Skip to content

Commit

Permalink
rustc: Use custom personality functions on MSVC
Browse files Browse the repository at this point in the history
Exception handling on MSVC for Rust has at this point a long and storied
history to it. We currently use the exception mechanisms on MSVC to implement
panics in Rust. On MSVC both 32 and 64-bit exceptions are based on SEH,
structured exception handling. LLVM long ago added special instructions for
MSVC, and we've been using those for as long as MSVC panics have been
implemented!

Exception handling at the system layer is typically guided by "personality
functions" which are in theory intended to be language specific and allow
programming languages to implement custom logic. Since the beginning, however,
LLVM has had a hardcoded list of "known personalities" as they behave quite
differently. As a result, Rust has historically shoehorned our desired panic
behavior into preexisting personality functions defined on MSVC.

Originally Rust actually used the functions `__C_specific_handler` (64-bit) and
`_except_handler3` (32-bit). Using these personalities was relatively easy in
Rust and only required a "filter function" on our "catch" equivalent to only
catch Rust exceptions. Unfortunately these personalities suffered two
[fatal][f1] [flaws][f2], which caused us to subsequently [switch] to the
`__CxxFrameHandler3` personality.

This personality is intended for C++, but we're mostly like C++ in any case so
it worked quite well for a long time! The default C++ personality didn't run
cleanups on faults and LLVM optimized invokes of nounwind functions well. The
only downside at this point was that the support was [sort of scary][scary].

Fast forward to the 1.24.0 release and another [fatal flaw][f3] is found in our
strategy. Historically we've always declared "unwinding into Rust code from
other languages is undefined behavior" (or unwinding out of Rust code). In
1.24.0 we changed `extern` functions defined in Rust to enforce this behavior,
forcibly aborting the process if the function panics. Everything was ship shape
until it was discovered that `longjmp` across Rust frames caused the process to
abort!

It turns out that on MSVC `longjmp` is implemented with SEH! Furthermore it
turns out that the personality we're using, `__CxxFrameHandler3`, recognized the
`longjmp` exception enough to run cleanups. Consequently, when SEH ran past an
`extern` function in Rust it aborted the process. Sounds like "cleanups run on
segfaults" v2!

Well in any case, that's a long-winded way of describing how shoehorning Rust's
desired behavior into existing personality functions is getting more and more
difficult. As a result, this commit starts taking a new strategy of defining
custom personality functions in Rust (like we do for all other platforms) and
teaching LLVM about these personalities so they're classified correctly and
don't suffer from [old bugs][f2].

Alright, so with all that information in your head now this commit can be
described with:

* New personality functions are added for MSVC: `rust_seh{32,64}_personality`.
* These functions are shims around `__C_specific_handler` and `_except_handler3`
  like how on Unix we're typically a shim around a gcc personality.
* Rust's personality functions defer on all exceptions that *aren't*
  Rust-related. We choose an arbitrary code to represent a Rust exception and
  only exceptions with matching codes execute our cleanups/catches. (the
  prevents [previous bugs][f1] with the personalities these functions are
  wrapping).
* LLVM is updated with a small-ish commit to learn about these personality
  functions. The largest change here is, again, [ensuring old bugs don't
  resurface][f2] by teaching LLVM that it can simplify invokes of nounwind
  functions in Rust.
* Finally, bedbad6 is partially reverted to restore the old translation
  behavior of the `try` intrinsic, bringing some scary code back into the
  compiler about `llvm.localescape` and such.

Overall the intent of this commit is to preserve all existing behavior with
panics on MSVC (aka keep old bugs closed and use the same system in general) but
enable longjmps across Rust code. To this effect a test is checked in which
asserts that we can indeed longjmp across Rust code with destructors and such.

[f1]: rust-lang#33112
[f2]: rust-lang#33116
[switch]: rust-lang@38e6e5d0
[scary]: https://github.com/rust-lang/rust/blob/bedbad61195d2eae69b43eca49c6d3e2aee8f208/src/libpanic_unwind/seh.rs#L107-L294
[f3]: rust-lang#48251
  • Loading branch information
alexcrichton committed Feb 27, 2018
1 parent 322d7f7 commit 1613fe2
Show file tree
Hide file tree
Showing 15 changed files with 667 additions and 303 deletions.
2 changes: 1 addition & 1 deletion .gitmodules
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[submodule "src/llvm"]
path = src/llvm
url = https://github.com/rust-lang/llvm.git
url = https://github.com/alexcrichton/llvm.git
branch = master
[submodule "src/jemalloc"]
path = src/jemalloc
Expand Down
4 changes: 2 additions & 2 deletions src/libcore/panicking.rs
Original file line number Diff line number Diff line change
Expand Up @@ -65,8 +65,8 @@ pub fn panic_fmt(fmt: fmt::Arguments, file_line_col: &(&'static str, u32, u32))
extern {
#[lang = "panic_fmt"]
#[unwind]
fn panic_impl(fmt: fmt::Arguments, file: &'static str, line: u32, col: u32) -> !;
fn rust_begin_unwind(fmt: fmt::Arguments, file: &'static str, line: u32, col: u32) -> !;
}
let (file, line, col) = *file_line_col;
unsafe { panic_impl(fmt, file, line, col) }
unsafe { rust_begin_unwind(fmt, file, line, col) }
}
28 changes: 22 additions & 6 deletions src/libpanic_abort/lib.rs
Original file line number Diff line number Diff line change
Expand Up @@ -98,17 +98,33 @@ pub unsafe extern fn __rust_start_panic(_data: usize, _vtable: usize) -> u32 {
// runtime at all.
pub mod personalities {
#[no_mangle]
#[cfg(not(all(target_os = "windows",
target_env = "gnu",
target_arch = "x86_64")))]
#[cfg(not(all(
target_os = "windows",
any(
target_env = "msvc",
all(target_env = "gnu", target_arch = "x86_64")
)
)))]
pub extern fn rust_eh_personality() {}

// On x86_64-pc-windows-gnu we use our own personality function that needs
// to return `ExceptionContinueSearch` as we're passing on all our frames.
#[no_mangle]
#[cfg(all(target_os = "windows",
target_env = "gnu",
target_arch = "x86_64"))]
#[cfg(all(
target_os = "windows",
any(
target_env = "msvc",
all(target_env = "gnu", target_arch = "x86_64")
)
))]
#[cfg_attr(
all(target_env = "msvc", target_arch = "x86"),
export_name = "rust_seh32_personality"
)]
#[cfg_attr(
all(target_env = "msvc", target_arch = "x86_64"),
export_name = "rust_seh64_personality"
)]
pub extern fn rust_eh_personality(_record: usize,
_frame: usize,
_context: usize,
Expand Down
7 changes: 6 additions & 1 deletion src/libpanic_unwind/lib.rs
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,12 @@ use core::raw;
pub use imp::eh_frame_registry::*;

// *-pc-windows-msvc
#[cfg(target_env = "msvc")]
#[cfg(all(target_env = "msvc", stage0))]
#[path = "seh_stage0.rs"]
mod imp;

// *-pc-windows-msvc
#[cfg(all(target_env = "msvc", not(stage0)))]
#[path = "seh.rs"]
mod imp;

Expand Down
Loading

0 comments on commit 1613fe2

Please sign in to comment.