wasm/v8: Source wee8 from envoy_toolshed prebuilt via label_flag

[dcillera]

Commit Message: wasm/v8: Source wee8 from envoy_toolshed prebuilt via label_flag

Additional Description:

This wires Envoy's proxy-wasm V8 engine to consume the prebuilt wee8 static
library published by envoy_toolshed, instead of building V8 from source
(~30–120 min → seconds), while keeping the change working in both WORKSPACE
and bzlmod modes.

Mechanism — a label_flag, not a hardcoded rewrite

proxy-wasm-cpp-host's v8_lib depends on //bazel:wee8_no_pointer_compression,
which wraps @v8//:wee8 and therefore builds V8 from source. To use the prebuilt
that dep must be redirected to @envoy_toolshed//v8:wee8.

The previous WORKSPACE-only approach hardcoded that redirect inside proxy-wasm's
BUILD — which only works because WORKSPACE has a flat, global repo namespace.
Under bzlmod's strict per-module repo visibility, a label inside proxy-wasm
resolves against proxy-wasm's own repo mapping, which does not declare
@envoy_toolshed (fails with No repository visible as '@envoy_toolshed').
override_repo/overrides are root-module-only, so the redirect can't live in the
envoy_toolshed dep either.

The portable fix: proxy-wasm's v8 engine dep becomes a
label_flag //bazel:v8_engine (default :wee8_no_pointer_compression, preserving
upstream from-source behaviour). The root module (Envoy) sets the flag value to
@envoy_toolshed//v8:wee8. A root-set label_flag value resolves in the root's
repo mapping — where @envoy_toolshed is a bazel_dep — so the same seam works in
WORKSPACE and bzlmod. The patch bakes in no Envoy-specific repo, making it a
candidate to upstream into proxy-wasm-cpp-host.

This is complementary to the existing //bazel:engine string_flag (which selects
which wasm engine): the new //bazel:v8_engine label_flag selects which V8
source (prebuilt vs from-source).

@envoy_toolshed//v8:wee8 is a platform-agnostic alias that selects the right
prebuilt per platform (linux x86_64/aarch64, libcxx/libstdc++) and falls back to
@v8//:wee8 from-source on unsupported platforms — so no platform loses support.

Changes

• bazel/proxy_wasm_cpp_host.patch: add label_flag(name = "v8_engine", build_setting_default = ":wee8_no_pointer_compression"); point v8_lib deps at
  //bazel:v8_engine. (Regenerated from pristine proxy-wasm; round-trip verified.)
• .bazelrc: build --@proxy-wasm-cpp-host//bazel:v8_engine=@envoy_toolshed//v8:wee8.
• bazel/repositories_extra.bzl: setup_wee8_prebuilt() to define the
  @wee8_prebuilt_* repos. Requires envoy_toolshed >= 0.4.9 (already pinned on main).

Status / follow-ups (draft PR — showcasing the milestone)

• ✅ Works end-to-end in the real Envoy tree today (WORKSPACE mode). See Testing.
• ⬜ Full Envoy-in-bzlmod wiring is staged follow-up gated on the broader bzlmod
  migration: envoy_toolshed as a bazel_dep, swapping setup_wee8_prebuilt()
  for the wee8_prebuilt_extension use_repo, and proxy-wasm gaining a
  MODULE.bazel. The label_flag seam is ready for all of that today.
• ⬜ Optionally upstream the generic label_flag to proxy-wasm-cpp-host.

Risk Level: Low — default flag value preserves upstream from-source behaviour;
prebuilt path falls back to source on unsupported platforms; no BUILD/source edits
outside the patch and dependency wiring.

Testing: Full ./ci/do_ci.sh dev (docker, WORKSPACE, published envoy_toolshed
0.4.9 prebuilt): envoy-static and all test binaries link against the prebuilt
libwee8.a with no undefined symbols. 1695/1702 tests pass; the 7 failures are
unrelated env/flaky integration tests (IPv6-less docker on DNS/forward-proxy cases,
a mount-permissions shell test, redis fake-upstream segfaults, one flaky geoip) — no
wasm/v8 targets among them. cquery on @proxy-wasm-cpp-host//:v8_lib shows
@wee8_prebuilt_x86_64//:wee8 + lib/libwee8.a and zero @v8// references.

Docs Changes: N/A

Release Notes: N/A (build/dependency wiring; no user-facing behaviour change)

Platform Specific Features: Prebuilt wee8 available for linux x86_64 (libcxx +
libstdc++) and aarch64 (libcxx); other platforms transparently fall back to building
V8 from source.

[repokitteh-read-only]

As a reminder, PRs marked as draft will not be automatically assigned reviewers,
or be handled by maintainer-oncall triage.

Please mark your PR as ready when you want it to be reviewed!

🐱

Caused by: #47108 was opened by dcillera.

see: more, trace.

[phlax]

i think the absl libs have to be added at consumer with current toolshed build - not sure if that is best way - but something like this should probs work ...

envoy_cc_library(
    name = "wee8_compile_lib",
    srcs = ["wee8_compile.cc"],
    copts = [
        "-Wno-comments",
        "-Wno-non-virtual-dtor",
        "-Wno-unused-parameter",
    ],
    deps = [
        "@com_google_absl//absl/container:flat_hash_map",
        "@com_google_absl//absl/container:flat_hash_set",
        "@com_google_absl//absl/hash",
        "@com_google_absl//absl/synchronization",
        "@proxy-wasm-cpp-host//:base_lib",
        "@proxy-wasm-cpp-host//:v8_lib",
    ],
)

[dcillera]

Thanks @phlax — done in the latest push. Added the abseil deps to test/tools/wee8_compile so the prebuilt (which excludes abseil from libwee8.a by design) links; the from-source @v8//:wee8 was propagating those transitively, which is why the bare v8_lib consumer worked before.

One tweak vs your snippet: the current tree uses @abseil-cpp//absl/... rather than @com_google_absl//..., so I used that.

On "not sure if that is best way" — I think there are two options and I'd like your call:

• A (this PR): abseil-at-consumer. Works, minimal; in practice wee8_compile is the only bare consumer (envoy-static already links all of abseil, so the full do_ci.sh dev was green). Downside: every future minimal v8_lib consumer has to remember to add the abseil deps.
• B (drop-in parity): abseil re-exposed by the prebuilt. Make toolshed's prebuilt cc_library wrapper propagate the same abseil deps the source @v8//:wee8 exposes, so no consumer needs changes and the prebuilt is a true drop-in. Needs a toolshed change + release, and has to handle the repo-name difference across modes (@com_google_absl in WORKSPACE vs @abseil-cpp in bzlmod) so the wrapper's dep resolves in both.

I lean towards B as the long-term fix (keeps the "prebuilt == source" contract) with A unblocking us now — but happy to go whichever way you prefer. If B, I'll open it against toolshed.

[phlax]

yeah dont mind either way wrt how we bundle absl - i discussed it with a bot when i was working on it in toolshed - it was on that basis i went this way - but feel free to flip it

[phlax]

fails gcc - that might have been the reason for not bundling the symbols

[dcillera]

The previous CI failures should be fixed.
Still outstanding (toolshed-side, not fixable in Envoy): the arm64 wee8_compile_tool segfault from the runtime-broken aarch64 prebuilt — needs the aarch64 artifact repaired or the @envoy_toolshed//v8:wee8 alias to fall back to source for aarch64.

[phlax]

lets fix the arm artifacts in toolshed