Tracking issue for the #[alloc_error_handler] attribute (for no_std + liballoc)

[SimonSapin]

View all comments

This attribute is mandatory when using the alloc crate without the std crate. It is used like this:

#[alloc_error_handler]
fn foo(_: core::alloc::Layout) -> ! {
    // …
}

Implementation PR: #52191

Blocking issues

• #[alloc_error_handler] must not unwind. So we have to either make this a safety requirement or catch unwinding ourselves.
• Adding #[track_caller] on #[alloc_error_handler] seems to cause undefined behavior #83430
• Who is responsible for preventing reentrancy issues through the allocator? unsafe-code-guidelines#506
• alloc_error_handler can be an unsafe fn which is then unsoundly invoked #134225
• The combination of alloc_error_handler and target_features_11 is unsound #134234

Original issue:

---

In a no_std program or staticlib, linking to the alloc crate may cause this error:

error: language item required, but not found: `oom`

This is fixed by providing the oom lang item, which is is normally provided by the std crate (where it calls a dynamically-settable hook #51245, then aborts). This is called by alloc::alloc::handle_alloc_error (which is called by Vec and others on memory allocation failure).

#![feature(lang_items)]

#[lang = "oom"]
extern fn foo(_: core::alloc::Layout) -> ! {
    // example implementation based on libc
    extern "C" { fn abort() -> !; }
    unsafe { abort() }
}

However, defining a lang item is an unstable feature.

Possible solutions include:

1. Add and stabilize a dedicated attribute similar to the #[panic_implementation] attribute:

#[alloc_error_handler]
fn foo(_: core::alloc::Layout) -> ! {
    // …
}

The downside is that this is one more mandatory hoop to jump through for no_std program that would have been fine with a default hook that aborts.

2. Move std’s dynamically-settable hook into alloc: Move OOM handling to liballoc and remove the oom lang item #51607. The downside is some mandatory space overhead.

[SimonSapin]

Better idea: remove the lang item and move all of OOM handling to liballoc, except for the default hook that prints to stderr. Have compiler magic similar to that of #[global_allocator] that uses the printing default hook when std is linked, or a no-op default hook otherwise.

[glandium]

Bikeshedding on oom renaming: alloc_error would be shorter.

[SimonSapin]

I forgot to link #51543, which does indeed use alloc_error.