1

I need to hook into C++'s exception throwing mechanism like this:

namespace __cxxabiv1
{
    extern "C" void __cxa_throw(void* voidPointerToActualObject, std::type_info* stdTypeInfoOfActualObject, void (*destructor)(void *))
    {
        // If thrownException is a custom exception type or something deriving from it, poke a value into it.
    }
}

If you're wondering "Why would you do that?"

I have this simple example of throwing an exception that's part of a very simple class hierarchy:

#include <stdexcept>

class Upper : public std::exception
{
    public:
        int pokeMe = 111111;
};
class Lower : public Upper {};

int main()
{
    throw Lower();
}

#include <cxxabi.h>

namespace __cxxabiv1
{
    extern "C" void __cxa_throw(void* voidPointerToActualObject, std::type_info* stdTypeInfoOfActualObject, void (*destructor)(void *))
    {
        // The point is to do the equivalent of this:
        Lower* staticallyTypedPointerToActualObject = reinterpret_cast<Lower*>(voidPointerToActualObject);
        auto thisWorks = dynamic_cast<Upper*>(staticallyTypedPointerToActualObject);
        thisWorks->pokeMe = 222222;

        // But we don't know the actual static type, so we can't get a statically typed pointer. We only have a void* and a type_info:
        auto abiTypeInfoOfActualObject = dynamic_cast<const abi::__class_type_info*>(stdTypeInfoOfActualObject);
        auto abiTypeInfoOfUpper = dynamic_cast<const abi::__class_type_info*>(&typeid(Upper));
        Upper* thisDoesNotWork = reinterpret_cast<Upper*>(abi::__dynamic_cast(voidPointerToActualObject, abiTypeInfoOfActualObject, abiTypeInfoOfUpper, -1));
        thisDoesNotWork->pokeMe = 333333;

        // Elided for clarity: Call the original __cxa_throw function here
        // Instead, suppress these warnings:
        (void)destructor; // Unused parameter
        while (1) { } // Return from non-returning function
    }
}

I don't see a reason why __dynamic_cast shouldn't be able to upcast, but it returns nullptr.
Why? And how do I get it to work?

It seems to be able to do downcasts just fine, BTW:

auto abiTypeInfoOfActualObject = dynamic_cast<const abi::__class_type_info*>(&typeid(Upper)); // Plonking this here for testing
auto abiTypeInfoOfUpper = dynamic_cast<const abi::__class_type_info*>(&typeid(Lower)); // Casting to Lower instead of Upper
Lower* thisDoesNotWork = reinterpret_cast<Lower*>(abi::__dynamic_cast(voidPointerToActualObject, abiTypeInfoOfActualObject, abiTypeInfoOfUpper, -1));
3
  • 1
    Why can't the hooked __cxa_throw use the normal dynamic_cast? Jan 30 at 10:38
  • @HolyBlackCat dynamic_cast<T>(x) requires that the static type of x is a pointer to a class type that "somehow relates to T". But voidPointerToActualObject is a void*. I can reinterpret_cast that to Lower* in my example because I know for a fact that I throw that. But a program could throw a number of different things that don't relate to Lower or Upper. E.g. throw "NotEvenAnException";.
    – Niko O
    Jan 30 at 12:41
  • This suggests that abi::__dynamic_cast only implements base-to-derived cast and cross-cast. It doesn't expect to be called for a derived-to-base cast because the compiler is assumed to have resolved this cast at compile time, by effectively replacing it with static_cast. Jan 31 at 14:44

1 Answer 1

0

I managed to dig up this archived conversation from 2004:

The ABI document does not require that __dynamic_cast perform a derived-to-base cast. Those __dynamic_cast operations that can actually be performed statically by the compiler must be performed statically by the compiler -- the runtime library does not expect to be called in that situation.

So that answers that question. Greeeeeeat.
But the conversation luckily mentions:

Yes; the holder knows the static type; it can throw a pointer of that type. The cast operation can catch the pointer type it's looking for, or fail the cast with catch(...).

That gave me the idea to try this (simplified version):

namespace __cxxabiv1
{

    using ThrowFunction = decltype(__cxa_throw)*;
    ThrowFunction oldThrowFunction = nullptr;

    extern "C" void __cxa_throw(void* voidPointerToActualObject, std::type_info* stdTypeInfoOfActualObject, void (*destructor)(void *))
    {
        if (oldThrowFunction == nullptr)
        {
            oldThrowFunction = (ThrowFunction)dlsym(RTLD_NEXT, "__cxa_throw");
        }

        try
        {
            oldThrowFunction(voidPointerToActualObject, stdTypeInfoOfActualObject, destructor);
        }
        catch (Upper& ex)
        {
            ex.pokeMe = 333333;
        }
        catch (...)
        {
        }

        oldThrowFunction(voidPointerToActualObject, stdTypeInfoOfActualObject, destructor);
    }
}

And I can't believe it but it actually works!

Edit: Disclaimer: It seems that this way, the destructor callback is actually called twice, because if use std::string pokeMe, the string is trashed by the time I get to the second call to oldThrowFunction. I'll experiment around with over the next few days.

Edit2: That's indeed the case. I couldn't find anything indicating whether __cxa_throw accepts nullptr as the destructor argument (it didn't crash for me, at least), so the safest bet is to pass a pointer to an empty dummy function:

void dummyDestructor(void*)
{
}
//...
oldThrowFunction(voidPointerToActualObject, stdTypeInfoOfActualObject, &dummyDestructor);

Edit 3: Goddamnit! It seems that this causes memory corruption. malloc crashes with a segfault at a later point when doing this.
Back to square -5.

6
  • Perhaps rethrow using throw; or std::rethrow_exception? And to avoid infinite recursion, add a global flag (possibly thread_local) to see if you're rethrowing or not. Feb 2 at 10:26
  • throw; wouldn't work because that only works in a catch block. std::rethrow_exception needs an std::exception_ptr. I can probably create that from the void*. I'll test it when I have the time and report back.
    – Niko O
    Feb 2 at 13:01
  • But you do have a catch block. Feb 2 at 13:03
  • Right now, yes. But see Edit 3. This approach of throwing with oldThrowFunction and immediately catching it to see if it's the right type, then throwing it again with oldThrowFunction, seems to corrupt memory. That's why I need to replace this approach. I assumed you were suggesting a replacement. Is that not the case?
    – Niko O
    Feb 2 at 13:12
  • Yes, I'm saying that instead of the second oldThrowFunction, you use throw, which in turn calls your __cxa_throw, which calls oldThrowFunction. This way you have one oldThrowFunction per one __cxa_throw, which might fix memory corruption. Feb 2 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.