tree 56cd4133b84a6d1c4fada5e19737a7069b8a6fed
parent ca74a55f51a91aa02630fbc26f6604dca6a82f65
author Yuli Fiterman <fiterman@google.com> 1787785601 +0000
committer Yuli Fiterman <fiterman@google.com> 1788296659 -0700

bmcweb: Log throw-site stack on std::terminate

Uncaught exceptions in gbmcweb reach std::terminate only after asio's
io_context and the sdbusplus posted-rethrow loop have already unwound the
stack, so the default terminate handler prints a backtrace that no longer
contains the original throw site. This makes fleet crashes from stray
exceptions very hard to triage.

Interpose __cxa_throw (the folly exception_tracer technique, reduced to a
single self-contained translation unit) to record the throw-site stack of
every exception, keyed by the exception object address, and install a
std::terminate handler that looks the record up via the in-flight
exception_ptr and logs it. The terminate path performs no allocation,
takes no locks and cannot re-enter, since it may run under suspected heap
corruption.

For the interposer to record throws from libstdc++ and other shared
objects -- not just the executable's own code -- it must win dynamic
symbol resolution against libstdc++'s __cxa_throw. Export it with default
visibility plus a linker --dynamic-list, and compile the tracer
translation unit directly into the executable so -Wl,--exclude-libs,ALL
cannot force it back to a local, non-interposing symbol. Without this the
interposer only captures throws whose __cxa_throw call site is compiled
into the executable, and misses standard-library and cross-library throws.

A runtime kill switch (--exception_stack_tracer=false) disables recording
and keeps the default terminate handler.

The tracer depends on glibc backtrace(), libgcc unwinding and the Itanium
__cxa_throw ABI, so it is built only in the meson/yocto (gcc) image.
Every reference to it from webserver_main_setup is guarded by
BMCWEB_ENABLE_EXCEPTION_STACK_TRACER, which is defined only by meson, so
the google3/blaze build carries no dependency on the tracer. The tracer
source, header and test are GoB-only.

Tested:
- Built gbmcweb and ran the unit tests inside the gbmcweb Gerrit
  presubmit gcc image (openbmc-ubuntu-unit-test) with the presubmit meson
  flags; exception_stack_tracer_test passes 4/4.
- Verified the guarded references compile out when
  BMCWEB_ENABLE_EXCEPTION_STACK_TRACER is undefined.
- On an emulated BMC image in Mimik (QEMU), using an out-of-tree
  debug-only endpoint that throws from a separate shared library through
  asio's inline executor (catch + async rethrow), confirmed the terminate
  handler logged the throw-site stack and that it symbolized across both
  modules. Before exporting the interposer the same cross-module throw was
  not recorded; after, it is. Verified with readelf that __cxa_throw is
  GLOBAL DEFAULT in the executable's dynamic symbol table.

Google-Bug-Id: 553672958
Signed-off-by: Yuli Fiterman <fiterman@google.com>
Change-Id: Ib461c25ffd44188707b628fad9d85f08ef516549