fix: split inproc handler thread

.github/workflows/benchmark.yml

@@ -44,7 +44,7 @@ jobs:
         if: ${{ runner.os == 'Linux' }}
         run: |
           sudo apt update
-          sudo apt install -y libcurl4-openssl-dev
+          sudo apt install -y libcurl4-openssl-dev libunwind-dev
 
       - name: Benchmark
         shell: bash

.github/workflows/ci.yml

@@ -39,7 +39,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          # toolchain per runner-image availability:
+            # toolchain per runner-image availability:
             #   ubuntu 22.04
             #     GCC: 9-12
             #     clang: 11-15
@@ -140,6 +140,10 @@ jobs:
             os: macos-14
             ERROR_ON_WARNINGS: 1
             SYSTEM_VERSION_COMPAT: 0
+          - name: macOS 26 (xcode llvm)
+            os: macos-26
+            ERROR_ON_WARNINGS: 1
+            SYSTEM_VERSION_COMPAT: 0
           - name: macOS 14 (xcode llvm + universal)
             os: macos-14
             ERROR_ON_WARNINGS: 1
@@ -222,7 +226,7 @@ jobs:
         run: |
           sudo apt update
           # Install common dependencies
-          sudo apt install cmake llvm valgrind zlib1g-dev libcurl4-openssl-dev
+          sudo apt install cmake llvm valgrind zlib1g-dev libcurl4-openssl-dev libunwind-dev
           # For GCC, install both gcc-X and g++-X. For Clang, only install clang-X (includes C++ compiler)
           if [[ "$CC" == gcc-* ]]; then
             sudo apt install "${CC}" "${CXX}"
@@ -253,19 +257,14 @@ jobs:
         run: |
           sudo dpkg --add-architecture i386
           sudo apt update
-          sudo apt install cmake "${CC}-multilib" "${CXX}-multilib" zlib1g-dev:i386 libssl-dev:i386 libcurl4-openssl-dev:i386
+          sudo apt install cmake "${CC}-multilib" "${CXX}-multilib" zlib1g-dev:i386 libssl-dev:i386 libcurl4-openssl-dev:i386 libunwind-dev:i386 liblzma-dev:i386
 
       - name: Installing Alpine Linux Dependencies
         if: ${{ contains(matrix.container, 'alpine') }}
         run: |
           apk update
           apk add curl-dev libunwind-dev libunwind-static xz-dev
 
-        # https://github.com/actions/runner-images/issues/9491
-      - name: Decrease vm.mmap_rnd_bit to prevent ASLR ASAN issues
-        if: ${{ runner.os == 'Linux' && contains(env['RUN_ANALYZER'], 'asan') }}
-        run: sudo sysctl vm.mmap_rnd_bits=28
-
       - name: Installing CodeChecker
         if: ${{ contains(env['RUN_ANALYZER'], 'code-checker') }}
         run: sudo snap install codechecker --classic

.github/workflows/codeql.yml

@@ -37,7 +37,7 @@ jobs:
       - name: Installing Linux Dependencies
         run: |
           sudo apt update
-          sudo apt install cmake clang-14 clang-tools llvm kcov g++-12 valgrind zlib1g-dev libcurl4-openssl-dev
+          sudo apt install cmake clang-14 clang-tools llvm kcov g++-12 valgrind zlib1g-dev libcurl4-openssl-dev libunwind-dev
 
       - if: matrix.language == 'java'
         name: Setup Java Version

CHANGELOG.md

@@ -2,12 +2,23 @@
 
 ## Unreleased
 
+**Breaking**:
+
+- inproc(Linux): the `inproc` backend on Linux now depends on "nognu" `libunwind`. ([#1446](https://github.com/getsentry/sentry-native/pull/1446))
+- inproc: since we split `inproc` into signal-handler/UEF part and a separate handler thread, `before_send` and `on_crash` could be called from other threads than the one that crashed. While this was never part of the contract, if your code relies on this, it will no longer work. ([#1446](https://github.com/getsentry/sentry-native/pull/1446))
+
 **Features**:
 
 - Add custom attributes API for logs. When `logs_with_attributes` is set to `true`, treats the first `varg` passed into `sentry_logs_X(message,...)` as a `sentry_value_t` object of attributes. ([#1435](https://github.com/getsentry/sentry-native/pull/1435))
 - Add runtime API to query user consent requirement. ([#1443](https://github.com/getsentry/sentry-native/pull/1443))
 - Add logs flush on `sentry_flush()`. ([#1434](https://github.com/getsentry/sentry-native/pull/1434))
 
+**Fixes**:
+
+- Make the signal-handler synchronization fully atomic to fix rare race scenarios. ([#1446](https://github.com/getsentry/sentry-native/pull/1446))
+- Reintroduce an FP-based stack-walker for macOS that can start from a user context. This also makes `inproc` backend functional again on macOS 13+. ([#1446](https://github.com/getsentry/sentry-native/pull/1446))
+- Split the `inproc` signal handler (and UEF on Windows) into a safe handler part and an "unsafe" handler thread. This minimizes exposure to undefined behavior inside the signal handler. ([#1446](https://github.com/getsentry/sentry-native/pull/1446))
+
 ## 0.12.1
 
 **Fixes**:

CMakeLists.txt

@@ -144,15 +144,6 @@ if(LINUX)
 		set(CMAKE_ASM_FLAGS  "${CMAKE_ASM_FLAGS} -m32 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE")
 		set_property(GLOBAL PROPERTY FIND_LIBRARY_USE_LIB64_PATHS OFF)
 	endif()
-
-        execute_process(
-                COMMAND ${CMAKE_C_COMPILER} -dumpmachine
-                OUTPUT_VARIABLE TARGET_TRIPLET
-                OUTPUT_STRIP_TRAILING_WHITESPACE
-        )
-        if(TARGET_TRIPLET MATCHES "musl")
-                set(MUSL TRUE)
-        endif()
 endif()
 
 # CMAKE_POSITION_INDEPENDENT_CODE must be set BEFORE adding any libraries (including subprojects)
@@ -266,9 +257,12 @@ endif()
 
 if(ANDROID)
 	set(SENTRY_WITH_LIBUNWINDSTACK TRUE)
-elseif(MUSL)
+elseif(LINUX)
 	set(SENTRY_WITH_LIBUNWIND TRUE)
+elseif(APPLE)
+	set(SENTRY_WITH_LIBUNWIND_MAC TRUE)
 elseif(NOT WIN32 AND NOT PROSPERO)
+	# this should never be true, but we keep it as fallback
 	set(SENTRY_WITH_LIBBACKTRACE TRUE)
 endif()
 
@@ -621,12 +615,30 @@ endif()
 if(SENTRY_WITH_LIBUNWIND)
 	if(LINUX)
 		option(SENTRY_LIBUNWIND_SHARED "Link to shared libunwind" ${SENTRY_BUILD_SHARED_LIBS})
-		find_path(LIBUNWIND_INCLUDE_DIR libunwind.h PATH_SUFFIXES libunwind REQUIRED)
+
+		# ensure suffix and search paths for include and library search (specifically for multilib)
+		if(SENTRY_BUILD_FORCE32)
+			set(_unwind_triplet "i386-linux-gnu")
+			set(_i386_libpaths /usr/lib/i386-linux-gnu /lib/i386-linux-gnu /usr/lib32 /lib32)
+		else()
+			set(_unwind_triplet "${CMAKE_LIBRARY_ARCHITECTURE}")
+		endif()
+
+		find_path(LIBUNWIND_INCLUDE_DIR libunwind.h
+			PATH_SUFFIXES
+				${_unwind_triplet}
+				libunwind # some distros put the libunwind headers into a subdirectory
+			REQUIRED)
 		if(SENTRY_LIBUNWIND_SHARED)
-			find_library(LIBUNWIND_LIBRARIES unwind REQUIRED)
+			find_library(LIBUNWIND_LIBRARIES unwind PATH_SUFFIXES ${_unwind_triplet} REQUIRED)
 		else()
-			find_library(LIBUNWIND_LIBRARIES libunwind.a REQUIRED)
-			find_library(LZMA_LIBRARY lzma)
+			find_library(LIBUNWIND_LIBRARIES libunwind.a PATH_SUFFIXES ${_unwind_triplet} REQUIRED)
+			if(SENTRY_BUILD_FORCE32)
+				find_library(LZMA_LIBRARY lzma PATHS ${_i386_libpaths} NO_DEFAULT_PATH)
+			else()
+				find_library(LZMA_LIBRARY lzma PATH_SUFFIXES ${_unwind_triplet})
+			endif()
+
 			if(LZMA_LIBRARY)
 				list(APPEND LIBUNWIND_LIBRARIES ${LZMA_LIBRARY})
 			endif()
@@ -685,6 +697,15 @@ if(SENTRY_BACKEND_CRASHPAD)
 		$<BUILD_INTERFACE:crashpad::client>
 		$<INSTALL_INTERFACE:sentry_crashpad::client>
 	)
+
+	# ignore #include_next <signal.h> warning being a GCC extension via pedantic
+	if (LINUX)
+		target_include_directories(sentry
+				SYSTEM PRIVATE
+				external/crashpad/compat/linux
+		)
+	endif()
+
 	install(EXPORT crashpad_export NAMESPACE sentry_crashpad:: FILE sentry_crashpad-targets.cmake
 		DESTINATION "${CMAKE_INSTALL_CMAKEDIR}"
 	)
@@ -813,6 +834,21 @@ if(SENTRY_BUILD_EXAMPLES)
 		# Disable all optimizations for the `sentry_example` in gcc/clang. This allows us to keep crash triggers simple.
 		# The effects besides reproducible code-gen across compiler versions, will be negligible for build- and runtime.
 		target_compile_options(sentry_example PRIVATE $<BUILD_INTERFACE:-O0>)
+
+		# Most Linux distros will build executables with PIE. However, if we build a static library, not all static
+		# dependencies being packaged with the same distro, are built with PIC enabled. This will lead `ld` to error on
+		# relocation data, thus failing the build/tests. There is no need to build the example with PIE enabled.
+		# Similarly, LTO must be disabled since the static library archive might have different LTO bytecode version.
+		if (LINUX AND NOT SENTRY_BUILD_SHARED_LIBS)
+			target_link_options(sentry_example PRIVATE
+				-no-pie
+				-fno-lto
+			)
+			target_compile_options(sentry_example PRIVATE
+				-fno-pie
+				-fno-lto
+			)
+		endif()
 	endif()
 
 	# set static runtime if enabled
@@ -824,11 +860,17 @@ if(SENTRY_BUILD_EXAMPLES)
 		set_target_properties(sentry_example PROPERTIES FOLDER ${SENTRY_FOLDER})
 	endif()
 
+	if(CMAKE_GENERATOR STREQUAL "Xcode")
+		set(SENTRY_FIXTURE_OUTPUT_DIR "$<TARGET_BUNDLE_DIR:sentry_example>/..")
+	else()
+		set(SENTRY_FIXTURE_OUTPUT_DIR "$<TARGET_FILE_DIR:sentry_example>")
+	endif()
+
 	add_custom_command(TARGET sentry_example POST_BUILD
-		COMMAND ${CMAKE_COMMAND} -E copy_if_different "${CMAKE_CURRENT_SOURCE_DIR}/tests/fixtures/minidump.dmp" "$<TARGET_FILE_DIR:sentry_example>/minidump.dmp")
+		COMMAND ${CMAKE_COMMAND} -E copy_if_different "${CMAKE_CURRENT_SOURCE_DIR}/tests/fixtures/minidump.dmp" "${SENTRY_FIXTURE_OUTPUT_DIR}/minidump.dmp")
 
 	add_custom_command(TARGET sentry_example POST_BUILD
-		COMMAND ${CMAKE_COMMAND} -E copy_if_different "${CMAKE_CURRENT_SOURCE_DIR}/tests/fixtures/view-hierarchy.json" "$<TARGET_FILE_DIR:sentry_example>/view-hierarchy.json")
+		COMMAND ${CMAKE_COMMAND} -E copy_if_different "${CMAKE_CURRENT_SOURCE_DIR}/tests/fixtures/view-hierarchy.json" "${SENTRY_FIXTURE_OUTPUT_DIR}/view-hierarchy.json")
 endif()
 
 # Limit the exported symbols when sentry is built as a shared library to those with a "sentry_" prefix:

src/CMakeLists.txt

@@ -153,6 +153,9 @@ elseif(SENTRY_BACKEND_NONE)
 endif()
 
 # unwinder
+sentry_target_sources_cwd(sentry
+	unwinder/sentry_unwinder.h
+)
 if(SENTRY_WITH_LIBBACKTRACE)
 	target_compile_definitions(sentry PRIVATE SENTRY_WITH_UNWINDER_LIBBACKTRACE)
 	sentry_target_sources_cwd(sentry
@@ -167,6 +170,13 @@ if(SENTRY_WITH_LIBUNWIND)
 	)
 endif()
 
+if(SENTRY_WITH_LIBUNWIND_MAC)
+	target_compile_definitions(sentry PRIVATE SENTRY_WITH_UNWINDER_LIBUNWIND_MAC)
+	sentry_target_sources_cwd(sentry
+			unwinder/sentry_unwinder_libunwind_mac.c
+	)
+endif()
+
 if(SENTRY_WITH_LIBUNWINDSTACK)
 	target_compile_definitions(sentry PRIVATE SENTRY_WITH_UNWINDER_LIBUNWINDSTACK)
 	sentry_target_sources_cwd(sentry

src/backends/sentry_backend_breakpad.cpp

@@ -261,22 +261,22 @@ breakpad_backend_startup(
         && defined(SENTRY_THREAD_STACK_GUARANTEE_AUTO_INIT)
     sentry__set_default_thread_stack_guarantee();
 #    endif
-    backend->data = new google_breakpad::ExceptionHandler(
+    backend->data = new (std::nothrow) google_breakpad::ExceptionHandler(
         current_run_folder->path_w, nullptr, breakpad_backend_callback, nullptr,
         google_breakpad::ExceptionHandler::HANDLER_EXCEPTION);
 #elif defined(SENTRY_PLATFORM_MACOS)
     // If process is being debugged and there are breakpoints set it will cause
     // task_set_exception_ports to crash the whole process and debugger
-    backend->data = new google_breakpad::ExceptionHandler(
-        current_run_folder->path, nullptr, breakpad_backend_callback, nullptr,
-        !IsDebuggerActive(), nullptr);
+    backend->data = new (std::nothrow)
+        google_breakpad::ExceptionHandler(current_run_folder->path, nullptr,
+            breakpad_backend_callback, nullptr, !IsDebuggerActive(), nullptr);
 #elif defined(SENTRY_PLATFORM_IOS)
-    backend->data
-        = new google_breakpad::ExceptionHandler(current_run_folder->path,
-            nullptr, breakpad_backend_callback, nullptr, true, nullptr);
+    backend->data = new (std::nothrow)
+        google_breakpad::ExceptionHandler(current_run_folder->path, nullptr,
+            breakpad_backend_callback, nullptr, true, nullptr);
 #else
     google_breakpad::MinidumpDescriptor descriptor(current_run_folder->path);
-    backend->data = new google_breakpad::ExceptionHandler(
+    backend->data = new (std::nothrow) google_breakpad::ExceptionHandler(
         descriptor, nullptr, breakpad_backend_callback, nullptr, true, -1);
 #endif
     return backend->data == nullptr;

src/backends/sentry_backend_crashpad.cpp

@@ -32,8 +32,7 @@ extern "C" {
 #if defined(__GNUC__)
 #    pragma GCC diagnostic push
 #    pragma GCC diagnostic ignored "-Wunused-parameter"
-#    pragma GCC diagnostic ignored "-Wgnu-zero-variadic-macro-arguments"
-#    pragma GCC diagnostic ignored "-Wfour-char-constants"
+#    pragma GCC diagnostic ignored "-Wmultichar"
 #elif defined(_MSC_VER)
 #    pragma warning(push)
 #    pragma warning(disable : 4100) // unreferenced formal parameter
@@ -310,11 +309,11 @@ flush_scope_from_handler(
 
 #    ifdef SENTRY_PLATFORM_WINDOWS
 static bool
-sentry__crashpad_handler(EXCEPTION_POINTERS *ExceptionInfo)
+crashpad_handler(EXCEPTION_POINTERS *ExceptionInfo)
 {
 #    else
 static bool
-sentry__crashpad_handler(int signum, siginfo_t *info, ucontext_t *user_context)
+crashpad_handler(int signum, siginfo_t *info, ucontext_t *user_context)
 {
     sentry__page_allocator_enable();
     sentry__enter_signal_handler();
@@ -540,7 +539,7 @@ crashpad_backend_startup(
     // Initialize database first, flushing the consent later on as part of
     // `sentry_init` will persist the upload flag.
     data->db = crashpad::CrashReportDatabase::Initialize(database).release();
-    data->client = new crashpad::CrashpadClient;
+    data->client = new (std::nothrow) crashpad::CrashpadClient;
     char *minidump_url
         = sentry__dsn_get_minidump_url(options->dsn, options->user_agent);
     if (minidump_url) {
@@ -581,8 +580,7 @@ crashpad_backend_startup(
     }
 
 #if defined(SENTRY_PLATFORM_LINUX) || defined(SENTRY_PLATFORM_WINDOWS)
-    crashpad::CrashpadClient::SetFirstChanceExceptionHandler(
-        &sentry__crashpad_handler);
+    crashpad::CrashpadClient::SetFirstChanceExceptionHandler(&crashpad_handler);
 #endif
 #ifdef SENTRY_PLATFORM_LINUX
     // Crashpad was recently changed to register its own signal stack, which for
@@ -593,7 +591,7 @@ crashpad_backend_startup(
     if (g_signal_stack.ss_sp) {
         g_signal_stack.ss_size = SIGNAL_STACK_SIZE;
         g_signal_stack.ss_flags = 0;
-        sigaltstack(&g_signal_stack, 0);
+        sigaltstack(&g_signal_stack, nullptr);
     }
 #endif
 
@@ -632,9 +630,9 @@ crashpad_backend_shutdown(sentry_backend_t *backend)
 
 #ifdef SENTRY_PLATFORM_LINUX
     g_signal_stack.ss_flags = SS_DISABLE;
-    sigaltstack(&g_signal_stack, 0);
+    sigaltstack(&g_signal_stack, nullptr);
     sentry_free(g_signal_stack.ss_sp);
-    g_signal_stack.ss_sp = NULL;
+    g_signal_stack.ss_sp = nullptr;
 #endif
 }
 
@@ -745,8 +743,8 @@ crashpad_backend_prune_database(sentry_backend_t *backend)
     // large.
     data->db->CleanDatabase(60 * 60 * 24 * 2);
     crashpad::BinaryPruneCondition condition(crashpad::BinaryPruneCondition::OR,
-        new crashpad::DatabaseSizePruneCondition(1024 * 8),
-        new crashpad::AgePruneCondition(2));
+        new (std::nothrow) crashpad::DatabaseSizePruneCondition(1024 * 8),
+        new (std::nothrow) crashpad::AgePruneCondition(2));
     crashpad::PruneCrashReportDatabase(data->db, &condition);
 }
 
@@ -825,12 +823,11 @@ sentry__backend_new(void)
     }
     memset(backend, 0, sizeof(sentry_backend_t));
 
-    auto *data = SENTRY_MAKE(crashpad_state_t);
+    auto *data = new (std::nothrow) crashpad_state_t {};
     if (!data) {
         sentry_free(backend);
         return nullptr;
     }
-    memset(data, 0, sizeof(crashpad_state_t));
     data->scope_flush = false;
     data->crashed = false;