属性宏，要求编译器证明某个函数不会引发恐慌情况
Attribute macro to require that the compiler prove a function can't ever panic
