1 //===--- CrashRecoveryContext.cpp - Crash Recovery ------------------------===//
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
9 #include "llvm/Support/CrashRecoveryContext.h"
10 #include "llvm/Config/llvm-config.h"
11 #include "llvm/Support/ErrorHandling.h"
12 #include "llvm/Support/ExitCodes.h"
13 #include "llvm/Support/ManagedStatic.h"
14 #include "llvm/Support/Signals.h"
15 #include "llvm/Support/ThreadLocal.h"
16 #include "llvm/Support/thread.h"
24 struct CrashRecoveryContextImpl
;
27 sys::ThreadLocal
<const CrashRecoveryContextImpl
> > CurrentContext
;
29 struct CrashRecoveryContextImpl
{
30 // When threads are disabled, this links up all active
31 // CrashRecoveryContextImpls. When threads are enabled there's one thread
32 // per CrashRecoveryContext and CurrentContext is a thread-local, so only one
33 // CrashRecoveryContextImpl is active per thread and this is always null.
34 const CrashRecoveryContextImpl
*Next
;
36 CrashRecoveryContext
*CRC
;
38 volatile unsigned Failed
: 1;
39 unsigned SwitchedThread
: 1;
40 unsigned ValidJumpBuffer
: 1;
43 CrashRecoveryContextImpl(CrashRecoveryContext
*CRC
) noexcept
44 : CRC(CRC
), Failed(false), SwitchedThread(false), ValidJumpBuffer(false) {
45 Next
= CurrentContext
->get();
46 CurrentContext
->set(this);
48 ~CrashRecoveryContextImpl() {
50 CurrentContext
->set(Next
);
53 /// Called when the separate crash-recovery thread was finished, to
54 /// indicate that we don't need to clear the thread-local CurrentContext.
55 void setSwitchedThread() {
56 #if defined(LLVM_ENABLE_THREADS) && LLVM_ENABLE_THREADS != 0
57 SwitchedThread
= true;
61 // If the function ran by the CrashRecoveryContext crashes or fails, then
62 // 'RetCode' represents the returned error code, as if it was returned by a
63 // process. 'Context' represents the signal type on Unix; on Windows, it is
64 // the ExceptionContext.
65 void HandleCrash(int RetCode
, uintptr_t Context
) {
66 // Eliminate the current context entry, to avoid re-entering in case the
67 // cleanup code crashes.
68 CurrentContext
->set(Next
);
70 assert(!Failed
&& "Crash recovery context already failed!");
73 if (CRC
->DumpStackAndCleanupOnFailure
)
74 sys::CleanupOnSignal(Context
);
76 CRC
->RetCode
= RetCode
;
78 // Jump back to the RunSafely we were called under.
80 longjmp(JumpBuffer
, 1);
82 // Otherwise let the caller decide of the outcome of the crash. Currently
83 // this occurs when using SEH on Windows with MSVC or clang-cl.
88 static ManagedStatic
<std::mutex
> gCrashRecoveryContextMutex
;
89 static bool gCrashRecoveryEnabled
= false;
91 static ManagedStatic
<sys::ThreadLocal
<const CrashRecoveryContext
>>
92 tlIsRecoveringFromCrash
;
94 static void installExceptionOrSignalHandlers();
95 static void uninstallExceptionOrSignalHandlers();
97 CrashRecoveryContextCleanup::~CrashRecoveryContextCleanup() {}
99 CrashRecoveryContext::CrashRecoveryContext() {
100 // On Windows, if abort() was previously triggered (and caught by a previous
101 // CrashRecoveryContext) the Windows CRT removes our installed signal handler,
102 // so we need to install it again.
103 sys::DisableSystemDialogsOnCrash();
106 CrashRecoveryContext::~CrashRecoveryContext() {
107 // Reclaim registered resources.
108 CrashRecoveryContextCleanup
*i
= head
;
109 const CrashRecoveryContext
*PC
= tlIsRecoveringFromCrash
->get();
110 tlIsRecoveringFromCrash
->set(this);
112 CrashRecoveryContextCleanup
*tmp
= i
;
114 tmp
->cleanupFired
= true;
115 tmp
->recoverResources();
118 tlIsRecoveringFromCrash
->set(PC
);
120 CrashRecoveryContextImpl
*CRCI
= (CrashRecoveryContextImpl
*) Impl
;
124 bool CrashRecoveryContext::isRecoveringFromCrash() {
125 return tlIsRecoveringFromCrash
->get() != nullptr;
128 CrashRecoveryContext
*CrashRecoveryContext::GetCurrent() {
129 if (!gCrashRecoveryEnabled
)
132 const CrashRecoveryContextImpl
*CRCI
= CurrentContext
->get();
139 void CrashRecoveryContext::Enable() {
140 std::lock_guard
<std::mutex
> L(*gCrashRecoveryContextMutex
);
141 // FIXME: Shouldn't this be a refcount or something?
142 if (gCrashRecoveryEnabled
)
144 gCrashRecoveryEnabled
= true;
145 installExceptionOrSignalHandlers();
148 void CrashRecoveryContext::Disable() {
149 std::lock_guard
<std::mutex
> L(*gCrashRecoveryContextMutex
);
150 if (!gCrashRecoveryEnabled
)
152 gCrashRecoveryEnabled
= false;
153 uninstallExceptionOrSignalHandlers();
156 void CrashRecoveryContext::registerCleanup(CrashRecoveryContextCleanup
*cleanup
)
161 head
->prev
= cleanup
;
162 cleanup
->next
= head
;
167 CrashRecoveryContext::unregisterCleanup(CrashRecoveryContextCleanup
*cleanup
) {
170 if (cleanup
== head
) {
171 head
= cleanup
->next
;
173 head
->prev
= nullptr;
176 cleanup
->prev
->next
= cleanup
->next
;
178 cleanup
->next
->prev
= cleanup
->prev
;
183 #if defined(_MSC_VER)
185 #include <windows.h> // for GetExceptionInformation
187 // If _MSC_VER is defined, we must have SEH. Use it if it's available. It's way
188 // better than VEH. Vectored exception handling catches all exceptions happening
189 // on the thread with installed exception handlers, so it can interfere with
190 // internal exception handling of other libraries on that thread. SEH works
191 // exactly as you would expect normal exception handling to work: it only
192 // catches exceptions if they would bubble out from the stack frame with __try /
195 static void installExceptionOrSignalHandlers() {}
196 static void uninstallExceptionOrSignalHandlers() {}
198 // We need this function because the call to GetExceptionInformation() can only
199 // occur inside the __except evaluation block
200 static int ExceptionFilter(_EXCEPTION_POINTERS
*Except
) {
201 // Lookup the current thread local recovery object.
202 const CrashRecoveryContextImpl
*CRCI
= CurrentContext
->get();
205 // Something has gone horribly wrong, so let's just tell everyone
207 CrashRecoveryContext::Disable();
208 return EXCEPTION_CONTINUE_SEARCH
;
211 int RetCode
= (int)Except
->ExceptionRecord
->ExceptionCode
;
212 if ((RetCode
& 0xF0000000) == 0xE0000000)
213 RetCode
&= ~0xF0000000; // this crash was generated by sys::Process::Exit
216 const_cast<CrashRecoveryContextImpl
*>(CRCI
)->HandleCrash(
217 RetCode
, reinterpret_cast<uintptr_t>(Except
));
219 return EXCEPTION_EXECUTE_HANDLER
;
222 #if defined(__clang__) && defined(_M_IX86)
223 // Work around PR44697.
224 __attribute__((optnone
))
226 bool CrashRecoveryContext::RunSafely(function_ref
<void()> Fn
) {
227 if (!gCrashRecoveryEnabled
) {
231 assert(!Impl
&& "Crash recovery context already initialized!");
232 Impl
= new CrashRecoveryContextImpl(this);
235 } __except (ExceptionFilter(GetExceptionInformation())) {
244 // This is a non-MSVC compiler, probably mingw gcc or clang without
245 // -fms-extensions. Use vectored exception handling (VEH).
247 // On Windows, we can make use of vectored exception handling to catch most
248 // crashing situations. Note that this does mean we will be alerted of
249 // exceptions *before* structured exception handling has the opportunity to
250 // catch it. Unfortunately, this causes problems in practice with other code
251 // running on threads with LLVM crash recovery contexts, so we would like to
252 // eventually move away from VEH.
254 // Vectored works on a per-thread basis, which is an advantage over
255 // SetUnhandledExceptionFilter. SetUnhandledExceptionFilter also doesn't have
256 // any native support for chaining exception handlers, but VEH allows more than
259 // The vectored exception handler functionality was added in Windows
260 // XP, so if support for older versions of Windows is required,
261 // it will have to be added.
263 #include "llvm/Support/Windows/WindowsSupport.h"
265 static LONG CALLBACK
ExceptionHandler(PEXCEPTION_POINTERS ExceptionInfo
)
267 // DBG_PRINTEXCEPTION_WIDE_C is not properly defined on all supported
268 // compilers and platforms, so we define it manually.
269 constexpr ULONG DbgPrintExceptionWideC
= 0x4001000AL
;
270 switch (ExceptionInfo
->ExceptionRecord
->ExceptionCode
)
272 case DBG_PRINTEXCEPTION_C
:
273 case DbgPrintExceptionWideC
:
274 case 0x406D1388: // set debugger thread name
275 return EXCEPTION_CONTINUE_EXECUTION
;
278 // Lookup the current thread local recovery object.
279 const CrashRecoveryContextImpl
*CRCI
= CurrentContext
->get();
282 // Something has gone horribly wrong, so let's just tell everyone
284 CrashRecoveryContext::Disable();
285 return EXCEPTION_CONTINUE_SEARCH
;
288 // TODO: We can capture the stack backtrace here and store it on the
289 // implementation if we so choose.
291 int RetCode
= (int)ExceptionInfo
->ExceptionRecord
->ExceptionCode
;
292 if ((RetCode
& 0xF0000000) == 0xE0000000)
293 RetCode
&= ~0xF0000000; // this crash was generated by sys::Process::Exit
296 const_cast<CrashRecoveryContextImpl
*>(CRCI
)->HandleCrash(
297 RetCode
, reinterpret_cast<uintptr_t>(ExceptionInfo
));
299 // Note that we don't actually get here because HandleCrash calls
300 // longjmp, which means the HandleCrash function never returns.
301 llvm_unreachable("Handled the crash, should have longjmp'ed out of here");
304 // Because the Enable and Disable calls are static, it means that
305 // there may not actually be an Impl available, or even a current
306 // CrashRecoveryContext at all. So we make use of a thread-local
307 // exception table. The handles contained in here will either be
308 // non-NULL, valid VEH handles, or NULL.
309 static sys::ThreadLocal
<const void> sCurrentExceptionHandle
;
311 static void installExceptionOrSignalHandlers() {
312 // We can set up vectored exception handling now. We will install our
313 // handler as the front of the list, though there's no assurances that
314 // it will remain at the front (another call could install itself before
315 // our handler). This 1) isn't likely, and 2) shouldn't cause problems.
316 PVOID handle
= ::AddVectoredExceptionHandler(1, ExceptionHandler
);
317 sCurrentExceptionHandle
.set(handle
);
320 static void uninstallExceptionOrSignalHandlers() {
321 PVOID currentHandle
= const_cast<PVOID
>(sCurrentExceptionHandle
.get());
323 // Now we can remove the vectored exception handler from the chain
324 ::RemoveVectoredExceptionHandler(currentHandle
);
326 // Reset the handle in our thread-local set.
327 sCurrentExceptionHandle
.set(NULL
);
333 // Generic POSIX implementation.
335 // This implementation relies on synchronous signals being delivered to the
336 // current thread. We use a thread local object to keep track of the active
337 // crash recovery context, and install signal handlers to invoke HandleCrash on
338 // the active object.
340 // This implementation does not attempt to chain signal handlers in any
341 // reliable fashion -- if we get a signal outside of a crash recovery context we
342 // simply disable crash recovery and raise the signal again.
346 static const int Signals
[] =
347 { SIGABRT
, SIGBUS
, SIGFPE
, SIGILL
, SIGSEGV
, SIGTRAP
};
348 static const unsigned NumSignals
= array_lengthof(Signals
);
349 static struct sigaction PrevActions
[NumSignals
];
351 static void CrashRecoverySignalHandler(int Signal
) {
352 // Lookup the current thread local recovery object.
353 const CrashRecoveryContextImpl
*CRCI
= CurrentContext
->get();
356 // We didn't find a crash recovery context -- this means either we got a
357 // signal on a thread we didn't expect it on, the application got a signal
358 // outside of a crash recovery context, or something else went horribly
361 // Disable crash recovery and raise the signal again. The assumption here is
362 // that the enclosing application will terminate soon, and we won't want to
363 // attempt crash recovery again.
365 // This call of Disable isn't thread safe, but it doesn't actually matter.
366 CrashRecoveryContext::Disable();
369 // The signal will be thrown once the signal mask is restored.
373 // Unblock the signal we received.
375 sigemptyset(&SigMask
);
376 sigaddset(&SigMask
, Signal
);
377 sigprocmask(SIG_UNBLOCK
, &SigMask
, nullptr);
379 // Return the same error code as if the program crashed, as mentioned in the
380 // section "Exit Status for Commands":
381 // https://pubs.opengroup.org/onlinepubs/9699919799/xrat/V4_xcu_chap02.html
382 int RetCode
= 128 + Signal
;
384 // Don't consider a broken pipe as a crash (see clang/lib/Driver/Driver.cpp)
385 if (Signal
== SIGPIPE
)
389 const_cast<CrashRecoveryContextImpl
*>(CRCI
)->HandleCrash(RetCode
, Signal
);
392 static void installExceptionOrSignalHandlers() {
393 // Setup the signal handler.
394 struct sigaction Handler
;
395 Handler
.sa_handler
= CrashRecoverySignalHandler
;
396 Handler
.sa_flags
= 0;
397 sigemptyset(&Handler
.sa_mask
);
399 for (unsigned i
= 0; i
!= NumSignals
; ++i
) {
400 sigaction(Signals
[i
], &Handler
, &PrevActions
[i
]);
404 static void uninstallExceptionOrSignalHandlers() {
405 // Restore the previous signal handlers.
406 for (unsigned i
= 0; i
!= NumSignals
; ++i
)
407 sigaction(Signals
[i
], &PrevActions
[i
], nullptr);
412 bool CrashRecoveryContext::RunSafely(function_ref
<void()> Fn
) {
413 // If crash recovery is disabled, do nothing.
414 if (gCrashRecoveryEnabled
) {
415 assert(!Impl
&& "Crash recovery context already initialized!");
416 CrashRecoveryContextImpl
*CRCI
= new CrashRecoveryContextImpl(this);
419 CRCI
->ValidJumpBuffer
= true;
420 if (setjmp(CRCI
->JumpBuffer
) != 0) {
431 [[noreturn
]] void CrashRecoveryContext::HandleExit(int RetCode
) {
434 ::RaiseException(0xE0000000 | RetCode
, 0, 0, NULL
);
436 // On Unix we don't need to raise an exception, we go directly to
437 // HandleCrash(), then longjmp will unwind the stack for us.
438 CrashRecoveryContextImpl
*CRCI
= (CrashRecoveryContextImpl
*)Impl
;
439 assert(CRCI
&& "Crash recovery context never initialized!");
440 CRCI
->HandleCrash(RetCode
, 0 /*no sig num*/);
442 llvm_unreachable("Most likely setjmp wasn't called!");
445 bool CrashRecoveryContext::throwIfCrash(int RetCode
) {
447 // On Windows, the high bits are reserved for kernel return codes. Values
448 // starting with 0x80000000 are reserved for "warnings"; values of 0xC0000000
449 // and up are for "errors". In practice, both are interpreted as a
450 // non-continuable signal.
451 unsigned Code
= ((unsigned)RetCode
& 0xF0000000) >> 28;
452 if (Code
!= 0xC && Code
!= 8)
454 ::RaiseException(RetCode
, 0, 0, NULL
);
456 // On Unix, signals are represented by return codes of 128 or higher.
457 // Exit code 128 is a reserved value and should not be raised as a signal.
460 llvm::sys::unregisterHandlers();
461 raise(RetCode
- 128);
466 // FIXME: Portability.
467 static void setThreadBackgroundPriority() {
469 setpriority(PRIO_DARWIN_THREAD
, 0, PRIO_DARWIN_BG
);
473 static bool hasThreadBackgroundPriority() {
475 return getpriority(PRIO_DARWIN_THREAD
, 0) == 1;
482 struct RunSafelyOnThreadInfo
{
483 function_ref
<void()> Fn
;
484 CrashRecoveryContext
*CRC
;
485 bool UseBackgroundPriority
;
490 static void RunSafelyOnThread_Dispatch(void *UserData
) {
491 RunSafelyOnThreadInfo
*Info
=
492 reinterpret_cast<RunSafelyOnThreadInfo
*>(UserData
);
494 if (Info
->UseBackgroundPriority
)
495 setThreadBackgroundPriority();
497 Info
->Result
= Info
->CRC
->RunSafely(Info
->Fn
);
499 bool CrashRecoveryContext::RunSafelyOnThread(function_ref
<void()> Fn
,
500 unsigned RequestedStackSize
) {
501 bool UseBackgroundPriority
= hasThreadBackgroundPriority();
502 RunSafelyOnThreadInfo Info
= { Fn
, this, UseBackgroundPriority
, false };
503 llvm::thread
Thread(RequestedStackSize
== 0
505 : llvm::Optional
<unsigned>(RequestedStackSize
),
506 RunSafelyOnThread_Dispatch
, &Info
);
509 if (CrashRecoveryContextImpl
*CRC
= (CrashRecoveryContextImpl
*)Impl
)
510 CRC
->setSwitchedThread();