47d6db0be8
* Reel in unsafety around `InstanceHandle` This commit is an attempt, or at least is targeted at being a start, at reeling in the unsafety around the `InstanceHandle` type. Currently this type represents a sort of moral `Rc<Instance>` but is a bit more specialized since the underlying memory is allocated through mmap. Additionally, though, `InstanceHandle` exposes a fundamental flaw in its safety by safetly allowing mutable access so long as you have `&mut InstanceHandle`. This type, however, is trivially created by simply cloning a `InstanceHandle` to get an owned reference. This means that `&mut InstanceHandle` does not actually provide any guarantees about uniqueness, so there's no more safety than `&InstanceHandle` itself. This commit removes all `&mut self` APIs from `InstanceHandle`, additionally removing some where `&self` was `unsafe` and `&mut self` was safe (since it was trivial to subvert this "safety"). In doing so interior mutability patterns are now used much more extensively through structures such as `Table` and `Memory`. Additionally a number of methods were refactored to be a bit clearer and use helper functions where possible. This is a relatively large commit unfortunately, but it snowballed very quickly into touching quite a few places. My hope though is that this will prevent developers working on wasmtime internals as well as developers still yet to migrate to the `wasmtime` crate from falling into trivial unsafe traps by accidentally using `&mut` when they can't. All existing users relying on `&mut` will need to migrate to some form of interior mutability, such as using `RefCell` or `Cell`. This commit also additionally marks `InstanceHandle::new` as an `unsafe` function. The rationale for this is that the `&mut`-safety is only the beginning for the safety of `InstanceHandle`. In general the wasmtime internals are extremely unsafe and haven't been audited for appropriate usage of `unsafe`. Until that's done it's hoped that we can warn users with this `unsafe` constructor and otherwise push users to the `wasmtime` crate which we know is safe. * Fix windows build * Wrap up mutable memory state in one structure Rather than having separate fields * Use `Cell::set`, not `Cell::replace`, where possible * Add a helper function for offsets from VMContext * Fix a typo from merging * rustfmt * Use try_from, not as * Tweak style of some setters
29 lines
1.0 KiB
Rust
29 lines
1.0 KiB
Rust
use more_asserts::assert_gt;
|
|
use std::path::PathBuf;
|
|
use wasmtime_environ::settings;
|
|
use wasmtime_environ::settings::Configurable;
|
|
use wasmtime_jit::{instantiate, native, CompilationStrategy, Compiler, NullResolver};
|
|
|
|
const PATH_MODULE_RS2WASM_ADD_FUNC: &str = r"tests/wat/rs2wasm-add-func.wat";
|
|
|
|
/// Simple test reading a wasm-file and translating to binary representation.
|
|
#[test]
|
|
fn test_environ_translate() {
|
|
let path = PathBuf::from(PATH_MODULE_RS2WASM_ADD_FUNC);
|
|
let data = wat::parse_file(path).expect("expecting valid wat-file");
|
|
assert_gt!(data.len(), 0);
|
|
|
|
let mut flag_builder = settings::builder();
|
|
flag_builder.enable("enable_verifier").unwrap();
|
|
|
|
let isa_builder = native::builder();
|
|
let isa = isa_builder.finish(settings::Flags::new(flag_builder));
|
|
|
|
let mut resolver = NullResolver {};
|
|
let mut compiler = Compiler::new(isa, CompilationStrategy::Auto);
|
|
unsafe {
|
|
let instance = instantiate(&mut compiler, &data, &mut resolver, false);
|
|
assert!(instance.is_ok());
|
|
}
|
|
}
|