Return a panic inside the decoder as an error, not as the end of the thread

rawler panics on some input rather than returning Err — a DNG whose IFD
claims a >50000 px image, which the reference library has: a 521 MB
stitched panorama, IMG_4181-Pano.dng. On a worker thread a panic is the
end of the thread, so the face sweep that met it stopped thirteen
seconds in, three sweeps running on the tablet and three on the
desktop, with "17301 image(s) to index" as the last word. FR-RAW-4
says a malformed file must not abort a batch, and that is this crate's
promise whatever the library beneath it does: every entry point that
calls into rawler now runs under catch_unwind, and a file that panics
the decoder is one failed file with the panic's message in the error.

Verified on the panorama itself: metadata reads, decode returns the
error, the thread survives. The crash hook still records the panic,
which is right — it is a defect in a dependency and the record is how
it gets reported.

This commit is contained in:

dtourolle

2026-09-19 10:45:07 +02:00

parent 78cb00634e

commit c0b1e78f7c

4 changed files with 81 additions and 9 deletions

docs/traceability.md

+9 -9

View File

File diff suppressed because one or more lines are too long