6 ms·

> it’s sometimes nice to have the assurance that no code being executed can possibly panic. I struggling to think of any language that can provide this guarant

> it’s sometimes nice to have the assurance that no code being executed can possibly panic. I struggling to think of any language that can provide this guarantee. Even Python can segfault while executing C extensions. Maybe java?

loeg 5y ago
I think it's a property that you could validate via static analysis in relatively strongly-typed languages. I agree it would be impossible for Python, just because everything can change at runtime.
ajkjk 5y ago
But most languages don't have all their libraries willing to intentionally panic, so it's not a big deal in practice.
- ansible 5y ago
  It would be nice to have an overall scorecard for a library. It would show a bunch of stuff related to the crate: existence of unit tests, fuzz testing, and measures of the test coverage, if the code passes clippy checks, which edition of Rust, and such. We could also grade crates by how many open tickets they have which haven't seen a response, etc. This wouldn't be intended to shame the library maintainers, but more to indicate which projects are active, and which ones have issues fixed promptly. It would be easy enough to also scan the source for sources of panics.
oefrha 5y ago
You can easily segfault in pure Python: import sys sys.setrecursionlimit(1048576) def recurse(): recurse() recurse()
- orf 5y ago
  A slightly simpler way is just: import ctypes ctypes.string_at(0)
Retr0id 5y ago
Vanilla python can also segfault, in certain edge cases. eval((lambda:0).__code__.replace(co_consts=()))
- amilios 5y ago
  This code throws a missing attribute error on Python 3.7? 'code' object has no attribute 'replace'. Is it for 2.7?
  - Retr0id 5y ago
    3.8+, iirc
Deukhoofd 5y ago
To do so in C# requires messing with C libraries, but generally most behaviour that could actually segfault throws an exception instead.
- garaetjjte 5y ago
  panic is just different name for exception though.
  - throwawayninja 5y ago
    Exceptions can be handled, so in rust an "exception" is a "Result<T,U>". A panic means the program terminates, guaranteed. This allows us to ignore hugely difficult edge cases when interacting with hardware / OSes and still ensure the code meets safety guarantees; if the code isn't executing it cannot invalidate any invariants.
    - baseballdork 5y ago
      > A panic means the program terminates, guaranteed. That's not strictly true: https://doc.rust-lang.org/std/panic/fn.catch_unwind.html https://doc.rust-lang.org/std/panic/fn.catch_unwind.html
- adastra22 5y ago
  Panic is what Rust calls exceptions.
  - dragonwriter 5y ago
    > Panic is what Rust calls exceptions. Not exactly; “panic” is what Go calls exceptions. Rust “panic!” macro, though, is more of a gentle abort (I guess it's like an uncatchable exception, but that qualifier so radically changes the nature that I can't see it as really the same kind of thing.)
    - adastra22 5y ago
thesuperbigfrog 5y ago
Ada has a set of High Integrity Restrictions that define pragmas that turn off exceptions: "No_Exceptions - Raise_statements and exception_handlers are not allowed. No language-defined run-time checks are generated; however, a run-time check performed automatically by the hardware is permitted." Source: http://www.ada-auth.org/standards/12rm/html/RM-H-4.html http://www.ada-auth.org/standards/12rm/html/RM-H-4.html If the underlying operating system or board support system have similar support then panic situations would be avoided entirely. While this is a highly-specialized case, it is defined and supported by high integrity Ada implementations / runtimes.
- bb88 5y ago
  You don't want to do that. It's an optimization, not a "The compiler will guarantee there won't be exceptions thrown." https://www.adaic.org/resources/add_content/docs/95style/html/sec_5/5-9-5.html https://www.adaic.org/resources/add_content/docs/95style/htm... "If you disable exception checks and program execution results in a condition in which an exception would otherwise occur, the program execution is erroneous. The results are unpredictable"
kazinator 5y ago
Sometimes to have the assurance means in some specific code, not always: the code is entered via some entry point, and guaranteed to reach one of its exit points without hitting a panic.

loeg 5y ago

I think it's a property that you could validate via static analysis in relatively strongly-typed languages. I agree it would be impossible for Python, just because everything can change at runtime.

ajkjk 5y ago

But most languages don't have all their libraries willing to intentionally panic, so it's not a big deal in practice.

ansible 5y ago
It would be nice to have an overall scorecard for a library. It would show a bunch of stuff related to the crate: existence of unit tests, fuzz testing, and measures of the test coverage, if the code passes clippy checks, which edition of Rust, and such. We could also grade crates by how many open tickets they have which haven't seen a response, etc. This wouldn't be intended to shame the library maintainers, but more to indicate which projects are active, and which ones have issues fixed promptly. It would be easy enough to also scan the source for sources of panics.

oefrha 5y ago

You can easily segfault in pure Python: import sys sys.setrecursionlimit(1048576) def recurse(): recurse() recurse()

orf 5y ago
A slightly simpler way is just: import ctypes ctypes.string_at(0)

Retr0id 5y ago

Vanilla python can also segfault, in certain edge cases. eval((lambda:0).__code__.replace(co_consts=()))

amilios 5y ago
This code throws a missing attribute error on Python 3.7? 'code' object has no attribute 'replace'. Is it for 2.7?
- Retr0id 5y ago
  3.8+, iirc

Deukhoofd 5y ago

To do so in C# requires messing with C libraries, but generally most behaviour that could actually segfault throws an exception instead.

garaetjjte 5y ago
panic is just different name for exception though.
- throwawayninja 5y ago
  Exceptions can be handled, so in rust an "exception" is a "Result<T,U>". A panic means the program terminates, guaranteed. This allows us to ignore hugely difficult edge cases when interacting with hardware / OSes and still ensure the code meets safety guarantees; if the code isn't executing it cannot invalidate any invariants.
  - baseballdork 5y ago
    > A panic means the program terminates, guaranteed. That's not strictly true: https://doc.rust-lang.org/std/panic/fn.catch_unwind.html https://doc.rust-lang.org/std/panic/fn.catch_unwind.html
adastra22 5y ago
Panic is what Rust calls exceptions.
- dragonwriter 5y ago
  > Panic is what Rust calls exceptions. Not exactly; “panic” is what Go calls exceptions. Rust “panic!” macro, though, is more of a gentle abort (I guess it's like an uncatchable exception, but that qualifier so radically changes the nature that I can't see it as really the same kind of thing.)
  - adastra22 5y ago

thesuperbigfrog 5y ago

Ada has a set of High Integrity Restrictions that define pragmas that turn off exceptions: "No_Exceptions - Raise_statements and exception_handlers are not allowed. No language-defined run-time checks are generated; however, a run-time check performed automatically by the hardware is permitted." Source: http://www.ada-auth.org/standards/12rm/html/RM-H-4.html http://www.ada-auth.org/standards/12rm/html/RM-H-4.html If the underlying operating system or board support system have similar support then panic situations would be avoided entirely. While this is a highly-specialized case, it is defined and supported by high integrity Ada implementations / runtimes.

bb88 5y ago
You don't want to do that. It's an optimization, not a "The compiler will guarantee there won't be exceptions thrown." https://www.adaic.org/resources/add_content/docs/95style/html/sec_5/5-9-5.html https://www.adaic.org/resources/add_content/docs/95style/htm... "If you disable exception checks and program execution results in a condition in which an exception would otherwise occur, the program execution is erroneous. The results are unpredictable"

kazinator 5y ago

Sometimes to have the assurance means in some specific code, not always: the code is entered via some entry point, and guaranteed to reach one of its exit points without hitting a panic.