v7

Author: zhengyu123

ddprof-lib/src/main/cpp/hotspot/hotspotSupport.cpp

@@ -182,8 +182,6 @@ __attribute__((no_sanitize("address"))) int HotspotSupport::walkVM(void* ucontex
     bool fp_chain_fallback = false;
     int fp_chain_depth = 0;
 
-    ProfiledThread* profiled_thread = ProfiledThread::currentSignalSafe();
-
     _jmp_ctx.set(&crash_protection_ctx);
     if (setjmp(crash_protection_ctx) != 0) {
         // checkFault() does a longjmp from inside segvHandler, bypassing

ddprof-lib/src/main/cpp/thread.h

@@ -28,14 +28,11 @@ class ProfiledThread : public ThreadLocalData {
     TYPE_MASK = TYPE_JAVA_THREAD | TYPE_NOT_JAVA_THREAD
   };
 
-private:
-  // We are allowing several levels of nesting because we can be
-  // eg. in a crash handler when wallclock signal kicks in,
-  // catching sigseg while also triggering CPU signal handler
-  // which would also potentially trigger sigseg we need to handle.
-  // This means 3 levels but we allow for some wiggling space, just in case.
-  // Even with 5 levels cap we will need any highly recursing signal handlers
+  // Maximum number of nested crash-handler invocations allowed on a single
+  // thread.  Exposed publicly so unit tests can loop to the limit precisely.
   static constexpr u32 CRASH_HANDLER_NESTING_LIMIT = 5;
+
+private:
   static pthread_key_t _tls_key;
   static bool _tls_key_initialized;
 

ddprof-lib/src/test/cpp/hotspot_crash_protection_ut.cpp

@@ -2,43 +2,41 @@
  * Copyright 2026 Datadog, Inc.
  * SPDX-License-Identifier: Apache-2.0
  *
- * Unit tests for the MonitorDeflationThread crash-protection gate.
+ * Unit tests for the crash-protection and thread-classification mechanisms
+ * used by HotspotSupport::walkVM().
  *
- * Root cause (JDK 25.0.2): walkVM() unconditionally wrote a jmp_buf address
- * into ThreadShadow::_exception_file for every non-null VMThread, including
- * JVM-internal threads like MonitorDeflationThread.  In JDK 25,
- * ObjectMonitorDeflationSafepointer reads _exception_file at safepoint
- * boundaries; a stale jmp_buf address caused a crash in deflate_monitor_list.
+ * Background: profiling signals can interrupt any JVM thread — including
+ * JVM-internal threads such as MonitorDeflationThread.  walkVM must never
+ * dereference JavaThread-only fields (anchor, vframe_top, …) on such threads.
+ * VMThread::isJavaThread() provides the gate.
  *
- * Fix: gate the write on `VMThread::isJavaThread(vm_thread)`.
+ * Crash recovery inside walkVM relies on setjmp/longjmp:
+ *   1. walkVM stores a jmp_buf* in HotspotSupport::_jmp_ctx (thread-local).
+ *   2. If a fault fires during the walk, checkFault() detects the live context
+ *      via isThreadProtectedByLongjmp() and calls longjmp() to unwind.
+ *   3. ProfiledThread tracks nested crash-handler depth so recursive faults
+ *      (e.g. wall-clock signal inside a crash handler) are capped safely.
  *
- * `isJavaThread()` has two paths:
- *  1. Fast path  — reads the cached ProfiledThread::ThreadType set by the
- *                  JVMTI ThreadStart callback (TYPE_JAVA_THREAD /
- *                  TYPE_NOT_JAVA_THREAD).
- *  2. Slow path  — falls back to the vtable majority vote in
- *                  VMThread::hasJavaThreadVtable(): at least 2 of the 3
- *                  selected vtable entries (indices 1, 3, 5) must match
- *                  those of a known JavaThread captured at profiler start.
- *
- * Tests here cover:
- *  A. ProfiledThread classification (fast path) — setJavaThread / threadType.
- *  B. Vtable majority-vote logic (slow path)    — replicated inline as a
- *     whitebox test because hasJavaThreadVtable() is private.
- *  C. setup_crash_protection gate condition     — the boolean that walkVM
- *     uses to decide whether to touch _exception_file.
+ * Tests cover:
+ *   A. ProfiledThread thread-type classification (isJavaThread fast path)
+ *   B. Vtable majority-vote logic (isJavaThread slow path)
+ *   C. Crash-handler nesting depth (ProfiledThread crash handler state)
+ *   D. Longjmp-protection state via HotspotSupport public API
  */
 
 #include <gtest/gtest.h>
 #include "thread.h"
+#include "hotspot/hotspotSupport.h"
 
 #ifdef __linux__
 
-#include <pthread.h>
 #include <cstring>
 
 // ---------------------------------------------------------------------------
-// A. ProfiledThread thread-type classification (fast path of isJavaThread)
+// A. ProfiledThread thread-type classification (isJavaThread fast path)
+//
+// JVMTI ThreadStart callbacks call setJavaThread(true/false) to cache the
+// result; isJavaThread() returns it directly without touching the vtable.
 // ---------------------------------------------------------------------------
 
 class ProfiledThreadTypeTest : public ::testing::Test {
@@ -56,26 +54,22 @@ class ProfiledThreadTypeTest : public ::testing::Test {
     ProfiledThread* _pt = nullptr;
 };
 
-// A fresh ProfiledThread carries TYPE_UNKNOWN until explicitly classified.
+// A fresh ProfiledThread is not yet classified.
 TEST_F(ProfiledThreadTypeTest, InitialStateIsUnknown) {
     EXPECT_EQ(ProfiledThread::TYPE_UNKNOWN, _pt->threadType());
 }
 
-// After being marked as a Java thread the type is TYPE_JAVA_THREAD.
 TEST_F(ProfiledThreadTypeTest, MarkAsJavaThreadSetsCorrectType) {
     _pt->setJavaThread(true);
     EXPECT_EQ(ProfiledThread::TYPE_JAVA_THREAD, _pt->threadType());
 }
 
-// After being marked as a non-Java thread (e.g. MonitorDeflationThread) the
-// type is TYPE_NOT_JAVA_THREAD, which makes isJavaThread() return false and
-// prevents walkVM from writing _exception_file.
+// MonitorDeflationThread and similar JVM-internal threads are marked false.
 TEST_F(ProfiledThreadTypeTest, MarkAsNonJavaThreadSetsCorrectType) {
     _pt->setJavaThread(false);
     EXPECT_EQ(ProfiledThread::TYPE_NOT_JAVA_THREAD, _pt->threadType());
 }
 
-// Reclassification works: a thread initially marked Java can be reclassified.
 TEST_F(ProfiledThreadTypeTest, ReclassificationFromJavaToNonJava) {
     _pt->setJavaThread(true);
     EXPECT_EQ(ProfiledThread::TYPE_JAVA_THREAD, _pt->threadType());
@@ -84,44 +78,35 @@ TEST_F(ProfiledThreadTypeTest, ReclassificationFromJavaToNonJava) {
     EXPECT_EQ(ProfiledThread::TYPE_NOT_JAVA_THREAD, _pt->threadType());
 }
 
-// The fast-path short-circuit: if threadType() != TYPE_UNKNOWN,
-// isJavaThread() returns it directly without consulting the vtable.
-// Verify the logic isJavaThread() uses:
-//   type != TYPE_UNKNOWN  →  return type == TYPE_JAVA_THREAD
-TEST_F(ProfiledThreadTypeTest, FastPathLogicForJavaThread) {
+// Replicate the fast-path branch used by isJavaThread():
+//   if (type != TYPE_UNKNOWN) return type == TYPE_JAVA_THREAD;
+TEST_F(ProfiledThreadTypeTest, FastPathReturnsTrueForJavaThread) {
     _pt->setJavaThread(true);
     ProfiledThread::ThreadType type = _pt->threadType();
-    bool fast_path_result = (type != ProfiledThread::TYPE_UNKNOWN)
-                          && (type == ProfiledThread::TYPE_JAVA_THREAD);
-    EXPECT_TRUE(fast_path_result);
+    bool result = (type != ProfiledThread::TYPE_UNKNOWN)
+               && (type == ProfiledThread::TYPE_JAVA_THREAD);
+    EXPECT_TRUE(result);
 }
 
-TEST_F(ProfiledThreadTypeTest, FastPathLogicForNonJavaThread) {
+TEST_F(ProfiledThreadTypeTest, FastPathReturnsFalseForNonJavaThread) {
     _pt->setJavaThread(false);
     ProfiledThread::ThreadType type = _pt->threadType();
-    bool fast_path_result = (type != ProfiledThread::TYPE_UNKNOWN)
-                          && (type == ProfiledThread::TYPE_JAVA_THREAD);
-    EXPECT_FALSE(fast_path_result);
+    bool result = (type != ProfiledThread::TYPE_UNKNOWN)
+               && (type == ProfiledThread::TYPE_JAVA_THREAD);
+    EXPECT_FALSE(result);
 }
 
 // ---------------------------------------------------------------------------
-// B. Vtable majority-vote logic (slow path of hasJavaThreadVtable)
+// B. Vtable majority-vote logic (isJavaThread slow path via hasJavaThreadVtable)
 //
-// VMThread::hasJavaThreadVtable() compares vtable entries at indices 1, 3, 5
-// against _java_thread_vtbl[1/3/5] and returns true when >= 2 match.
-// This ensures a MonitorDeflationThread (which is a JavaThread subclass but
-// has its own vtable) is correctly classified as a non-Java thread.
-//
-// We replicate the vote logic here as a whitebox unit test, keeping it in
-// sync with the comment in vmStructs.inline.h.
+// hasJavaThreadVtable() compares vtable entries at indices 1, 3, 5 against
+// _java_thread_vtbl[] captured from a known JavaThread at profiler start.
+// At least 2 of 3 must match — tolerating product-vs-debug vtable variation.
 // ---------------------------------------------------------------------------
 
 namespace {
 
-// Simulate the 2-of-3 majority vote performed by hasJavaThreadVtable().
-// Arguments:
-//   thread_vtbl  – vtable pointer array of the candidate thread
-//   known_vtbl   – _java_thread_vtbl captured from a real JavaThread
+// Replicates the 2-of-3 vote in hasJavaThreadVtable().
 static bool vtableVote(void** thread_vtbl, void** known_vtbl) {
     int matches = (thread_vtbl[1] == known_vtbl[1])
                 + (thread_vtbl[3] == known_vtbl[3])
@@ -133,74 +118,72 @@ static bool vtableVote(void** thread_vtbl, void** known_vtbl) {
 
 class VtableVoteTest : public ::testing::Test {
 protected:
-    // Sentinel vtable entries used as the "known JavaThread vtable".
     void* known[8] = {
         (void*)0x1000, (void*)0x1001, (void*)0x1002,
         (void*)0x1003, (void*)0x1004, (void*)0x1005,
         (void*)0x1006, (void*)0x1007
     };
 
-    // A thread vtable that exactly matches `known`.
+    // Identical to `known` — a real JavaThread.
     void* same[8] = {
         (void*)0x1000, (void*)0x1001, (void*)0x1002,
         (void*)0x1003, (void*)0x1004, (void*)0x1005,
         (void*)0x1006, (void*)0x1007
     };
 
-    // A thread vtable that shares no entries with `known`
-    // (simulates MonitorDeflationThread or another JVM-internal thread).
+    // Completely different — MonitorDeflationThread or other JVM-internal thread.
     void* different[8] = {
         (void*)0x2000, (void*)0x2001, (void*)0x2002,
         (void*)0x2003, (void*)0x2004, (void*)0x2005,
         (void*)0x2006, (void*)0x2007
     };
 };
 
-// Exact match (3/3) → java thread.
 TEST_F(VtableVoteTest, ExactMatchIsJavaThread) {
     EXPECT_TRUE(vtableVote(same, known));
 }
 
-// Zero matches → not a java thread (MonitorDeflationThread case).
 TEST_F(VtableVoteTest, NoMatchIsNotJavaThread) {
     EXPECT_FALSE(vtableVote(different, known));
 }
 
-// Exactly 2 matches → still a java thread (handles product vs. debug JVM).
+// 2/3 match — handles product vs. debug JVM where one entry differs.
 TEST_F(VtableVoteTest, TwoMatchesIsJavaThread) {
     void* partial[8];
     memcpy(partial, same, sizeof(partial));
-    // Corrupt one of the three checked entries (index 1).
-    partial[1] = (void*)0xDEAD;
+    partial[1] = (void*)0xDEAD;  // corrupt one of the three checked entries
     EXPECT_TRUE(vtableVote(partial, known));
 }
 
-// Exactly 1 match → not a java thread.
 TEST_F(VtableVoteTest, OneMatchIsNotJavaThread) {
     void* partial[8];
     memcpy(partial, different, sizeof(partial));
-    // Give it one real entry (index 3) to stay below the threshold.
-    partial[3] = known[3];
+    partial[3] = known[3];  // one real entry — still below threshold
     EXPECT_FALSE(vtableVote(partial, known));
 }
 
-// All zeros (uninitialized _java_thread_vtbl before profiler attaches) →
-// a thread whose own vtable is also all-zero scores 3/3 but that cannot
-// happen in practice because NULL vtable entries dereference to nothing.
-// More practically: a non-zero vtable against an all-zero reference → 0/3.
-TEST_F(VtableVoteTest, UninitializedReferenceVtableGivesNoMatches) {
-    void* zero_ref[8] = {};  // _java_thread_vtbl not yet initialized
+// _java_thread_vtbl not yet initialised (profiler just attached): any real
+// thread vtable scores 0/3 against an all-zero reference.
+TEST_F(VtableVoteTest, UninitializedReferenceGivesNoMatches) {
+    void* zero_ref[8] = {};
     EXPECT_FALSE(vtableVote(same, zero_ref));
 }
 
 // ---------------------------------------------------------------------------
-// C. setup_crash_protection gate condition
+// C. Crash-handler nesting depth
+//
+// ProfiledThread tracks how many crash-handler invocations are active on this
+// thread so recursive signals (wall-clock arriving inside a crash handler)
+// are capped at CRASH_HANDLER_NESTING_LIMIT.
 //
-// walkVM computes: setup_crash_protection = (vm_thread != NULL) && isJavaThread()
-// Verify that the gate is false for TYPE_NOT_JAVA_THREAD threads (fast path).
+// Profiler::crashHandlerInternal calls:
+//   enterCrashHandler()   — on entry, returns false if limit reached
+//   exitCrashHandler()    — on normal exit
+//   resetCrashHandler()   — from checkFault before longjmp to unwind all
+//                           nesting at once
 // ---------------------------------------------------------------------------
 
-class CrashProtectionGateTest : public ::testing::Test {
+class CrashHandlerNestingTest : public ::testing::Test {
 protected:
     void SetUp() override {
         ProfiledThread::initCurrentThread();
@@ -213,43 +196,88 @@ class CrashProtectionGateTest : public ::testing::Test {
     }
 
     ProfiledThread* _pt = nullptr;
+};
+
+TEST_F(CrashHandlerNestingTest, InitialDepthAllowsEntry) {
+    EXPECT_TRUE(_pt->enterCrashHandler());
+    _pt->exitCrashHandler();
+}
 
-    // Replicate the fast-path of isJavaThread() for gating purposes.
-    static bool fastPathIsJavaThread(ProfiledThread* pt) {
-        if (pt == nullptr) return false;
-        ProfiledThread::ThreadType type = pt->threadType();
-        if (type != ProfiledThread::TYPE_UNKNOWN) {
-            return type == ProfiledThread::TYPE_JAVA_THREAD;
-        }
-        return false; // TYPE_UNKNOWN → slow vtable path (not tested here)
+TEST_F(CrashHandlerNestingTest, ExitDecrements) {
+    _pt->enterCrashHandler();
+    _pt->exitCrashHandler();
+    // After a balanced enter/exit, another enter should still succeed.
+    EXPECT_TRUE(_pt->enterCrashHandler());
+    _pt->exitCrashHandler();
+}
+
+// At the nesting limit enterCrashHandler returns false to prevent runaway recursion.
+TEST_F(CrashHandlerNestingTest, LimitBlocksFurtherEntry) {
+    for (u32 i = 0; i < ProfiledThread::CRASH_HANDLER_NESTING_LIMIT; i++) {
+        EXPECT_TRUE(_pt->enterCrashHandler()) << "entry " << i << " should succeed";
     }
-};
+    EXPECT_FALSE(_pt->enterCrashHandler()) << "entry at limit should fail";
 
-// Gate is off for a JVM-internal thread (TYPE_NOT_JAVA_THREAD):
-// _exception_file must NOT be written.
-TEST_F(CrashProtectionGateTest, GateOffForNonJavaThread) {
-    _pt->setJavaThread(false);
-    // Simulate: vm_thread != NULL (non-null pointer means JVM thread struct exists)
-    bool vm_thread_non_null = true;
-    bool setup_crash_protection = vm_thread_non_null && fastPathIsJavaThread(_pt);
-    EXPECT_FALSE(setup_crash_protection);
+    // Clean up the nesting we opened above.
+    for (u32 i = 0; i < ProfiledThread::CRASH_HANDLER_NESTING_LIMIT; i++) {
+        _pt->exitCrashHandler();
+    }
 }
 
-// Gate is on for a real Java application thread (TYPE_JAVA_THREAD):
-// _exception_file IS written so crash recovery via longjmp works.
-TEST_F(CrashProtectionGateTest, GateOnForJavaThread) {
-    _pt->setJavaThread(true);
-    bool vm_thread_non_null = true;
-    bool setup_crash_protection = vm_thread_non_null && fastPathIsJavaThread(_pt);
-    EXPECT_TRUE(setup_crash_protection);
+// resetCrashHandler() is called by checkFault() before longjmp so that the
+// landing pad in walkVM starts with a clean nesting count.
+TEST_F(CrashHandlerNestingTest, ResetAllowsEntryAfterDeepNesting) {
+    for (u32 i = 0; i < ProfiledThread::CRASH_HANDLER_NESTING_LIMIT; i++) {
+        _pt->enterCrashHandler();
+    }
+    _pt->resetCrashHandler();
+    EXPECT_TRUE(_pt->enterCrashHandler());
+    _pt->exitCrashHandler();
+}
+
+// exitCrashHandler is a no-op if depth is already 0 (failsafe against
+// unbalanced calls during error paths).
+TEST_F(CrashHandlerNestingTest, ExitAtZeroIsNoop) {
+    _pt->exitCrashHandler();  // depth was 0, must not underflow
+    EXPECT_TRUE(_pt->enterCrashHandler());
+    _pt->exitCrashHandler();
+}
+
+// isDeepCrashHandler returns true only when depth *exceeds* the limit.
+// At exactly the limit, it is false — entry is refused but "deep" is not yet set.
+TEST_F(CrashHandlerNestingTest, IsDeepOnlyAboveLimit) {
+    for (u32 i = 0; i < ProfiledThread::CRASH_HANDLER_NESTING_LIMIT; i++) {
+        _pt->enterCrashHandler();
+    }
+    EXPECT_FALSE(_pt->isDeepCrashHandler());  // at limit, not above it
+    _pt->resetCrashHandler();
+}
+
+// ---------------------------------------------------------------------------
+// D. Longjmp-protection state (HotspotSupport::isThreadProtectedByLongjmp)
+//
+// walkVM arms crash recovery by storing a jmp_buf* in a thread-local slot
+// (_jmp_ctx) before the stack walk and clearing it afterward.  checkFault()
+// reads this slot via isThreadProtectedByLongjmp() to decide whether to
+// longjmp.
+//
+// HotspotSupport::initThread() initialises the slot to nullptr (so the key
+// is valid but the protection is off).  isThreadProtectedByLongjmp() returns
+// true only when the slot holds a non-null jmp_buf*.
+// ---------------------------------------------------------------------------
+
+TEST(LongjmpProtectionTest, UninitializedKeyMeansNotProtected) {
+    // Without initThread() the pthread key may not be valid at all; either way
+    // isThreadProtectedByLongjmp() must not crash and must return false.
+    // (On a thread that has never called initThread the get() returns nullptr.)
+    EXPECT_FALSE(HotspotSupport::isThreadProtectedByLongjmp());
 }
 
-// Gate is always off when vm_thread is NULL (no JVM thread struct).
-TEST_F(CrashProtectionGateTest, GateOffWhenNoVmThread) {
-    _pt->setJavaThread(true);  // would be a Java thread, but vm_thread is NULL
-    bool vm_thread_non_null = false;
-    bool setup_crash_protection = vm_thread_non_null && fastPathIsJavaThread(_pt);
-    EXPECT_FALSE(setup_crash_protection);
+TEST(LongjmpProtectionTest, AfterInitThreadKeyIsValidButNotProtected) {
+    HotspotSupport::initThread();
+    EXPECT_TRUE(HotspotSupport::isInitialized());
+    // The slot is initialised to nullptr — no active walkVM on this thread.
+    EXPECT_FALSE(HotspotSupport::isThreadProtectedByLongjmp());
 }
 
 #endif  // __linux__