Experts catching panics wrong?

[quinedot]

@geebee22

quinedot wrote:

"There are also a lot of tricky caveats around catching panics that even experts get wrong."

What exactly are you referring to?

From the thread I also linked to, there's the issues @kpreid pointed out (bugs in rustc/stdlib -- experts getting it wrong), followed by some conversations around the RUDRA paper.

To quote the Lang team lead in #97,

Code using catch_unwind is not typically prepared to handle an object that panics in its Drop impl. Even the standard library has had various bugs in this regard, and if the standard library doesn't consistently get it right, we can hardly expect others to do so.

That quote is in the context of removing that particular footgun, but there is no consensus yet and the footgun still exists.

Those are the citations I have on hand, but I've seen other examples via TWIR, changesets, blog posts, and the like.

@kpreid

If you're writing a library, and you're relying on catch_unwind for soundness (for example, any FFI wrapper that accepts a Rust function as a callback called from C must, since panics must not cross FFI boundaries), then your library is unsound if you don't handle this because your library being sound means that it can't cause UB no matter what any of the code interacting with it does.

I want to highlight this as well. Protecting an FFI boundary from unwind UB is one of the niche circumstances where catching panics is not only applicable, but necessary. And because it's a soundness issue, "eh, esoteric circumstances" doesn't cut it in a language like Rust, where safety is a core tenant.

It can be a struggle to recognize when coming from C/C++ say, where a lot of UB is "turned off" with compiler flags or just culturally ignored.

I do recognize that if there's not a risk of UB, it may not be worth one's effort, and slapping a good-enough sticker on it is a viable approach. However, catch_unwind does not protect you from unexpectedly broken logical invariants (as panics break the library API), so trying to recover can still be risky (prone to bugs).