Make Wasmtime compatible with Stacked Borrows in MIRI

.github/workflows/main.yml

@@ -625,7 +625,7 @@ jobs:
           -p wasmtime-runtime \
           -p wasmtime-environ
       env:
-        MIRIFLAGS: -Zmiri-tree-borrows
+        MIRIFLAGS: -Zmiri-strict-provenance
 
     # common logic to cancel the entire run if this job fails
     - run: gh run cancel ${{ github.run_id }}

crates/c-api/include/wasmtime/func.h

@@ -296,14 +296,14 @@ WASM_API_EXTERN wasmtime_context_t* wasmtime_caller_context(wasmtime_caller_t* c
  */
 WASM_API_EXTERN void wasmtime_func_from_raw(
     wasmtime_context_t* context,
-    size_t raw,
+    void *raw,
     wasmtime_func_t *ret);
 
 /**
  * \brief Converts a `func`  which belongs to `context` into a `usize`
  * parameter that is suitable for insertion into a #wasmtime_val_raw_t.
  */
-WASM_API_EXTERN size_t wasmtime_func_to_raw(
+WASM_API_EXTERN void *wasmtime_func_to_raw(
     wasmtime_context_t* context,
     const wasmtime_func_t *func);
 

crates/c-api/include/wasmtime/val.h

@@ -70,7 +70,7 @@ WASM_API_EXTERN void wasmtime_externref_delete(wasmtime_externref_t *ref);
  * Note that the returned #wasmtime_externref_t is an owned value that must be
  * deleted via #wasmtime_externref_delete by the caller if it is non-null.
  */
-WASM_API_EXTERN wasmtime_externref_t *wasmtime_externref_from_raw(wasmtime_context_t *context, size_t raw);
+WASM_API_EXTERN wasmtime_externref_t *wasmtime_externref_from_raw(wasmtime_context_t *context, void *raw);
 
 /**
  * \brief Converts a #wasmtime_externref_t to a raw value suitable for storing
@@ -82,7 +82,7 @@ WASM_API_EXTERN wasmtime_externref_t *wasmtime_externref_from_raw(wasmtime_conte
  * context of the store. Do not perform a GC between calling this function and
  * passing it to WebAssembly.
  */
-WASM_API_EXTERN size_t wasmtime_externref_to_raw(
+WASM_API_EXTERN void *wasmtime_externref_to_raw(
     wasmtime_context_t *context,
     const wasmtime_externref_t *ref);
 
@@ -180,15 +180,15 @@ typedef union wasmtime_val_raw {
   /// passed to `wasmtime_func_from_raw` to determine the `wasmtime_func_t`.
   ///
   /// Note that this field is always stored in a little-endian format.
-  size_t funcref;
+  void *funcref;
   /// Field for when this val is a WebAssembly `externref` value.
   ///
   /// If this is set to 0 then it's a null externref, otherwise this must be
   /// passed to `wasmtime_externref_from_raw` to determine the
   /// `wasmtime_externref_t`.
   ///
   /// Note that this field is always stored in a little-endian format.
-  size_t externref;
+  void *externref;
 } wasmtime_val_raw_t;
 
 /**

crates/c-api/src/func.rs

@@ -420,13 +420,16 @@ pub unsafe extern "C" fn wasmtime_caller_export_get(
 #[no_mangle]
 pub unsafe extern "C" fn wasmtime_func_from_raw(
     store: CStoreContextMut<'_>,
-    raw: usize,
+    raw: *mut c_void,
     func: &mut Func,
 ) {
     *func = Func::from_raw(store, raw).unwrap();
 }
 
 #[no_mangle]
-pub unsafe extern "C" fn wasmtime_func_to_raw(store: CStoreContextMut<'_>, func: &Func) -> usize {
+pub unsafe extern "C" fn wasmtime_func_to_raw(
+    store: CStoreContextMut<'_>,
+    func: &Func,
+) -> *mut c_void {
     func.to_raw(store)
 }

crates/c-api/src/val.rs

@@ -296,17 +296,17 @@ pub extern "C" fn wasmtime_externref_delete(_val: Option<ExternRef>) {}
 pub unsafe extern "C" fn wasmtime_externref_to_raw(
     cx: CStoreContextMut<'_>,
     val: Option<ManuallyDrop<ExternRef>>,
-) -> usize {
+) -> *mut c_void {
     match val {
         Some(ptr) => ptr.to_raw(cx),
-        None => 0,
+        None => ptr::null_mut(),
     }
 }
 
 #[no_mangle]
 pub unsafe extern "C" fn wasmtime_externref_from_raw(
     _cx: CStoreContextMut<'_>,
-    val: usize,
+    val: *mut c_void,
 ) -> Option<ExternRef> {
     ExternRef::from_raw(val)
 }

crates/runtime/Cargo.toml

@@ -25,6 +25,7 @@ anyhow = { workspace = true }
 memfd = "0.6.2"
 paste = "1.0.3"
 encoding_rs = { version = "0.8.31", optional = true }
+sptr = "0.3.2"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 mach = "0.3.2"

crates/runtime/src/component.rs

@@ -7,10 +7,11 @@
 //! cranelift-compiled adapters, will use this `VMComponentContext` as well.
 
 use crate::{
-    Store, VMArrayCallFunction, VMFuncRef, VMGlobalDefinition, VMMemoryDefinition,
+    SendSyncPtr, Store, VMArrayCallFunction, VMFuncRef, VMGlobalDefinition, VMMemoryDefinition,
     VMNativeCallFunction, VMOpaqueContext, VMSharedSignatureIndex, VMWasmCallFunction, ValRaw,
 };
 use memoffset::offset_of;
+use sptr::Strict;
 use std::alloc::{self, Layout};
 use std::marker;
 use std::mem;
@@ -40,37 +41,15 @@ pub struct ComponentInstance {
     /// Size and offset information for the trailing `VMComponentContext`.
     offsets: VMComponentOffsets<HostPtr>,
 
-    /// A self-referential pointer to the `ComponentInstance` itself.
-    ///
-    /// The reason for this field's existence is a bit subtle because if you
-    /// have a pointer to `ComponentInstance` then why have this field which has
-    /// the same information? The subtlety here is due to the fact that this is
-    /// here to handle provenance and aliasing issues with optimizations in LLVM
-    /// and Rustc. Put another way, this is here to make MIRI happy. That's an
-    /// oversimplification, though, since this is actually required for
-    /// correctness to communicate the actual intent to LLVM's optimizations and
-    /// such.
-    ///
-    /// This field is chiefly used during `ComponentInstance::vmctx`. If you
-    /// think of pointers as a pair of address and provenance, this type stores
-    /// the provenance of the entire allocation. That's technically all we need
-    /// here, just the provenance, but that can only be done with storage of a
-    /// pointer hence the storage here.
-    ///
-    /// Finally note that there's a small wrapper around this to add `Send` and
-    /// `Sync` bounds, but serves no other purpose.
-    self_reference: RawComponentInstance,
+    /// For more information about this see the documentation on
+    /// `Instance::vmctx_self_reference`.
+    vmctx_self_reference: SendSyncPtr<VMComponentContext>,
 
     /// A zero-sized field which represents the end of the struct for the actual
     /// `VMComponentContext` to be allocated behind.
     vmctx: VMComponentContext,
 }
 
-struct RawComponentInstance(NonNull<ComponentInstance>);
-
-unsafe impl Send for RawComponentInstance {}
-unsafe impl Sync for RawComponentInstance {}
-
 /// Type signature for host-defined trampolines that are called from
 /// WebAssembly.
 ///
@@ -174,7 +153,15 @@ impl ComponentInstance {
             ptr.as_ptr(),
             ComponentInstance {
                 offsets,
-                self_reference: RawComponentInstance(ptr),
+                vmctx_self_reference: SendSyncPtr::new(
+                    NonNull::new(
+                        ptr.as_ptr()
+                            .cast::<u8>()
+                            .add(mem::size_of::<ComponentInstance>())
+                            .cast(),
+                    )
+                    .unwrap(),
+                ),
                 vmctx: VMComponentContext {
                     _marker: marker::PhantomPinned,
                 },
@@ -185,13 +172,8 @@ impl ComponentInstance {
     }
 
     fn vmctx(&self) -> *mut VMComponentContext {
-        let self_ref = self.self_reference.0.as_ptr();
-        unsafe {
-            self_ref
-                .cast::<u8>()
-                .add(mem::size_of::<ComponentInstance>())
-                .cast()
-        }
+        let addr = std::ptr::addr_of!(self.vmctx);
+        Strict::with_addr(self.vmctx_self_reference.as_ptr(), Strict::addr(addr))
     }
 
     unsafe fn vmctx_plus_offset<T>(&self, offset: u32) -> *const T {
@@ -520,15 +502,9 @@ impl VMComponentContext {
 /// This type can be dereferenced to `ComponentInstance` to access the
 /// underlying methods.
 pub struct OwnedComponentInstance {
-    ptr: ptr::NonNull<ComponentInstance>,
+    ptr: SendSyncPtr<ComponentInstance>,
 }
 
-// Using `NonNull` turns off auto-derivation of these traits but the owned usage
-// here enables these trait impls so long as `ComponentInstance` itself
-// implements these traits.
-unsafe impl Send for OwnedComponentInstance where ComponentInstance: Send {}
-unsafe impl Sync for OwnedComponentInstance where ComponentInstance: Sync {}
-
 impl OwnedComponentInstance {
     /// Allocates a new `ComponentInstance + VMComponentContext` pair on the
     /// heap with `malloc` and configures it for the `component` specified.
@@ -545,10 +521,11 @@ impl OwnedComponentInstance {
             // zeroed allocation is done here to try to contain
             // use-before-initialized issues.
             let ptr = alloc::alloc_zeroed(layout) as *mut ComponentInstance;
-            let ptr = ptr::NonNull::new(ptr).unwrap();
+            let ptr = NonNull::new(ptr).unwrap();
 
             ComponentInstance::new_at(ptr, layout.size(), offsets, store);
 
+            let ptr = SendSyncPtr::new(ptr);
             OwnedComponentInstance { ptr }
         }
     }