compile wraps its body in catch_unwind (lib.rs:454). No other exported function does: create_compiler (:100), set_sys_inputs (:214), free_compiler (:198), free_compile_result (:482), reset_world. Since Rust 1.81 an uncaught unwind across a "C" boundary aborts, and the crate builds well above that.
Panics reachable in create_compiler today: VirtualPath::new("<main>").expect(...), the file-id budget in #41, and anything inside font enumeration or SystemWorld::new. The VirtualPath unwrap fixed in #37 was one instance of this class, not the class itself.
Two unchecked pointer reads in the same function:
lib.rs:146, CStr::from_ptr(sys_inputs), with no null check, unlike set_sys_inputs which checks its compiler pointer.lib.rs:157, CStr::from_ptr(p) per font path, so a null entry dereferences null.
A guarded function fails one call. An unguarded one takes down every other in-flight request in the process and leaves nothing in the log.
What I would like:
catch_unwind in each exported body, converted into the failure the signature already allows: null for create_compiler, false for set_sys_inputs, no-op for the free functions.- Null checks on the pointers that are currently read unconditionally.
- A
panic::set_hook capturing message and location, so the reason survives into the .NET exception.
Point 3 needs somewhere to put the message: create_compiler returns a bare null and discards the one world.rs builds. That part overlaps #24.
Happy to send a PR.
compilewraps its body incatch_unwind(lib.rs:454). No other exported function does:create_compiler(:100),set_sys_inputs(:214),free_compiler(:198),free_compile_result(:482),reset_world. Since Rust 1.81 an uncaught unwind across a"C"boundary aborts, and the crate builds well above that.Panics reachable in
create_compilertoday:VirtualPath::new("<main>").expect(...), the file-id budget in #41, and anything inside font enumeration orSystemWorld::new. TheVirtualPathunwrap fixed in #37 was one instance of this class, not the class itself.Two unchecked pointer reads in the same function:
lib.rs:146,CStr::from_ptr(sys_inputs), with no null check, unlikeset_sys_inputswhich checks its compiler pointer.lib.rs:157,CStr::from_ptr(p)per font path, so a null entry dereferences null.A guarded function fails one call. An unguarded one takes down every other in-flight request in the process and leaves nothing in the log.
What I would like:
catch_unwindin each exported body, converted into the failure the signature already allows: null forcreate_compiler,falseforset_sys_inputs, no-op for the free functions.panic::set_hookcapturing message and location, so the reason survives into the .NET exception.Point 3 needs somewhere to put the message:
create_compilerreturns a bare null and discards the oneworld.rsbuilds. That part overlaps #24.Happy to send a PR.