Reject panicking calls in no_panic functions

Author: olwang

src/analyzer.rs

@@ -75,6 +75,7 @@ impl Analyzer<'_> {
         self.check_generic_constraints();
         self.check_pure_bodies();
         self.check_no_block_bodies();
+        self.check_no_panic_bodies();
         self.check_noalloc_allocations();
         self.check_try_operator_result_returns();
         self.check_resource_fields();
@@ -927,6 +928,95 @@ impl Analyzer<'_> {
         }
     }
 
+    fn check_no_panic_bodies(&mut self) {
+        let items = self.syntax_program.items.clone();
+        for item in &items {
+            let Item::Function(function) = item else {
+                continue;
+            };
+            if !function_has_effect(function, "no_panic") {
+                continue;
+            }
+            self.check_no_panic_block(&function.name, &function.body);
+        }
+    }
+
+    fn check_no_panic_block(&mut self, function_name: &str, block: &Block) {
+        for statement in &block.statements {
+            self.check_no_panic_stmt(function_name, statement);
+        }
+    }
+
+    fn check_no_panic_stmt(&mut self, function_name: &str, statement: &Stmt) {
+        match statement {
+            Stmt::Let(stmt) => {
+                if let Some(value) = &stmt.value {
+                    self.check_no_panic_expr(function_name, value);
+                }
+            }
+            Stmt::Return(stmt) => {
+                if let Some(value) = &stmt.value {
+                    self.check_no_panic_expr(function_name, value);
+                }
+            }
+            Stmt::Expr(value) => self.check_no_panic_expr(function_name, value),
+            Stmt::With(stmt) => {
+                self.check_no_panic_expr(function_name, &stmt.resource);
+                self.check_no_panic_block(function_name, &stmt.body);
+            }
+            Stmt::If(stmt) => {
+                self.check_no_panic_expr(function_name, &stmt.condition);
+                self.check_no_panic_block(function_name, &stmt.then_body);
+                if let Some(else_body) = &stmt.else_body {
+                    self.check_no_panic_block(function_name, else_body);
+                }
+            }
+            Stmt::Loop(stmt) => {
+                if let Some(condition) = &stmt.condition {
+                    self.check_no_panic_expr(function_name, condition);
+                }
+                self.check_no_panic_block(function_name, &stmt.body);
+            }
+            Stmt::Break(_) | Stmt::Continue(_) | Stmt::Unknown(_) => {}
+        }
+    }
+
+    fn check_no_panic_expr(&mut self, function_name: &str, expr: &Expr) {
+        match expr {
+            Expr::Call {
+                callee, args, span, ..
+            } => {
+                match self.hir.resolve_call(callee) {
+                    CallResolution::Resolved { signature, kind } => {
+                        if !matches!(kind, ResolvedCalleeKind::Constructor { .. })
+                            && !signature.effects.iter().any(|effect| effect == "no_panic")
+                        {
+                            self.panic_call_diagnostic(function_name, callee, span);
+                        }
+                    }
+                    CallResolution::EnumVariant | CallResolution::Unknown => {}
+                }
+                for arg in args {
+                    self.check_no_panic_expr(function_name, &arg.value);
+                }
+            }
+            Expr::Effect { value, .. } | Expr::Manage { value, .. } | Expr::Try { value, .. } => {
+                self.check_no_panic_expr(function_name, value);
+            }
+            Expr::Binary { left, right, .. } => {
+                self.check_no_panic_expr(function_name, left);
+                self.check_no_panic_expr(function_name, right);
+            }
+            Expr::Field { base, .. } => self.check_no_panic_expr(function_name, base),
+            Expr::Index { base, index, .. } => {
+                self.check_no_panic_expr(function_name, base);
+                self.check_no_panic_expr(function_name, index);
+            }
+            Expr::Closure { body, .. } => self.check_no_panic_block(function_name, body),
+            Expr::Ident(_, _) | Expr::Number(_, _) | Expr::String(_, _) | Expr::Unknown(_) => {}
+        }
+    }
+
     fn check_duplicate_declarations(&mut self) {
         for duplicate in self.hir.duplicate_symbols() {
             self.diagnostics.push(
@@ -1360,6 +1450,33 @@ impl Analyzer<'_> {
             ),
         );
     }
+
+    fn panic_call_diagnostic(
+        &mut self,
+        function_name: &str,
+        callee: &Callee,
+        span: &crate::diagnostic::Span,
+    ) {
+        self.diagnostics.push(
+            Diagnostic::error(
+                code::INVALID_NO_PANIC_CALL,
+                format!(
+                    "`{function_name}` is declared no_panic but calls possibly panicking function `{}`.",
+                    callee_display(callee)
+                ),
+                span.clone(),
+                "possibly panicking call in no_panic function",
+            )
+            .with_cause(
+                "A `no_panic` function may only call constructors, enum variants, or functions also declared `effects(no_panic)`.",
+            )
+            .with_fix(
+                "remove_no_panic_or_call_no_panic",
+                "Remove `no_panic`, or call only APIs whose signatures are declared `effects(no_panic)`.",
+                "manual",
+            ),
+        );
+    }
 }
 
 fn resource_pool_namespace_arg(namespace: &str) -> Option<&str> {

src/diagnostic.rs

@@ -19,6 +19,7 @@ pub mod code {
     pub const UNKNOWN_FILE_FEATURE: &str = "RS0016";
     pub const DUPLICATE_FILE_FEATURE: &str = "RS0017";
     pub const INVALID_NO_BLOCK_CALL: &str = "RS0018";
+    pub const INVALID_NO_PANIC_CALL: &str = "RS0019";
     pub const FEATURE_VIOLATION: &str = "RS0101";
     pub const UNNAMED_ARGUMENT: &str = "RS0201";
     pub const MISSING_DATA_EFFECT: &str = "RS0202";
@@ -311,6 +312,11 @@ static DIAGNOSTIC_EXPLANATIONS: &[DiagnosticExplanation] = &[
         title: "invalid no_block call",
         explanation: "`effects(no_block)` is a guarantee that the function does not block the current isolate. Calls inside it must target constructors, enum variants, or functions also declared `effects(no_block)`.",
     },
+    DiagnosticExplanation {
+        code: code::INVALID_NO_PANIC_CALL,
+        title: "invalid no_panic call",
+        explanation: "`effects(no_panic)` is a guarantee that the function does not intentionally panic. Calls inside it must target constructors, enum variants, or functions also declared `effects(no_panic)`.",
+    },
     DiagnosticExplanation {
         code: code::FEATURE_VIOLATION,
         title: "feature violation",

tests/fixtures/fail/no-panic-plain-call.rss

@@ -0,0 +1,11 @@
+// expect: RS0019
+
+fn may_panic(value: Int) -> Int {
+    return value
+}
+
+fn promised_no_panic(value: Int) -> Int
+    effects(no_panic)
+{
+    return may_panic(value: value)
+}

tests/fixtures/pass/no-panic-helper-call.rss

@@ -0,0 +1,11 @@
+fn checked_id(value: Int) -> Int
+    effects(no_panic)
+{
+    return value
+}
+
+fn checked_twice(value: Int) -> Int
+    effects(no_panic)
+{
+    return checked_id(value: value)
+}