Finding Panics with Call Graph Analyzer

Rust panics signal unrecoverable errors, whether caused by bugs or callers violating a function’s assumptions. Eliminating every possible panic is often impractical: replacing failures with Results can merely move the point of failure up the call stack. The more useful goal is to make panic paths visible and track changes to them. Reducing panics can still matter when code size is constrained, in critical operations such as firmware updates or public services vulnerable to denial-of-service, and inside panic-handling code. The discussion also stresses recovery: watchdogs and recovery images for embedded devices, or catching unwinding panics on host systems, can be more practical than demanding that failure never occur.

The Call Graph Analyzer (CGA), developed with Microsoft through the Open Device Partnership, extracts a call graph from monomorphized Rust MIR to identify functions that can panic, including code in dependencies and the standard library. Unlike linker checks, it can report specific paths without requiring a binary to contain no panics; unlike source-level or HIR analysis, it can see compiler-generated checks and dependency code. CGA runs as a rustc driver, traverses externally accessible entry points, and aims to support async and embedded Rust. Its tradeoffs are significant: it requires a particular nightly compiler, may analyze a different compiler and configuration from the one used for the final binary, and takes roughly two to three times as long as cargo check. Because it analyzes code before LLVM removes unreachable paths, it can also report false positives.