1 //===--- CrashRecoveryContext.cpp - Crash Recovery ------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8
9 #include "llvm/Support/CrashRecoveryContext.h"
10 #include "llvm/Config/llvm-config.h"
11 #include "llvm/Support/ErrorHandling.h"
12 #include "llvm/Support/ExitCodes.h"
13 #include "llvm/Support/ManagedStatic.h"
14 #include "llvm/Support/Signals.h"
15 #include "llvm/Support/ThreadLocal.h"
16 #include "llvm/Support/thread.h"
17 #include <mutex>
18 #include <setjmp.h>
19
20 using namespace llvm;
21
22 namespace {
23
24 struct CrashRecoveryContextImpl;
25
26 static ManagedStatic<
27 sys::ThreadLocal<const CrashRecoveryContextImpl> > CurrentContext;
28
29 struct CrashRecoveryContextImpl {
30 // When threads are disabled, this links up all active
31 // CrashRecoveryContextImpls. When threads are enabled there's one thread
32 // per CrashRecoveryContext and CurrentContext is a thread-local, so only one
33 // CrashRecoveryContextImpl is active per thread and this is always null.
34 const CrashRecoveryContextImpl *Next;
35
36 CrashRecoveryContext *CRC;
37 ::jmp_buf JumpBuffer;
38 volatile unsigned Failed : 1;
39 unsigned SwitchedThread : 1;
40 unsigned ValidJumpBuffer : 1;
41
42 public:
CrashRecoveryContextImpl__anonc9d3275c0111::CrashRecoveryContextImpl43 CrashRecoveryContextImpl(CrashRecoveryContext *CRC) noexcept
44 : CRC(CRC), Failed(false), SwitchedThread(false), ValidJumpBuffer(false) {
45 Next = CurrentContext->get();
46 CurrentContext->set(this);
47 }
~CrashRecoveryContextImpl__anonc9d3275c0111::CrashRecoveryContextImpl48 ~CrashRecoveryContextImpl() {
49 if (!SwitchedThread)
50 CurrentContext->set(Next);
51 }
52
53 /// Called when the separate crash-recovery thread was finished, to
54 /// indicate that we don't need to clear the thread-local CurrentContext.
setSwitchedThread__anonc9d3275c0111::CrashRecoveryContextImpl55 void setSwitchedThread() {
56 #if defined(LLVM_ENABLE_THREADS) && LLVM_ENABLE_THREADS != 0
57 SwitchedThread = true;
58 #endif
59 }
60
61 // If the function ran by the CrashRecoveryContext crashes or fails, then
62 // 'RetCode' represents the returned error code, as if it was returned by a
63 // process. 'Context' represents the signal type on Unix; on Windows, it is
64 // the ExceptionContext.
HandleCrash__anonc9d3275c0111::CrashRecoveryContextImpl65 void HandleCrash(int RetCode, uintptr_t Context) {
66 // Eliminate the current context entry, to avoid re-entering in case the
67 // cleanup code crashes.
68 CurrentContext->set(Next);
69
70 assert(!Failed && "Crash recovery context already failed!");
71 Failed = true;
72
73 if (CRC->DumpStackAndCleanupOnFailure)
74 sys::CleanupOnSignal(Context);
75
76 CRC->RetCode = RetCode;
77
78 // Jump back to the RunSafely we were called under.
79 if (ValidJumpBuffer)
80 longjmp(JumpBuffer, 1);
81
82 // Otherwise let the caller decide of the outcome of the crash. Currently
83 // this occurs when using SEH on Windows with MSVC or clang-cl.
84 }
85 };
86 } // namespace
87
88 static ManagedStatic<std::mutex> gCrashRecoveryContextMutex;
89 static bool gCrashRecoveryEnabled = false;
90
91 static ManagedStatic<sys::ThreadLocal<const CrashRecoveryContext>>
92 tlIsRecoveringFromCrash;
93
94 static void installExceptionOrSignalHandlers();
95 static void uninstallExceptionOrSignalHandlers();
96
~CrashRecoveryContextCleanup()97 CrashRecoveryContextCleanup::~CrashRecoveryContextCleanup() {}
98
CrashRecoveryContext()99 CrashRecoveryContext::CrashRecoveryContext() {
100 // On Windows, if abort() was previously triggered (and caught by a previous
101 // CrashRecoveryContext) the Windows CRT removes our installed signal handler,
102 // so we need to install it again.
103 sys::DisableSystemDialogsOnCrash();
104 }
105
~CrashRecoveryContext()106 CrashRecoveryContext::~CrashRecoveryContext() {
107 // Reclaim registered resources.
108 CrashRecoveryContextCleanup *i = head;
109 const CrashRecoveryContext *PC = tlIsRecoveringFromCrash->get();
110 tlIsRecoveringFromCrash->set(this);
111 while (i) {
112 CrashRecoveryContextCleanup *tmp = i;
113 i = tmp->next;
114 tmp->cleanupFired = true;
115 tmp->recoverResources();
116 delete tmp;
117 }
118 tlIsRecoveringFromCrash->set(PC);
119
120 CrashRecoveryContextImpl *CRCI = (CrashRecoveryContextImpl *) Impl;
121 delete CRCI;
122 }
123
isRecoveringFromCrash()124 bool CrashRecoveryContext::isRecoveringFromCrash() {
125 return tlIsRecoveringFromCrash->get() != nullptr;
126 }
127
GetCurrent()128 CrashRecoveryContext *CrashRecoveryContext::GetCurrent() {
129 if (!gCrashRecoveryEnabled)
130 return nullptr;
131
132 const CrashRecoveryContextImpl *CRCI = CurrentContext->get();
133 if (!CRCI)
134 return nullptr;
135
136 return CRCI->CRC;
137 }
138
Enable()139 void CrashRecoveryContext::Enable() {
140 std::lock_guard<std::mutex> L(*gCrashRecoveryContextMutex);
141 // FIXME: Shouldn't this be a refcount or something?
142 if (gCrashRecoveryEnabled)
143 return;
144 gCrashRecoveryEnabled = true;
145 installExceptionOrSignalHandlers();
146 }
147
Disable()148 void CrashRecoveryContext::Disable() {
149 std::lock_guard<std::mutex> L(*gCrashRecoveryContextMutex);
150 if (!gCrashRecoveryEnabled)
151 return;
152 gCrashRecoveryEnabled = false;
153 uninstallExceptionOrSignalHandlers();
154 }
155
registerCleanup(CrashRecoveryContextCleanup * cleanup)156 void CrashRecoveryContext::registerCleanup(CrashRecoveryContextCleanup *cleanup)
157 {
158 if (!cleanup)
159 return;
160 if (head)
161 head->prev = cleanup;
162 cleanup->next = head;
163 head = cleanup;
164 }
165
166 void
unregisterCleanup(CrashRecoveryContextCleanup * cleanup)167 CrashRecoveryContext::unregisterCleanup(CrashRecoveryContextCleanup *cleanup) {
168 if (!cleanup)
169 return;
170 if (cleanup == head) {
171 head = cleanup->next;
172 if (head)
173 head->prev = nullptr;
174 }
175 else {
176 cleanup->prev->next = cleanup->next;
177 if (cleanup->next)
178 cleanup->next->prev = cleanup->prev;
179 }
180 delete cleanup;
181 }
182
183 #if defined(_MSC_VER)
184
185 #include <windows.h> // for GetExceptionInformation
186
187 // If _MSC_VER is defined, we must have SEH. Use it if it's available. It's way
188 // better than VEH. Vectored exception handling catches all exceptions happening
189 // on the thread with installed exception handlers, so it can interfere with
190 // internal exception handling of other libraries on that thread. SEH works
191 // exactly as you would expect normal exception handling to work: it only
192 // catches exceptions if they would bubble out from the stack frame with __try /
193 // __except.
194
installExceptionOrSignalHandlers()195 static void installExceptionOrSignalHandlers() {}
uninstallExceptionOrSignalHandlers()196 static void uninstallExceptionOrSignalHandlers() {}
197
198 // We need this function because the call to GetExceptionInformation() can only
199 // occur inside the __except evaluation block
ExceptionFilter(_EXCEPTION_POINTERS * Except)200 static int ExceptionFilter(_EXCEPTION_POINTERS *Except) {
201 // Lookup the current thread local recovery object.
202 const CrashRecoveryContextImpl *CRCI = CurrentContext->get();
203
204 if (!CRCI) {
205 // Something has gone horribly wrong, so let's just tell everyone
206 // to keep searching
207 CrashRecoveryContext::Disable();
208 return EXCEPTION_CONTINUE_SEARCH;
209 }
210
211 int RetCode = (int)Except->ExceptionRecord->ExceptionCode;
212 if ((RetCode & 0xF0000000) == 0xE0000000)
213 RetCode &= ~0xF0000000; // this crash was generated by sys::Process::Exit
214
215 // Handle the crash
216 const_cast<CrashRecoveryContextImpl *>(CRCI)->HandleCrash(
217 RetCode, reinterpret_cast<uintptr_t>(Except));
218
219 return EXCEPTION_EXECUTE_HANDLER;
220 }
221
222 #if defined(__clang__) && defined(_M_IX86)
223 // Work around PR44697.
224 __attribute__((optnone))
225 #endif
RunSafely(function_ref<void ()> Fn)226 bool CrashRecoveryContext::RunSafely(function_ref<void()> Fn) {
227 if (!gCrashRecoveryEnabled) {
228 Fn();
229 return true;
230 }
231 assert(!Impl && "Crash recovery context already initialized!");
232 Impl = new CrashRecoveryContextImpl(this);
233 __try {
234 Fn();
235 } __except (ExceptionFilter(GetExceptionInformation())) {
236 return false;
237 }
238 return true;
239 }
240
241 #else // !_MSC_VER
242
243 #if defined(_WIN32)
244 // This is a non-MSVC compiler, probably mingw gcc or clang without
245 // -fms-extensions. Use vectored exception handling (VEH).
246 //
247 // On Windows, we can make use of vectored exception handling to catch most
248 // crashing situations. Note that this does mean we will be alerted of
249 // exceptions *before* structured exception handling has the opportunity to
250 // catch it. Unfortunately, this causes problems in practice with other code
251 // running on threads with LLVM crash recovery contexts, so we would like to
252 // eventually move away from VEH.
253 //
254 // Vectored works on a per-thread basis, which is an advantage over
255 // SetUnhandledExceptionFilter. SetUnhandledExceptionFilter also doesn't have
256 // any native support for chaining exception handlers, but VEH allows more than
257 // one.
258 //
259 // The vectored exception handler functionality was added in Windows
260 // XP, so if support for older versions of Windows is required,
261 // it will have to be added.
262
263 #include "llvm/Support/Windows/WindowsSupport.h"
264
ExceptionHandler(PEXCEPTION_POINTERS ExceptionInfo)265 static LONG CALLBACK ExceptionHandler(PEXCEPTION_POINTERS ExceptionInfo)
266 {
267 // DBG_PRINTEXCEPTION_WIDE_C is not properly defined on all supported
268 // compilers and platforms, so we define it manually.
269 constexpr ULONG DbgPrintExceptionWideC = 0x4001000AL;
270 switch (ExceptionInfo->ExceptionRecord->ExceptionCode)
271 {
272 case DBG_PRINTEXCEPTION_C:
273 case DbgPrintExceptionWideC:
274 case 0x406D1388: // set debugger thread name
275 return EXCEPTION_CONTINUE_EXECUTION;
276 }
277
278 // Lookup the current thread local recovery object.
279 const CrashRecoveryContextImpl *CRCI = CurrentContext->get();
280
281 if (!CRCI) {
282 // Something has gone horribly wrong, so let's just tell everyone
283 // to keep searching
284 CrashRecoveryContext::Disable();
285 return EXCEPTION_CONTINUE_SEARCH;
286 }
287
288 // TODO: We can capture the stack backtrace here and store it on the
289 // implementation if we so choose.
290
291 int RetCode = (int)ExceptionInfo->ExceptionRecord->ExceptionCode;
292 if ((RetCode & 0xF0000000) == 0xE0000000)
293 RetCode &= ~0xF0000000; // this crash was generated by sys::Process::Exit
294
295 // Handle the crash
296 const_cast<CrashRecoveryContextImpl *>(CRCI)->HandleCrash(
297 RetCode, reinterpret_cast<uintptr_t>(ExceptionInfo));
298
299 // Note that we don't actually get here because HandleCrash calls
300 // longjmp, which means the HandleCrash function never returns.
301 llvm_unreachable("Handled the crash, should have longjmp'ed out of here");
302 }
303
304 // Because the Enable and Disable calls are static, it means that
305 // there may not actually be an Impl available, or even a current
306 // CrashRecoveryContext at all. So we make use of a thread-local
307 // exception table. The handles contained in here will either be
308 // non-NULL, valid VEH handles, or NULL.
309 static sys::ThreadLocal<const void> sCurrentExceptionHandle;
310
installExceptionOrSignalHandlers()311 static void installExceptionOrSignalHandlers() {
312 // We can set up vectored exception handling now. We will install our
313 // handler as the front of the list, though there's no assurances that
314 // it will remain at the front (another call could install itself before
315 // our handler). This 1) isn't likely, and 2) shouldn't cause problems.
316 PVOID handle = ::AddVectoredExceptionHandler(1, ExceptionHandler);
317 sCurrentExceptionHandle.set(handle);
318 }
319
uninstallExceptionOrSignalHandlers()320 static void uninstallExceptionOrSignalHandlers() {
321 PVOID currentHandle = const_cast<PVOID>(sCurrentExceptionHandle.get());
322 if (currentHandle) {
323 // Now we can remove the vectored exception handler from the chain
324 ::RemoveVectoredExceptionHandler(currentHandle);
325
326 // Reset the handle in our thread-local set.
327 sCurrentExceptionHandle.set(NULL);
328 }
329 }
330
331 #else // !_WIN32
332
333 // Generic POSIX implementation.
334 //
335 // This implementation relies on synchronous signals being delivered to the
336 // current thread. We use a thread local object to keep track of the active
337 // crash recovery context, and install signal handlers to invoke HandleCrash on
338 // the active object.
339 //
340 // This implementation does not attempt to chain signal handlers in any
341 // reliable fashion -- if we get a signal outside of a crash recovery context we
342 // simply disable crash recovery and raise the signal again.
343
344 #include <signal.h>
345
346 static const int Signals[] =
347 { SIGABRT, SIGBUS, SIGFPE, SIGILL, SIGSEGV, SIGTRAP };
348 static const unsigned NumSignals = array_lengthof(Signals);
349 static struct sigaction PrevActions[NumSignals];
350
CrashRecoverySignalHandler(int Signal)351 static void CrashRecoverySignalHandler(int Signal) {
352 // Lookup the current thread local recovery object.
353 const CrashRecoveryContextImpl *CRCI = CurrentContext->get();
354
355 if (!CRCI) {
356 // We didn't find a crash recovery context -- this means either we got a
357 // signal on a thread we didn't expect it on, the application got a signal
358 // outside of a crash recovery context, or something else went horribly
359 // wrong.
360 //
361 // Disable crash recovery and raise the signal again. The assumption here is
362 // that the enclosing application will terminate soon, and we won't want to
363 // attempt crash recovery again.
364 //
365 // This call of Disable isn't thread safe, but it doesn't actually matter.
366 CrashRecoveryContext::Disable();
367 raise(Signal);
368
369 // The signal will be thrown once the signal mask is restored.
370 return;
371 }
372
373 // Unblock the signal we received.
374 sigset_t SigMask;
375 sigemptyset(&SigMask);
376 sigaddset(&SigMask, Signal);
377 sigprocmask(SIG_UNBLOCK, &SigMask, nullptr);
378
379 // Return the same error code as if the program crashed, as mentioned in the
380 // section "Exit Status for Commands":
381 // https://pubs.opengroup.org/onlinepubs/9699919799/xrat/V4_xcu_chap02.html
382 int RetCode = 128 + Signal;
383
384 // Don't consider a broken pipe as a crash (see clang/lib/Driver/Driver.cpp)
385 if (Signal == SIGPIPE)
386 RetCode = EX_IOERR;
387
388 if (CRCI)
389 const_cast<CrashRecoveryContextImpl *>(CRCI)->HandleCrash(RetCode, Signal);
390 }
391
installExceptionOrSignalHandlers()392 static void installExceptionOrSignalHandlers() {
393 // Setup the signal handler.
394 struct sigaction Handler;
395 Handler.sa_handler = CrashRecoverySignalHandler;
396 Handler.sa_flags = 0;
397 sigemptyset(&Handler.sa_mask);
398
399 for (unsigned i = 0; i != NumSignals; ++i) {
400 sigaction(Signals[i], &Handler, &PrevActions[i]);
401 }
402 }
403
uninstallExceptionOrSignalHandlers()404 static void uninstallExceptionOrSignalHandlers() {
405 // Restore the previous signal handlers.
406 for (unsigned i = 0; i != NumSignals; ++i)
407 sigaction(Signals[i], &PrevActions[i], nullptr);
408 }
409
410 #endif // !_WIN32
411
RunSafely(function_ref<void ()> Fn)412 bool CrashRecoveryContext::RunSafely(function_ref<void()> Fn) {
413 // If crash recovery is disabled, do nothing.
414 if (gCrashRecoveryEnabled) {
415 assert(!Impl && "Crash recovery context already initialized!");
416 CrashRecoveryContextImpl *CRCI = new CrashRecoveryContextImpl(this);
417 Impl = CRCI;
418
419 CRCI->ValidJumpBuffer = true;
420 if (setjmp(CRCI->JumpBuffer) != 0) {
421 return false;
422 }
423 }
424
425 Fn();
426 return true;
427 }
428
429 #endif // !_MSC_VER
430
431 LLVM_ATTRIBUTE_NORETURN
HandleExit(int RetCode)432 void CrashRecoveryContext::HandleExit(int RetCode) {
433 #if defined(_WIN32)
434 // SEH and VEH
435 ::RaiseException(0xE0000000 | RetCode, 0, 0, NULL);
436 #else
437 // On Unix we don't need to raise an exception, we go directly to
438 // HandleCrash(), then longjmp will unwind the stack for us.
439 CrashRecoveryContextImpl *CRCI = (CrashRecoveryContextImpl *)Impl;
440 assert(CRCI && "Crash recovery context never initialized!");
441 CRCI->HandleCrash(RetCode, 0 /*no sig num*/);
442 #endif
443 llvm_unreachable("Most likely setjmp wasn't called!");
444 }
445
throwIfCrash(int RetCode)446 bool CrashRecoveryContext::throwIfCrash(int RetCode) {
447 #if defined(_WIN32)
448 // On Windows, the high bits are reserved for kernel return codes. Values
449 // starting with 0x80000000 are reserved for "warnings"; values of 0xC0000000
450 // and up are for "errors". In practice, both are interpreted as a
451 // non-continuable signal.
452 unsigned Code = ((unsigned)RetCode & 0xF0000000) >> 28;
453 if (Code != 0xC && Code != 8)
454 return false;
455 ::RaiseException(RetCode, 0, 0, NULL);
456 #else
457 // On Unix, signals are represented by return codes of 128 or higher.
458 // Exit code 128 is a reserved value and should not be raised as a signal.
459 if (RetCode <= 128)
460 return false;
461 llvm::sys::unregisterHandlers();
462 raise(RetCode - 128);
463 #endif
464 return true;
465 }
466
467 // FIXME: Portability.
setThreadBackgroundPriority()468 static void setThreadBackgroundPriority() {
469 #ifdef __APPLE__
470 setpriority(PRIO_DARWIN_THREAD, 0, PRIO_DARWIN_BG);
471 #endif
472 }
473
hasThreadBackgroundPriority()474 static bool hasThreadBackgroundPriority() {
475 #ifdef __APPLE__
476 return getpriority(PRIO_DARWIN_THREAD, 0) == 1;
477 #else
478 return false;
479 #endif
480 }
481
482 namespace {
483 struct RunSafelyOnThreadInfo {
484 function_ref<void()> Fn;
485 CrashRecoveryContext *CRC;
486 bool UseBackgroundPriority;
487 bool Result;
488 };
489 } // namespace
490
RunSafelyOnThread_Dispatch(void * UserData)491 static void RunSafelyOnThread_Dispatch(void *UserData) {
492 RunSafelyOnThreadInfo *Info =
493 reinterpret_cast<RunSafelyOnThreadInfo*>(UserData);
494
495 if (Info->UseBackgroundPriority)
496 setThreadBackgroundPriority();
497
498 Info->Result = Info->CRC->RunSafely(Info->Fn);
499 }
RunSafelyOnThread(function_ref<void ()> Fn,unsigned RequestedStackSize)500 bool CrashRecoveryContext::RunSafelyOnThread(function_ref<void()> Fn,
501 unsigned RequestedStackSize) {
502 bool UseBackgroundPriority = hasThreadBackgroundPriority();
503 RunSafelyOnThreadInfo Info = { Fn, this, UseBackgroundPriority, false };
504 llvm::thread Thread(RequestedStackSize == 0
505 ? llvm::None
506 : llvm::Optional<unsigned>(RequestedStackSize),
507 RunSafelyOnThread_Dispatch, &Info);
508 Thread.join();
509
510 if (CrashRecoveryContextImpl *CRC = (CrashRecoveryContextImpl *)Impl)
511 CRC->setSwitchedThread();
512 return Info.Result;
513 }
514