PEP: 601 Title: Forbid return/break/continue breaking out of finally Author: Damien George, Batuhan Taskaya Sponsor: Nick Coghlan Discussions-To: https://discuss.python.org/t/pep-601-forbid-return-break-continue-breaking-out-of-finally/2239 Status: Rejected Type: Standards Track Content-Type: text/x-rst Created: 26-Aug-2019 Python-Version: 3.8 Post-History: 26-Aug-2019, 23-Sep-2019 Resolution: https://discuss.python.org/t/pep-601-forbid-return-break-continue-breaking-out-of-finally/2239/32 Rejection Note ============== This PEP was rejected by the Steering Council by a vote of 4/4. Guido's arguments for rejecting the PEP are: "it seems to me that most languages implement this kind of construct but have style guides and/or linters that reject it. I would support a proposal to add this to :pep:`8`", and "I note that the toy examples are somewhat misleading – the functionality that may be useful is a conditional return (or break etc.) inside a finally block.". Abstract ======== This PEP proposes to forbid ``return``, ``break`` and ``continue`` statements within a ``finally`` suite where they would break out of the ``finally``. Their use in such a location silently cancels any active exception being raised through the ``finally``, leading to unclear code and possible bugs. ``continue`` is currently not supported in a ``finally`` in Python 3.7 (due to implementation issues) and the proposal is to not add support for it in Python 3.8. For ``return`` and ``break`` the proposal is to deprecate their use in Python 3.9, emit a compilation warning in Python 3.10 and then forbid their use after that. Motivation ========== The use of ``return``, ``break`` and ``continue`` within a ``finally`` suite leads to behaviour which is not at all obvious. Consider the following function:: def foo(): try: foo() finally: return This will return cleanly (without an exception) even though it has infinite recursion and raises an exception within the ``try``. The reason is that the ``return`` within the ``finally`` will silently cancel any exception that propagates through the ``finally`` suite. Such behaviour is unexpected and not at all obvious. This function is equivalent to:: def foo(): try: foo() except: pass return ``break`` and ``continue`` have similar behaviour (they silence exceptions) if they jump to code outside the ``finally`` suite. For example:: def bar(): while True: try: 1 / 0 finally: break This behaviour goes against the following parts of The Zen of Python: * Explicit is better than implicit - exceptions are implicitly silenced * Readability counts - the intention of the code is not obvious * Errors should never pass silently; Unless explicitly silenced - exceptions are implicitly silenced If this behaviour of silencing exceptions is really needed then the explicit form of a try-except can be used instead, and this makes the code clearer. Independent to the semantics, implementing ``return``/``break``/``continue`` within a ``finally`` suite is non-trivial as it requires to correctly track any active exceptions at runtime (an executing ``finally`` suite may or may not have an active exception) and cancel them as appropriate. CPython did have a bug in this for the case of ``continue`` and so originally disallowed it [1]_. Requiring correct behaviour for ``return``/``break``/``continue`` within a ``finally`` puts an unnecessary burden on alternative implementations of Python. Other languages =============== Java allows to return from within a ``finally`` block, but its use is discouraged according to [2]_, [3]_, [4]_. The Java compiler later on included a linting option ``-Xlint:finally`` to warn against the use of return within a ``finally`` block. The Eclipse editor also warns about this use. Ruby allows return from inside ensure (Python's finally), but it should be an explicit return. It is discouraged and handled by linters [5]_, [6]_. Like Ruby, JavaScript also allows use of ``return``/``break``/``continue`` within a ``finally`` but it is seen as unsafe and it is handled by eslint [7]_. C# forbids the use of ending statements like ``return``/``goto``/``break`` within a ``finally`` [8]_, [9]_. Rationale ========= Since the behaviour of ``return``/``break``/``continue`` within a ``finally`` is unclear, the pattern is rarely used, and there is a simple alternative to writing equivalent code (which is more explicit), forbidding the syntax is the most straightforward approach. Specification ============= This is a change to the compiler, not the grammar. The compiler should check for the following in a ``finally`` suite: * A ``return`` in any statement, at any level of nesting. * A ``break``/``continue`` in any statement, at any level of nesting, that would transfer control flow outside the ``finally`` suite. Upon finding such a case it should emit the appropriate exception: * For ``continue``, a ``SyntaxError`` (this is the current behaviour of 3.7). * For ``return``/``break``, a ``SyntaxWarning`` in 3.10, and a ``SyntaxError`` after that. For example, the following are all forbidden by this proposal:: def f(): try: pass finally: return def g(): try: pass finally: try: return finally: pass def h(): try: pass finally: try: pass finally: for x in range(10): return The following is still allowed because the ``continue`` doesn't escape the ``finally``:: try: pass finally: for x in range(10): continue Note that yielding from within a ``finally`` remains acceptable by this PEP because resuming the generator will resume the ``finally`` and eventually raise any active exceptions (so they are never silenced by yielding). Backwards Compatibility ======================= This is a backwards incompatible change, for ``return`` and ``break``. The following locations in the CPython standard library (at v3.8.0b1-651-g7fcc2088a5) use ``return`` within ``finally``: * Lib/subprocess.py:921 - the use here looks like a bug * Lib/multiprocessing/connection.py:316 - the use here looks legitimate but the intention is not clear * Lib/multiprocessing/connection.py:318 - the use here looks legitimate but the intention is not clear * Lib/test/test_sys_settrace.py:837 - a test for ``return`` within ``finally`` * Lib/test/test_sys_settrace.py:1346 - a test for ``return`` within ``finally`` There are no uses of ``break`` within a ``finally`` (that break out of the ``finally``) in the standard library. Security Implications ===================== This is a simplification of the language, and removal of associated code, so should not introduce any new paths for a security exploit. How to Teach This ================= This feature is very rarely used so forbidding it will likely only impact advanced users, not beginners and probably not any existing teaching material. Since this is the removal of a feature teaching users will be one by the raising of a ``SyntaxError`` if/when the forbidden feature is used. Reference Implementation ======================== There is currently no reference implementation, although the way continue is currently handled in a ``finally`` (raising a ``SyntaxError``) can be extended to ``return`` and ``break``. References ========== .. [1] https://github.com/python/cpython/issues/82011 .. [2] https://stackoverflow.com/questions/48088/returning-from-a-finally-block-in-java .. [3] https://web.archive.org/web/20070922061412/http://weblogs.java.net/blog/staufferjames/archive/2007/06/_dont_return_in.html .. [4] https://wiki.sei.cmu.edu/confluence/display/java/ERR04-J.+Do+not+complete+abruptly+from+a+finally+block .. [5] https://github.com/rubocop/rubocop/issues/5949 .. [6] https://www.rubydoc.info/gems/rubocop/0.74.0/RuboCop/Cop/Lint/EnsureReturn .. [7] https://eslint.org/docs/rules/no-unsafe-finally .. [8] https://social.msdn.microsoft.com/Forums/vstudio/en-US/87faf259-3c54-4f3a-8d2b-ff82de44992f/return-statement-in-finally-block?forum=netfxbcl .. [9] https://stackoverflow.com/a/5788268 Copyright ========= This document is placed in the public domain or under the CC0-1.0-Universal license, whichever is more permissive.