-
Notifications
You must be signed in to change notification settings - Fork 182
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove some panics from zerovec's derive and icu_codepointtrie #6052
Conversation
The zerovec one seems like a slam dunk to me. The codepointtrie one is iffy: it would be nice to have these panics as debug checks at least. Most Rust release builds do not panic on overflow, however Android does. We could in theory disable that behavior for the bionic binary, but I don't know if it's easy. It is nice to make an attempt to remove panics from this code. On the other hand, it makes the code gnarlier, and bugs will be harder to trace. (I could introduce some code that wraps the wrapping arithmetic in debug assertions) Routes to take here:
We could also potentially add CI ensuring that panicking infra never makes it into bionic. |
2073a5d
to
6df2f3a
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good work. Just some small things
let mut index1_pos: u32 = code_point >> SHIFT_1; | ||
if self.header.trie_type == TrieType::Fast { | ||
debug_assert!( | ||
FAST_TYPE_FAST_INDEXING_MAX < code_point && code_point < self.header.high_start | ||
); | ||
index1_pos = index1_pos + BMP_INDEX_LENGTH - OMITTED_BMP_INDEX_1_LENGTH; | ||
index1_pos = index1_pos.wrapping_add(BMP_INDEX_LENGTH - OMITTED_BMP_INDEX_1_LENGTH); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Suggestion: Given that we have a good GIGO code path, I agree with removing the panicky subtract impls in "safe release" mode like Android is using. However, I think we should keep the debug asserts in test mode. In other words, since we do this a lot in this file, please make a helper function or macro that does the wrapping_add
or wrapping_sub
with an explicit debug_assert
and use it everywhere in this file.
The helper function/macro could eventually make its way into the shared-macro helper file. (#4467)
I prefer this option conditional on the "potentially" part:
|
Works for me, happy to add debug assertions |
I managed to have a nice-looking but simple macro; and I also discovered another place in zerovec derive that could use a non-panicking bounds check. |
Discovered whilst working on bionic, I noticed panic machinery being pulled in.