panicking.rs - source
Description: Source of the Rust file `library/core/src/panicking.rs`.

#
core/
panicking.rs

    1//! Panic support for core
    2//!
    3//! In core, panicking is always done with a message, resulting in a `core::panic::PanicInfo`
    4//! containing a `fmt::Arguments`. In std, however, panicking can be done with panic_any, which
    5//! throws a `Box<dyn Any>` containing any type of value. Because of this,
    6//! `std::panic::PanicHookInfo` is a different type, which contains a `&dyn Any` instead of a
    7//! `fmt::Arguments`. std's panic handler will convert the `fmt::Arguments` to a `&dyn Any`
    8//! containing either a `&'static str` or `String` containing the formatted message.
    9//!
    10//! The core library cannot define any panic handler, but it can invoke it.
    11//! This means that the functions inside of core are allowed to panic, but to be
    12//! useful an upstream crate must define panicking for core to use. The current
    13//! interface for panicking is:
    14//!
    15//! ```
    16//! fn panic_impl(pi: &core::panic::PanicInfo<'_>) -> !
    17//! # { loop {} }
    18//! ```
    19//!
    20//! This module contains a few other panicking functions, but these are just the
    21//! necessary lang items for the compiler. All panics are funneled through this
    22//! one function. The actual symbol is declared through the `#[panic_handler]` attribute.
    23
    24#![allow(dead_code, missing_docs)]
    25#![unstable(
    26    feature = "panic_internals",
    27    reason = "internal details of the implementation of the `panic!` and related macros",
    28    issue = "none"
    29)]
    30
    31use crate::fmt;
    32use crate::intrinsics::const_eval_select;
    33use crate::panic::{Location, PanicInfo};
    34
    35#[cfg(feature = "panic_immediate_abort")]
    36compile_error!(
    37    "panic_immediate_abort is now a real panic strategy! \
    38    Enable it with `panic = \"immediate-abort\"` in Cargo.toml, \
    39    or with the compiler flags `-Zunstable-options -Cpanic=immediate-abort`. \
    40    In both cases, you still need to build core, e.g. with `-Zbuild-std`"
    41);
    42
    43// First we define the two main entry points that all panics go through.
    44// In the end both are just convenience wrappers around `panic_impl`.
    45
    46/// The entry point for panicking with a formatted message.
    47///
    48/// This is designed to reduce the amount of code required at the call
    49/// site as much as possible (so that `panic!()` has as low an impact
    50/// on (e.g.) the inlining of other functions as possible), by moving
    51/// the actual formatting into this shared place.
    52// If panic=immediate-abort, inline the abort call,
    53// otherwise avoid inlining because of it is cold path.
    54#[cfg_attr(not(panic = "immediate-abort"), inline(never), cold)]
    55#[cfg_attr(panic = "immediate-abort", inline)]
    56#[track_caller]
    57#[lang = "panic_fmt"] // needed for const-evaluated panics
    58#[rustc_do_not_const_check] // hooked by const-eval
    59#[rustc_const_stable_indirect] // must follow stable const rules since it is exposed to stable
    60pub const fn panic_fmt(fmt: fmt::Arguments<'_>) -> ! {
    61    if cfg!(panic = "immediate-abort") {
    62        super::intrinsics::abort()
    63    }
    64
    65    // NOTE This function never crosses the FFI boundary; it's a Rust-to-Rust call
    66    // that gets resolved to the `#[panic_handler]` function.
    67    unsafe extern "Rust" {
    68        #[lang = "panic_impl"]
    69        fn panic_impl(pi: &PanicInfo<'_>) -> !;
    70    }
    71
    72    let pi = PanicInfo::new(
    73        &fmt,
    74        Location::caller(),
    75        /* can_unwind */ true,
    76        /* force_no_backtrace */ false,
    77    );
    78
    79    // SAFETY: `panic_impl` is defined in safe Rust code and thus is safe to call.
    80    unsafe { panic_impl(&pi) }
    81}
    82
    83/// Like `panic_fmt`, but for non-unwinding panics.
    84///
    85/// Has to be a separate function so that it can carry the `rustc_nounwind` attribute.
    86#[cfg_attr(not(panic = "immediate-abort"), inline(never), cold)]
    87#[cfg_attr(panic = "immediate-abort", inline)]
    88#[track_caller]
    89// This attribute has the key side-effect that if the panic handler ignores `can_unwind`
    90// and unwinds anyway, we will hit the "unwinding out of nounwind function" guard,
    91// which causes a "panic in a function that cannot unwind".
    92#[rustc_nounwind]
    93#[rustc_const_stable_indirect] // must follow stable const rules since it is exposed to stable
    94#[rustc_allow_const_fn_unstable(const_eval_select)]
    95pub const fn panic_nounwind_fmt(fmt: fmt::Arguments<'_>, force_no_backtrace: bool) -> ! {
    96    const_eval_select!(
    97        @capture { fmt: fmt::Arguments<'_>, force_no_backtrace: bool } -> !:
    98        if const #[track_caller] {
    99            // We don't unwind anyway at compile-time so we can call the regular `panic_fmt`.
    100            panic_fmt(fmt)
    101        } else #[track_caller] {
    102            if cfg!(panic = "immediate-abort") {
    103                super::intrinsics::abort()
    104            }
    105
    106            // NOTE This function never crosses the FFI boundary; it's a Rust-to-Rust call
    107            // that gets resolved to the `#[panic_handler]` function.
    108            unsafe extern "Rust" {
    109                #[lang = "panic_impl"]
    110                fn panic_impl(pi: &PanicInfo<'_>) -> !;
    111            }
    112
    113            // PanicInfo with the `can_unwind` flag set to false forces an abort.
    114            let pi = PanicInfo::new(
    115                &fmt,
    116                Location::caller(),
    117                /* can_unwind */ false,
    118                force_no_backtrace,
    119            );
    120
    121            // SAFETY: `panic_impl` is defined in safe Rust code and thus is safe to call.
    122            unsafe { panic_impl(&pi) }
    123        }
    124    )
    125}
    126
    127// Next we define a bunch of higher-level wrappers that all bottom out in the two core functions
    128// above.
    129
    130/// The underlying implementation of core's `panic!` macro when no formatting is used.
    131// Never inline unless panic=immediate-abort to avoid code
    132// bloat at the call sites as much as possible.
    133#[cfg_attr(not(panic = "immediate-abort"), inline(never), cold)]
    134#[cfg_attr(panic = "immediate-abort", inline)]
    135#[track_caller]
    136#[rustc_const_stable_indirect] // must follow stable const rules since it is exposed to stable
    137#[lang = "panic"] // used by lints and miri for panics
    138pub const fn panic(expr: &'static str) -> ! {
    139    // Use Arguments::from_str instead of format_args!("{expr}") to potentially
    140    // reduce size overhead. The format_args! macro uses str's Display trait to
    141    // write expr, which calls Formatter::pad, which must accommodate string
    142    // truncation and padding (even though none is used here). Using
    143    // Arguments::from_str may allow the compiler to omit Formatter::pad from the
    144    // output binary, saving up to a few kilobytes.
    145    // However, this optimization only works for `'static` strings: `from_str` also makes this
    146    // message return `Some` from `Arguments::as_str`, which means it can become part of the panic
    147    // payload without any allocation or copying. Shorter-lived strings would become invalid as
    148    // stack frames get popped during unwinding, and couldn't be directly referenced from the
    149    // payload.
    150    panic_fmt(fmt::Arguments::from_str(expr));
    151}
    152
    153// We generate functions for usage by compiler-generated assertions.
    154//
    155// Placing these functions in libcore means that all Rust programs can generate a jump into this
    156// code rather than expanding to panic("...") above, which adds extra bloat to call sites (for the
    157// constant string argument's pointer and length).
    158//
    159// This is especially important when this code is called often (e.g., with -Coverflow-checks) for
    160// reducing binary size impact.
    161macro_rules! panic_const {
    162    ($($lang:ident = $message:expr,)+) => {
    163        $(
    164            /// This is a panic called with a message that's a result of a MIR-produced Assert.
    165            //
    166            // never inline unless panic=immediate-abort to avoid code
    167            // bloat at the call sites as much as possible
    168            #[cfg_attr(not(panic = "immediate-abort"), inline(never), cold)]
    169            #[cfg_attr(panic = "immediate-abort", inline)]
    170            #[track_caller]
    171            #[rustc_const_stable_indirect] // must follow stable const rules since it is exposed to stable
    172            #[lang = stringify!($lang)]
    173            pub const fn $lang() -> ! {
    174                // See the comment in `panic(&'static str)` for why we use `Arguments::from_str` here.
    175                panic_fmt(fmt::Arguments::from_str($message));
    176            }
    177        )+
    178    }
    179}
    180
    181// Unfortunately this set of strings is replicated here and in a few places in the compiler in
    182// slightly different forms. It's not clear if there's a good way to deduplicate without adding
    183// special cases to the compiler (e.g., a const generic function wouldn't have a single definition
    184// shared across crates, which is exactly what we want here).
    185pub mod panic_const {
    186    use super::*;
    187    panic_const! {
    188        panic_const_add_overflow = "attempt to add with overflow",
    189        panic_const_sub_overflow = "attempt to subtract with overflow",
    190        panic_const_mul_overflow = "attempt to multiply with overflow",
    191        panic_const_div_overflow = "attempt to divide with overflow",
    192        panic_const_rem_overflow = "attempt to calculate the remainder with overflow",
    193        panic_const_neg_overflow = "attempt to negate with overflow",
    194        panic_const_shr_overflow = "attempt to shift right with overflow",
    195        panic_const_shl_overflow = "attempt to shift left with overflow",
    196        panic_const_div_by_zero = "attempt to divide by zero",
    197        panic_const_rem_by_zero = "attempt to calculate the remainder with a divisor of zero",
    198        panic_const_coroutine_resumed = "coroutine resumed after completion",
    199        panic_const_async_fn_resumed = "`async fn` resumed after completion",
    200        panic_const_async_gen_fn_resumed = "`async gen fn` resumed after completion",
    201        panic_const_gen_fn_none = "`gen fn` should just keep returning `None` after completion",
    202        panic_const_coroutine_resumed_panic = "coroutine resumed after panicking",
    203        panic_const_async_fn_resumed_panic = "`async fn` resumed after panicking",
    204        panic_const_async_gen_fn_resumed_panic = "`async gen fn` resumed after panicking",
    205        panic_const_gen_fn_none_panic = "`gen fn` should just keep returning `None` after panicking",
    206    }
    207    // Separated panic constants list for async drop feature
    208    // (May be joined when the corresponding lang items will be in the bootstrap)
    209    panic_const! {
    210        panic_const_coroutine_resumed_drop = "coroutine resumed after async drop",
    211        panic_const_async_fn_resumed_drop = "`async fn` resumed after async drop",
    212        panic_const_async_gen_fn_resumed_drop = "`async gen fn` resumed after async drop",
    213        panic_const_gen_fn_none_drop = "`gen fn` resumed after async drop",
    214    }
    215}
    216
    217/// Like `panic`, but without unwinding and track_caller to reduce the impact on codesize on the caller.
    218/// If you want `#[track_caller]` for nicer errors, call `panic_nounwind_fmt` directly.
    219#[cfg_attr(not(panic = "immediate-abort"), inline(never), cold)]
    220#[cfg_attr(panic = "immediate-abort", inline)]
    221#[lang = "panic_nounwind"] // needed by codegen for non-unwinding panics
    222#[rustc_nounwind]
    223#[rustc_const_stable_indirect] // must follow stable const rules since it is exposed to stable
    224pub const fn panic_nounwind(expr: &'static str) -> ! {
    225    panic_nounwind_fmt(fmt::Arguments::from_str(expr), /* force_no_backtrace */ false);
    226}
    227
    228/// Like `panic_nounwind`, but also inhibits showing a backtrace.
    229#[cfg_attr(not(panic = "immediate-abort"), inline(never), cold)]
    230#[cfg_attr(panic = "immediate-abort", inline)]
    231#[rustc_nounwind]
    232pub fn panic_nounwind_nobacktrace(expr: &'static str) -> ! {
    233    panic_nounwind_fmt(fmt::Arguments::from_str(expr), /* force_no_backtrace */ true);
    234}
    235
    236#[inline]
    237#[track_caller]
    238#[rustc_diagnostic_item = "unreachable_display"] // needed for `non-fmt-panics` lint
    239pub fn unreachable_display<T: fmt::Display>(x: &T) -> ! {
    240    panic_fmt(format_args!("internal error: entered unreachable code: {}", *x));
    241}
    242
    243/// This exists solely for the 2015 edition `panic!` macro to trigger
    244/// a lint on `panic!(my_str_variable);`.
    245#[inline]
    246#[track_caller]
    247#[rustc_diagnostic_item = "panic_str_2015"]
    248#[rustc_const_stable_indirect] // must follow stable const rules since it is exposed to stable
    249pub const fn panic_str_2015(expr: &str) -> ! {
    250    panic_display(&expr);
    251}
    252
    253#[inline]
    254#[track_caller]
    255#[lang = "panic_display"] // needed for const-evaluated panics
    256#[rustc_do_not_const_check] // hooked by const-eval
    257#[rustc_const_stable_indirect] // must follow stable const rules since it is exposed to stable
    258pub const fn panic_display<T: fmt::Display>(x: &T) -> ! {
    259    panic_fmt(format_args!("{}", *x));
    260}
    261
    262#[cfg_attr(not(panic = "immediate-abort"), inline(never), cold, optimize(size))]
    263#[cfg_attr(panic = "immediate-abort", inline)]
    264#[track_caller]
    265#[lang = "panic_bounds_check"] // needed by codegen for panic on OOB array/slice access
    266fn panic_bounds_check(index: usize, len: usize) -> ! {
    267    if cfg!(panic = "immediate-abort") {
    268        super::intrinsics::abort()
    269    }
    270
    271    panic!("index out of bounds: the len is {len} but the index is {index}")
    272}
    273
    274#[cfg_attr(not(panic = "immediate-abort"), inline(never), cold, optimize(size))]
    275#[cfg_attr(panic = "immediate-abort", inline)]
    276#[track_caller]
    277#[lang = "panic_misaligned_pointer_dereference"] // needed by codegen for panic on misaligned pointer deref
    278#[rustc_nounwind] // `CheckAlignment` MIR pass requires this function to never unwind
    279fn panic_misaligned_pointer_dereference(required: usize, found: usize) -> ! {
    280    if cfg!(panic = "immediate-abort") {
    281        super::intrinsics::abort()
    282    }
    283
    284    panic_nounwind_fmt(
    285        format_args!(
    286            "misaligned pointer dereference: address must be a multiple of {required:#x} but is {found:#x}"
    287        ),
    288        /* force_no_backtrace */ false,
    289    )
    290}
    291
    292#[cfg_attr(not(panic = "immediate-abort"), inline(never), cold, optimize(size))]
    293#[cfg_attr(panic = "immediate-abort", inline)]
    294#[track_caller]
    295#[lang = "panic_null_pointer_dereference"] // needed by codegen for panic on null pointer deref
    296#[rustc_nounwind] // `CheckNull` MIR pass requires this function to never unwind
    297fn panic_null_pointer_dereference() -> ! {
    298    if cfg!(panic = "immediate-abort") {
    299        super::intrinsics::abort()
    300    }
    301
    302    panic_nounwind_fmt(
    303        format_args!("null pointer dereference occurred"),
    304        /* force_no_backtrace */ false,
    305    )
    306}
    307
    308#[cfg_attr(not(panic = "immediate-abort"), inline(never), cold, optimize(size))]
    309#[cfg_attr(panic = "immediate-abort", inline)]
    310#[track_caller]
    311#[lang = "panic_invalid_enum_construction"] // needed by codegen for panic on invalid enum construction.
    312#[rustc_nounwind] // `CheckEnums` MIR pass requires this function to never unwind
    313fn panic_invalid_enum_construction(source: u128) -> ! {
    314    if cfg!(panic = "immediate-abort") {
    315        super::intrinsics::abort()
    316    }
    317
    318    panic_nounwind_fmt(
    319        format_args!("trying to construct an enum from an invalid value {source:#x}"),
    320        /* force_no_backtrace */ false,
    321    )
    322}
    323
    324/// Panics because we cannot unwind out of a function.
    325///
    326/// This is a separate function to avoid the codesize impact of each crate containing the string to
    327/// pass to `panic_nounwind`.
    328///
    329/// This function is called directly by the codegen backend, and must not have
    330/// any extra arguments (including those synthesized by track_caller).
    331#[cfg_attr(not(panic = "immediate-abort"), inline(never), cold, optimize(size))]
    332#[cfg_attr(panic = "immediate-abort", inline)]
    333#[lang = "panic_cannot_unwind"] // needed by codegen for panic in nounwind function
    334#[rustc_nounwind]
    335fn panic_cannot_unwind() -> ! {
    336    // Keep the text in sync with `UnwindTerminateReason::as_str` in `rustc_middle`.
    337    panic_nounwind("panic in a function that cannot unwind")
    338}
    339
    340/// Panics because we are unwinding out of a destructor during cleanup.
    341///
    342/// This is a separate function to avoid the codesize impact of each crate containing the string to
    343/// pass to `panic_nounwind`.
    344///
    345/// This function is called directly by the codegen backend, and must not have
    346/// any extra arguments (including those synthesized by track_caller).
    347#[cfg_attr(not(panic = "immediate-abort"), inline(never), cold, optimize(size))]
    348#[cfg_attr(panic = "immediate-abort", inline)]
    349#[lang = "panic_in_cleanup"] // needed by codegen for panic in nounwind function
    350#[rustc_nounwind]
    351fn panic_in_cleanup() -> ! {
    352    // Keep the text in sync with `UnwindTerminateReason::as_str` in `rustc_middle`.
    353    panic_nounwind_nobacktrace("panic in a destructor during cleanup")
    354}
    355
    356/// This function is used instead of panic_fmt in const eval.
    357#[lang = "const_panic_fmt"] // needed by const-eval machine to replace calls to `panic_fmt` lang item
    358#[rustc_const_stable_indirect] // must follow stable const rules since it is exposed to stable
    359pub const fn const_panic_fmt(fmt: fmt::Arguments<'_>) -> ! {
    360    if let Some(msg) = fmt.as_str() {
    361        // The panic_display function is hooked by const eval.
    362        panic_display(&msg);
    363    } else {
    364        // SAFETY: This is only evaluated at compile time, which reliably
    365        // handles this UB (in case this branch turns out to be reachable
    366        // somehow).
    367        unsafe { crate::hint::unreachable_unchecked() };
    368    }
    369}
    370
    371#[derive(Debug)]
    372#[doc(hidden)]
    373pub enum AssertKind {
    374    Eq,
    375    Ne,
    376    Match,
    377}
    378
    379/// Internal function for `assert_eq!` and `assert_ne!` macros
    380#[cfg_attr(not(panic = "immediate-abort"), inline(never), cold, optimize(size))]
    381#[cfg_attr(panic = "immediate-abort", inline)]
    382#[track_caller]
    383#[doc(hidden)]
    384pub fn assert_failed<T, U>(
    385    kind: AssertKind,
    386    left: &T,
    387    right: &U,
    388    args: Option<fmt::Arguments<'_>>,
    389) -> !
    390where
    391    T: fmt::Debug + ?Sized,
    392    U: fmt::Debug + ?Sized,
    393{
    394    assert_failed_inner(kind, &left, &right, args)
    395}
    396
    397/// Internal function for `assert_match!`
    398#[cfg_attr(not(panic = "immediate-abort"), inline(never), cold, optimize(size))]
    399#[cfg_attr(panic = "immediate-abort", inline)]
    400#[track_caller]
    401#[doc(hidden)]
    402pub fn assert_matches_failed<T: fmt::Debug + ?Sized>(
    403    left: &T,
    404    right: &str,
    405    args: Option<fmt::Arguments<'_>>,
    406) -> ! {
    407    // The pattern is a string so it can be displayed directly.
    408    struct Pattern<'a>(&'a str);
    409    impl fmt::Debug for Pattern<'_> {
    410        fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
    411            f.write_str(self.0)
    412        }
    413    }
    414    assert_failed_inner(AssertKind::Match, &left, &Pattern(right), args);
    415}
    416
    417/// Non-generic version of the above functions, to avoid code bloat.
    418#[cfg_attr(not(panic = "immediate-abort"), inline(never), cold, optimize(size))]
    419#[cfg_attr(panic = "immediate-abort", inline)]
    420#[track_caller]
    421fn assert_failed_inner(
    422    kind: AssertKind,
    423    left: &dyn fmt::Debug,
    424    right: &dyn fmt::Debug,
    425    args: Option<fmt::Arguments<'_>>,
    426) -> ! {
    427    let op = match kind {
    428        AssertKind::Eq => "==",
    429        AssertKind::Ne => "!=",
    430        AssertKind::Match => "matches",
    431    };
    432
    433    match args {
    434        Some(args) => panic!(
    435            r#"assertion `left {op} right` failed: {args}
    436  left: {left:?}
    437 right: {right:?}"#
    438        ),
    439        None => panic!(
    440            r#"assertion `left {op} right` failed
    441  left: {left:?}
    442 right: {right:?}"#
    443        ),
    444    }
    445}