1 //===--- CrashRecoveryContext.cpp - Crash Recovery ------------------------===//
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
9 #include "llvm/Support/CrashRecoveryContext.h"
10 #include "llvm/Config/llvm-config.h"
11 #include "llvm/Support/ErrorHandling.h"
12 #include "llvm/Support/ExitCodes.h"
13 #include "llvm/Support/Signals.h"
14 #include "llvm/Support/thread.h"
23 struct CrashRecoveryContextImpl
;
24 static LLVM_THREAD_LOCAL
const CrashRecoveryContextImpl
*CurrentContext
;
26 struct CrashRecoveryContextImpl
{
27 // When threads are disabled, this links up all active
28 // CrashRecoveryContextImpls. When threads are enabled there's one thread
29 // per CrashRecoveryContext and CurrentContext is a thread-local, so only one
30 // CrashRecoveryContextImpl is active per thread and this is always null.
31 const CrashRecoveryContextImpl
*Next
;
33 CrashRecoveryContext
*CRC
;
35 volatile unsigned Failed
: 1;
36 unsigned SwitchedThread
: 1;
37 unsigned ValidJumpBuffer
: 1;
40 CrashRecoveryContextImpl(CrashRecoveryContext
*CRC
) noexcept
41 : CRC(CRC
), Failed(false), SwitchedThread(false), ValidJumpBuffer(false) {
42 Next
= CurrentContext
;
43 CurrentContext
= this;
45 ~CrashRecoveryContextImpl() {
47 CurrentContext
= Next
;
50 /// Called when the separate crash-recovery thread was finished, to
51 /// indicate that we don't need to clear the thread-local CurrentContext.
52 void setSwitchedThread() {
53 #if defined(LLVM_ENABLE_THREADS) && LLVM_ENABLE_THREADS != 0
54 SwitchedThread
= true;
58 // If the function ran by the CrashRecoveryContext crashes or fails, then
59 // 'RetCode' represents the returned error code, as if it was returned by a
60 // process. 'Context' represents the signal type on Unix; on Windows, it is
61 // the ExceptionContext.
62 void HandleCrash(int RetCode
, uintptr_t Context
) {
63 // Eliminate the current context entry, to avoid re-entering in case the
64 // cleanup code crashes.
65 CurrentContext
= Next
;
67 assert(!Failed
&& "Crash recovery context already failed!");
70 if (CRC
->DumpStackAndCleanupOnFailure
)
71 sys::CleanupOnSignal(Context
);
73 CRC
->RetCode
= RetCode
;
75 // Jump back to the RunSafely we were called under.
77 longjmp(JumpBuffer
, 1);
79 // Otherwise let the caller decide of the outcome of the crash. Currently
80 // this occurs when using SEH on Windows with MSVC or clang-cl.
84 std::mutex
&getCrashRecoveryContextMutex() {
85 static std::mutex CrashRecoveryContextMutex
;
86 return CrashRecoveryContextMutex
;
89 static bool gCrashRecoveryEnabled
= false;
91 static LLVM_THREAD_LOCAL
const CrashRecoveryContext
*IsRecoveringFromCrash
;
95 static void installExceptionOrSignalHandlers();
96 static void uninstallExceptionOrSignalHandlers();
98 CrashRecoveryContextCleanup::~CrashRecoveryContextCleanup() = default;
100 CrashRecoveryContext::CrashRecoveryContext() {
101 // On Windows, if abort() was previously triggered (and caught by a previous
102 // CrashRecoveryContext) the Windows CRT removes our installed signal handler,
103 // so we need to install it again.
104 sys::DisableSystemDialogsOnCrash();
107 CrashRecoveryContext::~CrashRecoveryContext() {
108 // Reclaim registered resources.
109 CrashRecoveryContextCleanup
*i
= head
;
110 const CrashRecoveryContext
*PC
= IsRecoveringFromCrash
;
111 IsRecoveringFromCrash
= this;
113 CrashRecoveryContextCleanup
*tmp
= i
;
115 tmp
->cleanupFired
= true;
116 tmp
->recoverResources();
119 IsRecoveringFromCrash
= PC
;
121 CrashRecoveryContextImpl
*CRCI
= (CrashRecoveryContextImpl
*) Impl
;
125 bool CrashRecoveryContext::isRecoveringFromCrash() {
126 return IsRecoveringFromCrash
!= nullptr;
129 CrashRecoveryContext
*CrashRecoveryContext::GetCurrent() {
130 if (!gCrashRecoveryEnabled
)
133 const CrashRecoveryContextImpl
*CRCI
= CurrentContext
;
140 void CrashRecoveryContext::Enable() {
141 std::lock_guard
<std::mutex
> L(getCrashRecoveryContextMutex());
142 // FIXME: Shouldn't this be a refcount or something?
143 if (gCrashRecoveryEnabled
)
145 gCrashRecoveryEnabled
= true;
146 installExceptionOrSignalHandlers();
149 void CrashRecoveryContext::Disable() {
150 std::lock_guard
<std::mutex
> L(getCrashRecoveryContextMutex());
151 if (!gCrashRecoveryEnabled
)
153 gCrashRecoveryEnabled
= false;
154 uninstallExceptionOrSignalHandlers();
157 void CrashRecoveryContext::registerCleanup(CrashRecoveryContextCleanup
*cleanup
)
162 head
->prev
= cleanup
;
163 cleanup
->next
= head
;
168 CrashRecoveryContext::unregisterCleanup(CrashRecoveryContextCleanup
*cleanup
) {
171 if (cleanup
== head
) {
172 head
= cleanup
->next
;
174 head
->prev
= nullptr;
177 cleanup
->prev
->next
= cleanup
->next
;
179 cleanup
->next
->prev
= cleanup
->prev
;
184 #if defined(_MSC_VER)
186 #include <windows.h> // for GetExceptionInformation
188 // If _MSC_VER is defined, we must have SEH. Use it if it's available. It's way
189 // better than VEH. Vectored exception handling catches all exceptions happening
190 // on the thread with installed exception handlers, so it can interfere with
191 // internal exception handling of other libraries on that thread. SEH works
192 // exactly as you would expect normal exception handling to work: it only
193 // catches exceptions if they would bubble out from the stack frame with __try /
196 static void installExceptionOrSignalHandlers() {}
197 static void uninstallExceptionOrSignalHandlers() {}
199 // We need this function because the call to GetExceptionInformation() can only
200 // occur inside the __except evaluation block
201 static int ExceptionFilter(_EXCEPTION_POINTERS
*Except
) {
202 // Lookup the current thread local recovery object.
203 const CrashRecoveryContextImpl
*CRCI
= CurrentContext
;
206 // Something has gone horribly wrong, so let's just tell everyone
208 CrashRecoveryContext::Disable();
209 return EXCEPTION_CONTINUE_SEARCH
;
212 int RetCode
= (int)Except
->ExceptionRecord
->ExceptionCode
;
213 if ((RetCode
& 0xF0000000) == 0xE0000000)
214 RetCode
&= ~0xF0000000; // this crash was generated by sys::Process::Exit
217 const_cast<CrashRecoveryContextImpl
*>(CRCI
)->HandleCrash(
218 RetCode
, reinterpret_cast<uintptr_t>(Except
));
220 return EXCEPTION_EXECUTE_HANDLER
;
223 #if defined(__clang__) && defined(_M_IX86)
224 // Work around PR44697.
225 __attribute__((optnone
))
227 bool CrashRecoveryContext::RunSafely(function_ref
<void()> Fn
) {
228 if (!gCrashRecoveryEnabled
) {
232 assert(!Impl
&& "Crash recovery context already initialized!");
233 Impl
= new CrashRecoveryContextImpl(this);
236 } __except (ExceptionFilter(GetExceptionInformation())) {
245 // This is a non-MSVC compiler, probably mingw gcc or clang without
246 // -fms-extensions. Use vectored exception handling (VEH).
248 // On Windows, we can make use of vectored exception handling to catch most
249 // crashing situations. Note that this does mean we will be alerted of
250 // exceptions *before* structured exception handling has the opportunity to
251 // catch it. Unfortunately, this causes problems in practice with other code
252 // running on threads with LLVM crash recovery contexts, so we would like to
253 // eventually move away from VEH.
255 // Vectored works on a per-thread basis, which is an advantage over
256 // SetUnhandledExceptionFilter. SetUnhandledExceptionFilter also doesn't have
257 // any native support for chaining exception handlers, but VEH allows more than
260 // The vectored exception handler functionality was added in Windows
261 // XP, so if support for older versions of Windows is required,
262 // it will have to be added.
264 #include "llvm/Support/Windows/WindowsSupport.h"
266 static LONG CALLBACK
ExceptionHandler(PEXCEPTION_POINTERS ExceptionInfo
)
268 // DBG_PRINTEXCEPTION_WIDE_C is not properly defined on all supported
269 // compilers and platforms, so we define it manually.
270 constexpr ULONG DbgPrintExceptionWideC
= 0x4001000AL
;
271 switch (ExceptionInfo
->ExceptionRecord
->ExceptionCode
)
273 case DBG_PRINTEXCEPTION_C
:
274 case DbgPrintExceptionWideC
:
275 case 0x406D1388: // set debugger thread name
276 return EXCEPTION_CONTINUE_EXECUTION
;
279 // Lookup the current thread local recovery object.
280 const CrashRecoveryContextImpl
*CRCI
= CurrentContext
;
283 // Something has gone horribly wrong, so let's just tell everyone
285 CrashRecoveryContext::Disable();
286 return EXCEPTION_CONTINUE_SEARCH
;
289 // TODO: We can capture the stack backtrace here and store it on the
290 // implementation if we so choose.
292 int RetCode
= (int)ExceptionInfo
->ExceptionRecord
->ExceptionCode
;
293 if ((RetCode
& 0xF0000000) == 0xE0000000)
294 RetCode
&= ~0xF0000000; // this crash was generated by sys::Process::Exit
297 const_cast<CrashRecoveryContextImpl
*>(CRCI
)->HandleCrash(
298 RetCode
, reinterpret_cast<uintptr_t>(ExceptionInfo
));
300 // Note that we don't actually get here because HandleCrash calls
301 // longjmp, which means the HandleCrash function never returns.
302 llvm_unreachable("Handled the crash, should have longjmp'ed out of here");
305 // Because the Enable and Disable calls are static, it means that
306 // there may not actually be an Impl available, or even a current
307 // CrashRecoveryContext at all. So we make use of a thread-local
308 // exception table. The handles contained in here will either be
309 // non-NULL, valid VEH handles, or NULL.
310 static LLVM_THREAD_LOCAL
const void* sCurrentExceptionHandle
;
312 static void installExceptionOrSignalHandlers() {
313 // We can set up vectored exception handling now. We will install our
314 // handler as the front of the list, though there's no assurances that
315 // it will remain at the front (another call could install itself before
316 // our handler). This 1) isn't likely, and 2) shouldn't cause problems.
317 PVOID handle
= ::AddVectoredExceptionHandler(1, ExceptionHandler
);
318 sCurrentExceptionHandle
= handle
;
321 static void uninstallExceptionOrSignalHandlers() {
322 PVOID currentHandle
= const_cast<PVOID
>(sCurrentExceptionHandle
);
324 // Now we can remove the vectored exception handler from the chain
325 ::RemoveVectoredExceptionHandler(currentHandle
);
327 // Reset the handle in our thread-local set.
328 sCurrentExceptionHandle
= NULL
;
334 // Generic POSIX implementation.
336 // This implementation relies on synchronous signals being delivered to the
337 // current thread. We use a thread local object to keep track of the active
338 // crash recovery context, and install signal handlers to invoke HandleCrash on
339 // the active object.
341 // This implementation does not attempt to chain signal handlers in any
342 // reliable fashion -- if we get a signal outside of a crash recovery context we
343 // simply disable crash recovery and raise the signal again.
347 static const int Signals
[] =
348 { SIGABRT
, SIGBUS
, SIGFPE
, SIGILL
, SIGSEGV
, SIGTRAP
};
349 static const unsigned NumSignals
= std::size(Signals
);
350 static struct sigaction PrevActions
[NumSignals
];
352 static void CrashRecoverySignalHandler(int Signal
) {
353 // Lookup the current thread local recovery object.
354 const CrashRecoveryContextImpl
*CRCI
= CurrentContext
;
357 // We didn't find a crash recovery context -- this means either we got a
358 // signal on a thread we didn't expect it on, the application got a signal
359 // outside of a crash recovery context, or something else went horribly
362 // Disable crash recovery and raise the signal again. The assumption here is
363 // that the enclosing application will terminate soon, and we won't want to
364 // attempt crash recovery again.
366 // This call of Disable isn't thread safe, but it doesn't actually matter.
367 CrashRecoveryContext::Disable();
370 // The signal will be thrown once the signal mask is restored.
374 // Unblock the signal we received.
376 sigemptyset(&SigMask
);
377 sigaddset(&SigMask
, Signal
);
378 sigprocmask(SIG_UNBLOCK
, &SigMask
, nullptr);
380 // Return the same error code as if the program crashed, as mentioned in the
381 // section "Exit Status for Commands":
382 // https://pubs.opengroup.org/onlinepubs/9699919799/xrat/V4_xcu_chap02.html
383 int RetCode
= 128 + Signal
;
385 // Don't consider a broken pipe as a crash (see clang/lib/Driver/Driver.cpp)
386 if (Signal
== SIGPIPE
)
390 const_cast<CrashRecoveryContextImpl
*>(CRCI
)->HandleCrash(RetCode
, Signal
);
393 static void installExceptionOrSignalHandlers() {
394 // Setup the signal handler.
395 struct sigaction Handler
;
396 Handler
.sa_handler
= CrashRecoverySignalHandler
;
397 Handler
.sa_flags
= 0;
398 sigemptyset(&Handler
.sa_mask
);
400 for (unsigned i
= 0; i
!= NumSignals
; ++i
) {
401 sigaction(Signals
[i
], &Handler
, &PrevActions
[i
]);
405 static void uninstallExceptionOrSignalHandlers() {
406 // Restore the previous signal handlers.
407 for (unsigned i
= 0; i
!= NumSignals
; ++i
)
408 sigaction(Signals
[i
], &PrevActions
[i
], nullptr);
413 bool CrashRecoveryContext::RunSafely(function_ref
<void()> Fn
) {
414 // If crash recovery is disabled, do nothing.
415 if (gCrashRecoveryEnabled
) {
416 assert(!Impl
&& "Crash recovery context already initialized!");
417 CrashRecoveryContextImpl
*CRCI
= new CrashRecoveryContextImpl(this);
420 CRCI
->ValidJumpBuffer
= true;
421 if (setjmp(CRCI
->JumpBuffer
) != 0) {
432 [[noreturn
]] void CrashRecoveryContext::HandleExit(int RetCode
) {
434 // Since the exception code is actually of NTSTATUS type, we use the
435 // Microsoft-recommended 0xE prefix, to signify that this is a user error.
436 // This value is a combination of the customer field (bit 29) and severity
437 // field (bits 30-31) in the NTSTATUS specification.
438 ::RaiseException(0xE0000000 | RetCode
, 0, 0, NULL
);
440 // On Unix we don't need to raise an exception, we go directly to
441 // HandleCrash(), then longjmp will unwind the stack for us.
442 CrashRecoveryContextImpl
*CRCI
= (CrashRecoveryContextImpl
*)Impl
;
443 assert(CRCI
&& "Crash recovery context never initialized!");
444 CRCI
->HandleCrash(RetCode
, 0 /*no sig num*/);
446 llvm_unreachable("Most likely setjmp wasn't called!");
449 bool CrashRecoveryContext::isCrash(int RetCode
) {
451 // On Windows, the code is interpreted as NTSTATUS. The two high bits
452 // represent the severity. Values starting with 0x80000000 are reserved for
453 // "warnings"; values of 0xC0000000 and up are for "errors". In practice, both
454 // are interpreted as a non-continuable signal.
455 unsigned Code
= ((unsigned)RetCode
& 0xF0000000) >> 28;
456 if (Code
!= 0xC && Code
!= 8)
459 // On Unix, signals are represented by return codes of 128 or higher.
460 // Exit code 128 is a reserved value and should not be raised as a signal.
467 bool CrashRecoveryContext::throwIfCrash(int RetCode
) {
468 if (!isCrash(RetCode
))
471 ::RaiseException(RetCode
, 0, 0, NULL
);
473 llvm::sys::unregisterHandlers();
474 raise(RetCode
- 128);
479 // FIXME: Portability.
480 static void setThreadBackgroundPriority() {
482 setpriority(PRIO_DARWIN_THREAD
, 0, PRIO_DARWIN_BG
);
486 static bool hasThreadBackgroundPriority() {
488 return getpriority(PRIO_DARWIN_THREAD
, 0) == 1;
495 struct RunSafelyOnThreadInfo
{
496 function_ref
<void()> Fn
;
497 CrashRecoveryContext
*CRC
;
498 bool UseBackgroundPriority
;
503 static void RunSafelyOnThread_Dispatch(void *UserData
) {
504 RunSafelyOnThreadInfo
*Info
=
505 reinterpret_cast<RunSafelyOnThreadInfo
*>(UserData
);
507 if (Info
->UseBackgroundPriority
)
508 setThreadBackgroundPriority();
510 Info
->Result
= Info
->CRC
->RunSafely(Info
->Fn
);
512 bool CrashRecoveryContext::RunSafelyOnThread(function_ref
<void()> Fn
,
513 unsigned RequestedStackSize
) {
514 bool UseBackgroundPriority
= hasThreadBackgroundPriority();
515 RunSafelyOnThreadInfo Info
= { Fn
, this, UseBackgroundPriority
, false };
516 llvm::thread
Thread(RequestedStackSize
== 0
518 : std::optional
<unsigned>(RequestedStackSize
),
519 RunSafelyOnThread_Dispatch
, &Info
);
522 if (CrashRecoveryContextImpl
*CRC
= (CrashRecoveryContextImpl
*)Impl
)
523 CRC
->setSwitchedThread();