Disallow values to cross stores (#1016)

* Disallow values to cross stores

Lots of internals in the wasmtime-{jit,runtime} crates are highly
unsafe, so it's up to the `wasmtime` API crate to figure out how to make
it safe. One guarantee we need to provide is that values never cross
between stores. For example you can't take a function in one store and
move it over into a different instance in a different store. This
dynamic check can't be performed at compile time and it's up to
`wasmtime` to do the check itself.

This adds a number of checks, but not all of them, to the codebase for
now. This primarily adds checks around instantiation, globals, and
tables. The main hole in this is functions, where you can pass in
arguments or return values that are not from the right store. For now
though we can't compile modules with `anyref` parameters/returns anyway,
so we should be good. Eventually when that is supported we'll need to
put the guards in place.

Closes #958

* Clarify how values test they come from stores

* Allow null anyref to initialize tables

crates/api/src/func.rs

@@ -143,7 +143,7 @@ use wasmtime_runtime::{InstanceHandle, VMContext, VMFunctionBody};
 /// ```
 #[derive(Clone)]
 pub struct Func {
-    _store: Store,
+    store: Store,
     callable: Rc<dyn WrappedCallable + 'static>,
     ty: FuncType,
 }
@@ -510,7 +510,7 @@ impl Func {
         callable: Rc<dyn WrappedCallable + 'static>,
     ) -> Func {
         Func {
-            _store: store.clone(),
+            store: store.clone(),
             callable,
             ty,
         }
@@ -541,6 +541,13 @@ impl Func {
     /// This function should not panic unless the underlying function itself
     /// initiates a panic.
     pub fn call(&self, params: &[Val]) -> Result<Box<[Val]>, Trap> {
+        for param in params {
+            if !param.comes_from_same_store(&self.store) {
+                return Err(Trap::new(
+                    "cross-`Store` values are not currently supported",
+                ));
+            }
+        }
         let mut results = vec![Val::null(); self.result_arity()];
         self.callable.call(params, &mut results)?;
         Ok(results.into_boxed_slice())
@@ -689,6 +696,10 @@ impl Func {
         /// See the [`Func::get1`] method for more documentation.
         (get15, A1, A2, A3, A4, A5, A6, A7, A8, A9, A10, A11, A12, A13, A14, A15)
     }
+
+    pub(crate) fn store(&self) -> &Store {
+        &self.store
+    }
 }
 
 impl fmt::Debug for Func {