svn commit: r325386 - head/sys/kern

[Bruce Evans]

On Sun, 5 Nov 2017, Mateusz Guzik wrote:

> On Sun, Nov 5, 2017 at 9:15 PM, Konstantin Belousov <kostikbel at gmail.com>
> wrote:
>
>> On Sun, Nov 05, 2017 at 12:37:50PM -0700, Ian Lepore wrote:
>>> IMO, the only reason ASSERT-style macros exist is to hide the
>>> conditional-on-build-type part of the operation.  That is, to avoid
>>> having #ifdef INVARIANTS scattered everywhere.
>> bde' point is that KASSERT() is badly designed, and I agree with him.
>> Now we could at least remove the () around the message formatting part,
>> but it is too late.
>>>
>>> Creating a macro to generate always-on error detection and reporting
>>> code just because there exists a macro to do so conditionally seems to
>>> turn the world on its head.
>> I agree with this statement.  if()panic(); construct is good enough, IMO.

I agree.

> I don't like our panic messages whatsoever, they are quite often not
> informative.

I don't like our panic messages, since they are too long.

> For instance consider:
> if (obj->foo < bar)
>    panic("bad foo %d, have fun looking for bar");

I almost prefer panic(".") where the dot is rendered in red :-).  The
dot is too hard to grep for, so I acually prefer panic(
"<literal_function_name>").  panic("%s", __func__) is even better than
the dot for unreadability.

Often the value of foo and bar and hundreds of other variables printed by
a bloated panic statement are obvious or uninteresting, and you need to
use a debugger and a compiler that does't optimize out or otherwise
obfuscate anything.

> Instead a macro akin to PASS(obj->foo, <, bar, "obj %p", obj); can
> expand itself to stringify the first 3 terms and also show the compared
> values. Saves on boiler-plate written by hand.
> 
> I think *all* panics should be accompanied with a linux's oops-like dump.

Dumps can be produced by debuggers or hd on core files.  More than function
names (also offsets within functions) can be produced by debuggers or
addr2line, all without any space/time bloat for stringification.

Some panics already occur via traps.  Then trap() does a simple dump
and panic() can't print anything more useful.  Instead of the red dot
panic, I also prefer a breakpoint or null pointer trap.  Both are
restartble using kdb, unlike panic().  If no backend is attached to kdb,
then these traps turn into panics with a dump from trap().

Bruce