pub struct RuntimeMemory<M: Memory> { /* private fields */ }Expand description
RuntimeMemory
Exclusive virtual memory leased through a runtime’s committed authority.
Implements Memory for stable structures without exposing the backing
memory or an alternate manager. The lease cannot be cloned; dropping it
permits another open of the same allocation. Moving it into a collection
transfers the lease until that collection releases the memory.
The handle can outlive its runtime and retains the backing claim. A replacement
runtime is refused until every handle releases it. Custom backing identities
must follow super::MemoryBacking; raw aliased access remains prohibited.
IO checks the virtual extent before upstream bucket translation. Empty IO
is valid at the end of memory, but not beyond it. Reads preserve the upstream
optimized support for uninitialized destinations through Memory::read_unsafe.
Growth reserves physical capacity before assigning manager buckets. Ordinary
backing refusal, arithmetic overflow and bucket exhaustion return typed errors
without changing virtual extents or manager metadata. Backing implementations
must obey the Memory contract; traps and partial writes are not transactions
on native memory. Typed collections retain their own failure behavior.
Size, valid IO, and growth check the complete bounded manager metadata before
using cached translations. Detected divergence permanently poisons this owner.
Invalid IO bounds still refuse before backing access. These checks add bounded
metadata reads, not ledger/payload decoding or synchronization with raw aliases.
Implementations§
Source§impl<M: Memory> RuntimeMemory<M>
impl<M: Memory> RuntimeMemory<M>
Sourcepub fn grow(&self, pages: u64) -> Result<u64, RuntimeGrowError>
pub fn grow(&self, pages: u64) -> Result<u64, RuntimeGrowError>
Grow by the requested pages, returning the previous virtual page count.
Capacity is reserved before assigning manager buckets. Ordinary refusal
preserves virtual extents and manager metadata and permits retry. The
upstream Memory::grow adapter translates errors into its required
-1 sentinel; direct runtime callers receive super::RuntimeGrowError.
A zero-page request verifies metadata and returns the current extent
without growth or writes, after checking for reentrant growth.
§Panics
Panics if a private growth-accounting invariant is broken or backing memory panics.