Summary

The coroutinize pass (HWJS-3 coro arm, [hwjs-coro], emitted by wasmld) REFUSES a function that takes the address of a dynamic alloca/VLA and passes it to a callee (an opaque sink) across a coroutine suspend, and FATALs the whole final link. The pass already lowers the equivalent escape when it stays inside the delta=0-copied linear memory (DS6); this residual "escape to an opaque/host sink OUTSIDE the copied linear memory" case is refused rather than lowered.

Where it bites

Porting jq (meta-oe jq_1.7.1) for wasm32-hwjs glibc. jq's default build pulls in oniguruma (meta-oe onig_6.9.9) for its regex builtins. onig's disable_noname_group_capture() (src/regcomp.c) allocas a per-pattern GroupNumRemap map (a VLA sized by the pattern's capture-group count) and passes its address to the group-renumber walk — a callee the pass treats as an opaque sink — and that function suspends. The final link of the jq executable (which merges libjq + libonig) therefore refuses.

Evidence

Exactly one definition is refused (jq's own code links clean):

[hwjs-coro] REFUSE fn=disable_noname_group_capture
  reason=vla/dynamic-alloca-address-escape-opaque-sink escaped=1 opaque_escape=1
  ptrelem=0 across=0 dynalloca_total=1 suspends=2 (escape to an opaque/host sink
  OUTSIDE the delta=0-copied linear memory; in-MEMORY escape is DS6-lowered, this
  residual is not — never-silent)

wasmld: FATAL (HWJS-3 coro arm): the coroutinize pass REFUSED function(s) in the
  merged module (non-benign class, lines above). ... Stop-and-report.

Impact

Any wasm32-hwjs package that links oniguruma is unbuildable at --with-oniguruma; concretely it blocks jq's regex builtins (test/match/sub/gsub/scan/splits).

Workaround (applied downstream)

Build jq --without-oniguruma (a supported PACKAGECONFIG toggle). jq then links and ships with full core JSON filtering; only the regex builtins are unavailable. Recorded on our side as a gated skip in the on-target jq self-test.

Proposed fix (direction)

Extend the DS6-style lowering to the dynamic-alloca-address-escape-to-opaque-sink case (opaque_escape=1, dynalloca_total>=1) — the pass already handles the in-memory escape, so this is the residual sibling case rather than a new mechanism. Alternatively (upstream oniguruma), that one VLA could be heap-allocated, sidestepping the escape — but the general pass limitation would still refuse the next VLA-escape-across-suspend, so the pass-side lowering is the durable fix.

No candidate branch: this is a change inside the coroutinize pass (compiler internals), and I have no hwjs-cc checkout able to push a verified fix — filing with the root cause and direction for the maintainer.

Proposed fix targets brintos/hwjs-cc only — no distro submodule pins moved. All distros share one lineage, so pin bumps are coordinated on merge, not per-engineer.