consolidate unsafe code in concurrent.rs and friends#159
Conversation
This adds a few abstractions to reduce the amount of unsafe code and make what remains easier to reason about locally (i.e. without relying as much on functions only being called in certain contexts, or on non-local safe code upholding invariants). This introduces a `StoreToken` abstraction for witnessing the data type parameter `T` for a `StoreContextMut<T>` and later safely casting from a `&mut dyn VMStore` to a `&mut StoreInner<T>` within a closure by asserting that the `StoreId`s match. This also eliminates various transmutes and other unsafe shenanigans to avoid a `T: 'static` bound since we've finally decided avoiding such a bound is impractical. Signed-off-by: Joel Dice <joel.dice@fermyon.com>
|
There are a bunch of outdated comments that need updating to match the new code; will work on that next. |
Signed-off-by: Joel Dice <joel.dice@fermyon.com>
Signed-off-by: Joel Dice <joel.dice@fermyon.com>
|
Looks like it's going to take some work to convince CI to let me bump the MSRV to 1.85.0 given that it's newer than $CURRENT_STABLE minus 2; I'll probably just wait until 1.87.0 is released in a few days, which should satisfy it. |
This consolidates some unsafe code to avoid the need for non-local reasoning about invariants. Specifically, we can now efficiently transfer ownership of buffered items for host-based streams and futures without requiring unsafe blocks. Signed-off-by: Joel Dice <joel.dice@fermyon.com>
|
If you want to test a bit sooner you can try decrementing this to 1 to increase the msrv to 1.85 |
|
@alexcrichton Does this failure mean anything to you? https://github.com/bytecodealliance/wasip3-prototyping/actions/runs/15052610459/job/42310963180 I can repro locally both on this branch and on
|
|
I think I'll just |
|
Oof, it's broken on s390x too, I guess. |
a199faa to
53193a3
Compare
|
CI and I are just not getting along today. Now the AddressSanitizer tests are failing with a bunch of leaks reported. Could be a real regression or could be another MSRV thing. I can't seem to use AddressSanitizer on my Linux/ARM64 machine, whether natively or via qemu, so I haven't been able to repro and bisect yet. Might need to borrow a Linux/x86_64 machine and try there. |
I'm splitting this out of #159 to see if the CI failures there are due to this change or the other ones. This started failing when I bumped the MSRV. Presumably this will be addressed upstream, but for now I'm disabling the test so it doesn't block other work. Signed-off-by: Joel Dice <joel.dice@fermyon.com>
|
re riscv64/s390x, yeah that definitely looks like the msrv update, and is something we'll have to fix in upstream wasmtime re asan, that may also be an msrv update with a newer llvm and a new ASAN build detecting something. Maybe threads related? Unsure, would need to try reproducing locally (if possible I'd recommend decoupling the update to 1.87 and just update the msrv window to 1 to make the msrv here 1.85 while still using 1.86 as before today) |
This will hopefully sidestep the various 1.87 upgrade headaches that will be addressed upstream. Signed-off-by: Joel Dice <joel.dice@fermyon.com>
53193a3 to
dfcef3d
Compare
|
Okay; I just pushed an update to reduce |
|
Now the MinGW build is broken, both here and in #166. I'm going to just step slowly away from the computer for now. |
Some of the GitHub images have a broken MinGW, so we'll skip this for now. Signed-off-by: Joel Dice <joel.dice@fermyon.com>
Pull Request is not mergeable
|
Looks like the address sanitizer leak reports are a real regression and not related to the MSRV bump; they passed in #166 but failed here. I'll borrow a Linux/x86_64 device and see if I can repro and debug locally. |
1ed8892 to
0f958c9
Compare
|
I've fixed some of the leaks flagged by AddressSanitizer; working on the others now. |
0f958c9 to
115d0ab
Compare
In `ComponentInstance::from_vmctx` and `StoreContextMut::with_detached_instance[_async]` we were leaking memory due to having taken `InstanceData` out of the `Store` and making it unreachable except via a raw pointer, meaning there was nothing responsible for dropping it on panic. This commit stashes the data elsewhere in the store to make sure it gets dropped. Signed-off-by: Joel Dice <joel.dice@fermyon.com>
115d0ab to
49f24c1
Compare
This adds a few abstractions to reduce the amount of unsafe code and make what remains easier to reason about locally (i.e. without relying as much on functions only being called in certain contexts, or on non-local safe code upholding invariants).
This introduces a
StoreTokenabstraction for witnessing the data type parameterTfor aStoreContextMut<T>and later safely casting from a&mut dyn VMStoreto a&mut StoreInner<T>within a closure by asserting that theStoreIds match.This also eliminates various transmutes and other unsafe shenanigans to avoid a
T: 'staticbound since we've finally decided avoiding such a bound is impractical.