runtime: make many runtime panics fatal#5552
Merged
Merged
Conversation
Match the Go runtime by terminating instead of unwinding when an allocator exhausts the heap. Recovering an OOM can leave allocator locks held and cannot safely continue when the panic path itself needs memory.
Match the Go runtime by terminating for deadlocks, stack overflows, runtime and GC invariants, invalid lock operations, and platform initialization failures instead of routing them through panic/recover. Keep language-level runtime errors and unsupported user operations recoverable. Add crash coverage that verifies fatal errors bypass deferred recover calls.
jakebailey
force-pushed
the
runtime-fatal-errors
branch
from
July 24, 2026 19:10
742c156 to
42f7278
Compare
Member
|
Thank you for working on this @jakebailey and to @dgryski for review. Now merging. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In #5438, I made runtime panics recoverable.
But, I didn't think about the fact that because they previously were not recoverable, they had historically been used like fatal errors (
throwin BigGo terms). This means that if a tinygo process OOMs, it won't crash... It will attempt to panic, and then bad things happen (panicking needs to allocate!), which I figured out due to a hang inregexp/syntaxtests in #5550 on the qemu-riscv runner with limited memory.So, introduce
runtimeFataland switch OOMs and many other things to it that should not have been recoverable panics.