
     KJ_WIN32(RemoveDirectoryW(path.begin()), dbgStr(path));
   } else {
     KJ_WIN32(DeleteFileW(path.begin()), dbgStr(path));
   }
 
   return true;
 }
 
 static Path getPathFromHandle(HANDLE handle) {
   DWORD tryLen = MAX_PATH;
   for (;;) {
     auto temp = kj::heapArray<wchar_t>(tryLen + 1);
     DWORD len = GetFinalPathNameByHandleW(handle, temp.begin(), tryLen, 0);
     if (len == 0) {
       KJ_FAIL_WIN32("GetFinalPathNameByHandleW", GetLastError());
     }
     if (len < temp.size()) {
       return Path::parseWin32Api(temp.slice(0, len));
     }
     // Try again with new length.
     tryLen = len;
   }
 }
 
 struct MmapRange {
   uint64_t offset;
   uint64_t size;
 };
 
 static size_t getAllocationGranularity() {
   SYSTEM_INFO info;
   GetSystemInfo(&info);
   return info.dwAllocationGranularity;
 };
 
 static MmapRange getMmapRange(uint64_t offset, uint64_t size) {
   // Rounds the given offset down to the nearest page boundary, and adjusts the size up to match.
   // (This is somewhat different from Unix: we do NOT round the size up to an even multiple of
   // pages.)
   static const uint64_t pageSize = getAllocationGranularity();
   uint64_t pageMask = pageSize - 1;
 
   uint64_t realOffset = offset & ~pageMask;
 
   uint64_t end = offset + size;
 
   return { realOffset, end - realOffset };
 }
 
 class MmapDisposer: public ArrayDisposer {
 protected:
   void disposeImpl(void* firstElement, size_t elementSize, size_t elementCount,
                    size_t capacity, void (*destroyElement)(void*)) const {
     auto range = getMmapRange(reinterpret_cast<uintptr_t>(firstElement),
                               elementSize * elementCount);
     void* mapping = reinterpret_cast<void*>(range.offset);
     if (mapping != nullptr) {
       KJ_ASSERT(UnmapViewOfFile(mapping)) { break; }
     }
   }
 };
 
 #if _MSC_VER && _MSC_VER < 1910 && !defined(__clang__)
 // TODO(msvc): MSVC 2015 can't initialize a constexpr's vtable correctly.
 const MmapDisposer mmapDisposer = MmapDisposer();
 #else
 constexpr MmapDisposer mmapDisposer = MmapDisposer();
 #endif
 
 void* win32Mmap(HANDLE handle, MmapRange range, DWORD pageProtect, DWORD access) {
   HANDLE mappingHandle;
   KJ_WIN32(mappingHandle = CreateFileMappingW(handle, NULL, pageProtect, 0, 0, NULL));
   KJ_DEFER(KJ_WIN32(CloseHandle(mappingHandle)) { break; });
 
   void* mapping = MapViewOfFile(mappingHandle, access,
       static_cast<DWORD>(range.offset >> 32), static_cast<DWORD>(range.offset), range.size);
   if (mapping == nullptr) {
     KJ_FAIL_WIN32("MapViewOfFile", GetLastError());
   }
 
   // It's unclear from the documentation whether mappings will always start at a multiple of the
   // allocation granularity, but we depend on that later, so check it...
   KJ_ASSERT(getMmapRange(reinterpret_cast<uintptr_t>(mapping), 0).size == 0);
 
   return mapping;
 }
 
 class DiskHandle {
   // We need to implement each of ReadableFile, AppendableFile, File, ReadableDirectory, and
   // Directory for disk handles. There is a lot of implementation overlap between these, especially
   // stat(), sync(), etc. We can't have everything inherit from a common DiskFsNode that implements
   // these because then we get diamond inheritance which means we need to make all our inheritance
   // virtual which means downcasting requires RTTI which violates our goal of supporting compiling
   // with no RTTI. So instead we have the DiskHandle class which implements all the methods without
   // inheriting anything, and then we have DiskFile, DiskDirectory, etc. hold this and delegate to
   // it. Ugly, but works.
 
 public:
   DiskHandle(AutoCloseHandle&& handle, Maybe<Path> dirPath)
       : handle(kj::mv(handle)), dirPath(kj::mv(dirPath)) {}
 
   AutoCloseHandle handle;
   kj::Maybe<Path> dirPath;  // needed for directories, empty for files
 
   Array<wchar_t> nativePath(PathPtr path) const {
     return KJ_ASSERT_NONNULL(dirPath).append(path).forWin32Api(true);
   }
 
   // OsHandle ------------------------------------------------------------------
 
   AutoCloseHandle clone() const {
     HANDLE newHandle;
     KJ_WIN32(DuplicateHandle(GetCurrentProcess(), handle, GetCurrentProcess(), &newHandle,
                              0, FALSE, DUPLICATE_SAME_ACCESS));
     return AutoCloseHandle(newHandle);
   }
 
   HANDLE getWin32Handle() const {
     return handle.get();
   }
 
   // FsNode --------------------------------------------------------------------
 
   FsNode::Metadata stat() const {
     BY_HANDLE_FILE_INFORMATION stats;
     KJ_WIN32(GetFileInformationByHandle(handle, &stats));
     auto metadata = statToMetadata(stats);
 
     // Get space usage, e.g. for sparse files. Apparently the correct way to do this is to query
     // "compression".
     FILE_COMPRESSION_INFO compInfo;
     KJ_WIN32_HANDLE_ERRORS(GetFileInformationByHandleEx(
         handle, FileCompressionInfo, &compInfo, sizeof(compInfo))) {
       case ERROR_CALL_NOT_IMPLEMENTED:
         // Probably WINE.
         break;
       default:
         KJ_FAIL_WIN32("GetFileInformationByHandleEx(FileCompressionInfo)", error) { break; }
         break;
     } else {
       metadata.spaceUsed = compInfo.CompressedFileSize.QuadPart;
     }
 
     return metadata;
   }
 
   void sync() const { KJ_WIN32(FlushFileBuffers(handle)); }
   void datasync() const { KJ_WIN32(FlushFileBuffers(handle)); }
 
   // ReadableFile --------------------------------------------------------------
 
   size_t read(uint64_t offset, ArrayPtr<byte> buffer) const {
     // ReadFile() probably never returns short reads unless it hits EOF. Unfortunately, though,
     // this is not documented, and it's unclear whether we can rely on it.
 
     size_t total = 0;
     while (buffer.size() > 0) {
       // Apparently, the way to fake pread() on Windows is to provide an OVERLAPPED structure even
       // though we're not doing overlapped I/O.
       OVERLAPPED overlapped;
       memset(&overlapped, 0, sizeof(overlapped));
       overlapped.Offset = static_cast<DWORD>(offset);
       overlapped.OffsetHigh = static_cast<DWORD>(offset >> 32);
 
       DWORD n;
       KJ_WIN32_HANDLE_ERRORS(ReadFile(handle, buffer.begin(), buffer.size(), &n, &overlapped)) {
         case ERROR_HANDLE_EOF:
           // The documentation claims this shouldn't happen for synchronous reads, but it seems
           // to happen for me, at least under WINE.
           n = 0;
           break;
         default:
           KJ_FAIL_WIN32("ReadFile", offset, buffer.size()) { return total; }
       }
       if (n == 0) break;
       total += n;
       offset += n;
       buffer = buffer.slice(n, buffer.size());
     }
     return total;
   }
 
   Array<const byte> mmap(uint64_t offset, uint64_t size) const {
     if (size == 0) return nullptr;  // Windows won't allow zero-length mappings
     auto range = getMmapRange(offset, size);
     const void* mapping = win32Mmap(handle, range, PAGE_READONLY, FILE_MAP_READ);
     return Array<const byte>(reinterpret_cast<const byte*>(mapping) + (offset - range.offset),
                              size, mmapDisposer);
   }
 
   Array<byte> mmapPrivate(uint64_t offset, uint64_t size) const {
     if (size == 0) return nullptr;  // Windows won't allow zero-length mappings
     auto range = getMmapRange(offset, size);
     void* mapping = win32Mmap(handle, range, PAGE_READONLY, FILE_MAP_COPY);
     return Array<byte>(reinterpret_cast<byte*>(mapping) + (offset - range.offset),
                        size, mmapDisposer);
   }
 
   // File ----------------------------------------------------------------------
 
   void write(uint64_t offset, ArrayPtr<const byte> data) const {
     // WriteFile() probably never returns short writes unless there's no space left on disk.
     // Unfortunately, though, this is not documented, and it's unclear whether we can rely on it.
 
     while (data.size() > 0) {
       // Apparently, the way to fake pwrite() on Windows is to provide an OVERLAPPED structure even
       // though we're not doing overlapped I/O.
       OVERLAPPED overlapped;
       memset(&overlapped, 0, sizeof(overlapped));
       overlapped.Offset = static_cast<DWORD>(offset);
       overlapped.OffsetHigh = static_cast<DWORD>(offset >> 32);
 
       DWORD n;
       KJ_WIN32(WriteFile(handle, data.begin(), data.size(), &n, &overlapped));
       KJ_ASSERT(n > 0, "WriteFile() returned zero?");
       offset += n;
       data = data.slice(n, data.size());
     }
   }
 
   void zero(uint64_t offset, uint64_t size) const {
     FILE_ZERO_DATA_INFORMATION info;
     memset(&info, 0, sizeof(info));
     info.FileOffset.QuadPart = offset;
     info.BeyondFinalZero.QuadPart = offset + size;
 
     DWORD dummy;
     KJ_WIN32_HANDLE_ERRORS(DeviceIoControl(handle, FSCTL_SET_ZERO_DATA, &info,
                                            sizeof(info), NULL, 0, &dummy, NULL)) {
       case ERROR_NOT_SUPPORTED: {
         // Dang. Let's do it the hard way.
         static const byte ZEROS[4096] = { 0 };
 
         while (size > sizeof(ZEROS)) {
           write(offset, ZEROS);
           size -= sizeof(ZEROS);
           offset += sizeof(ZEROS);
         }
         write(offset, kj::arrayPtr(ZEROS, size));
         break;
       }
 
       default:
         KJ_FAIL_WIN32("DeviceIoControl(FSCTL_SET_ZERO_DATA)", error);
         break;
     }
   }
 
   void truncate(uint64_t size) const {
     // SetEndOfFile() would require seeking the file. It looks like SetFileInformationByHandle()
     // lets us avoid this!
     FILE_END_OF_FILE_INFO info;
     memset(&info, 0, sizeof(info));
     info.EndOfFile.QuadPart = size;
     KJ_WIN32_HANDLE_ERRORS(
         SetFileInformationByHandle(handle, FileEndOfFileInfo, &info, sizeof(info))) {
       case ERROR_CALL_NOT_IMPLEMENTED: {
         // Wine doesn't implement this. :(
 
         LONG currentHigh = 0;
         LONG currentLow = SetFilePointer(handle, 0, &currentHigh, FILE_CURRENT);
         if (currentLow == INVALID_SET_FILE_POINTER) {
           KJ_FAIL_WIN32("SetFilePointer", GetLastError());
         }
         uint64_t current = (uint64_t(currentHigh) << 32) | uint64_t((ULONG)currentLow);
 
         LONG endLow = size & 0x00000000ffffffffull;
         LONG endHigh = size >> 32;
         if (SetFilePointer(handle, endLow, &endHigh, FILE_BEGIN) == INVALID_SET_FILE_POINTER) {
           KJ_FAIL_WIN32("SetFilePointer", GetLastError());
         }
 
         KJ_WIN32(SetEndOfFile(handle));
 
         if (current < size) {
           if (SetFilePointer(handle, currentLow, &currentHigh, FILE_BEGIN) ==
                   INVALID_SET_FILE_POINTER) {
             KJ_FAIL_WIN32("SetFilePointer", GetLastError());
           }
         }
 
         break;
       }
       default:
         KJ_FAIL_WIN32("SetFileInformationByHandle", error);
     }
   }
 
   class WritableFileMappingImpl final: public WritableFileMapping {
   public:
     WritableFileMappingImpl(Array<byte> bytes): bytes(kj::mv(bytes)) {}
 
     ArrayPtr<byte> get() const override {
       // const_cast OK because WritableFileMapping does indeed provide a writable view despite
       // being const itself.
       return arrayPtr(const_cast<byte*>(bytes.begin()), bytes.size());
     }
 
     void changed(ArrayPtr<byte> slice) const override {
       KJ_REQUIRE(slice.begin() >= bytes.begin() && slice.end() <= bytes.end(),
                  "byte range is not part of this mapping");
 
       // Nothing needed here -- NT tracks dirty pages.
     }
 
     void sync(ArrayPtr<byte> slice) const override {
       KJ_REQUIRE(slice.begin() >= bytes.begin() && slice.end() <= bytes.end(),
                  "byte range is not part of this mapping");
 
       // Zero is treated specially by FlushViewOfFile(), so check for it. (This also handles the
       // case where `bytes` is actually empty and not a real mapping.)
       if (slice.size() > 0) {
         KJ_WIN32(FlushViewOfFile(slice.begin(), slice.size()));
       }
     }
 
   private:
     Array<byte> bytes;
   };
 
   Own<const WritableFileMapping> mmapWritable(uint64_t offset, uint64_t size) const {
     if (size == 0) {
       // Windows won't allow zero-length mappings
       return heap<WritableFileMappingImpl>(nullptr);
     }
     auto range = getMmapRange(offset, size);
     void* mapping = win32Mmap(handle, range, PAGE_READWRITE, FILE_MAP_ALL_ACCESS);
     auto array = Array<byte>(reinterpret_cast<byte*>(mapping) + (offset - range.offset),
                              size, mmapDisposer);
     return heap<WritableFileMappingImpl>(kj::mv(array));
   }
 
   // copy() is not optimized on Windows.
 
   // ReadableDirectory ---------------------------------------------------------
 
   template <typename Func>
   auto list(bool needTypes, Func&& func) const
       -> Array<Decay<decltype(func(instance<StringPtr>(), instance<FsNode::Type>()))>> {
     PathPtr path = KJ_ASSERT_NONNULL(dirPath);
     auto glob = join16(path.forWin32Api(true), L"*");
 
     // TODO(perf): Use FindFileEx() with FindExInfoBasic? Not apparently supported on Vista.
     // TODO(someday): Use NtQueryDirectoryObject() instead? It's "internal", but so much cleaner.
     WIN32_FIND_DATAW data;
     HANDLE handle = FindFirstFileW(glob.begin(), &data);
     if (handle == INVALID_HANDLE_VALUE) {
       auto error = GetLastError();
       if (error == ERROR_FILE_NOT_FOUND) return nullptr;
       KJ_FAIL_WIN32("FindFirstFile", error, dbgStr(glob));
     }
     KJ_DEFER(KJ_WIN32(FindClose(handle)) { break; });
 
     typedef Decay<decltype(func(instance<StringPtr>(), instance<FsNode::Type>()))> Entry;
     kj::Vector<Entry> entries;
 
     do {
       auto name = decodeUtf16(
           arrayPtr(reinterpret_cast<char16_t*>(data.cFileName), wcslen(data.cFileName)));
       if (name != "." && name != ".." && !name.startsWith(HIDDEN_PREFIX)) {
         entries.add(func(name, modeToType(data.dwFileAttributes, data.dwReserved0)));
       }
     } while (FindNextFileW(handle, &data));
 
     auto error = GetLastError();
     if (error != ERROR_NO_MORE_FILES) {
       KJ_FAIL_WIN32("FindNextFile", error, path);
     }
 
     auto result = entries.releaseAsArray();
     std::sort(result.begin(), result.end());
     return result;
   }
 
   Array<String> listNames() const {
     return list(false, [](StringPtr name, FsNode::Type type) { return heapString(name); });
   }
 
   Array<ReadableDirectory::Entry> listEntries() const {
     return list(true, [](StringPtr name, FsNode::Type type) {
       return ReadableDirectory::Entry { type, heapString(name), };
     });
   }
 
   bool exists(PathPtr path) const {
     DWORD result = GetFileAttributesW(nativePath(path).begin());
     if (result == INVALID_FILE_ATTRIBUTES) {
       auto error = GetLastError();
       switch (error) {
         case ERROR_FILE_NOT_FOUND:
         case ERROR_PATH_NOT_FOUND:
           return false;
         default:
           KJ_FAIL_WIN32("GetFileAttributesEx(path)", error, path) { return false; }
       }
     } else {
       return true;
     }
   }
 
   Maybe<FsNode::Metadata> tryLstat(PathPtr path) const {
     // We use FindFirstFileW() because in the case of symlinks it will return info about the
     // symlink rather than info about the target.
     WIN32_FIND_DATAW data;
     HANDLE handle = FindFirstFileW(nativePath(path).begin(), &data);
     if (handle == INVALID_HANDLE_VALUE) {
       auto error = GetLastError();
       if (error == ERROR_FILE_NOT_FOUND) return nullptr;
       KJ_FAIL_WIN32("FindFirstFile", error, path);
     } else {
       KJ_WIN32(FindClose(handle));
       return statToMetadata(data);
     }
   }
 
   Maybe<Own<const ReadableFile>> tryOpenFile(PathPtr path) const {
     HANDLE newHandle;
     KJ_WIN32_HANDLE_ERRORS(newHandle = CreateFileW(
         nativePath(path).begin(),
         GENERIC_READ,
         FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
         NULL,
         OPEN_EXISTING,
         FILE_ATTRIBUTE_NORMAL,
         NULL)) {
       case ERROR_FILE_NOT_FOUND:
       case ERROR_PATH_NOT_FOUND:
         return nullptr;
       default:
         KJ_FAIL_WIN32("CreateFile(path, OPEN_EXISTING)", error, path) { return nullptr; }
     }
 
     return newDiskReadableFile(kj::AutoCloseHandle(newHandle));
   }
 
   Maybe<AutoCloseHandle> tryOpenSubdirInternal(PathPtr path) const {
     HANDLE newHandle;
     KJ_WIN32_HANDLE_ERRORS(newHandle = CreateFileW(
         nativePath(path).begin(),
         GENERIC_READ,
         // When opening directories, we do NOT use FILE_SHARE_DELETE, because we need the directory
         // path to remain vaild.
         //
         // TODO(someday): Use NtCreateFile() and related "internal" APIs that allow for
         //   openat()-like behavior?
         FILE_SHARE_READ | FILE_SHARE_WRITE,
         NULL,
         OPEN_EXISTING,
         FILE_FLAG_BACKUP_SEMANTICS,  // apparently, this flag is required for directories
         NULL)) {
       case ERROR_FILE_NOT_FOUND:
       case ERROR_PATH_NOT_FOUND:
         return nullptr;
       default:
         KJ_FAIL_WIN32("CreateFile(directoryPath, OPEN_EXISTING)", error, path) { return nullptr; }
     }
 
     kj::AutoCloseHandle ownHandle(newHandle);
 
     BY_HANDLE_FILE_INFORMATION info;
     KJ_WIN32(GetFileInformationByHandle(ownHandle, &info));
 
     KJ_REQUIRE(info.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY, "not a directory", path);
     return kj::mv(ownHandle);
   }
 
   Maybe<Own<const ReadableDirectory>> tryOpenSubdir(PathPtr path) const {
     return tryOpenSubdirInternal(path).map([&](AutoCloseHandle&& handle) {
       return newDiskReadableDirectory(kj::mv(handle), KJ_ASSERT_NONNULL(dirPath).append(path));
     });
   }
 
   Maybe<String> tryReadlink(PathPtr path) const {
     // Windows symlinks work differently from Unix. Generally they are set up by the system
     // administrator and apps are expected to treat them transparently. Hence, on Windows, we act
     // as if nothing is a symlink by always returning null here.
     // TODO(someday): If we want to treat Windows symlinks more like Unix ones, start by reverting
     //   the comment that added this comment.
     return nullptr;
   }
 
   // Directory -----------------------------------------------------------------
 
   static LPSECURITY_ATTRIBUTES makeSecAttr(WriteMode mode) {
     if (has(mode, WriteMode::PRIVATE)) {
       KJ_UNIMPLEMENTED("WriteMode::PRIVATE on Win32 is not implemented");
     }
 
     return nullptr;
   }
 
   bool tryMkdir(PathPtr path, WriteMode mode, bool noThrow) const {
     // Internal function to make a directory.
 
     auto filename = nativePath(path);
 
     KJ_WIN32_HANDLE_ERRORS(CreateDirectoryW(filename.begin(), makeSecAttr(mode))) {
       case ERROR_ALREADY_EXISTS:
       case ERROR_FILE_EXISTS: {
         // Apparently this path exists.
         if (!has(mode, WriteMode::MODIFY)) {
           // Require exclusive create.
           return false;
         }
 
         // MODIFY is allowed, so we just need to check whether the existing entry is a directory.
         DWORD attr = GetFileAttributesW(filename.begin());
         if (attr == INVALID_FILE_ATTRIBUTES) {
           // CreateDirectory() says it already exists but we can't get attributes. Maybe it's a
           // dangling link, or maybe we can't access it for some reason. Assume failure.
           //
           // TODO(someday): Maybe we should be creating the directory at the target of the
           //   link?
           goto failed;
         }
         return attr & FILE_ATTRIBUTE_DIRECTORY;
       }
       case ERROR_PATH_NOT_FOUND:
         if (has(mode, WriteMode::CREATE_PARENT) && path.size() > 0 &&
             tryMkdir(path.parent(), WriteMode::CREATE | WriteMode::MODIFY |
                                     WriteMode::CREATE_PARENT, true)) {
           // Retry, but make sure we don't try to create the parent again.
           return tryMkdir(path, mode - WriteMode::CREATE_PARENT, noThrow);
         } else {
           goto failed;
         }
       default:
       failed:
         if (noThrow) {
           // Caller requested no throwing.
           return false;
         } else {
           KJ_FAIL_WIN32("CreateDirectory", error, path);
         }
     }
 
     return true;
   }
 
   kj::Maybe<Array<wchar_t>> createNamedTemporary(
       PathPtr finalName, WriteMode mode, Path& kjTempPath,
       Function<BOOL(const wchar_t*)> tryCreate) const {
     // Create a temporary file which will eventually replace `finalName`.
     //
     // Calls `tryCreate` to actually create the temporary, passing in the desired path. tryCreate()
     // is expected to behave like a win32 call, returning a BOOL and setting `GetLastError()` on
     // error. tryCreate() MUST fail with ERROR_{FILE,ALREADY}_EXISTS if the path exists -- this is
     // not checked in advance, since it needs to be checked atomically. In the case of
     // ERROR_*_EXISTS, tryCreate() will be called again with a new path.
     //
     // Returns the temporary path that succeeded. Only returns nullptr if there was an exception
     // but we're compiled with -fno-exceptions.
     //
     // The optional parameter `kjTempPath` is filled in with the KJ Path of the temporary.
 
     if (finalName.size() == 0) {
       KJ_FAIL_REQUIRE("can't replace self") { break; }
       return nullptr;
     }
 
     static uint counter = 0;
     static const DWORD pid = GetCurrentProcessId();
     auto tempName = kj::str(HIDDEN_PREFIX, pid, '.', counter++, '.',
                             finalName.basename()[0], ".partial");
     kjTempPath = finalName.parent().append(tempName);
     auto path = nativePath(kjTempPath);
 
     KJ_WIN32_HANDLE_ERRORS(tryCreate(path.begin())) {
       case ERROR_ALREADY_EXISTS:
       case ERROR_FILE_EXISTS:
         // Try again with a new counter value.
         return createNamedTemporary(finalName, mode, kj::mv(tryCreate));
       case ERROR_PATH_NOT_FOUND:
         if (has(mode, WriteMode::CREATE_PARENT) && finalName.size() > 1 &&
             tryMkdir(finalName.parent(), WriteMode::CREATE | WriteMode::MODIFY |
                                          WriteMode::CREATE_PARENT, true)) {
           // Retry, but make sure we don't try to create the parent again.
           mode = mode - WriteMode::CREATE_PARENT;
           return createNamedTemporary(finalName, mode, kj::mv(tryCreate));
         }
         KJ_FALLTHROUGH;
       default:
         KJ_FAIL_WIN32("create(path)", error, path) { break; }
         return nullptr;
     }
 
     return kj::mv(path);
   }
 
   kj::Maybe<Array<wchar_t>> createNamedTemporary(
       PathPtr finalName, WriteMode mode, Function<BOOL(const wchar_t*)> tryCreate) const {
     Path dummy = nullptr;
     return createNamedTemporary(finalName, mode, dummy, kj::mv(tryCreate));
   }
 
   bool tryReplaceNode(PathPtr path, WriteMode mode,
                       Function<BOOL(const wchar_t*)> tryCreate) const {
     // Replaces the given path with an object created by calling tryCreate().
     //
     // tryCreate() must behave like a win32 call which creates the node at the path passed to it,
     // returning FALSE error. If the path passed to tryCreate already exists, it MUST fail with
     // ERROR_{FILE,ALREADY}_EXISTS.
     //
     // When `mode` includes MODIFY, replaceNode() reacts to ERROR_*_EXISTS by creating the
     // node in a temporary location and then rename()ing it into place.
 
     if (path.size() == 0) {
       KJ_FAIL_REQUIRE("can't replace self") { return false; }
     }
 
     auto filename = nativePath(path);
 
     if (has(mode, WriteMode::CREATE)) {
       // First try just cerating the node in-place.
       KJ_WIN32_HANDLE_ERRORS(tryCreate(filename.begin())) {
         case ERROR_ALREADY_EXISTS:
         case ERROR_FILE_EXISTS:
           // Target exists.
           if (has(mode, WriteMode::MODIFY)) {
             // Fall back to MODIFY path, below.
             break;
           } else {
             return false;
           }
         case ERROR_PATH_NOT_FOUND:
           if (has(mode, WriteMode::CREATE_PARENT) && path.size() > 0 &&
               tryMkdir(path.parent(), WriteMode::CREATE | WriteMode::MODIFY |
                                       WriteMode::CREATE_PARENT, true)) {
             // Retry, but make sure we don't try to create the parent again.
             return tryReplaceNode(path, mode - WriteMode::CREATE_PARENT, kj::mv(tryCreate));
           }
           KJ_FALLTHROUGH;
         default:
           KJ_FAIL_WIN32("create(path)", error, path) { return false; }
       } else {
         // Success.
         return true;
       }
     }
 
     // Either we don't have CREATE mode or the target already exists. We need to perform a
     // replacement instead.
 
     KJ_IF_MAYBE(tempPath, createNamedTemporary(path, mode, kj::mv(tryCreate))) {
       if (tryCommitReplacement(path, *tempPath, mode)) {
         return true;
       } else {
         KJ_WIN32_HANDLE_ERRORS(DeleteFileW(tempPath->begin())) {
           case ERROR_FILE_NOT_FOUND:
             // meh
             break;
           default:
             KJ_FAIL_WIN32("DeleteFile(tempPath)", error, dbgStr(*tempPath));
         }
         return false;
       }
     } else {
       // threw, but exceptions are disabled
       return false;
     }
   }
 
   Maybe<AutoCloseHandle> tryOpenFileInternal(PathPtr path, WriteMode mode, bool append) const {
     DWORD disposition;
     if (has(mode, WriteMode::MODIFY)) {
       if (has(mode, WriteMode::CREATE)) {
         disposition = OPEN_ALWAYS;
       } else {
         disposition = OPEN_EXISTING;
       }
     } else {
       if (has(mode, WriteMode::CREATE)) {
         disposition = CREATE_NEW;
       } else {
         // Neither CREATE nor MODIFY -- impossible to satisfy preconditions.
         return nullptr;
       }
     }
 
     DWORD access = GENERIC_READ | GENERIC_WRITE;
     if (append) {
       // FILE_GENERIC_WRITE includes both FILE_APPEND_DATA and FILE_WRITE_DATA, but we only want
       // the former. There are also a zillion other bits that we need, annoyingly.
       access = (FILE_READ_ATTRIBUTES | FILE_GENERIC_WRITE) & ~FILE_WRITE_DATA;
     }
 
     auto filename = path.toString();
 
     HANDLE newHandle;
     KJ_WIN32_HANDLE_ERRORS(newHandle = CreateFileW(
         nativePath(path).begin(),
         access,
         FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
         makeSecAttr(mode),
         disposition,
         FILE_ATTRIBUTE_NORMAL,
         NULL)) {
       case ERROR_PATH_NOT_FOUND:
         if (has(mode, WriteMode::CREATE)) {
           // A parent directory didn't exist. Maybe cerate it.
           if (has(mode, WriteMode::CREATE_PARENT) && path.size() > 0 &&
               tryMkdir(path.parent(), WriteMode::CREATE | WriteMode::MODIFY |
                                       WriteMode::CREATE_PARENT, true)) {
             // Retry, but make sure we don't try to create the parent again.
             return tryOpenFileInternal(path, mode - WriteMode::CREATE_PARENT, append);
           }
 
           KJ_FAIL_REQUIRE("parent is not a directory", path) { return nullptr; }
         } else {
           // MODIFY-only mode. ERROR_PATH_NOT_FOUND = parent path doesn't exist = return null.
           return nullptr;
         }
       case ERROR_FILE_NOT_FOUND:
         if (!has(mode, WriteMode::CREATE)) {
           // MODIFY-only mode. ERROR_FILE_NOT_FOUND = doesn't exist = return null.
           return nullptr;
         }
         goto failed;
       case ERROR_ALREADY_EXISTS:
       case ERROR_FILE_EXISTS:
         if (!has(mode, WriteMode::MODIFY)) {
           // CREATE-only mode. ERROR_ALREADY_EXISTS = already exists = return null.
           return nullptr;
         }
         goto failed;
       default:
       failed:
         KJ_FAIL_WIN32("CreateFile", error, path) { return nullptr; }
     }
 
     return kj::AutoCloseHandle(newHandle);
   }
 
   bool tryCommitReplacement(
       PathPtr toPath, ArrayPtr<const wchar_t> fromPath,
       WriteMode mode, kj::Maybe<kj::PathPtr> pathForCreatingParents = nullptr) const {
     // Try to use MoveFileEx() to replace `toPath` with `fromPath`.
 
     auto wToPath = nativePath(toPath);
 
     DWORD flags = has(mode, WriteMode::MODIFY) ? MOVEFILE_REPLACE_EXISTING : 0;
 
     if (!has(mode, WriteMode::CREATE)) {
       // Non-atomically verify that target exists. There's no way to make this atomic.
       DWORD result = GetFileAttributesW(wToPath.begin());
       if (result == INVALID_FILE_ATTRIBUTES) {
         auto error = GetLastError();
         switch (error) {
           case ERROR_FILE_NOT_FOUND:
           case ERROR_PATH_NOT_FOUND:
             return false;
           default:
             KJ_FAIL_WIN32("GetFileAttributesEx(toPath)", error, toPath) { return false; }
         }
       }
     }
 
     KJ_WIN32_HANDLE_ERRORS(MoveFileExW(fromPath.begin(), wToPath.begin(), flags)) {
       case ERROR_ALREADY_EXISTS:
       case ERROR_FILE_EXISTS:
         // We must not be in MODIFY mode.
         return false;
       case ERROR_PATH_NOT_FOUND:
         KJ_IF_MAYBE(p, pathForCreatingParents) {
           if (has(mode, WriteMode::CREATE_PARENT) &&
               p->size() > 0 && tryMkdir(p->parent(),
                   WriteMode::CREATE | WriteMode::MODIFY | WriteMode::CREATE_PARENT, true)) {
             // Retry, but make sure we don't try to create the parent again.
             return tryCommitReplacement(toPath, fromPath, mode - WriteMode::CREATE_PARENT);
           }
         }
         goto default_;
 
       case ERROR_ACCESS_DENIED: {
         // This often means that the target already exists and cannot be replaced, e.g. because
         // it is a directory. Move it out of the way first, then move our replacement in, then
         // delete the old thing.
 
         if (has(mode, WriteMode::MODIFY)) {
           KJ_IF_MAYBE(tempName,
               createNamedTemporary(toPath, WriteMode::CREATE, [&](const wchar_t* tempName2) {
             return MoveFileW(wToPath.begin(), tempName2);
           })) {
             KJ_WIN32_HANDLE_ERRORS(MoveFileW(fromPath.begin(), wToPath.begin())) {
               default:
                 // Try to move back.
                 MoveFileW(tempName->begin(), wToPath.begin());
                 KJ_FAIL_WIN32("MoveFile", error, dbgStr(fromPath), dbgStr(wToPath)) {
                   return false;
                 }
             }
 
             // Succeeded, delete temporary.
             rmrf(*tempName);
             return true;
           } else {
             // createNamedTemporary() threw exception but exceptions are disabled.
             return false;
           }
         } else {
           // Not MODIFY, so no overwrite allowed. If the file really does exist, we need to return
           // false.
           if (GetFileAttributesW(wToPath.begin()) != INVALID_FILE_ATTRIBUTES) {
             return false;
           }
         }
 
         goto default_;
       }
 
       default:
       default_:
         KJ_FAIL_WIN32("MoveFileEx", error, dbgStr(wToPath), dbgStr(fromPath)) { return false; }
     }
 
     return true;
   }
 
   template <typename T>
   class ReplacerImpl final: public Directory::Replacer<T> {
   public:
     ReplacerImpl(Own<T>&& object, const DiskHandle& parentDirectory,
                  Array<wchar_t>&& tempPath, Path&& path, WriteMode mode)
         : Directory::Replacer<T>(mode),
           object(kj::mv(object)), parentDirectory(parentDirectory),
           tempPath(kj::mv(tempPath)), path(kj::mv(path)) {}
 
     ~ReplacerImpl() noexcept(false) {
       if (!committed) {
         object = Own<T>();  // Force close of handle before trying to delete.
 
         if (kj::isSameType<T, File>()) {
           KJ_WIN32(DeleteFileW(tempPath.begin())) { break; }
         } else {
           rmrfChildren(tempPath);
           KJ_WIN32(RemoveDirectoryW(tempPath.begin())) { break; }
         }
       }
     }
 
     const T& get() override {
       return *object;
     }
 
     bool tryCommit() override {
       KJ_ASSERT(!committed, "already committed") { return false; }
 
       // For directories, we intentionally don't use FILE_SHARE_DELETE on our handle because if the
       // directory name changes our paths would be wrong. But, this means we can't rename the
       // directory here to commit it. So, we need to close the handle and then re-open it
       // afterwards. Ick.
       AutoCloseHandle* objectHandle = getHandlePointerHack(*object);
       if (kj::isSameType<T, Directory>()) {
         *objectHandle = nullptr;
       }
       KJ_DEFER({
         if (kj::isSameType<T, Directory>()) {
           HANDLE newHandle = nullptr;
           KJ_WIN32(newHandle = CreateFileW(
               committed ? parentDirectory.nativePath(path).begin() : tempPath.begin(),
               GENERIC_READ,
               FILE_SHARE_READ | FILE_SHARE_WRITE,
               NULL,
               OPEN_EXISTING,
               FILE_FLAG_BACKUP_SEMANTICS,  // apparently, this flag is required for directories
               NULL)) { return; }
           *objectHandle = AutoCloseHandle(newHandle);
           *getPathPointerHack(*object) = KJ_ASSERT_NONNULL(parentDirectory.dirPath).append(path);
         }
       });
 
       return committed = parentDirectory.tryCommitReplacement(
           path, tempPath, Directory::Replacer<T>::mode);
     }
 
   private:
     Own<T> object;
     const DiskHandle& parentDirectory;
     Array<wchar_t> tempPath;
     Path path;
     bool committed = false;  // true if *successfully* committed (in which case tempPath is gone)
   };
 
   template <typename T>
   class BrokenReplacer final: public Directory::Replacer<T> {
     // For recovery path when exceptions are disabled.
 
   public:
     BrokenReplacer(Own<const T> inner)
         : Directory::Replacer<T>(WriteMode::CREATE | WriteMode::MODIFY),
           inner(kj::mv(inner)) {}
 
     const T& get() override { return *inner; }
     bool tryCommit() override { return false; }
 
   private:
     Own<const T> inner;
   };
 
   Maybe<Own<const File>> tryOpenFile(PathPtr path, WriteMode mode) const {
     return tryOpenFileInternal(path, mode, false).map(newDiskFile);
   }
 
   Own<Directory::Replacer<File>> replaceFile(PathPtr path, WriteMode mode) const {
     HANDLE newHandle_;
     KJ_IF_MAYBE(temp, createNamedTemporary(path, mode,
         [&](const wchar_t* candidatePath) {
       newHandle_ = CreateFileW(
           candidatePath,
           GENERIC_READ | GENERIC_WRITE,
           FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
           makeSecAttr(mode),
           CREATE_NEW,
           FILE_ATTRIBUTE_NORMAL,
           NULL);
       return newHandle_ != INVALID_HANDLE_VALUE;
     })) {
       AutoCloseHandle newHandle(newHandle_);
       return heap<ReplacerImpl<File>>(newDiskFile(kj::mv(newHandle)), *this, kj::mv(*temp),
                                       path.clone(), mode);
     } else {
       // threw, but exceptions are disabled
       return heap<BrokenReplacer<File>>(newInMemoryFile(nullClock()));
     }
   }
 
   Own<const File> createTemporary() const {
     HANDLE newHandle_;
     KJ_IF_MAYBE(temp, createNamedTemporary(Path("unnamed"), WriteMode::CREATE,
         [&](const wchar_t* candidatePath) {
       newHandle_ = CreateFileW(
           candidatePath,
           GENERIC_READ | GENERIC_WRITE,
           0,
           NULL,   // TODO(someday): makeSecAttr(WriteMode::PRIVATE), when it's implemented
           CREATE_NEW,
           FILE_ATTRIBUTE_TEMPORARY | FILE_FLAG_DELETE_ON_CLOSE,
           NULL);
       return newHandle_ != INVALID_HANDLE_VALUE;
     })) {
       AutoCloseHandle newHandle(newHandle_);
       return newDiskFile(kj::mv(newHandle));
     } else {
       // threw, but exceptions are disabled
       return newInMemoryFile(nullClock());
     }
   }
 
   Maybe<Own<AppendableFile>> tryAppendFile(PathPtr path, WriteMode mode) const {
     return tryOpenFileInternal(path, mode, true).map(newDiskAppendableFile);
   }
 
   Maybe<Own<const Directory>> tryOpenSubdir(PathPtr path, WriteMode mode) const {
     // Must create before open.
     if (has(mode, WriteMode::CREATE)) {
       if (!tryMkdir(path, mode, false)) return nullptr;
     }
 
     return tryOpenSubdirInternal(path).map([&](AutoCloseHandle&& handle) {
       return newDiskDirectory(kj::mv(handle), KJ_ASSERT_NONNULL(dirPath).append(path));
     });
   }
 
   Own<Directory::Replacer<Directory>> replaceSubdir(PathPtr path, WriteMode mode) const {
     Path kjTempPath = nullptr;
     KJ_IF_MAYBE(temp, createNamedTemporary(path, mode, kjTempPath,
         [&](const wchar_t* candidatePath) {
       return CreateDirectoryW(candidatePath, makeSecAttr(mode));
     })) {
       HANDLE subdirHandle_;
       KJ_WIN32_HANDLE_ERRORS(subdirHandle_ = CreateFileW(
           temp->begin(),
           GENERIC_READ,
           FILE_SHARE_READ | FILE_SHARE_WRITE,
           NULL,
           OPEN_EXISTING,
           FILE_FLAG_BACKUP_SEMANTICS,  // apparently, this flag is required for directories
           NULL)) {
         default:
           KJ_FAIL_WIN32("CreateFile(just-created-temporary, OPEN_EXISTING)", error, path) {
             goto fail;
           }
       }
 
       AutoCloseHandle subdirHandle(subdirHandle_);
       return heap<ReplacerImpl<Directory>>(
           newDiskDirectory(kj::mv(subdirHandle),
               KJ_ASSERT_NONNULL(dirPath).append(kj::mv(kjTempPath))),
           *this, kj::mv(*temp), path.clone(), mode);
     } else {
       // threw, but exceptions are disabled
     fail:
       return heap<BrokenReplacer<Directory>>(newInMemoryDirectory(nullClock()));
     }
   }
 
   bool trySymlink(PathPtr linkpath, StringPtr content, WriteMode mode) const {
     // We can't really create symlinks on Windows. Reasons:
     // - We'd need to know whether the target is a file or a directory to pass the correct flags.
     //   That means we'd need to evaluate the link content and track down the target. What if the
     //   taget doesn't exist? It's unclear if this is even allowed on Windows.
     // - Apparently, creating symlinks is a privileged operation on Windows prior to Windows 10.
     //   The flag SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE is very new.
     KJ_UNIMPLEMENTED(
         "Creating symbolic links is not supported on Windows due to semantic differences.");
   }
 
   bool tryTransfer(PathPtr toPath, WriteMode toMode,
                    const Directory& fromDirectory, PathPtr fromPath,
                    TransferMode mode, const Directory& self) const {
     KJ_REQUIRE(toPath.size() > 0, "can't replace self") { return false; }
 
     // Try to get the "from" path.
     Array<wchar_t> rawFromPath;
 #if !KJ_NO_RTTI
     // Oops, dynamicDowncastIfAvailable() doesn't work since this isn't a downcast, it's a
     // side-cast...
     if (auto dh = dynamic_cast<const DiskHandle*>(&fromDirectory)) {
       rawFromPath = dh->nativePath(fromPath);
     } else
 #endif
     KJ_IF_MAYBE(h, fromDirectory.getWin32Handle()) {
       // Can't downcast to DiskHandle, but getWin32Handle() returns a handle... maybe RTTI is
       // disabled? Or maybe this is some kind of wrapper?
       rawFromPath = getPathFromHandle(*h).append(fromPath).forWin32Api(true);
     } else {
       // Not a disk directory, so fall back to default implementation.
       return self.Directory::tryTransfer(toPath, toMode, fromDirectory, fromPath, mode);
     }
 
     if (mode == TransferMode::LINK) {
       return tryReplaceNode(toPath, toMode, [&](const wchar_t* candidatePath) {
         return CreateHardLinkW(candidatePath, rawFromPath.begin(), NULL);
       });
     } else if (mode == TransferMode::MOVE) {
       return tryCommitReplacement(toPath, rawFromPath, toMode, toPath);
     } else if (mode == TransferMode::COPY) {
       // We can accellerate copies on Windows.
 
       if (!has(toMode, WriteMode::CREATE)) {
         // Non-atomically verify that target exists. There's no way to make this atomic.
         if (!exists(toPath)) return false;
       }
 
       bool failIfExists = !has(toMode, WriteMode::MODIFY);
       KJ_WIN32_HANDLE_ERRORS(
           CopyFileW(rawFromPath.begin(), nativePath(toPath).begin(), failIfExists)) {
         case ERROR_ALREADY_EXISTS:
         case ERROR_FILE_EXISTS:
         case ERROR_FILE_NOT_FOUND:
         case ERROR_PATH_NOT_FOUND:
           return false;
         case ERROR_ACCESS_DENIED:
           // This usually means that fromPath was a directory or toPath was a direcotry. Fall back
           // to default implementation.
           break;
         default:
           KJ_FAIL_WIN32("CopyFile", error, fromPath, toPath) { return false; }
       } else {
         // Copy succeeded.
         return true;
       }
     }
 
     // OK, we can't do anything efficient using the OS. Fall back to default implementation.
     return self.Directory::tryTransfer(toPath, toMode, fromDirectory, fromPath, mode);
   }
 
   bool tryRemove(PathPtr path) const {
     return rmrf(nativePath(path));
   }
 };
 
 #define FSNODE_METHODS                                              \
   Maybe<void*> getWin32Handle() const override { return DiskHandle::getWin32Handle(); } \
                                                                     \
   Metadata stat() const override { return DiskHandle::stat(); }     \
   void sync() const override { DiskHandle::sync(); }                \
   void datasync() const override { DiskHandle::datasync(); }
 
 class DiskReadableFile final: public ReadableFile, public DiskHandle {
 public:
   DiskReadableFile(AutoCloseHandle&& handle): DiskHandle(kj::mv(handle), nullptr) {}
 
   Own<const FsNode> cloneFsNode() const override {
     return heap<DiskReadableFile>(DiskHandle::clone());
   }
 
   FSNODE_METHODS
 
   size_t read(uint64_t offset, ArrayPtr<byte> buffer) const override {
     return DiskHandle::read(offset, buffer);
   }
   Array<const byte> mmap(uint64_t offset, uint64_t size) const override {
     return DiskHandle::mmap(offset, size);
   }
   Array<byte> mmapPrivate(uint64_t offset, uint64_t size) const override {
     return DiskHandle::mmapPrivate(offset, size);
   }
 };
 
 class DiskAppendableFile final: public AppendableFile, public DiskHandle {
 public:
   DiskAppendableFile(AutoCloseHandle&& handle)
       : DiskHandle(kj::mv(handle), nullptr),
         stream(DiskHandle::handle.get()) {}
 
   Own<const FsNode> cloneFsNode() const override {
     return heap<DiskAppendableFile>(DiskHandle::clone());
   }
 
   FSNODE_METHODS
 
   void write(const void* buffer, size_t size) override { stream.write(buffer, size); }
   void write(ArrayPtr<const ArrayPtr<const byte>> pieces) override {
     implicitCast<OutputStream&>(stream).write(pieces);
   }
 
 private:
   HandleOutputStream stream;
 };
 
 class DiskFile final: public File, public DiskHandle {
 public:
   DiskFile(AutoCloseHandle&& handle): DiskHandle(kj::mv(handle), nullptr) {}
 
   Own<const FsNode> cloneFsNode() const override {
     return heap<DiskFile>(DiskHandle::clone());
   }
 
   FSNODE_METHODS
 
   size_t read(uint64_t offset, ArrayPtr<byte> buffer) const override {
     return DiskHandle::read(offset, buffer);
   }
   Array<const byte> mmap(uint64_t offset, uint64_t size) const override {
     return DiskHandle::mmap(offset, size);
   }
   Array<byte> mmapPrivate(uint64_t offset, uint64_t size) const override {
     return DiskHandle::mmapPrivate(offset, size);
   }
 
   void write(uint64_t offset, ArrayPtr<const byte> data) const override {
     DiskHandle::write(offset, data);
   }
   void zero(uint64_t offset, uint64_t size) const override {
     DiskHandle::zero(offset, size);
   }
   void truncate(uint64_t size) const override {
     DiskHandle::truncate(size);
   }
   Own<const WritableFileMapping> mmapWritable(uint64_t offset, uint64_t size) const override {
     return DiskHandle::mmapWritable(offset, size);
   }
   // copy() is not optimized on Windows.
 };
 
 class DiskReadableDirectory final: public ReadableDirectory, public DiskHandle {
 public:
   DiskReadableDirectory(AutoCloseHandle&& handle, Path&& path)
       : DiskHandle(kj::mv(handle), kj::mv(path)) {}
 
   Own<const FsNode> cloneFsNode() const override {
     return heap<DiskReadableDirectory>(DiskHandle::clone(), KJ_ASSERT_NONNULL(dirPath).clone());
   }
 
   FSNODE_METHODS
 
   Array<String> listNames() const override { return DiskHandle::listNames(); }
   Array<Entry> listEntries() const override { return DiskHandle::listEntries(); }
   bool exists(PathPtr path) const override { return DiskHandle::exists(path); }
   Maybe<FsNode::Metadata> tryLstat(PathPtr path) const override {
     return DiskHandle::tryLstat(path);
   }
   Maybe<Own<const ReadableFile>> tryOpenFile(PathPtr path) const override {
     return DiskHandle::tryOpenFile(path);
   }
   Maybe<Own<const ReadableDirectory>> tryOpenSubdir(PathPtr path) const override {
     return DiskHandle::tryOpenSubdir(path);
   }
   Maybe<String> tryReadlink(PathPtr path) const override { return DiskHandle::tryReadlink(path); }
 };
 
 class DiskDirectoryBase: public Directory, public DiskHandle {
 public:
   DiskDirectoryBase(AutoCloseHandle&& handle, Path&& path)
       : DiskHandle(kj::mv(handle), kj::mv(path)) {}
 
   bool exists(PathPtr path) const override { return DiskHandle::exists(path); }
   Maybe<FsNode::Metadata> tryLstat(PathPtr path) const override { return DiskHandle::tryLstat(path); }
   Maybe<Own<const ReadableFile>> tryOpenFile(PathPtr path) const override {
     return DiskHandle::tryOpenFile(path);
   }
   Maybe<Own<const ReadableDirectory>> tryOpenSubdir(PathPtr path) const override {
     return DiskHandle::tryOpenSubdir(path);
   }
   Maybe<String> tryReadlink(PathPtr path) const override { return DiskHandle::tryReadlink(path); }
 
   Maybe<Own<const File>> tryOpenFile(PathPtr path, WriteMode mode) const override {
     return DiskHandle::tryOpenFile(path, mode);
   }
   Own<Replacer<File>> replaceFile(PathPtr path, WriteMode mode) const override {
     return DiskHandle::replaceFile(path, mode);
   }
   Maybe<Own<AppendableFile>> tryAppendFile(PathPtr path, WriteMode mode) const override {
     return DiskHandle::tryAppendFile(path, mode);
   }
   Maybe<Own<const Directory>> tryOpenSubdir(PathPtr path, WriteMode mode) const override {
     return DiskHandle::tryOpenSubdir(path, mode);
   }
   Own<Replacer<Directory>> replaceSubdir(PathPtr path, WriteMode mode) const override {
     return DiskHandle::replaceSubdir(path, mode);
   }
   bool trySymlink(PathPtr linkpath, StringPtr content, WriteMode mode) const override {
     return DiskHandle::trySymlink(linkpath, content, mode);
   }
   bool tryTransfer(PathPtr toPath, WriteMode toMode,
                    const Directory& fromDirectory, PathPtr fromPath,
                    TransferMode mode) const override {
     return DiskHandle::tryTransfer(toPath, toMode, fromDirectory, fromPath, mode, *this);
   }
   // tryTransferTo() not implemented because we have nothing special we can do.
   bool tryRemove(PathPtr path) const override {
     return DiskHandle::tryRemove(path);
   }
 };
 
 class DiskDirectory final: public DiskDirectoryBase {
 public:
   DiskDirectory(AutoCloseHandle&& handle, Path&& path)
       : DiskDirectoryBase(kj::mv(handle), kj::mv(path)) {}
 
   Own<const FsNode> cloneFsNode() const override {
     return heap<DiskDirectory>(DiskHandle::clone(), KJ_ASSERT_NONNULL(dirPath).clone());
   }
 
   FSNODE_METHODS
 
   Array<String> listNames() const override { return DiskHandle::listNames(); }
   Array<Entry> listEntries() const override { return DiskHandle::listEntries(); }
   Own<const File> createTemporary() const override {
     return DiskHandle::createTemporary();
   }
 };
 
 class RootDiskDirectory final: public DiskDirectoryBase {
   // On Windows, the root directory is special.
   //
   // HACK: We only override a few functions of DiskDirectory, and we rely on the fact that
   //   Path::forWin32Api(true) throws an exception complaining about missing drive letter if the
   //   path is totally empty.
 
 public:
   RootDiskDirectory(): DiskDirectoryBase(nullptr, Path(nullptr)) {}
 
   Own<const FsNode> cloneFsNode() const override {
     return heap<RootDiskDirectory>();
   }
 
   Metadata stat() const override {
     return { Type::DIRECTORY, 0, 0, UNIX_EPOCH, 1, 0 };
   }
   void sync() const override {}
   void datasync() const override {}
 
   Array<String> listNames() const override {
     return KJ_MAP(e, listEntries()) { return kj::mv(e.name); };
   }
   Array<Entry> listEntries() const override {
     DWORD drives = GetLogicalDrives();
     if (drives == 0) {
       KJ_FAIL_WIN32("GetLogicalDrives()", GetLastError()) { return nullptr; }
     }
 
     Vector<Entry> results;
     for (uint i = 0; i < 26; i++) {
       if (drives & (1 << i)) {
         char name[2] = { static_cast<char>('A' + i), ':' };
         results.add(Entry { FsNode::Type::DIRECTORY, kj::heapString(name, 2) });
       }
     }
 
     return results.releaseAsArray();
   }
 
   Own<const File> createTemporary() const override {
     KJ_FAIL_REQUIRE("can't create temporaries in Windows pseudo-root directory (the drive list)");
   }
 };
 
 class DiskFilesystem final: public Filesystem {
 public:
   DiskFilesystem()
       : DiskFilesystem(computeCurrentPath()) {}
   DiskFilesystem(Path currentPath)
       : current(KJ_ASSERT_NONNULL(root.tryOpenSubdirInternal(currentPath),
                       "path returned by GetCurrentDirectory() doesn't exist?"),
                 kj::mv(currentPath)) {}
 
   const Directory& getRoot() const override {
     return root;
   }
 
   const Directory& getCurrent() const override {
     return current;
   }
 
   PathPtr getCurrentPath() const override {
     return KJ_ASSERT_NONNULL(current.dirPath);
   }
 
 private:
   RootDiskDirectory root;
   DiskDirectory current;
 
   static Path computeCurrentPath() {
     DWORD tryLen = MAX_PATH;
     for (;;) {
       auto temp = kj::heapArray<wchar_t>(tryLen + 1);
       DWORD len = GetCurrentDirectoryW(temp.size(), temp.begin());
       if (len == 0) {
         KJ_FAIL_WIN32("GetCurrentDirectory", GetLastError()) { break; }
         return Path(".");
       }
       if (len < temp.size()) {
         return Path::parseWin32Api(temp.slice(0, len));
       }
       // Try again with new length.
       tryLen = len;
     }
   }
 };
 
 } // namespace
 
 Own<ReadableFile> newDiskReadableFile(AutoCloseHandle fd) {
   return heap<DiskReadableFile>(kj::mv(fd));
 }
 Own<AppendableFile> newDiskAppendableFile(AutoCloseHandle fd) {
   return heap<DiskAppendableFile>(kj::mv(fd));
 }
 Own<File> newDiskFile(AutoCloseHandle fd) {
   return heap<DiskFile>(kj::mv(fd));
 }
 Own<ReadableDirectory> newDiskReadableDirectory(AutoCloseHandle fd) {
   return heap<DiskReadableDirectory>(kj::mv(fd), getPathFromHandle(fd));
 }
 static Own<ReadableDirectory> newDiskReadableDirectory(AutoCloseHandle fd, Path&& path) {
   return heap<DiskReadableDirectory>(kj::mv(fd), kj::mv(path));
 }
 Own<Directory> newDiskDirectory(AutoCloseHandle fd) {
   return heap<DiskDirectory>(kj::mv(fd), getPathFromHandle(fd));
 }
 static Own<Directory> newDiskDirectory(AutoCloseHandle fd, Path&& path) {
   return heap<DiskDirectory>(kj::mv(fd), kj::mv(path));
 }
 
 Own<Filesystem> newDiskFilesystem() {
   return heap<DiskFilesystem>();
 }
 
 static AutoCloseHandle* getHandlePointerHack(Directory& dir) {
   return &static_cast<DiskDirectoryBase&>(dir).handle;
 }
 static Path* getPathPointerHack(Directory& dir) {
   return &KJ_ASSERT_NONNULL(static_cast<DiskDirectoryBase&>(dir).dirPath);
 }
 
 } // namespace kj
 
 #endif  // _WIN32