Enum ExecError 

pub enum ExecError {
    Wasmtime(Error),
    NotFound(InstanceId),
    MissingExport(String),
    Timeout(TimeoutContext),
    ModuleMemoryTooLarge {
        requested_bytes: u64,
        limit_bytes: u64,
    },
    CapacityExhausted {
        active: usize,
        limit: usize,
    },
    TenantCapacityExhausted {
        tenant: TenantId,
        active: usize,
        limit: usize,
    },
    ModuleTooLarge {
        len: usize,
        max: usize,
    },
    EpochTickerNotRunning,
}

Errors raised by the executor.

Variants

Wasmtime(Error)

Wasmtime returned an error during compile / instantiate / call.

The full wasmtime error chain (including any inner trap, backtrace, or compile-error context) is preserved via #[from] (which thiserror also wires as #[source]) so callers converting to tensor_wasm_core::error::TensorWasmError do not lose detail.

NotFound(InstanceId)

Looked up an instance that does not exist (or has terminated).

MissingExport(String)

Looked up an export that the instance does not provide.

Timeout(TimeoutContext)

The instance ran past its deadline before the call completed.

Carries the offending InstanceId plus the real elapsed_ms / deadline_ms figures captured at the time the epoch interrupt fired. Surfaced as tensor_wasm_core::error::TensorWasmError::KernelTimeout with the same numbers on the conversion boundary.

Tuple-shaped (rather than a struct variant) so existing match arms like ExecError::Timeout(_) keep compiling.

ModuleMemoryTooLarge

The module declares — via an exported or imported wasmtime::ExternType::Memory — an initial or maximum linear memory size that exceeds EngineConfig::max_memory_bytes.

Surfaced before Instance::new_async because Wasmtime’s wasmtime::ResourceLimiter::memory_growing only fires on memory.grow, not on the initial allocation. A guest declaring (memory 1 65536) would otherwise force a 4 GiB allocation at instantiation. Maps to tensor_wasm_core::error::TensorWasmError::MemoryExhausted.

Fields

requested_bytes: u64

Bytes the module asked for (initial or declared maximum, whichever tripped the check first).

limit_bytes: u64

Configured engine-wide per-instance cap in bytes.

CapacityExhausted

The executor refused to admit a new instance because the engine-wide live-instance cap (crate::engine::EngineConfig::max_instances) is already saturated.

Surfaced from TensorWasmExecutor::spawn_instance before any compile / instantiate work; the failed spawn never consumes a slot in the registry. Mapped to tensor_wasm_core::error::TensorWasmError::MemoryExhausted on the conversion boundary (the API layer surfaces it as 503). The executor refused to admit a new instance because an admission-control ceiling is already saturated. Surfaced for two rejections that the API layer treats identically (503, retryable):

• the engine-wide live-instance ceiling (crate::engine::EngineConfig::max_instances, exec S-10); or
• the spawning tenant’s per-tenant fairness cap (crate::engine::EngineConfig::max_instances_per_tenant), even though the engine-wide ceiling may still have headroom. One tenant hitting its per-tenant cap is refused here WITHOUT affecting any other tenant’s ability to spawn.

Surfaced from TensorWasmExecutor::spawn_instance before any compile / instantiate work; the failed spawn never consumes a slot (engine-wide or per-tenant). Mapped to tensor_wasm_core::error::TensorWasmError::MemoryExhausted on the conversion boundary (the API layer surfaces it as 503).

This is the engine-wide ceiling: the shared max_instances budget is saturated and the spawn would succeed once aggregate load drops. The remedy is retry-with-backoff and it is no single tenant’s fault, so the API layer maps it to 503. The per-tenant fairness cap is a distinct condition — see ExecError::TenantCapacityExhausted.

Fields

active: usize

Engine-wide live-instance count observed at the rejection point (post-increment, so active > limit).

limit: usize

Configured engine-wide max_instances ceiling that was exceeded.

TenantCapacityExhausted

A single tenant exceeded its per-tenant fairness cap (crate::engine::EngineConfig::max_instances_per_tenant) while the shared engine-wide budget still had room. This is semantically distinct from ExecError::CapacityExhausted: the offending tenant is over its own quota, so the corrective action is for that tenant to reduce concurrency — not to wait for global load to drop. The API layer maps it to 429 (tenant_capacity_exhausted) rather than 503, giving callers a quota-specific retry signal. Other tenants are unaffected.

Fields

tenant: TenantId

The tenant whose per-tenant cap was hit (the spawn’s owner).

active: usize

That tenant’s live-instance count at the rejection point (post-increment, so active > limit).

limit: usize

The configured per-tenant max_instances_per_tenant ceiling.

ModuleTooLarge

The submitted Wasm module is larger than the configured pre-compile size cap (crate::engine::EngineConfig::max_module_bytes, floored at MAX_MODULE_BYTES).

Rejected before Module::from_binary runs so a pathological code section cannot force Cranelift to burn CPU on adversarial input. Mapped to tensor_wasm_core::error::TensorWasmError::MemoryExhausted on the conversion boundary (the API layer surfaces it as 503).

Fields

len: usize

Length of the rejected wasm blob, in bytes.

max: usize

Configured per-executor cap, in bytes.

EpochTickerNotRunning

spawn_instance was called with a deadline configured but the engine’s epoch ticker is not running. Without the ticker, the per-store epoch counter never advances, so neither the per-call deadline nor MAX_START_FN_DURATION can fire — a runaway guest would wedge the worker thread until it returned of its own accord. Refuse the spawn instead of silently dropping the deadline contract.

Trait Implementations

impl Debug for ExecError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for ExecError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for ExecError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<Error> for ExecError

fn from(source: Error) -> Self

Converts to this type from the input type.

impl From<ExecError> for TensorWasmError

fn from(e: ExecError) -> Self

Converts to this type from the input type.