6 ms·

Rust currently cannot reliably panic on allocation failures because the error object is inside a Box, which itself requires allocation. This means that if memor

Rust currently cannot reliably panic on allocation failures because the error object is inside a Box, which itself requires allocation. This means that if memory is tight, panicking itself might fail. For reference, this is the type that is returned from catch_unwind: https://doc.rust-lang.org/std/thread/type.Result.html https://doc.rust-lang.org/std/thread/type.Result.html But I completely agree that Rust has exceptions. They are even used in the toolchain implementation for non-local control flow.

nextaccountic 3y ago
> Rust currently cannot reliably panic on allocation failures because the error object is inside a Box, which itself requires allocation. This means that if memory is tight, panicking itself might fail. This seems like something that should be allocated at program startup, just like other things like the program's environment (I think it's copied to Rust's own data structures at startup to avoid using the non-threadsafe C API), and other things allocated at startup .. but of course, not at Linux, such error allocation would be unneeded there.. .. except of you disable overcommit, which can and do happen, so in the general case you don't know if this error object can ever appear
- fweimer 3y ago
  The Box type, as used in the return type, transfers ownership to the calling function, so a check in the deallocator path would be needed to recognize this special object and avoid deallocating it. GCC has an emergency pool for its exception allocations, which is also quite ugly. And of course that pool can be too small. It should be possible to add a third arm to that Result type, returning some &'static reference, but I'm not sure how to do it in a backwards-compatibile way.
  - nextaccountic 3y ago
    I mean, allocate something like static ALLOCATION_ERROR: Box<dyn Error> = (something); and then use this variable whenever there is an allocation error. you might need unsafe { } but that's okay, the stdlib is full of unsafe
    - fweimer 3y ago
      If you use it for producing the Box in the return value, you have to move out of it, and then it's gone. If you don't move it, you have a use-after-free bug after the first such panic has been caught and the box has been dropped as a result.

nextaccountic 3y ago

> Rust currently cannot reliably panic on allocation failures because the error object is inside a Box, which itself requires allocation. This means that if memory is tight, panicking itself might fail. This seems like something that should be allocated at program startup, just like other things like the program's environment (I think it's copied to Rust's own data structures at startup to avoid using the non-threadsafe C API), and other things allocated at startup .. but of course, not at Linux, such error allocation would be unneeded there.. .. except of you disable overcommit, which can and do happen, so in the general case you don't know if this error object can ever appear

fweimer 3y ago
The Box type, as used in the return type, transfers ownership to the calling function, so a check in the deallocator path would be needed to recognize this special object and avoid deallocating it. GCC has an emergency pool for its exception allocations, which is also quite ugly. And of course that pool can be too small. It should be possible to add a third arm to that Result type, returning some &'static reference, but I'm not sure how to do it in a backwards-compatibile way.
- nextaccountic 3y ago
  I mean, allocate something like static ALLOCATION_ERROR: Box<dyn Error> = (something); and then use this variable whenever there is an allocation error. you might need unsafe { } but that's okay, the stdlib is full of unsafe
  - fweimer 3y ago
    If you use it for producing the Box in the return value, you have to move out of it, and then it's gone. If you don't move it, you have a use-after-free bug after the first such panic has been caught and the box has been dropped as a result.