7 ms·

Another thing to note is that exactly the same bug can be made in Rust or go, both of which officially don't have exceptions. They both, of course, do have exce

by usrnm 2y ago

Another thing to note is that exactly the same bug can be made in Rust or go, both of which officially don't have exceptions. They both, of course, do have exceptions and just call them a different name.

LegionMammal978 2y ago
As it happens, Rust 1.81 recently added a feature where it aborts by default when you attempt to unwind from a function with the "C" ABI [0], which mitigates this issue for most FFI use cases. Of course, it's not uncommon to find unsafe Rust code that misbehaves badly when something panics, which is yet another of its hazards that I wish were better documented. In this case, I'd put down the lesson as "exceptions in C++ are very dangerous if you're coming out of C code", since they can cause undocumented and unexpected behavior that ultimately led to the use-after-return issue here. [0] https://blog.rust-lang.org/2024/09/05/Rust-1.81.0.html#abort-on-uncaught-panics-in-extern-c-functions https://blog.rust-lang.org/2024/09/05/Rust-1.81.0.html#abort...
- ryao 2y ago
  What do you mean by "misbehaves badly when something panics"?
  - LegionMammal978 2y ago
    If some unsafe code gets interrupted by a panic when it's in an intermediate state (before it can clean something up, or make two values consistent), then further operations on that state can result in UB. See https://github.com/becheran/grid/issues/19 https://github.com/becheran/grid/issues/19, https://gitlab.com/tspiteri/rug/-/issues/47 https://gitlab.com/tspiteri/rug/-/issues/47, and https://gitlab.com/tspiteri/rug/-/issues/49 https://gitlab.com/tspiteri/rug/-/issues/49 for a few of the less-contrived issues I've filed. It can also result in logic errors if objects are used after their methods panic, but such usage is generally not expected to work in the first place.
samatman 2y ago
Exceptions aren't bad because of the name. Exceptions are bad because lower stack frames unwind higher ones, without giving those frames any opportunity to do something sane with any captured resources. Calling it panic/recover doesn't help anything.

by usrnm 2y ago

LegionMammal978 2y ago

As it happens, Rust 1.81 recently added a feature where it aborts by default when you attempt to unwind from a function with the "C" ABI [0], which mitigates this issue for most FFI use cases. Of course, it's not uncommon to find unsafe Rust code that misbehaves badly when something panics, which is yet another of its hazards that I wish were better documented. In this case, I'd put down the lesson as "exceptions in C++ are very dangerous if you're coming out of C code", since they can cause undocumented and unexpected behavior that ultimately led to the use-after-return issue here. [0] https://blog.rust-lang.org/2024/09/05/Rust-1.81.0.html#abort-on-uncaught-panics-in-extern-c-functions https://blog.rust-lang.org/2024/09/05/Rust-1.81.0.html#abort...

ryao 2y ago
What do you mean by "misbehaves badly when something panics"?
- LegionMammal978 2y ago
  If some unsafe code gets interrupted by a panic when it's in an intermediate state (before it can clean something up, or make two values consistent), then further operations on that state can result in UB. See https://github.com/becheran/grid/issues/19 https://github.com/becheran/grid/issues/19, https://gitlab.com/tspiteri/rug/-/issues/47 https://gitlab.com/tspiteri/rug/-/issues/47, and https://gitlab.com/tspiteri/rug/-/issues/49 https://gitlab.com/tspiteri/rug/-/issues/49 for a few of the less-contrived issues I've filed. It can also result in logic errors if objects are used after their methods panic, but such usage is generally not expected to work in the first place.

samatman 2y ago

Exceptions aren't bad because of the name. Exceptions are bad because lower stack frames unwind higher ones, without giving those frames any opportunity to do something sane with any captured resources. Calling it panic/recover doesn't help anything.