Fix double read/writes on stream/future handles (#12873)

* Fix double read/writes on stream/future handles

This should result in a first-class trap, not a bug.

* Fix CI

Relax panics in async/futures to traps/errors (#12688)

* Relax panics in async/futures to traps/errors

This commit is an admittance that I don't believe we're going to get
to a point where we are c

Relax panics in async/futures to traps/errors (#12688)

* Relax panics in async/futures to traps/errors

This commit is an admittance that I don't believe we're going to get
to a point where we are confident enough in the fuzzing of
component-model-async such that we could confidently say we're
exercising the vast majority of possible panics. Development of
component-model-async has shown a steady trickle of panics over the
course of the development of the feature, and this trend has been
persistent over time as well.

An attempt was made in #12119 to add a fuzzer dedicated to async events
but that didn't actually find anything in development and it has missed
a number of panics present before and discovered after its introduction.
Overall I do not know how to improve the fuzzer to the point that it
would find pretty much all of the existing async-related panics over
time.

To help address this concern of the `concurrent.rs` implementation this
commit goes through and replaces things like `unwrap()`, `assert!`,
`panic!`, and `unreachable!` with an error-producing form. The benefit
of this is that a bug in the implementation is less likely to result in
a panic and instead just results in a non-spec-compliant trap. The
downside of doing this though is that it can become unclear what errors
are "first class traps", or expected to be guest reachable, and which
are expected to be bugs in Wasmtime. To help address this I've performed
a few refactorings here as well.

* Some traps previously present as error strings are now promoted to
using `Trap::Foo` instead. This has some refactoring of the Rust/C
side as well to make it easier to define new variants. Tests were
additionally added for any trap messages that weren't previously
tested as being reachable.

* A new `bail_bug!` macro was added (internally) for Wasmtime. This is
coupled with a concrete `WasmtimeBug` error type (exported as
`wasmtime::WasmtimeBug`). The intention is that `bail!` continues to
be "here's a string and I'm a bit too lazy to make a concrete error"
while `bail_bug!` indicates "this is a bug in wasmtime please report
this if you see it".

The rough vision is that if an error condition is reached, and the system
is not broken in such a way that panicking is required, then `bail_bug!`
can be used to indicate a bug in Wasmtime as opposed to panicking. This
reduces the real-world impact of hitting these scenarios by downgrading a
CVE-worthy `panic!` into a bug-worthy non-spec-compliant trap. Not all
panics are able to be transitioned to this as some are load bearing from
a safety perspective or similar (or indicate something equally broken),
but the vast majority of cases are suitable for "return a trap, lock
down the store, and let destructors take care of everything else".

This change additionally has resulted in API changes for `FutureReader`
and `StreamReader`. For example creation of these types now returns a
`Result` for when the `ResourceTable` is full, for example, instead of
panicking.

* Fix CI build

* Translate `WasmtimeBug` to panics in debug mode

* Review comments

* Refactor some stream methods for fewer panics

show more ...

refactor recursive reentrance checks (#12349)

* refactor recursive reentrance checks

This commit makes a few changes related to recursive reentrance checks, instance
poisoning, etc.:

- Implements

refactor recursive reentrance checks (#12349)

* refactor recursive reentrance checks

This commit makes a few changes related to recursive reentrance checks, instance
poisoning, etc.:

- Implements the more restrictive lift/lower rules described in https://github.com/WebAssembly/component-model/pull/589 such that a component instance may not lower a function lifted by one of its ancestors, nor vice-versa. Any such lower will result in a fused adapter which traps unconditionally, preventing guest-to-guest recursive reentrance without requiring data flow analysis.
- Note that this required updating several WAST tests which were violating the new rule, including some in the `tests/component-model` Git submodule, which I've updated.
- This is handled entirely in the `fact` module now; I've removed the `AlwaysTrap` case previously handled by `wasmtime-cranelift`.
- Removes `FLAG_MAY_ENTER` from `InstanceFlags`. It is no longer needed for guest-to-guest calls due to the above, and for guest-to-host-to-guest calls we can rely on either `FLAG_NEEDS_POST_RETURN` for sync-lifted functions or the `GuestTask` call stack for async-lifted functions.
- Adds a `StoreOpaque::trapped` field which is set when _any_ instance belonging to that store traps, at which point the entire store is considered poisoned, meaning no instance belonging to it may be entered. This prevents indeterminant concurrent task state left over from the trapping instance from leaking into other instances.

Note that this does _not_ include code to push and pop `GuestTask` instances for
guest-to-guest sync-to-sync calls, nor for host-to-guest calls using e.g. the
synchronous `Func::call` API, so certain intrinsics which expect a `GuestTask`
to be present such as `backpressure.inc` will still fail in such cases. I'll
address that in a later PR.

Also note that I made a small change to `wasmtime-wit-bindgen`, adding a `Send`
bound on the `T` type parameter for `store | async` functions. This allowed me
to recursively call `{Typed}Func::call_concurrent` from inside a host function,
and it doesn't have any downsides AFAICT.

Fixes #12128

* bless bindgen expansions

* bless disas tests

* address review feedback

* sync `trap.h` with `trap_encoding.rs`

...and add const assertions to `trap.rs` to help avoid future divergence.

show more ...

c-api: new wasmtime_trap_new_code function (#10765)

* c-api: new wasmtime_trap_new_code function

* review comments

* remove accidental include

add clang format (#7601)

* add clang-format

We chose WebKit style because out of all the builtin styles it seems the
closest to what already exists in wasmtime.

Signed-off-by: Tyler Rockwood <rock

add clang format (#7601)

* add clang-format

We chose WebKit style because out of all the builtin styles it seems the
closest to what already exists in wasmtime.

Signed-off-by: Tyler Rockwood <[email protected]>

* c-api: don't reorder headers

The order here matters

Signed-off-by: Tyler Rockwood <[email protected]>

* c-api: apply clang-format

Signed-off-by: Tyler Rockwood <[email protected]>

* fiber: apply clang-format

Signed-off-by: Tyler Rockwood <[email protected]>

* runtime: apply clang-format

Signed-off-by: Tyler Rockwood <[email protected]>

* examples: apply clang format

Signed-off-by: Tyler Rockwood <[email protected]>

* tests: apply clang-format

Signed-off-by: Tyler Rockwood <[email protected]>

* ci: add clang-format checks

Signed-off-by: Tyler Rockwood <[email protected]>

* clang-format: keep braces on the same line

This is more the existing style

Signed-off-by: Tyler Rockwood <[email protected]>

* remove clang-format

Just use the tool defaults (LLVM)

Signed-off-by: Tyler Rockwood <[email protected]>

* Fix ci name

Signed-off-by: Tyler Rockwood <[email protected]>

* manually reformat a couple of comments

prtest:full

Signed-off-by: Tyler Rockwood <[email protected]>

* disable formatting for doc-wasm.h

Signed-off-by: Tyler Rockwood <[email protected]>

* manually reformat wasmtime.h

Signed-off-by: Tyler Rockwood <[email protected]>

* disable formatting

To prevent a link from being broken

Signed-off-by: Tyler Rockwood <[email protected]>

* examples: fixing build commands

Signed-off-by: Tyler Rockwood <[email protected]>

* fix parameter comment

Signed-off-by: Tyler Rockwood <[email protected]>

---------

Signed-off-by: Tyler Rockwood <[email protected]>

show more ...

Fix `OutOfFuel` trap code not represented in the C API. (#5230)

This commit adds the missing "out of fuel" trap code to the C API.

Without this, calls to `wasmtime_trap_code` will trigger an unre

Fix `OutOfFuel` trap code not represented in the C API. (#5230)

This commit adds the missing "out of fuel" trap code to the C API.

Without this, calls to `wasmtime_trap_code` will trigger an unreachable panic
on traps from running out of fuel.

show more ...

Update how exits are modeled in the C API (#5215)

Previously extracting an exit code was only possibly on a `wasm_trap_t`
which will never successfully have an exit code on it, so the exit code
ex

Update how exits are modeled in the C API (#5215)

Previously extracting an exit code was only possibly on a `wasm_trap_t`
which will never successfully have an exit code on it, so the exit code
extractor is moved over to `wasmtime_error_t`. Additionally extracting a
wasm trace from a `wasmtime_error_t` is added since traces happen on
both traps and errors now.

show more ...

c-api: add wasmtime_trap_code (#3086)

Eventually this should be added to the wasmtime-go binding, addressing
https://github.com/bytecodealliance/wasmtime-go/issues/63.

Added a snippet to example

c-api: add wasmtime_trap_code (#3086)

Eventually this should be added to the wasmtime-go binding, addressing
https://github.com/bytecodealliance/wasmtime-go/issues/63.

Added a snippet to examples/interrupt.c to verify that this works as
expected in manual testing.

Signed-off-by: Stephan Renatus <[email protected]>

show more ...

Implement RFC 11: Redesigning Wasmtime's APIs (#2897)

Implement Wasmtime's new API as designed by RFC 11. This is quite a large commit which has had lots of discussion externally, so for more inform

Implement RFC 11: Redesigning Wasmtime's APIs (#2897)

Implement Wasmtime's new API as designed by RFC 11. This is quite a large commit which has had lots of discussion externally, so for more information it's best to read the RFC thread and the PR thread.

show more ...