fast-interp: legacy exception handling (try/catch/rethrow/delegate/tag)

.clang-format

@@ -1,4 +1,4 @@
-# using [clang-formt-12 options](https://releases.llvm.org/12.0.0/tools/clang/docs/ClangFormatStyleOptions.html)
+# using [clang-format-21 options](https://releases.llvm.org/21.1.0/tools/clang/docs/ClangFormatStyleOptions.html)
 RawStringFormats:
   - Language: Cpp
     Delimiters:

.github/actions/install-wasi-sdk-wabt/action.yml

@@ -15,6 +15,13 @@ inputs:
   os:
     description: "Operating system to install on (ubuntu, macos)"
     required: true
+  # Default 29 because addr2line.py (samples/debug-tools*) requires
+  # llvm-symbolizer / llvm-addr2line, which only ship in wasi-sdk 29+.
+  # Callers can pin a different version when they have a specific need.
+  wasi_sdk_version:
+    description: "wasi-sdk major version to install (e.g. '25', '29', '33')"
+    required: false
+    default: "29"
 
 runs:
   using: "composite"
@@ -29,13 +36,17 @@ runs:
     - name: Set up wasi-sdk and wabt on Ubuntu
       if: ${{ startsWith(inputs.os, 'ubuntu') }}
       shell: bash
+      env:
+        SDK_VER: ${{ inputs.wasi_sdk_version }}
       run: |
+        SDK_DIR="wasi-sdk-${SDK_VER}.0-x86_64-linux"
         echo "Downloading wasi-sdk for Ubuntu..."
-        sudo wget -O wasi-sdk.tar.gz --progress=dot:giga https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-25/wasi-sdk-25.0-x86_64-linux.tar.gz
+        sudo wget -O wasi-sdk.tar.gz --progress=dot:giga \
+          "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${SDK_VER}/${SDK_DIR}.tar.gz"
 
         echo "Extracting wasi-sdk..."
         sudo tar -xf wasi-sdk.tar.gz
-        sudo ln -sf  wasi-sdk-25.0-x86_64-linux/ wasi-sdk
+        sudo ln -sf "${SDK_DIR}/" wasi-sdk
 
         echo "Downloading wabt for Ubuntu..."
         sudo wget -O wabt.tar.gz     --progress=dot:giga https://github.com/WebAssembly/wabt/releases/download/1.0.37/wabt-1.0.37-ubuntu-20.04.tar.gz
@@ -47,19 +58,23 @@ runs:
         /opt/wasi-sdk/bin/clang --version
         /opt/wabt/bin/wasm-interp --version
 
-        echo "::notice::wasi-sdk-25 and wabt-1.0.37 installed on ubuntu"
+        echo "::notice::wasi-sdk-${SDK_VER} and wabt-1.0.37 installed on ubuntu"
       working-directory: /opt
 
     - name: Set up wasi-sdk and wabt on macOS on Intel
       if: ${{ inputs.os == 'macos-15-intel' }}
       shell: bash
+      env:
+        SDK_VER: ${{ inputs.wasi_sdk_version }}
       run: |
+        SDK_DIR="wasi-sdk-${SDK_VER}.0-x86_64-macos"
         echo "Downloading wasi-sdk for macOS on Intel..."
-        sudo wget -O wasi-sdk.tar.gz --progress=dot:giga https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-25/wasi-sdk-25.0-x86_64-macos.tar.gz
+        sudo wget -O wasi-sdk.tar.gz --progress=dot:giga \
+          "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${SDK_VER}/${SDK_DIR}.tar.gz"
 
         echo "Extracting wasi-sdk..."
         sudo tar -xf wasi-sdk.tar.gz
-        sudo ln -sf  wasi-sdk-25.0-x86_64-macos wasi-sdk
+        sudo ln -sf "${SDK_DIR}" wasi-sdk
 
         echo "Downloading wabt for macOS on Intel..."
         sudo wget -O wabt.tar.gz     --progress=dot:giga https://github.com/WebAssembly/wabt/releases/download/1.0.36/wabt-1.0.36-macos-12.tar.gz
@@ -71,19 +86,23 @@ runs:
         /opt/wasi-sdk/bin/clang --version
         /opt/wabt/bin/wasm-interp --version
 
-        echo "::notice::wasi-sdk-25 and wabt-1.0.36 installed on ${{ inputs.os }}"
+        echo "::notice::wasi-sdk-${SDK_VER} and wabt-1.0.36 installed on ${{ inputs.os }}"
       working-directory: /opt
 
     - name: Set up wasi-sdk and wabt on macOS on ARM
       if: ${{ inputs.os == 'macos-15' }}
       shell: bash
+      env:
+        SDK_VER: ${{ inputs.wasi_sdk_version }}
       run: |
+        SDK_DIR="wasi-sdk-${SDK_VER}.0-arm64-macos"
         echo "Downloading wasi-sdk for macOS on ARM..."
-        sudo wget -O wasi-sdk.tar.gz --progress=dot:giga https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-25/wasi-sdk-25.0-arm64-macos.tar.gz
+        sudo wget -O wasi-sdk.tar.gz --progress=dot:giga \
+          "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${SDK_VER}/${SDK_DIR}.tar.gz"
 
         echo "Extracting wasi-sdk..."
         sudo tar -xf wasi-sdk.tar.gz
-        sudo ln -sf  wasi-sdk-25.0-arm64-macos wasi-sdk
+        sudo ln -sf "${SDK_DIR}" wasi-sdk
 
         echo "Downloading wabt for macOS on ARM..."
         sudo wget -O wabt.tar.gz     --progress=dot:giga https://github.com/WebAssembly/wabt/releases/download/1.0.37/wabt-1.0.37-macos-14.tar.gz
@@ -95,20 +114,23 @@ runs:
         /opt/wasi-sdk/bin/clang --version
         /opt/wabt/bin/wasm-interp --version
 
-        echo "::notice::wasi-sdk-25 and wabt-1.0.37 installed on ${{ inputs.os }}"
+        echo "::notice::wasi-sdk-${SDK_VER} and wabt-1.0.37 installed on ${{ inputs.os }}"
       working-directory: /opt
 
     - name: Set up wasi-sdk and wabt on Windows
       if: ${{ startsWith(inputs.os, 'windows') }}
       shell: bash
+      env:
+        SDK_VER: ${{ inputs.wasi_sdk_version }}
       run: |
         choco install -y wget
 
         mkdir -p /opt/wasi-sdk
         mkdir -p /opt/wabt
 
         echo "Downloading wasi-sdk for Windows..."
-        wget -O wasi-sdk.tar.gz --progress=dot:giga https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-25/wasi-sdk-25.0-x86_64-windows.tar.gz
+        wget -O wasi-sdk.tar.gz --progress=dot:giga \
+          "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${SDK_VER}/wasi-sdk-${SDK_VER}.0-x86_64-windows.tar.gz"
 
         echo "Extracting wasi-sdk..."
         tar --strip-components=1 -xf wasi-sdk.tar.gz -C /opt/wasi-sdk
@@ -122,4 +144,4 @@ runs:
         /opt/wasi-sdk/bin/clang --version
         /opt/wabt/bin/wasm-interp --version
 
-        echo "::notice::wasi-sdk-25 and wabt-1.0.37 installed on Windows"
+        echo "::notice::wasi-sdk-${SDK_VER} and wabt-1.0.37 installed on Windows"

.github/scripts/codeql_buildscript.sh

@@ -19,9 +19,20 @@ sudo wget --progress=dot:giga -O clang+llvm-x86_64-linux-gnu.tar.xz https://gith
 popd
 
 # libtinfo.so.5 for /opt/llvm-18.1.8/lib/libomptarget.rtl.amdgpu.so.18.1
+# Install the libtinfo5 compat package at the same ncurses version as the
+# runner's already-installed libtinfo6; fall back to the newest one in the
+# pool. A hard-coded URL 404s once the ncurses point release is bumped, which
+# then breaks the wamrc link against libomptarget (NCURSES_TINFO_5 symbols).
 sudo apt -qq update
-wget http://security.ubuntu.com/ubuntu/pool/universe/n/ncurses/libtinfo5_6.3-2ubuntu0.1_amd64.deb
-sudo apt install -y -qq ./libtinfo5_6.3-2ubuntu0.1_amd64.deb
+nc_pool="http://security.ubuntu.com/ubuntu/pool/universe/n/ncurses"
+nc_ver="$(dpkg-query -W -f='${Version}' libtinfo6)"
+libtinfo5_deb="libtinfo5_${nc_ver}_amd64.deb"
+if ! wget -q "${nc_pool}/${libtinfo5_deb}"; then
+  libtinfo5_deb="$(wget -qO- "${nc_pool}/" \
+    | grep -oE 'libtinfo5_[0-9][^"]*_amd64\.deb' | sort -Vu | tail -1)"
+  wget -q "${nc_pool}/${libtinfo5_deb}"
+fi
+sudo apt install -y -qq "./${libtinfo5_deb}"
 
 # Start the build process
 WAMR_DIR=${PWD}

.github/scripts/codeql_fail_on_error.py

@@ -61,9 +61,15 @@ def codeql_sarif_contain_error(filename, dismissed_alerts):
         s = json.load(f)
 
     for run in s.get("runs", []):
-        rules_metadata = run["tool"]["driver"]["rules"]
+        # Rule metadata isn't always in one place: CodeQL keeps it on the tool
+        # driver, but rules contributed by a query-pack extension live on that
+        # extension instead, and the driver's list is empty when nothing fired.
+        # So read the driver rules, then fall back to gathering them from the
+        # extensions rather than assuming a fixed location.
+        rules_metadata = run["tool"]["driver"].get("rules") or []
         if not rules_metadata:
-            rules_metadata = run["tool"]["extensions"][0]["rules"]
+            for ext in run["tool"].get("extensions", []):
+                rules_metadata += ext.get("rules", [])
 
         for res in run.get("results", []):
             if "ruleIndex" in res:

.github/workflows/build_docker_images.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: Build and save Docker image(wasm-debug-server:${{ inputs.ver_num }}) to tar file
         run: |

.github/workflows/build_iwasm_release.yml

@@ -104,11 +104,11 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: get cached LLVM libraries
         id: retrieve_llvm_libs
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm/build/bin

.github/workflows/build_llvm_libraries.yml

@@ -45,7 +45,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: install dependencies for non macos
         if: ${{ !startsWith(inputs.os, 'macos') }}
@@ -79,7 +79,7 @@ jobs:
 
       - name: Cache LLVM libraries
         id: retrieve_llvm_libs
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm/build/bin

.github/workflows/build_wamr_lldb.yml

@@ -55,7 +55,7 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: download and install wasi-sdk
         run: |
@@ -68,7 +68,7 @@ jobs:
 
       - name: Cache build
         id: lldb_build_cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm-project/build/bin

.github/workflows/build_wamr_sdk.yml

@@ -45,7 +45,7 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: download wamr-app-framework
         run: |

.github/workflows/build_wamr_vscode_ext.yml

@@ -24,7 +24,7 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: Use Node.js 18.x
         uses: actions/setup-node@v6

.github/workflows/build_wamr_wasi_extensions.yml

@@ -28,7 +28,7 @@ jobs:
         os: [ubuntu-22.04]
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: install-wasi-sdk-wabt
         uses: ./.github/actions/install-wasi-sdk-wabt

.github/workflows/build_wamrc.yml

@@ -41,11 +41,11 @@ jobs:
       contents: write # for uploading release artifacts
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v7.0.0
 
       - name: get cached LLVM libraries
         id: retrieve_llvm_libs
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ./core/deps/llvm/build/bin

.github/workflows/check_version_h.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
 
       - name: cmake execute to generate version.h
         run: cmake -B build_version -S .

.github/workflows/codeql.yml

@@ -9,17 +9,35 @@ on:
   push:
     branches:
       - dev/**
+  # scan pull requests so findings surface on the PR instead of only post-merge
+  pull_request:
   # midnight UTC on the latest commit on the main branch
   schedule:
     - cron: "0 0 * * *"
   # allow to be triggered manually
   workflow_dispatch:
 
+# Serialize CodeQL runs per PR / branch. Only a pull_request cancels its own
+# superseded run - once a PR head is replaced the old analysis is throwaway.
+# Pushes to dev/** and the nightly cron are left to finish, so branch and
+# scheduled scans are never dropped.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   analyze:
-    # only run this job if the repository is not a fork
-    # if want to run this job on a fork, please remove the if condition
-    if: github.repository == 'bytecodealliance/wasm-micro-runtime'
+    # Pull requests: only scan when the head branch lives in this same
+    # repository. A pull request from a fork runs with a read-only GITHUB_TOKEN
+    # (no `security-events: write`), so uploading results and reading
+    # code-scanning alerts is not permitted and the job would fail; skip it
+    # cleanly instead. Other events (push to dev/**, the nightly cron, manual
+    # runs) keep the original behavior of running only on the upstream repo.
+    if: >-
+      (github.event_name == 'pull_request' &&
+       github.event.pull_request.head.repo.full_name == github.repository)
+      || (github.event_name != 'pull_request' &&
+          github.repository == 'bytecodealliance/wasm-micro-runtime')
     name: Analyze
     # Runner size impacts CodeQL analysis time. To learn more, please see:
     #   - https://gh.io/recommended-hardware-resources-for-running-codeql
@@ -43,13 +61,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
         with:
           submodules: recursive
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.36.0
+        uses: github/codeql-action/init@v4.37.0
         with:
           languages: ${{ matrix.language }}
           # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
@@ -61,7 +79,7 @@ jobs:
           ./.github/scripts/codeql_buildscript.sh || exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.36.0
+        uses: github/codeql-action/analyze@v4.37.0
         with:
           category: "/language:${{matrix.language}}"
           upload: false
@@ -114,7 +132,7 @@ jobs:
           output: ${{ steps.step1.outputs.sarif-output }}/cpp.sarif
 
       - name: Upload CodeQL results to code scanning
-        uses: github/codeql-action/upload-sarif@v4.36.0
+        uses: github/codeql-action/upload-sarif@v4.37.0
         with:
           sarif_file: ${{ steps.step1.outputs.sarif-output }}
           category: "/language:${{matrix.language}}"

.github/workflows/coding_guidelines.yml

@@ -19,13 +19,29 @@ permissions:
 
 jobs:
   compliance_job:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - name: checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
 
+      - name: install clang-format-21
+        run: |
+          # clang-format 21 matches the LLVM shipped in Xcode 26/27, so
+          # contributors who build or auto-format on macOS/Xcode get the same
+          # result as CI and other LLVM-built platforms - no formatting
+          # surprises. It is a small (~50 MB) apt package from apt.llvm.org,
+          # not a full LLVM toolchain download.
+          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key \
+            | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc >/dev/null
+          . /etc/os-release
+          echo "deb http://apt.llvm.org/${VERSION_CODENAME}/ llvm-toolchain-${VERSION_CODENAME}-21 main" \
+            | sudo tee /etc/apt/sources.list.d/llvm.list >/dev/null
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq clang-format-21
+          clang-format-21 --version
+
       # github.event.pull_request.base.label = ${{github.repository}}/${{github.base_ref}}
       - name: Run Coding Guidelines Checks
         run: /usr/bin/env python3 ./ci/coding_guidelines_check.py --commits ${{ github.event.pull_request.base.sha }}..HEAD