I very much agree that Rust programs need to be able to recover from OOM. Returning Result from any function that may allocate would both have terrible ergonomics and massively break backwards compatibility, so the only reasonable thing to do in such circumstances is to panic. That, in turn, means that unwinding must never itself allocate.
It is expected that these panics, like any other, would be caught at rather high levels in the program, and handled generically, like any other unexpected error.
- return an error code
- 500 Internal Server Error
- DB transaction rollback
- save state to disc, then shutdown or restart
- unload the image file
- drop an RPC connection
- kill the browser tab
- etc