grpc 1.81.1 → 1.82.0.pre2

data/src/ruby/lib/grpc/generic/client_stub.rb

@@ -79,10 +79,9 @@ module GRPC
     # when present, this is the default timeout used for calls
     #
     # @param host [String] the host the stub connects to
-    # @param creds [Core::ChannelCredentials|Symbol] the channel credentials, or
-    #     :this_channel_is_insecure, which explicitly indicates that the client
-    #     should be created with an insecure connection. Note: this argument is
-    #     ignored if the channel_override argument is provided.
+    # @param creds [Core::ChannelCredentials|Core::CallCredentials|Symbol]
+    #     ChannelCredentials, CallCredentials (creates default SSL channel), or
+    #     :this_channel_is_insecure. Ignored if channel_override is provided.
     # @param channel_override [Core::Channel] a pre-created channel
     # @param timeout [Number] the default timeout to use in requests
     # @param propagate_mask [Number] A bitwise combination of flags in
@@ -101,7 +100,18 @@ module GRPC
                    propagate_mask: nil,
                    channel_args: {},
                    interceptors: [])
-      @ch = ClientStub.setup_channel(channel_override, host, creds,
+      # Split credentials: CallCredentials alone create a default secure channel.
+      # CompositeChannelCredentials splitting is handled by Core::CompositeCredentialsHandler
+      # module when the pure Ruby toggle is enabled.
+      if creds.is_a?(Core::CallCredentials)
+        @call_creds    = creds
+        @channel_creds = Core::ChannelCredentials.new
+      else
+        @call_creds    = nil
+        @channel_creds = creds
+      end
+
+      @ch = ClientStub.setup_channel(channel_override, host, @channel_creds,
                                      channel_args.dup)
       alt_host = channel_args[Core::Channel::SSL_TARGET]
       @host = alt_host.nil? ? host : alt_host
@@ -154,30 +164,19 @@ module GRPC
                          credentials: nil,
                          metadata: {})
       c = new_active_call(method, marshal, unmarshal,
-                          deadline: deadline,
-                          parent: parent,
+                          deadline: deadline, parent: parent,
                           credentials: credentials)
-      interception_context = @interceptors.build_context
+
       intercept_args = {
         method: method,
         request: req,
         call: c.interceptable,
         metadata: metadata
       }
-      if return_op
-        # return the operation view of the active_call; define #execute as a
-        # new method for this instance that invokes #request_response.
-        c.merge_metadata_to_send(metadata)
-        op = c.operation
-        op.define_singleton_method(:execute) do
-          interception_context.intercept!(:request_response, intercept_args) do
-            c.request_response(req, metadata: metadata)
-          end
-        end
-        op
-      else
-        interception_context.intercept!(:request_response, intercept_args) do
-          c.request_response(req, metadata: metadata)
+
+      handle_return_op(c, return_op, metadata, credentials, method) do
+        execute_with_interceptors(:request_response, intercept_args, credentials, method, c) do |resolved_md|
+          c.request_response(req, metadata: resolved_md)
         end
       end
     end
@@ -231,30 +230,19 @@ module GRPC
                         credentials: nil,
                         metadata: {})
       c = new_active_call(method, marshal, unmarshal,
-                          deadline: deadline,
-                          parent: parent,
+                          deadline: deadline, parent: parent,
                           credentials: credentials)
-      interception_context = @interceptors.build_context
+
       intercept_args = {
         method: method,
         requests: requests,
         call: c.interceptable,
         metadata: metadata
       }
-      if return_op
-        # return the operation view of the active_call; define #execute as a
-        # new method for this instance that invokes #client_streamer.
-        c.merge_metadata_to_send(metadata)
-        op = c.operation
-        op.define_singleton_method(:execute) do
-          interception_context.intercept!(:client_streamer, intercept_args) do
-            c.client_streamer(requests)
-          end
-        end
-        op
-      else
-        interception_context.intercept!(:client_streamer, intercept_args) do
-          c.client_streamer(requests, metadata: metadata)
+
+      handle_return_op(c, return_op, metadata, credentials, method) do
+        execute_with_interceptors(:client_streamer, intercept_args, credentials, method, c) do |resolved_md|
+          c.client_streamer(requests, metadata: resolved_md)
         end
       end
     end
@@ -323,30 +311,19 @@ module GRPC
                         metadata: {},
                         &blk)
       c = new_active_call(method, marshal, unmarshal,
-                          deadline: deadline,
-                          parent: parent,
+                          deadline: deadline, parent: parent,
                           credentials: credentials)
-      interception_context = @interceptors.build_context
+
       intercept_args = {
         method: method,
         request: req,
         call: c.interceptable,
         metadata: metadata
       }
-      if return_op
-        # return the operation view of the active_call; define #execute
-        # as a new method for this instance that invokes #server_streamer
-        c.merge_metadata_to_send(metadata)
-        op = c.operation
-        op.define_singleton_method(:execute) do
-          interception_context.intercept!(:server_streamer, intercept_args) do
-            c.server_streamer(req, &blk)
-          end
-        end
-        op
-      else
-        interception_context.intercept!(:server_streamer, intercept_args) do
-          c.server_streamer(req, metadata: metadata, &blk)
+
+      handle_return_op(c, return_op, metadata, credentials, method) do
+        execute_with_interceptors(:server_streamer, intercept_args, credentials, method, c) do |resolved_md|
+          c.server_streamer(req, metadata: resolved_md, &blk)
         end
       end
     end
@@ -445,30 +422,19 @@ module GRPC
                       metadata: {},
                       &blk)
       c = new_active_call(method, marshal, unmarshal,
-                          deadline: deadline,
-                          parent: parent,
+                          deadline: deadline, parent: parent,
                           credentials: credentials)
-      interception_context = @interceptors.build_context
+
       intercept_args = {
         method: method,
         requests: requests,
         call: c.interceptable,
         metadata: metadata
       }
-      if return_op
-        # return the operation view of the active_call; define #execute
-        # as a new method for this instance that invokes #bidi_streamer
-        c.merge_metadata_to_send(metadata)
-        op = c.operation
-        op.define_singleton_method(:execute) do
-          interception_context.intercept!(:bidi_streamer, intercept_args) do
-            c.bidi_streamer(requests, &blk)
-          end
-        end
-        op
-      else
-        interception_context.intercept!(:bidi_streamer, intercept_args) do
-          c.bidi_streamer(requests, metadata: metadata, &blk)
+
+      handle_return_op(c, return_op, metadata, credentials, method) do
+        execute_with_interceptors(:bidi_streamer, intercept_args, credentials, method, c) do |resolved_md|
+          c.bidi_streamer(requests, metadata: resolved_md, &blk)
         end
       end
     end
@@ -480,6 +446,7 @@ module GRPC
     # @param method [string] the method being called.
     # @param marshal [Function] f(obj)->string that marshals requests
     # @param unmarshal [Function] f(string)->obj that unmarshals responses
+    # @param deadline [Time] (optional) the time the request should complete
     # @param parent [Grpc::Call] a parent call, available when calls are
     #   made from server
     # @param credentials [Core::CallCredentials] credentials to use when making
@@ -499,5 +466,51 @@ module GRPC
       ActiveCall.new(call, marshal, unmarshal, deadline,
                      started: false)
     end
+
+    # Runs the interceptor chain and resolves metadata/credentials exactly once
+    # at the end of the chain.
+    def execute_with_interceptors(rpc_type, intercept_args, credentials, method, call)
+      interception_context = @interceptors.build_context
+      call_started = false
+      already_finished = !call.status.nil?
+      begin
+        interception_context.intercept!(rpc_type, intercept_args) do
+          resolved_md = resolve_call_metadata(intercept_args[:metadata], credentials, method)
+          call_started = true
+          yield(resolved_md)
+        end
+      rescue StandardError => e
+        call.op_is_done unless call_started || already_finished
+        raise e
+      end
+    end
+
+    # Handles return_op lifecycle branching
+    def handle_return_op(call, return_op, metadata, credentials, method, &block)
+      if return_op
+        stub = self
+        op = call.operation
+        op.define_singleton_method(:execute) do
+          block.call
+        end
+        op.define_singleton_method(:start_call) do |op_metadata = {}|
+          resolved_md = stub.send(:resolve_call_metadata, metadata, credentials, method)
+          call.merge_metadata_to_send(resolved_md.merge(op_metadata))
+          call.send_initial_metadata
+        rescue StandardError => e
+          call.op_is_done unless call.metadata_sent
+          raise e
+        end
+        op
+      else
+        yield
+      end
+    end
+
+    def resolve_call_metadata(metadata, _credentials, _method)
+      metadata
+    end
+
+    private :resolve_call_metadata, :execute_with_interceptors, :handle_return_op
   end
 end

data/src/ruby/lib/grpc/generic/interceptors.rb

@@ -169,7 +169,7 @@ module GRPC
     def intercept!(type, args = {})
       return yield if @interceptors.none?
 
-      i = @interceptors.pop
+      i = @interceptors.shift
       return yield unless i
 
       i.send(type, **args) do

data/src/ruby/lib/grpc/version.rb

@@ -14,5 +14,5 @@
 
 # GRPC contains the General RPC module.
 module GRPC
-  VERSION = '1.81.1'
+  VERSION = '1.82.0.pre2'
 end

data/src/ruby/lib/grpc.rb

@@ -22,6 +22,25 @@ require_relative 'grpc/notifier'
 require_relative 'grpc/version'
 require_relative 'grpc/core/status_codes'
 require_relative 'grpc/core/time_consts'
+
+# Feature toggle: set GRPC_EXPERIMENTS=pure_ruby_call_credentials to enable.
+# Default (false): uses C extension path for backward compatibility.
+# NOTE: must be set before `require 'grpc'` — evaluated once at load time.
+module GRPC
+  PURE_RUBY_CALL_CREDENTIALS_ENABLED =
+    ENV.fetch('GRPC_EXPERIMENTS', '')
+       .split(',')
+       .map(&:strip)
+       .include?('pure_ruby_call_credentials')
+       .freeze
+end
+
+if GRPC::PURE_RUBY_CALL_CREDENTIALS_ENABLED
+  require_relative 'grpc/core/call_credentials'
+  require_relative 'grpc/core/channel_credentials'
+  require_relative 'grpc/core/credentials_helper'
+end
+
 require_relative 'grpc/generic/active_call'
 require_relative 'grpc/generic/client_stub'
 require_relative 'grpc/generic/service'
@@ -35,3 +54,9 @@ begin
 ensure
   file.close
 end
+
+# Prepend CompositeCredentialsHandler if pure Ruby credentials are enabled.
+# This must happen after all credential classes are loaded.
+if GRPC::PURE_RUBY_CALL_CREDENTIALS_ENABLED
+  GRPC::ClientStub.class_eval { prepend GRPC::Core::CompositeCredentialsHandler }
+end

data/src/ruby/spec/call_credentials_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # Copyright 2015 gRPC authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -16,20 +18,35 @@ require 'spec_helper'
 
 describe GRPC::Core::CallCredentials do
   CallCredentials = GRPC::Core::CallCredentials
-
   let(:auth_proc) { proc { { 'plugin_key' => 'plugin_value' } } }
+  let(:auth_proc2) { proc { { 'plugin_key2' => 'plugin_value2' } } }
 
   describe '#new' do
     it 'can successfully create a CallCredentials from a proc' do
       expect { CallCredentials.new(auth_proc) }.not_to raise_error
     end
+
+    context 'pure Ruby path only' do
+      before do
+        skip 'pure Ruby path only: set GRPC_EXPERIMENTS=pure_ruby_call_credentials' \
+          unless GRPC::PURE_RUBY_CALL_CREDENTIALS_ENABLED
+      end
+
+      it 'can successfully create a CallCredentials from a block' do
+        expect { CallCredentials.new { { 'foo' => 'bar' } } }.not_to raise_error
+      end
+    end
+
+    it 'fails if initialized without a proc or block' do
+      expect { CallCredentials.new('not a proc') }.to raise_error(TypeError)
+    end
   end
 
   describe '#compose' do
     it 'can compose with another CallCredentials' do
       creds1 = CallCredentials.new(auth_proc)
       creds2 = CallCredentials.new(auth_proc)
-      expect { creds1.compose creds2 }.not_to raise_error
+      expect { creds1.compose(creds2) }.not_to raise_error
     end
 
     it 'can compose with multiple CallCredentials' do
@@ -38,5 +55,38 @@ describe GRPC::Core::CallCredentials do
       creds3 = CallCredentials.new(auth_proc)
       expect { creds1.compose(creds2, creds3) }.not_to raise_error
     end
+
+    context 'pure Ruby path only' do
+      before do
+        skip 'pure Ruby path only: set GRPC_EXPERIMENTS=pure_ruby_call_credentials' \
+          unless GRPC::PURE_RUBY_CALL_CREDENTIALS_ENABLED
+      end
+
+      it 'returns a CompositeCallCredentials with merged metadata' do
+        creds1 = CallCredentials.new(auth_proc)
+        creds2 = CallCredentials.new(auth_proc2)
+        composite = creds1.compose(creds2)
+        expect(composite).to be_a(GRPC::Core::CompositeCallCredentials)
+        expect(composite.get_metadata(nil))
+          .to eq({ 'plugin_key' => 'plugin_value', 'plugin_key2' => 'plugin_value2' })
+      end
+
+      it 'returns a CompositeCallCredentials when composing multiple' do
+        creds1 = CallCredentials.new(auth_proc)
+        creds2 = CallCredentials.new(auth_proc2)
+        creds3 = CallCredentials.new(proc { { 'plugin_key3' => 'plugin_value3' } })
+        composite = creds1.compose(creds2, creds3)
+        expect(composite).to be_a(GRPC::Core::CompositeCallCredentials)
+        expect(composite.get_metadata(nil))
+          .to eq({ 'plugin_key' => 'plugin_value',
+                   'plugin_key2' => 'plugin_value2',
+                   'plugin_key3' => 'plugin_value3' })
+      end
+
+      it 'fails if composed with non-CallCredentials' do
+        creds1 = CallCredentials.new(auth_proc)
+        expect { creds1.compose('not a cred') }.to raise_error(TypeError)
+      end
+    end
   end
 end

data/src/ruby/spec/credentials_helper_spec.rb

@@ -0,0 +1,80 @@
+# Copyright 2015 gRPC authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'spec_helper'
+require 'grpc/core/credentials_helper'
+
+describe GRPC::Core::CallCredentialsHelper do
+  before(:each) do
+    skip 'pure Ruby path only: set GRPC_EXPERIMENTS=pure_ruby_call_credentials' \
+      unless GRPC::PURE_RUBY_CALL_CREDENTIALS_ENABLED
+  end
+
+  describe '.resolve' do
+    it 'returns nil if both are nil' do
+      expect(GRPC::Core::CallCredentialsHelper.resolve(nil, nil)).to eq(nil)
+    end
+
+    it 'returns channel creds if call creds are nil' do
+      creds = double('creds')
+      expect(GRPC::Core::CallCredentialsHelper.resolve(creds, nil)).to eq(creds)
+    end
+
+    it 'returns call creds if channel creds are nil' do
+      creds = double('creds')
+      expect(GRPC::Core::CallCredentialsHelper.resolve(nil, creds)).to eq(creds)
+    end
+
+    it 'composes if both are present' do
+      creds1 = double('creds1')
+      creds2 = double('creds2')
+      expect(creds1).to receive(:compose).with(creds2).and_return('composite')
+      expect(GRPC::Core::CallCredentialsHelper.resolve(creds1, creds2)).to eq('composite')
+    end
+  end
+
+  describe '.apply' do
+    let(:metadata) { {} }
+    let(:creds) { double('creds') }
+
+    it 'does nothing if creds are nil' do
+      GRPC::Core::CallCredentialsHelper.apply(nil, metadata, 'host', 'channel_creds')
+      expect(metadata).to eq({})
+    end
+
+    it 'does nothing if channel is insecure' do
+      GRPC::Core::CallCredentialsHelper.apply(creds, metadata, 'host', :this_channel_is_insecure)
+      expect(metadata).to eq({})
+    end
+
+    it 'applies metadata if valid' do
+      expect(creds).to receive(:get_metadata).and_return({ 'foo' => 'bar' })
+      GRPC::Core::CallCredentialsHelper.apply(creds, metadata, 'host', 'secure_channel_creds')
+      expect(metadata).to eq({ 'foo' => 'bar' })
+    end
+
+    it 'handles exceptions' do
+      expect(creds).to receive(:get_metadata).and_raise('error')
+      expect do
+        GRPC::Core::CallCredentialsHelper.apply(creds, metadata, 'host', 'secure_channel_creds')
+      end.to raise_error(GRPC::BadStatus)
+    end
+
+    it 'converts keys and values to strings' do
+      expect(creds).to receive(:get_metadata).and_return({ foo: :bar })
+      GRPC::Core::CallCredentialsHelper.apply(creds, metadata, 'host', 'secure_channel_creds')
+      expect(metadata).to eq({ 'foo' => 'bar' })
+    end
+  end
+end

data/src/ruby/spec/generic/client_stub_spec.rb

@@ -157,6 +157,29 @@ describe 'ClientStub' do  # rubocop:disable Metrics/BlockLength
       end
       expect(&blk).to_not raise_error
     end
+
+    it 'creates secure channel when only CallCredentials provided' do
+      call_creds = GRPC::Core::CallCredentials.new(proc { {} })
+      stub = GRPC::ClientStub.new(fake_host, call_creds)
+      # Verify the internal channel credentials are SSL (not insecure)
+      expect(stub.instance_variable_get(:@channel_creds)).to be_a(GRPC::Core::ChannelCredentials)
+      expect(stub.instance_variable_get(:@call_creds)).to eq(call_creds)
+    end
+
+    context 'with CompositeChannelCredentials (pure Ruby path)' do
+      it 'splits CompositeChannelCredentials into channel + call creds' do
+        skip 'CompositeChannelCredentials requires pure Ruby toggle ON' \
+          unless GRPC::PURE_RUBY_CALL_CREDENTIALS_ENABLED
+        require 'grpc/core/call_credentials'
+        require 'grpc/core/channel_credentials'
+        chan_creds = GRPC::Core::ChannelCredentials.new
+        call_creds = GRPC::Core::CallCredentials.new(proc { {} })
+        composite = chan_creds.compose(call_creds)
+        stub = GRPC::ClientStub.new(fake_host, composite)
+        expect(stub.instance_variable_get(:@channel_creds)).to eq(chan_creds)
+        expect(stub.instance_variable_get(:@call_creds)).to eq(call_creds)
+      end
+    end
   end
 
   describe '#request_response', request_response: true do
@@ -301,7 +324,7 @@ describe 'ClientStub' do  # rubocop:disable Metrics/BlockLength
     describe 'via a call operation' do
       after(:each) do
         # make sure op.wait doesn't freeze, even if there's a bad status
-        @op.wait
+        @op&.wait
       end
       def get_response(stub, run_start_call_first: false, credentials: nil)
         @op = stub.request_response(@method, @sent_msg, noop, noop,
@@ -403,7 +426,7 @@ describe 'ClientStub' do  # rubocop:disable Metrics/BlockLength
     describe 'via a call operation' do
       after(:each) do
         # make sure op.wait doesn't freeze, even if there's a bad status
-        @op.wait
+        @op&.wait
       end
       def get_response(stub, run_start_call_first: false)
         @op = stub.client_streamer(@method, @sent_msgs, noop, noop,
@@ -522,7 +545,7 @@ describe 'ClientStub' do  # rubocop:disable Metrics/BlockLength
 
     describe 'via a call operation' do
       after(:each) do
-        @op.wait # make sure wait doesn't freeze
+        @op&.wait
       end
       def get_responses(stub, run_start_call_first: false, unmarshal: noop)
         @op = stub.server_streamer(@method, @sent_msg, noop, unmarshal,
@@ -841,7 +864,7 @@ describe 'ClientStub' do  # rubocop:disable Metrics/BlockLength
 
     describe 'via a call operation' do
       after(:each) do
-        @op.wait # make sure wait doesn't freeze
+        @op&.wait
       end
       def get_responses(stub, run_start_call_first: false, deadline: nil,
                         marshal_proc: noop)

data/src/ruby/spec/generic/server_interceptors_spec.rb

@@ -84,7 +84,7 @@ describe 'Server Interceptors' do
         run_services_on_server(@server, services: [service]) do
           stub = build_insecure_stub(EchoStub)
           expect_any_instance_of(GRPC::ActiveCall).to(
-            receive(:client_streamer).with(requests)
+            receive(:client_streamer).with(requests, metadata: client_metadata)
               .once.and_call_original
           )
           op = stub.a_client_streaming_rpc(requests, client_call_opts)
@@ -122,7 +122,7 @@ describe 'Server Interceptors' do
         run_services_on_server(@server, services: [service]) do
           stub = build_insecure_stub(EchoStub)
           expect_any_instance_of(GRPC::ActiveCall).to(
-            receive(:server_streamer).with(request)
+            receive(:server_streamer).with(request, metadata: client_metadata)
               .once.and_call_original
           )
           op = stub.a_server_streaming_rpc(request, client_call_opts)
@@ -162,7 +162,7 @@ describe 'Server Interceptors' do
         run_services_on_server(@server, services: [service]) do
           stub = build_insecure_stub(EchoStub)
           expect_any_instance_of(GRPC::ActiveCall).to(
-            receive(:bidi_streamer).with(requests)
+            receive(:bidi_streamer).with(requests, metadata: client_metadata)
               .once.and_call_original
           )
           op = stub.a_bidi_rpc(requests, client_call_opts)
@@ -203,6 +203,20 @@ describe 'Server Interceptors' do
         expect(stub.an_rpc(request)).to be_a(EchoMsg)
       end
     end
+
+    it 'should be invoked in FIFO order', server: true do
+      expect(interceptor).to receive(:request_response).ordered
+        .once.and_call_original
+      expect(interceptor2).to receive(:request_response).ordered
+        .once.and_call_original
+      expect(interceptor3).to receive(:request_response).ordered
+        .once.and_call_original
+
+      run_services_on_server(@server, services: [service]) do
+        stub = build_insecure_stub(EchoStub)
+        expect(stub.an_rpc(request)).to be_a(EchoMsg)
+      end
+    end
   end
 
   context 'when an interceptor is not added' do

data/third_party/upb/upb/base/error_handler.h

@@ -0,0 +1,79 @@
+// Protocol Buffers - Google's data interchange format
+// Copyright 2025 Google LLC.  All rights reserved.
+//
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file or at
+// https://developers.google.com/open-source/licenses/bsd
+
+#ifndef GOOGLE_UPB_UPB_BASE_ERROR_HANDLER_H__
+#define GOOGLE_UPB_UPB_BASE_ERROR_HANDLER_H__
+
+#include <setjmp.h>
+
+// Must be last.
+#include "upb/port/def.inc"
+
+// upb_ErrorHandler is a standard longjmp()-based exception handler for UPB.
+// It is used for efficient error handling in cases where longjmp() is safe to
+// use, such as in highly performance-sensitive C parsing code.
+//
+// This structure contains both a jmp_buf and an error code; the error code is
+// stored in the structure prior to calling longjmp(). This is necessary because
+// per the C standard, it is not possible to store the result of setjmp(), so
+// the error code must be passed out-of-band.
+//
+// upb_ErrorHandler is generally not C++-compatible, because longjmp() does not
+// run C++ destructors.  So any library that supports upb_ErrorHandler should
+// also support a regular return-based error handling mechanism. (Note: we
+// could conceivably extend this to take a callback, which could either call
+// longjmp() or throw a C++ exception. But since C++ exceptions are forbidden
+// by the C++ style guide, there's not likely to be a demand for this.)
+//
+// To support both cases (longjmp() or return-based status) efficiently, code
+// can be written like this:
+//
+//   UPB_ATTR_CONST bool upb_Arena_HasErrHandler(const upb_Arena* a);
+//
+//   INLINE void* upb_Arena_Malloc(upb_Arena* a, size_t size) {
+//     if (UPB_UNLIKELY(a->end - a->ptr < size)) {
+//         void* ret = upb_Arena_MallocFallback(a, size);
+//         UPB_MAYBE_ASSUME(upb_Arena_HasErrHandler(a), ret != NULL);
+//         return ret;
+//     }
+//     void* ret = a->ptr;
+//     a->ptr += size;
+//     UPB_ASSUME(ret != NULL);
+//     return ret;
+//   }
+//
+// If the optimizer can prove that an error handler is present, it can assume
+// that upb_Arena_Malloc() will not return NULL.
+
+// We need to standardize on any error code that might be thrown by an error
+// handler.
+
+typedef enum {
+  kUpb_ErrorCode_Ok = 0,
+  kUpb_ErrorCode_OutOfMemory = 1,
+  kUpb_ErrorCode_Malformed = 2,
+} upb_ErrorCode;
+
+typedef struct {
+  int code;
+  jmp_buf buf;
+} upb_ErrorHandler;
+
+UPB_INLINE void upb_ErrorHandler_Init(upb_ErrorHandler* e) {
+  e->code = kUpb_ErrorCode_Ok;
+}
+
+UPB_INLINE UPB_NORETURN void upb_ErrorHandler_ThrowError(upb_ErrorHandler* e,
+                                                         int code) {
+  UPB_ASSERT(code != kUpb_ErrorCode_Ok);
+  e->code = code;
+  UPB_LONGJMP(e->buf, 1);
+}
+
+#include "upb/port/undef.inc"
+
+#endif  // GOOGLE_UPB_UPB_BASE_ERROR_HANDLER_H__