Harden the C ABI: catch C++ exceptions instead of terminating the process (#27) - #29
Open
Borderliner wants to merge 1 commit into
Open
Harden the C ABI: catch C++ exceptions instead of terminating the process (#27)#29Borderliner wants to merge 1 commit into
Borderliner wants to merge 1 commit into
Conversation
…cess Every extern "C" PICOGK_API function can currently let a C++/OpenVDB exception propagate across the FFI boundary, which is UB and in practice calls std::terminate and aborts the host process -- uncatchable from non-C++ bindings (Python ctypes, Rust FFI, ...). See leap71#27. Wrap each PICOGK_API body in a try/catch that records a last-error string, sets a flag, and returns a type-appropriate sentinel (void -> ;, bool -> false, handle/int -> 0, float -> NaN), and add PicoGK_SetError / PicoGK_nGetLastError plus an exported g_pkLastErrorFlag so a binding can poll after each call and raise its own exception. No behavioural change for calls that don't throw (the flag is cleared on entry and set only on exception). Does not cover hard faults (SIGSEGV) or hangs -- those remain the binding's responsibility. Generated mechanically (idempotent) so it can be re-applied across runtime versions; in PicoPie it currently runs as a build-time transform. Addresses leap71#27.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses #27 — harden the C ABI so a thrown C++/OpenVDB exception becomes a catchable error in the caller instead of a process abort.
Problem
Every
extern "C"PICOGK_APIfunction can let a C++ exception propagate across the FFI boundary. That's undefined behaviour and in practice callsstd::terminate, killing the host process. A C# caller cantry/catch; a C-ABI binding (Pythonctypes, Rust FFI, …) cannot — there's no C++ frame to unwind into. Examples that abort today: a CSG/second implicit intersect on a non-level-set grid (OpenVDBValueError), an out-of-range VDB field index (std::vector::at→std::out_of_range).Change (
Source/PicoGKLibrary.cpponly)PicoGK_SetError/PicoGK_nGetLastErrorand an exportedg_pkLastErrorFlag, plusPICOGK_GUARD_TRY/PICOGK_GUARD_CATCH(sentinel)macros.PICOGK_APIfunctions intry/catch, returning a type-appropriate sentinel (void→;,bool→false, handle/int→0,float→NaN). A binding clears the flag on entry, reads it after each call, and raises.The diff is large but entirely mechanical — the reviewable core is the ~40-line infra block at the top and the uniform two-line wrap repeated per function. It's produced by an idempotent script, so it can be re-generated for future runtime versions rather than hand-maintained.
Properties
catch).SIGSEGVfrom e.g. a NaN reaching native math) or hangs — those are best guarded at the binding boundary; this converts the large class of thrown exceptions.Verification
This exact transform is what PicoPie applies to the pinned runtime at build time; it compiles and ships on Linux, macOS, and Windows in PicoPie's wheel CI, and a subprocess fuzz campaign of degenerate inputs (NaN/inf, empty grids, repeated CSG) runs with zero process aborts.
Open to adjustment
Happy to tailor the approach to your preferences — e.g. making the last-error string
thread_localfor multi-threaded API use (currently a single file-scope global), the symbol names, or limiting the scope to the throw-prone subset rather than all functions.Reported & implemented via PicoPie, a Pythonic binding of PicoGK.