win: Implement and use ScopedProcessSuspend

util/win/scoped_process_suspend.cc

+// Copyright 2015 The Crashpad Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "util/win/scoped_process_suspend.h"
+
+#include <winternl.h>
+
+#include "base/logging.h"
+
+namespace crashpad {
+
+ScopedProcessSuspend::ScopedProcessSuspend(HANDLE process) : process_(process) {
+  typedef NTSTATUS(__stdcall * NtSuspendProcessFunc)(HANDLE);
+  static NtSuspendProcessFunc func = reinterpret_cast<NtSuspendProcessFunc>(
+      GetProcAddress(GetModuleHandle(L"ntdll.dll"), "NtSuspendProcess"));

[Mark Mentovai, 2015/09/04 15:57:50]

What happens if this process suspends a target process and then this process
crashes so that the destructor never runs? Does the target remain suspended, or
does the system associate a suspension with a caller and implicitly resume it if
the caller dies?

OS X implements the latter behavior.

If Windows implements the former, there’s probably not anything that we can do,
although we should at least understand that it’s a limitation of
NtSuspendProcess, document it as a warning on ScopedSuspendProcess, and keep it
in the backs of our minds. Then, in the future, if we’re ever facing a bug where
we have lots of suspended processes and we don’t know why, we can think of this
day and this call and figure out whether Crashpad itself is crashing.

[scottmg, 2015/09/04 22:05:38]

It's a not-too-magic wrapper around Suspend/ResumeThread, and doesn't keep track
of where the suspends/resumes came from. So yes, it's not guaranteed to free up
the suspended process.

+  if (func(process_) != 0)
+    LOG(ERROR) << "NtSuspendProcess failed";

[Mark Mentovai, 2015/09/04 15:57:50]

Will this set GetLastError()? If so, this can be PLOG. Same on line 36.

Also, the string doesn’t need to say “failed”, just the function name is usually
enough (especially with PLOG).

[scottmg, 2015/09/04 22:05:38]

No, they're NTSTATUS returns, not GLE. Added to LOG in case of failure.

+}
+
+ScopedProcessSuspend::~ScopedProcessSuspend() {
+  typedef NTSTATUS(__stdcall * NtResumeProcessFunc)(HANDLE);
+  static NtResumeProcessFunc func = reinterpret_cast<NtResumeProcessFunc>(
+      GetProcAddress(GetModuleHandle(L"ntdll.dll"), "NtResumeProcess"));
+  if (func(process_) != 0)
+    LOG(ERROR) << "NtResumeProcess failed";
+}
+
+}  // namespace crashpad