fix: error when actor panics directly

[alanshaw]

Attempting to resolve filecoin-project/test-vectors#87, quoting @anorth:

If an actor implementation panics directly (rather than calling Abortf) then the evaluation is undefined. There is no exit code corresponding to this. The result should not go on chain. A panic (which could also come from some actor dependency) may indicate a transient state or error that cannot be replicated by other nodes and thus cannot form part of consensus. E.g. an out-of-memory.

I believe that returning a "fatal" ActorError instead of SysErrSenderInvalid(1) prevents the message from being recorded on chain since it's caught in ApplyMessage here.

[whyrusleeping]

@alanshaw @anorth we explicitly are treating nothing as a fatal error (as far as I know). I'd rather have a miner create an invalid block than have the chain halt because everyone set block X as their head and evaluating it causes a fault.

[Kubuxu]

Yeah, this should not be a fatal error but one of the Sys* errors that signifies actors doing something really bad.

[alanshaw]

Okay, well, just so you know, there are a bunch of places in the runtime where Fatalf is being used (18 in total) which we might want to check up on 😅:

Just to reiterate, the case where this kind of error happens should be extremely rare and this change would cause the message to not make it into a block in the first place. If I understand correctly and we allow this kind of message into a block, then another node applying this message is likely to not reach the same state conclusion anyway.

I'm super new to the code base so I'm happy to take your advice on this. If you're still set on returning a Sys* code then we could use 4 - its unused, and we could call it...SysErrActorMalfunction?

[anorth]

I'd rather have a miner create an invalid block than have the chain halt because everyone set block X as their head and evaluating it causes a fault.

Ok, can we not use SysErrInvalidSender at least? Use one of the reserved exit codes, and we can rename it later.