Delete FEATURE_CORRUPTING_EXCEPTIONS (#35938)

* Delete HCORMODULE

* Delete FEATURE_CORRUPTING_EXCEPTIONS

Ability to catch corrupting exceptions was disabled in .NET Core since early days for security reasons. This is still disabled after this change, but achieved in much simpler way without the full corrupting exceptions machinery.

* Delete unused bSecurityCheck argument of GetComIPFromObjectRef

src/coreclr/clrdefinitions.cmake

@@ -105,7 +105,6 @@ endif(CLR_CMAKE_TARGET_WIN32)
 add_definitions(-DFEATURE_BASICFREEZE)
 add_definitions(-DFEATURE_CORECLR)
 add_definitions(-DFEATURE_CORESYSTEM)
-add_definitions(-DFEATURE_CORRUPTING_EXCEPTIONS)
 if(FEATURE_DBGIPC)
   add_definitions(-DFEATURE_DBGIPC_TRANSPORT_DI)
   add_definitions(-DFEATURE_DBGIPC_TRANSPORT_VM)

src/coreclr/src/inc/clrconfigvalues.h

@@ -253,7 +253,6 @@ CONFIG_DWORD_INFO(INTERNAL_SuppressLockViolationsOnReentryFromOS, W("SuppressLoc
 CONFIG_DWORD_INFO_DIRECT_ACCESS(INTERNAL_AssertOnFailFast, W("AssertOnFailFast"), "")
 RETAIL_CONFIG_DWORD_INFO_EX(UNSUPPORTED_legacyCorruptedStateExceptionsPolicy, W("legacyCorruptedStateExceptionsPolicy"), 0, "Enabled Pre-V4 CSE behavior", CLRConfig::EEConfig_default)
 CONFIG_DWORD_INFO_EX(INTERNAL_SuppressLostExceptionTypeAssert, W("SuppressLostExceptionTypeAssert"), 0, "", CLRConfig::EEConfig_default)
-RETAIL_CONFIG_DWORD_INFO_EX(UNSUPPORTED_FailFastOnCorruptedStateException, W("FailFastOnCorruptedStateException"), 0, "Failfast if a CSE is encountered", CLRConfig::EEConfig_default)
 RETAIL_CONFIG_DWORD_INFO_EX(INTERNAL_UseEntryPointFilter, W("UseEntryPointFilter"), 0, "", CLRConfig::EEConfig_default)
 RETAIL_CONFIG_DWORD_INFO_EX(INTERNAL_Corhost_Swallow_Uncaught_Exceptions, W("Corhost_Swallow_Uncaught_Exceptions"), 0, "", CLRConfig::EEConfig_default)
 

src/coreclr/src/inc/corpriv.h

@@ -25,9 +25,6 @@
 
 interface IAssemblyName;
 
-// PE images loaded through the runtime.
-typedef struct _dummyCOR { BYTE b; } *HCORMODULE;
-
 class UTSemReadWrite;
 
 // Helper function to get a pointer to the Dispenser interface.
@@ -70,11 +67,6 @@ STDAPI GetAssemblyMDInternalImport(     // Return code.
     REFIID      riid,                   // [IN] The interface desired.
     IUnknown    **ppIUnk);              // [OUT] Return interface on success.
 
-HRESULT GetAssemblyMDInternalImportFromImage(
-    HCORMODULE hImage,                         //[IN] pointer to module handle to get the metadata from.
-    REFIID riid,                               //[IN] The interface desired.
-    IUnknown **ppIUnk);                        //[OUT] Return Interface on success.
-
 STDAPI GetAssemblyMDInternalImportByStream( // Return code.
     IStream     *pIStream,              // [IN] The IStream for the file
     UINT64      AssemblyId,             // [IN] Unique Id for the assembly
@@ -303,60 +295,6 @@ typedef enum CorOpenFlagsInternal
 #define COR_MODULE_CLASS    "<Module>"
 #define COR_WMODULE_CLASS   W("<Module>")
 
-STDAPI RuntimeOpenImage(LPCWSTR pszFileName, HCORMODULE* hHandle);
-STDAPI RuntimeOpenImageInternal(LPCWSTR pszFileName, HCORMODULE* hHandle,
-                                DWORD *pdwLength, MDInternalImportFlags flags, HANDLE hFile = INVALID_HANDLE_VALUE);
-STDAPI RuntimeOpenImageByStream(IStream* pIStream, UINT64 AssemblyId, DWORD dwModuleId,
-                                HCORMODULE* hHandle, DWORD *pdwLength, MDInternalImportFlags flags);
-
-void   RuntimeAddRefHandle(HCORMODULE hHandle);
-STDAPI RuntimeReleaseHandle(HCORMODULE hHandle);
-STDAPI RuntimeGetImageBase(HCORMODULE hHandle, LPVOID* base, BOOL bMapped, COUNT_T* dwSize);
-STDAPI RuntimeGetImageKind(HCORMODULE hHandle, DWORD* pdwKind, DWORD* pdwMachine);
-STDAPI RuntimeOSHandle(HCORMODULE hHandle, HMODULE* hModule);
-STDAPI RuntimeGetAssemblyStrongNameHashForModule(HCORMODULE       hModule,
-                                                 IMetaDataImport *pMDimport,
-                                                 BYTE            *pbSNHash,
-                                                 DWORD           *pcbSNHash);
-STDAPI RuntimeGetMDInternalImport(HCORMODULE hHandle,
-                                  MDInternalImportFlags flags,
-                                  IMDInternalImport** ppMDImport);
-
-FORCEINLINE
-void ReleaseHCorModule(HCORMODULE hModule)
-{
-    HRESULT hr = RuntimeReleaseHandle(hModule);
-    _ASSERTE(SUCCEEDED(hr));
-}
-
-typedef Wrapper<HCORMODULE, DoNothing<HCORMODULE>, ReleaseHCorModule, (UINT_PTR) NULL> HCORMODULEHolder;
-
-
-// ===========================================================================
-// ISNAssemblySignature (similar to IAssemblySignature in V1)
-//
-// This is a private interface that allows querying of the strong name
-// signature.
-// This can be used for (strong-named) assemblies added to the GAC as
-// a unique identifier.
-//
-
-// {848845BC-0C4A-42e3-8915-DC850112443D}
-EXTERN_GUID(IID_ISNAssemblySignature, 0x848845BC, 0x0C4A, 0x42e3, 0x89, 0x15, 0xDC, 0x85, 0x01, 0x12, 0x44, 0x3D);
-
-#undef  INTERFACE
-#define INTERFACE ISNAssemblySignature
-DECLARE_INTERFACE_(ISNAssemblySignature, IUnknown)
-{
-    // Returns the strong-name signature if the assembly is strong-name-signed
-    // Returns the MVID if the assembly is delay-signed.
-    // Fails if the assembly is not signed at all.
-    STDMETHOD(GetSNAssemblySignature) (
-        BYTE  *pbSig,    // [IN, OUT] Buffer to write signature
-        DWORD *pcbSig    // [IN, OUT] Size of buffer, bytes written
-    ) PURE;
-};
-
 //-------------------------------------
 //--- ICeeGenInternal
 //-------------------------------------

src/coreclr/src/inc/ex.h

@@ -706,93 +706,17 @@ class CAutoTryCleanup
         EX_RETHROW;                                                     \
     }                                                                   \
 
-// Don't use this - use RethrowCorruptingExceptions (see below) instead.
 #define SwallowAllExceptions ;
 
-//////////////////////////////////////////////////////////////////////
-//
-// Corrupted State Exception Support
-//
-/////////////////////////////////////////////////////////////////////
-
-#ifdef FEATURE_CORRUPTING_EXCEPTIONS
-
-#define CORRUPTING_EXCEPTIONS_ONLY(expr) expr
-#define COMMA_CORRUPTING_EXCEPTIONS_ONLY(expr) ,expr
-
-// EX_END_CATCH has been modified to not swallow Corrupting Exceptions (CE) when one of the
-// following arguments are passed to it:
-//
-// 1) RethrowTerminalExceptions - rethrows both terminal and corrupting exceptions
-// 2) RethrowCorruptingExceptions - swallows all exceptions exception corrupting exceptions. This SHOULD BE USED instead of SwallowAllExceptions.
-// 3) RethrowTerminalExceptionsEx - same as (1) but rethrow of CE can be controlled via a condition.
-// 4) RethrowCorruptingExceptionsEx - same as (2) but rethrow of CE can be controlled via a condition.
-//
-// By default, if a CE is encountered when one of the above policies are applied, the runtime will
-// ensure that the CE propagates up the stack and not get swallowed unless the developer chooses to override the behaviour.
-// This can be done by using the "Ex" versions above that take a conditional which evaluates to a BOOL. In such a case,
-// the CE will *only* be rethrown if the conditional evalutes to TRUE. For examples, refer to COMToCLRWorker or
-// DispatchInfo::InvokeMember implementations.
-//
-// SET_CE_RETHROW_FLAG_FOR_EX_CATCH macros helps evaluate if the CE is to be rethrown or not. This has been redefined in
-// Clrex.h to add the condition of evaluating the throwable as well (which is not available outside the VM folder).
-//
-// Passing FALSE as the second argument to IsProcessCorruptedStateException implies that SET_CE_RETHROW_FLAG_FOR_EX_CATCH
-// will ensure that we dont rethrow SO and allow EX_ENDTRY to SO specific processing. If none is done, then EX_ENDTRY will
-// rethrow SO. By that time stack has been reclaimed and thus, throwing SO will be safe.
-//
-// We also check the global override flag incase it has been set to force pre-V4 beahviour. "0" implies it has not
-// been overriden.
-#define SET_CE_RETHROW_FLAG_FOR_EX_CATCH(expr)      ((((expr) == TRUE) && \
-                                                      (CLRConfig::GetConfigValue(CLRConfig::UNSUPPORTED_legacyCorruptedStateExceptionsPolicy) == 0) && \
-                                                      IsProcessCorruptedStateException(GetCurrentExceptionCode(), FALSE)))
-
-// This rethrow policy can be used in EX_END_CATCH to swallow all exceptions except the corrupting ones.
-// This macro can be used to rethrow the CE based upon a BOOL condition.
-#define RethrowCorruptingExceptionsEx(expr)                              \
-    if (SET_CE_RETHROW_FLAG_FOR_EX_CATCH(expr))                          \
-    {                                                                    \
-        STATIC_CONTRACT_THROWS_TERMINAL;                                 \
-        EX_RETHROW;                                                      \
-    }
-
-#define RethrowCorruptingExceptionsExAndHookRethrow(shouldRethrowExpr, aboutToRethrowExpr) \
-    if (SET_CE_RETHROW_FLAG_FOR_EX_CATCH(shouldRethrowExpr))             \
-    {                                                                    \
-        STATIC_CONTRACT_THROWS_TERMINAL;                                 \
-        aboutToRethrowExpr;                                              \
-        EX_RETHROW;                                                      \
-    }
-
-#else // !FEATURE_CORRUPTING_EXCEPTIONS
-
-#define CORRUPTING_EXCEPTIONS_ONLY(expr)
-#define COMMA_CORRUPTING_EXCEPTIONS_ONLY(expr)
-
-// When we dont have support for CE, just map it to SwallowAllExceptions
-#define RethrowCorruptingExceptionsEx(expr) SwallowAllExceptions
-#define RethrowCorruptingExceptionsExAndHookRethrow(shouldRethrowExpr, aboutToRethrowExpr) SwallowAllExceptions
-#define SET_CE_RETHROW_FLAG_FOR_EX_CATCH(expr) !TRUE
-#endif // FEATURE_CORRUPTING_EXCEPTIONS
-
-// Map to RethrowCorruptingExceptionsEx so that it does the "right" thing
-#define RethrowCorruptingExceptions RethrowCorruptingExceptionsEx(TRUE)
-
-// This macro can be used to rethrow the CE based upon a BOOL condition. It will continue to rethrow terminal
-// exceptions unconditionally.
-#define RethrowTerminalExceptionsEx(expr)                               \
-    if (GET_EXCEPTION()->IsTerminal() ||                                \
-        SET_CE_RETHROW_FLAG_FOR_EX_CATCH(expr))                         \
+// When applied to EX_END_CATCH, this policy will always rethrow Terminal exceptions if they are
+// encountered.
+#define RethrowTerminalExceptions                                       \
+    if (GET_EXCEPTION()->IsTerminal())                                  \
     {                                                                   \
         STATIC_CONTRACT_THROWS_TERMINAL;                                \
         EX_RETHROW;                                                     \
     }                                                                   \
 
-
-// When applied to EX_END_CATCH, this policy will always rethrow Terminal and Corrupting exceptions if they are
-// encountered.
-#define RethrowTerminalExceptions  RethrowTerminalExceptionsEx(TRUE)
-
 // Special define to be used in EEStartup that will also check for VM initialization before
 // commencing on a path that may use the managed thread object.
 #define RethrowTerminalExceptionsWithInitCheck  \

src/coreclr/src/inc/utilcode.h

@@ -4715,13 +4715,6 @@ BOOL IsIPInModule(HMODULE_TGT hModule, PCODE ip);
 
 extern HINSTANCE g_hmodCoreCLR;
 
-#ifdef FEATURE_CORRUPTING_EXCEPTIONS
-
-// Corrupting Exception limited support for outside the VM folder
-BOOL IsProcessCorruptedStateException(DWORD dwExceptionCode, BOOL fCheckForSO = TRUE);
-
-#endif // FEATURE_CORRUPTING_EXCEPTIONS
-
 namespace UtilCode
 {
     // These are type-safe versions of Interlocked[Compare]Exchange

src/coreclr/src/md/runtime/mdinternaldisp.h

@@ -16,7 +16,6 @@
 
 #include "mdinternalro.h"
 
-
 enum MDFileFormat
 {
     MDFormat_ReadOnly = 0,
@@ -25,20 +24,13 @@ enum MDFileFormat
     MDFormat_Invalid = 3
 };
 
-
-HRESULT CheckFileFormat(LPVOID pData, ULONG cbData, MDFileFormat *pFormat);
 STDAPI GetMDInternalInterface(
     LPVOID      pData,                  // [IN] Buffer with the metadata.
     ULONG       cbData,                 // [IN] Size of the data in the buffer.
     DWORD       flags,                  // [IN] MDInternal_OpenForRead or MDInternal_OpenForENC
     REFIID      riid,                   // [in] The interface desired.
     void        **ppIUnk);              // [out] Return interface on success.
 
-HRESULT GetAssemblyMDInternalImportHelper(HCORMODULE hModule,
-                                          REFIID     riid,
-                                          MDInternalImportFlags flags,
-                                          IUnknown   **ppIUnk);
-
 #endif //FEATURE_METADATA_INTERNAL_APIS
 
 #endif // __MDInternalDispenser__h__

src/coreclr/src/utilcode/util.cpp

@@ -3031,58 +3031,6 @@ lDone: ;
     return param.fRet;
 }
 
-#ifdef FEATURE_CORRUPTING_EXCEPTIONS
-
-// To include definition of EXCEPTION_SOFTSO
-#include "corexcep.h"
-
-// These functions provide limited support for corrupting exceptions
-// outside the VM folder. Its limited since we don't have access to the
-// throwable.
-//
-// These functions are also wrapped by the corresponding CEHelper
-// methods in excep.cpp.
-
-// Given an exception code, this method returns a BOOL to indicate if the
-// code belongs to a corrupting exception or not.
-BOOL IsProcessCorruptedStateException(DWORD dwExceptionCode, BOOL fCheckForSO /*=TRUE*/)
-{
-    LIMITED_METHOD_CONTRACT;
-
-    // By default, assume its not corrupting
-    BOOL fIsCorruptedStateException = FALSE;
-
-    if (CLRConfig::GetConfigValue(CLRConfig::UNSUPPORTED_legacyCorruptedStateExceptionsPolicy) == 1)
-    {
-        return fIsCorruptedStateException;
-    }
-
-    // If we have been asked not to include SO in the CSE check
-    // and the code represent SO, then exit now.
-    if ((fCheckForSO == FALSE) && (dwExceptionCode == STATUS_STACK_OVERFLOW))
-    {
-        return fIsCorruptedStateException;
-    }
-
-    switch(dwExceptionCode)
-    {
-        case STATUS_ACCESS_VIOLATION:
-        case STATUS_STACK_OVERFLOW:
-        case EXCEPTION_ILLEGAL_INSTRUCTION:
-        case EXCEPTION_IN_PAGE_ERROR:
-        case EXCEPTION_INVALID_DISPOSITION:
-        case EXCEPTION_NONCONTINUABLE_EXCEPTION:
-        case EXCEPTION_PRIV_INSTRUCTION:
-        case STATUS_UNWIND_CONSOLIDATE:
-            fIsCorruptedStateException = TRUE;
-            break;
-    }
-
-    return fIsCorruptedStateException;
-}
-
-#endif // FEATURE_CORRUPTING_EXCEPTIONS
-
 namespace Clr
 {
 namespace Util

src/coreclr/src/vm/.vscode/c_cpp_properties.json

@@ -53,7 +53,6 @@
                 "FEATURE_COMINTEROP_WINRT_MANAGED_ACTIVATION",
                 "FEATURE_CORECLR",
                 "FEATURE_CORESYSTEM",
-                "FEATURE_CORRUPTING_EXCEPTIONS",
                 "FEATURE_DATABREAKPOINT",
                 "FEATURE_DEFAULT_INTERFACES",
                 "FEATURE_EVENT_TRACE=1",

src/coreclr/src/vm/castcache.cpp

@@ -40,7 +40,7 @@ BASEARRAYREF CastCache::CreateCastCache(DWORD size)
     EX_CATCH
     {
     }
-    EX_END_CATCH(RethrowCorruptingExceptions)
+    EX_END_CATCH(RethrowTerminalExceptions)
 
     if (!table)
     {
@@ -54,7 +54,7 @@ BASEARRAYREF CastCache::CreateCastCache(DWORD size)
         EX_CATCH
         {
         }
-        EX_END_CATCH(RethrowCorruptingExceptions)
+        EX_END_CATCH(RethrowTerminalExceptions)
 
         if (!table)
         {