|
3 | 3 | r[panic] |
4 | 4 |
|
5 | 5 | r[panic.intro] |
6 | | -Rust provides a mechanism to prevent a function from returning normally, and |
7 | | -instead "panic," which is a response to an error condition that is typically |
8 | | -not expected to be recoverable within the context in which the error is |
9 | | -encountered. |
| 6 | +Rust provides a mechanism to prevent a function from returning normally, and instead "panic," which is a response to an error condition that is typically not expected to be recoverable within the context in which the error is encountered. |
10 | 7 |
|
11 | 8 | r[panic.lang-ops] |
12 | | -Some language constructs, such as out-of-bounds [array indexing], panic |
13 | | -automatically. |
| 9 | +Some language constructs, such as out-of-bounds [array indexing], panic automatically. |
14 | 10 |
|
15 | 11 | r[panic.control] |
16 | | -There are also language features that provide a level of control |
17 | | -over panic behavior: |
18 | | -* A [_panic runtime_](#panic-runtimes) defined how a panic is handled during |
19 | | - runtime. |
| 12 | +There are also language features that provide a level of control over panic behavior: |
| 13 | + |
| 14 | +* A [_panic runtime_](#panic-runtimes) defined how a panic is handled during runtime. |
20 | 15 | * [FFI ABIs](items/functions.md#unwinding) may alter how panics behave. |
21 | 16 |
|
22 | 17 | > [!NOTE] |
23 | | -> The standard library provides the capability to explicitly panic |
24 | | -> via the [`panic!` macro][panic!]. |
| 18 | +> The standard library provides the capability to explicitly panic via the [`panic!` macro][panic!]. |
25 | 19 |
|
26 | 20 | ## Unwinding |
27 | 21 |
|
28 | 22 | r[panic.unwind] |
29 | 23 |
|
30 | 24 | r[panic.unwind.intro] |
31 | | -Panicking may either be recoverable or non-recoverable, though it can be |
32 | | -configured (via `panic=abort`) to always be non-recoverable. (The converse is |
33 | | -not true: `panic=unwind` does not guarantee that all panics are recoverable, |
34 | | -only that panicking via the `panic!` macro and similar standard library |
35 | | -mechanisms is recoverable.) |
| 25 | +Panicking may either be recoverable or non-recoverable, though it can be configured (via `panic=abort`) to always be non-recoverable. (The converse is not true: `panic=unwind` does not guarantee that all panics are recoverable, only that panicking via the `panic!` macro and similar standard library mechanisms is recoverable.) |
36 | 26 |
|
37 | 27 | r[panic.unwind.destruction] |
38 | | -When panic recovery occurs, the runtime "unwinds" Rust frames, just as C++'s `throw` unwinds C++ frames, until the panic reaches |
39 | | -the point of recovery (for instance at a thread boundary). This means that as |
40 | | -the panic traverses Rust frames, live objects in those frames that [implement |
41 | | -`Drop`][destructors] will have their `drop` methods called. Thus, when normal |
42 | | -execution resumes, no-longer-accessible objects will have been "cleaned up" |
43 | | -just as if they had gone out of scope normally. |
| 28 | +When panic recovery occurs, the runtime "unwinds" Rust frames, just as C++'s `throw` unwinds C++ frames, until the panic reaches the point of recovery (for instance at a thread boundary). This means that as the panic traverses Rust frames, live objects in those frames that [implement `Drop`][destructors] will have their `drop` methods called. Thus, when normal execution resumes, no-longer-accessible objects will have been "cleaned up" just as if they had gone out of scope normally. |
44 | 29 |
|
45 | 30 | > [!NOTE] |
46 | | -> As long as this guarantee of resource-cleanup is preserved, |
47 | | -> "unwinding" may be implemented without actually using the mechanism used by |
48 | | -> C++ for the target platform. |
| 31 | +> As long as this guarantee of resource-cleanup is preserved, "unwinding" may be implemented without actually using the mechanism used by C++ for the target platform. |
49 | 32 |
|
50 | 33 | > [!NOTE] |
51 | | -> The standard library provides two mechanisms for recovering from a panic, |
52 | | -> [`std::panic::catch_unwind`] (which enables recovery within the |
53 | | -> panicking thread) and [`std::thread::spawn`] (which automatically |
54 | | -> sets up panic recovery for the spawned thread so that other threads may |
55 | | -> continue running). |
| 34 | +> The standard library provides two mechanisms for recovering from a panic, [`std::panic::catch_unwind`] (which enables recovery within the panicking thread) and [`std::thread::spawn`] (which automatically sets up panic recovery for the spawned thread so that other threads may continue running). |
56 | 35 |
|
57 | 36 | ### Unwinding across FFI boundaries |
58 | 37 |
|
59 | 38 | r[panic.unwind.ffi] |
60 | 39 |
|
61 | 40 | r[panic.unwind.ffi.intro] |
62 | | -It is possible to unwind across FFI boundaries using an [appropriate ABI |
63 | | -declaration][unwind-abi]. While useful in certain cases, this creates unique |
64 | | -opportunities for undefined behavior, especially when multiple language runtimes |
65 | | -are involved. |
| 41 | +It is possible to unwind across FFI boundaries using an [appropriate ABI declaration][unwind-abi]. While useful in certain cases, this creates unique opportunities for undefined behavior, especially when multiple language runtimes are involved. |
66 | 42 |
|
67 | 43 | r[panic.unwind.ffi.undefined] |
68 | 44 | Unwinding with the wrong ABI is undefined behavior: |
69 | 45 |
|
70 | | -* Causing an unwind into Rust code from a foreign function that was called via a |
71 | | - function declaration or pointer declared with a non-unwinding ABI, such as `"C"`, |
72 | | - `"system"`, etc. (For example, this case occurs when such a function written in |
73 | | - C++ throws an exception that is uncaught and propagates to Rust.) |
74 | | -* Calling a Rust `extern` function that unwinds (with `extern "C-unwind"` or |
75 | | - another ABI that permits unwinding) from a runtime that does not support. |
76 | | - unwinding, such as code compiled with GCC or Clang using `-fno-exceptions` |
| 46 | +* Causing an unwind into Rust code from a foreign function that was called via a function declaration or pointer declared with a non-unwinding ABI, such as `"C"`, `"system"`, etc. (For example, this case occurs when such a function written in C++ throws an exception that is uncaught and propagates to Rust.) |
| 47 | +* Calling a Rust `extern` function that unwinds (with `extern "C-unwind"` or another ABI that permits unwinding) from a runtime that does not support. unwinding, such as code compiled with GCC or Clang using `-fno-exceptions` |
77 | 48 |
|
78 | 49 | r[panic.unwind.ffi.catch-foreign] |
79 | | -Catching a foreign unwinding operation (such as a C++ exception) using |
80 | | -[`std::panic::catch_unwind`], [`std::thread::JoinHandle::join`], or by letting it propagate beyond the |
81 | | -Rust `main()` function or thread root will have one of two behaviors, and it is unspecified |
82 | | -which will occur: |
| 50 | +Catching a foreign unwinding operation (such as a C++ exception) using [`std::panic::catch_unwind`], [`std::thread::JoinHandle::join`], or by letting it propagate beyond the Rust `main()` function or thread root will have one of two behaviors, and it is unspecified which will occur: |
| 51 | + |
83 | 52 | * The process aborts. |
84 | 53 | * The function returns a [`Result::Err`] containing an opaque type. |
85 | 54 |
|
86 | 55 | > [!NOTE] |
87 | | -> Rust code compiled or linked with a different instance of the Rust runtime counts as a |
88 | | -> "foreign exception" for the purpose of this guarantee. Thus, a library that |
89 | | -> uses `panic!` and is linked against one version of the Rust standard library, |
90 | | -> invoked from an application that uses a different version of the standard |
91 | | -> library, may cause the entire application to crash even if the library is only |
92 | | -> used within a child thread. |
| 56 | +> Rust code compiled or linked with a different instance of the Rust runtime counts as a "foreign exception" for the purpose of this guarantee. Thus, a library that uses `panic!` and is linked against one version of the Rust standard library, invoked from an application that uses a different version of the standard library, may cause the entire application to crash even if the library is only used within a child thread. |
93 | 57 |
|
94 | 58 | r[panic.unwind.ffi.dispose-panic] |
95 | | -There are currently no guarantees about the behavior that occurs when a foreign |
96 | | -runtime attempts to dispose of, or rethrow, a Rust `panic` payload. In other |
97 | | -words, an unwind originated from a Rust runtime must either lead to termination |
98 | | -of the process or be caught by the same runtime. |
| 59 | +There are currently no guarantees about the behavior that occurs when a foreign runtime attempts to dispose of, or rethrow, a Rust `panic` payload. In other words, an unwind originated from a Rust runtime must either lead to termination of the process or be caught by the same runtime. |
99 | 60 |
|
100 | 61 | ## Panic runtimes |
101 | 62 |
|
102 | 63 | r[panic.runtime] |
103 | 64 |
|
104 | | -The actual behavior and implementation of `panic!` is controlled by the _panic |
105 | | -runtime_. |
| 65 | +The actual behavior and implementation of `panic!` is controlled by the _panic runtime_. |
106 | 66 |
|
107 | 67 | > [!NOTE] |
108 | | -> The Rust standard library provides two panic runtimes: |
109 | | -> `panic_unwind` (which unwinds the stack and is potentially recoverable) and |
110 | | -> `panic_abort` (which aborts the process and is non-recoverable). The default |
111 | | -> runtime depends on the target platform, but is generally `panic_unwind` on |
112 | | -> platforms with native support for C++ exceptions. |
| 68 | +> The Rust standard library provides two panic runtimes: `panic_unwind` (which unwinds the stack and is potentially recoverable) and `panic_abort` (which aborts the process and is non-recoverable). The default runtime depends on the target platform, but is generally `panic_unwind` on platforms with native support for C++ exceptions. |
113 | 69 |
|
114 | 70 | > [!NOTE] |
115 | | -> When compiling code that is guaranteed to be linked to a non-recoverable panic |
116 | | -> runtime, the optimizer may assume that unwinding across Rust frames is |
117 | | -> impossible, which can result in both code-size and runtime speed improvements. |
| 71 | +> When compiling code that is guaranteed to be linked to a non-recoverable panic runtime, the optimizer may assume that unwinding across Rust frames is impossible, which can result in both code-size and runtime speed improvements. |
118 | 72 |
|
119 | 73 | See also the [`panic_handler` attribute](runtime.md#the-panic_handler-attribute) which can be used to change the behavior of panics. |
120 | 74 |
|
|
0 commit comments