Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RUST_BACKTRACE on macOS can trigger crashes #71397

Closed
jdm opened this issue Apr 21, 2020 · 10 comments · Fixed by #71577
Closed

RUST_BACKTRACE on macOS can trigger crashes #71397

jdm opened this issue Apr 21, 2020 · 10 comments · Fixed by #71577
Labels
A-runtime Area: std's runtime and "pre-main" init for handling backtraces, unwinds, stack overflows C-bug Category: This is a bug. O-macos Operating system: macOS regression-from-stable-to-nightly Performance or correctness regression from stable to nightly. T-libs-api Relevant to the library API team, which will review and decide on the PR/issue.

Comments

@jdm
Copy link
Contributor

jdm commented Apr 21, 2020

I'm running macOS 10.15.3. Starting in the 3/26 nightly, running applications and tests that panic with RUST_BACKTRACE=1 frequently results in a segfault:

joshmatthews@joshmatthews-fcmd6r neovide % RUST_BACKTRACE=1 cargo run
warning: unreachable expression
   --> src/window.rs:150:9
    |
149 |   panic!();
    |   --------- any code following this expression is unreachable
150 | /         if self.ignore_text_input {
151 | |             self.ignore_text_input = false;
152 | |         } else {
153 | |             let text = if text == "<" {
...   |
158 | |             BRIDGE.queue_command(UiCommand::Keyboard(text))
159 | |         }
    | |_________^ unreachable expression
    |
    = note: `#[warn(unreachable_code)]` on by default

    Finished dev [unoptimized + debuginfo] target(s) in 0.21s
     Running `target/debug/neovide`
thread 'main' panicked at 'explicit panic', src/window.rs:149:1
stack backtrace:
zsh: segmentation fault  RUST_BACKTRACE=1 cargo run

The backtrace from this shows libbacktrace:

thread 'main' panicked at 'explicit panic', src/window.rs:149:1
stack backtrace:
Process 9595 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x740)
    frame #0: 0x0000000100a569b3 neovide`__rdos_macho_add + 2163
neovide`__rdos_macho_add:
->  0x100a569b3 <+2163>: movq   (%rcx), %rcx
    0x100a569b6 <+2166>: testq  %rcx, %rcx
    0x100a569b9 <+2169>: jne    0x100a569b0               ; <+2160>
    0x100a569bb <+2171>: movq   %r14, (%rax)
Target 0: (neovide) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x740)
  * frame #0: 0x0000000100a569b3 neovide`__rdos_macho_add + 2163
    frame #1: 0x0000000100a56046 neovide`__rdos_backtrace_initialize + 278
    frame #2: 0x0000000100a553d2 neovide`fileline_initialize + 450
    frame #3: 0x0000000100a55498 neovide`__rdos_backtrace_syminfo + 40
    frame #4: 0x0000000100a47737 neovide`backtrace::symbolize::libbacktrace::resolve::h7f9f0ba72481fbad at libbacktrace.rs:469:9 [opt]
    frame #5: 0x0000000100a3d4ee neovide`std::sys_common::backtrace::_print_fmt::_$u7b$$u7b$closure$u7d$$u7d$::h1788fc7cbd879752 [inlined] backtrace::symbolize::resolve_frame_unsynchronized::h61c7548d2ef51055 at mod.rs:178:5 [opt]
    frame #6: 0x0000000100a3d4d9 neovide`std::sys_common::backtrace::_print_fmt::_$u7b$$u7b$closure$u7d$$u7d$::h1788fc7cbd879752 at backtrace.rs:85 [opt]
    frame #7: 0x0000000100a473c3 neovide`backtrace::backtrace::libunwind::trace::trace_fn::h839531a54973d0a3 [inlined] core::ops::function::impls::_$LT$impl$u20$core..ops..function..FnMut$LT$A$GT$$u20$for$u20$$RF$mut$u20$F$GT$::call_mut::h25035912fcd7ea4d at function.rs:274:13 [opt]
    frame #8: 0x0000000100a473b5 neovide`backtrace::backtrace::libunwind::trace::trace_fn::h839531a54973d0a3 at libunwind.rs:98 [opt]
    frame #9: 0x00007fff6971d196 libunwind.dylib`_Unwind_Backtrace + 78
    frame #10: 0x0000000100a3ce5f neovide`_$LT$std..sys_common..backtrace.._print..DisplayBacktrace$u20$as$u20$core..fmt..Display$GT$::fmt::h427013014b44f9a8 [inlined] backtrace::backtrace::libunwind::trace::h28d4037cad4f389e at libunwind.rs:86:5 [opt]
    frame #11: 0x0000000100a3ce4c neovide`_$LT$std..sys_common..backtrace.._print..DisplayBacktrace$u20$as$u20$core..fmt..Display$GT$::fmt::h427013014b44f9a8 [inlined] backtrace::backtrace::trace_unsynchronized::hd54fd38f7fdb5696 at mod.rs:66 [opt]
    frame #12: 0x0000000100a3ce4c neovide`_$LT$std..sys_common..backtrace.._print..DisplayBacktrace$u20$as$u20$core..fmt..Display$GT$::fmt::h427013014b44f9a8 [inlined] std::sys_common::backtrace::_print_fmt::hb47266356b9734d1 at backtrace.rs:78 [opt]
    frame #13: 0x0000000100a3cd40 neovide`_$LT$std..sys_common..backtrace.._print..DisplayBacktrace$u20$as$u20$core..fmt..Display$GT$::fmt::h427013014b44f9a8 at backtrace.rs:59 [opt]
    frame #14: 0x0000000100a64f1e neovide`core::fmt::write::h27b2640c546226f6 at mod.rs:1069:17 [opt]
    frame #15: 0x0000000100a39a57 neovide`std::io::Write::write_fmt::he5892bc9871e1e5f at mod.rs:1439:15 [opt]
    frame #16: 0x0000000100a3ef0a neovide`std::panicking::default_hook::_$u7b$$u7b$closure$u7d$$u7d$::h3b089677c4f8d745 [inlined] std::sys_common::backtrace::_print::hf45c79eb5391485c at backtrace.rs:62:5 [opt]
    frame #17: 0x0000000100a3eeb9 neovide`std::panicking::default_hook::_$u7b$$u7b$closure$u7d$$u7d$::h3b089677c4f8d745 [inlined] std::sys_common::backtrace::print::h43196d14250d00b9 at backtrace.rs:49 [opt]
    frame #18: 0x0000000100a3eead neovide`std::panicking::default_hook::_$u7b$$u7b$closure$u7d$$u7d$::h3b089677c4f8d745 at panicking.rs:198 [opt]
    frame #19: 0x0000000100a3ec4c neovide`std::panicking::default_hook::hcfb648533dd347e2 at panicking.rs:218:9 [opt]
    frame #20: 0x0000000100a3f4d8 neovide`std::panicking::rust_panic_with_hook::hb95563f6bbfa7e96 at panicking.rs:511:17 [opt]
    frame #21: 0x0000000100a6f756 neovide`std::panicking::begin_panic::h4d337183d183fa38(msg=(data_ptr = "explicit panicCould not calculate logical mouse positionpressreleaseuprightno_idleRender failed. ClosingStarting window event loopCould not create sdl event pumprefresh_rate", length = 14)) at panicking.rs:438:5
    frame #22: 0x00000001000716e8 neovide`neovide::window::WindowWrapper::handle_text_input::h753c24ebed39fa77(self=0x00007ffeefbfd838, text=String @ 0x00007ffeefbff728) at window.rs:149:1
    frame #23: 0x00000001000726ba neovide`neovide::window::ui_loop::h321839a92b1801d3 at window.rs:270:50
    frame #24: 0x00000001000c3ae5 neovide`neovide::main::h6353e38135ac2e41 at main.rs:24:5
    frame #25: 0x00000001000decae neovide`std::rt::lang_start::_$u7b$$u7b$closure$u7d$$u7d$::heda059d8c2ddf031 at rt.rs:67:34
    frame #26: 0x0000000100a3f839 neovide`std::rt::lang_start_internal::h80bdaa9ee12e5134 [inlined] std::rt::lang_start_internal::_$u7b$$u7b$closure$u7d$$u7d$::h8c31ec7a8b13107a at rt.rs:52:13 [opt]
    frame #27: 0x0000000100a3f82e neovide`std::rt::lang_start_internal::h80bdaa9ee12e5134 [inlined] std::panicking::try::do_call::h7c5c3835f900e8bd at panicking.rs:331 [opt]
    frame #28: 0x0000000100a3f82e neovide`std::rt::lang_start_internal::h80bdaa9ee12e5134 [inlined] std::panicking::try::hfc986d95955e33bd at panicking.rs:274 [opt]
    frame #29: 0x0000000100a3f82e neovide`std::rt::lang_start_internal::h80bdaa9ee12e5134 [inlined] std::panic::catch_unwind::h021461f3fbd332fb at panic.rs:394 [opt]
    frame #30: 0x0000000100a3f82e neovide`std::rt::lang_start_internal::h80bdaa9ee12e5134 at rt.rs:51 [opt]
    frame #31: 0x00000001000dec91 neovide`std::rt::lang_start::h1e9a4c075cc2b5d2(main=(neovide`neovide::main::h6353e38135ac2e41 at main.rs:22), argc=1, argv=0x00007ffeefbff8f8) at rt.rs:67:5
    frame #32: 0x00000001000c3b12 neovide`main + 34
    frame #33: 0x00007fff694e67fd libdyld.dylib`start + 1
    frame #34: 0x00007fff694e67fd libdyld.dylib`start + 1

Since 64a8c8a#diff-1a7024d46c31d728a04d5e0cafd98df8 merged as part of #70383 which merged on March 25, there's a pretty clear candidate for the regression.

@jdm jdm added regression-from-stable-to-nightly Performance or correctness regression from stable to nightly. C-bug Category: This is a bug. labels Apr 21, 2020
@jdm
Copy link
Contributor Author

jdm commented Apr 21, 2020

I found this as part of Servo's unit test suite, which now has intermittent segfaults in #[should_panic] tests on CI with nightlies since 3/26. I've also reproduced this by adding a panic!() in https://github.com/Kethku/neovide/blob/56cc29d47ccbff7cf823a738b3f7f4a31e8af26d/src/window.rs#L150, but I haven't yet been able to create a standalone unit test that demonstrates the issue.

@jdm
Copy link
Contributor Author

jdm commented Apr 21, 2020

It looks like the code that is crashing was introduced as part of rust-lang/libbacktrace@4e548e7, which was brought in as part of the submodule update in rust-lang/backtrace-rs@703aeee.

@jonas-schievink jonas-schievink added A-runtime Area: std's runtime and "pre-main" init for handling backtraces, unwinds, stack overflows O-macos Operating system: macOS T-libs-api Relevant to the library API team, which will review and decide on the PR/issue. E-needs-bisection Call for participation: This issue needs bisection: https://github.com/rust-lang/cargo-bisect-rustc and removed E-needs-bisection Call for participation: This issue needs bisection: https://github.com/rust-lang/cargo-bisect-rustc labels Apr 21, 2020
@jdm
Copy link
Contributor Author

jdm commented Apr 21, 2020

Here's a standalone testcase that reproduces the problem for me:
Cargo.toml:

[package]
name = "panic_test"
version = "0.1.0"
authors = ["Josh Matthews <[email protected]>"]
edition = "2018"

[dependencies]
core-graphics = "*"

main.rs:

fn main() {
    let a = core_graphics::color::CGColor::rgb(0., 0., 0., 0.);
    panic!()
}

@jdm
Copy link
Contributor Author

jdm commented Apr 21, 2020

I have a suspicion that my testcase only works because of #56068 right now.

@Amanieu
Copy link
Member

Amanieu commented Apr 23, 2020

Can you open an issue on backtrace-rs?

@jdm
Copy link
Contributor Author

jdm commented Apr 23, 2020

Filed rust-lang/backtrace-rs#312.

@jdm
Copy link
Contributor Author

jdm commented Apr 23, 2020

rust-lang/backtrace-rs#312 (comment) reports that pulling in an updated backtrace-rs to rustc should fix this.

Thomasdezeeuw added a commit to Thomasdezeeuw/stored that referenced this issue Apr 28, 2020
Caused by a problem in libbacktrace first reported to rust repo in
rust-lang/rust#71397, than to backtrac-rs in
rust-lang/backtrace-rs#312, fixed in
backtrace-rs here:
rust-lang/backtrace-rs@b53c52b.

Update of backtrace-rs for rustc is here:
rust-lang/rust#71577, no yet merged.
@bors bors closed this as completed in d9312a8 Apr 29, 2020
@pepyakin
Copy link
Contributor

I think I am getting this on a stable rustc 1.44.0 (49cae55 2020-06-01) on macOS 10.15.5.
Initially, I caught a segfault for a test code that panics.

running 2 tests
test tests::result_should_serialize_deserialize_properly ... ok
error: test failed, to rerun pass '-p pallet-contracts-rpc --lib'

Caused by:
  process didn't exit successfully: `/Users/pepyakin/dev/parity/substrate/target/debug/deps/pallet_contracts_rpc-d3910674823302e5` (signal: 11, SIGSEGV: invalid memory reference)

when I tried to launch the same code under lldd it panicked properly (I tried a dozen of times). Then, another test run has led to a stall. /usr/bin/sample for the process showed this:

Sampling process 35504 for 3 seconds with 1 millisecond of run time between samples
Sampling completed, processing symbols...
Analysis of sampling pallet_contracts_rpc-d3910674823302e5 (pid 35504) every 1 millisecond
Process:         pallet_contracts_rpc-d3910674823302e5 [35504]
Path:            /Users/USER/*/pallet_contracts_rpc-d3910674823302e5
Load Address:    0x10601a000
Identifier:      pallet_contracts_rpc-d3910674823302e5
Version:         0
Code Type:       X86-64
Parent Process:  cargo [35503]

Date/Time:       2020-06-10 14:37:01.469 +0200
Launch Time:     2020-06-10 14:36:40.831 +0200
OS Version:      Mac OS X 10.15.5 (19F96)
Report Version:  7
Analysis Tool:   /usr/bin/sample

Physical footprint:         12.4M
Physical footprint (peak):  12.4M
----

Call graph:
    2798 Thread_1449457   DispatchQueue_1: com.apple.main-thread  (serial)
    + 2798 start  (in libdyld.dylib) + 1  [0x7fff6871dcc9]
    +   2798 main  (in pallet_contracts_rpc-d3910674823302e5) + 34  [0x106022df2]
    +     2798 std::rt::lang_start::h2982339634add2f5  (in pallet_contracts_rpc-d3910674823302e5) + 65  [0x10601ae81]  rt.rs:67
    +       2798 std::rt::lang_start_internal::h1069bf3e81ece2dd  (in pallet_contracts_rpc-d3910674823302e5) + 441  [0x1060a69c9]  rt.rs:51
    +         2798 std::rt::lang_start::_$u7b$$u7b$closure$u7d$$u7d$::h17d40798dcc92eee  (in pallet_contracts_rpc-d3910674823302e5) + 14  [0x10601ae9e]  rt.rs:67
    +           2798 pallet_contracts_rpc::main::h5b73f23169ae7275  (in pallet_contracts_rpc-d3910674823302e5) + 24  [0x106022dc8]
    +             2798 test::test_main_static::h5ec0d2acdadcabb7  (in pallet_contracts_rpc-d3910674823302e5) + 286  [0x10604c5ce]  lib.rs:139
    +               2798 test::test_main::ha0ba06cde89e658c  (in pallet_contracts_rpc-d3910674823302e5) + 298  [0x10604b28a]  lib.rs:120
    +                 2798 test::console::run_tests_console::hb1588804e66cb577  (in pallet_contracts_rpc-d3910674823302e5) + 9643  [0x10603ee5b]  console.rs:280
    +                   2798 std::sync::mpsc::shared::Packet$LT$T$GT$::recv::he5639701e5f48e33  (in pallet_contracts_rpc-d3910674823302e5) + 347  [0x10602e38b]  shared.rs:229
    +                     2798 std::sync::mpsc::blocking::WaitToken::wait_max_until::h4078089a70fd63c5  (in pallet_contracts_rpc-d3910674823302e5) + 286  [0x1060a32be]  blocking.rs:75
    +                       2798 std::thread::park_timeout::h5ad21fe3fd74daf8  (in pallet_contracts_rpc-d3910674823302e5) + 270  [0x10609b4ce]  mod.rs:1014
    +                         2798 std::sys::unix::condvar::Condvar::wait_timeout::h17d79840596d07fd  (in pallet_contracts_rpc-d3910674823302e5) + 249  [0x1060a6f29]  condvar.rs:153
    +                           2798 _pthread_cond_wait  (in libsystem_pthread.dylib) + 698  [0x7fff68922425]
    +                             2798 __psynch_cvwait  (in libsystem_kernel.dylib) + 10  [0x7fff68861882]
    2798 Thread_1449458: tests::call_request_should_serialize_deserialize_properly
      2798 thread_start  (in libsystem_pthread.dylib) + 15  [0x7fff6891db8b]
        2798 _pthread_start  (in libsystem_pthread.dylib) + 148  [0x7fff68922109]
          2798 std::sys::unix::thread::Thread::new::thread_start::h2b28b74d30bce841  (in pallet_contracts_rpc-d3910674823302e5) + 45  [0x1060ac60d]  thread.rs:87
            2798 core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::hd45267100ae6c7ce  (in pallet_contracts_rpc-d3910674823302e5) + 117  [0x1060303a5]  function.rs:232
              2798 std::sys_common::backtrace::__rust_begin_short_backtrace::hffd4a983e423c33e  (in pallet_contracts_rpc-d3910674823302e5) + 43  [0x10602aecb]  backtrace.rs:130
                2798 test::run_test::run_test_inner::_$u7b$$u7b$closure$u7d$$u7d$::hf35455f67ec1e4ed  (in pallet_contracts_rpc-d3910674823302e5) + 819  [0x106050ca3]  lib.rs:450
                  2798 core::ops::function::FnOnce::call_once::h14427d74c038af42  (in pallet_contracts_rpc-d3910674823302e5) + 17  [0x106023511]  function.rs:232
                    2798 pallet_contracts_rpc::tests::call_request_should_serialize_deserialize_properly::_$u7b$$u7b$closure$u7d$$u7d$::h88024b7db0e1a095  (in pallet_contracts_rpc-d3910674823302e5) + 17  [0x106023301]  lib.rs:295
                      2798 pallet_contracts_rpc::tests::call_request_should_serialize_deserialize_properly::h65dce4213e60d6a0  (in pallet_contracts_rpc-d3910674823302e5) + 80  [0x106025f80]  lib.rs:297
                        2798 core::result::Result$LT$T$C$E$GT$::unwrap::h4e51363d6979532e  (in pallet_contracts_rpc-d3910674823302e5) + 102  [0x10602a406]  result.rs:1005
                          2798 core::option::expect_none_failed::h07b7c1add83ba342  (in pallet_contracts_rpc-d3910674823302e5) + 117  [0x1060d2635]  option.rs:1268
                            2798 core::panicking::panic_fmt::h299f54c72477a62a  (in pallet_contracts_rpc-d3910674823302e5) + 47  [0x1060d272f]  panicking.rs:111
                              2798 rust_begin_unwind  (in pallet_contracts_rpc-d3910674823302e5) + 130  [0x1060a6232]  panicking.rs:419
                                2798 std::panicking::rust_panic_with_hook::h2cd47f71d6d55501  (in pallet_contracts_rpc-d3910674823302e5) + 296  [0x1060a6668]  panicking.rs:511
                                  2798 std::panicking::default_hook::h722aa3f5c1c31788  (in pallet_contracts_rpc-d3910674823302e5) + 664  [0x1060a5d78]  panicking.rs:215
                                    2798 std::panicking::default_hook::_$u7b$$u7b$closure$u7d$$u7d$::ha991e4eca34b4afa  (in pallet_contracts_rpc-d3910674823302e5) + 474  [0x1060a609a]  panicking.rs:198
                                      2798 std::io::impls::_$LT$impl$u20$std..io..Write$u20$for$u20$alloc..boxed..Box$LT$W$GT$$GT$::write_fmt::h352c9db3a02449c0  (in pallet_contracts_rpc-d3910674823302e5) + 76  [0x10609e36c]  impls.rs:156
                                        2798 std::io::Write::write_fmt::h53fe50e3fff0275d  (in pallet_contracts_rpc-d3910674823302e5) + 89  [0x10602b9c9]  mod.rs:1504
                                          2798 core::fmt::write::hf81c429634e1f3ed  (in pallet_contracts_rpc-d3910674823302e5) + 510  [0x1060c94ae]  mod.rs:1069
                                            2798 _$LT$std..sys_common..backtrace.._print..DisplayBacktrace$u20$as$u20$core..fmt..Display$GT$::fmt::h83d53b696ac99295  (in pallet_contracts_rpc-d3910674823302e5) + 319  [0x1060a3f9f]  backtrace.rs:59
                                              2798 _Unwind_Backtrace  (in libunwind.dylib) + 78  [0x7fff6895413f]
                                                2798 backtrace::backtrace::libunwind::trace::trace_fn::h10f4b899671fce38  (in pallet_contracts_rpc-d3910674823302e5) + 35  [0x1060add93]  libunwind.rs:98
                                                  2798 std::sys_common::backtrace::_print_fmt::_$u7b$$u7b$closure$u7d$$u7d$::h56579608189a9677  (in pallet_contracts_rpc-d3910674823302e5) + 110  [0x1060a462e]  backtrace.rs:85
                                                    2798 backtrace::symbolize::libbacktrace::resolve::h39ea9ff39d2c28cb  (in pallet_contracts_rpc-d3910674823302e5) + 231  [0x1060ae107]  libbacktrace.rs:469
                                                      2798 __rdos_backtrace_syminfo  (in pallet_contracts_rpc-d3910674823302e5) + 40  [0x1060bbe68]
                                                        2798 fileline_initialize  (in pallet_contracts_rpc-d3910674823302e5) + 450  [0x1060bbda2]
                                                          2798 __rdos_backtrace_initialize  (in pallet_contracts_rpc-d3910674823302e5) + 278  [0x1060bca16]
                                                            2798 __rdos_macho_add  (in pallet_contracts_rpc-d3910674823302e5) + 2166,2160  [0x1060bd386,0x1060bd380]

Total number in stack (recursive counted multiple, when >=5):

Sort by top of stack, same collapsed (when >= 5):
        __psynch_cvwait  (in libsystem_kernel.dylib)        2798
        __rdos_macho_add  (in pallet_contracts_rpc-d3910674823302e5)        2798

which led me to this issue.

@alexcrichton
Copy link
Member

@pepyakin I think the fix for this isn't in 1.44, it should be in 1.45, though. Can you test to see if the issue is fixed on beta?

@pepyakin
Copy link
Contributor

I tried to rebuild and re-run the test and I couldn't reproduce this issue again with beta!

netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this issue Jul 7, 2020
Pkgsrc changes:
 * None.

Upstream changes:

Version 1.44.1 (2020-06-18)
===========================

* [rustfmt accepts rustfmt_skip in cfg_attr again.][73078]
* [Don't hash executable filenames on apple platforms, fixing backtraces.]
  [cargo/8329]
* [Fix crashes when finding backtrace on macOS.][71397]
* [Clippy applies lint levels into different files.][clippy/5356]

[71397]: rust-lang/rust#71397
[73078]: rust-lang/rust#73078
[cargo/8329]: rust-lang/cargo#8329
[clippy/5356]: rust-lang/rust-clippy#5356
alexcrichton added a commit to alexcrichton/rust that referenced this issue Jul 17, 2020
This commit is a proof-of-concept for switching the standard library's
backtrace symbolication mechanism on most platforms from libbacktrace to
gimli. The standard library's support for `RUST_BACKTRACE=1` requires
in-process parsing of object files and DWARF debug information to
interpret it and print the filename/line number of stack frames as part
of a backtrace.

Historically this support in the standard library has come from a
library called "libbacktrace". The libbacktrace library seems to have
been extracted from gcc at some point and is written in C. We've had a
lot of issues with libbacktrace over time, unfortunately, though. The
library does not appear to be actively maintained since we've had
patches sit for months-to-years without comments. We have discovered a
good number of soundness issues with the library itself, both when
parsing valid DWARF as well as invalid DWARF. This is enough of an issue
that the libs team has previously decided that we cannot feed untrusted
inputs to libbacktrace. This also doesn't take into account the
portability of libbacktrace which has been difficult to manage and
maintain over time. While possible there are lots of exceptions and it's
the main C dependency of the standard library right now.

For years it's been the desire to switch over to a Rust-based solution
for symbolicating backtraces. It's been assumed that we'll be using the
Gimli family of crates for this purpose, which are targeted at safely
and efficiently parsing DWARF debug information. I've been working
recently to shore up the Gimli support in the `backtrace` crate. As of a
few weeks ago the `backtrace` crate, by default, uses Gimli when loaded
from crates.io. This transition has gone well enough that I figured it
was time to start talking seriously about this change to the standard
library.

This commit is a preview of what's probably the best way to integrate
the `backtrace` crate into the standard library with the Gimli feature
turned on. While today it's used as a crates.io dependency, this commit
switches the `backtrace` crate to a submodule of this repository which
will need to be updated manually. This is not done lightly, but is
thought to be the best solution. The primary reason for this is that the
`backtrace` crate needs to do some pretty nontrivial filesystem
interactions to locate debug information. Working without `std::fs` is
not an option, and while it might be possible to do some sort of
trait-based solution when prototyped it was found to be too unergonomic.
Using a submodule allows the `backtrace` crate to build as a submodule
of the `std` crate itself, enabling it to use `std::fs` and such.

Otherwise this adds new dependencies to the standard library. This step
requires extra attention because this means that these crates are now
going to be included with all Rust programs by default. It's important
to note, however, that we're already shipping libbacktrace with all Rust
programs by default and it has a bunch of C code implementing all of
this internally anyway, so we're basically already switching
already-shipping functionality to Rust from C.

* `object` - this crate is used to parse object file headers and
  contents. Very low-level support is used from this crate and almost
  all of it is disabled. Largely we're just using struct definitions as
  well as convenience methods internally to read bytes and such.

* `addr2line` - this is the main meat of the implementation for
  symbolication. This crate depends on `gimli` for DWARF parsing and
  then provides interfaces needed by the `backtrace` crate to turn an
  address into a filename / line number. This crate is actually pretty
  small (fits in a single file almost!) and mirrors most of what
  `dwarf.c` does for libbacktrace.

* `miniz_oxide` - the libbacktrace crate transparently handles
  compressed debug information which is compressed with zlib. This crate
  is used to decompress compressed debug sections.

* `gimli` - not actually used directly, but a dependency of `addr2line`.

* `adler32`- not used directly either, but a dependency of
  `miniz_oxide`.

The goal of this change is to improve the safety of backtrace
symbolication in the standard library, especially in the face of
possibly malformed DWARF debug information. Even to this day we're still
seeing segfaults in libbacktrace which could possibly become security
vulnerabilities. This change should almost entirely eliminate this
possibility whilc also paving the way forward to adding more features
like split debug information.

Some references for those interested are:

* Original addition of libbacktrace - rust-lang#12602
* OOM with libbacktrace - rust-lang#24231
* Backtrace failure due to use of uninitialized value - rust-lang#28447
* Possibility to feed untrusted data to libbacktrace - rust-lang#21889
* Soundness fix for libbacktrace - rust-lang#33729
* Crash in libbacktrace - rust-lang#39468
* Support for macOS, never merged - ianlancetaylor/libbacktrace#2
* Performance issues with libbacktrace - rust-lang#29293, rust-lang#37477
* Update procedure is quite complicated due to how many patches we
  need to carry - rust-lang#50955
* Libbacktrace doesn't work on MinGW with dynamic libs - rust-lang#71060
* Segfault in libbacktrace on macOS - rust-lang#71397

Switching to Rust will not make us immune to all of these issues. The
crashes are expected to go away, but correctness and performance may
still have bugs arise. The gimli and `backtrace` crates, however, are
actively maintained unlike libbacktrace, so this should enable us to at
least efficiently apply fixes as situations come up.
bors added a commit to rust-lang-ci/rust that referenced this issue Jul 18, 2020
…Simulacrum

std: Switch from libbacktrace to gimli

This commit is a proof-of-concept for switching the standard library's
backtrace symbolication mechanism on most platforms from libbacktrace to
gimli. The standard library's support for `RUST_BACKTRACE=1` requires
in-process parsing of object files and DWARF debug information to
interpret it and print the filename/line number of stack frames as part
of a backtrace.

Historically this support in the standard library has come from a
library called "libbacktrace". The libbacktrace library seems to have
been extracted from gcc at some point and is written in C. We've had a
lot of issues with libbacktrace over time, unfortunately, though. The
library does not appear to be actively maintained since we've had
patches sit for months-to-years without comments. We have discovered a
good number of soundness issues with the library itself, both when
parsing valid DWARF as well as invalid DWARF. This is enough of an issue
that the libs team has previously decided that we cannot feed untrusted
inputs to libbacktrace. This also doesn't take into account the
portability of libbacktrace which has been difficult to manage and
maintain over time. While possible there are lots of exceptions and it's
the main C dependency of the standard library right now.

For years it's been the desire to switch over to a Rust-based solution
for symbolicating backtraces. It's been assumed that we'll be using the
Gimli family of crates for this purpose, which are targeted at safely
and efficiently parsing DWARF debug information. I've been working
recently to shore up the Gimli support in the `backtrace` crate. As of a
few weeks ago the `backtrace` crate, by default, uses Gimli when loaded
from crates.io. This transition has gone well enough that I figured it
was time to start talking seriously about this change to the standard
library.

This commit is a preview of what's probably the best way to integrate
the `backtrace` crate into the standard library with the Gimli feature
turned on. While today it's used as a crates.io dependency, this commit
switches the `backtrace` crate to a submodule of this repository which
will need to be updated manually. This is not done lightly, but is
thought to be the best solution. The primary reason for this is that the
`backtrace` crate needs to do some pretty nontrivial filesystem
interactions to locate debug information. Working without `std::fs` is
not an option, and while it might be possible to do some sort of
trait-based solution when prototyped it was found to be too unergonomic.
Using a submodule allows the `backtrace` crate to build as a submodule
of the `std` crate itself, enabling it to use `std::fs` and such.

Otherwise this adds new dependencies to the standard library. This step
requires extra attention because this means that these crates are now
going to be included with all Rust programs by default. It's important
to note, however, that we're already shipping libbacktrace with all Rust
programs by default and it has a bunch of C code implementing all of
this internally anyway, so we're basically already switching
already-shipping functionality to Rust from C.

* `object` - this crate is used to parse object file headers and
  contents. Very low-level support is used from this crate and almost
  all of it is disabled. Largely we're just using struct definitions as
  well as convenience methods internally to read bytes and such.

* `addr2line` - this is the main meat of the implementation for
  symbolication. This crate depends on `gimli` for DWARF parsing and
  then provides interfaces needed by the `backtrace` crate to turn an
  address into a filename / line number. This crate is actually pretty
  small (fits in a single file almost!) and mirrors most of what
  `dwarf.c` does for libbacktrace.

* `miniz_oxide` - the libbacktrace crate transparently handles
  compressed debug information which is compressed with zlib. This crate
  is used to decompress compressed debug sections.

* `gimli` - not actually used directly, but a dependency of `addr2line`.

* `adler32`- not used directly either, but a dependency of
  `miniz_oxide`.

The goal of this change is to improve the safety of backtrace
symbolication in the standard library, especially in the face of
possibly malformed DWARF debug information. Even to this day we're still
seeing segfaults in libbacktrace which could possibly become security
vulnerabilities. This change should almost entirely eliminate this
possibility whilc also paving the way forward to adding more features
like split debug information.

Some references for those interested are:

* Original addition of libbacktrace - rust-lang#12602
* OOM with libbacktrace - rust-lang#24231
* Backtrace failure due to use of uninitialized value - rust-lang#28447
* Possibility to feed untrusted data to libbacktrace - rust-lang#21889
* Soundness fix for libbacktrace - rust-lang#33729
* Crash in libbacktrace - rust-lang#39468
* Support for macOS, never merged - ianlancetaylor/libbacktrace#2
* Performance issues with libbacktrace - rust-lang#29293, rust-lang#37477
* Update procedure is quite complicated due to how many patches we
  need to carry - rust-lang#50955
* Libbacktrace doesn't work on MinGW with dynamic libs - rust-lang#71060
* Segfault in libbacktrace on macOS - rust-lang#71397

Switching to Rust will not make us immune to all of these issues. The
crashes are expected to go away, but correctness and performance may
still have bugs arise. The gimli and `backtrace` crates, however, are
actively maintained unlike libbacktrace, so this should enable us to at
least efficiently apply fixes as situations come up.

---

I want to note that my purpose for creating a PR here is to start a conversation about this. I think that all the various pieces are in place that this is compelling enough that I think this transition should be talked about seriously. There are a number of items which still need to be addressed before actually merging this PR, however:

* [ ] `gimli` needs to be published to crates.io
* [ ] `addr2line` needs a publish
* [ ] `miniz_oxide` needs a publish
* [ ] Tests probably shouldn't recommend the `gimli` crate's traits for implementing
* [ ] The `backtrace` crate's branch changes need to be merged to the master branch (rust-lang/backtrace-rs#349)
* [ ] The support for `libbacktrace` on some platforms needs to be audited to see if we should support more strategies in the gimli implementation - rust-lang/backtrace-rs#325, rust-lang/backtrace-rs#326, rust-lang/backtrace-rs#350, rust-lang/backtrace-rs#351

Most of the merging/publishing I'm not actively pushing on right now. It's a bit wonky for crates to support libstd so I'm holding off on pulling the trigger everywhere until there's a bit more discussion about how to go through with this. Namely rust-lang/backtrace-rs#349 I'm going to hold off merging until we decide to go through with the submodule strategy.

In any case this is a pretty major change, so I suspect that the compiler team is likely going to be interested in this. I don't mean to force changes by dumping a bunch of code by any means. Integration of external crates into the standard library is so difficult I wanted to have a proof-of-concept to review while talking about whether to do this at all (hence the PR), but I'm more than happy to follow any processes needed to merge this. I must admit though that I'm not entirely sure myself at this time what the process would be to decide to merge this, so I'm hoping others can help me figure that out!
alexcrichton added a commit to alexcrichton/rust that referenced this issue Jul 28, 2020
This commit is a proof-of-concept for switching the standard library's
backtrace symbolication mechanism on most platforms from libbacktrace to
gimli. The standard library's support for `RUST_BACKTRACE=1` requires
in-process parsing of object files and DWARF debug information to
interpret it and print the filename/line number of stack frames as part
of a backtrace.

Historically this support in the standard library has come from a
library called "libbacktrace". The libbacktrace library seems to have
been extracted from gcc at some point and is written in C. We've had a
lot of issues with libbacktrace over time, unfortunately, though. The
library does not appear to be actively maintained since we've had
patches sit for months-to-years without comments. We have discovered a
good number of soundness issues with the library itself, both when
parsing valid DWARF as well as invalid DWARF. This is enough of an issue
that the libs team has previously decided that we cannot feed untrusted
inputs to libbacktrace. This also doesn't take into account the
portability of libbacktrace which has been difficult to manage and
maintain over time. While possible there are lots of exceptions and it's
the main C dependency of the standard library right now.

For years it's been the desire to switch over to a Rust-based solution
for symbolicating backtraces. It's been assumed that we'll be using the
Gimli family of crates for this purpose, which are targeted at safely
and efficiently parsing DWARF debug information. I've been working
recently to shore up the Gimli support in the `backtrace` crate. As of a
few weeks ago the `backtrace` crate, by default, uses Gimli when loaded
from crates.io. This transition has gone well enough that I figured it
was time to start talking seriously about this change to the standard
library.

This commit is a preview of what's probably the best way to integrate
the `backtrace` crate into the standard library with the Gimli feature
turned on. While today it's used as a crates.io dependency, this commit
switches the `backtrace` crate to a submodule of this repository which
will need to be updated manually. This is not done lightly, but is
thought to be the best solution. The primary reason for this is that the
`backtrace` crate needs to do some pretty nontrivial filesystem
interactions to locate debug information. Working without `std::fs` is
not an option, and while it might be possible to do some sort of
trait-based solution when prototyped it was found to be too unergonomic.
Using a submodule allows the `backtrace` crate to build as a submodule
of the `std` crate itself, enabling it to use `std::fs` and such.

Otherwise this adds new dependencies to the standard library. This step
requires extra attention because this means that these crates are now
going to be included with all Rust programs by default. It's important
to note, however, that we're already shipping libbacktrace with all Rust
programs by default and it has a bunch of C code implementing all of
this internally anyway, so we're basically already switching
already-shipping functionality to Rust from C.

* `object` - this crate is used to parse object file headers and
  contents. Very low-level support is used from this crate and almost
  all of it is disabled. Largely we're just using struct definitions as
  well as convenience methods internally to read bytes and such.

* `addr2line` - this is the main meat of the implementation for
  symbolication. This crate depends on `gimli` for DWARF parsing and
  then provides interfaces needed by the `backtrace` crate to turn an
  address into a filename / line number. This crate is actually pretty
  small (fits in a single file almost!) and mirrors most of what
  `dwarf.c` does for libbacktrace.

* `miniz_oxide` - the libbacktrace crate transparently handles
  compressed debug information which is compressed with zlib. This crate
  is used to decompress compressed debug sections.

* `gimli` - not actually used directly, but a dependency of `addr2line`.

* `adler32`- not used directly either, but a dependency of
  `miniz_oxide`.

The goal of this change is to improve the safety of backtrace
symbolication in the standard library, especially in the face of
possibly malformed DWARF debug information. Even to this day we're still
seeing segfaults in libbacktrace which could possibly become security
vulnerabilities. This change should almost entirely eliminate this
possibility whilc also paving the way forward to adding more features
like split debug information.

Some references for those interested are:

* Original addition of libbacktrace - rust-lang#12602
* OOM with libbacktrace - rust-lang#24231
* Backtrace failure due to use of uninitialized value - rust-lang#28447
* Possibility to feed untrusted data to libbacktrace - rust-lang#21889
* Soundness fix for libbacktrace - rust-lang#33729
* Crash in libbacktrace - rust-lang#39468
* Support for macOS, never merged - ianlancetaylor/libbacktrace#2
* Performance issues with libbacktrace - rust-lang#29293, rust-lang#37477
* Update procedure is quite complicated due to how many patches we
  need to carry - rust-lang#50955
* Libbacktrace doesn't work on MinGW with dynamic libs - rust-lang#71060
* Segfault in libbacktrace on macOS - rust-lang#71397

Switching to Rust will not make us immune to all of these issues. The
crashes are expected to go away, but correctness and performance may
still have bugs arise. The gimli and `backtrace` crates, however, are
actively maintained unlike libbacktrace, so this should enable us to at
least efficiently apply fixes as situations come up.
Thomasdezeeuw added a commit to Thomasdezeeuw/stored that referenced this issue Aug 21, 2020
Rust issue #71397 (rust-lang/rust#71397) has
been resolved.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
A-runtime Area: std's runtime and "pre-main" init for handling backtraces, unwinds, stack overflows C-bug Category: This is a bug. O-macos Operating system: macOS regression-from-stable-to-nightly Performance or correctness regression from stable to nightly. T-libs-api Relevant to the library API team, which will review and decide on the PR/issue.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants