From 1ebb4f3866e75996b20e8db7f65aa8da068676f8 Mon Sep 17 00:00:00 2001
From: Alejandro Alonso <alejandro.alonso@kaleidos.net>
Date: Wed, 14 Oct 2026 10:15:53 +0200
Subject: [PATCH] :wrench: Fail CI when render-wasm JS glue exports invoke_*V
 (#12243)

* :wrench: Fail CI when render-wasm JS glue exports invoke_*V

Add check-no-invoke-v (path from _build_env) and run it in CI: WASM
after a production frontend build so JS longjmp + SIMD ABI
regressions are caught in the pipeline.

* :bug: Fail closed in render-wasm invoke_* glue check

* :wrench: Check exporter wasm glue for any invoke_* wrapper

---------

Co-authored-by: Elena Torro <elenatorro@gmail.com>
---
 .github/workflows/tests-exporter.yml |  5 ++++
 .github/workflows/tests-wasm.yml     | 10 +++++++
 render-wasm/check-no-invoke-v        | 41 ++++++++++++++++++++++++++++
 3 files changed, 56 insertions(+)
 create mode 100755 render-wasm/check-no-invoke-v

diff --git a/.github/workflows/tests-exporter.yml b/.github/workflows/tests-exporter.yml
index 82b7b12f73..ed0da17b28 100644
--- a/.github/workflows/tests-exporter.yml
+++ b/.github/workflows/tests-exporter.yml
@@ -61,3 +61,8 @@ jobs:
         working-directory: ./exporter
         run: |
           ./scripts/test
+
+      - name: Check no invoke_* in exporter JS glue
+        working-directory: ./render-wasm
+        run: |
+          ./check-no-invoke-v export
diff --git a/.github/workflows/tests-wasm.yml b/.github/workflows/tests-wasm.yml
index f3e1547321..eac2d7ebf3 100644
--- a/.github/workflows/tests-wasm.yml
+++ b/.github/workflows/tests-wasm.yml
@@ -60,3 +60,13 @@ jobs:
         working-directory: ./render-wasm
         run: |
           ./test
+
+      - name: Build
+        working-directory: ./render-wasm
+        run: |
+          NODE_ENV=production ./build frontend
+
+      - name: Check no invoke_*V in JS glue
+        working-directory: ./render-wasm
+        run: |
+          ./check-no-invoke-v
diff --git a/render-wasm/check-no-invoke-v b/render-wasm/check-no-invoke-v
new file mode 100755
index 0000000000..b90502a235
--- /dev/null
+++ b/render-wasm/check-no-invoke-v
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Usage: ./check-no-invoke-v [frontend|export] [glue-path]
+#
+# Fail if the Emscripten JS glue has any invoke_* wrapper. With Wasm EH and
+# Wasm SjLj there should be none; invoke_*V (v128) throws a TypeError at the
+# JS boundary.
+set -euo pipefail
+
+_SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+TARGET=${1:-frontend}
+# _build_env reads NODE_ENV without a default; keep set -u happy.
+NODE_ENV=${NODE_ENV:-}
+RENDER_TARGET=$TARGET
+# shellcheck source=/dev/null
+. "$_SCRIPT_DIR/_build_env" "$TARGET"
+
+if [[ $# -ge 2 ]]; then
+  GLUE=$2
+elif [[ "$TARGET" = "export" ]]; then
+  GLUE="$_SCRIPT_DIR/$EXPORT_DEST/$BUILD_NAME.js"
+else
+  GLUE="$_SCRIPT_DIR/$FRONTEND_DEST/$BUILD_NAME.js"
+fi
+
+if [[ ! -f "$GLUE" ]]; then
+  echo "error: JS glue not found: $GLUE" >&2
+  echo "hint: run ./build $TARGET first" >&2
+  exit 1
+fi
+
+status=0
+grep -qE 'invoke_[A-Za-z0-9]+' "$GLUE" || status=$?
+
+if [[ $status -eq 0 ]]; then
+  echo "error: JS glue has invoke_* wrappers: $GLUE" >&2
+  grep -oE 'invoke_[A-Za-z0-9]+' "$GLUE" | sort -u >&2
+  exit 1
+elif [[ $status -gt 1 ]]; then
+  echo "error: grep failed on $GLUE" >&2
+  exit "$status"
+fi