@@ -33,6 +33,7 @@ import Control.Lens
3333import Data.Atomics qualified as Atomic
3434import Data.Bits
3535import Data.Functor.Classes (Eq1 (.. ), Ord1 (.. ))
36+ import Data.List qualified as List
3637import Data.IORef (IORef )
3738import Data.IORef qualified as IORef
3839import Data.Map.Strict qualified as M
@@ -2361,13 +2362,32 @@ preEvalTopLevelConstants cacheableCombs newCombs cc = do
23612362 atomically $ do
23622363 modifyTVar evaluatedCacheableCombsVar $ EC. mapInsert w (EC. mapSingleton 0 $ CachedVal w val)
23632364 apply0 (Just hook) cc activeThreads w
2365+ `catch` \ e ->
2366+ -- ignore sandboxing exceptions during pre-eval, in case they
2367+ -- don't matter for the final result.
2368+ if isSandboxingException e
2369+ then pure ()
2370+ else throwIO e
23642371
23652372 evaluatedCacheableCombs <- readTVarIO evaluatedCacheableCombsVar
23662373 let allNew = evaluatedCacheableCombs <> newCombs
23672374 -- Rewrite all the inlined combinator references to point to the
23682375 -- new cached versions.
23692376 atomically $ modifyTVar (combs cc) (\ existingCombs -> (resolveCombs (Just $ EC. mapDifference existingCombs allNew) allNew) <> existingCombs)
23702377
2378+ -- Checks if a runtime exception is due to sandboxing.
2379+ --
2380+ -- This is used above during pre-evaluation, to ignore sandboxing
2381+ -- exceptions for top-level constant dependencies of docs and such, in
2382+ -- case the docs don't actually evaluate them.
2383+ isSandboxingException :: RuntimeExn -> Bool
2384+ isSandboxingException (PE _ (P. toPlainUnbroken -> msg)) =
2385+ List. isPrefixOf sdbx1 msg || List. isPrefixOf sdbx2 msg
2386+ where
2387+ sdbx1 = " attempted to use sandboxed operation"
2388+ sdbx2 = " Attempted to use disallowed builtin in sandboxed"
2389+ isSandboxingException _ = False
2390+
23712391expandSandbox ::
23722392 Map Reference (Set Reference ) ->
23732393 [(Reference , SuperGroup Symbol )] ->
0 commit comments