runtime: don't crash in exception handler on windows/arm64

[TopperDEL]

I have a quite complex bug but together with @marler8997 we found a workaround.

I tried to get a go-library working on a Hololens 2 via .Net. So I build the library into a dll using the awesome zig-compiler, and then tried to PInvoke into it from C#/.Net. I did all this already successfull on Windows, Linux, MacOs, Android and iOs.

On Hololens, though, my app always crashed whenever the UWP (Universal Windows Platform) DLL came together with the go-runtime. We know found out that Go seems to try to handle an exception thrown from UWP and fails to do so leading to a "badsignal" and an application crash.

@marler8997 helped me with an many in-depth-sessions debugging assembly code and created that patch:
marler8997@f645ec0

May someone with knowledge of the win-arm64-build if this is a good solution or if there might be a better way of doing it? Thank you very much!

What version of Go are you using (go version)?

1.17.6

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

Windows, ARM64, Hololens 2

[ALTree]

cc @cherrymui @mknyszek (my guess)

[marler8997]

This comment from @ianlancetaylor seems very relevant here: #12465 (comment)

This is the Go signal handler receiving a SIGCHLD signal. It's not a problem for getg to return nil in sigtrampgo. That just means that a signal occurred on a non-Go thread.

But this comment contradicts what the sigtramp code is doing. If getg returns nil, sigtramp calls badsignal2 which calls abort causing an AccessViolation. If Ian's comment is still correct today (it was made in 2015) then this is indeed a bug in sigtramp.

My workaround was jut to modify sigtramp to return 0 when getg returns nil (marler8997@f645ec0). On windows this tells the caller that the exception is not handled and to continue to the next handler, which may be the functionality we want here.

It's also interesting to note the naming of this function sigtramp. This is a vestigal to linuxy platforms where programs need to register a special "trampoline" function to make signals work. This is not the case on windows as the "trampoline" functionality is already provided by other means. Instead executables can register callback functions without setting up a trampoline and already has a mechanism to support multiple callbacks and a way to stop/continue through them. The simple solution of returning when getg returns nil may actually be correct on Windows.

Also note that I see arm32 does the same thing here, so if this fix is correct then it should probably go to arm32 as well.

[ianlancetaylor]

SIGCHLD only happens on Unix systems. The Unix sigtramp does correctly handle getg returning nil.

I don't know enough about Windows exceptions off-hand to know whether the same problem occurs. It wouldn't be surprising. The windows-amd64 sigtramp function does appear to handle a nil g.

[marler8997]

Yes the same problem occurs on Windows. On windows rather than signals they call this "Vectored Exception Handling". It's a simple mechanism where the applications can register multiple callbacks which are then called by whatever mechanism Windows uses to capture interrupts and propagate them to userspace. The handler will continue to call each one or stop depending on the return value of the previous call.

What's happening in our case is another library is using exception handling as normal control flow. When the exception occurs it calls go's sigtramp on a thread that go's runtime doesn't know about and viola, here we are.

[gopherbot]

Change https://go.dev/cl/442896 mentions this issue: runtime: ignore exceptions from non-Go threads on windows arm/arm64

[qmuntal]

Thanks for reporting this issue @TopperDEL @marler8997.

I've been investigating it and get to the same conclusion as you: we should ignore exceptions coming from non-Go threads instead of calling badsignal2, which is inline with what's happening on windows amd64 and 386.

[TopperDEL]

Thanks for the update! The finding goes to @marler8997 and I'm still very thankfull for that!
As I don't know how the process is: do you know when that fix might be released?

[ALTree]

@TopperDEL The change linked above is under review (with a comment from Alex). After that comment is addressed, it could be merged (unless other issues arise). If it is merged, it'll be included in the next Go release (Go 1.20), scheduled for February 2023.

Serious issues with no workarounds can be backported to a minor release. If that happens, the fix will also be available in the next 1.19 minor release (could be 1.19.3 or later). These are done roughly every month.

[TopperDEL]

Thank you very much for that info!

[marler8997]

@qmuntal any reason why my commit (marler8997@f645ec0) was not included in the one that was merged (6fe3ccd)? This commit was the result of many hours of work that spanned the course of a year, but, now my authorship is now gone from the commit history because you took my changes and incorporated them into your own commit.

[qmuntal]

now my authorship is now gone from the commit history because you took my changes and incorporated them into your own commit.

To be clear, I did not incorporate your changes into my commit, I didn't even read the discussions in this issue.

I've recently gone through Windows sigtramp many times due to CL 431775 and CL 442216 and I already knew arm64 had this issue, and the solution is quite trivial once you understand Go assembly (which is nit trivial at all!). Yet, I have to admit I took the g_ok label name once I saw it, as it was cleaner than what I had (BNE 6(PC)).

Having said this, I hope you trust me when I said I did not act in bad faith. I could have done a better job by either asking you to submit your change or adding you as a co-author, but I didn't, and I'm sorry for that. Will take this a s a lesson.

[marler8997]

To be clear, I did not incorporate your changes into my commit, I didn't even read the discussions in this issue.

Ok fair enough. The changes looks almost exactly the same but I see there's a couple differences now that I look more closely.

I had submitted this change back in January https://go-review.googlesource.com/c/go/+/381775#message-d3c3fc570adf49bb93dd96a011a1d2d20b6fa21a

But, I remember there was a concern about the solution that I was going to try to look into but never came back to it. It was something about trying to tell whether the TLS was initialized or not when g was nil? You can find it in the linked discussion thread if you're interested.

Anyway, I normally wouldn't care about a 7 line change, but, this is a result of dozens of hours of work over the coarse of a year so I'm a little bummed I won't get any credit in the git commit history, but, sounds like you came up with the change on your own without my help so fair is fair.

[TopperDEL]

I can only thank you both for fixing a bug in a world where I don't know anything about. :)

[qmuntal]

I had submitted this change back in January https://go-review.googlesource.com/c/go/+/381775#message-d3c3fc570adf49bb93dd96a011a1d2d20b6fa21a

That CL does not link to this issue but to 43800, probably by mistake, so gerritbot did not create the appropriate link and I couldn't know it was there. Unfortunate.

But, I remember there was a concern about the solution that I was going to try to look into but never came back to it. It was something about trying to tell whether the TLS was initialized or not when g was nil? You can find it in the linked discussion thread if you're interested.

I made a conscious decision to not special-case uninitialized TLS and I was even going to submit a CL removing that from amd64 and 386, as seemed to me that that branch is not reachable (see #8224 (comment) for more discussion on this). But given the conversations that you linked, I might be wrong and will have to reconsider.

Edit: sigtramp callback is set in initExceptionHandler, which is called from osinit and always after wintls. This means TLS can't be uninitialized when reaching sigtramp, unless there is a sever runtime bug. In any case, calling badsignal2 is not a good solution, as the problem wouldn't be a bad signal, but an error initialization the runtime.

[gopherbot]

Change https://go.dev/cl/463116 mentions this issue: runtime: remove unused badsignal2 on windows