Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 # Breakpad Client Libraries | 1 # Breakpad Client Libraries |
| 2 | 2 |
| 3 ## Objective | 3 ## Objective |
| 4 | 4 |
| 5 The Breakpad client libraries are responsible for monitoring an application for | 5 The Breakpad client libraries are responsible for monitoring an application for |
| 6 crashes (exceptions), handling them when they occur by generating a dump, and | 6 crashes (exceptions), handling them when they occur by generating a dump, and |
| 7 providing a means to upload dumps to a crash reporting server. These tasks are | 7 providing a means to upload dumps to a crash reporting server. These tasks are |
| 8 divided between the “handler” (short for “exception handler”) library linked in | 8 divided between the "handler" (short for "exception handler") library linked in |
| 9 to an application being monitored for crashes, and the “sender” library, | 9 to an application being monitored for crashes, and the "sender" library, |
| 10 intended to be linked in to a separate external program. | 10 intended to be linked in to a separate external program. |
| 11 | 11 |
| 12 ## Background | 12 ## Background |
| 13 | 13 |
| 14 As one of the chief tasks of the client handler is to generate a dump, an | 14 As one of the chief tasks of the client handler is to generate a dump, an |
| 15 understanding of [dump files](processor_design.md) will aid in understanding the | 15 understanding of [dump files](processor_design.md) will aid in understanding the |
| 16 handler. | 16 handler. |
| 17 | 17 |
| 18 ## Overview | 18 ## Overview |
| 19 | 19 |
| (...skipping 18 matching lines...) Expand all Loading... | |
| 38 the start-up process as possible. Developers of library code using Breakpad to | 38 the start-up process as possible. Developers of library code using Breakpad to |
| 39 monitor itself may wish to install a Breakpad handler when the library is | 39 monitor itself may wish to install a Breakpad handler when the library is |
| 40 loaded, or may only want to install a handler when calls are made in to the | 40 loaded, or may only want to install a handler when calls are made in to the |
| 41 library. | 41 library. |
| 42 | 42 |
| 43 The handler can be triggered to generate a dump either by catching an exception | 43 The handler can be triggered to generate a dump either by catching an exception |
| 44 or at the request of the application itself. The latter case may be useful in | 44 or at the request of the application itself. The latter case may be useful in |
| 45 debugging assertions or other conditions where developers want to know how a | 45 debugging assertions or other conditions where developers want to know how a |
| 46 program got in to a specific non-crash state. After generating a dump, the | 46 program got in to a specific non-crash state. After generating a dump, the |
| 47 handler calls a user-specified callback function. The callback function may | 47 handler calls a user-specified callback function. The callback function may |
| 48 collect additional data about the program’s state, quit the program, launch a | 48 collect additional data about the program's state, quit the program, launch a |
|
Bons
2016/06/29 17:22:16
Why are you replacing the smart quotes with dumb o
vapier
2016/06/29 17:56:40
smart quotes are an abomination ;).
they don't re
| |
| 49 crash reporter application, or perform other tasks. Allowing for this | 49 crash reporter application, or perform other tasks. Allowing for this |
| 50 functionality to be dictated by a callback function preserves flexibility. | 50 functionality to be dictated by a callback function preserves flexibility. |
| 51 | 51 |
| 52 The sender library is also has a separate implementation for each supported | 52 The sender library is also has a separate implementation for each supported |
| 53 platform, because of the varying interfaces for accessing network resources on | 53 platform, because of the varying interfaces for accessing network resources on |
| 54 different operating systems. The sender transmits a dump along with other | 54 different operating systems. The sender transmits a dump along with other |
| 55 application-defined information to a crash report server via HTTP. Because dumps | 55 application-defined information to a crash report server via HTTP. Because dumps |
| 56 may contain sensitive data, the sender allows for the use of HTTPS. | 56 may contain sensitive data, the sender allows for the use of HTTPS. |
| 57 | 57 |
| 58 The canonical example of the entire client system would be for a monitored | 58 The canonical example of the entire client system would be for a monitored |
| 59 application to link against the handler library, install a Breakpad handler from | 59 application to link against the handler library, install a Breakpad handler from |
| 60 its main function, and provide a callback to launch a small crash reporter | 60 its main function, and provide a callback to launch a small crash reporter |
| 61 program. The crash reporter program would be linked against the sender library, | 61 program. The crash reporter program would be linked against the sender library, |
| 62 and would send the crash dump when launched. A separate process is recommended | 62 and would send the crash dump when launched. A separate process is recommended |
| 63 for this function because of the unreliability inherent in doing any significant | 63 for this function because of the unreliability inherent in doing any significant |
| 64 amount of work from a crashed process. | 64 amount of work from a crashed process. |
| 65 | 65 |
| 66 ## Detailed Design | 66 ## Detailed Design |
| 67 | 67 |
| 68 ### Exception Handler Installation | 68 ### Exception Handler Installation |
| 69 | 69 |
| 70 The mechanisms for installing an exception handler vary between operating | 70 The mechanisms for installing an exception handler vary between operating |
| 71 systems. On Windows, it’s a relatively simple matter of making one call to | 71 systems. On Windows, it's a relatively simple matter of making one call to |
| 72 register a [top-level exception filter] | 72 register a |
| 73 (http://msdn.microsoft.com/library/en-us/debug/base/setunhandledexceptionfilter. asp) | 73 [top-level exception filter](https://msdn.microsoft.com/library/en-us/debug/base /setunhandledexceptionfilter.asp) |
| 74 callback function. On most Unix-like systems such as Linux, processes are | 74 callback function. On most Unix-like systems such as Linux, processes are |
| 75 informed of exceptions by the delivery of a signal, so an exception handler | 75 informed of exceptions by the delivery of a signal, so an exception handler |
| 76 takes the form of a signal handler. The native mechanism to catch exceptions on | 76 takes the form of a signal handler. The native mechanism to catch exceptions on |
| 77 Mac OS X requires a large amount of code to set up a Mach port, identify it as | 77 Mac OS X requires a large amount of code to set up a Mach port, identify it as |
| 78 the exception port, and assign a thread to listen for an exception on that port. | 78 the exception port, and assign a thread to listen for an exception on that port. |
| 79 Just as the preparation of exception handlers differ, the manner in which they | 79 Just as the preparation of exception handlers differ, the manner in which they |
| 80 are called differs as well. On Windows and most Unix-like systems, the handler | 80 are called differs as well. On Windows and most Unix-like systems, the handler |
| 81 is called on the thread that caused the exception. On Mac OS X, the thread | 81 is called on the thread that caused the exception. On Mac OS X, the thread |
| 82 listening to the exception port is notified that an exception has occurred. The | 82 listening to the exception port is notified that an exception has occurred. The |
| 83 different implementations of the Breakpad handler libraries perform these tasks | 83 different implementations of the Breakpad handler libraries perform these tasks |
| 84 in the appropriate ways on each platform, while exposing a similar interface on | 84 in the appropriate ways on each platform, while exposing a similar interface on |
| 85 each. | 85 each. |
| 86 | 86 |
| 87 A Breakpad handler is embodied in an `ExceptionHandler` object. Because it’s a | 87 A Breakpad handler is embodied in an `ExceptionHandler` object. Because it's a |
| 88 C++ object, `ExceptionHandler`s may be created as local variables, allowing them | 88 C++ object, `ExceptionHandler`s may be created as local variables, allowing them |
| 89 to be installed and removed as functions are called and return. This provides | 89 to be installed and removed as functions are called and return. This provides |
| 90 one possible way for a developer to monitor only a portion of an application for | 90 one possible way for a developer to monitor only a portion of an application for |
| 91 crashes. | 91 crashes. |
| 92 | 92 |
| 93 ### Exception Basics | 93 ### Exception Basics |
| 94 | 94 |
| 95 Once an application encounters an exception, it is in an indeterminate and | 95 Once an application encounters an exception, it is in an indeterminate and |
| 96 possibly hazardous state. Consequently, any code that runs after an exception | 96 possibly hazardous state. Consequently, any code that runs after an exception |
| 97 occurs must take extreme care to avoid performing operations that might fail, | 97 occurs must take extreme care to avoid performing operations that might fail, |
| 98 hang, or cause additional exceptions. This task is not at all straightforward, | 98 hang, or cause additional exceptions. This task is not at all straightforward, |
| 99 and the Breakpad handler library seeks to do it properly, accounting for all of | 99 and the Breakpad handler library seeks to do it properly, accounting for all of |
| 100 the minute details while allowing other application developers, even those with | 100 the minute details while allowing other application developers, even those with |
| 101 little systems programming experience, to reap the benefits. All of the Breakpad | 101 little systems programming experience, to reap the benefits. All of the Breakpad |
| 102 handler code that executes after an exception occurs has been written according | 102 handler code that executes after an exception occurs has been written according |
| 103 to the following guidelines for safety at exception time: | 103 to the following guidelines for safety at exception time: |
| 104 | 104 |
| 105 * Use of the application heap is forbidden. The heap may be corrupt or | 105 * Use of the application heap is forbidden. The heap may be corrupt or |
| 106 otherwise unusable, and allocators may not function. | 106 otherwise unusable, and allocators may not function. |
| 107 * Resource allocation must be severely limited. The handler may create a new | 107 * Resource allocation must be severely limited. The handler may create a new |
| 108 file to contain the dump, and it may attempt to launch a process to continue | 108 file to contain the dump, and it may attempt to launch a process to continue |
| 109 handling the crash. | 109 handling the crash. |
| 110 * Execution on the thread that caused the exception is significantly limited. | 110 * Execution on the thread that caused the exception is significantly limited. |
| 111 The only code permitted to execute on this thread is the code necessary to | 111 The only code permitted to execute on this thread is the code necessary to |
| 112 transition handling to a dedicated preallocated handler thread, and the code | 112 transition handling to a dedicated preallocated handler thread, and the code |
| 113 to return from the exception handler. | 113 to return from the exception handler. |
| 114 * Handlers shouldn’t handle crashes by attempting to walk stacks themselves, | 114 * Handlers shouldn't handle crashes by attempting to walk stacks themselves, |
| 115 as stacks may be in inconsistent states. Dump generation should be performed | 115 as stacks may be in inconsistent states. Dump generation should be performed |
| 116 by interfacing with the operating system’s memory manager and code module | 116 by interfacing with the operating system's memory manager and code module |
| 117 manager. | 117 manager. |
| 118 * Library code, including runtime library code, must be avoided unless it | 118 * Library code, including runtime library code, must be avoided unless it |
| 119 provably meets the above guidelines. For example, this means that the STL | 119 provably meets the above guidelines. For example, this means that the STL |
| 120 string class may not be used, because it performs operations that attempt to | 120 string class may not be used, because it performs operations that attempt to |
| 121 allocate and use heap memory. It also means that many C runtime functions | 121 allocate and use heap memory. It also means that many C runtime functions |
| 122 must be avoided, particularly on Windows, because of heap operations that | 122 must be avoided, particularly on Windows, because of heap operations that |
| 123 they may perform. | 123 they may perform. |
| 124 | 124 |
| 125 A dedicated handler thread is used to preserve the state of the exception thread | 125 A dedicated handler thread is used to preserve the state of the exception thread |
| 126 when an exception occurs: during dump generation, it is difficult if not | 126 when an exception occurs: during dump generation, it is difficult if not |
| 127 impossible for a thread to accurately capture its own state. Performing all | 127 impossible for a thread to accurately capture its own state. Performing all |
| 128 exception-handling functions on a separate thread is also critical when handling | 128 exception-handling functions on a separate thread is also critical when handling |
| 129 stack-limit-exceeded exceptions. It would be hazardous to run out of stack space | 129 stack-limit-exceeded exceptions. It would be hazardous to run out of stack space |
| 130 while attempting to handle an exception. Because of the rule against allocating | 130 while attempting to handle an exception. Because of the rule against allocating |
| 131 resources at exception time, the Breakpad handler library creates its handler | 131 resources at exception time, the Breakpad handler library creates its handler |
| 132 thread when it installs its exception handler. On Mac OS X, this handler thread | 132 thread when it installs its exception handler. On Mac OS X, this handler thread |
| 133 is created during the normal setup of the exception handler, and the handler | 133 is created during the normal setup of the exception handler, and the handler |
| 134 thread will be signaled directly in the event of an exception. On Windows and | 134 thread will be signaled directly in the event of an exception. On Windows and |
| 135 Linux, the handler thread is signaled by a small amount of code that executes on | 135 Linux, the handler thread is signaled by a small amount of code that executes on |
| 136 the exception thread. Because the code that executes on the exception thread in | 136 the exception thread. Because the code that executes on the exception thread in |
| 137 this case is small and safe, this does not pose a problem. Even when an | 137 this case is small and safe, this does not pose a problem. Even when an |
| 138 exception is caused by exceeding stack size limits, this code is sufficiently | 138 exception is caused by exceeding stack size limits, this code is sufficiently |
| 139 compact to execute entirely within the stack’s guard page without causing an | 139 compact to execute entirely within the stack's guard page without causing an |
| 140 exception. | 140 exception. |
| 141 | 141 |
| 142 The handler thread may also be triggered directly by a user call, even when no | 142 The handler thread may also be triggered directly by a user call, even when no |
| 143 exception occurs, to allow dumps to be generated at any point deemed | 143 exception occurs, to allow dumps to be generated at any point deemed |
| 144 interesting. | 144 interesting. |
| 145 | 145 |
| 146 ### Filter Callback | 146 ### Filter Callback |
| 147 | 147 |
| 148 When the handler thread begins handling an exception, it calls an optional | 148 When the handler thread begins handling an exception, it calls an optional |
| 149 user-defined filter callback function, which is responsible for judging whether | 149 user-defined filter callback function, which is responsible for judging whether |
| 150 Breakpad’s handler should continue handling the exception or not. This mechanism | 150 Breakpad's handler should continue handling the exception or not. This mechanism |
| 151 is provided for the benefit of library or plug-in code, whose developers may not | 151 is provided for the benefit of library or plug-in code, whose developers may not |
| 152 be interested in reports of crashes that occur outside of their modules but | 152 be interested in reports of crashes that occur outside of their modules but |
| 153 within processes hosting their code. If the filter callback indicates that it is | 153 within processes hosting their code. If the filter callback indicates that it is |
| 154 not interested in the exception, the Breakpad handler arranges for it to be | 154 not interested in the exception, the Breakpad handler arranges for it to be |
| 155 delivered to any previously-installed handler. | 155 delivered to any previously-installed handler. |
| 156 | 156 |
| 157 ### Dump Generation | 157 ### Dump Generation |
| 158 | 158 |
| 159 Assuming that the filter callback approves (or does not exist), the handler | 159 Assuming that the filter callback approves (or does not exist), the handler |
| 160 writes a dump in a directory specified by the application developer when the | 160 writes a dump in a directory specified by the application developer when the |
| 161 handler was installed, using a previously generated unique identifier to avoid | 161 handler was installed, using a previously generated unique identifier to avoid |
| 162 name collisions. The mechanics of dump generation also vary between platforms, | 162 name collisions. The mechanics of dump generation also vary between platforms, |
| 163 but in general, the process involves enumerating each thread of execution, and | 163 but in general, the process involves enumerating each thread of execution, and |
| 164 capturing its state, including processor context and the active portion of its | 164 capturing its state, including processor context and the active portion of its |
| 165 stack area. The dump also includes a list of the code modules loaded in to the | 165 stack area. The dump also includes a list of the code modules loaded in to the |
| 166 application, and an indicator of which thread generated the exception or | 166 application, and an indicator of which thread generated the exception or |
| 167 requested the dump. In order to avoid allocating memory during this process, the | 167 requested the dump. In order to avoid allocating memory during this process, the |
| 168 dump is written in place on disk. | 168 dump is written in place on disk. |
| 169 | 169 |
| 170 ### Post-Dump Behavior | 170 ### Post-Dump Behavior |
| 171 | 171 |
| 172 Upon completion of writing the dump, a second callback function is called. This | 172 Upon completion of writing the dump, a second callback function is called. This |
| 173 callback may be used to launch a separate crash reporting program or to collect | 173 callback may be used to launch a separate crash reporting program or to collect |
| 174 additional data from the application. The callback may also be used to influence | 174 additional data from the application. The callback may also be used to influence |
| 175 whether Breakpad will treat the exception as handled or unhandled. Even after a | 175 whether Breakpad will treat the exception as handled or unhandled. Even after a |
| 176 dump is successfully generated, Breakpad can be made to behave as though it | 176 dump is successfully generated, Breakpad can be made to behave as though it |
| 177 didn’t actually handle an exception. This function may be useful for developers | 177 didn't actually handle an exception. This function may be useful for developers |
| 178 who want to test their applications with Breakpad enabled but still retain the | 178 who want to test their applications with Breakpad enabled but still retain the |
| 179 ability to use traditional debugging techniques. It also allows a | 179 ability to use traditional debugging techniques. It also allows a |
| 180 Breakpad-enabled application to coexist with a platform’s native crash reporting | 180 Breakpad-enabled application to coexist with a platform's native crash reporting |
| 181 system, such as Mac OS X’ [CrashReporter] | 181 system, such as Mac OS X's |
| 182 (http://developer.apple.com/technotes/tn2004/tn2123.html) and [Windows Error | 182 [CrashReporter](https://developer.apple.com/technotes/tn2004/tn2123.html) |
| 183 Reporting](http://msdn.microsoft.com/isv/resources/wer/). | 183 and |
| 184 [Windows Error Reporting](https://msdn.microsoft.com/en-us/library/windows/deskt op/bb513641(v=vs.85).aspx). | |
| 184 | 185 |
| 185 Typically, when Breakpad handles an exception fully and no debuggers are | 186 Typically, when Breakpad handles an exception fully and no debuggers are |
| 186 involved, the crashed process will terminate. | 187 involved, the crashed process will terminate. |
| 187 | 188 |
| 188 Authors of both callback functions that execute within a Breakpad handler are | 189 Authors of both callback functions that execute within a Breakpad handler are |
| 189 cautioned that their code will be run at exception time, and that as a result, | 190 cautioned that their code will be run at exception time, and that as a result, |
| 190 they should observe the same programming practices that the Breakpad handler | 191 they should observe the same programming practices that the Breakpad handler |
| 191 itself adheres to. Notably, if a callback is to be used to collect additional | 192 itself adheres to. Notably, if a callback is to be used to collect additional |
| 192 data from an application, it should take care to read only “safe” data. This | 193 data from an application, it should take care to read only "safe" data. This |
| 193 might involve accessing only static memory locations that are updated | 194 might involve accessing only static memory locations that are updated |
| 194 periodically during the course of normal program execution. | 195 periodically during the course of normal program execution. |
| 195 | 196 |
| 196 ### Sender Library | 197 ### Sender Library |
| 197 | 198 |
| 198 The Breakpad sender library provides a single function to send a crash report to | 199 The Breakpad sender library provides a single function to send a crash report to |
| 199 a crash server. It accepts a crash server’s URL, a map of key-value parameters | 200 a crash server. It accepts a crash server's URL, a map of key-value parameters |
| 200 that will accompany the dump, and the path to a dump file itself. Each of the | 201 that will accompany the dump, and the path to a dump file itself. Each of the |
| 201 key-value parameters and the dump file are sent as distinct parts of a multipart | 202 key-value parameters and the dump file are sent as distinct parts of a multipart |
| 202 HTTP POST request to the specified URL using the platform’s native HTTP | 203 HTTP POST request to the specified URL using the platform's native HTTP |
| 203 facilities. On Linux, [libcurl](http://curl.haxx.se/) is used for this function, | 204 facilities. On Linux, [libcurl](https://curl.haxx.se/) is used for this function , |
| 204 as it is the closest thing to a standard HTTP library available on that | 205 as it is the closest thing to a standard HTTP library available on that |
| 205 platform. | 206 platform. |
| 206 | 207 |
| 207 ## Future Plans | 208 ## Future Plans |
| 208 | 209 |
| 209 Although we’ve had great success with in-process dump generation by following | 210 Although we've had great success with in-process dump generation by following |
| 210 our guidelines for safe code at exception time, we are exploring options for | 211 our guidelines for safe code at exception time, we are exploring options for |
| 211 allowing dumps to be generated in a separate process, to further enhance the | 212 allowing dumps to be generated in a separate process, to further enhance the |
| 212 handler library’s robustness. | 213 handler library's robustness. |
| 213 | 214 |
| 214 On Windows, we intend to offer tools to make it easier for Breakpad’s settings | 215 On Windows, we intend to offer tools to make it easier for Breakpad's settings |
| 215 to be managed by the native group policy management system. | 216 to be managed by the native group policy management system. |
| 216 | 217 |
| 217 We also plan to offer tools that many developers would find desirable in the | 218 We also plan to offer tools that many developers would find desirable in the |
| 218 context of handling crashes, such as a mechanism to determine at launch if the | 219 context of handling crashes, such as a mechanism to determine at launch if the |
| 219 program last terminated in a crash, and a way to calculate “crashiness” in terms | 220 program last terminated in a crash, and a way to calculate "crashiness" in terms |
| 220 of crashes over time or the number of application launches between crashes. | 221 of crashes over time or the number of application launches between crashes. |
| 221 | 222 |
| 222 We are also investigating methods to capture crashes that occur early in an | 223 We are also investigating methods to capture crashes that occur early in an |
| 223 application’s launch sequence, including crashes that occur before a program’s | 224 application's launch sequence, including crashes that occur before a program's |
| 224 main function begins executing. | 225 main function begins executing. |
| OLD | NEW |