Spurious behavior of Display::fmt errors

[Xion]

I've encountered a surprising and undocumented behavior of Display::fmt, which I was advised on #rust to file an issue about.

Given the code (http://is.gd/iRjVCG):

use std::fmt;
use std::io::{self, Write};


struct Foo;

impl fmt::Display for Foo {
    fn fmt(&self, _: &mut fmt::Formatter) -> fmt::Result {
        Err(fmt::Error)
    }
}


fn main() {
    write!(io::stdout(), "{} {} {}", 1, Foo, "bar").unwrap();
}

the expected result, as far as I can tell, is a panic. Instead it just prints 1, apparently terminating at the formatting error of Foo but otherwise suppressing the error and returning Ok from write!.

(I encountered this behavior in the wild on current 1.6 stable. The above is a minimal example that reproduces it).

If this is intended, I find it extremely surprising. For one, this would mean there is no reliable way to distinguish formatting errors (Err returned from Display::fmt) from Display implementations that simply return an empty string in the simple format!("{}", ...) cases.

But if that's the intended behavior, then this probably qualifies as a documentation bug or omission, because there is no explanation what is the effect of returning Err from Display:::fmt.

[alexcrichton]

Hm I thought we already had an issue for this, but I can't seem to find it now. The problem here is that we assume that fmt::Error is never "just generated", but rather it always originates from the underlying writer returning an error. This is probably a relatively easy fix in the code.