Use sigsetjmp/siglongjmp instead of setjmp/longjmp

ddprof-lib/src/main/cpp/counters.h

@@ -149,10 +149,10 @@
 #endif
 
 // Fault-injection + debug only: faults injected while the current thread was
-// NOT inside a walkVM longjmp-protected region. Such a site relies solely on
+// NOT inside a walkVM siglongjmp-protected region. Such a site relies solely on
 // safefetch (or would genuinely crash if the poisoned pointer is raw-dereferenced
 // outside any recovery), so a non-zero value flags injection sites that are not
-// covered by longjmp protection. Compiled in only when both __FAULT_INJECTION__
+// covered by siglongjmp protection. Compiled in only when both __FAULT_INJECTION__
 // and DEBUG are defined.
 #if defined(__FAULT_INJECTION__) && defined(DEBUG)
 #define DD_COUNTER_TABLE_FI_DEBUG(X) \
@@ -162,7 +162,7 @@
 #endif
 
 // Debug-only counters: SafeAccess reads/copies issued while the thread is
-// already inside a walkVM longjmp-protected region (redundant safefetch
+// already inside a walkVM siglongjmp-protected region (redundant safefetch
 // overhead). Not compiled into release builds at all, so they occupy no enum
 // slot and add no storage there.
 #ifdef DEBUG

ddprof-lib/src/main/cpp/faultInjection.cpp

@@ -89,7 +89,7 @@ bool shouldFire(u64 threshold, const char* fn) {
  // place that counts an actually-injected fault.
  Counters::increment(FAULTS_INJECTED);
 #ifdef DEBUG
- // Flag injections fired at a site with no walkVM longjmp protection active:
+ // Flag injections fired at a site with no walkVM siglongjmp protection active:
  // recovery there depends entirely on safefetch, and a raw deref would crash.
  ProfiledThread* t = ProfiledThread::current(); // never allocates
  if (t == nullptr || !t->isProtected()) {

ddprof-lib/src/main/cpp/faultInjection.h

@@ -20,7 +20,7 @@
 // site (VMStructs::at, walkVM, walkFP, walkDwarf). When __FAULT_INJECTION__ is
 // defined, each wrapped expression, with the tier's probability, is replaced by
 // a deliberately bad address (so the load faults and the profiler's recovery
-// path — SafeAccess safefetch or walkVM's setjmp/longjmp — is exercised) or a
+// path — SafeAccess safefetch or walkVM's sigsetjmp/siglongjmp — is exercised) or a
 // random int/long value. When the flag is NOT defined, every macro is a strict
 // identity: it expands to exactly the parenthesized original expression, with
 // unchanged type and value category and zero runtime cost.

ddprof-lib/src/main/cpp/guards.h

@@ -90,14 +90,14 @@ class SignalHandlerScope {
 #define SIGNAL_HANDLER_GUARD() SignalHandlerScope _signal_handler_scope
 
 // Manually release the most recent SIGNAL_HANDLER_GUARD() before chaining to
-// another handler that may longjmp through us (e.g. J9's SIGSEGV null-pointer
+// another handler that may siglongjmp through us (e.g. J9's SIGSEGV null-pointer
 // check handler). After release(), depth has already been decremented; the
 // destructor becomes a no-op.
 #define SIGNAL_HANDLER_GUARD_RELEASE() _signal_handler_scope.release()
 
-// Compensate for a longjmp that bypassed a SignalHandlerScope's destructor.
-// Call at the setjmp landing point AFTER a known longjmp originated from
-// within a signal handler frame (e.g. HotSpot's checkFault → longjmp recovery
+// Compensate for a siglongjmp that bypassed a SignalHandlerScope's destructor.
+// Call at the sigsetjmp landing point AFTER a known siglongjmp originated from
+// within a signal handler frame (e.g. HotSpot's checkFault → siglongjmp recovery
 // in walkVM).
 void signalHandlerUnwindAfterLongjmp();
 #define SIGNAL_HANDLER_UNWIND_AFTER_LONGJMP() signalHandlerUnwindAfterLongjmp()

ddprof-lib/src/main/cpp/hotspot/hotspotSupport.cpp

@@ -248,19 +248,19 @@ __attribute__((no_sanitize("address"))) int HotspotSupport::walkVM(void* ucontex
  int bcp_offset = InterpreterFrame::bcp_offset();
 
 
-jmp_buf crash_protection_ctx;
- // Chaining jmp_buf
+sigjmp_buf crash_protection_ctx;
+ // Chaining sigjmp_buf
  // A non-signal-based-sampler can be interrupted by signal based sampler,
  // then we end up with multiple HotspotSupport::walkVM() calls on stack,
- // each one sets up jmp_buf, they need to be chained to jump back to
+ // each one sets up sigjmp_buf, they need to be chained to jump back to
  // correct location.
-jmp_buf* prev_jmp_buf = prof_thread->getJmpCtx();
- // Should be preserved across setjmp/longjmp
+sigjmp_buf* prev_jmp_buf = prof_thread->getJmpCtx();
+ // Should be preserved across sigsetjmp/siglongjmp
  volatile int depth = 0;
  int actual_max_depth = truncated ? max_depth + 1 : max_depth;
 
- if (setjmp(crash_protection_ctx) != 0) {
- // checkFault() does a longjmp from inside segvHandler, bypassing
+ if (sigsetjmp(crash_protection_ctx, 1) != 0) {
+ // checkFault() does a siglongjmp from inside segvHandler, bypassing
  // segvHandler's SignalHandlerScope destructor. Compensate.
  SIGNAL_HANDLER_UNWIND_AFTER_LONGJMP();
  prof_thread->setJmpCtx(prev_jmp_buf);
@@ -378,7 +378,7 @@ __attribute__((no_sanitize("address"))) int HotspotSupport::walkVM(void* ucontex
  }
  // entry_fp has been range-checked by isValidFP above; any remaining
  // SIGSEGV from a stale/concurrently-freed pointer is caught by the
- // setjmp crash protection in walkVM (checkFault -> longjmp).
+ // sigsetjmp crash protection in walkVM (checkFault -> siglongjmp).
  uintptr_t* carrier_fp_addr = (uintptr_t*)INJECT_FAULT_ADDRESS_UNLIKELY(entry_fp);
  uintptr_t carrier_fp = *carrier_fp_addr;
  const void* carrier_pc = ((const void**)carrier_fp_addr)[FRAME_PC_SLOT];
@@ -414,8 +414,8 @@ __attribute__((no_sanitize("address"))) int HotspotSupport::walkVM(void* ucontex
  // while PC is still in JVM stubs (JavaCalls, method entry/exit), we see CodeHeap
  // code without VMThread context.
  //
- // Without vm_thread, crash protection via setjmp/longjmp cannot work
- // (checkFault() needs vm_thread->exception() to longjmp). Any memory dereference in interpreter
+ // Without vm_thread, crash protection via sigsetjmp/siglongjmp cannot work
+ // (checkFault() needs vm_thread->exception() to siglongjmp). Any memory dereference in interpreter
  // frame handling or NMethod validation would crash the process with unrecoverable SEGV.
  //
  // The missing VMThread is a timing issue during thread lifecycle.
@@ -984,14 +984,14 @@ void HotspotSupport::checkFault(ProfiledThread* thrd) {
  return;
  }
 
- // Check if longjmp is setup for this thread
+ // Check if siglongjmp is set up for this thread
  if (!thrd->isProtected()) {
  return;
  }
 
  thrd->resetCrashHandler();
  Counters::increment(WALKVM_LONGJMP_RECOVERED);
-longjmp(*thrd->getJmpCtx(), 1);
+siglongjmp(*thrd->getJmpCtx(), 1);
 }
 
 int HotspotSupport::getJavaTraceAsync(void *ucontext, ASGCT_CallFrame *frames,

ddprof-lib/src/main/cpp/hotspot/vmStructs.h

@@ -33,11 +33,11 @@ class VMNMethod;
 // During stack walking in the profiler's signal handler, GC or class unloading
 // on another thread can free VMNMethod/VMMethod memory concurrently, making
 // pointers stale between the readability check and the actual dereference.
-// In release builds the setjmp/longjmp crash protection in walkVM catches the
+// In release builds the sigsetjmp/siglongjmp crash protection in walkVM catches the
 // resulting SIGSEGV. In debug builds the assert(isReadable) fires first,
 // sending SIGABRT which is uncatchable by crash protection.
 // When crash protection is active the assert is redundant — any bad read will
-// be caught by the SIGSEGV handler and recovered via longjmp — so we skip it.
+// be caught by the SIGSEGV handler and recovered via siglongjmp — so we skip it.
 //
 // Defined at the bottom of this file after VMThread is declared so that the
 // VMThread fallback path (isExceptionActive) is accessible without forward-

ddprof-lib/src/main/cpp/profiler.cpp

@@ -927,23 +927,23 @@ void Profiler::disableEngines() {
 void Profiler::segvHandler(int signo, siginfo_t *siginfo, void *ucontext) {
  // J9 installs a SIGSEGV handler that uses siglongjmp() to recover from
  // null-pointer-check faults during normal Java execution. When we chain to
- // it, that longjmp unwinds past our stack frame and skips the RAII
+ // it, that siglongjmp unwinds past our stack frame and skips the RAII
  // destructor, permanently leaking depth on the thread. Release the guard
  // before chaining so depth is correct whether the chained handler returns
- // or longjmps.
+ // or siglongjmps.
  //
  // Sanitizer-coverage note: this also means depth == 0 inside the chained
  // handler, so DEBUG_ASSERT_NOT_IN_SIGNAL() will NOT fire for AS-unsafe
  // code reachable from a chained handler that returns normally. This is
- // the lesser of two evils — leaking depth on longjmp would silently
+ // the lesser of two evils — leaking depth on siglongjmp would silently
  // break the production deferred-refresh gate, while the sanitizer gap
  // is bounded to third-party signal handler code we don't own.
  SIGNAL_HANDLER_GUARD();
  if (crashHandlerInternal(signo, siginfo, ucontext)) {
  return; // Handled — destructor decrements depth
  }
  SIGNAL_HANDLER_GUARD_RELEASE();
- // Not handled, chain to next handler (may longjmp; never return through us)
+ // Not handled, chain to next handler (may siglongjmp; never return through us)
  SigAction chain = OS::getSegvChainTarget();
  if (chain != nullptr) {
  chain(signo, siginfo, ucontext);
@@ -954,7 +954,7 @@ void Profiler::segvHandler(int signo, siginfo_t *siginfo, void *ucontext) {
 
 void Profiler::busHandler(int signo, siginfo_t *siginfo, void *ucontext) {
  // See segvHandler: release before chaining in case the chained handler
- // longjmps through us.
+ // siglongjmps through us.
  SIGNAL_HANDLER_GUARD();
  if (crashHandlerInternal(signo, siginfo, ucontext)) {
  return; // Handled — destructor decrements depth
@@ -982,7 +982,7 @@ int Profiler::crashHandlerInternal(int signo, siginfo_t *siginfo, void *ucontext
 
  // Reentrancy protection: use TLS-based tracking if available.
  // If TLS is not available, the thread is not protected by
- // longjmp, so bail out.
+ // siglongjmp, so bail out.
  bool have_tls_protection = false;
  if (thrd != nullptr) {
  if (!thrd->enterCrashHandler()) {
@@ -1015,7 +1015,7 @@ int Profiler::crashHandlerInternal(int signo, siginfo_t *siginfo, void *ucontext
  // the following checks require vmstructs and therefore HotSpot
 
  // HotspotSupport::checkFault has its own check if we're in a protected stack walk.
- // If the fault is from our protected walk, it will longjmp and never return.
+ // If the fault is from our protected walk, it will siglongjmp and never return.
  // If it returns, the fault wasn't from our code.
  HotspotSupport::checkFault(thrd);
 

ddprof-lib/src/main/cpp/safeAccess.h

@@ -119,9 +119,9 @@ class SafeAccess {
 #ifdef DEBUG
 private:
  // Debug diagnostic: bump a counter when a SafeAccess read/copy is issued while
- // the current thread is already inside a walkVM longjmp-protected region, where
+ // the current thread is already inside a walkVM siglongjmp-protected region, where
  // the safefetch/safecopy overhead is redundant (a fault there is caught by the
- // longjmp anyway). Defined out-of-line in safeAccess.cpp so this widely-included
+ // siglongjmp anyway). Defined out-of-line in safeAccess.cpp so this widely-included
  // header need not pull in threadLocalData.h / counters.h. isCopy selects the
  // SAFECOPY_WHILE_PROTECTED vs SAFEFETCH_WHILE_PROTECTED counter.
  static void countIfLongjmpProtected(bool isCopy);

ddprof-lib/src/main/cpp/threadLocalData.h

@@ -58,12 +58,12 @@ class ProfiledThread : public ThreadLocalData {
  static void freeValue(void* value);
 
  static ThreadLocal<ProfiledThread*, nullptr, freeValue> _current_thread;
- // longjmp buffer. Used by hotspot only at this moment.
+ // siglongjmp buffer. Used by hotspot only at this moment.
  // Published in walkVM() and consumed in checkFault() from an asynchronous
  // SEGV-handler context on the same thread; atomic makes the publish/observe
  // ordering explicit instead of relying on plain load/store, matching how
  // _crash_depth is hardened below.
- std::atomic<jmp_buf*> _jmp_buf;
+ std::atomic<sigjmp_buf*> _jmp_buf;
 
  u64 _pc;
  u64 _sp;
@@ -238,11 +238,11 @@ class ProfiledThread : public ThreadLocalData {
  return __atomic_load_n(&_crash_depth, __ATOMIC_RELAXED) > CRASH_HANDLER_NESTING_LIMIT;
  }
 
- inline void setJmpCtx(jmp_buf* buf) {
- _jmp_buf = buf;
+ inline void setJmpCtx(sigjmp_buf* buf) {
+ _jmp_buf = buf;
  }
 
- inline jmp_buf* getJmpCtx() const {
+ inline sigjmp_buf* getJmpCtx() const {
  return _jmp_buf;
  }
 

ddprof-lib/src/test/cpp/faultInjection_ut.cpp

@@ -51,7 +51,7 @@ TEST(FaultInjectionTest, DisabledValueMacrosAreIdentity) {
 
 #else // __FAULT_INJECTION__ enabled (built under -PenableFaultInjection)
 
-// Chain: safefetch recovery first, then walkVM setjmp/longjmp recovery, then
+// Chain: safefetch recovery first, then walkVM sigsetjmp/siglongjmp recovery, then
 // the crash handler as a last resort so a genuine bug still produces a report.
 static void (*orig_segvHandler)(int, siginfo_t*, void*);
 static void (*orig_busHandler)(int, siginfo_t*, void*);
@@ -60,7 +60,7 @@ static void fi_signal_wrapper(int signo, siginfo_t* siginfo, void* context) {
  if (SafeAccess::handle_safefetch(signo, context)) {
  return; // safefetch load recovered; PC already rewritten to _cont.
  }
- HotspotSupport::checkFault(ProfiledThread::current()); // longjmp if protected
+ HotspotSupport::checkFault(ProfiledThread::current()); // siglongjmp if protected
  // Not protected and not a safefetch fault — real crash.
  if (signo == SIGBUS && orig_busHandler != nullptr) {
  orig_busHandler(signo, siginfo, context);
@@ -144,8 +144,8 @@ TEST_F(FaultInjectionTest, SafeAccessRecoversFromInjectedFault) {
 }
 
 // (c2) walkVM path: a raw dereference of an injected poison pointer must be
-// caught by the setjmp/longjmp crash protection, returning control to setjmp.
-TEST_F(FaultInjectionTest, WalkVmSetjmpRecoversFromInjectedFault) {
+// caught by the sigsetjmp/siglongjmp crash protection, returning control to sigsetjmp.
+TEST_F(FaultInjectionTest, WalkVmSigsetjmpRecoversFromInjectedFault) {
  ProfiledThread* t = ProfiledThread::current();
  ASSERT_NE(t, nullptr);
 
@@ -155,9 +155,9 @@ TEST_F(FaultInjectionTest, WalkVmSetjmpRecoversFromInjectedFault) {
  volatile size_t reads = 0;
  volatile size_t faults = 0;
 
-jmp_buf ctx;
- if (setjmp(ctx) != 0) {
- recovered = true; // returned here via checkFault -> longjmp
+sigjmp_buf ctx;
+ if (sigsetjmp(ctx, 1) != 0) {
+ recovered = true; // returned here via checkFault -> siglongjmp
  faults++;
  }
  t->setJmpCtx(&ctx);
@@ -174,8 +174,8 @@ TEST_F(FaultInjectionTest, WalkVmSetjmpRecoversFromInjectedFault) {
 
  // We should have observed a recovered fault, or the loop completed cleanly. The
  // essential assertion is that the process did not die and, when a fault was
- // injected, setjmp regained control.
- EXPECT_GT(faults, 0u) << "expected at least one injected fault to longjmp-recover";
+ // injected, sigsetjmp regained control.
+ EXPECT_GT(faults, 0u) << "expected at least one injected fault to siglongjmp-recover";
  EXPECT_TRUE(recovered);
  SUCCEED();
 }