core/
panicking.rs

1//! Panic support for core
2//!
3//! In core, panicking is always done with a message, resulting in a `core::panic::PanicInfo`
4//! containing a `fmt::Arguments`. In std, however, panicking can be done with panic_any, which
5//! throws a `Box<dyn Any>` containing any type of value. Because of this,
6//! `std::panic::PanicHookInfo` is a different type, which contains a `&dyn Any` instead of a
7//! `fmt::Arguments`. std's panic handler will convert the `fmt::Arguments` to a `&dyn Any`
8//! containing either a `&'static str` or `String` containing the formatted message.
9//!
10//! The core library cannot define any panic handler, but it can invoke it.
11//! This means that the functions inside of core are allowed to panic, but to be
12//! useful an upstream crate must define panicking for core to use. The current
13//! interface for panicking is:
14//!
15//! ```
16//! fn panic_impl(pi: &core::panic::PanicInfo<'_>) -> !
17//! # { loop {} }
18//! ```
19//!
20//! This module contains a few other panicking functions, but these are just the
21//! necessary lang items for the compiler. All panics are funneled through this
22//! one function. The actual symbol is declared through the `#[panic_handler]` attribute.
23
24#![allow(dead_code, missing_docs)]
25#![unstable(
26    feature = "panic_internals",
27    reason = "internal details of the implementation of the `panic!` and related macros",
28    issue = "none"
29)]
30
31#[cfg(not(feature = "ferrocene_certified"))]
32use crate::fmt;
33use crate::intrinsics::const_eval_select;
34#[cfg(feature = "ferrocene_certified")]
35use crate::panic::PanicInfo;
36#[cfg(not(feature = "ferrocene_certified"))]
37use crate::panic::{Location, PanicInfo};
38
39/// Ferrocene addition: Alias used in our panic-related patches to avoid having to certify `fmt`.
40#[cfg(not(feature = "ferrocene_certified"))]
41pub(crate) type PanicFmt<'a> = fmt::Arguments<'a>;
42#[cfg(feature = "ferrocene_certified")]
43pub(crate) type PanicFmt<'a> = &'a &'static str;
44
45#[cfg(feature = "panic_immediate_abort")]
46// blocked on `assert`
47#[cfg(not(feature = "ferrocene_certified"))]
48const _: () = assert!(cfg!(panic = "abort"), "panic_immediate_abort requires -C panic=abort");
49
50// First we define the two main entry points that all panics go through.
51// In the end both are just convenience wrappers around `panic_impl`.
52
53/// The entry point for panicking with a formatted message.
54///
55/// This is designed to reduce the amount of code required at the call
56/// site as much as possible (so that `panic!()` has as low an impact
57/// on (e.g.) the inlining of other functions as possible), by moving
58/// the actual formatting into this shared place.
59// If panic_immediate_abort, inline the abort call,
60// otherwise avoid inlining because of it is cold path.
61#[cfg_attr(not(feature = "panic_immediate_abort"), inline(never), cold)]
62#[cfg_attr(feature = "panic_immediate_abort", inline)]
63#[track_caller]
64#[lang = "panic_fmt"] // needed for const-evaluated panics
65#[rustc_do_not_const_check] // hooked by const-eval
66#[rustc_const_stable_indirect] // must follow stable const rules since it is exposed to stable
67pub const fn panic_fmt(fmt: PanicFmt<'_>) -> ! {
68    if cfg!(feature = "panic_immediate_abort") {
69        super::intrinsics::abort()
70    }
71
72    // NOTE This function never crosses the FFI boundary; it's a Rust-to-Rust call
73    // that gets resolved to the `#[panic_handler]` function.
74    unsafe extern "Rust" {
75        #[lang = "panic_impl"]
76        fn panic_impl(pi: &PanicInfo<'_>) -> !;
77    }
78
79    #[cfg(not(feature = "ferrocene_certified"))]
80    let pi = PanicInfo::new(
81        &fmt,
82        Location::caller(),
83        /* can_unwind */ true,
84        /* force_no_backtrace */ false,
85    );
86    #[cfg(feature = "ferrocene_certified")]
87    let pi = PanicInfo::new(&fmt);
88    // SAFETY: `panic_impl` is defined in safe Rust code and thus is safe to call.
89    unsafe { panic_impl(&pi) }
90}
91
92/// Like `panic_fmt`, but for non-unwinding panics.
93///
94/// Has to be a separate function so that it can carry the `rustc_nounwind` attribute.
95#[cfg_attr(not(feature = "panic_immediate_abort"), inline(never), cold)]
96#[cfg_attr(feature = "panic_immediate_abort", inline)]
97#[track_caller]
98// This attribute has the key side-effect that if the panic handler ignores `can_unwind`
99// and unwinds anyway, we will hit the "unwinding out of nounwind function" guard,
100// which causes a "panic in a function that cannot unwind".
101#[rustc_nounwind]
102#[rustc_const_stable_indirect] // must follow stable const rules since it is exposed to stable
103#[rustc_allow_const_fn_unstable(const_eval_select)]
104pub const fn panic_nounwind_fmt(fmt: PanicFmt<'_>, _force_no_backtrace: bool) -> ! {
105    const_eval_select!(
106        @capture { fmt: PanicFmt<'_>, _force_no_backtrace: bool } -> !:
107        if const #[track_caller] {
108            // We don't unwind anyway at compile-time so we can call the regular `panic_fmt`.
109            panic_fmt(fmt)
110        } else #[track_caller] {
111            if cfg!(feature = "panic_immediate_abort") {
112                super::intrinsics::abort()
113            }
114
115            // NOTE This function never crosses the FFI boundary; it's a Rust-to-Rust call
116            // that gets resolved to the `#[panic_handler]` function.
117            unsafe extern "Rust" {
118                #[lang = "panic_impl"]
119                fn panic_impl(pi: &PanicInfo<'_>) -> !;
120            }
121
122            // PanicInfo with the `can_unwind` flag set to false forces an abort.
123            #[cfg(not(feature = "ferrocene_certified"))]
124            let pi = PanicInfo::new(
125                &fmt,
126                Location::caller(),
127                /* can_unwind */ false,
128                _force_no_backtrace,
129            );
130            #[cfg(feature = "ferrocene_certified")]
131            let pi = PanicInfo::new(&fmt);
132
133            // SAFETY: `panic_impl` is defined in safe Rust code and thus is safe to call.
134            unsafe { panic_impl(&pi) }
135        }
136    )
137}
138
139// Next we define a bunch of higher-level wrappers that all bottom out in the two core functions
140// above.
141
142/// The underlying implementation of core's `panic!` macro when no formatting is used.
143// Never inline unless panic_immediate_abort to avoid code
144// bloat at the call sites as much as possible.
145#[cfg_attr(not(feature = "panic_immediate_abort"), inline(never), cold)]
146#[cfg_attr(feature = "panic_immediate_abort", inline)]
147#[track_caller]
148#[rustc_const_stable_indirect] // must follow stable const rules since it is exposed to stable
149#[lang = "panic"] // used by lints and miri for panics
150pub const fn panic(expr: &'static str) -> ! {
151    // Use Arguments::new_const instead of format_args!("{expr}") to potentially
152    // reduce size overhead. The format_args! macro uses str's Display trait to
153    // write expr, which calls Formatter::pad, which must accommodate string
154    // truncation and padding (even though none is used here). Using
155    // Arguments::new_const may allow the compiler to omit Formatter::pad from the
156    // output binary, saving up to a few kilobytes.
157    // However, this optimization only works for `'static` strings: `new_const` also makes this
158    // message return `Some` from `Arguments::as_str`, which means it can become part of the panic
159    // payload without any allocation or copying. Shorter-lived strings would become invalid as
160    // stack frames get popped during unwinding, and couldn't be directly referenced from the
161    // payload.
162    #[cfg(not(feature = "ferrocene_certified"))]
163    panic_fmt(fmt::Arguments::new_const(&[expr]));
164    #[cfg(feature = "ferrocene_certified")]
165    panic_fmt(&expr)
166}
167
168// We generate functions for usage by compiler-generated assertions.
169//
170// Placing these functions in libcore means that all Rust programs can generate a jump into this
171// code rather than expanding to panic("...") above, which adds extra bloat to call sites (for the
172// constant string argument's pointer and length).
173//
174// This is especially important when this code is called often (e.g., with -Coverflow-checks) for
175// reducing binary size impact.
176#[cfg(not(feature = "ferrocene_certified"))]
177macro_rules! panic_const {
178    ($($lang:ident = $message:expr,)+) => {
179        $(
180            /// This is a panic called with a message that's a result of a MIR-produced Assert.
181            //
182            // never inline unless panic_immediate_abort to avoid code
183            // bloat at the call sites as much as possible
184            #[cfg_attr(not(feature = "panic_immediate_abort"), inline(never), cold)]
185            #[cfg_attr(feature = "panic_immediate_abort", inline)]
186            #[track_caller]
187            #[rustc_const_stable_indirect] // must follow stable const rules since it is exposed to stable
188            #[lang = stringify!($lang)]
189            pub const fn $lang() -> ! {
190                // Use Arguments::new_const instead of format_args!("{expr}") to potentially
191                // reduce size overhead. The format_args! macro uses str's Display trait to
192                // write expr, which calls Formatter::pad, which must accommodate string
193                // truncation and padding (even though none is used here). Using
194                // Arguments::new_const may allow the compiler to omit Formatter::pad from the
195                // output binary, saving up to a few kilobytes.
196                panic_fmt(fmt::Arguments::new_const(&[$message]));
197            }
198        )+
199    }
200}
201
202// Unfortunately this set of strings is replicated here and in a few places in the compiler in
203// slightly different forms. It's not clear if there's a good way to deduplicate without adding
204// special cases to the compiler (e.g., a const generic function wouldn't have a single definition
205// shared across crates, which is exactly what we want here).
206#[cfg(not(feature = "ferrocene_certified"))]
207pub mod panic_const {
208    use super::*;
209    panic_const! {
210        panic_const_add_overflow = "attempt to add with overflow",
211        panic_const_sub_overflow = "attempt to subtract with overflow",
212        panic_const_mul_overflow = "attempt to multiply with overflow",
213        panic_const_div_overflow = "attempt to divide with overflow",
214        panic_const_rem_overflow = "attempt to calculate the remainder with overflow",
215        panic_const_neg_overflow = "attempt to negate with overflow",
216        panic_const_shr_overflow = "attempt to shift right with overflow",
217        panic_const_shl_overflow = "attempt to shift left with overflow",
218        panic_const_div_by_zero = "attempt to divide by zero",
219        panic_const_rem_by_zero = "attempt to calculate the remainder with a divisor of zero",
220        panic_const_coroutine_resumed = "coroutine resumed after completion",
221        panic_const_async_fn_resumed = "`async fn` resumed after completion",
222        panic_const_async_gen_fn_resumed = "`async gen fn` resumed after completion",
223        panic_const_gen_fn_none = "`gen fn` should just keep returning `None` after completion",
224        panic_const_coroutine_resumed_panic = "coroutine resumed after panicking",
225        panic_const_async_fn_resumed_panic = "`async fn` resumed after panicking",
226        panic_const_async_gen_fn_resumed_panic = "`async gen fn` resumed after panicking",
227        panic_const_gen_fn_none_panic = "`gen fn` should just keep returning `None` after panicking",
228    }
229    // Separated panic constants list for async drop feature
230    // (May be joined when the corresponding lang items will be in the bootstrap)
231    panic_const! {
232        panic_const_coroutine_resumed_drop = "coroutine resumed after async drop",
233        panic_const_async_fn_resumed_drop = "`async fn` resumed after async drop",
234        panic_const_async_gen_fn_resumed_drop = "`async gen fn` resumed after async drop",
235        panic_const_gen_fn_none_drop = "`gen fn` resumed after async drop",
236    }
237}
238
239/// Like `panic`, but without unwinding and track_caller to reduce the impact on codesize on the caller.
240/// If you want `#[track_caller]` for nicer errors, call `panic_nounwind_fmt` directly.
241#[cfg_attr(not(feature = "panic_immediate_abort"), inline(never), cold)]
242#[cfg_attr(feature = "panic_immediate_abort", inline)]
243#[lang = "panic_nounwind"] // needed by codegen for non-unwinding panics
244#[rustc_nounwind]
245#[rustc_const_stable_indirect] // must follow stable const rules since it is exposed to stable
246pub const fn panic_nounwind(expr: &'static str) -> ! {
247    #[cfg(not(feature = "ferrocene_certified"))]
248    panic_nounwind_fmt(fmt::Arguments::new_const(&[expr]), /* force_no_backtrace */ false);
249    #[cfg(feature = "ferrocene_certified")]
250    panic_nounwind_fmt(&expr, /* force_no_backtrace */ false);
251}
252
253/// Like `panic_nounwind`, but also inhibits showing a backtrace.
254#[cfg_attr(not(feature = "panic_immediate_abort"), inline(never), cold)]
255#[cfg_attr(feature = "panic_immediate_abort", inline)]
256#[rustc_nounwind]
257#[cfg(not(feature = "ferrocene_certified"))]
258pub fn panic_nounwind_nobacktrace(expr: &'static str) -> ! {
259    panic_nounwind_fmt(fmt::Arguments::new_const(&[expr]), /* force_no_backtrace */ true);
260}
261
262#[inline]
263#[track_caller]
264#[rustc_diagnostic_item = "unreachable_display"] // needed for `non-fmt-panics` lint
265#[cfg(not(feature = "ferrocene_certified"))]
266pub fn unreachable_display<T: fmt::Display>(x: &T) -> ! {
267    panic_fmt(format_args!("internal error: entered unreachable code: {}", *x));
268}
269
270/// This exists solely for the 2015 edition `panic!` macro to trigger
271/// a lint on `panic!(my_str_variable);`.
272#[inline]
273#[track_caller]
274#[rustc_diagnostic_item = "panic_str_2015"]
275#[rustc_const_stable_indirect] // must follow stable const rules since it is exposed to stable
276#[cfg(not(feature = "ferrocene_certified"))]
277pub const fn panic_str_2015(expr: &str) -> ! {
278    panic_display(&expr);
279}
280
281#[inline]
282#[track_caller]
283#[lang = "panic_display"] // needed for const-evaluated panics
284#[rustc_do_not_const_check] // hooked by const-eval
285#[rustc_const_stable_indirect] // must follow stable const rules since it is exposed to stable
286#[cfg(not(feature = "ferrocene_certified"))]
287pub const fn panic_display<T: fmt::Display>(x: &T) -> ! {
288    panic_fmt(format_args!("{}", *x));
289}
290
291#[cfg_attr(not(feature = "panic_immediate_abort"), inline(never), cold, optimize(size))]
292#[cfg_attr(feature = "panic_immediate_abort", inline)]
293#[track_caller]
294#[lang = "panic_bounds_check"] // needed by codegen for panic on OOB array/slice access
295#[cfg(not(feature = "ferrocene_certified"))]
296fn panic_bounds_check(index: usize, len: usize) -> ! {
297    if cfg!(feature = "panic_immediate_abort") {
298        super::intrinsics::abort()
299    }
300
301    panic!("index out of bounds: the len is {len} but the index is {index}")
302}
303
304#[cfg_attr(not(feature = "panic_immediate_abort"), inline(never), cold, optimize(size))]
305#[cfg_attr(feature = "panic_immediate_abort", inline)]
306#[track_caller]
307#[lang = "panic_misaligned_pointer_dereference"] // needed by codegen for panic on misaligned pointer deref
308#[rustc_nounwind] // `CheckAlignment` MIR pass requires this function to never unwind
309#[cfg(not(feature = "ferrocene_certified"))]
310fn panic_misaligned_pointer_dereference(required: usize, found: usize) -> ! {
311    if cfg!(feature = "panic_immediate_abort") {
312        super::intrinsics::abort()
313    }
314
315    panic_nounwind_fmt(
316        format_args!(
317            "misaligned pointer dereference: address must be a multiple of {required:#x} but is {found:#x}"
318        ),
319        /* force_no_backtrace */ false,
320    )
321}
322
323#[cfg_attr(not(feature = "panic_immediate_abort"), inline(never), cold, optimize(size))]
324#[cfg_attr(feature = "panic_immediate_abort", inline)]
325#[track_caller]
326#[lang = "panic_null_pointer_dereference"] // needed by codegen for panic on null pointer deref
327#[rustc_nounwind] // `CheckNull` MIR pass requires this function to never unwind
328#[cfg(not(feature = "ferrocene_certified"))]
329fn panic_null_pointer_dereference() -> ! {
330    if cfg!(feature = "panic_immediate_abort") {
331        super::intrinsics::abort()
332    }
333
334    panic_nounwind_fmt(
335        format_args!("null pointer dereference occurred"),
336        /* force_no_backtrace */ false,
337    )
338}
339
340#[cfg_attr(not(feature = "panic_immediate_abort"), inline(never), cold, optimize(size))]
341#[cfg_attr(feature = "panic_immediate_abort", inline)]
342#[track_caller]
343#[lang = "panic_invalid_enum_construction"] // needed by codegen for panic on invalid enum construction.
344#[rustc_nounwind] // `CheckEnums` MIR pass requires this function to never unwind
345#[cfg(not(feature = "ferrocene_certified"))]
346fn panic_invalid_enum_construction(source: u128) -> ! {
347    if cfg!(feature = "panic_immediate_abort") {
348        super::intrinsics::abort()
349    }
350
351    panic_nounwind_fmt(
352        format_args!("trying to construct an enum from an invalid value {source:#x}"),
353        /* force_no_backtrace */ false,
354    )
355}
356
357/// Panics because we cannot unwind out of a function.
358///
359/// This is a separate function to avoid the codesize impact of each crate containing the string to
360/// pass to `panic_nounwind`.
361///
362/// This function is called directly by the codegen backend, and must not have
363/// any extra arguments (including those synthesized by track_caller).
364#[cfg_attr(not(feature = "panic_immediate_abort"), inline(never), cold, optimize(size))]
365#[cfg_attr(feature = "panic_immediate_abort", inline)]
366#[lang = "panic_cannot_unwind"] // needed by codegen for panic in nounwind function
367#[rustc_nounwind]
368fn panic_cannot_unwind() -> ! {
369    // Keep the text in sync with `UnwindTerminateReason::as_str` in `rustc_middle`.
370    panic_nounwind("panic in a function that cannot unwind")
371}
372
373/// Panics because we are unwinding out of a destructor during cleanup.
374///
375/// This is a separate function to avoid the codesize impact of each crate containing the string to
376/// pass to `panic_nounwind`.
377///
378/// This function is called directly by the codegen backend, and must not have
379/// any extra arguments (including those synthesized by track_caller).
380#[cfg_attr(not(feature = "panic_immediate_abort"), inline(never), cold, optimize(size))]
381#[cfg_attr(feature = "panic_immediate_abort", inline)]
382#[lang = "panic_in_cleanup"] // needed by codegen for panic in nounwind function
383#[rustc_nounwind]
384#[cfg(not(feature = "ferrocene_certified"))]
385fn panic_in_cleanup() -> ! {
386    // Keep the text in sync with `UnwindTerminateReason::as_str` in `rustc_middle`.
387    panic_nounwind_nobacktrace("panic in a destructor during cleanup")
388}
389
390/// This function is used instead of panic_fmt in const eval.
391#[lang = "const_panic_fmt"] // needed by const-eval machine to replace calls to `panic_fmt` lang item
392#[rustc_const_stable_indirect] // must follow stable const rules since it is exposed to stable
393#[cfg(not(feature = "ferrocene_certified"))]
394pub const fn const_panic_fmt(fmt: fmt::Arguments<'_>) -> ! {
395    if let Some(msg) = fmt.as_str() {
396        // The panic_display function is hooked by const eval.
397        panic_display(&msg);
398    } else {
399        // SAFETY: This is only evaluated at compile time, which reliably
400        // handles this UB (in case this branch turns out to be reachable
401        // somehow).
402        unsafe { crate::hint::unreachable_unchecked() };
403    }
404}
405
406#[derive(Debug)]
407#[doc(hidden)]
408#[cfg(not(feature = "ferrocene_certified"))]
409pub enum AssertKind {
410    Eq,
411    Ne,
412    Match,
413}
414
415/// Internal function for `assert_eq!` and `assert_ne!` macros
416#[cfg_attr(not(feature = "panic_immediate_abort"), inline(never), cold, optimize(size))]
417#[cfg_attr(feature = "panic_immediate_abort", inline)]
418#[track_caller]
419#[doc(hidden)]
420#[cfg(not(feature = "ferrocene_certified"))]
421pub fn assert_failed<T, U>(
422    kind: AssertKind,
423    left: &T,
424    right: &U,
425    args: Option<fmt::Arguments<'_>>,
426) -> !
427where
428    T: fmt::Debug + ?Sized,
429    U: fmt::Debug + ?Sized,
430{
431    assert_failed_inner(kind, &left, &right, args)
432}
433
434/// Internal function for `assert_match!`
435#[cfg_attr(not(feature = "panic_immediate_abort"), inline(never), cold, optimize(size))]
436#[cfg_attr(feature = "panic_immediate_abort", inline)]
437#[track_caller]
438#[doc(hidden)]
439#[cfg(not(feature = "ferrocene_certified"))]
440pub fn assert_matches_failed<T: fmt::Debug + ?Sized>(
441    left: &T,
442    right: &str,
443    args: Option<fmt::Arguments<'_>>,
444) -> ! {
445    // The pattern is a string so it can be displayed directly.
446    struct Pattern<'a>(&'a str);
447    impl fmt::Debug for Pattern<'_> {
448        fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
449            f.write_str(self.0)
450        }
451    }
452    assert_failed_inner(AssertKind::Match, &left, &Pattern(right), args);
453}
454
455/// Non-generic version of the above functions, to avoid code bloat.
456#[cfg_attr(not(feature = "panic_immediate_abort"), inline(never), cold, optimize(size))]
457#[cfg_attr(feature = "panic_immediate_abort", inline)]
458#[track_caller]
459#[cfg(not(feature = "ferrocene_certified"))]
460fn assert_failed_inner(
461    kind: AssertKind,
462    left: &dyn fmt::Debug,
463    right: &dyn fmt::Debug,
464    args: Option<fmt::Arguments<'_>>,
465) -> ! {
466    let op = match kind {
467        AssertKind::Eq => "==",
468        AssertKind::Ne => "!=",
469        AssertKind::Match => "matches",
470    };
471
472    match args {
473        Some(args) => panic!(
474            r#"assertion `left {op} right` failed: {args}
475  left: {left:?}
476 right: {right:?}"#
477        ),
478        None => panic!(
479            r#"assertion `left {op} right` failed
480  left: {left:?}
481 right: {right:?}"#
482        ),
483    }
484}