Module panic_safe 

Panic-safety helpers for the C ABI boundary.

Rust panics that unwind across extern "C" into Swift are undefined behaviour. Extern callbacks that invoke user code must use the appropriate helper in this module to catch supported panics and report a best-effort diagnostic without unwinding into their caller.

A destructor that panics while another panic is already unwinding aborts the process before catch_unwind can recover. Callbacks with potentially panicking teardown state must use catch_user_panic_result_with_cleanup so callback execution, cleanup, and best-effort destruction happen in explicit phases.

No helper can safely contain multiple destructor panics from one opaque aggregate without leaking arbitrary user state. Callback closures, cleanup closures, state, results, panic payloads, and body-local values must uphold Rust’s standard destructor invariant: their aggregate destruction must not produce a second panic while already unwinding.

This is intentionally a single shared helper rather than ad-hoc catch_unwind calls so the diagnostic format and the payload-destruction defence-in-depth stay consistent.

Functions

catch_user_panic

Run f and swallow any panic it produces.

catch_user_panic_result

Run a result-returning callback and convert any contained panic to None.

catch_user_panic_result_with_cleanup

Run a callback and an explicit library-owned cleanup phase.

log_callback_panic

Best-effort logger for panics caught at the C ABI boundary.