|
3 | 3 | r[panic]
|
4 | 4 |
|
5 | 5 | r[panic.intro]
|
6 |
| -Rust provides a mechanism to prevent a function from returning normally, and |
7 |
| -instead "panic," which is a response to an error condition that is typically |
8 |
| -not expected to be recoverable within the context in which the error is |
9 |
| -encountered. |
| 6 | +Rust provides a mechanism to prevent a function from returning normally, and instead "panic," which is a response to an error condition that is typically not expected to be recoverable within the context in which the error is encountered. |
10 | 7 |
|
11 | 8 | r[panic.lang-ops]
|
12 |
| -Some language constructs, such as out-of-bounds [array indexing], panic |
13 |
| -automatically. |
| 9 | +Some language constructs, such as out-of-bounds [array indexing], panic automatically. |
14 | 10 |
|
15 | 11 | r[panic.control]
|
16 |
| -There are also language features that provide a level of control |
17 |
| -over panic behavior: |
18 |
| -* A [_panic runtime_](#panic-runtimes) defined how a panic is handled during |
19 |
| - runtime. |
| 12 | +There are also language features that provide a level of control over panic behavior: |
| 13 | + |
| 14 | +* A [_panic runtime_](#panic-runtimes) defined how a panic is handled during runtime. |
20 | 15 | * [FFI ABIs](items/functions.md#unwinding) may alter how panics behave.
|
21 | 16 |
|
22 | 17 | > [!NOTE]
|
23 |
| -> The standard library provides the capability to explicitly panic |
24 |
| -> via the [`panic!` macro][panic!]. |
| 18 | +> The standard library provides the capability to explicitly panic via the [`panic!` macro][panic!]. |
25 | 19 |
|
26 | 20 | ## Unwinding
|
27 | 21 |
|
28 | 22 | r[panic.unwind]
|
29 | 23 |
|
30 | 24 | r[panic.unwind.intro]
|
31 |
| -Panicking may either be recoverable or non-recoverable, though it can be |
32 |
| -configured (via `panic=abort`) to always be non-recoverable. (The converse is |
33 |
| -not true: `panic=unwind` does not guarantee that all panics are recoverable, |
34 |
| -only that panicking via the `panic!` macro and similar standard library |
35 |
| -mechanisms is recoverable.) |
| 25 | +Panicking may either be recoverable or non-recoverable, though it can be configured (via `panic=abort`) to always be non-recoverable. (The converse is not true: `panic=unwind` does not guarantee that all panics are recoverable, only that panicking via the `panic!` macro and similar standard library mechanisms is recoverable.) |
36 | 26 |
|
37 | 27 | r[panic.unwind.destruction]
|
38 |
| -When panic recovery occurs, the runtime "unwinds" Rust frames, just as C++'s `throw` unwinds C++ frames, until the panic reaches |
39 |
| -the point of recovery (for instance at a thread boundary). This means that as |
40 |
| -the panic traverses Rust frames, live objects in those frames that [implement |
41 |
| -`Drop`][destructors] will have their `drop` methods called. Thus, when normal |
42 |
| -execution resumes, no-longer-accessible objects will have been "cleaned up" |
43 |
| -just as if they had gone out of scope normally. |
| 28 | +When panic recovery occurs, the runtime "unwinds" Rust frames, just as C++'s `throw` unwinds C++ frames, until the panic reaches the point of recovery (for instance at a thread boundary). This means that as the panic traverses Rust frames, live objects in those frames that [implement `Drop`][destructors] will have their `drop` methods called. Thus, when normal execution resumes, no-longer-accessible objects will have been "cleaned up" just as if they had gone out of scope normally. |
44 | 29 |
|
45 | 30 | > [!NOTE]
|
46 |
| -> As long as this guarantee of resource-cleanup is preserved, |
47 |
| -> "unwinding" may be implemented without actually using the mechanism used by |
48 |
| -> C++ for the target platform. |
| 31 | +> As long as this guarantee of resource-cleanup is preserved, "unwinding" may be implemented without actually using the mechanism used by C++ for the target platform. |
49 | 32 |
|
50 | 33 | > [!NOTE]
|
51 |
| -> The standard library provides two mechanisms for recovering from a panic, |
52 |
| -> [`std::panic::catch_unwind`] (which enables recovery within the |
53 |
| -> panicking thread) and [`std::thread::spawn`] (which automatically |
54 |
| -> sets up panic recovery for the spawned thread so that other threads may |
55 |
| -> continue running). |
| 34 | +> The standard library provides two mechanisms for recovering from a panic, [`std::panic::catch_unwind`] (which enables recovery within the panicking thread) and [`std::thread::spawn`] (which automatically sets up panic recovery for the spawned thread so that other threads may continue running). |
56 | 35 |
|
57 | 36 | ### Unwinding across FFI boundaries
|
58 | 37 |
|
59 | 38 | r[panic.unwind.ffi]
|
60 | 39 |
|
61 | 40 | r[panic.unwind.ffi.intro]
|
62 |
| -It is possible to unwind across FFI boundaries using an [appropriate ABI |
63 |
| -declaration][unwind-abi]. While useful in certain cases, this creates unique |
64 |
| -opportunities for undefined behavior, especially when multiple language runtimes |
65 |
| -are involved. |
| 41 | +It is possible to unwind across FFI boundaries using an [appropriate ABI declaration][unwind-abi]. While useful in certain cases, this creates unique opportunities for undefined behavior, especially when multiple language runtimes are involved. |
66 | 42 |
|
67 | 43 | r[panic.unwind.ffi.undefined]
|
68 | 44 | Unwinding with the wrong ABI is undefined behavior:
|
69 | 45 |
|
70 |
| -* Causing an unwind into Rust code from a foreign function that was called via a |
71 |
| - function declaration or pointer declared with a non-unwinding ABI, such as `"C"`, |
72 |
| - `"system"`, etc. (For example, this case occurs when such a function written in |
73 |
| - C++ throws an exception that is uncaught and propagates to Rust.) |
74 |
| -* Calling a Rust `extern` function that unwinds (with `extern "C-unwind"` or |
75 |
| - another ABI that permits unwinding) from a runtime that does not support. |
76 |
| - unwinding, such as code compiled with GCC or Clang using `-fno-exceptions` |
| 46 | +* Causing an unwind into Rust code from a foreign function that was called via a function declaration or pointer declared with a non-unwinding ABI, such as `"C"`, `"system"`, etc. (For example, this case occurs when such a function written in C++ throws an exception that is uncaught and propagates to Rust.) |
| 47 | +* Calling a Rust `extern` function that unwinds (with `extern "C-unwind"` or another ABI that permits unwinding) from a runtime that does not support. unwinding, such as code compiled with GCC or Clang using `-fno-exceptions` |
77 | 48 |
|
78 | 49 | r[panic.unwind.ffi.catch-foreign]
|
79 |
| -Catching a foreign unwinding operation (such as a C++ exception) using |
80 |
| -[`std::panic::catch_unwind`], [`std::thread::JoinHandle::join`], or by letting it propagate beyond the |
81 |
| -Rust `main()` function or thread root will have one of two behaviors, and it is unspecified |
82 |
| -which will occur: |
| 50 | +Catching a foreign unwinding operation (such as a C++ exception) using [`std::panic::catch_unwind`], [`std::thread::JoinHandle::join`], or by letting it propagate beyond the Rust `main()` function or thread root will have one of two behaviors, and it is unspecified which will occur: |
| 51 | + |
83 | 52 | * The process aborts.
|
84 | 53 | * The function returns a [`Result::Err`] containing an opaque type.
|
85 | 54 |
|
86 | 55 | > [!NOTE]
|
87 |
| -> Rust code compiled or linked with a different instance of the Rust runtime counts as a |
88 |
| -> "foreign exception" for the purpose of this guarantee. Thus, a library that |
89 |
| -> uses `panic!` and is linked against one version of the Rust standard library, |
90 |
| -> invoked from an application that uses a different version of the standard |
91 |
| -> library, may cause the entire application to crash even if the library is only |
92 |
| -> used within a child thread. |
| 56 | +> Rust code compiled or linked with a different instance of the Rust runtime counts as a "foreign exception" for the purpose of this guarantee. Thus, a library that uses `panic!` and is linked against one version of the Rust standard library, invoked from an application that uses a different version of the standard library, may cause the entire application to crash even if the library is only used within a child thread. |
93 | 57 |
|
94 | 58 | r[panic.unwind.ffi.dispose-panic]
|
95 |
| -There are currently no guarantees about the behavior that occurs when a foreign |
96 |
| -runtime attempts to dispose of, or rethrow, a Rust `panic` payload. In other |
97 |
| -words, an unwind originated from a Rust runtime must either lead to termination |
98 |
| -of the process or be caught by the same runtime. |
| 59 | +There are currently no guarantees about the behavior that occurs when a foreign runtime attempts to dispose of, or rethrow, a Rust `panic` payload. In other words, an unwind originated from a Rust runtime must either lead to termination of the process or be caught by the same runtime. |
99 | 60 |
|
100 | 61 | ## Panic runtimes
|
101 | 62 |
|
102 | 63 | r[panic.runtime]
|
103 | 64 |
|
104 |
| -The actual behavior and implementation of `panic!` is controlled by the _panic |
105 |
| -runtime_. |
| 65 | +The actual behavior and implementation of `panic!` is controlled by the _panic runtime_. |
106 | 66 |
|
107 | 67 | > [!NOTE]
|
108 |
| -> The Rust standard library provides two panic runtimes: |
109 |
| -> `panic_unwind` (which unwinds the stack and is potentially recoverable) and |
110 |
| -> `panic_abort` (which aborts the process and is non-recoverable). The default |
111 |
| -> runtime depends on the target platform, but is generally `panic_unwind` on |
112 |
| -> platforms with native support for C++ exceptions. |
| 68 | +> The Rust standard library provides two panic runtimes: `panic_unwind` (which unwinds the stack and is potentially recoverable) and `panic_abort` (which aborts the process and is non-recoverable). The default runtime depends on the target platform, but is generally `panic_unwind` on platforms with native support for C++ exceptions. |
113 | 69 |
|
114 | 70 | > [!NOTE]
|
115 |
| -> When compiling code that is guaranteed to be linked to a non-recoverable panic |
116 |
| -> runtime, the optimizer may assume that unwinding across Rust frames is |
117 |
| -> impossible, which can result in both code-size and runtime speed improvements. |
| 71 | +> When compiling code that is guaranteed to be linked to a non-recoverable panic runtime, the optimizer may assume that unwinding across Rust frames is impossible, which can result in both code-size and runtime speed improvements. |
118 | 72 |
|
119 | 73 | See also the [`panic_handler` attribute](runtime.md#the-panic_handler-attribute) which can be used to change the behavior of panics.
|
120 | 74 |
|
|
0 commit comments