win: Capture some CRITICAL_SECTION debugging data

client/crashpad_client_win.cc

 // Copyright 2015 The Crashpad Authors. All rights reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //     http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 30 matching lines @@
 HANDLE g_signal_non_crash_dump = INVALID_HANDLE_VALUE;
 HANDLE g_non_crash_dump_done = INVALID_HANDLE_VALUE;
 
 // Guards multiple simultaneous calls to DumpWithoutCrash(). This is leaked.
 base::Lock* g_non_crash_dump_lock;
 
 // Where we store a pointer to the context information when taking a non-crash
 // dump.
 crashpad::ExceptionInformation g_non_crash_exception_information;
 
+// A CRITICAL_SECTION initialized with
+// RTL_CRITICAL_SECTION_FLAG_FORCE_DEBUG_INFO to force it to be allocated with a
+// valid .DebugInfo field. The address of this critical section is given to the
+// handler. All critical sections with debug info are linked in a doubly-linked
+// list, so this allows the handler to capture all of them.
+CRITICAL_SECTION g_critical_section_with_debug_info;
+
 LONG WINAPI UnhandledExceptionHandler(EXCEPTION_POINTERS* exception_pointers) {
   // Tracks whether a thread has already entered UnhandledExceptionHandler.
   static base::subtle::AtomicWord have_crashed;
 
   // This is a per-process handler. While this handler is being invoked, other
   // threads are still executing as usual, so multiple threads could enter at
   // the same time. Because we're in a crashing state, we shouldn't be doing
   // anything that might cause allocations, call into kernel mode, etc. So, we
   // don't want to take a critical section here to avoid simultaneous access to
   // the global exception pointers in ExceptionInformation. Because the crash
@@ skipping 26 matching lines @@
   Sleep(kMillisecondsUntilTerminate);
 
   LOG(ERROR) << "crash server did not respond, self-terminating";
 
   const UINT kCrashExitCodeNoDump = 0xffff7001;
   TerminateProcess(GetCurrentProcess(), kCrashExitCodeNoDump);
 
   return EXCEPTION_CONTINUE_SEARCH;
 }
 
+BOOL CrashpadInitializeCriticalSectionEx(
+    CRITICAL_SECTION* critical_section,
+    DWORD spin_count,
+    DWORD flags) {
+  static decltype(InitializeCriticalSectionEx)* initialize_critical_section_ex =
+      reinterpret_cast<decltype(InitializeCriticalSectionEx)*>(GetProcAddress(
+          LoadLibrary(L"kernel32.dll"), "InitializeCriticalSectionEx"));
+  if (!initialize_critical_section_ex)
+    return false;
+  return initialize_critical_section_ex(critical_section, spin_count, flags);
+}
+
 }  // namespace
 
 namespace crashpad {
 
 CrashpadClient::CrashpadClient() {
 }
 
 CrashpadClient::~CrashpadClient() {
 }
 
@@ skipping 15 matching lines @@
   ClientToServerMessage message;
   memset(&message, 0, sizeof(message));
   message.type = ClientToServerMessage::kRegister;
   message.registration.version = RegistrationRequest::kMessageVersion;
   message.registration.client_process_id = GetCurrentProcessId();
   message.registration.crash_exception_information =
       reinterpret_cast<WinVMAddress>(&g_crash_exception_information);
   message.registration.non_crash_exception_information =
       reinterpret_cast<WinVMAddress>(&g_non_crash_exception_information);
 
+  // We create this dummy CRITICAL_SECTION with the
+  // RTL_CRITICAL_SECTION_FLAG_FORCE_DEBUG_INFO flag set to have an entry point
+  // into the doubly-linked list of RTL_CRITICAL_SECTION_DEBUG objects. This
+  // allows us to walk the list at crash time to gather data for !locks. A
+  // debugger would instead inspect ntdll!RtlCriticalSectionList to get the head
+  // of the list. But that is not an exported symbol, so on an arbitrary client
+  // machine, we don't have a way of getting that pointer.
+  if (CrashpadInitializeCriticalSectionEx(
+          &g_critical_section_with_debug_info,
+          0,
+          RTL_CRITICAL_SECTION_FLAG_FORCE_DEBUG_INFO)) {
+    message.registration.critical_section_address =
+        reinterpret_cast<WinVMAddress>(&g_critical_section_with_debug_info);
+  } else {
+    PLOG(ERROR) << "InitializeCriticalSectionEx";
+  }
+
   ServerToClientMessage response = {0};
 
   if (!SendToCrashHandlerServer(
           base::UTF8ToUTF16(ipc_port), message, &response)) {
     return false;
   }
 
   // The server returns these already duplicated to be valid in this process.
   g_signal_exception = reinterpret_cast<HANDLE>(
       static_cast<uintptr_t>(response.registration.request_crash_dump_event));
@@ skipping 66 matching lines @@
       reinterpret_cast<crashpad::WinVMAddress>(&exception_pointers);
 
   bool set_event_result = SetEvent(g_signal_non_crash_dump);
   PLOG_IF(ERROR, !set_event_result) << "SetEvent";
 
   DWORD wfso_result = WaitForSingleObject(g_non_crash_dump_done, INFINITE);
   PLOG_IF(ERROR, wfso_result != WAIT_OBJECT_0) << "WaitForSingleObject";
 }
 
 }  // namespace crashpad