1//===--- CrashRecoveryContext.cpp - Crash Recovery ------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8
9#include "llvm/Support/CrashRecoveryContext.h"
10#include "llvm/Config/llvm-config.h"
11#include "llvm/Support/ErrorHandling.h"
12#include "llvm/Support/ExitCodes.h"
13#include "llvm/Support/Signals.h"
14#include "llvm/Support/thread.h"
15#include <cassert>
16#include <mutex>
17#include <setjmp.h>
18
19using namespace llvm;
20
21namespace {
22
23struct CrashRecoveryContextImpl;
24static LLVM_THREAD_LOCAL const CrashRecoveryContextImpl *CurrentContext;
25
26struct CrashRecoveryContextImpl {
27 // When threads are disabled, this links up all active
28 // CrashRecoveryContextImpls. When threads are enabled there's one thread
29 // per CrashRecoveryContext and CurrentContext is a thread-local, so only one
30 // CrashRecoveryContextImpl is active per thread and this is always null.
31 const CrashRecoveryContextImpl *Next;
32
33 CrashRecoveryContext *CRC;
34 ::jmp_buf JumpBuffer;
35 volatile unsigned Failed : 1;
36 unsigned SwitchedThread : 1;
37 unsigned ValidJumpBuffer : 1;
38
39public:
40 CrashRecoveryContextImpl(CrashRecoveryContext *CRC) noexcept
41 : CRC(CRC), Failed(false), SwitchedThread(false), ValidJumpBuffer(false) {
42 Next = CurrentContext;
43 CurrentContext = this;
44 }
45 ~CrashRecoveryContextImpl() {
46 if (!SwitchedThread)
47 CurrentContext = Next;
48 }
49
50 /// Called when the separate crash-recovery thread was finished, to
51 /// indicate that we don't need to clear the thread-local CurrentContext.
52 void setSwitchedThread() {
53#if defined(LLVM_ENABLE_THREADS) && LLVM_ENABLE_THREADS != 0
54 SwitchedThread = true;
55#endif
56 }
57
58 // If the function ran by the CrashRecoveryContext crashes or fails, then
59 // 'RetCode' represents the returned error code, as if it was returned by a
60 // process. 'Context' represents the signal type on Unix; on Windows, it is
61 // the ExceptionContext.
62 void HandleCrash(int RetCode, uintptr_t Context) {
63 // Eliminate the current context entry, to avoid re-entering in case the
64 // cleanup code crashes.
65 CurrentContext = Next;
66
67 assert(!Failed && "Crash recovery context already failed!");
68 Failed = true;
69
70 if (CRC->DumpStackAndCleanupOnFailure)
71 sys::CleanupOnSignal(Context);
72
73 CRC->RetCode = RetCode;
74
75 // Jump back to the RunSafely we were called under.
76 if (ValidJumpBuffer)
77 longjmp(env: JumpBuffer, val: 1);
78
79 // Otherwise let the caller decide of the outcome of the crash. Currently
80 // this occurs when using SEH on Windows with MSVC or clang-cl.
81 }
82};
83
84std::mutex &getCrashRecoveryContextMutex() {
85 static std::mutex CrashRecoveryContextMutex;
86 return CrashRecoveryContextMutex;
87}
88
89static bool gCrashRecoveryEnabled = false;
90
91static LLVM_THREAD_LOCAL const CrashRecoveryContext *IsRecoveringFromCrash;
92
93} // namespace
94
95static void
96installExceptionOrSignalHandlers(bool NeedsPOSIXUtilitySignalHandling);
97static void uninstallExceptionOrSignalHandlers();
98
99CrashRecoveryContextCleanup::~CrashRecoveryContextCleanup() = default;
100
101CrashRecoveryContext::CrashRecoveryContext() {
102 // On Windows, if abort() was previously triggered (and caught by a previous
103 // CrashRecoveryContext) the Windows CRT removes our installed signal handler,
104 // so we need to install it again.
105 sys::DisableSystemDialogsOnCrash();
106}
107
108CrashRecoveryContext::~CrashRecoveryContext() {
109 // Reclaim registered resources.
110 CrashRecoveryContextCleanup *i = head;
111 const CrashRecoveryContext *PC = IsRecoveringFromCrash;
112 IsRecoveringFromCrash = this;
113 while (i) {
114 CrashRecoveryContextCleanup *tmp = i;
115 i = tmp->next;
116 tmp->cleanupFired = true;
117 tmp->recoverResources();
118 delete tmp;
119 }
120 IsRecoveringFromCrash = PC;
121
122 CrashRecoveryContextImpl *CRCI = (CrashRecoveryContextImpl *) Impl;
123 delete CRCI;
124}
125
126bool CrashRecoveryContext::isRecoveringFromCrash() {
127 return IsRecoveringFromCrash != nullptr;
128}
129
130CrashRecoveryContext *CrashRecoveryContext::GetCurrent() {
131 if (!gCrashRecoveryEnabled)
132 return nullptr;
133
134 const CrashRecoveryContextImpl *CRCI = CurrentContext;
135 if (!CRCI)
136 return nullptr;
137
138 return CRCI->CRC;
139}
140
141void CrashRecoveryContext::Enable(bool NeedsPOSIXUtilitySignalHandling) {
142 std::lock_guard<std::mutex> L(getCrashRecoveryContextMutex());
143 // FIXME: Shouldn't this be a refcount or something?
144 if (gCrashRecoveryEnabled)
145 return;
146 gCrashRecoveryEnabled = true;
147 installExceptionOrSignalHandlers(NeedsPOSIXUtilitySignalHandling);
148}
149
150void CrashRecoveryContext::Disable() {
151 std::lock_guard<std::mutex> L(getCrashRecoveryContextMutex());
152 if (!gCrashRecoveryEnabled)
153 return;
154 gCrashRecoveryEnabled = false;
155 uninstallExceptionOrSignalHandlers();
156}
157
158void CrashRecoveryContext::registerCleanup(CrashRecoveryContextCleanup *cleanup)
159{
160 if (!cleanup)
161 return;
162 if (head)
163 head->prev = cleanup;
164 cleanup->next = head;
165 head = cleanup;
166}
167
168void
169CrashRecoveryContext::unregisterCleanup(CrashRecoveryContextCleanup *cleanup) {
170 if (!cleanup)
171 return;
172 if (cleanup == head) {
173 head = cleanup->next;
174 if (head)
175 head->prev = nullptr;
176 }
177 else {
178 cleanup->prev->next = cleanup->next;
179 if (cleanup->next)
180 cleanup->next->prev = cleanup->prev;
181 }
182 delete cleanup;
183}
184
185#if defined(_MSC_VER)
186
187#include <windows.h> // for GetExceptionInformation
188
189// If _MSC_VER is defined, we must have SEH. Use it if it's available. It's way
190// better than VEH. Vectored exception handling catches all exceptions happening
191// on the thread with installed exception handlers, so it can interfere with
192// internal exception handling of other libraries on that thread. SEH works
193// exactly as you would expect normal exception handling to work: it only
194// catches exceptions if they would bubble out from the stack frame with __try /
195// __except.
196
197static void
198installExceptionOrSignalHandlers(bool NeedsPOSIXUtilitySignalHandling) {}
199static void uninstallExceptionOrSignalHandlers() {}
200
201// We need this function because the call to GetExceptionInformation() can only
202// occur inside the __except evaluation block
203static int ExceptionFilter(_EXCEPTION_POINTERS *Except) {
204 // Lookup the current thread local recovery object.
205 const CrashRecoveryContextImpl *CRCI = CurrentContext;
206
207 if (!CRCI) {
208 // Something has gone horribly wrong, so let's just tell everyone
209 // to keep searching
210 CrashRecoveryContext::Disable();
211 return EXCEPTION_CONTINUE_SEARCH;
212 }
213
214 int RetCode = (int)Except->ExceptionRecord->ExceptionCode;
215 if ((RetCode & 0xF0000000) == 0xE0000000)
216 RetCode &= ~0xF0000000; // this crash was generated by sys::Process::Exit
217
218 // Handle the crash
219 const_cast<CrashRecoveryContextImpl *>(CRCI)->HandleCrash(
220 RetCode, reinterpret_cast<uintptr_t>(Except));
221
222 return EXCEPTION_EXECUTE_HANDLER;
223}
224
225#if defined(__clang__) && defined(_M_IX86)
226// Work around PR44697.
227__attribute__((optnone))
228#endif
229bool CrashRecoveryContext::RunSafely(function_ref<void()> Fn) {
230 if (!gCrashRecoveryEnabled) {
231 Fn();
232 return true;
233 }
234 assert(!Impl && "Crash recovery context already initialized!");
235 Impl = new CrashRecoveryContextImpl(this);
236 __try {
237 Fn();
238 } __except (ExceptionFilter(GetExceptionInformation())) {
239 return false;
240 }
241 return true;
242}
243
244#else // !_MSC_VER
245
246#if defined(_WIN32)
247// This is a non-MSVC compiler, probably mingw gcc or clang without
248// -fms-extensions. Use vectored exception handling (VEH).
249//
250// On Windows, we can make use of vectored exception handling to catch most
251// crashing situations. Note that this does mean we will be alerted of
252// exceptions *before* structured exception handling has the opportunity to
253// catch it. Unfortunately, this causes problems in practice with other code
254// running on threads with LLVM crash recovery contexts, so we would like to
255// eventually move away from VEH.
256//
257// Vectored works on a per-thread basis, which is an advantage over
258// SetUnhandledExceptionFilter. SetUnhandledExceptionFilter also doesn't have
259// any native support for chaining exception handlers, but VEH allows more than
260// one.
261//
262// The vectored exception handler functionality was added in Windows
263// XP, so if support for older versions of Windows is required,
264// it will have to be added.
265
266#include "llvm/Support/Windows/WindowsSupport.h"
267
268static LONG CALLBACK ExceptionHandler(PEXCEPTION_POINTERS ExceptionInfo)
269{
270 // DBG_PRINTEXCEPTION_WIDE_C is not properly defined on all supported
271 // compilers and platforms, so we define it manually.
272 constexpr ULONG DbgPrintExceptionWideC = 0x4001000AL;
273 switch (ExceptionInfo->ExceptionRecord->ExceptionCode)
274 {
275 case DBG_PRINTEXCEPTION_C:
276 case DbgPrintExceptionWideC:
277 case 0x406D1388: // set debugger thread name
278 return EXCEPTION_CONTINUE_EXECUTION;
279 }
280
281 // Lookup the current thread local recovery object.
282 const CrashRecoveryContextImpl *CRCI = CurrentContext;
283
284 if (!CRCI) {
285 // Something has gone horribly wrong, so let's just tell everyone
286 // to keep searching
287 CrashRecoveryContext::Disable();
288 return EXCEPTION_CONTINUE_SEARCH;
289 }
290
291 // TODO: We can capture the stack backtrace here and store it on the
292 // implementation if we so choose.
293
294 int RetCode = (int)ExceptionInfo->ExceptionRecord->ExceptionCode;
295 if ((RetCode & 0xF0000000) == 0xE0000000)
296 RetCode &= ~0xF0000000; // this crash was generated by sys::Process::Exit
297
298 // Handle the crash
299 const_cast<CrashRecoveryContextImpl *>(CRCI)->HandleCrash(
300 RetCode, reinterpret_cast<uintptr_t>(ExceptionInfo));
301
302 // Note that we don't actually get here because HandleCrash calls
303 // longjmp, which means the HandleCrash function never returns.
304 llvm_unreachable("Handled the crash, should have longjmp'ed out of here");
305}
306
307// Because the Enable and Disable calls are static, it means that
308// there may not actually be an Impl available, or even a current
309// CrashRecoveryContext at all. So we make use of a thread-local
310// exception table. The handles contained in here will either be
311// non-NULL, valid VEH handles, or NULL.
312static LLVM_THREAD_LOCAL const void* sCurrentExceptionHandle;
313
314static void
315installExceptionOrSignalHandlers(bool NeedsPOSIXUtilitySignalHandling) {
316 // We can set up vectored exception handling now. We will install our
317 // handler as the front of the list, though there's no assurances that
318 // it will remain at the front (another call could install itself before
319 // our handler). This 1) isn't likely, and 2) shouldn't cause problems.
320 PVOID handle = ::AddVectoredExceptionHandler(1, ExceptionHandler);
321 sCurrentExceptionHandle = handle;
322}
323
324static void uninstallExceptionOrSignalHandlers() {
325 PVOID currentHandle = const_cast<PVOID>(sCurrentExceptionHandle);
326 if (currentHandle) {
327 // Now we can remove the vectored exception handler from the chain
328 ::RemoveVectoredExceptionHandler(currentHandle);
329
330 // Reset the handle in our thread-local set.
331 sCurrentExceptionHandle = NULL;
332 }
333}
334
335#else // !_WIN32
336
337// Generic POSIX implementation.
338//
339// This implementation relies on synchronous signals being delivered to the
340// current thread. We use a thread local object to keep track of the active
341// crash recovery context, and install signal handlers to invoke HandleCrash on
342// the active object.
343//
344// This implementation does not attempt to chain signal handlers in any
345// reliable fashion -- if we get a signal outside of a crash recovery context we
346// simply disable crash recovery and raise the signal again.
347
348#include <signal.h>
349
350static const int Signals[] =
351 { SIGABRT, SIGBUS, SIGFPE, SIGILL, SIGSEGV, SIGTRAP };
352static const unsigned NumSignals = std::size(Signals);
353static struct sigaction PrevActions[NumSignals];
354
355static void CrashRecoverySignalHandler(int Signal) {
356 // Lookup the current thread local recovery object.
357 const CrashRecoveryContextImpl *CRCI = CurrentContext;
358
359 if (!CRCI) {
360 // We didn't find a crash recovery context -- this means either we got a
361 // signal on a thread we didn't expect it on, the application got a signal
362 // outside of a crash recovery context, or something else went horribly
363 // wrong.
364 //
365 // Disable crash recovery and raise the signal again. The assumption here is
366 // that the enclosing application will terminate soon, and we won't want to
367 // attempt crash recovery again.
368 //
369 // This call of Disable isn't thread safe, but it doesn't actually matter.
370 CrashRecoveryContext::Disable();
371 raise(sig: Signal);
372
373 // The signal will be thrown once the signal mask is restored.
374 return;
375 }
376
377 // Unblock the signal we received.
378 sigset_t SigMask;
379 sigemptyset(set: &SigMask);
380 sigaddset(set: &SigMask, signo: Signal);
381 sigprocmask(SIG_UNBLOCK, set: &SigMask, oset: nullptr);
382
383 // Return the same error code as if the program crashed, as mentioned in the
384 // section "Exit Status for Commands":
385 // https://pubs.opengroup.org/onlinepubs/9699919799/xrat/V4_xcu_chap02.html
386 int RetCode = 128 + Signal;
387
388 // Don't consider a broken pipe as a crash (see clang/lib/Driver/Driver.cpp)
389 if (Signal == SIGPIPE)
390 RetCode = EX_IOERR;
391
392 if (CRCI)
393 const_cast<CrashRecoveryContextImpl *>(CRCI)->HandleCrash(RetCode, Context: Signal);
394}
395
396static void
397installExceptionOrSignalHandlers(bool NeedsPOSIXUtilitySignalHandling) {
398 // Setup the signal handler.
399 struct sigaction Handler;
400 Handler.sa_handler = CrashRecoverySignalHandler;
401 Handler.sa_flags = 0;
402 sigemptyset(set: &Handler.sa_mask);
403
404 for (unsigned i = 0; i != NumSignals; ++i) {
405 if (NeedsPOSIXUtilitySignalHandling) {
406 // Don't install the new handler if the signal disposition is SIG_IGN.
407 struct sigaction act;
408 if (sigaction(sig: Signals[i], NULL, oact: &act) == 0 && act.sa_handler != SIG_IGN)
409 sigaction(sig: Signals[i], act: &Handler, oact: &PrevActions[i]);
410 } else {
411 sigaction(sig: Signals[i], act: &Handler, oact: &PrevActions[i]);
412 }
413 }
414}
415
416static void uninstallExceptionOrSignalHandlers() {
417 // Restore the previous signal handlers.
418 for (unsigned i = 0; i != NumSignals; ++i)
419 sigaction(sig: Signals[i], act: &PrevActions[i], oact: nullptr);
420}
421
422#endif // !_WIN32
423
424bool CrashRecoveryContext::RunSafely(function_ref<void()> Fn) {
425 // If crash recovery is disabled, do nothing.
426 if (gCrashRecoveryEnabled) {
427 assert(!Impl && "Crash recovery context already initialized!");
428 CrashRecoveryContextImpl *CRCI = new CrashRecoveryContextImpl(this);
429 Impl = CRCI;
430
431 CRCI->ValidJumpBuffer = true;
432 if (setjmp(CRCI->JumpBuffer) != 0) {
433 return false;
434 }
435 }
436
437 Fn();
438 return true;
439}
440
441#endif // !_MSC_VER
442
443[[noreturn]] void CrashRecoveryContext::HandleExit(int RetCode) {
444#if defined(_WIN32)
445 // Since the exception code is actually of NTSTATUS type, we use the
446 // Microsoft-recommended 0xE prefix, to signify that this is a user error.
447 // This value is a combination of the customer field (bit 29) and severity
448 // field (bits 30-31) in the NTSTATUS specification.
449 ::RaiseException(0xE0000000 | RetCode, 0, 0, NULL);
450#else
451 // On Unix we don't need to raise an exception, we go directly to
452 // HandleCrash(), then longjmp will unwind the stack for us.
453 CrashRecoveryContextImpl *CRCI = (CrashRecoveryContextImpl *)Impl;
454 assert(CRCI && "Crash recovery context never initialized!");
455 CRCI->HandleCrash(RetCode, Context: 0 /*no sig num*/);
456#endif
457 llvm_unreachable("Most likely setjmp wasn't called!");
458}
459
460bool CrashRecoveryContext::isCrash(int RetCode) {
461#if defined(_WIN32)
462 // On Windows, the code is interpreted as NTSTATUS. The two high bits
463 // represent the severity. Values starting with 0x80000000 are reserved for
464 // "warnings"; values of 0xC0000000 and up are for "errors". In practice, both
465 // are interpreted as a non-continuable signal.
466 unsigned Code = ((unsigned)RetCode & 0xF0000000) >> 28;
467 if (Code != 0xC && Code != 8)
468 return false;
469#else
470 // On Unix, signals are represented by return codes of 128 or higher.
471 // Exit code 128 is a reserved value and should not be raised as a signal.
472 if (RetCode <= 128)
473 return false;
474#endif
475 return true;
476}
477
478bool CrashRecoveryContext::throwIfCrash(int RetCode) {
479 if (!isCrash(RetCode))
480 return false;
481#if defined(_WIN32)
482 ::RaiseException(RetCode, 0, 0, NULL);
483#else
484 llvm::sys::unregisterHandlers();
485 raise(sig: RetCode - 128);
486#endif
487 return true;
488}
489
490// FIXME: Portability.
491static void setThreadBackgroundPriority() {
492#ifdef __APPLE__
493 setpriority(PRIO_DARWIN_THREAD, 0, PRIO_DARWIN_BG);
494#endif
495}
496
497static bool hasThreadBackgroundPriority() {
498#ifdef __APPLE__
499 return getpriority(PRIO_DARWIN_THREAD, 0) == 1;
500#else
501 return false;
502#endif
503}
504
505namespace {
506struct RunSafelyOnThreadInfo {
507 function_ref<void()> Fn;
508 CrashRecoveryContext *CRC;
509 bool UseBackgroundPriority;
510 bool Result;
511};
512} // namespace
513
514static void RunSafelyOnThread_Dispatch(void *UserData) {
515 RunSafelyOnThreadInfo *Info =
516 reinterpret_cast<RunSafelyOnThreadInfo*>(UserData);
517
518 if (Info->UseBackgroundPriority)
519 setThreadBackgroundPriority();
520
521 Info->Result = Info->CRC->RunSafely(Fn: Info->Fn);
522}
523bool CrashRecoveryContext::RunSafelyOnThread(function_ref<void()> Fn,
524 unsigned RequestedStackSize) {
525 bool UseBackgroundPriority = hasThreadBackgroundPriority();
526 RunSafelyOnThreadInfo Info = { .Fn: Fn, .CRC: this, .UseBackgroundPriority: UseBackgroundPriority, .Result: false };
527 llvm::thread Thread(RequestedStackSize == 0
528 ? std::nullopt
529 : std::optional<unsigned>(RequestedStackSize),
530 RunSafelyOnThread_Dispatch, &Info);
531 Thread.join();
532
533 if (CrashRecoveryContextImpl *CRC = (CrashRecoveryContextImpl *)Impl)
534 CRC->setSwitchedThread();
535 return Info.Result;
536}
537
538bool CrashRecoveryContext::RunSafelyOnNewStack(function_ref<void()> Fn,
539 unsigned RequestedStackSize) {
540 return RunSafelyOnThread(Fn, RequestedStackSize);
541}
542