536 lines · cpp
1//===--- CrashRecoveryContext.cpp - Crash Recovery ------------------------===//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===----------------------------------------------------------------------===//8 9#include "llvm/Support/CrashRecoveryContext.h"10#include "llvm/Config/llvm-config.h"11#include "llvm/Support/ErrorHandling.h"12#include "llvm/Support/ExitCodes.h"13#include "llvm/Support/Signals.h"14#include "llvm/Support/thread.h"15#include <cassert>16#include <mutex>17#include <setjmp.h>18 19using namespace llvm;20 21namespace {22 23struct CrashRecoveryContextImpl;24static LLVM_THREAD_LOCAL const CrashRecoveryContextImpl *CurrentContext;25 26struct CrashRecoveryContextImpl {27 // When threads are disabled, this links up all active28 // CrashRecoveryContextImpls. When threads are enabled there's one thread29 // per CrashRecoveryContext and CurrentContext is a thread-local, so only one30 // CrashRecoveryContextImpl is active per thread and this is always null.31 const CrashRecoveryContextImpl *Next;32 33 CrashRecoveryContext *CRC;34 ::jmp_buf JumpBuffer;35 volatile unsigned Failed : 1;36 unsigned SwitchedThread : 1;37 unsigned ValidJumpBuffer : 1;38 39public:40 CrashRecoveryContextImpl(CrashRecoveryContext *CRC) noexcept41 : CRC(CRC), Failed(false), SwitchedThread(false), ValidJumpBuffer(false) {42 Next = CurrentContext;43 CurrentContext = this;44 }45 ~CrashRecoveryContextImpl() {46 if (!SwitchedThread)47 CurrentContext = Next;48 }49 50 /// Called when the separate crash-recovery thread was finished, to51 /// indicate that we don't need to clear the thread-local CurrentContext.52 void setSwitchedThread() {53#if defined(LLVM_ENABLE_THREADS) && LLVM_ENABLE_THREADS != 054 SwitchedThread = true;55#endif56 }57 58 // If the function ran by the CrashRecoveryContext crashes or fails, then59 // 'RetCode' represents the returned error code, as if it was returned by a60 // process. 'Context' represents the signal type on Unix; on Windows, it is61 // the ExceptionContext.62 void HandleCrash(int RetCode, uintptr_t Context) {63 // Eliminate the current context entry, to avoid re-entering in case the64 // cleanup code crashes.65 CurrentContext = Next;66 67 assert(!Failed && "Crash recovery context already failed!");68 Failed = true;69 70 if (CRC->DumpStackAndCleanupOnFailure)71 sys::CleanupOnSignal(Context);72 73 CRC->RetCode = RetCode;74 75 // Jump back to the RunSafely we were called under.76 if (ValidJumpBuffer)77 longjmp(JumpBuffer, 1);78 79 // Otherwise let the caller decide of the outcome of the crash. Currently80 // this occurs when using SEH on Windows with MSVC or clang-cl.81 }82};83 84std::mutex &getCrashRecoveryContextMutex() {85 static std::mutex CrashRecoveryContextMutex;86 return CrashRecoveryContextMutex;87}88 89static bool gCrashRecoveryEnabled = false;90 91static LLVM_THREAD_LOCAL const CrashRecoveryContext *IsRecoveringFromCrash;92 93} // namespace94 95static void installExceptionOrSignalHandlers();96static void uninstallExceptionOrSignalHandlers();97 98CrashRecoveryContextCleanup::~CrashRecoveryContextCleanup() = default;99 100CrashRecoveryContext::CrashRecoveryContext() {101 // On Windows, if abort() was previously triggered (and caught by a previous102 // CrashRecoveryContext) the Windows CRT removes our installed signal handler,103 // so we need to install it again.104 sys::DisableSystemDialogsOnCrash();105}106 107CrashRecoveryContext::~CrashRecoveryContext() {108 // Reclaim registered resources.109 CrashRecoveryContextCleanup *i = head;110 const CrashRecoveryContext *PC = IsRecoveringFromCrash;111 IsRecoveringFromCrash = this;112 while (i) {113 CrashRecoveryContextCleanup *tmp = i;114 i = tmp->next;115 tmp->cleanupFired = true;116 tmp->recoverResources();117 delete tmp;118 }119 IsRecoveringFromCrash = PC;120 121 CrashRecoveryContextImpl *CRCI = (CrashRecoveryContextImpl *) Impl;122 delete CRCI;123}124 125bool CrashRecoveryContext::isRecoveringFromCrash() {126 return IsRecoveringFromCrash != nullptr;127}128 129CrashRecoveryContext *CrashRecoveryContext::GetCurrent() {130 if (!gCrashRecoveryEnabled)131 return nullptr;132 133 const CrashRecoveryContextImpl *CRCI = CurrentContext;134 if (!CRCI)135 return nullptr;136 137 return CRCI->CRC;138}139 140void CrashRecoveryContext::Enable() {141 std::lock_guard<std::mutex> L(getCrashRecoveryContextMutex());142 // FIXME: Shouldn't this be a refcount or something?143 if (gCrashRecoveryEnabled)144 return;145 gCrashRecoveryEnabled = true;146 installExceptionOrSignalHandlers();147}148 149void CrashRecoveryContext::Disable() {150 std::lock_guard<std::mutex> L(getCrashRecoveryContextMutex());151 if (!gCrashRecoveryEnabled)152 return;153 gCrashRecoveryEnabled = false;154 uninstallExceptionOrSignalHandlers();155}156 157void CrashRecoveryContext::registerCleanup(CrashRecoveryContextCleanup *cleanup)158{159 if (!cleanup)160 return;161 if (head)162 head->prev = cleanup;163 cleanup->next = head;164 head = cleanup;165}166 167void168CrashRecoveryContext::unregisterCleanup(CrashRecoveryContextCleanup *cleanup) {169 if (!cleanup)170 return;171 if (cleanup == head) {172 head = cleanup->next;173 if (head)174 head->prev = nullptr;175 }176 else {177 cleanup->prev->next = cleanup->next;178 if (cleanup->next)179 cleanup->next->prev = cleanup->prev;180 }181 delete cleanup;182}183 184#if defined(_MSC_VER)185 186#include <windows.h> // for GetExceptionInformation187 188// If _MSC_VER is defined, we must have SEH. Use it if it's available. It's way189// better than VEH. Vectored exception handling catches all exceptions happening190// on the thread with installed exception handlers, so it can interfere with191// internal exception handling of other libraries on that thread. SEH works192// exactly as you would expect normal exception handling to work: it only193// catches exceptions if they would bubble out from the stack frame with __try /194// __except.195 196static void installExceptionOrSignalHandlers() {}197static void uninstallExceptionOrSignalHandlers() {}198 199// We need this function because the call to GetExceptionInformation() can only200// occur inside the __except evaluation block201static int ExceptionFilter(_EXCEPTION_POINTERS *Except) {202 // Lookup the current thread local recovery object.203 const CrashRecoveryContextImpl *CRCI = CurrentContext;204 205 if (!CRCI) {206 // Something has gone horribly wrong, so let's just tell everyone207 // to keep searching208 CrashRecoveryContext::Disable();209 return EXCEPTION_CONTINUE_SEARCH;210 }211 212 int RetCode = (int)Except->ExceptionRecord->ExceptionCode;213 if ((RetCode & 0xF0000000) == 0xE0000000)214 RetCode &= ~0xF0000000; // this crash was generated by sys::Process::Exit215 216 // Handle the crash217 const_cast<CrashRecoveryContextImpl *>(CRCI)->HandleCrash(218 RetCode, reinterpret_cast<uintptr_t>(Except));219 220 return EXCEPTION_EXECUTE_HANDLER;221}222 223#if defined(__clang__) && defined(_M_IX86)224// Work around PR44697.225__attribute__((optnone))226#endif227bool CrashRecoveryContext::RunSafely(function_ref<void()> Fn) {228 if (!gCrashRecoveryEnabled) {229 Fn();230 return true;231 }232 assert(!Impl && "Crash recovery context already initialized!");233 Impl = new CrashRecoveryContextImpl(this);234 __try {235 Fn();236 } __except (ExceptionFilter(GetExceptionInformation())) {237 return false;238 }239 return true;240}241 242#else // !_MSC_VER243 244#if defined(_WIN32)245// This is a non-MSVC compiler, probably mingw gcc or clang without246// -fms-extensions. Use vectored exception handling (VEH).247//248// On Windows, we can make use of vectored exception handling to catch most249// crashing situations. Note that this does mean we will be alerted of250// exceptions *before* structured exception handling has the opportunity to251// catch it. Unfortunately, this causes problems in practice with other code252// running on threads with LLVM crash recovery contexts, so we would like to253// eventually move away from VEH.254//255// Vectored works on a per-thread basis, which is an advantage over256// SetUnhandledExceptionFilter. SetUnhandledExceptionFilter also doesn't have257// any native support for chaining exception handlers, but VEH allows more than258// one.259//260// The vectored exception handler functionality was added in Windows261// XP, so if support for older versions of Windows is required,262// it will have to be added.263 264#include "llvm/Support/Windows/WindowsSupport.h"265 266static LONG CALLBACK ExceptionHandler(PEXCEPTION_POINTERS ExceptionInfo)267{268 // DBG_PRINTEXCEPTION_WIDE_C is not properly defined on all supported269 // compilers and platforms, so we define it manually.270 constexpr ULONG DbgPrintExceptionWideC = 0x4001000AL;271 switch (ExceptionInfo->ExceptionRecord->ExceptionCode)272 {273 case DBG_PRINTEXCEPTION_C:274 case DbgPrintExceptionWideC:275 case 0x406D1388: // set debugger thread name276 return EXCEPTION_CONTINUE_EXECUTION;277 }278 279 // Lookup the current thread local recovery object.280 const CrashRecoveryContextImpl *CRCI = CurrentContext;281 282 if (!CRCI) {283 // Something has gone horribly wrong, so let's just tell everyone284 // to keep searching285 CrashRecoveryContext::Disable();286 return EXCEPTION_CONTINUE_SEARCH;287 }288 289 // TODO: We can capture the stack backtrace here and store it on the290 // implementation if we so choose.291 292 int RetCode = (int)ExceptionInfo->ExceptionRecord->ExceptionCode;293 if ((RetCode & 0xF0000000) == 0xE0000000)294 RetCode &= ~0xF0000000; // this crash was generated by sys::Process::Exit295 296 // Handle the crash297 const_cast<CrashRecoveryContextImpl *>(CRCI)->HandleCrash(298 RetCode, reinterpret_cast<uintptr_t>(ExceptionInfo));299 300 // Note that we don't actually get here because HandleCrash calls301 // longjmp, which means the HandleCrash function never returns.302 llvm_unreachable("Handled the crash, should have longjmp'ed out of here");303}304 305// Because the Enable and Disable calls are static, it means that306// there may not actually be an Impl available, or even a current307// CrashRecoveryContext at all. So we make use of a thread-local308// exception table. The handles contained in here will either be309// non-NULL, valid VEH handles, or NULL.310static LLVM_THREAD_LOCAL const void* sCurrentExceptionHandle;311 312static void installExceptionOrSignalHandlers() {313 // We can set up vectored exception handling now. We will install our314 // handler as the front of the list, though there's no assurances that315 // it will remain at the front (another call could install itself before316 // our handler). This 1) isn't likely, and 2) shouldn't cause problems.317 PVOID handle = ::AddVectoredExceptionHandler(1, ExceptionHandler);318 sCurrentExceptionHandle = handle;319}320 321static void uninstallExceptionOrSignalHandlers() {322 PVOID currentHandle = const_cast<PVOID>(sCurrentExceptionHandle);323 if (currentHandle) {324 // Now we can remove the vectored exception handler from the chain325 ::RemoveVectoredExceptionHandler(currentHandle);326 327 // Reset the handle in our thread-local set.328 sCurrentExceptionHandle = NULL;329 }330}331 332#else // !_WIN32333 334// Generic POSIX implementation.335//336// This implementation relies on synchronous signals being delivered to the337// current thread. We use a thread local object to keep track of the active338// crash recovery context, and install signal handlers to invoke HandleCrash on339// the active object.340//341// This implementation does not attempt to chain signal handlers in any342// reliable fashion -- if we get a signal outside of a crash recovery context we343// simply disable crash recovery and raise the signal again.344 345#include <signal.h>346 347static const int Signals[] =348 { SIGABRT, SIGBUS, SIGFPE, SIGILL, SIGSEGV, SIGTRAP };349static const unsigned NumSignals = std::size(Signals);350static struct sigaction PrevActions[NumSignals];351 352static void CrashRecoverySignalHandler(int Signal) {353 // Lookup the current thread local recovery object.354 const CrashRecoveryContextImpl *CRCI = CurrentContext;355 356 if (!CRCI) {357 // We didn't find a crash recovery context -- this means either we got a358 // signal on a thread we didn't expect it on, the application got a signal359 // outside of a crash recovery context, or something else went horribly360 // wrong.361 //362 // Disable crash recovery and raise the signal again. The assumption here is363 // that the enclosing application will terminate soon, and we won't want to364 // attempt crash recovery again.365 //366 // This call of Disable isn't thread safe, but it doesn't actually matter.367 CrashRecoveryContext::Disable();368 raise(Signal);369 370 // The signal will be thrown once the signal mask is restored.371 return;372 }373 374 // Unblock the signal we received.375 sigset_t SigMask;376 sigemptyset(&SigMask);377 sigaddset(&SigMask, Signal);378 sigprocmask(SIG_UNBLOCK, &SigMask, nullptr);379 380 // Return the same error code as if the program crashed, as mentioned in the381 // section "Exit Status for Commands":382 // https://pubs.opengroup.org/onlinepubs/9699919799/xrat/V4_xcu_chap02.html383 int RetCode = 128 + Signal;384 385 // Don't consider a broken pipe as a crash (see clang/lib/Driver/Driver.cpp)386 if (Signal == SIGPIPE)387 RetCode = EX_IOERR;388 389 if (CRCI)390 const_cast<CrashRecoveryContextImpl *>(CRCI)->HandleCrash(RetCode, Signal);391}392 393static void installExceptionOrSignalHandlers() {394 // Setup the signal handler.395 struct sigaction Handler;396 Handler.sa_handler = CrashRecoverySignalHandler;397 Handler.sa_flags = 0;398 sigemptyset(&Handler.sa_mask);399 400 for (unsigned i = 0; i != NumSignals; ++i) {401 sigaction(Signals[i], &Handler, &PrevActions[i]);402 }403}404 405static void uninstallExceptionOrSignalHandlers() {406 // Restore the previous signal handlers.407 for (unsigned i = 0; i != NumSignals; ++i)408 sigaction(Signals[i], &PrevActions[i], nullptr);409}410 411#endif // !_WIN32412 413bool CrashRecoveryContext::RunSafely(function_ref<void()> Fn) {414 // If crash recovery is disabled, do nothing.415 if (gCrashRecoveryEnabled) {416 assert(!Impl && "Crash recovery context already initialized!");417 CrashRecoveryContextImpl *CRCI = new CrashRecoveryContextImpl(this);418 Impl = CRCI;419 420 CRCI->ValidJumpBuffer = true;421 if (setjmp(CRCI->JumpBuffer) != 0) {422 return false;423 }424 }425 426 Fn();427 return true;428}429 430#endif // !_MSC_VER431 432[[noreturn]] void CrashRecoveryContext::HandleExit(int RetCode) {433#if defined(_WIN32)434 // Since the exception code is actually of NTSTATUS type, we use the435 // Microsoft-recommended 0xE prefix, to signify that this is a user error.436 // This value is a combination of the customer field (bit 29) and severity437 // field (bits 30-31) in the NTSTATUS specification.438 ::RaiseException(0xE0000000 | RetCode, 0, 0, NULL);439#else440 // On Unix we don't need to raise an exception, we go directly to441 // HandleCrash(), then longjmp will unwind the stack for us.442 CrashRecoveryContextImpl *CRCI = (CrashRecoveryContextImpl *)Impl;443 assert(CRCI && "Crash recovery context never initialized!");444 CRCI->HandleCrash(RetCode, 0 /*no sig num*/);445#endif446 llvm_unreachable("Most likely setjmp wasn't called!");447}448 449bool CrashRecoveryContext::isCrash(int RetCode) {450#if defined(_WIN32)451 // On Windows, the code is interpreted as NTSTATUS. The two high bits452 // represent the severity. Values starting with 0x80000000 are reserved for453 // "warnings"; values of 0xC0000000 and up are for "errors". In practice, both454 // are interpreted as a non-continuable signal.455 unsigned Code = ((unsigned)RetCode & 0xF0000000) >> 28;456 if (Code != 0xC && Code != 8)457 return false;458#else459 // On Unix, signals are represented by return codes of 128 or higher.460 // Exit code 128 is a reserved value and should not be raised as a signal.461 if (RetCode <= 128)462 return false;463#endif464 return true;465}466 467bool CrashRecoveryContext::throwIfCrash(int RetCode) {468 if (!isCrash(RetCode))469 return false;470#if defined(_WIN32)471 ::RaiseException(RetCode, 0, 0, NULL);472#else473 llvm::sys::unregisterHandlers();474 raise(RetCode - 128);475#endif476 return true;477}478 479// FIXME: Portability.480static void setThreadBackgroundPriority() {481#ifdef __APPLE__482 setpriority(PRIO_DARWIN_THREAD, 0, PRIO_DARWIN_BG);483#endif484}485 486static bool hasThreadBackgroundPriority() {487#ifdef __APPLE__488 return getpriority(PRIO_DARWIN_THREAD, 0) == 1;489#else490 return false;491#endif492}493 494namespace {495struct RunSafelyOnThreadInfo {496 function_ref<void()> Fn;497 CrashRecoveryContext *CRC;498 bool UseBackgroundPriority;499 bool Result;500};501} // namespace502 503static void RunSafelyOnThread_Dispatch(void *UserData) {504 RunSafelyOnThreadInfo *Info =505 reinterpret_cast<RunSafelyOnThreadInfo*>(UserData);506 507 if (Info->UseBackgroundPriority)508 setThreadBackgroundPriority();509 510 Info->Result = Info->CRC->RunSafely(Info->Fn);511}512bool CrashRecoveryContext::RunSafelyOnThread(function_ref<void()> Fn,513 unsigned RequestedStackSize) {514 bool UseBackgroundPriority = hasThreadBackgroundPriority();515 RunSafelyOnThreadInfo Info = { Fn, this, UseBackgroundPriority, false };516 llvm::thread Thread(RequestedStackSize == 0517 ? std::nullopt518 : std::optional<unsigned>(RequestedStackSize),519 RunSafelyOnThread_Dispatch, &Info);520 Thread.join();521 522 if (CrashRecoveryContextImpl *CRC = (CrashRecoveryContextImpl *)Impl)523 CRC->setSwitchedThread();524 return Info.Result;525}526 527bool CrashRecoveryContext::RunSafelyOnNewStack(function_ref<void()> Fn,528 unsigned RequestedStackSize) {529#ifdef LLVM_HAS_SPLIT_STACKS530 return runOnNewStack(RequestedStackSize,531 function_ref<bool()>([&]() { return RunSafely(Fn); }));532#else533 return RunSafelyOnThread(Fn, RequestedStackSize);534#endif535}536