fix: propagate unwind safety to user callbacks across all gloo crates

[guybedford]

wasm-bindgen 0.2.117+ added MaybeUnwindSafe bounds on Closure::wrap and Closure::once because closures handed to JS are invoked across a catch_unwind boundary under panic = "unwind". Every gloo crate that wraps user (or internal) Fn/FnMut/FnOnce callbacks fails to compile under -Cpanic=unwind because the Box::new(callback) as Box<dyn Fn*> coercion (and the FnOnce trait selection) erases the static UnwindSafe bound that wasm-bindgen requires.

This breaks every downstream crate that pulls in gloo and tests under -Cpanic=unwind — see the failure on MattiasBuelens/wasm-streams#35.

The fix follows the same pattern in every affected crate:

• Where user callbacks flow through the public API (gloo-timers, gloo-events, gloo-render), surface the requirement via a CallbackUnwindSafe marker trait. It resolves to std::panic::UnwindSafe under panic = "unwind" on wasm and to a no-op blanket otherwise. Callers with non-UnwindSafe captures must wrap them in std::panic::AssertUnwindSafe at the call site, which is where the invariants can actually be reasoned about.

• Where the closures are purely internal (gloo-net websocket/eventsource, gloo-worker actor trampoline, gloo-timers futures wrappers, gloo-render's internal slot), use Closure::wrap_assert_unwind_safe / Closure::once_assert_unwind_safe under panic=unwind. The unwind-safety assertion is audited per call site: every internal closure either touches lock-free mpsc::UnboundedSender pushes, single-shot Option<Waker> takes, or Rc<RefCell<...>> slots where the borrow is released before invoking nested user code. A panic mid-callback leaves observers seeing only states already reachable by normal operation (a missing wake, a dropped event).

• All under-panic=unwind code paths are cfg-gated, so default panic = "abort" builds are byte-for-byte unchanged and remain compatible with any 0.2.x wasm-bindgen. No version-requirement bumps anywhere.

// before
pub fn new<F>(millis: u32, callback: F) -> Timeout
where F: 'static + FnOnce(),
{
    let closure = Closure::once(callback);
    ...
}

// after
pub fn new<F>(millis: u32, callback: F) -> Timeout
where F: 'static + FnOnce() + CallbackUnwindSafe,
{
    #[cfg(all(target_arch = "wasm32", panic = "unwind"))]
    let closure = Closure::once_assert_unwind_safe(callback);
    #[cfg(not(all(target_arch = "wasm32", panic = "unwind")))]
    let closure = Closure::once(callback);
    ...
}

This is not a breaking change. Under panic = "abort" (the default) CallbackUnwindSafe is a blanket implemented for every T, so the bound is invisible. Every existing caller continues to compile unchanged. Under panic = "unwind" gloo previously did not compile at all against wasm-bindgen 0.2.117+, so there are no existing panic=unwind callers to break. The change unblocks the configuration; it does not regress it.

The panic_unwind_build CI job now exercises every affected crate, not just gloo-timers default-features, so the regression cannot recur silently in any sibling crate. The nightly-pin workaround is also dropped: the upstream LLVM 22 + panic=unwind issue (wasm-bindgen#4929) is resolved.

Tested locally:

• RUSTFLAGS="-Cpanic=unwind" cargo +nightly build -p gloo-timers -p gloo-events -p gloo-render -p gloo-net -p gloo-worker --target wasm32-unknown-unknown -Zbuild-std=std,panic_unwind — passes.
• cargo build -p gloo-timers --features futures --target wasm32-unknown-unknown under both panic strategies — passes.
• Default-strategy cargo check + cargo clippy on all touched crates — clean.

[Madoshakalaka]

The futures feature is broken now:

RUSTFLAGS='-Cpanic=unwind' cargo +nightly check -p gloo-timers --features futures --target wasm32-unknown-unknown -Zbuild-std=std,panic_unwind

fails with

  error[E0277]: the type `UnsafeCell<Option<Waker>>` may contain interior mutability and a reference
   may not be safely transferrable across a catch_unwind boundary
     --> crates/timers/src/future.rs:143:43
     ...
  note: required for `{closure@crates/timers/src/future.rs:143:43: 143:50}`
        to implement `CallbackUnwindSafe`

The CI job runs cargo build -p gloo-timers --target wasm32-unknown-unknown -Zbuild-std=std,panic_unwind with default features only so this went undetected.

[guybedford]

I added the fix for the futures case as well and a CI test to check that in future.

We have since landed the wasm-bindgen change that does these stricter assertions which will be going out in wasm-bindgen@0.2.122 - would be great to have this landed by then!

[Madoshakalaka]

Additionally, I note all sibling crates fail with the flag:

RUSTFLAGS='-Cpanic=unwind' cargo +nightly check -p gloo-{events,render,net,worker} --target wasm32-unknown-unknown -Zbuild-std=std,panic_unwind

But it's out of the scope for this PR.

[jxs]

Hi, can we have a patch release with this?
it's unfortunately currently blocking libp2p/rust-libp2p#6446 (comment)
Thanks!