1 // Copyright 2019 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #ifndef BASE_IMMEDIATE_CRASH_H_
6 #define BASE_IMMEDIATE_CRASH_H_
7
8 #include "base/fuzzing_buildflags.h"
9 #include "build/build_config.h"
10
11 #if BUILDFLAG(USE_FUZZING_ENGINE)
12 #include <stdlib.h>
13 #endif // BUILDFLAG(USE_FUZZING_ENGINE)
14
15 // Crashes in the fastest possible way with no attempt at logging.
16 // There are several constraints; see http://crbug.com/664209 for more context.
17 //
18 // - TRAP_SEQUENCE_() must be fatal. It should not be possible to ignore the
19 // resulting exception or simply hit 'continue' to skip over it in a debugger.
20 // - Different instances of TRAP_SEQUENCE_() must not be folded together, to
21 // ensure crash reports are debuggable. Unlike __builtin_trap(), asm volatile
22 // blocks will not be folded together.
23 // Note: TRAP_SEQUENCE_() previously required an instruction with a unique
24 // nonce since unlike clang, GCC folds together identical asm volatile
25 // blocks.
26 // - TRAP_SEQUENCE_() must produce a signal that is distinct from an invalid
27 // memory access.
28 // - TRAP_SEQUENCE_() must be treated as a set of noreturn instructions.
29 // __builtin_unreachable() is used to provide that hint here. clang also uses
30 // this as a heuristic to pack the instructions in the function epilogue to
31 // improve code density.
32 // - base::ImmediateCrash() is used in allocation hooks. To prevent recursions,
33 // TRAP_SEQUENCE_() must not allocate.
34 //
35 // Additional properties that are nice to have:
36 // - TRAP_SEQUENCE_() should be as compact as possible.
37 // - The first instruction of TRAP_SEQUENCE_() should not change, to avoid
38 // shifting crash reporting clusters. As a consequence of this, explicit
39 // assembly is preferred over intrinsics.
40 // Note: this last bullet point may no longer be true, and may be removed in
41 // the future.
42
43 // Note: TRAP_SEQUENCE Is currently split into two macro helpers due to the fact
44 // that clang emits an actual instruction for __builtin_unreachable() on certain
45 // platforms (see https://crbug.com/958675). In addition, the int3/bkpt/brk will
46 // be removed in followups, so splitting it up like this now makes it easy to
47 // land the followups.
48
49 #if defined(COMPILER_GCC)
50
51 #if BUILDFLAG(IS_NACL)
52
53 // Crash report accuracy is not guaranteed on NaCl.
54 #define TRAP_SEQUENCE1_() __builtin_trap()
55 #define TRAP_SEQUENCE2_() asm volatile("")
56
57 #elif defined(ARCH_CPU_X86_FAMILY)
58
59 // TODO(https://crbug.com/958675): In theory, it should be possible to use just
60 // int3. However, there are a number of crashes with SIGILL as the exception
61 // code, so it seems likely that there's a signal handler that allows execution
62 // to continue after SIGTRAP.
63 #define TRAP_SEQUENCE1_() asm volatile("int3")
64
65 #if BUILDFLAG(IS_APPLE)
66 // Intentionally empty: __builtin_unreachable() is always part of the sequence
67 // (see IMMEDIATE_CRASH below) and already emits a ud2 on Mac.
68 #define TRAP_SEQUENCE2_() asm volatile("")
69 #else
70 #define TRAP_SEQUENCE2_() asm volatile("ud2")
71 #endif // BUILDFLAG(IS_APPLE)
72
73 #elif defined(ARCH_CPU_ARMEL)
74
75 // bkpt will generate a SIGBUS when running on armv7 and a SIGTRAP when running
76 // as a 32 bit userspace app on arm64. There doesn't seem to be any way to
77 // cause a SIGTRAP from userspace without using a syscall (which would be a
78 // problem for sandboxing).
79 // TODO(https://crbug.com/958675): Remove bkpt from this sequence.
80 #define TRAP_SEQUENCE1_() asm volatile("bkpt #0")
81 #define TRAP_SEQUENCE2_() asm volatile("udf #0")
82
83 #elif defined(ARCH_CPU_ARM64)
84
85 // This will always generate a SIGTRAP on arm64.
86 // TODO(https://crbug.com/958675): Remove brk from this sequence.
87 #define TRAP_SEQUENCE1_() asm volatile("brk #0")
88 #define TRAP_SEQUENCE2_() asm volatile("hlt #0")
89
90 #else
91
92 // Crash report accuracy will not be guaranteed on other architectures, but at
93 // least this will crash as expected.
94 #define TRAP_SEQUENCE1_() __builtin_trap()
95 #define TRAP_SEQUENCE2_() asm volatile("")
96
97 #endif // ARCH_CPU_*
98
99 #elif defined(COMPILER_MSVC)
100
101 #if !defined(__clang__)
102
103 // MSVC x64 doesn't support inline asm, so use the MSVC intrinsic.
104 #define TRAP_SEQUENCE1_() __debugbreak()
105 #define TRAP_SEQUENCE2_()
106
107 #elif defined(ARCH_CPU_ARM64)
108
109 // Windows ARM64 uses "BRK #F000" as its breakpoint instruction, and
110 // __debugbreak() generates that in both VC++ and clang.
111 #define TRAP_SEQUENCE1_() __debugbreak()
112 // Intentionally empty: __builtin_unreachable() is always part of the sequence
113 // (see IMMEDIATE_CRASH below) and already emits a ud2 on Win64,
114 // https://crbug.com/958373
115 #define TRAP_SEQUENCE2_() __asm volatile("")
116
117 #else
118
119 #define TRAP_SEQUENCE1_() asm volatile("int3")
120 #define TRAP_SEQUENCE2_() asm volatile("ud2")
121
122 #endif // __clang__
123
124 #else
125
126 #error No supported trap sequence!
127
128 #endif // COMPILER_GCC
129
130 #define TRAP_SEQUENCE_() \
131 do { \
132 TRAP_SEQUENCE1_(); \
133 TRAP_SEQUENCE2_(); \
134 } while (false)
135
136 // This version of ALWAYS_INLINE inlines even in is_debug=true.
137 // TODO(pbos): See if NDEBUG can be dropped from ALWAYS_INLINE as well, and if
138 // so merge. Otherwise document why it cannot inline in debug in
139 // base/compiler_specific.h.
140 #if defined(COMPILER_GCC)
141 #define IMMEDIATE_CRASH_ALWAYS_INLINE inline __attribute__((__always_inline__))
142 #elif defined(COMPILER_MSVC)
143 #define IMMEDIATE_CRASH_ALWAYS_INLINE __forceinline
144 #else
145 #define IMMEDIATE_CRASH_ALWAYS_INLINE inline
146 #endif
147
148 namespace base {
149
ImmediateCrash()150 [[noreturn]] IMMEDIATE_CRASH_ALWAYS_INLINE void ImmediateCrash() {
151 #if BUILDFLAG(USE_FUZZING_ENGINE)
152 // If fuzzing, exit in such a way that atexit() handlers are run in order
153 // to write out coverage information or failing fuzz cases. This is similar
154 // behavior to __sanitizer::Die
155 exit(-1);
156 #else // BUILDFLAG(USE_FUZZING_ENGINE)
157 TRAP_SEQUENCE_();
158 #endif // BUILDFLAG(USE_FUZZING_ENGINE)
159 #if defined(__clang__) || defined(COMPILER_GCC)
160 __builtin_unreachable();
161 #endif // defined(__clang__) || defined(COMPILER_GCC)
162 }
163
164 } // namespace base
165
166 #endif // BASE_IMMEDIATE_CRASH_H_
167