Tracking Issue for PanicInfo::can_unwind

[Amanieu]

Feature gate: #![feature(panic_can_unwind)]

This is a tracking issue for PanicInfo::can_unwind.

This function returns whether the panic handler is allowed to unwind the stack from the point where the panic occurred.

This is true for most kinds of panics with the exception of panics caused by trying to unwind out of a Drop implementation or a function whose ABI does not support unwinding.

Public API

// core::panic

impl PanicInfo {
    pub fn can_unwind(&self) -> bool;
}

Steps / History

• Implementation: Print a helpful message if unwinding aborts when it reaches a nounwind function #92828
• Final comment period (FCP)
• Stabilization PR

Unresolved Questions

• None yet.

[nbdd0121]

Just thought of this, what happens if the panic handler actually unwind? If it can cause undefined behaviour then the panic handler would have to be unsafe.

[Amanieu]

Unwinding is itself an unsafe operation. It is your responsibility to check that unwinding is actually possible before throwing an exception.

[nbdd0121]

That'll break encapsulation. There is no way that code can check that unwinding isn't currently in progress.

[Amanieu]

That's what the can_unwind flag on PanicInfo is for. You must not start unwinding if that function returns false.

[nbdd0121]

However there're no ways to prevent the panic handler from calling another function that unwinds. So either panic handler needs to be unsafe to take that responsibility, or it implies that C-unwind function cannot be encapsulated by safe APIs.

[Amanieu]

I just had a look through the code. By marking the panic_no_unwind lang item as nounwind (PR incoming), an unwind from a panic handler will become safe even if can_unwind is true. The compiler will add a TerminatorKind::Abort landing pad to panic_no_unwind which will simply call panic_no_unwind again. Eventually you will run out of stack and abort the process (which is safe).

This can be avoided by having a thread-local flag in the panic handler that catches recursive calls and aborts immediately. The standard library panic handler does this.

[nbdd0121]

Or probably just tweak the codegen to generate trap instead of panic_no_unwind call if the function being codegen-ed is panic_no_unwind.