feat: fail only the request when a handler hits a runtime error

cranelift/runtime-abi/runtime_functions.txt

@@ -37,6 +37,7 @@ pith_closure_get_env|pith_closure_get_env|I64,I64|I64
 pith_closure_retain|pith_closure_retain|I64|
 pith_closure_release|pith_closure_release|I64|
 print_err|pith_print_err|I64|
+isolate_call|pith_isolate_call|I64|I64
 pith_main_error_exit|pith_main_error_exit|I64,I64|I64
 bit_and|pith_bit_and|I64,I64|I64
 bit_or|pith_bit_or|I64,I64|I64

cranelift/runtime-abi/runtime_ownership.txt

@@ -53,6 +53,7 @@ pith_closure_get_env|b,-|borrow:0|runtime_core.rs:1068|returns the stored slot v
 pith_closure_retain|b|-|runtime_core.rs:793|retain: adds one count to the closure
 pith_closure_release|c|-|runtime_core.rs:807|release: drops one count; last release releases every tagged capture then frees the shell
 print_err|b|-|-|
+isolate_call|b|own|failure.rs:73|closure only called; returns the empty literal on success or a fresh string holding the failure message
 pith_main_error_exit|b,-|-|runtime_core.rs:1807|never returns: prints err (read only when is_string != 0) and exits(1)
 bit_and|-,-|-|-|
 bit_or|-,-|-|-|

cranelift/runtime/src/bytes.rs

@@ -285,12 +285,10 @@ pub unsafe extern "C" fn pith_bytes_get_strict(handle: i64, idx: i64) -> i64 {
     };
     let len = bytes.data.len() as i64;
     if idx < 0 || idx >= len {
-        eprintln!(
-            "pith runtime error: bytes index out of bounds: {} for bytes of length {}",
+        crate::failure::fail(format!(
+            "bytes index out of bounds: {} for bytes of length {}",
             idx, len
-        );
-        // panic-guard: strict bytes indexing out of bounds is a program bug with no value to return.
-        std::process::exit(1);
+        ));
     }
     bytes.data[idx as usize] as i64
 }

cranelift/runtime/src/collections/list.rs

@@ -927,12 +927,10 @@ unsafe fn set_value_inner(list: PithList, index: i64, value: i64, takes_caller_c
 #[cold]
 #[inline(never)]
 fn strict_store_out_of_bounds(index: i64, len: i64) -> ! {
-    eprintln!(
-        "pith runtime error: list index out of bounds: {} for list of length {}",
+    crate::failure::fail(format!(
+        "list index out of bounds: {} for list of length {}",
         index, len
-    );
-    // panic-guard: an index store out of bounds is a program bug with nothing to write to.
-    std::process::exit(1);
+    ))
 }
 
 #[inline]
@@ -1236,12 +1234,10 @@ fn strict_index_bad_handle() -> ! {
 #[cold]
 #[inline(never)]
 fn strict_index_out_of_bounds(index: i64, len: i64) -> ! {
-    eprintln!(
-        "pith runtime error: list index out of bounds: {} for list of length {} (use .get(i) for Optional access)",
+    crate::failure::fail(format!(
+        "list index out of bounds: {} for list of length {} (use .get(i) for Optional access)",
         index, len
-    );
-    // panic-guard: strict list indexing out of bounds is a program bug with no value to return.
-    std::process::exit(1);
+    ))
 }
 
 #[cold]

cranelift/runtime/src/collections/map.rs

@@ -1078,13 +1078,14 @@ unsafe fn remove_keyed(impl_ref: &mut MapImpl, map_key: &KeyRef<'_>) {
 
 /// Exit with the structured diagnostic for a strict miss: `m[k]` on a key
 /// the map does not hold.
-fn strict_miss(key_display: &str) -> ! {
-    eprintln!(
-        "pith runtime error: map key not found: {} (use .contains_key first, .get(k) for Optional, or .get_default(k, d) for a fallback)",
+///
+/// The caller passes the key's text by value: `fail` skips the caller's frame,
+/// so a string the caller still owned would never be freed.
+fn strict_miss(key_display: String) -> ! {
+    crate::failure::fail(format!(
+        "map key not found: {} (use .contains_key first, .get(k) for Optional, or .get_default(k, d) for a fallback)",
         key_display
-    );
-    // panic-guard: a missing key under strict indexing is a program bug with no value to return.
-    std::process::exit(1);
+    ))
 }
 
 /// Insert an i64 value with a C-string key.
@@ -1219,7 +1220,7 @@ unsafe fn upsert_add_keyed(impl_ref: &mut MapImpl, map_key: &KeyRef<'_>, delta:
     }
     match impl_ref.upsert_add(map_key, delta) {
         Some(v) => v,
-        None => strict_miss(&map_key.display()),
+        None => strict_miss(map_key.display()),
     }
 }
 
@@ -1287,7 +1288,7 @@ pub unsafe extern "C" fn pith_map_upsert_add_bkey(map_handle: i64, key: i64, del
     };
     require_key_flavor(impl_ref.key_type, KeyType::Bytes, "map_upsert_add_bkey");
     let Some(map_key) = bytes_key_ref(key) else {
-        strict_miss("<not a bytes value>");
+        strict_miss(String::from("<not a bytes value>"));
     };
     upsert_add_keyed(impl_ref, &map_key, delta)
 }
@@ -1363,7 +1364,7 @@ pub unsafe extern "C" fn pith_map_add_or_insert_bkey(map_handle: i64, key: i64,
     };
     require_key_flavor(impl_ref.key_type, KeyType::Bytes, "map_add_or_insert_bkey");
     let Some(map_key) = bytes_key_ref(key) else {
-        strict_miss("<not a bytes value>");
+        strict_miss(String::from("<not a bytes value>"));
     };
     add_or_insert_keyed(impl_ref, &map_key, delta, init)
 }
@@ -1449,7 +1450,7 @@ pub unsafe extern "C" fn pith_map_get_cstr_strict(map_handle: i64, key: *const i
     let map_key = cstr_key_ref(key);
     match get_keyed(impl_ref, &map_key) {
         Some(v) => v,
-        None => strict_miss(&map_key.display()),
+        None => strict_miss(map_key.display()),
     }
 }
 
@@ -1653,11 +1654,11 @@ pub unsafe extern "C" fn pith_map_get_bkey_strict(map_handle: i64, key: i64) ->
     };
     require_key_flavor(impl_ref.key_type, KeyType::Bytes, "map_get_bkey_strict");
     let Some(map_key) = bytes_key_ref(key) else {
-        strict_miss("<not a bytes value>");
+        strict_miss(String::from("<not a bytes value>"));
     };
     match get_keyed(impl_ref, &map_key) {
         Some(v) => v,
-        None => strict_miss(&map_key.display()),
+        None => strict_miss(map_key.display()),
     }
 }
 

cranelift/runtime/src/concurrency/mutex.rs

@@ -171,6 +171,8 @@ pub unsafe extern "C" fn pith_mutex_lock(handle: *mut PithMutexHandle) {
         Some(id) => lock_green(m, id),
         None => lock_os(m),
     }
+    // an isolated call that fails while holding the lock gives it back.
+    crate::failure::note_lock(handle as usize);
 }
 
 /// Unlock the mutex
@@ -182,6 +184,7 @@ pub unsafe extern "C" fn pith_mutex_unlock(handle: *mut PithMutexHandle) {
     let Some(m) = mutex_ref(handle) else {
         return;
     };
+    crate::failure::note_unlock(handle as usize);
     // wake any green tasks parked on this lock so they retry their acquire.
     // only a parked green task sets state 2, so an unlock with no one waiting
     // never takes the waiter lock. an os-thread waiter spins and needs no