1 //===--- CrashRecoveryContext.cpp - Crash Recovery ------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8
9 #include "llvm/Support/CrashRecoveryContext.h"
10 #include "llvm/Config/llvm-config.h"
11 #include "llvm/Support/ErrorHandling.h"
12 #include "llvm/Support/ExitCodes.h"
13 #include "llvm/Support/ManagedStatic.h"
14 #include "llvm/Support/Signals.h"
15 #include "llvm/Support/ThreadLocal.h"
16 #include <mutex>
17 #include <setjmp.h>
18
19 using namespace llvm;
20
21 namespace {
22
23 struct CrashRecoveryContextImpl;
24
25 static ManagedStatic<
26 sys::ThreadLocal<const CrashRecoveryContextImpl> > CurrentContext;
27
28 struct CrashRecoveryContextImpl {
29 // When threads are disabled, this links up all active
30 // CrashRecoveryContextImpls. When threads are enabled there's one thread
31 // per CrashRecoveryContext and CurrentContext is a thread-local, so only one
32 // CrashRecoveryContextImpl is active per thread and this is always null.
33 const CrashRecoveryContextImpl *Next;
34
35 CrashRecoveryContext *CRC;
36 ::jmp_buf JumpBuffer;
37 volatile unsigned Failed : 1;
38 unsigned SwitchedThread : 1;
39 unsigned ValidJumpBuffer : 1;
40
41 public:
CrashRecoveryContextImpl__anon74b3d33a0111::CrashRecoveryContextImpl42 CrashRecoveryContextImpl(CrashRecoveryContext *CRC) noexcept
43 : CRC(CRC), Failed(false), SwitchedThread(false), ValidJumpBuffer(false) {
44 Next = CurrentContext->get();
45 CurrentContext->set(this);
46 }
~CrashRecoveryContextImpl__anon74b3d33a0111::CrashRecoveryContextImpl47 ~CrashRecoveryContextImpl() {
48 if (!SwitchedThread)
49 CurrentContext->set(Next);
50 }
51
52 /// Called when the separate crash-recovery thread was finished, to
53 /// indicate that we don't need to clear the thread-local CurrentContext.
setSwitchedThread__anon74b3d33a0111::CrashRecoveryContextImpl54 void setSwitchedThread() {
55 #if defined(LLVM_ENABLE_THREADS) && LLVM_ENABLE_THREADS != 0
56 SwitchedThread = true;
57 #endif
58 }
59
60 // If the function ran by the CrashRecoveryContext crashes or fails, then
61 // 'RetCode' represents the returned error code, as if it was returned by a
62 // process. 'Context' represents the signal type on Unix; on Windows, it is
63 // the ExceptionContext.
HandleCrash__anon74b3d33a0111::CrashRecoveryContextImpl64 void HandleCrash(int RetCode, uintptr_t Context) {
65 // Eliminate the current context entry, to avoid re-entering in case the
66 // cleanup code crashes.
67 CurrentContext->set(Next);
68
69 assert(!Failed && "Crash recovery context already failed!");
70 Failed = true;
71
72 if (CRC->DumpStackAndCleanupOnFailure)
73 sys::CleanupOnSignal(Context);
74
75 CRC->RetCode = RetCode;
76
77 // Jump back to the RunSafely we were called under.
78 if (ValidJumpBuffer)
79 longjmp(JumpBuffer, 1);
80
81 // Otherwise let the caller decide of the outcome of the crash. Currently
82 // this occurs when using SEH on Windows with MSVC or clang-cl.
83 }
84 };
85 }
86
87 static ManagedStatic<std::mutex> gCrashRecoveryContextMutex;
88 static bool gCrashRecoveryEnabled = false;
89
90 static ManagedStatic<sys::ThreadLocal<const CrashRecoveryContext>>
91 tlIsRecoveringFromCrash;
92
93 static void installExceptionOrSignalHandlers();
94 static void uninstallExceptionOrSignalHandlers();
95
~CrashRecoveryContextCleanup()96 CrashRecoveryContextCleanup::~CrashRecoveryContextCleanup() {}
97
CrashRecoveryContext()98 CrashRecoveryContext::CrashRecoveryContext() {
99 // On Windows, if abort() was previously triggered (and caught by a previous
100 // CrashRecoveryContext) the Windows CRT removes our installed signal handler,
101 // so we need to install it again.
102 sys::DisableSystemDialogsOnCrash();
103 }
104
~CrashRecoveryContext()105 CrashRecoveryContext::~CrashRecoveryContext() {
106 // Reclaim registered resources.
107 CrashRecoveryContextCleanup *i = head;
108 const CrashRecoveryContext *PC = tlIsRecoveringFromCrash->get();
109 tlIsRecoveringFromCrash->set(this);
110 while (i) {
111 CrashRecoveryContextCleanup *tmp = i;
112 i = tmp->next;
113 tmp->cleanupFired = true;
114 tmp->recoverResources();
115 delete tmp;
116 }
117 tlIsRecoveringFromCrash->set(PC);
118
119 CrashRecoveryContextImpl *CRCI = (CrashRecoveryContextImpl *) Impl;
120 delete CRCI;
121 }
122
isRecoveringFromCrash()123 bool CrashRecoveryContext::isRecoveringFromCrash() {
124 return tlIsRecoveringFromCrash->get() != nullptr;
125 }
126
GetCurrent()127 CrashRecoveryContext *CrashRecoveryContext::GetCurrent() {
128 if (!gCrashRecoveryEnabled)
129 return nullptr;
130
131 const CrashRecoveryContextImpl *CRCI = CurrentContext->get();
132 if (!CRCI)
133 return nullptr;
134
135 return CRCI->CRC;
136 }
137
Enable()138 void CrashRecoveryContext::Enable() {
139 std::lock_guard<std::mutex> L(*gCrashRecoveryContextMutex);
140 // FIXME: Shouldn't this be a refcount or something?
141 if (gCrashRecoveryEnabled)
142 return;
143 gCrashRecoveryEnabled = true;
144 installExceptionOrSignalHandlers();
145 }
146
Disable()147 void CrashRecoveryContext::Disable() {
148 std::lock_guard<std::mutex> L(*gCrashRecoveryContextMutex);
149 if (!gCrashRecoveryEnabled)
150 return;
151 gCrashRecoveryEnabled = false;
152 uninstallExceptionOrSignalHandlers();
153 }
154
registerCleanup(CrashRecoveryContextCleanup * cleanup)155 void CrashRecoveryContext::registerCleanup(CrashRecoveryContextCleanup *cleanup)
156 {
157 if (!cleanup)
158 return;
159 if (head)
160 head->prev = cleanup;
161 cleanup->next = head;
162 head = cleanup;
163 }
164
165 void
unregisterCleanup(CrashRecoveryContextCleanup * cleanup)166 CrashRecoveryContext::unregisterCleanup(CrashRecoveryContextCleanup *cleanup) {
167 if (!cleanup)
168 return;
169 if (cleanup == head) {
170 head = cleanup->next;
171 if (head)
172 head->prev = nullptr;
173 }
174 else {
175 cleanup->prev->next = cleanup->next;
176 if (cleanup->next)
177 cleanup->next->prev = cleanup->prev;
178 }
179 delete cleanup;
180 }
181
182 #if defined(_MSC_VER)
183
184 #include <windows.h> // for GetExceptionInformation
185
186 // If _MSC_VER is defined, we must have SEH. Use it if it's available. It's way
187 // better than VEH. Vectored exception handling catches all exceptions happening
188 // on the thread with installed exception handlers, so it can interfere with
189 // internal exception handling of other libraries on that thread. SEH works
190 // exactly as you would expect normal exception handling to work: it only
191 // catches exceptions if they would bubble out from the stack frame with __try /
192 // __except.
193
installExceptionOrSignalHandlers()194 static void installExceptionOrSignalHandlers() {}
uninstallExceptionOrSignalHandlers()195 static void uninstallExceptionOrSignalHandlers() {}
196
197 // We need this function because the call to GetExceptionInformation() can only
198 // occur inside the __except evaluation block
ExceptionFilter(_EXCEPTION_POINTERS * Except)199 static int ExceptionFilter(_EXCEPTION_POINTERS *Except) {
200 // Lookup the current thread local recovery object.
201 const CrashRecoveryContextImpl *CRCI = CurrentContext->get();
202
203 if (!CRCI) {
204 // Something has gone horribly wrong, so let's just tell everyone
205 // to keep searching
206 CrashRecoveryContext::Disable();
207 return EXCEPTION_CONTINUE_SEARCH;
208 }
209
210 int RetCode = (int)Except->ExceptionRecord->ExceptionCode;
211 if ((RetCode & 0xF0000000) == 0xE0000000)
212 RetCode &= ~0xF0000000; // this crash was generated by sys::Process::Exit
213
214 // Handle the crash
215 const_cast<CrashRecoveryContextImpl *>(CRCI)->HandleCrash(
216 RetCode, reinterpret_cast<uintptr_t>(Except));
217
218 return EXCEPTION_EXECUTE_HANDLER;
219 }
220
221 #if defined(__clang__) && defined(_M_IX86)
222 // Work around PR44697.
223 __attribute__((optnone))
224 #endif
RunSafely(function_ref<void ()> Fn)225 bool CrashRecoveryContext::RunSafely(function_ref<void()> Fn) {
226 if (!gCrashRecoveryEnabled) {
227 Fn();
228 return true;
229 }
230 assert(!Impl && "Crash recovery context already initialized!");
231 Impl = new CrashRecoveryContextImpl(this);
232 __try {
233 Fn();
234 } __except (ExceptionFilter(GetExceptionInformation())) {
235 return false;
236 }
237 return true;
238 }
239
240 #else // !_MSC_VER
241
242 #if defined(_WIN32)
243 // This is a non-MSVC compiler, probably mingw gcc or clang without
244 // -fms-extensions. Use vectored exception handling (VEH).
245 //
246 // On Windows, we can make use of vectored exception handling to catch most
247 // crashing situations. Note that this does mean we will be alerted of
248 // exceptions *before* structured exception handling has the opportunity to
249 // catch it. Unfortunately, this causes problems in practice with other code
250 // running on threads with LLVM crash recovery contexts, so we would like to
251 // eventually move away from VEH.
252 //
253 // Vectored works on a per-thread basis, which is an advantage over
254 // SetUnhandledExceptionFilter. SetUnhandledExceptionFilter also doesn't have
255 // any native support for chaining exception handlers, but VEH allows more than
256 // one.
257 //
258 // The vectored exception handler functionality was added in Windows
259 // XP, so if support for older versions of Windows is required,
260 // it will have to be added.
261
262 #include "llvm/Support/Windows/WindowsSupport.h"
263
ExceptionHandler(PEXCEPTION_POINTERS ExceptionInfo)264 static LONG CALLBACK ExceptionHandler(PEXCEPTION_POINTERS ExceptionInfo)
265 {
266 // DBG_PRINTEXCEPTION_WIDE_C is not properly defined on all supported
267 // compilers and platforms, so we define it manually.
268 constexpr ULONG DbgPrintExceptionWideC = 0x4001000AL;
269 switch (ExceptionInfo->ExceptionRecord->ExceptionCode)
270 {
271 case DBG_PRINTEXCEPTION_C:
272 case DbgPrintExceptionWideC:
273 case 0x406D1388: // set debugger thread name
274 return EXCEPTION_CONTINUE_EXECUTION;
275 }
276
277 // Lookup the current thread local recovery object.
278 const CrashRecoveryContextImpl *CRCI = CurrentContext->get();
279
280 if (!CRCI) {
281 // Something has gone horribly wrong, so let's just tell everyone
282 // to keep searching
283 CrashRecoveryContext::Disable();
284 return EXCEPTION_CONTINUE_SEARCH;
285 }
286
287 // TODO: We can capture the stack backtrace here and store it on the
288 // implementation if we so choose.
289
290 int RetCode = (int)ExceptionInfo->ExceptionRecord->ExceptionCode;
291 if ((RetCode & 0xF0000000) == 0xE0000000)
292 RetCode &= ~0xF0000000; // this crash was generated by sys::Process::Exit
293
294 // Handle the crash
295 const_cast<CrashRecoveryContextImpl *>(CRCI)->HandleCrash(
296 RetCode, reinterpret_cast<uintptr_t>(ExceptionInfo));
297
298 // Note that we don't actually get here because HandleCrash calls
299 // longjmp, which means the HandleCrash function never returns.
300 llvm_unreachable("Handled the crash, should have longjmp'ed out of here");
301 }
302
303 // Because the Enable and Disable calls are static, it means that
304 // there may not actually be an Impl available, or even a current
305 // CrashRecoveryContext at all. So we make use of a thread-local
306 // exception table. The handles contained in here will either be
307 // non-NULL, valid VEH handles, or NULL.
308 static sys::ThreadLocal<const void> sCurrentExceptionHandle;
309
installExceptionOrSignalHandlers()310 static void installExceptionOrSignalHandlers() {
311 // We can set up vectored exception handling now. We will install our
312 // handler as the front of the list, though there's no assurances that
313 // it will remain at the front (another call could install itself before
314 // our handler). This 1) isn't likely, and 2) shouldn't cause problems.
315 PVOID handle = ::AddVectoredExceptionHandler(1, ExceptionHandler);
316 sCurrentExceptionHandle.set(handle);
317 }
318
uninstallExceptionOrSignalHandlers()319 static void uninstallExceptionOrSignalHandlers() {
320 PVOID currentHandle = const_cast<PVOID>(sCurrentExceptionHandle.get());
321 if (currentHandle) {
322 // Now we can remove the vectored exception handler from the chain
323 ::RemoveVectoredExceptionHandler(currentHandle);
324
325 // Reset the handle in our thread-local set.
326 sCurrentExceptionHandle.set(NULL);
327 }
328 }
329
330 #else // !_WIN32
331
332 // Generic POSIX implementation.
333 //
334 // This implementation relies on synchronous signals being delivered to the
335 // current thread. We use a thread local object to keep track of the active
336 // crash recovery context, and install signal handlers to invoke HandleCrash on
337 // the active object.
338 //
339 // This implementation does not attempt to chain signal handlers in any
340 // reliable fashion -- if we get a signal outside of a crash recovery context we
341 // simply disable crash recovery and raise the signal again.
342
343 #include <signal.h>
344
345 static const int Signals[] =
346 { SIGABRT, SIGBUS, SIGFPE, SIGILL, SIGSEGV, SIGTRAP };
347 static const unsigned NumSignals = array_lengthof(Signals);
348 static struct sigaction PrevActions[NumSignals];
349
CrashRecoverySignalHandler(int Signal)350 static void CrashRecoverySignalHandler(int Signal) {
351 // Lookup the current thread local recovery object.
352 const CrashRecoveryContextImpl *CRCI = CurrentContext->get();
353
354 if (!CRCI) {
355 // We didn't find a crash recovery context -- this means either we got a
356 // signal on a thread we didn't expect it on, the application got a signal
357 // outside of a crash recovery context, or something else went horribly
358 // wrong.
359 //
360 // Disable crash recovery and raise the signal again. The assumption here is
361 // that the enclosing application will terminate soon, and we won't want to
362 // attempt crash recovery again.
363 //
364 // This call of Disable isn't thread safe, but it doesn't actually matter.
365 CrashRecoveryContext::Disable();
366 raise(Signal);
367
368 // The signal will be thrown once the signal mask is restored.
369 return;
370 }
371
372 // Unblock the signal we received.
373 sigset_t SigMask;
374 sigemptyset(&SigMask);
375 sigaddset(&SigMask, Signal);
376 sigprocmask(SIG_UNBLOCK, &SigMask, nullptr);
377
378 // Return the same error code as if the program crashed, as mentioned in the
379 // section "Exit Status for Commands":
380 // https://pubs.opengroup.org/onlinepubs/9699919799/xrat/V4_xcu_chap02.html
381 int RetCode = 128 + Signal;
382
383 // Don't consider a broken pipe as a crash (see clang/lib/Driver/Driver.cpp)
384 if (Signal == SIGPIPE)
385 RetCode = EX_IOERR;
386
387 if (CRCI)
388 const_cast<CrashRecoveryContextImpl *>(CRCI)->HandleCrash(RetCode, Signal);
389 }
390
installExceptionOrSignalHandlers()391 static void installExceptionOrSignalHandlers() {
392 // Setup the signal handler.
393 struct sigaction Handler;
394 Handler.sa_handler = CrashRecoverySignalHandler;
395 Handler.sa_flags = 0;
396 sigemptyset(&Handler.sa_mask);
397
398 for (unsigned i = 0; i != NumSignals; ++i) {
399 sigaction(Signals[i], &Handler, &PrevActions[i]);
400 }
401 }
402
uninstallExceptionOrSignalHandlers()403 static void uninstallExceptionOrSignalHandlers() {
404 // Restore the previous signal handlers.
405 for (unsigned i = 0; i != NumSignals; ++i)
406 sigaction(Signals[i], &PrevActions[i], nullptr);
407 }
408
409 #endif // !_WIN32
410
RunSafely(function_ref<void ()> Fn)411 bool CrashRecoveryContext::RunSafely(function_ref<void()> Fn) {
412 // If crash recovery is disabled, do nothing.
413 if (gCrashRecoveryEnabled) {
414 assert(!Impl && "Crash recovery context already initialized!");
415 CrashRecoveryContextImpl *CRCI = new CrashRecoveryContextImpl(this);
416 Impl = CRCI;
417
418 CRCI->ValidJumpBuffer = true;
419 if (setjmp(CRCI->JumpBuffer) != 0) {
420 return false;
421 }
422 }
423
424 Fn();
425 return true;
426 }
427
428 #endif // !_MSC_VER
429
430 LLVM_ATTRIBUTE_NORETURN
HandleExit(int RetCode)431 void CrashRecoveryContext::HandleExit(int RetCode) {
432 #if defined(_WIN32)
433 // SEH and VEH
434 ::RaiseException(0xE0000000 | RetCode, 0, 0, NULL);
435 #else
436 // On Unix we don't need to raise an exception, we go directly to
437 // HandleCrash(), then longjmp will unwind the stack for us.
438 CrashRecoveryContextImpl *CRCI = (CrashRecoveryContextImpl *)Impl;
439 assert(CRCI && "Crash recovery context never initialized!");
440 CRCI->HandleCrash(RetCode, 0 /*no sig num*/);
441 #endif
442 llvm_unreachable("Most likely setjmp wasn't called!");
443 }
444
445 // FIXME: Portability.
setThreadBackgroundPriority()446 static void setThreadBackgroundPriority() {
447 #ifdef __APPLE__
448 setpriority(PRIO_DARWIN_THREAD, 0, PRIO_DARWIN_BG);
449 #endif
450 }
451
hasThreadBackgroundPriority()452 static bool hasThreadBackgroundPriority() {
453 #ifdef __APPLE__
454 return getpriority(PRIO_DARWIN_THREAD, 0) == 1;
455 #else
456 return false;
457 #endif
458 }
459
460 namespace {
461 struct RunSafelyOnThreadInfo {
462 function_ref<void()> Fn;
463 CrashRecoveryContext *CRC;
464 bool UseBackgroundPriority;
465 bool Result;
466 };
467 }
468
RunSafelyOnThread_Dispatch(void * UserData)469 static void RunSafelyOnThread_Dispatch(void *UserData) {
470 RunSafelyOnThreadInfo *Info =
471 reinterpret_cast<RunSafelyOnThreadInfo*>(UserData);
472
473 if (Info->UseBackgroundPriority)
474 setThreadBackgroundPriority();
475
476 Info->Result = Info->CRC->RunSafely(Info->Fn);
477 }
RunSafelyOnThread(function_ref<void ()> Fn,unsigned RequestedStackSize)478 bool CrashRecoveryContext::RunSafelyOnThread(function_ref<void()> Fn,
479 unsigned RequestedStackSize) {
480 bool UseBackgroundPriority = hasThreadBackgroundPriority();
481 RunSafelyOnThreadInfo Info = { Fn, this, UseBackgroundPriority, false };
482 llvm_execute_on_thread(RunSafelyOnThread_Dispatch, &Info,
483 RequestedStackSize == 0
484 ? llvm::None
485 : llvm::Optional<unsigned>(RequestedStackSize));
486 if (CrashRecoveryContextImpl *CRC = (CrashRecoveryContextImpl *)Impl)
487 CRC->setSwitchedThread();
488 return Info.Result;
489 }
490