path: root/js/src/ds/MemoryProtectionExceptionHandler.cpp

/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
 * vim: set ts=8 sts=2 et sw=2 tw=80:
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "ds/MemoryProtectionExceptionHandler.h"

#include "mozilla/Assertions.h"
#include "mozilla/Atomics.h"

#if defined(XP_WIN)
#  include "util/Windows.h"
#elif defined(XP_UNIX) && !defined(XP_DARWIN)
#  include <signal.h>
#  include <sys/types.h>
#  include <unistd.h>
#elif defined(XP_DARWIN)
#  include <mach/mach.h>
#  include <unistd.h>
#endif

#ifdef ANDROID
#  include <android/log.h>
#endif

#include "ds/SplayTree.h"

#include "threading/LockGuard.h"
#include "threading/Thread.h"
#include "vm/MutexIDs.h"
#include "vm/Runtime.h"

namespace js {

// Memory protection occurs at non-deterministic points when
// recording/replaying.
static mozilla::Atomic<bool, mozilla::SequentiallyConsistent>
    sProtectedRegionsInit(false);

/*
 * A class to store the addresses of the regions recognized as protected
 * by this exception handler. We use a splay tree to store these addresses.
 */
class ProtectedRegionTree {
  struct Region {
    uintptr_t first;
    uintptr_t last;

    Region(uintptr_t addr, size_t size)
        : first(addr), last(addr + (size - 1)) {}

    // This function compares 2 memory regions. If they overlap they are
    // considered as identical. This is used for querying if an address is
    // included in a range, or if an address is already registered as a
    // protected region.
    static int compare(const Region& A, const Region& B) {
      if (A.last < B.first) {
        return -1;
      }
      if (A.first > B.last) {
        return 1;
      }
      return 0;
    }
  };

  Mutex lock;
  LifoAlloc alloc;
  SplayTree<Region, Region> tree;

 public:
  ProtectedRegionTree()
      : lock(mutexid::ProtectedRegionTree),
        // Here "false" is used to not use the memory protection mechanism of
        // LifoAlloc in order to prevent dead-locks.
        alloc(4096),
        tree(&alloc) {
    sProtectedRegionsInit = true;
  }

  ~ProtectedRegionTree() { sProtectedRegionsInit = false; }

  void insert(uintptr_t addr, size_t size) {
    MOZ_ASSERT(addr && size);
    LockGuard<Mutex> guard(lock);
    AutoEnterOOMUnsafeRegion oomUnsafe;
    if (!tree.insert(Region(addr, size))) {
      oomUnsafe.crash("Failed to store allocation ID.");
    }
  }

  void remove(uintptr_t addr) {
    MOZ_ASSERT(addr);
    LockGuard<Mutex> guard(lock);
    tree.remove(Region(addr, 1));
  }

  bool isProtected(uintptr_t addr) {
    if (!addr) {
      return false;
    }
    LockGuard<Mutex> guard(lock);
    return tree.maybeLookup(Region(addr, 1));
  }
};

static bool sExceptionHandlerInstalled = false;

static ProtectedRegionTree sProtectedRegions;

bool MemoryProtectionExceptionHandler::isDisabled() {
#if defined(XP_WIN) && defined(MOZ_ASAN)
  // Under Windows ASan, WasmFaultHandler registers itself at 'last' priority
  // in order to let ASan's ShadowExceptionHandler stay at 'first' priority.
  // Unfortunately that results in spurious wasm faults passing through the
  // MemoryProtectionExceptionHandler, which breaks its assumption that any
  // faults it sees are fatal. Just disable this handler in that case, as the
  // crash annotations provided here are not critical for ASan builds.
  return true;
#elif !defined(MOZ_DIAGNOSTIC_ASSERT_ENABLED)
  // Disable the exception handler for Beta and Release builds.
  return true;
#else
  return false;
#endif
}

void MemoryProtectionExceptionHandler::addRegion(void* addr, size_t size) {
  if (sExceptionHandlerInstalled && sProtectedRegionsInit) {
    sProtectedRegions.insert(uintptr_t(addr), size);
  }
}

void MemoryProtectionExceptionHandler::removeRegion(void* addr) {
  if (sExceptionHandlerInstalled && sProtectedRegionsInit) {
    sProtectedRegions.remove(uintptr_t(addr));
  }
}

/* -------------------------------------------------------------------------- */

/*
 * This helper function attempts to replicate the functionality of
 * mozilla::MOZ_ReportCrash() in an async-signal-safe way.
 */
static MOZ_COLD MOZ_ALWAYS_INLINE void ReportCrashIfDebug(const char* aStr)
    MOZ_PRETEND_NORETURN_FOR_STATIC_ANALYSIS {
#ifdef DEBUG
#  if defined(XP_WIN)
  DWORD bytesWritten;
  BOOL ret = WriteFile(GetStdHandle(STD_ERROR_HANDLE), aStr, strlen(aStr) + 1,
                       &bytesWritten, nullptr);
#  elif defined(ANDROID)
  int ret = __android_log_write(ANDROID_LOG_FATAL, "MOZ_CRASH", aStr);
#  else
  ssize_t ret = write(STDERR_FILENO, aStr, strlen(aStr) + 1);
#  endif
  (void)ret;  // Ignore failures; we're already crashing anyway.
#endif
}

/* -------------------------------------------------------------------------- */

#if defined(XP_WIN)

static void* sVectoredExceptionHandler = nullptr;

/*
 * We can only handle one exception. To guard against races and reentrancy,
 * we set this value the first time we enter the exception handler and never
 * touch it again.
 */
static mozilla::Atomic<bool> sHandlingException(false);

static long __stdcall VectoredExceptionHandler(
    EXCEPTION_POINTERS* ExceptionInfo) {
  EXCEPTION_RECORD* ExceptionRecord = ExceptionInfo->ExceptionRecord;

  // We only handle one kind of exception; ignore all others.
  if (ExceptionRecord->ExceptionCode == EXCEPTION_ACCESS_VIOLATION) {
    // Make absolutely sure we can only get here once.
    if (sHandlingException.compareExchange(false, true)) {
      // Restore the previous handler. We're going to forward to it
      // anyway, and if we crash while doing so we don't want to hang.
      MOZ_ALWAYS_TRUE(
          RemoveVectoredExceptionHandler(sVectoredExceptionHandler));
      sExceptionHandlerInstalled = false;

      // Get the address that the offending code tried to access.
      uintptr_t address = uintptr_t(ExceptionRecord->ExceptionInformation[1]);

      // If the faulting address is in one of our protected regions, we
      // want to annotate the crash to make it stand out from the crowd.
      if (sProtectedRegionsInit && sProtectedRegions.isProtected(address)) {
        ReportCrashIfDebug(
            "Hit MOZ_CRASH(Tried to access a protected region!)\n");
        MOZ_CRASH_ANNOTATE("MOZ_CRASH(Tried to access a protected region!)");
      }
    }
  }

  // Forward to the previous handler which may be a debugger,
  // the crash reporter or something else entirely.
  return EXCEPTION_CONTINUE_SEARCH;
}

bool MemoryProtectionExceptionHandler::install() {
  MOZ_ASSERT(!sExceptionHandlerInstalled);

  // If the exception handler is disabled, report success anyway.
  if (MemoryProtectionExceptionHandler::isDisabled()) {
    return true;
  }

  // Install our new exception handler.
  sVectoredExceptionHandler = AddVectoredExceptionHandler(
      /* FirstHandler = */ true, VectoredExceptionHandler);

  sExceptionHandlerInstalled = sVectoredExceptionHandler != nullptr;
  return sExceptionHandlerInstalled;
}

void MemoryProtectionExceptionHandler::uninstall() {
  if (sExceptionHandlerInstalled) {
    MOZ_ASSERT(!sHandlingException);

    // Restore the previous exception handler.
    MOZ_ALWAYS_TRUE(RemoveVectoredExceptionHandler(sVectoredExceptionHandler));

    sExceptionHandlerInstalled = false;
  }
}

#elif defined(XP_UNIX) && !defined(XP_DARWIN)

static struct sigaction sPrevSEGVHandler = {};

/*
 * We can only handle one exception. To guard against races and reentrancy,
 * we set this value the first time we enter the exception handler and never
 * touch it again.
 */
static mozilla::Atomic<bool> sHandlingException(false);

static void UnixExceptionHandler(int signum, siginfo_t* info, void* context) {
  // Make absolutely sure we can only get here once.
  if (sHandlingException.compareExchange(false, true)) {
    // Restore the previous handler. We're going to forward to it
    // anyway, and if we crash while doing so we don't want to hang.
    MOZ_ALWAYS_FALSE(sigaction(SIGSEGV, &sPrevSEGVHandler, nullptr));

    MOZ_ASSERT(signum == SIGSEGV && info->si_signo == SIGSEGV);

    if (info->si_code == SEGV_ACCERR) {
      // Get the address that the offending code tried to access.
      uintptr_t address = uintptr_t(info->si_addr);

      // If the faulting address is in one of our protected regions, we
      // want to annotate the crash to make it stand out from the crowd.
      if (sProtectedRegionsInit && sProtectedRegions.isProtected(address)) {
        ReportCrashIfDebug(
            "Hit MOZ_CRASH(Tried to access a protected region!)\n");
        MOZ_CRASH_ANNOTATE("MOZ_CRASH(Tried to access a protected region!)");
      }
    }
  }

  // Forward to the previous handler which may be a debugger,
  // the crash reporter or something else entirely.
  if (sPrevSEGVHandler.sa_flags & SA_SIGINFO) {
    sPrevSEGVHandler.sa_sigaction(signum, info, context);
  } else if (sPrevSEGVHandler.sa_handler == SIG_DFL ||
             sPrevSEGVHandler.sa_handler == SIG_IGN) {
    sigaction(SIGSEGV, &sPrevSEGVHandler, nullptr);
  } else {
    sPrevSEGVHandler.sa_handler(signum);
  }

  // If we reach here, we're returning to let the default signal handler deal
  // with the exception. This is technically undefined behavior, but
  // everything seems to do it, and it removes us from the crash stack.
}

bool MemoryProtectionExceptionHandler::install() {
  MOZ_ASSERT(!sExceptionHandlerInstalled);

  // If the exception handler is disabled, report success anyway.
  if (MemoryProtectionExceptionHandler::isDisabled()) {
    return true;
  }

  // Install our new exception handler and save the previous one.
  struct sigaction faultHandler = {};
  faultHandler.sa_flags = SA_SIGINFO | SA_NODEFER | SA_ONSTACK;
  faultHandler.sa_sigaction = UnixExceptionHandler;
  sigemptyset(&faultHandler.sa_mask);
  sExceptionHandlerInstalled =
      !sigaction(SIGSEGV, &faultHandler, &sPrevSEGVHandler);

  return sExceptionHandlerInstalled;
}

void MemoryProtectionExceptionHandler::uninstall() {
  if (sExceptionHandlerInstalled) {
    MOZ_ASSERT(!sHandlingException);

    // Restore the previous exception handler.
    MOZ_ALWAYS_FALSE(sigaction(SIGSEGV, &sPrevSEGVHandler, nullptr));

    sExceptionHandlerInstalled = false;
  }
}

#elif defined(XP_DARWIN)

/*
 * The fact that we need to be able to forward to other exception handlers
 * makes this code much more complicated. The forwarding logic and the
 * structures required to make it work are heavily based on the code at
 * www.ravenbrook.com/project/mps/prototype/2013-06-24/machtest/machtest/main.c
 */

/* -------------------------------------------------------------------------- */
/*                Begin Mach definitions and helper functions                 */
/* -------------------------------------------------------------------------- */

/*
 * These are the message IDs associated with each exception type.
 * We'll be using sIDRequest64, but we need the others for forwarding.
 */
static const mach_msg_id_t sIDRequest32 = 2401;
static const mach_msg_id_t sIDRequestState32 = 2402;
static const mach_msg_id_t sIDRequestStateIdentity32 = 2403;

static const mach_msg_id_t sIDRequest64 = 2405;
static const mach_msg_id_t sIDRequestState64 = 2406;
static const mach_msg_id_t sIDRequestStateIdentity64 = 2407;

/*
 * Each message ID has an associated Mach message structure.
 * We use the preprocessor to make defining them a little less arduous.
 */
#  define REQUEST_HEADER_FIELDS mach_msg_header_t header;

#  define REQUEST_IDENTITY_FIELDS      \
    mach_msg_body_t msgh_body;         \
    mach_msg_port_descriptor_t thread; \
    mach_msg_port_descriptor_t task;

#  define REQUEST_GENERAL_FIELDS(bits) \
    NDR_record_t NDR;                  \
    exception_type_t exception;        \
    mach_msg_type_number_t code_count; \
    int##bits##_t code[2];

#  define REQUEST_STATE_FIELDS              \
    int flavor;                             \
    mach_msg_type_number_t old_state_count; \
    natural_t old_state[THREAD_STATE_MAX];

#  define REQUEST_TRAILER_FIELDS mach_msg_trailer_t trailer;

#  define EXCEPTION_REQUEST(bits)   \
    struct ExceptionRequest##bits { \
      REQUEST_HEADER_FIELDS         \
      REQUEST_IDENTITY_FIELDS       \
      REQUEST_GENERAL_FIELDS(bits)  \
      REQUEST_TRAILER_FIELDS        \
    };

#  define EXCEPTION_REQUEST_STATE(bits)  \
    struct ExceptionRequestState##bits { \
      REQUEST_HEADER_FIELDS              \
      REQUEST_GENERAL_FIELDS(bits)       \
      REQUEST_STATE_FIELDS               \
      REQUEST_TRAILER_FIELDS             \
    };

#  define EXCEPTION_REQUEST_STATE_IDENTITY(bits) \
    struct ExceptionRequestStateIdentity##bits { \
      REQUEST_HEADER_FIELDS                      \
      REQUEST_IDENTITY_FIELDS                    \
      REQUEST_GENERAL_FIELDS(bits)               \
      REQUEST_STATE_FIELDS                       \
      REQUEST_TRAILER_FIELDS                     \
    };

/* This is needed because not all fields are naturally aligned on 64-bit. */
#  ifdef __MigPackStructs
#    pragma pack(4)
#  endif

EXCEPTION_REQUEST(32)
EXCEPTION_REQUEST(64)
EXCEPTION_REQUEST_STATE(32)
EXCEPTION_REQUEST_STATE(64)
EXCEPTION_REQUEST_STATE_IDENTITY(32)
EXCEPTION_REQUEST_STATE_IDENTITY(64)

/* We use this as a common base when forwarding to the previous handler. */
union ExceptionRequestUnion {
  mach_msg_header_t header;
  ExceptionRequest32 r32;
  ExceptionRequest64 r64;
  ExceptionRequestState32 rs32;
  ExceptionRequestState64 rs64;
  ExceptionRequestStateIdentity32 rsi32;
  ExceptionRequestStateIdentity64 rsi64;
};

/* This isn't really a full Mach message, but it's all we need to send. */
struct ExceptionReply {
  mach_msg_header_t header;
  NDR_record_t NDR;
  kern_return_t RetCode;
};

#  ifdef __MigPackStructs
#    pragma pack()
#  endif

#  undef EXCEPTION_REQUEST_STATE_IDENTITY
#  undef EXCEPTION_REQUEST_STATE
#  undef EXCEPTION_REQUEST
#  undef REQUEST_STATE_FIELDS
#  undef REQUEST_GENERAL_FIELDS
#  undef REQUEST_IDENTITY_FIELDS
#  undef REQUEST_HEADER_FIELDS

/*
 * The exception handler we're forwarding to may not have the same behavior
 * or thread state flavor as what we're using. These macros help populate
 * the fields of the message we're about to send to the previous handler.
 */
#  define COPY_REQUEST_COMMON(bits, id)                                  \
    dst.header = src.header;                                             \
    dst.header.msgh_id = id;                                             \
    dst.header.msgh_size =                                               \
        static_cast<mach_msg_size_t>(sizeof(dst) - sizeof(dst.trailer)); \
    dst.NDR = src.NDR;                                                   \
    dst.exception = src.exception;                                       \
    dst.code_count = src.code_count;                                     \
    dst.code[0] = int##bits##_t(src.code[0]);                            \
    dst.code[1] = int##bits##_t(src.code[1]);

#  define COPY_REQUEST_IDENTITY    \
    dst.msgh_body = src.msgh_body; \
    dst.thread = src.thread;       \
    dst.task = src.task;

#  define COPY_REQUEST_STATE(flavor, stateCount, state)                  \
    mach_msg_size_t stateSize = stateCount * sizeof(natural_t);          \
    dst.header.msgh_size =                                               \
        static_cast<mach_msg_size_t>(sizeof(dst) - sizeof(dst.trailer) - \
                                     sizeof(dst.old_state) + stateSize); \
    dst.flavor = flavor;                                                 \
    dst.old_state_count = stateCount;                                    \
    memcpy(dst.old_state, state, stateSize);

#  define COPY_EXCEPTION_REQUEST(bits)                                    \
    static void CopyExceptionRequest##bits(ExceptionRequest64& src,       \
                                           ExceptionRequest##bits& dst) { \
      COPY_REQUEST_COMMON(bits, sIDRequest##bits)                         \
      COPY_REQUEST_IDENTITY                                               \
    }

#  define COPY_EXCEPTION_REQUEST_STATE(bits)                             \
    static void CopyExceptionRequestState##bits(                         \
        ExceptionRequest64& src, ExceptionRequestState##bits& dst,       \
        thread_state_flavor_t flavor, mach_msg_type_number_t stateCount, \
        thread_state_t state) {                                          \
      COPY_REQUEST_COMMON(bits, sIDRequestState##bits)                   \
      COPY_REQUEST_STATE(flavor, stateCount, state)                      \
    }

#  define COPY_EXCEPTION_REQUEST_STATE_IDENTITY(bits)                      \
    static void CopyExceptionRequestStateIdentity##bits(                   \
        ExceptionRequest64& src, ExceptionRequestStateIdentity##bits& dst, \
        thread_state_flavor_t flavor, mach_msg_type_number_t stateCount,   \
        thread_state_t state) {                                            \
      COPY_REQUEST_COMMON(bits, sIDRequestStateIdentity##bits)             \
      COPY_REQUEST_IDENTITY                                                \
      COPY_REQUEST_STATE(flavor, stateCount, state)                        \
    }

COPY_EXCEPTION_REQUEST(32)
COPY_EXCEPTION_REQUEST_STATE(32)
COPY_EXCEPTION_REQUEST_STATE_IDENTITY(32)
COPY_EXCEPTION_REQUEST(64)
COPY_EXCEPTION_REQUEST_STATE(64)
COPY_EXCEPTION_REQUEST_STATE_IDENTITY(64)

#  undef COPY_EXCEPTION_REQUEST_STATE_IDENTITY
#  undef COPY_EXCEPTION_REQUEST_STATE
#  undef COPY_EXCEPTION_REQUEST
#  undef COPY_REQUEST_STATE
#  undef COPY_REQUEST_IDENTITY
#  undef COPY_REQUEST_COMMON

/* -------------------------------------------------------------------------- */
/*                 End Mach definitions and helper functions                  */
/* -------------------------------------------------------------------------- */

/* Every Mach exception handler is parameterized by these four properties. */
struct MachExceptionParameters {
  exception_mask_t mask;
  mach_port_t port;
  exception_behavior_t behavior;
  thread_state_flavor_t flavor;
};

struct ExceptionHandlerState {
  MachExceptionParameters current;
  MachExceptionParameters previous;

  /* Each Mach exception handler runs in its own thread. */
  Thread handlerThread;
};

/* This choice of ID is arbitrary, but must not match our exception ID. */
static const mach_msg_id_t sIDQuit = 42;

static ExceptionHandlerState* sMachExceptionState = nullptr;

/*
 * The meat of our exception handler. This thread waits for an exception
 * message, annotates the exception if needed, then forwards it to the
 * previously installed handler (which will likely terminate the process).
 */
static void MachExceptionHandler() {
  ThisThread::SetName("JS MachExceptionHandler");
  kern_return_t ret;
  MachExceptionParameters& current = sMachExceptionState->current;
  MachExceptionParameters& previous = sMachExceptionState->previous;

  // We use the simplest kind of 64-bit exception message here.
  ExceptionRequest64 request = {};
  request.header.msgh_local_port = current.port;
  request.header.msgh_size = static_cast<mach_msg_size_t>(sizeof(request));
  ret = mach_msg(&request.header, MACH_RCV_MSG, 0, request.header.msgh_size,
                 current.port, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);

  // Restore the previous handler. We're going to forward to it
  // anyway, and if we crash while doing so we don't want to hang.
  task_set_exception_ports(mach_task_self(), previous.mask, previous.port,
                           previous.behavior, previous.flavor);

  // If we failed even receiving the message, just give up.
  if (ret != MACH_MSG_SUCCESS) {
    MOZ_CRASH("MachExceptionHandler: mach_msg failed to receive a message!");
  }

  // Terminate the thread if we're shutting down.
  if (request.header.msgh_id == sIDQuit) {
    return;
  }

  // The only other valid message ID is the one associated with the
  // EXCEPTION_DEFAULT | MACH_EXCEPTION_CODES behavior we chose.
  if (request.header.msgh_id != sIDRequest64) {
    MOZ_CRASH("MachExceptionHandler: Unexpected Message ID!");
  }

  // Make sure we can understand the exception we received.
  if (request.exception != EXC_BAD_ACCESS || request.code_count != 2) {
    MOZ_CRASH("MachExceptionHandler: Unexpected exception type!");
  }

  // Get the address that the offending code tried to access.
  uintptr_t address = uintptr_t(request.code[1]);

  // If the faulting address is inside one of our protected regions, we
  // want to annotate the crash to make it stand out from the crowd.
  if (sProtectedRegionsInit && sProtectedRegions.isProtected(address)) {
    ReportCrashIfDebug("Hit MOZ_CRASH(Tried to access a protected region!)\n");
    MOZ_CRASH_ANNOTATE("MOZ_CRASH(Tried to access a protected region!)");
  }

  // Forward to the previous handler which may be a debugger, the unix
  // signal handler, the crash reporter or something else entirely.
  if (previous.port != MACH_PORT_NULL) {
    mach_msg_type_number_t stateCount;
    thread_state_data_t state;
    if ((uint32_t(previous.behavior) & ~MACH_EXCEPTION_CODES) !=
        EXCEPTION_DEFAULT) {
      // If the previous handler requested thread state, get it here.
      stateCount = THREAD_STATE_MAX;
      ret = thread_get_state(request.thread.name, previous.flavor, state,
                             &stateCount);
      if (ret != KERN_SUCCESS) {
        MOZ_CRASH(
            "MachExceptionHandler: Could not get the thread state to forward!");
      }
    }

    // Depending on the behavior of the previous handler, the forwarded
    // exception message will have a different set of fields.
    // Of particular note is that exception handlers that lack
    // MACH_EXCEPTION_CODES will get 32-bit fields even on 64-bit
    // systems. It appears that OSX simply truncates these fields.
    ExceptionRequestUnion forward;
    switch (uint32_t(previous.behavior)) {
      case EXCEPTION_DEFAULT:
        CopyExceptionRequest32(request, forward.r32);
        break;
      case EXCEPTION_DEFAULT | MACH_EXCEPTION_CODES:
        CopyExceptionRequest64(request, forward.r64);
        break;
      case EXCEPTION_STATE:
        CopyExceptionRequestState32(request, forward.rs32, previous.flavor,
                                    stateCount, state);
        break;
      case EXCEPTION_STATE | MACH_EXCEPTION_CODES:
        CopyExceptionRequestState64(request, forward.rs64, previous.flavor,
                                    stateCount, state);
        break;
      case EXCEPTION_STATE_IDENTITY:
        CopyExceptionRequestStateIdentity32(request, forward.rsi32,
                                            previous.flavor, stateCount, state);
        break;
      case EXCEPTION_STATE_IDENTITY | MACH_EXCEPTION_CODES:
        CopyExceptionRequestStateIdentity64(request, forward.rsi64,
                                            previous.flavor, stateCount, state);
        break;
      default:
        MOZ_CRASH("MachExceptionHandler: Unknown previous handler behavior!");
    }

    // Forward the generated message to the old port. The local and remote
    // port fields *and their rights* are swapped on arrival, so we need to
    // swap them back first.
    forward.header.msgh_bits =
        (request.header.msgh_bits & ~MACH_MSGH_BITS_PORTS_MASK) |
        MACH_MSGH_BITS(MACH_MSGH_BITS_LOCAL(request.header.msgh_bits),
                       MACH_MSGH_BITS_REMOTE(request.header.msgh_bits));
    forward.header.msgh_local_port = forward.header.msgh_remote_port;
    forward.header.msgh_remote_port = previous.port;
    ret = mach_msg(&forward.header, MACH_SEND_MSG, forward.header.msgh_size, 0,
                   MACH_PORT_NULL, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
    if (ret != MACH_MSG_SUCCESS) {
      MOZ_CRASH(
          "MachExceptionHandler: Failed to forward to the previous handler!");
    }
  } else {
    // There was no previous task-level exception handler, so defer to the
    // host level one instead. We set the return code to KERN_FAILURE to
    // indicate that we did not handle the exception.
    // The reply message ID is always the request ID + 100.
    ExceptionReply reply = {};
    reply.header.msgh_bits =
        MACH_MSGH_BITS(MACH_MSGH_BITS_REMOTE(request.header.msgh_bits), 0);
    reply.header.msgh_size = static_cast<mach_msg_size_t>(sizeof(reply));
    reply.header.msgh_remote_port = request.header.msgh_remote_port;
    reply.header.msgh_local_port = MACH_PORT_NULL;
    reply.header.msgh_id = request.header.msgh_id + 100;
    reply.NDR = request.NDR;
    reply.RetCode = KERN_FAILURE;
    ret = mach_msg(&reply.header, MACH_SEND_MSG, reply.header.msgh_size, 0,
                   MACH_PORT_NULL, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
    if (ret != MACH_MSG_SUCCESS) {
      MOZ_CRASH("MachExceptionHandler: Failed to forward to the host level!");
    }
  }
}

static void TerminateMachExceptionHandlerThread() {
  // Send a simple quit message to the exception handler thread.
  mach_msg_header_t msg;
  msg.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0);
  msg.msgh_size = static_cast<mach_msg_size_t>(sizeof(msg));
  msg.msgh_remote_port = sMachExceptionState->current.port;
  msg.msgh_local_port = MACH_PORT_NULL;
  msg.msgh_reserved = 0;
  msg.msgh_id = sIDQuit;
  kern_return_t ret =
      mach_msg(&msg, MACH_SEND_MSG, sizeof(msg), 0, MACH_PORT_NULL,
               MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);

  if (ret == MACH_MSG_SUCCESS) {
    sMachExceptionState->handlerThread.join();
  } else {
    MOZ_CRASH("MachExceptionHandler: Handler thread failed to terminate!");
  }
}

bool MemoryProtectionExceptionHandler::install() {
  MOZ_ASSERT(!sExceptionHandlerInstalled);
  MOZ_ASSERT(!sMachExceptionState);

  // If the exception handler is disabled, report success anyway.
  if (MemoryProtectionExceptionHandler::isDisabled()) {
    return true;
  }

  sMachExceptionState = js_new<ExceptionHandlerState>();
  if (!sMachExceptionState) {
    return false;
  }

  kern_return_t ret;
  mach_port_t task = mach_task_self();

  // Allocate a new exception port with receive rights.
  sMachExceptionState->current = {};
  MachExceptionParameters& current = sMachExceptionState->current;
  ret = mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, &current.port);
  if (ret != KERN_SUCCESS) {
    return false;
  }

  // Give the new port send rights as well.
  ret = mach_port_insert_right(task, current.port, current.port,
                               MACH_MSG_TYPE_MAKE_SEND);
  if (ret != KERN_SUCCESS) {
    mach_port_deallocate(task, current.port);
    current = {};
    return false;
  }

  // Start the thread that will receive the messages from our exception port.
  if (!sMachExceptionState->handlerThread.init(MachExceptionHandler)) {
    mach_port_deallocate(task, current.port);
    current = {};
    return false;
  }

  // Set the other properties of our new exception handler.
  current.mask = EXC_MASK_BAD_ACCESS;
  current.behavior =
      exception_behavior_t(EXCEPTION_DEFAULT | MACH_EXCEPTION_CODES);
  current.flavor = THREAD_STATE_NONE;

  // Tell the task to use our exception handler, and save the previous one.
  sMachExceptionState->previous = {};
  MachExceptionParameters& previous = sMachExceptionState->previous;
  mach_msg_type_number_t previousCount = 1;
  ret = task_swap_exception_ports(
      task, current.mask, current.port, current.behavior, current.flavor,
      &previous.mask, &previousCount, &previous.port, &previous.behavior,
      &previous.flavor);
  if (ret != KERN_SUCCESS) {
    TerminateMachExceptionHandlerThread();
    mach_port_deallocate(task, current.port);
    previous = {};
    current = {};
    return false;
  }

  // We should have info on the previous exception handler, even if it's null.
  MOZ_ASSERT(previousCount == 1);

  sExceptionHandlerInstalled = true;
  return sExceptionHandlerInstalled;
}

void MemoryProtectionExceptionHandler::uninstall() {
  if (sExceptionHandlerInstalled) {
    MOZ_ASSERT(sMachExceptionState);

    mach_port_t task = mach_task_self();

    // Restore the previous exception handler.
    MachExceptionParameters& previous = sMachExceptionState->previous;
    task_set_exception_ports(task, previous.mask, previous.port,
                             previous.behavior, previous.flavor);

    TerminateMachExceptionHandlerThread();

    // Release the Mach IPC port we used.
    mach_port_deallocate(task, sMachExceptionState->current.port);

    sMachExceptionState->current = {};
    sMachExceptionState->previous = {};

    js_delete(sMachExceptionState);
    sMachExceptionState = nullptr;

    sExceptionHandlerInstalled = false;
  }
}

#else

#  error "This platform is not supported!"

#endif

} /* namespace js */