fix: split inproc handler thread by supervacuus · Pull Request #1446 · getsentry/sentry-native

supervacuus · 2025-11-10T10:59:44Z

This is a more elaborate, long-term fix to getsentry/sentry-java#4830 than #1444.

It also finishes the work done here: #1088
And fixes the issues raised here:

So, while the driver for this PR is a downstream issue that exposes the signal-unsafety of some parts of the current inproc implementation, it also addresses a much broader range of concerns that regularly affect inproc users on all platforms.

At a high level, it introduces a separate handler thread for inproc, which the signal handler (or UEF on Windows) wakes after it exchanges crash context data.

The idea is that we minimize signal handler/UEF to do the least amount of syscall stuff (or at least the subset documented in the signal-safety man-page), while the handler thread can execute functions outside that range (with limitations, since thread sync and heap allocations are still problematic). This allows us to reuse stdio functionality like formatters without running squarely into UB territory or having to rewrite all utilities to async-signal-safe versions, as in #1444.

There are a few considerable changes to mention:

since we run the event construction in a separate handler thread, the use of backtrace() or any unwinder that runs from the "current" instruction address is entirely useless (ignoring the fact that backtrace() was always signal-unsafe to begin with, which itself was the source of crashes, hangs or just empty stack traces).
this means we require a "user context"-based stack walker in inproc, which we already partially acknowledged in Using libunwind for mac, since backtrace do not expect thread context… #1088 and fix: support musl on Linux #1233.
on Linux, this PR requires libunwind (the nognu implementation, not the llvm one, which is a pure C++ exception unwinder), which is a breaking change (at least in the sense that users now require an additional dependency at build and runtime). This means that the "general" Linux usage is now the same as with the musl libc environments.
on macOS, we provide a user context stack-walker based on frame pointer records for arm64 and x86-64, and use the system-provided libunwind for the default stack-trace from a call-site. It turned out that the system-provided libunwind wasn't safe enough to use in the context of the signal handler (either led to hangs or had issues with escaping the trampoline). This means users can now use inproc on macOS again (if their code is compiled without omitting frame pointers, which is always the case by default on macOS).

Further improvements/fixes (summarizing the 30 commits, which I didn't want to squash):

the libunwind-based unwinder modules now also validate retrieved ucontext pointers against memory mapping (for Linux and macOS)
got rid of all remaining __sync functions and replaced them with __atomic (especially the signal handler blocking logic and the spinlock)
rectified the inconsistent usage of C++ new with std::nothrow throughout the affected backend code (including the initialization of crashpad_state_t, which still used malloc and memset although it has std::atomic members)
cleaned up the CMake configure phase of the integration test suite.
ensures that test fixtures do not end up in macOS bundles
fixes build issues with by-default PIE and LTO builds
musl is no longer a special case "Linux" in the build script
fixes a couple of warnings and test-case instabilities
introduce macos-26 build config

TODOs:

finish the x86-64 stackwalker for macOS (and clean up the code)
Figure out if we need the libbacktrace fallback at all and how to handle it.
provide a module-level description of the new mechanism in inproc
Decide on having the change
Update documentation
- Advanced usage might be outdated wrt to signal handling of inproc (fix(native): document inproc backend handler thread sentry-docs#16449)
- Remove mentions of inproc not working on macOS
- Clarify the new libunwind dependency on Linux

* use `std::nothrow` `new` consistently to keep exception-free semantics for allocation * rename static crashpad_handler to have no module-public prefix * use `nullptr` for arguments where we previously used 0 to clarify that those are pointers * eliminate the `memset()` of the `crashpad_state_t` initialization since it now contains non-trivially constructable fields (`std::atomic`) and replace it with `new` and an empty value initializer.

…ld, since libraries like libunwind.a might be packaged without PIC.

…ms with architecture prefixes (32-bit Linux)

…stack also ensure to get the first frame harmonize libunwind usage

jpnurmi

Are the crashpad and breakpad changes related?

src/sentry_string.h

supervacuus · 2026-02-16T06:57:30Z

Are the crashpad and breakpad changes related?

Only in the sense that I was getting compiler errors with Werror on one of my test setups, and I thought: Why not fix it. The changes are not behavioral at all: the initial code was already written as if new could return a nullptr.

getsentry/sentry-native#1446

* remove return value from sentry__addr_to_string() * vendor libunwind with a minimal Linux cmake setup for Linux x86, x86_64 and aarch64 * set CMAKE_SYSTEM_PROCESSOR=i686 for SENTRY_BUILD_FORCE32 * build libunwind with C11 target props * fix the source instead of setting C11 on target * move unw_context_t out of the else block. * enable ASM for libunwind * remove the ASM in ENABLED_LANGUAGES check for the breakpad build * remove unused files * document all changes * also get rid of humongous autoreconf generated release artifacts

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

CMakeLists.txt

getsentry/sentry-native#1446

Removed note about 'libunwind' requirement for Linux.

Update CHANGELOG with breaking changes and new features.

supervacuus · 2026-02-18T10:42:48Z

@jpnurmi, I saw you also ran against this branch. Any reasons not to merge this?

jpnurmi

LGTM 👍

Tested with sentry-dotnet: getsentry/sentry-dotnet#4926

jpnurmi · 2026-02-18T10:43:31Z

src/backends/sentry_backend_inproc.c

+#endif
+
+/**
+ * Inproc Backend Introduction


Thanks! I really tried not to be terse here because there is a lot of non-obvious, non-explicit stuff going on. At the same time, it required many explicit code changes to model the domain, which could feel overwhelming without the matching prose.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

tests/cmake.py

….py)

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

src/backends/sentry_backend_inproc.c

…path

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

src/sentry_sync.h

## DESCRIBE YOUR PR This PR updates the native docs wrt the changes introduced here: getsentry/sentry-native#1446 ## IS YOUR CHANGE URGENT? Help us prioritize incoming PRs by letting us know when the change needs to go live. - [ ] Urgent deadline (GA date, etc.):  - [ ] Other deadline:  - [x] None: Not urgent, can wait up to 1 week+ ## SLA - Teamwork makes the dream work, so please add a reviewer to your PRs. - Please give the docs team up to 1 week to review your PR unless you've added an urgent due date to it. Thanks in advance for your help! ## PRE-MERGE CHECKLIST *Make sure you've checked the following before merging your changes:* - [x] Checked Vercel preview for correctness, including links - [x] PR was reviewed and approved by any necessary SMEs (subject matter experts) - [ ] PR was reviewed and approved by a member of the [Sentry docs team](https://github.com/orgs/getsentry/teams/docs) ## LEGAL BOILERPLATE  Look, I get it. The entity doing business as "Sentry" was incorporated in the State of Delaware in 2015 as Functional Software, Inc. and is gonna need some rights from me in order to utilize my contributions in this here PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Sentry can use, modify, copy, and redistribute my contributions, under Sentry's choice of terms. ## EXTRA RESOURCES - [Sentry Docs contributor guide](https://docs.sentry.io/contributing/)

supervacuus added 30 commits November 6, 2025 11:10

fix: split inproc with a handler thread

01eb6e1

prevent warning on write() return value

7eb3ca8

get rid of unsused dispatch parameter

0cff127

and another unused return value for write()

1265007

fix trivial windows compile def issues to run tests locally

b57995c

make tests a bit less brittle

5a11ea2

ensure that find_cp_path isn't built on windows.

b83fc37

eliminate local handler strategy declaration in signal handler

c78f425

turn off painful warning noise

116c4a5

add libunwind to the CI dependencies

b4747c7

ensure we build the example with PIE disabled when doing a static bui…

d21c180

…ld, since libraries like libunwind.a might be packaged without PIC.

extend handler crash to windows

b0822d3

further clean of inproc

8b93cca

review and fix/remove remaining TODOs from branch changes

c4f662a

eliminate multichar warning in crashpad backend when using GCC

84b3a7a

ensure libunwind in benchmark and codeql workflows

ef7b03b

fix Linux ARM64 build (warning in libunwind)

6ae25c3

provide an x86_64 ucontext stackwalker for macOS

a0195db

bump lower-end GCC to 10.5.0

8a63e64

remove obsolete ASAN patch from CI

c1fd0a8

ensure lower-end GCC also finds libunwind

7c97dbb

disable LTO for the example too

524d8b4

use clang diagnostics only for __clang__

1c378c3

install 32-bit libunwind package for 32-bit Linux CI test config

4912a82

fix weird linker asymmetry

0c24c4f

provide empty path-suffix so that CMake can find libunwind on platfor…

70dd979

…ms with architecture prefixes (32-bit Linux)

remove can_lock mechanism from the handler block API

4449859

use PRIx64 without ull cast in sentry__value_new_addr()

4ce7940

fix off-by-one bug when returning the trace length after walking the …

8954928

…stack also ensure to get the first frame harmonize libunwind usage

supervacuus requested review from JoshuaMoelans and jpnurmi and removed request for jpnurmi February 13, 2026 08:43

jpnurmi reviewed Feb 13, 2026

View reviewed changes

src/sentry_string.h Outdated Show resolved Hide resolved

jpnurmi added a commit to getsentry/sentry-dotnet that referenced this pull request Feb 16, 2026

deps(sentry-native): checkout fix/split_inproc_handler_thread

06c7dc6

getsentry/sentry-native#1446

jpnurmi mentioned this pull request Feb 16, 2026

WIP: try inproc with libunwind getsentry/sentry-dotnet#4926

Draft

cursor bot reviewed Feb 17, 2026

View reviewed changes

CMakeLists.txt Outdated Show resolved Hide resolved

jpnurmi added a commit to getsentry/sentry-dotnet that referenced this pull request Feb 18, 2026

deps(sentry-native): checkout fix/split_inproc_handler_thread

0ff84eb

getsentry/sentry-native#1446

supervacuus added 3 commits February 18, 2026 11:31

remove no-pie/no-lto options from example entirely

11d2887

Update CONTRIBUTING.md to remove libunwind note

4c1c823

Removed note about 'libunwind' requirement for Linux.

Revise CHANGELOG for breaking changes

2c81320

Update CHANGELOG with breaking changes and new features.

jpnurmi approved these changes Feb 18, 2026

View reviewed changes

cursor bot reviewed Feb 18, 2026

View reviewed changes

tests/cmake.py Show resolved Hide resolved

test: eliminate llvm-cov flag duplication (cmake.py vs build_config…

32e2efd

….py)

cursor bot reviewed Feb 18, 2026

View reviewed changes

src/backends/sentry_backend_inproc.c Show resolved Hide resolved

Changed depth >= 2 to skip_hooks in the Unix pipe-failure fallback …

35f2a46

…path

cursor bot reviewed Feb 18, 2026

View reviewed changes

src/sentry_sync.h Show resolved Hide resolved

supervacuus merged commit eecc7fa into master Feb 18, 2026
46 checks passed

supervacuus deleted the fix/split_inproc_handler_thread branch February 18, 2026 12:22

supervacuus mentioned this pull request Feb 18, 2026

fix(native): document inproc backend handler thread getsentry/sentry-docs#16449

Merged

6 tasks

getsentry deleted a comment from github-actions bot Feb 19, 2026

BrewTestBot mentioned this pull request Feb 20, 2026

sentry-native 0.13.0 Homebrew/homebrew-core#268579

Merged

1 task

Uh oh!

Comments

Conversation

supervacuus commented Nov 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jpnurmi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

supervacuus commented Feb 16, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

supervacuus commented Feb 18, 2026

Uh oh!

jpnurmi left a comment

Choose a reason for hiding this comment

Uh oh!

jpnurmi Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

supervacuus Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

supervacuus commented Nov 10, 2025 •

edited

Loading