Merge branch main into dev/checkpoint_and_restore

.github/scripts/codeql_buildscript.sh

@@ -126,6 +126,16 @@ if [[ $? != 0 ]]; then
     exit 1;
 fi
 
+# build iwasm with multi-memory enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_MULTI_MEMORY=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with multi-memory enabled!"
+    exit 1;
+fi
+
 # build iwasm with hardware boundary check disabled
 cd ${WAMR_DIR}/product-mini/platforms/linux
 rm -rf build && mkdir build && cd build
@@ -280,3 +290,23 @@ if [[ $? != 0 ]]; then
     echo "Failed to build iwasm with linux perf support enabled!"
     exit 1;
 fi
+
+# build iwasm with shared heap enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_SHARED_HEAP=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm with shared heap enabled!"
+    exit 1;
+fi
+
+# build iwasm with dynamic aot debug enabled
+cd ${WAMR_DIR}/product-mini/platforms/linux
+rm -rf build && mkdir build && cd build
+cmake .. -DCMAKE_BUILD_TYPE=Debug -DWAMR_BUILD_DYNAMIC_AOT_DEBUG=1
+make -j
+if [[ $? != 0 ]]; then
+    echo "Failed to build iwasm dynamic aot debug enabled!"
+    exit 1;
+fi

.github/workflows/build_docker_images.yml

@@ -15,9 +15,14 @@ on:
         type: string
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   build-and-push-images:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write # for uploading release artifacts
 
     steps:
       - name: Checkout repository

.github/workflows/build_iwasm_release.yml

@@ -31,9 +31,78 @@ on:
         type: string
         required: false
 
+env:
+  DEFAULT_BUILD_OPTIONS: 
+    "-DWAMR_BUILD_AOT=1 -DWAMR_BUILD_INTERP=1 -DWAMR_BUILD_FAST_JIT=1 -DWAMR_BUILD_JIT=1 \
+     -DWAMR_BUILD_CUSTOM_NAME_SECTION=0 \
+     -DWAMR_BUILD_DEBUG_INTERP=0 \
+     -DWAMR_BUILD_DEBUG_AOT=0 \
+     -DWAMR_BUILD_DUMP_CALL_STACK=0 \
+     -DWAMR_BUILD_LIBC_UVWASI=0 \
+     -DWAMR_BUILD_LIBC_EMCC=0 \
+     -DWAMR_BUILD_LIB_RATS=0 \
+     -DWAMR_BUILD_LOAD_CUSTOM_SECTION=0 \
+     -DWAMR_BUILD_MEMORY_PROFILING=0 \
+     -DWAMR_BUILD_MINI_LOADER=0 \
+     -DWAMR_BUILD_MULTI_MODULE=0 \
+     -DWAMR_BUILD_PERF_PROFILING=0 \
+     -DWAMR_BUILD_SPEC_TEST=0 \
+     -DWAMR_BUILD_BULK_MEMORY=1 \
+     -DWAMR_BUILD_LIB_PTHREAD=1 \
+     -DWAMR_BUILD_LIB_PTHREAD_SEMAPHORE=1 \
+     -DWAMR_BUILD_LIB_WASI_THREADS=1 \
+     -DWAMR_BUILD_LIBC_BUILTIN=1 \
+     -DWAMR_BUILD_LIBC_WASI=1 \
+     -DWAMR_BUILD_REF_TYPES=1 \
+     -DWAMR_BUILD_SIMD=1 \
+     -DWAMR_BUILD_SHARED_MEMORY=1 \
+     -DWAMR_BUILD_TAIL_CALL=1 \
+     -DWAMR_BUILD_THREAD_MGR=1"
+  GC_EH_BUILD_OPTIONS:
+    "-DWAMR_BUILD_AOT=1 -DWAMR_BUILD_INTERP=1 -DWAMR_BUILD_FAST_INTERP=0 -DWAMR_BUILD_FAST_JIT=0 -DWAMR_BUILD_JIT=0 \
+     -DWAMR_BUILD_CUSTOM_NAME_SECTION=0 \
+     -DWAMR_BUILD_DEBUG_INTERP=0 \
+     -DWAMR_BUILD_DEBUG_AOT=0 \
+     -DWAMR_BUILD_DUMP_CALL_STACK=0 \
+     -DWAMR_BUILD_LIBC_UVWASI=0 \
+     -DWAMR_BUILD_LIBC_EMCC=0 \
+     -DWAMR_BUILD_LIB_RATS=0 \
+     -DWAMR_BUILD_LOAD_CUSTOM_SECTION=0 \
+     -DWAMR_BUILD_MEMORY_PROFILING=0 \
+     -DWAMR_BUILD_MINI_LOADER=0 \
+     -DWAMR_BUILD_MULTI_MODULE=0 \
+     -DWAMR_BUILD_PERF_PROFILING=0 \
+     -DWAMR_BUILD_SPEC_TEST=0 \
+     -DWAMR_BUILD_BULK_MEMORY=1 \
+     -DWAMR_BUILD_LIB_PTHREAD=1 \
+     -DWAMR_BUILD_LIB_PTHREAD_SEMAPHORE=1 \
+     -DWAMR_BUILD_LIB_WASI_THREADS=1 \
+     -DWAMR_BUILD_LIBC_BUILTIN=1 \
+     -DWAMR_BUILD_LIBC_WASI=1 \
+     -DWAMR_BUILD_REF_TYPES=1 \
+     -DWAMR_BUILD_SIMD=1 \
+     -DWAMR_BUILD_SHARED_MEMORY=1 \
+     -DWAMR_BUILD_TAIL_CALL=1 \
+     -DWAMR_BUILD_THREAD_MGR=1 \
+     -DWAMR_BUILD_EXCE_HANDLING=1 \
+     -DWAMR_BUILD_GC=1"
+
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ inputs.runner }}
+    strategy:
+      matrix:
+        include:
+          - build_options: $DEFAULT_BUILD_OPTIONS
+            suffix: ''
+          - build_options: $GC_EH_BUILD_OPTIONS
+            suffix: '-gc-eh'
+    permissions:
+      contents: write # for uploading release artifacts
+
     steps:
       - uses: actions/checkout@v4
 
@@ -51,40 +120,25 @@ jobs:
           fail-on-cache-miss: true
 
       - name: generate iwasm binary release
+        shell: bash
         run: |
-          cmake -S . -B build \
-            -DWAMR_BUILD_AOT=1 -DWAMR_BUILD_INTERP=1 -DWAMR_BUILD_FAST_JIT=1 -DWAMR_BUILD_JIT=1 \
-            -DWAMR_BUILD_CUSTOM_NAME_SECTION=0 \
-            -DWAMR_BUILD_DEBUG_INTERP=0 \
-            -DWAMR_BUILD_DEBUG_AOT=0 \
-            -DWAMR_BUILD_DUMP_CALL_STACK=0 \
-            -DWAMR_BUILD_LIBC_UVWASI=0 \
-            -DWAMR_BUILD_LIBC_EMCC=0 \
-            -DWAMR_BUILD_LIB_RATS=0 \
-            -DWAMR_BUILD_LOAD_CUSTOM_SECTION=0 \
-            -DWAMR_BUILD_MEMORY_PROFILING=0 \
-            -DWAMR_BUILD_MINI_LOADER=0 \
-            -DWAMR_BUILD_MULTI_MODULE=0 \
-            -DWAMR_BUILD_PERF_PROFILING=0 \
-            -DWAMR_BUILD_SPEC_TEST=0 \
-            -DWAMR_BUILD_BULK_MEMORY=1 \
-            -DWAMR_BUILD_LIB_PTHREAD=1 \
-            -DWAMR_BUILD_LIB_PTHREAD_SEMAPHORE=1 \
-            -DWAMR_BUILD_LIB_WASI_THREADS=1 \
-            -DWAMR_BUILD_LIBC_BUILTIN=1 \
-            -DWAMR_BUILD_LIBC_WASI=1 \
-            -DWAMR_BUILD_REF_TYPES=1 \
-            -DWAMR_BUILD_SIMD=1 \
-            -DWAMR_BUILD_SHARED_MEMORY=1 \
-            -DWAMR_BUILD_TAIL_CALL=1 \
-            -DWAMR_BUILD_THREAD_MGR=1
+          cmake -S . -B build ${{ matrix.build_options }}
           cmake --build build --config Release --parallel 4
         working-directory: ${{ inputs.cwd }}
 
-      - name: compress the binary
+      - name: Compress the binary on Windows
+        if: inputs.runner == 'windows-latest'
+        run: |
+          tar -czf iwasm${{ matrix.suffix }}-${{ inputs.ver_num }}-${{ inputs.runner }}.tar.gz iwasm.exe
+          Compress-Archive -Path iwasm.exe -DestinationPath iwasm${{ matrix.suffix }}-${{ inputs.ver_num }}-${{ inputs.runner }}.zip
+          mv iwasm${{ matrix.suffix }}-${{ inputs.ver_num }}-${{ inputs.runner }}.* ../
+        working-directory: ${{ inputs.cwd }}/build/Release
+
+      - name: compress the binary on non-Windows
+        if: inputs.runner != 'windows-latest'
         run: |
-          tar czf iwasm-${{ inputs.ver_num }}-${{ inputs.runner }}.tar.gz iwasm
-          zip iwasm-${{ inputs.ver_num }}-${{ inputs.runner }}.zip iwasm
+          tar czf iwasm${{ matrix.suffix }}-${{ inputs.ver_num }}-${{ inputs.runner }}.tar.gz iwasm
+          zip iwasm${{ matrix.suffix }}-${{ inputs.ver_num }}-${{ inputs.runner }}.zip iwasm
         working-directory: ${{ inputs.cwd }}/build
 
       - name: upload release tar.gz
@@ -93,8 +147,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           upload_url: ${{ inputs.upload_url }}
-          asset_path: ${{ inputs.cwd }}/build/iwasm-${{ inputs.ver_num }}-${{ inputs.runner }}.tar.gz
-          asset_name: iwasm-${{ inputs.ver_num }}-${{ inputs.arch }}-${{ inputs.runner }}.tar.gz
+          asset_path: ${{ inputs.cwd }}/build/iwasm${{ matrix.suffix }}-${{ inputs.ver_num }}-${{ inputs.runner }}.tar.gz
+          asset_name: iwasm${{ matrix.suffix }}-${{ inputs.ver_num }}-${{ inputs.arch }}-${{ inputs.runner }}.tar.gz
           asset_content_type: application/x-gzip
 
       - name: upload release zip
@@ -103,6 +157,6 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           upload_url: ${{ inputs.upload_url }}
-          asset_path: ${{ inputs.cwd }}/build/iwasm-${{ inputs.ver_num }}-${{ inputs.runner }}.zip
-          asset_name: iwasm-${{ inputs.ver_num }}-${{ inputs.arch }}-${{ inputs.runner }}.zip
+          asset_path: ${{ inputs.cwd }}/build/iwasm${{ matrix.suffix }}-${{ inputs.ver_num }}-${{ inputs.runner }}.zip
+          asset_name: iwasm${{ matrix.suffix }}-${{ inputs.ver_num }}-${{ inputs.arch }}-${{ inputs.runner }}.zip
           asset_content_type: application/zip

.github/workflows/build_llvm_libraries.yml

@@ -27,6 +27,9 @@ on:
         description: "A cached key of LLVM libraries"
         value: ${{ jobs.build_llvm_libraries.outputs.key}}
 
+permissions:
+  contents: read
+
 jobs:
   build_llvm_libraries:
     runs-on: ${{ inputs.os }}
@@ -36,13 +39,17 @@ jobs:
       image: ${{ inputs.container_image }}
     outputs:
       key: ${{ steps.create_lib_cache_key.outputs.key}}
+    permissions:
+      contents: read
+      actions: write # for uploading cached artifact
 
     steps:
       - name: checkout
         uses: actions/checkout@v4
 
       - name: install dependencies for non macos-14
         if: inputs.os != 'macos-14'
+        shell: bash
         run: /usr/bin/env python3 -m pip install -r requirements.txt
         working-directory: build-scripts
 
@@ -51,18 +58,23 @@ jobs:
         run: /usr/bin/env python3 -m pip install -r requirements.txt --break-system-packages
         working-directory: build-scripts
 
-      - name: retrieve the last commit ID
+      - name: Retrieve the last commit ID
         id: get_last_commit
-        run: echo "last_commit=$(GH_TOKEN=${{ secrets.GITHUB_TOKEN }} /usr/bin/env python3 ./build_llvm.py ${{ inputs.extra_build_llvm_options }} --llvm-ver)" >> $GITHUB_OUTPUT
-        working-directory: build-scripts
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          echo "last_commit=$(GH_TOKEN=${{ secrets.GITHUB_TOKEN }} /usr/bin/env python3 ./build_llvm.py ${{ inputs.extra_build_llvm_options }} --llvm-ver)" >> $GITHUB_OUTPUT
 
       # Bump the prefix number to evict all previous caches and
       # enforce a clean build, in the unlikely case that some
       # weird build error occur and llvm/build becomes a potential
       # suspect.
       - name: form the cache key of libraries
         id: create_lib_cache_key
-        run: echo "key=0-llvm-libraries-${{ inputs.os }}-${{ inputs.arch }}-${{ steps.get_last_commit.outputs.last_commit }}${{ inputs.cache_key_suffix }}" >> $GITHUB_OUTPUT
+        shell: bash
+        run: |
+          echo "key=0-llvm-libraries-${{ inputs.os }}-${{ inputs.arch }}-${{ steps.get_last_commit.outputs.last_commit }}${{ inputs.cache_key_suffix }}" >> $GITHUB_OUTPUT
 
       - name: Cache LLVM libraries
         id: retrieve_llvm_libs
@@ -107,7 +119,20 @@ jobs:
       - run: brew install ccache ninja
         if: steps.retrieve_llvm_libs.outputs.cache-hit != 'true' && startsWith(inputs.os, 'macos')
 
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/ccache
+          key: 0-ccache-${{ inputs.os }}-${{ steps.get_last_commit.outputs.last_commit }}
+          restore-keys: |
+            0-ccache-${{ inputs.os }}
+        if: steps.retrieve_llvm_libs.outputs.cache-hit != 'true' && inputs.os == 'windows-latest'
+
+      # Install tools on Windows
+      - run: choco install -y ccache ninja
+        if: steps.retrieve_llvm_libs.outputs.cache-hit != 'true' && inputs.os == 'windows-latest'
+
       - name: Build LLVM libraries
         if: steps.retrieve_llvm_libs.outputs.cache-hit != 'true'
+        shell: bash
         run: /usr/bin/env python3 ./build_llvm.py ${{ inputs.extra_build_llvm_options }} --arch ${{ inputs.arch }}
         working-directory: build-scripts

.github/workflows/build_wamr_lldb.yml

@@ -28,8 +28,13 @@ on:
         required: false
         default: "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-20/wasi-sdk-20.0-linux.tar.gz"
 
+permissions:
+  contents: read
+
 jobs:
   try_reuse:
+    permissions:
+      contents: write # for uploading release artifacts
     uses: ./.github/workflows/reuse_latest_release_binaries.yml
     with:
       binary_name_stem: "wamr-lldb-${{ inputs.ver_num }}-${{ inputs.arch }}-${{ inputs.runner }}"
@@ -46,6 +51,9 @@ jobs:
       PYTHON_VERSION: '3.10'
       PYTHON_UBUNTU_STANDALONE_BUILD: https://github.com/indygreg/python-build-standalone/releases/download/20230507/cpython-3.10.11+20230507-x86_64-unknown-linux-gnu-install_only.tar.gz
       PYTHON_MACOS_STANDALONE_BUILD: https://github.com/indygreg/python-build-standalone/releases/download/20230507/cpython-3.10.11+20230507-x86_64-apple-darwin-install_only.tar.gz
+    permissions:
+      contents: write # for uploading release artifacts
+
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/build_wamr_sdk.yml

@@ -35,9 +35,15 @@ on:
         type: string
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ inputs.runner }}
+    permissions:
+      contents: write # for uploading release artifacts
+
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/build_wamr_vscode_ext.yml

@@ -14,9 +14,15 @@ on:
         type: string
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write # for uploading release artifacts
+
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/build_wamrc.yml

@@ -31,9 +31,15 @@ on:
         type: string
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ inputs.runner }}
+    permissions:
+      contents: write # for uploading release artifacts
+
     steps:
       - uses: actions/checkout@v4
 
@@ -56,8 +62,16 @@ jobs:
           cmake --build build --config Release --parallel 4
         working-directory: wamr-compiler
 
-      - name: compress the binary
-        if: inputs.release
+      - name: Compress the binary on Windows
+        if: inputs.runner == 'windows-latest' && inputs.release
+        run: |
+          tar -czf wamrc-${{ inputs.ver_num }}-${{ inputs.runner }}.tar.gz wamrc.exe
+          Compress-Archive -Path wamrc.exe -DestinationPath wamrc-${{ inputs.ver_num }}-${{ inputs.runner }}.zip
+          mv wamrc-${{ inputs.ver_num }}-${{ inputs.runner }}.* ../
+        working-directory: wamr-compiler/build/Release
+
+      - name: compress the binary on non-Windows
+        if: inputs.runner != 'windows-latest' && inputs.release
         run: |
           tar czf wamrc-${{ inputs.ver_num }}-${{ inputs.runner }}.tar.gz wamrc
           zip wamrc-${{ inputs.ver_num }}-${{ inputs.runner }}.zip wamrc