Hacker News Reader

Comment by assbuttbuttass | Hacker News Reader

> it’s sometimes nice to have the assurance that no code being executed can possibly panic.

I struggling to think of any language that can provide this guarantee. Even Python can segfault while executing C extensions. Maybe java?

View on HN

You can easily segfault in pure Python:

  import sys
  sys.setrecursionlimit(1048576)
  def recurse(): recurse()
  recurse()

A slightly simpler way is just:

    import ctypes
    ctypes.string_at(0)

Ada has a set of High Integrity Restrictions that define pragmas that turn off exceptions:

"No_Exceptions - Raise_statements and exception_handlers are not allowed. No language-defined run-time checks are generated; however, a run-time check performed automatically by the hardware is permitted."

Source: http://www.ada-auth.org/standards/12rm/html/RM-H-4.html

If the underlying operating system or board support system have similar support then panic situations would be avoided entirely.

While this is a highly-specialized case, it is defined and supported by high integrity Ada implementations / runtimes.

You don't want to do that. It's an optimization, not a "The compiler will guarantee there won't be exceptions thrown."

https://www.adaic.org/resources/add_content/docs/95style/htm...

"If you disable exception checks and program execution results in a condition in which an exception would otherwise occur, the program execution is erroneous. The results are unpredictable"

But most languages don't have all their libraries willing to intentionally panic, so it's not a big deal in practice.

It would be nice to have an overall scorecard for a library. It would show a bunch of stuff related to the crate: existence of unit tests, fuzz testing, and measures of the test coverage, if the code passes clippy checks, which edition of Rust, and such. We could also grade crates by how many open tickets they have which haven't seen a response, etc. This wouldn't be intended to shame the library maintainers, but more to indicate which projects are active, and which ones have issues fixed promptly.

It would be easy enough to also scan the source for sources of panics.

Vanilla python can also segfault, in certain edge cases.

    eval((lambda:0).__code__.replace(co_consts=()))

This code throws a missing attribute error on Python 3.7? 'code' object has no attribute 'replace'. Is it for 2.7?

3.8+, iirc

Sometimes to have the assurance means in some specific code, not always: the code is entered via some entry point, and guaranteed to reach one of its exit points without hitting a panic.

I think it's a property that you could validate via static analysis in relatively strongly-typed languages. I agree it would be impossible for Python, just because everything can change at runtime.

To do so in C# requires messing with C libraries, but generally most behaviour that could actually segfault throws an exception instead.

Popping in my mind:

- System.Diagnostics.Debug.Assert (on debug builds)

- Envinroment.FailFast (this is precisely what panic! is usually used for)

- void BlowUp() { BlowUp(); }

But, in reality, any unexpected Exception: how would you properly handle an unexpected NRE or index out of bounds? Either swallowing the exception (bad) or aborting.

panic is just different name for exception though.

Exceptions can be handled, so in rust an "exception" is a "Result<T,U>". A panic means the program terminates, guaranteed. This allows us to ignore hugely difficult edge cases when interacting with hardware / OSes and still ensure the code meets safety guarantees; if the code isn't executing it cannot invalidate any invariants.

> A panic means the program terminates, guaranteed.

That's not strictly true: https://doc.rust-lang.org/std/panic/fn.catch_unwind.html

Panic is what Rust calls exceptions.

> Panic is what Rust calls exceptions.

Not exactly; “panic” is what Go calls exceptions.

Rust “panic!” macro, though, is more of a gentle abort (I guess it's like an uncatchable exception, but that qualifier so radically changes the nature that I can't see it as really the same kind of thing.)

https://doc.rust-lang.org/std/panic/fn.catch_unwind.html

Reply on news.ycombinator.com