Implement ExceptionHandling.SetFatalErrorHandler

src/coreclr/System.Private.CoreLib/System.Private.CoreLib.csproj

@@ -219,6 +219,7 @@
     <Compile Include="$(MSBuildThisFileDirectory)..\nativeaot\Runtime.Base\src\System\Runtime\ExceptionIDs.cs" />
     <Compile Include="$(MSBuildThisFileDirectory)..\nativeaot\Runtime.Base\src\System\Runtime\StackFrameIterator.cs" />
     <Compile Include="$(BclSourcesRoot)\System\Runtime\ExceptionServices\AsmOffsets.cs" />
+    <Compile Include="$(BclSourcesRoot)\System\Runtime\ExceptionServices\ExceptionHandling.CoreCLR.cs" />
     <Compile Include="$(BclSourcesRoot)\System\Runtime\ExceptionServices\InternalCalls.cs" />
     <Compile Include="$(BclSourcesRoot)\System\Runtime\GCSettings.CoreCLR.cs" />
     <Compile Include="$(BclSourcesRoot)\System\Runtime\JitInfo.CoreCLR.cs" />

src/coreclr/System.Private.CoreLib/src/System/Runtime/ExceptionServices/ExceptionHandling.CoreCLR.cs

@@ -0,0 +1,16 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+namespace System.Runtime.ExceptionServices
+{
+    public static partial class ExceptionHandling
+    {
+        [LibraryImport(RuntimeHelpers.QCall, EntryPoint = "ExceptionHandling_TrySetFatalErrorHandler")]
+        [SuppressGCTransition]
+        [return: MarshalAs(UnmanagedType.U1)]
+        private static partial bool TrySetFatalErrorHandler(IntPtr handler);
+    }
+}

src/coreclr/nativeaot/Runtime.Base/src/System/Runtime/ExceptionHandling.cs

@@ -307,7 +307,7 @@ internal static Exception GetClasslibException(ExceptionIDs id, IntPtr address)
             Exception? e = null;
             try
             {
-                e = ((delegate*<ExceptionIDs, Exception>)pGetRuntimeExceptionFunction)(id);
+                e = ((delegate*<ExceptionIDs, IntPtr, Exception>)pGetRuntimeExceptionFunction)(id, address);
             }
             catch when (true)
             {
@@ -362,7 +362,8 @@ internal static Exception GetClasslibExceptionFromEEType(ExceptionIDs id, Method
             Exception? e = null;
             try
             {
-                e = ((delegate*<ExceptionIDs, Exception>)pGetRuntimeExceptionFunction)(id);
+                // The MethodTable-based lookup path has no faulting instruction pointer to surface.
+                e = ((delegate*<ExceptionIDs, IntPtr, Exception>)pGetRuntimeExceptionFunction)(id, IntPtr.Zero);
             }
             catch when (true)
             {
@@ -424,8 +425,9 @@ public static void FailedAllocation(MethodTable* pEEType, bool fIsOverflow)
         // There are only a few cases where this happens now (the fast allocation helpers), so we limit the
         // exception types that MRT will return.
         [RuntimeExport("GetRuntimeException")]
-        public static Exception GetRuntimeException(ExceptionIDs id)
+        public static Exception GetRuntimeException(ExceptionIDs id, IntPtr faultingIP)
         {
+            _ = faultingIP;
             switch (id)
             {
                 case ExceptionIDs.OutOfMemory:

src/coreclr/nativeaot/Runtime/EHHelpers.cpp

@@ -12,6 +12,7 @@
 #include "TypeManager.h"
 #include "PalLimitedContext.h"
 #include "Pal.h"
+#include "volatile.h"
 #include "holder.h"
 #include "Crst.h"
 #include "RuntimeInstance.h"
@@ -30,6 +31,7 @@
 #include "NativeContext.h"
 #include <minipal/debugger.h>
 #include "corexcep.h"
+#include <public/fatal_error_handling.h>
 
 struct MethodRegionInfo
 {
@@ -39,6 +41,140 @@ struct MethodRegionInfo
     size_t coldSize;
 };
 
+using FatalErrorHandlerFunc = int (DOTNET_CALLCONV *)(int hresult, FatalErrorPropertyGetter getProperty);
+
+struct NativeFatalErrorContext
+{
+    void* Address;
+    void* PlatformData0;
+    void* PlatformData1;
+};
+
+static void* g_fatalErrorHandler = NULL;
+static volatile int64_t g_fatalErrorHandlerThreadId;
+static NativeFatalErrorContext g_nativeFatalErrorContext;
+
+static uint64_t TryAcquireFatalErrorHandler()
+{
+    uint64_t currentThreadId = PalGetCurrentOSThreadId();
+    return static_cast<uint64_t>(PalInterlockedCompareExchange64(
+        &g_fatalErrorHandlerThreadId, static_cast<int64_t>(currentThreadId), 0));
+}
+
+static void WaitForFatalErrorHandlerIfGcSafe(uint64_t previousThreadId)
+{
+    if (previousThreadId == PalGetCurrentOSThreadId())
+    {
+        return;
+    }
+
+#if defined(TARGET_UNIX) && !defined(TARGET_WASM)
+    Thread* pThread = ThreadStore::GetCurrentThreadIfAvailableAsyncSafe();
+#else
+    Thread* pThread = ThreadStore::GetCurrentThreadIfAvailable();
+#endif
+    if (pThread == nullptr || !pThread->IsCurrentThreadInCooperativeMode())
+    {
+        PalSleep(INFINITE);
+    }
+}
+
+static int32_t DOTNET_CALLCONV GetNativeFatalErrorProperty(int32_t prop, const void** value)
+{
+    if (value == nullptr)
+    {
+        return 0;
+    }
+
+    switch (static_cast<FatalErrorProperty>(prop))
+    {
+    case FEP_Address:
+        if (g_nativeFatalErrorContext.Address == nullptr)
+        {
+            return 0;
+        }
+        *value = g_nativeFatalErrorContext.Address;
+        return 1;
+
+#ifdef TARGET_WINDOWS
+    case FEP_WindowsExceptionRecord:
+        if (g_nativeFatalErrorContext.PlatformData0 == nullptr)
+        {
+            return 0;
+        }
+        *value = g_nativeFatalErrorContext.PlatformData0;
+        return 1;
+
+    case FEP_WindowsContextRecord:
+        if (g_nativeFatalErrorContext.PlatformData1 == nullptr)
+        {
+            return 0;
+        }
+        *value = g_nativeFatalErrorContext.PlatformData1;
+        return 1;
+#else
+    case FEP_PosixSigInfo:
+        if (g_nativeFatalErrorContext.PlatformData0 == nullptr)
+        {
+            return 0;
+        }
+        *value = g_nativeFatalErrorContext.PlatformData0;
+        return 1;
+
+    case FEP_UContext:
+        if (g_nativeFatalErrorContext.PlatformData1 == nullptr)
+        {
+            return 0;
+        }
+        *value = g_nativeFatalErrorContext.PlatformData1;
+        return 1;
+#endif
+
+    default:
+        return 0;
+    }
+}
+
+void RhpInvokeFatalErrorHandlerForNativeException(
+    int32_t errorCode,
+    void* faultAddress,
+    void* platformData0,
+    void* platformData1)
+{
+    void* pHandler = VolatileLoad(&g_fatalErrorHandler);
+    if (pHandler == nullptr)
+    {
+        return;
+    }
+
+    uint64_t previousThreadId = TryAcquireFatalErrorHandler();
+    if (previousThreadId != 0)
+    {
+        // A cooperative thread cannot block here because the managed fatal owner may
+        // need a GC while composing its crash report. Let default fatal handling proceed.
+        WaitForFatalErrorHandlerIfGcSafe(previousThreadId);
+        return;
+    }
+
+    g_nativeFatalErrorContext = { faultAddress, platformData0, platformData1 };
+
+    FatalErrorHandlerFunc pfnHandler = reinterpret_cast<FatalErrorHandlerFunc>(pHandler);
+    int result = pfnHandler(errorCode, GetNativeFatalErrorProperty);
+    ASSERT(result == RunDefaultHandler);
+}
+
+FCIMPL1(void, RhpRegisterFatalErrorHandler, void* pHandler)
+{
+    PalInterlockedExchangePointer(&g_fatalErrorHandler, pHandler);
+}
+FCIMPLEND
+
+FCIMPL0(uint64_t, RhpTryAcquireFatalErrorHandler)
+{
+    return TryAcquireFatalErrorHandler();
+}
+FCIMPLEND
+
 FCIMPL3(FC_BOOL_RET, RhpEHEnumInitFromStackFrameIterator,
     StackFrameIterator* pFrameIter, MethodRegionInfo* pMethodRegionInfoOut, EHEnum* pEHEnum)
 {
@@ -447,6 +583,53 @@ EXTERN_C void RhpContinueOnFatalErrors()
     g_ContinueOnFatalErrors = true;
 }
 
+// Returns true for the genuinely-fatal hardware fault codes that mirror the Unix signal
+// choke point (SIGSEGV/SIGFPE/SIGILL). Stack overflow is deliberately excluded: the guard
+// region leaves too little stack to invoke a user callback safely.
+static bool IsFatalHardwareExceptionForFatalErrorHandler(uintptr_t faultCode)
+{
+    switch (faultCode)
+    {
+    case STATUS_ACCESS_VIOLATION:
+    case STATUS_IN_PAGE_ERROR:
+    case STATUS_DATATYPE_MISALIGNMENT:
+    case STATUS_ILLEGAL_INSTRUCTION:
+    case STATUS_PRIVILEGED_INSTRUCTION:
+    case STATUS_ARRAY_BOUNDS_EXCEEDED:
+    case STATUS_INTEGER_DIVIDE_BY_ZERO:
+    case STATUS_INTEGER_OVERFLOW:
+    case STATUS_FLOAT_DIVIDE_BY_ZERO:
+    case STATUS_FLOAT_INVALID_OPERATION:
+    case STATUS_FLOAT_OVERFLOW:
+    case STATUS_FLOAT_UNDERFLOW:
+    case STATUS_FLOAT_INEXACT_RESULT:
+    case STATUS_FLOAT_DENORMAL_OPERAND:
+    case STATUS_FLOAT_STACK_CHECK:
+        return true;
+    default:
+        return false;
+    }
+}
+
+// For a genuinely-unmanaged fatal fault (one that the vectored exception handler did not
+// translate to a managed exception), forward the live exception records to a user-installed
+// fatal error handler, if one is registered.
+static void InvokeFatalErrorHandlerForNativeException(PEXCEPTION_POINTERS pExPtrs)
+{
+    uintptr_t faultCode = pExPtrs->ExceptionRecord->ExceptionCode;
+    if (!IsFatalHardwareExceptionForFatalErrorHandler(faultCode))
+    {
+        return;
+    }
+
+    // The fault address surfaced to the handler is the faulting instruction pointer,
+    // matching the managed fatal path. The accessed memory address (for a memory fault)
+    // remains available to the handler through the forwarded PEXCEPTION_RECORD.
+    void* faultAddress = (void*)((NATIVE_CONTEXT*)pExPtrs->ContextRecord)->GetIp();
+    RhpInvokeFatalErrorHandlerForNativeException(
+        static_cast<int32_t>(faultCode), faultAddress, pExPtrs->ExceptionRecord, pExPtrs->ContextRecord);
+}
+
 LONG WINAPI RhpVectoredExceptionHandler(PEXCEPTION_POINTERS pExPtrs)
 {
     uintptr_t faultCode = pExPtrs->ExceptionRecord->ExceptionCode;
@@ -570,6 +753,13 @@ LONG WINAPI RhpVectoredExceptionHandler(PEXCEPTION_POINTERS pExPtrs)
         return EXCEPTION_CONTINUE_EXECUTION;
     }
 
+    // RhpContinueOnFatalErrors leaves hardware faults for client handlers, so they are
+    // not known to be fatal at this point.
+    if (!g_ContinueOnFatalErrors)
+    {
+        InvokeFatalErrorHandlerForNativeException(pExPtrs);
+    }
+
     // The client may have told us to continue to search for custom handlers,
     // but in general we consider any form of hardware exception within the runtime itself a fatal error.
     // Note this includes the managed code within the runtime.

src/coreclr/nativeaot/Runtime/unix/HardwareExceptions.cpp

@@ -4,6 +4,7 @@
 #include "common.h"
 #include "CommonTypes.h"
 #include "Pal.h"
+#include "volatile.h"
 #include "PalLimitedContext.h"
 #include "CommonMacros.h"
 #include "config.h"
@@ -541,6 +542,30 @@ bool HardwareExceptionHandler(int code, siginfo_t *siginfo, void *context, void*
     return false;
 }
 
+// Defined in EHHelpers.cpp. Invokes the user callback directly from native code and
+// forwards the live signal structures through the native property getter.
+extern void RhpInvokeFatalErrorHandlerForNativeException(
+    int32_t errorCode,
+    void* faultAddress,
+    void* platformData0,
+    void* platformData1);
+
+// For a genuinely-unmanaged fatal fault (one that HardwareExceptionHandler did not translate
+// to a managed exception), forward the live siginfo_t/ucontext_t to a user-installed fatal
+// error handler, if one is registered.
+static void InvokeFatalErrorHandlerForNativeException(siginfo_t *siginfo, void *context)
+{
+    // The fault address surfaced to the handler is the faulting instruction pointer,
+    // matching the managed fatal path. The accessed memory address (for a memory fault)
+    // remains available to the handler through the forwarded siginfo_t (si_addr).
+    PAL_LIMITED_CONTEXT palContext;
+    NativeContextToPalContext(context, &palContext);
+    void* faultAddress = (void*)palContext.IP;
+    uint32_t faultCode = GetExceptionCodeForSignal(siginfo, context);
+    RhpInvokeFatalErrorHandlerForNativeException(
+        static_cast<int32_t>(faultCode), faultAddress, siginfo, context);
+}
+
 // Handler for the SIGSEGV signal
 void SIGSEGVHandler(int code, siginfo_t *siginfo, void *context)
 {
@@ -550,6 +575,8 @@ void SIGSEGVHandler(int code, siginfo_t *siginfo, void *context)
         return;
     }
 
+    InvokeFatalErrorHandlerForNativeException(siginfo, context);
+
     if (g_previousSIGSEGV.sa_sigaction != NULL)
     {
         g_previousSIGSEGV.sa_sigaction(code, siginfo, context);
@@ -572,6 +599,8 @@ void SIGFPEHandler(int code, siginfo_t *siginfo, void *context)
         return;
     }
 
+    InvokeFatalErrorHandlerForNativeException(siginfo, context);
+
     if (g_previousSIGFPE.sa_sigaction != NULL)
     {
         g_previousSIGFPE.sa_sigaction(code, siginfo, context);

src/coreclr/nativeaot/System.Private.CoreLib/src/Internal/Runtime/MethodTable.Runtime.cs

@@ -19,7 +19,7 @@ internal unsafe partial struct MethodTable
 
         internal Exception GetClasslibException(ExceptionIDs id)
         {
-            return RuntimeExceptionHelpers.GetRuntimeException(id);
+            return RuntimeExceptionHelpers.GetRuntimeException(id, IntPtr.Zero);
         }
 #pragma warning restore CA1822
 

src/coreclr/nativeaot/System.Private.CoreLib/src/System.Private.CoreLib.csproj

@@ -234,6 +234,7 @@
     <Compile Include="System\RuntimeTypeHandle.cs" />
     <Compile Include="System\Exception.NativeAot.cs" />
     <Compile Include="System\RuntimeExceptionHelpers.cs" />
+    <Compile Include="System\Runtime\ExceptionServices\ExceptionHandling.NativeAot.cs" />
     <Compile Include="System\EETypePtr.cs" />
     <Compile Include="System\Runtime\RuntimeImports.cs" />
     <Compile Include="System\ModuleHandle.cs" />

src/coreclr/nativeaot/System.Private.CoreLib/src/System/Runtime/ExceptionServices/ExceptionHandling.NativeAot.cs

@@ -0,0 +1,24 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Threading;
+
+namespace System.Runtime.ExceptionServices
+{
+    public static partial class ExceptionHandling
+    {
+        internal static IntPtr s_fatalErrorHandler;
+
+        private static unsafe bool TrySetFatalErrorHandler(IntPtr handler)
+        {
+            if (Interlocked.CompareExchange(ref s_fatalErrorHandler, handler, IntPtr.Zero) != IntPtr.Zero)
+                return false;
+
+            // Register the user callback with the native runtime so genuinely-unmanaged
+            // fatal exceptions can invoke it without transitioning into managed code.
+            RuntimeImports.RhpRegisterFatalErrorHandler((void*)handler);
+
+            return true;
+        }
+    }
+}

src/coreclr/nativeaot/System.Private.CoreLib/src/System/Runtime/RuntimeImports.cs

@@ -38,6 +38,15 @@ internal static partial class RuntimeImports
         [RuntimeImport(RuntimeLibrary, "RhGetCrashInfoBuffer")]
         internal static extern unsafe byte* RhGetCrashInfoBuffer(out int cbMaxSize);
 
+        // Registers the user callback for genuinely-unmanaged fatal exceptions.
+        [MethodImplAttribute(MethodImplOptions.InternalCall)]
+        [RuntimeImport(RuntimeLibrary, "RhpRegisterFatalErrorHandler")]
+        internal static extern unsafe void RhpRegisterFatalErrorHandler(void* pHandler);
+
+        [MethodImplAttribute(MethodImplOptions.InternalCall)]
+        [RuntimeImport(RuntimeLibrary, "RhpTryAcquireFatalErrorHandler")]
+        internal static extern ulong RhpTryAcquireFatalErrorHandler();
+
 #if TARGET_UNIX
         [MethodImplAttribute(MethodImplOptions.InternalCall)]
         [RuntimeImport(RuntimeLibrary, "RhCreateCrashDumpIfEnabled")]