code: public static H2OFailException fail(String msg, Throwable cause) {
      Log.fatal(msg);
      if (null != cause) Log.fatal(cause);
      Log.fatal("Stacktrace: ");
      Log.fatal(Arrays.toString(Thread.currentThread().getStackTrace()));
  
      // H2O fail() exists because of coding errors - but what if usage of fail() was itself a coding error?
      // Property "suppress.shutdown.on.failure" can be used in the case when someone is seeing shutdowns on production
      // because a developer incorrectly used fail() instead of just throwing a (recoverable) exception
      boolean suppressShutdown = getSysBoolProperty("suppress.shutdown.on.failure", false);
      if (! suppressShutdown) {
        H2O.shutdown(-1);
      } else {
        throw new IllegalStateException("Suppressed shutdown for failure: " + msg, cause);
      }
  
      // unreachable
      return new H2OFailException(msg);
    }
docs: H2O.fail is intended to be used in code where something should never happen, and if
  it does it's a coding error that needs to be addressed immediately.  Examples are:
  AutoBuffer serialization for an object you're trying to serialize isn't available;
  there's a typing error on your schema; your switch statement didn't cover all the AstRoot
  subclasses available in Rapids.
  <p>
  It should *not* be used when only the single request should fail, it should *only* be
  used if the error means that someone needs to go add some code right away.
  
  @param msg Message to Log.fatal()
  @param cause Optional cause exception to Log.fatal()
  @return never returns; calls System.exit(-1)