feat: add table_growing to ResourceLimiter for consistency

Signed-off-by: Henry <mail@henrygressmann.de>

Author: explodingcamera

ARCHITECTURE.md

@@ -46,7 +46,7 @@ Linear memory is a contiguous `Vec<u8>` allocation owned by a `MemoryInstance`.
 
 Fixed-width loads and stores use a single const-generic `read_fixed::<N>` / `write_fixed::<N>` pair rather than per-width vtable methods. Scalar operations reduce to an effective-address computation, a bounds check, a slice access, and a `from_le_bytes` / `to_le_bytes` conversion, with out-of-bounds construction kept on cold paths. Bulk operations such as `fill` and `copy_within` map directly to native slice methods.
 
-Memory growth keeps the Wasm page count and limits on `MemoryInstance`. Before the backing storage is allocated or resized, the configured `ResourceLimiter` is consulted so a host can bound guest memory consumption. The limiter is shared across the stores created from one `Engine` and lives behind an `Arc`.
+Memory growth keeps the Wasm page count and limits on `MemoryInstance`. Before memory or table backing storage is allocated or resized, the configured `ResourceLimiter` is consulted so a host can bound guest resource consumption. The limiter is shared across the stores created from one `Engine` and lives behind an `Arc`.
 
 For conventional operating systems, a future mmap-backed storage could reserve virtual address space and use guard pages to move more bounds enforcement to the operating system, reducing explicit checks in linear-memory hot paths. This is the same broad approach described in [Wasmtime's linear-memory architecture](https://docs.wasmtime.dev/contributing-architecture.html#linear-memory), where virtual-memory reservations and guard regions eliminate or deduplicate explicit bounds checks.
 

CHANGELOG.md

@@ -17,7 +17,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Added `ValueLane` for mapping WebAssembly value types to their physical 32-bit, 64-bit, or 128-bit storage lane.
 - Added a `validate` feature to `tinywasm` and `tinywasm-parser` (enabled by default) to optionally skip wasmparser validation for faster parsing of trusted modules.
 - Added optional parse-time operand deduplication to reduce precompiled module and `.twasm` archive size.
-- Added a `ResourceLimiter` trait, configurable through `engine::Config::with_resource_limiter`, to bound guest memory allocation and growth.
+- Added a `ResourceLimiter` trait, configurable through `engine::Config::with_resource_limiter`, to bound guest memory and table allocation and growth.
 
 ### Changed
 
@@ -48,7 +48,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Changed `TableType::element_type` and `Element::ty` from `WasmType` to `RefType`, and replaced module `table_types` with `TableDefinition { ty, init }`.
 - Removed the pluggable memory backend system (`LinearMemory`, `MemoryBackend`, `VecMemory`, `PagedMemory`, `LazyLinearMemory`, and `Config::with_memory_backend`). Linear memory is always `Vec`-backed. To limit initial memory allocation and growth, configure a `ResourceLimiter` with `Config::with_resource_limiter`.
 - Removed the local-memory allocation analysis (`LocalMemoryAllocation` and `ParserOptions::optimize_local_memory_allocation`). Local memories are always allocated eagerly.
-- Removed `Config::with_trap_on_oom`. A `ResourceLimiter` can return a trap when rejecting a memory allocation or growth request.
+- Removed `Config::with_trap_on_oom`. A `ResourceLimiter` can return a trap when rejecting a memory or table allocation or growth request.
+- `Table::grow` now returns `Result<Option<usize>>`, matching `Memory::grow`. Growth limits and allocation failures return `None`, while limiter-provided traps return an error.
 
 ## [0.10.0] - 2026-07-24
 

README.md

@@ -61,7 +61,7 @@ TinyWasm modules can be compiled to the internal `twasm` bytecode format, which
 
 With default features disabled, `tinywasm` depends only on `core`, `alloc`, and `libm`[^libm], making it usable in `no_std + alloc` environments.
 
-Use `Engine` and `engine::Config` when you need non-default runtime settings such as fuel accounting, stack sizing, or the GC collection threshold. A `ResourceLimiter` attached to the engine's config bounds guest memory allocation and growth and can trap rejected requests.
+Use `Engine` and `engine::Config` when you need non-default runtime settings such as fuel accounting, stack sizing, or the GC collection threshold. A `ResourceLimiter` attached to the engine's config bounds guest memory and table allocation and growth and can trap rejected requests.
 
 [^libm]: [rust-lang/rust#137578](https://github.com/rust-lang/rust/issues/137578) — tracking issue for floating-point math support in `no_std`.
 

crates/tinywasm/src/interpreter/executor.rs

@@ -1880,14 +1880,15 @@ impl<'store, const BUDGETED: bool> Executor<'store, BUDGETED> {
         let arch = self.store.state.get_table(table_addr).kind.arch();
         let n = self.pop_table_operand(arch)?;
         let val = <ValueRef>::stack_pop(&mut self.store.value_stack);
+        let limiter = self.store.engine.config().resource_limiter.as_deref();
         let table = self.store.state.get_table_mut(table_addr);
         let sz = table.size();
-        let result = table.grow(n, val);
-        match (arch, result) {
-            (MemoryArch::I32, Ok(())) => self.store.value_stack.push(sz as i32),
-            (MemoryArch::I32, Err(_)) => self.store.value_stack.push(-1_i32),
-            (MemoryArch::I64, Ok(())) => self.store.value_stack.push(sz as i64),
-            (MemoryArch::I64, Err(_)) => self.store.value_stack.push(-1_i64),
+        let grew = table.grow(n, val, limiter)?;
+        match (arch, grew) {
+            (MemoryArch::I32, true) => self.store.value_stack.push(sz as i32),
+            (MemoryArch::I32, false) => self.store.value_stack.push(-1_i32),
+            (MemoryArch::I64, true) => self.store.value_stack.push(sz as i64),
+            (MemoryArch::I64, false) => self.store.value_stack.push(-1_i64),
         }
     }
 

crates/tinywasm/src/lib.rs

@@ -55,8 +55,8 @@
 //!
 //! For non-default runtime behavior, construct a [`Store`] with a custom [`Engine`]
 //! and [`engine::Config`] to control stack sizing and fuel accounting. A [`ResourceLimiter`] can be
-//! attached to the engine configuration to bound memory allocation and growth for stores created
-//! from that engine and to trap rejected requests.
+//! attached to the engine configuration to bound memory and table allocation and growth for stores
+//! created from that engine and to trap rejected requests.
 //!
 //! For more examples, see the [`examples`](https://github.com/explodingcamera/tinywasm/tree/main/examples) directory.
 //!

crates/tinywasm/src/reference.rs

@@ -373,8 +373,9 @@ impl Table {
             return Err(Error::other("host tables cannot use module-relative concrete reference types"));
         }
         let init = table_value_to_element(&store.state, ty.element_type, init).map_err(Error::from)?;
+        let limiter = store.engine.config().resource_limiter.clone();
         let addr = store.state.tables.len() as TableAddr;
-        store.state.tables.push(TableInstance::new(ty, init)?);
+        store.state.tables.push(TableInstance::new(ty, init, limiter.as_deref())?);
         Ok(Self(StoreItem::new(store.id(), addr)))
     }
 
@@ -435,15 +436,23 @@ impl Table {
         store.state.get_table_mut(self.0.addr).copy_within(dst, src, len)
     }
 
-    /// Grow the table and return the previous size.
-    pub fn grow(&self, store: &mut Store, delta: i32, init: WasmValue) -> Result<usize> {
+    /// Grows the table and returns the previous size.
+    ///
+    /// Returns `None` if growth fails or is rejected by the resource limiter. A limiter-provided
+    /// trap is returned as an error.
+    pub fn grow(&self, store: &mut Store, delta: i32, init: WasmValue) -> Result<Option<usize>> {
         self.0.validate_store(store)?;
         let table = store.state.get_table(self.0.addr);
         let old_size = table.size();
         let init = table_value_to_element(&store.state, table.kind.element_type, init)?;
-        let delta = usize::try_from(delta).map_err(|_| Trap::TableOutOfBounds { offset: 0, len: 1, max: old_size })?;
-        store.state.get_table_mut(self.0.addr).grow(delta, init)?;
-        Ok(old_size)
+        let Ok(delta) = usize::try_from(delta) else {
+            return Ok(None);
+        };
+        let limiter = store.engine.config().resource_limiter.clone();
+        match store.state.get_table_mut(self.0.addr).grow(delta, init, limiter.as_deref())? {
+            true => Ok(Some(old_size)),
+            false => Ok(None),
+        }
     }
 }
 

crates/tinywasm/src/store/mod.rs

@@ -35,8 +35,8 @@ static STORE_ID: AtomicU32 = AtomicU32::new(0);
 ///
 /// Configure a limiter with
 /// [`Config::with_resource_limiter`](crate::engine::Config::with_resource_limiter). It currently
-/// controls guest linear-memory allocation and growth. It does not account for stacks, GC storage,
-/// runtime metadata, or other host allocations.
+/// controls guest linear-memory and table allocation and growth. It does not account for stacks,
+/// GC storage, runtime metadata, or other host allocations.
 ///
 /// # Example
 /// ```rust
@@ -69,13 +69,31 @@ pub trait ResourceLimiter: Send + Sync {
     ///
     /// Sizes are in bytes. `current` is zero for initial allocation, and `maximum` is `None` for an
     /// unbounded memory. `Ok(false)` rejects the request, while `Err` traps. Rejected initial
-    /// allocations return [`Trap::OutOfMemory`], since they have no normal failure result.
+    /// allocations return [`Trap::OutOfMemory`], since they have no normal failure result. The
+    /// default implementation allows the request.
     fn memory_growing(
         &self,
-        current: usize,
-        desired: usize,
-        maximum: Option<usize>,
-    ) -> core::result::Result<bool, Trap>;
+        _current: usize,
+        _desired: usize,
+        _maximum: Option<usize>,
+    ) -> core::result::Result<bool, Trap> {
+        Ok(true)
+    }
+
+    /// Returns whether a table allocation or growth is allowed.
+    ///
+    /// Sizes are in elements. `current` is zero for initial allocation, and `maximum` is `None` for
+    /// an unbounded table. `Ok(false)` rejects the request, while `Err` traps. Rejected initial
+    /// allocations return [`Trap::OutOfMemory`], since they have no normal failure result. The
+    /// default implementation allows the request.
+    fn table_growing(
+        &self,
+        _current: usize,
+        _desired: usize,
+        _maximum: Option<usize>,
+    ) -> core::result::Result<bool, Trap> {
+        Ok(true)
+    }
 }
 
 /// Runtime state used by WebAssembly instances and host functions.
@@ -281,6 +299,7 @@ impl Store {
         type_addrs: &[TypeAddr],
     ) -> Result<impl ExactSizeIterator<Item = TableAddr>> {
         let start = self.state.tables.len() as TableAddr;
+        let limiter = self.engine.config().resource_limiter.clone();
         self.state.tables.reserve_exact(tables.len());
         for table in tables {
             let init = match &table.init {
@@ -295,7 +314,7 @@ impl Store {
                 MemoryArch::I32 => TableType::new(element_type, table.ty.size_initial, table.ty.size_max),
                 MemoryArch::I64 => TableType::new64(element_type, table.ty.size_initial, table.ty.size_max),
             };
-            self.state.tables.push(TableInstance::new(ty, init)?);
+            self.state.tables.push(TableInstance::new(ty, init, limiter.as_deref())?);
         }
         Ok(start..start + tables.len() as TableAddr)
     }

crates/tinywasm/src/store/table.rs

@@ -1,4 +1,4 @@
-use crate::{Result, Trap, interpreter::ValueRef};
+use crate::{ResourceLimiter, Result, Trap, interpreter::ValueRef};
 use alloc::vec::Vec;
 use core::ops::Range;
 use tinywasm_types::*;
@@ -16,11 +16,17 @@ pub(crate) struct TableInstance {
 
 impl TableInstance {
     /// Creates a table filled with the given initial reference.
-    pub(crate) fn new(kind: TableType, init: ValueRef) -> Result<Self> {
+    pub(crate) fn new(kind: TableType, init: ValueRef, limiter: Option<&dyn ResourceLimiter>) -> Result<Self> {
         let size = cold_err!(usize::try_from(kind.size_initial)).map_err(|_| Trap::OutOfMemory)?;
         if size > MAX_TABLE_SIZE {
             return Err(Trap::OutOfMemory.into());
         }
+        if size != 0
+            && let Some(limiter) = limiter
+            && !limiter.table_growing(0, size, Self::maximum_size(kind))?
+        {
+            return Err(Trap::OutOfMemory.into());
+        }
         let mut elements = Vec::new();
         cold_err!(elements.try_reserve_exact(size)).map_err(|_| Trap::OutOfMemory)?;
         elements.resize(size, init);
@@ -74,17 +80,38 @@ impl TableInstance {
         Ok(())
     }
 
-    pub(crate) fn grow(&mut self, n: usize, init: ValueRef) -> Result<(), Trap> {
-        let len = n.checked_add(self.elements.len()).ok_or(Trap::OutOfMemory)?;
+    pub(crate) fn grow(
+        &mut self,
+        n: usize,
+        init: ValueRef,
+        limiter: Option<&dyn ResourceLimiter>,
+    ) -> Result<bool, Trap> {
+        let Some(len) = n.checked_add(self.elements.len()) else {
+            return Ok(false);
+        };
         let declared_max = self.kind.size_max.and_then(|max| usize::try_from(max).ok()).unwrap_or(usize::MAX);
         let max = declared_max.min(MAX_TABLE_SIZE);
         if len > max {
-            return Err(crate::Trap::TableOutOfBounds { offset: len, len: 1, max: self.elements.len() });
+            return Ok(false);
+        }
+        if len == self.elements.len() {
+            return Ok(true);
+        }
+        if let Some(limiter) = limiter
+            && !limiter.table_growing(self.elements.len(), len, Self::maximum_size(self.kind))?
+        {
+            return Ok(false);
         }
 
-        cold_err!(self.elements.try_reserve_exact(n)).map_err(|_| Trap::OutOfMemory)?;
+        if cold_err!(self.elements.try_reserve_exact(n)).is_err() {
+            return Ok(false);
+        }
         self.elements.resize(len, init);
-        Ok(())
+        Ok(true)
+    }
+
+    fn maximum_size(kind: TableType) -> Option<usize> {
+        kind.size_max.and_then(|maximum| usize::try_from(maximum).ok())
     }
 
     pub(crate) fn size(&self) -> usize {

crates/tinywasm/tests/internal_refs.rs

@@ -65,7 +65,7 @@ fn exported_tables_and_globals_have_handle_and_helper_apis() -> Result<(), Box<d
     assert_eq!(table.get(&store, 0)?, WasmValue::Ref(tinywasm::types::RefValue::Null));
 
     let old_size = instance.table("t")?.grow(&mut store, 1, tinywasm::types::RefValue::Null.into())?;
-    assert_eq!(old_size, 1);
+    assert_eq!(old_size, Some(1));
     assert_eq!(instance.table("t")?.size(&store)?, 2);
 
     Ok(())

crates/tinywasm/tests/memory.rs

@@ -3,8 +3,8 @@ extern crate alloc;
 use alloc::sync::Arc;
 
 use tinywasm::engine::Config;
-use tinywasm::types::{MemoryArch, MemoryType};
-use tinywasm::{Engine, Memory, ModuleInstance, ResourceLimiter, Store, Trap};
+use tinywasm::types::{MemoryArch, MemoryType, RefType, RefValue, TableType};
+use tinywasm::{Engine, Memory, ModuleInstance, ResourceLimiter, Store, Table, Trap};
 
 type TestResult<T = ()> = Result<T, Box<dyn core::error::Error>>;
 
@@ -51,6 +51,10 @@ impl ResourceLimiter for DenyAll {
     fn memory_growing(&self, _current: usize, _desired: usize, _maximum: Option<usize>) -> Result<bool, Trap> {
         Ok(false)
     }
+
+    fn table_growing(&self, _current: usize, _desired: usize, _maximum: Option<usize>) -> Result<bool, Trap> {
+        Ok(false)
+    }
 }
 
 struct DenyGrowth;
@@ -59,6 +63,10 @@ impl ResourceLimiter for DenyGrowth {
     fn memory_growing(&self, current: usize, _desired: usize, _maximum: Option<usize>) -> Result<bool, Trap> {
         Ok(current == 0)
     }
+
+    fn table_growing(&self, current: usize, _desired: usize, _maximum: Option<usize>) -> Result<bool, Trap> {
+        Ok(current == 0)
+    }
 }
 
 struct TrapGrowth;
@@ -67,6 +75,10 @@ impl ResourceLimiter for TrapGrowth {
     fn memory_growing(&self, current: usize, _desired: usize, _maximum: Option<usize>) -> Result<bool, Trap> {
         if current == 0 { Ok(true) } else { Err(Trap::Unreachable) }
     }
+
+    fn table_growing(&self, current: usize, _desired: usize, _maximum: Option<usize>) -> Result<bool, Trap> {
+        if current == 0 { Ok(true) } else { Err(Trap::Unreachable) }
+    }
 }
 
 #[test]
@@ -138,6 +150,33 @@ fn resource_limiter_rejects_module_memory_initial_size() -> TestResult {
     Ok(())
 }
 
+#[test]
+fn resource_limiter_rejects_table_initial_size() {
+    let mut store = store_with_limiter(Arc::new(DenyAll));
+    let result = Table::new(&mut store, TableType::new(RefType::FUNCREF, 1, None), RefValue::Null.into());
+
+    assert!(matches!(result, Err(tinywasm::Error::Trap(Trap::OutOfMemory))));
+}
+
+#[test]
+fn resource_limiter_can_reject_table_growth() -> TestResult {
+    let mut store = store_with_limiter(Arc::new(DenyGrowth));
+    let table = Table::new(&mut store, TableType::new(RefType::FUNCREF, 1, None), RefValue::Null.into())?;
+
+    assert_eq!(table.grow(&mut store, 1, RefValue::Null.into())?, None);
+    assert_eq!(table.size(&store)?, 1);
+    Ok(())
+}
+
+#[test]
+fn resource_limiter_can_trap_table_growth() -> TestResult {
+    let mut store = store_with_limiter(Arc::new(TrapGrowth));
+    let table = Table::new(&mut store, TableType::new(RefType::FUNCREF, 1, None), RefValue::Null.into())?;
+
+    assert!(matches!(table.grow(&mut store, 1, RefValue::Null.into()), Err(tinywasm::Error::Trap(Trap::Unreachable))));
+    Ok(())
+}
+
 #[test]
 fn resource_limiter_allows_guest_memory_grow_by_default() -> TestResult {
     let wasm = wat::parse_str(