bytecodealliance / bytecodealliance/wasmtime
`ResourceAny` API ergonomics
- Dominant language
- Rust
- Stars
- 18.6k
- Forks
- 1.8k
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 126
Description
#### Feature
`ResourceAny` is in the component model, both when the guest returns resources but also when `borrow<...>` resources are passed to the guest. The `ResourceAny` type `Copy`able handle and is usually passed by value. To destroy a resource `resource_drop[_async]` is called. Since the handle itself is `Copy`, you may still have copies of that handle around. Accidently reusing the handle results in:
```text
host-owned resource is being used with the wrong type
```
as this test shows:
https://github.com/bytecodealliance/wasmtime/blob/23c0f09d0ba1041fc300bc4aabada0ded783c538/tests/all/component_model/resources.rs#L181-L203
Now there are two DX issues here:
- the error message is somewhat misleading (it actually even happens when you allocate the same resource type into the slot, i.e. if the test would have used `t1` & `t1` instead of `t` and `u`)
- since the handle doesn't have any form of refcounting, it is hard to enforce a "don't reuse a de-allocated resource" in a codebase esp. since `ResourceAny` is `Copy` and is often passed by value, hence you cannot really build a strong ref-count guard around it
#### Benefit
Improving the situation may prevent certain "used after free" bugs (even though they don't panic or SEGFAULT, they are still not great)
#### Implementation
Ideally `ResourceAny` wouldn't be `Copy` and would be passed by reference. Then `resource_drop[_async]` could consume the type. However there might be other API considerations that could prevent that.
#### Alternatives
If the type stays `Copy`, could we at least make the error message a bit clearer?
Contributor guide
Assessment
This issue has not been assessed yet.