fix(lance): contain Rust panics at FFI boundary

Author: wangyong9999

crates/lance_ffi/Cargo.toml

@@ -44,7 +44,7 @@ cbindgen = "0.29"
 opt-level = 3
 lto = "thin"
 codegen-units = 1
-panic = "abort"
+panic = "unwind"
 
 [profile.dev]
-panic = "abort"
+panic = "unwind"

crates/lance_ffi/src/error.rs

@@ -15,8 +15,10 @@
 // specific language governing permissions and limitations
 // under the License.
 
+use std::any::Any;
 use std::cell::RefCell;
 use std::ffi::{c_char, CString};
+use std::panic::{catch_unwind, AssertUnwindSafe};
 
 thread_local! {
     static LAST_ERROR: RefCell<CString> =
@@ -38,7 +40,77 @@ pub(crate) fn fail(message: impl Into<String>) -> i32 {
     -1
 }
 
+pub(crate) fn panic_message(payload: Box<dyn Any + Send>) -> String {
+    let message = payload
+        .downcast_ref::<String>()
+        .map(String::as_str)
+        .or_else(|| payload.downcast_ref::<&str>().copied())
+        .unwrap_or("unknown panic");
+    format!("Lance panicked: {message}")
+}
+
+// Catch before returning through the C ABI, including panics during cleanup.
+pub(crate) fn catch_panic<T>(fallback: T, operation: impl FnOnce() -> T) -> T {
+    match catch_unwind(AssertUnwindSafe(operation)) {
+        Ok(result) => result,
+        Err(payload) => {
+            fail(panic_message(payload));
+            fallback
+        }
+    }
+}
+
 #[no_mangle]
 pub extern "C" fn paimon_lance_last_error() -> *const c_char {
-    LAST_ERROR.with(|cell| cell.borrow().as_ptr())
+    // Do not try to record another error if accessing the error slot panics.
+    catch_unwind(|| LAST_ERROR.with(|cell| cell.borrow().as_ptr())).unwrap_or(std::ptr::null())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::ffi::CStr;
+
+    pub(crate) fn last_error() -> String {
+        unsafe { CStr::from_ptr(paimon_lance_last_error()) }
+            .to_str()
+            .unwrap()
+            .to_owned()
+    }
+
+    #[test]
+    fn panic_becomes_error_and_unwinds_locals() {
+        let dropped = std::cell::Cell::new(false);
+        struct OnDrop<'a>(&'a std::cell::Cell<bool>);
+        impl Drop for OnDrop<'_> {
+            fn drop(&mut self) {
+                self.0.set(true);
+            }
+        }
+        assert_eq!(
+            catch_panic(-1, || {
+                let _guard = OnDrop(&dropped);
+                panic!("decode failed");
+            }),
+            -1
+        );
+        assert!(dropped.get());
+        assert_eq!(last_error(), "Lance panicked: decode failed");
+        assert_eq!(
+            catch_panic(-1, || {
+                clear_last_error();
+                42
+            }),
+            42
+        );
+        assert_eq!(last_error(), "");
+    }
+
+    #[test]
+    fn supports_owned_and_non_string_panics() {
+        catch_panic((), || std::panic::panic_any(String::from("owned message")));
+        assert_eq!(last_error(), "Lance panicked: owned message");
+        catch_panic((), || std::panic::panic_any(42));
+        assert_eq!(last_error(), "Lance panicked: unknown panic");
+    }
 }

crates/lance_ffi/src/lib.rs

@@ -17,6 +17,9 @@
 
 #![deny(unsafe_op_in_unsafe_fn)]
 
+#[cfg(not(panic = "unwind"))]
+compile_error!("paimon_lance_ffi requires panic=unwind to contain panics at the C ABI");
+
 mod error;
 mod reader;
 mod runtime;