Switch from libbacktrace to gimli

[alexcrichton]

Proposal

Switch the standard library's method of symbolicating addresses in a backtrace from using the C library libbacktrace to the Rust library gimli. The goal is to at a bare minimum maintain feature parity with libbacktrace while enabling future additions such as searching for split debuginfo and more platform support.

While we've wanted to do this for quite some time the devil really is in the details for this proposal. I've created a PR at rust-lang/rust#73441 which I don't intend to get merged as-is but I hope to use to showcase how all this integration is going to hapen. I'm hoping that gives us something concrete to scan over and talk about, so we can make sure that possible points of integration do indeed actually work!

Longer description

Note: this is copied from this PR

This commit is a proof-of-concept for switching the standard library's
backtrace symbolication mechanism on most platforms from libbacktrace to
gimli. The standard library's support for RUST_BACKTRACE=1 requires
in-process parsing of object files and DWARF debug information to
interpret it and print the filename/line number of stack frames as part
of a backtrace.

Historically this support in the standard library has come from a
library called "libbacktrace". The libbacktrace library seems to have
been extracted from gcc at some point and is written in C. We've had a
lot of issues with libbacktrace over time, unfortunately, though. The
library does not appear to be actively maintained since we've had
patches sit for months-to-years without comments. We have discovered a
good number of soundness issues with the library itself, both when
parsing valid DWARF as well as invalid DWARF. This is enough of an issue
that the libs team has previously decided that we cannot feed untrusted
inputs to libbacktrace. This also doesn't take into account the
portability of libbacktrace which has been difficult to manage and
maintain over time. While possible there are lots of exceptions and it's
the main C dependency of the standard library right now.

For years it's been the desire to switch over to a Rust-based solution
for symbolicating backtraces. It's been assumed that we'll be using the
Gimli family of crates for this purpose, which are targeted at safely
and efficiently parsing DWARF debug information. I've been working
recently to shore up the Gimli support in the backtrace crate. As of a
few weeks ago the backtrace crate, by default, uses Gimli when loaded
from crates.io. This transition has gone well enough that I figured it
was time to start talking seriously about this change to the standard
library.

This commit is a preview of what's probably the best way to integrate
the backtrace crate into the standard library with the Gimli feature
turned on. While today it's used as a crates.io dependency, this commit
switches the backtrace crate to a submodule of this repository which
will need to be updated manually. This is not done lightly, but is
thought to be the best solution. The primary reason for this is that the
backtrace crate needs to do some pretty nontrivial filesystem
interactions to locate debug information. Working without std::fs is
not an option, and while it might be possible to do some sort of
trait-based solution when prototyped it was found to be too unergonomic.
Using a submodule allows the backtrace crate to build as a submodule
of the std crate itself, enabling it to use std::fs and such.

Otherwise this adds new dependencies to the standard library. This step
requires extra attention because this means that these crates are now
going to be included with all Rust programs by default. It's important
to note, however, that we're already shipping libbacktrace with all Rust
programs by default and it has a bunch of C code implementing all of
this internally anyway, so we're basically already switching
already-shipping functionality to Rust from C.

• object - this crate is used to parse object file headers and
  contents. Very low-level support is used from this crate and almost
  all of it is disabled. Largely we're just using struct definitions as
  well as convenience methods internally to read bytes and such.

• addr2line - this is the main meat of the implementation for
  symbolication. This crate depends on gimli for DWARF parsing and
  then provides interfaces needed by the backtrace crate to turn an
  address into a filename / line number. This crate is actually pretty
  small (fits in a single file almost!) and mirrors most of what
  dwarf.c does for libbacktrace.

• miniz_oxide - the libbacktrace crate transparently handles
  compressed debug information which is compressed with zlib. This crate
  is used to decompress compressed debug sections.

• gimli - not actually used directly, but a dependency of addr2line.

• adler32- not used directly either, but a dependency of
  miniz_oxide.

The goal of this change is to improve the safety of backtrace
symbolication in the standard library, especially in the face of
possibly malformed DWARF debug information. Even to this day we're still
seeing segfaults in libbacktrace which could possibly become security
vulnerabilities. This change should almost entirely eliminate this
possibility whilc also paving the way forward to adding more features
like split debug information.

Some references for those interested are:

• Original addition of libbacktrace - #12602
• OOM with libbacktrace - #24231
• Backtrace failure due to use of uninitialized value - #28447
• Possibility to feed untrusted data to libbacktrace - #21889
• Soundness fix for libbacktrace - #33729
• Crash in libbacktrace - #39468
• Support for macOS, never merged - Mach-O support ianlancetaylor/libbacktrace#2
• Performance issues with libbacktrace - #29293, #37477
• Update procedure is quite complicated due to how many patches we
  need to carry - #50955
• Libbacktrace doesn't work on MinGW with dynamic libs - #71060
• Segfault in libbacktrace on macOS - #71397

Switching to Rust will not make us immune to all of these issues. The
crashes are expected to go away, but correctness and performance may
still have bugs arise. The gimli and backtrace crates, however, are
actively maintained unlike libbacktrace, so this should enable us to at
least efficiently apply fixes as situations come up.

Mentors or Reviewers

@alexcrichton for mentoring
@Mark-Simulacrum as primary review and @nagisa as secondary (if needed)

Process

The main points of the Major Change Process is as follows:

• File an issue describing the proposal.
• A compiler team member or contributor who is knowledgeable in the area can second by writing @rustbot second.
  • Finding a "second" suffices for internal changes. If however you are proposing a new public-facing feature, such as a -C flag, then full team check-off is required.
  • Compiler team members can initiate a check-off via @rfcbot fcp merge on either the MCP or the PR.
• Once an MCP is seconded, the Final Comment Period begins. If no objections are raised after 10 days, the MCP is considered approved.

You can read more about Major Change Proposals on forge.

Comments

This issue is not meant to be used for technical discussion. There is a Zulip stream for that. Use this issue to leave procedural comments, such as volunteering to review, indicating that you second the proposal (or third, etc), or raising a concern that you would like to be addressed.

[rustbot]

This issue is not meant to be used for technical discussion. There is a Zulip stream for that. Use this issue to leave procedural comments, such as volunteering to review, indicating that you second the proposal (or third, etc), or raising a concern that you would like to be addressed.

[nagisa]

I’m willing to review and second this if nobody else comes forward.

[Mark-Simulacrum]

I'm going to go ahead and formally @rustbot second this proposal. I think it's the right move for us -- for the reasons listed in the detailed summary (thank you!), primarily.

I am also going to try and sign up to help with some of the review bits, though I'll leave that discussion for the PR itself -- seems more appropriate. I've edited the proposal here to indicate as such and also include a note about @nagisa's possible involvement.