Upgrade to upstream WebKit baf4a9a7ec0b

[robobun]

Merges upstream WebKit main at baf4a9a7ec0b (2026-08-22): 387 commits since the previous merge base 47f7250137c6 (2026-08-16), 82 of them touching JavaScriptCore, WTF or bmalloc.

#455 was squash-merged, so the fork's history no longer contains the upstream commits it merged and git merge-base origin/main upstream/main reports the older 3722912ff800. The merge was done with the squash commit grafted as a merge of its PR parents (git replace --graft e462c38dd3 a2f8782020 47f7250137c6), which gives the correct base. This merge commit has baf4a9a7ec0b as its second parent, so the next upgrade does not need the graft as long as it lands as a merge commit rather than a squash.

The fork's main moved while this PR was open (#330 DFG/FTL byte-offset accessors, #450 critical-collection headroom, #491 pending TerminationException in the microtask job). d0fae3b merges it in without conflicts; the 12 buffer-accessor-jit*.js tests pass on the merged debug build with --useDollarVM=1, and a Bun built from bun main (which needs #330) links and passes its Buffer suites against it.

Conflict resolutions

• yarr/YarrJIT.cpp: kept at the fork's version (Yarr: JIT lookbehinds, first-code-point alternation dispatch, Boyer-Moore and /u·/v spec alignment, RegExp correctness fixes #299 policy, same as Upgrade to upstream WebKit 47f7250137c6 #455). Upstream's 01f04c4fb4 (JIT lookbehinds that contain backreferences) restructures the backreference codegen that the fork already reworked for mirrored frames; the fork compiles these patterns already. Upstream's three new tests (regexp-lookbehind-jit-backreferences.js, regexp-lookbehind-jit-backreferences-unicode.js, regexp-backreference-greedy-non-bmp-capture-restore-pos.js) pass on this build in JIT and --useRegExpJIT=false mode. 2165451fd3 (interpreter tryConsumeBackReference position restore) was already in the fork. de9231d86e (FixedVector ovector) merged cleanly.
• WTF/URLParser.cpp and .h: kept at the fork's version. Upstream's eb44b6cfaa SIMD-scans path, query, fragment and opaque-path runs, which the fork's URLParser rewrite (0cbb4a1946, c6cfe90c60, eeab04040f) already does with its own table-driven scanners. Upstream's CodePointIterator::span()/advanceBy() additions and the two new TestWebKitAPI cases are in.
• Atomics.wait termination (03e836de2f vs the fork's [JSC] Atomics.wait / memory.atomic.wait: wake up for a termination requested from another thread #432): WaiterListManager::waitSyncImpl keeps the fork's version (termination wake-up delivered under the waiter list lock, deferred termination respected, trap consumed and the TerminationException thrown before returning Terminated). The two callers take upstream's vm.throwTerminationExceptionIfNeeded(), which is a no-op when the exception is already pending. throwWasmToJSException's early-out for a pending TerminationException is in.
• Module map (f324cca020): upstream no longer registers a module entry for a fetch failure and evicts a FetchFailed entry on the next loadModule. The fork's ModuleLoader: record a non-Error fetch rejection as a fetch failure #262 (setFetchError for a non-ErrorInstance fetch rejection in moduleLoadTopSettled) is dropped: that path no longer registers anything for any fetch failure, so the poisoned EvaluationFailed entry ModuleLoader: record a non-Error fetch rejection as a fetch failure #262 fixed cannot be created. Verified ModuleLoader: record a non-Error fetch rejection as a fetch failure #262's repro (import a file with a parse error, then import a file that statically imports it) completes on a Bun built against this tree. JSModuleLoader.h/.cpp: both sides' additions kept (removeFailedFetchEntry, public getRegisteredMayBeNull, the fork's registryEntry/removeEntry/clearAll/loadModuleSync).
• CodeCache.cpp: upstream's c823243598 generates CodeForConstruct for class constructors via UnlinkedFunctionExecutable::isClassConstructorFunction(). The fork's "NOTE: We changed this in Bun" loop called isConstructor() on the UnlinkedFunctionExecutable, which resolves to JSCell::isConstructor() and is always false for a non-object cell, so it never generated anything but CodeForCall. Upstream's version replaces it. The fork's recordParseFromUnlinkedCodeBlock now takes an UnlinkedGlobalCodeBlock* because 3d0e6c14b1 moved the parse results off UnlinkedCodeBlock (follow-up commit d7ff6be).
• CachedTypes.cpp: 3d0e6c14b1 moves m_features/m_lexicallyScopedFeatures into the new CachedGlobalCodeBlock; the fork's unsigned : N bitfields (fix: use unsigned bitfields for portable bytecode cache struct layout #141, portable layout across MSVC and Itanium) are kept for the fields that stay in CachedCodeBlock (m_parseMode, m_codeGenerationMode). The new CachedGlobalCodeBlock fields are plain (non-bitfield) members, which lay out the same on both ABIs.
• SyntheticModuleRecord: db2d849cbe changes tryCreateWithExportNamesAndValues to take ArgList; the fork's lazy-export overloads (SyntheticModuleRecord: exports whose values are produced on first binding #408) follow. MarkedArgumentBuffer converts implicitly.
• ThreadingPOSIX.cpp (9a18171a13, RT threads removed, per-QOS sched_setattr on Linux): the fork's !USE(BUN_JSC_ADDITIONS) main-thread detection branch keeps its guard and takes the new Thread(QOS, SchedulingPolicy, IsMain) constructor. Thread::updateSchedulingAttributes is a no-op under USE(BUN_JSC_ADDITIONS) on Linux: upstream now resets every WTF thread to SCHED_OTHER nice 0 with a 100% utilization clamp and puts JIT/Wasm compiler threads on SCHED_BATCH nice 10 when the host has 4 or fewer cores. Bun's threads keep inheriting the process's scheduling policy, nice level and clamps, as they did before this merge. Drop that hunk if following upstream is preferred. RealTimeThreads.cpp is deleted (the fork only added an include to it).
• Options.h, JSWebAssemblyInstance.h: upstream's new includes (OSCheck.h, WasmLimits.h, <wtf/BitSet.h>) added in the fork's quoted-include style.
• JSType.h, .github/workflows and the release tarball names are unchanged. PromiseOperations.js is gone upstream (see 38027ff0ec below): Bun's six $newPromiseCapability call sites move to $newPromise() plus $resolvePromise/$rejectPromise (or the ...WithFirstResolvingFunctionCallCheck variants) in the Bun PR.

Verification

• bun run jsc:build:debug (Linux x64, debug + ASAN): builds, jsc shell runs.
• JSTests: the 464 regexp*/string-*/yarr* stress tests (including the three regexp tests upstream added in this range), each in JIT and --useRegExpJIT=false mode: 890 of 928 runs pass as-is. The rest: 4 files need --useDollarVM=1 (pass with it), 2 need the --useRegExpBufferBoundaries option the fork does not have (\A/\z, same as Upgrade to upstream WebKit 47f7250137c6 #455), regexp-unicode-code-unit-read-for-bmp-terms.js is the Yarr: JIT lookbehinds, first-code-point alternation dispatch, Boyer-Moore and /u·/v spec alignment, RegExp correctness fixes #299 match-start behaviour documented in Upgrade to upstream WebKit 47f7250137c6 #455, 4 are //@ skip upstream (too-long-rope, memory hog), 1 needs the //@ runDefault(--watchdog) options (an infinite loop by design), 3 need ICU locale data the bundled libicudata only exposes through Bun's decompress hook (toLocaleString, localeCompare; they pass when run through Bun), and 2 exceed a 600 s limit under ASAN (string-substring-jit.js, string-iterator-surrogate-pairs.js: identical timings on the current pin and on this tree at a reduced loop count).
• bun run build:local: Bun links and runs against this tree. Bun's test/js/bun/jsc, node/vm, node/module, bun/resolve, node/worker_threads, bun/wasm, node/util, node/events, node/dgram, web/url, web/atomics, node/http/node-http-connect, node/async_hooks, node/string_decoder suites: the only failures are 5-second-timeout tests, an IPv6 multicast ENODEV, and a Valkey client debug_assert that a Bun debug build on the current WebKit pin fails the same way on this (shared, debug + ASAN) machine.
• Atomics.wait: a worker parked in Atomics.wait terminates in under 100 ms on worker.terminate().

Upstream changes

Each remaining commit appears once, under the most specific heading that applies. The 17 commits in the range whose only engine-side footprint is a WebCore/WebKit preference entry, a WTF build-file list change, or Cocoa/GTK/WPE-only code the JSCOnly port does not compile are omitted (7d86b2c8a0, 94f879afe6, 2f072fbfec, 3dfdbed8e4, 86a8860a42, 0c33544154, 722d0b38a9, cc7a6821b7, d8ad5b5f9a, b66aab8e21, 5e3cb10ac4, c2b3e55128, 2dce2395a4, d27b7fd89e, 6248fa7145, 8bd2ba0d3e, f0a1fd2b32).

API and ABI changes

• cffd5ed032 — [API][PERF] WTF::PriorityQueue now follows std::priority_queue conventions: the template takes a less-than functor type (default std::less<T>, function pointers are rejected by static_assert) instead of an isHigherPriority function pointer and serves the greatest element first; the isLessThan/isLessThanEqual/isGreaterThan/isGreaterThanEqual helpers were removed from wtf/MathExtras.h. This fixes Wasm::Worklist, whose comparator was never flipped when it moved off std::priority_queue (present in Bun's previous WebKit): compilation plans were served in reverse priority (Preparation before Compilation before Synchronous before Shutdown) and newest-first within a priority, and completePlanSynchronously bumped the plan with decreaseKey instead of increaseKey, so synchronous WebAssembly.Module/Instance compiles could wait behind queued async work. DFG inlining, Wasm inlining and the greedy register allocator were adapted to the new convention with no change in ordering; Bun has no direct PriorityQueue usage.

• 9a18171a13 — [API][PERF] Linux thread scheduling in WTF is reworked: the RealTimeThreads/SCHED_RR machinery is removed (wtf/linux/RealTimeThreads.h renamed to HighPriorityThreads.h, rtkit nice-boosting only under USE(GLIB)), and every WTF::Thread now applies its QOS from its own entry point via sched_setattr: the default UserInitiated QOS maps to SCHED_OTHER, nice 0 plus SCHED_FLAG_UTIL_CLAMP_MIN = 1024 (a 100% DVFS frequency floor, with automatic fallback on kernels that reject uclamp), Default gets a 20% floor, Utility gets SCHED_BATCH/nice 10 and Background gets SCHED_IDLE/nice 19. JIT and Wasm worklist threads now pass compilerThreadQOS(), which is Utility on Linux hosts with <= 4 cores, so concurrent compilation is deprioritized on small machines/containers. API surface: the protected Thread ctor is now Thread(QOS, SchedulingPolicy, IsMain), AutomaticThread gains a ThreadQOS ctor overload, Thread::qos() is added and isRealtime() is derived from the scheduling policy, and ThreadingEnums.h adds ThreadSchedulingState, defaultThreadQOS, defaultThreadSchedulingPolicy, compilerThreadQOS(); Darwin and Windows behaviour is unchanged.

• e1fdc80a34 — [API] WTF::weekDay(int32_t days) in wtf/DateMath.h is rewritten as a branchless unsigned multiply-and-shift (Ben Joffe's method) that is well-defined for the whole int32_t range (the old (days + 4) % 7 was signed overflow for days > INT32_MAX - 4, unreachable from JS since day counts are clipped to +-1e8), and the unused WTF::msToWeekDay(double) is removed. ISO8601::dayOfWeek (Temporal PlainDate/PlainDateTime dayOfWeek) drops its private Int128 copy of the modulo and uses daysFromYearMonth + WTF::weekDay. Results are unchanged (upstream checked all 2^32 inputs); authored by Bun's Sosuke Suzuki.

• 75a9d414a4 — [API] (additive) Correctness fix for VM::deleteAllCode / Heap::deleteAllCodeBlocks: the VM-level m_syncResumeCallCache (the MicrotaskCallCache used to resume async functions/async generators from the microtask queue) lives outside any VMEntryScope and kept stale Executable->CodeBlock entry points after all code was detached, so a later resumption could call into a detached CodeBlock. Adds MicrotaskCall::clear(), MicrotaskCallCache::clear() and public VM::clearMicrotaskCallCaches(), which Heap::deleteAllCodeBlocks now calls; CodeCache::clear() also now calls write() first. Directly relevant to Bun, which calls vm.deleteAllCode(...) in WebWorker__teardownJSCVM, JSC__VM__deleteAllCode, and via the debugger's recompileAllJSFunctions path while async work may still be pending.

• 3302d7a455 — [PERF][API] SourceProviderCache now pre-reserves its m_map hash map from the source length (sourceLength / 512 entries, capped at 64K) to avoid repeated rehash/realloc while a large script is parsed. The public default constructor is replaced by a private explicit SourceProviderCache(unsigned sourceLength) plus static Ref<SourceProviderCache> create(unsigned); VM::addSourceProviderCache is updated. Bun only includes the header (src/jsc/modules/BunJSCModule.h) and never constructs one directly, so no Bun changes are needed.

• 1450e69522 — [API] WTF DequeIterator and DequeConstIterator gain defaulted default constructors (required by the C++20 bidirectional_iterator concept, and by MSVC's STL std::reverse_iterator, which value-initializes its stored iterator). Purely additive; Bun's many WTF::Deque uses (streams, JSBufferList, worker queues) are unaffected and this may help MSVC-STL builds that instantiate Deque::rbegin().

• f2d69489c6 — Removes the unused tryAllocateBuffer helper from VectorBufferBase/VectorBuffer in wtf/Vector.h; allocateBuffer<FailureAction::Report> remains for the same purpose. [API] Technically a public-header removal, but Bun's src/ has no references to it, so no action needed.

• 03e836de2f — [BEHAVIOR] Fixes a thread blocked in Atomics.wait / Wasm memory.atomic.wait never unblocking after VM::notifyNeedTermination(): WaiterListManager::waitSyncImpl now also observes the pending NeedTermination trap (not just hasTerminationRequest()), dequeues the waiter and returns Terminated, and the new VM::throwTerminationExceptionIfNeeded() materializes the TerminationException through handleTraps. This directly affects Bun, whose VmHandle::request_termination (used by worker.terminate()) fires exactly that trap, so a worker parked in Atomics.wait now terminates instead of hanging. [API] Adds VM::throwTerminationExceptionIfNeeded(); throwWasmToJSException now early-outs whenever a TerminationException is already pending.

• 88b46e6bc7 — [API] wtf/BorrowedBytes.h is deleted and replaced by wtf/EscapableByteSpan.h: BorrowedBytes/BorrowedSpanScope/BorrowedVectorScope are gone, replaced by a stack-only, non-refcounted EscapableByteSpan (plus escapableSpan() helper and SpanUInt8/MutableSpanUInt8/VectorUInt8 aliases) that RELEASE_ASSERTs if a copy outlives the borrow. This is a Swift-interop type used only by PAL crypto on Cocoa; Bun has no references to either header, so no impact beyond the header rename in WTF_PUBLIC_HEADERS.

• f324cca020 — [BEHAVIOR] [API] The module loader stops caching fetch failures: JSModuleLoader::loadModule now evicts a FetchFailed registry entry (new removeFailedFetchEntry) and re-fetches instead of re-rejecting with a duplicated copy of the old error, and the top-level rejection paths in JSMicrotask.cpp no longer call ensureRegistered just to stash an error (evaluation errors are still cached; maybeDuplicateFetchError is no longer used on that path). For Bun this means a second import() of a specifier whose fetch previously rejected (e.g. a missing file or failed loader) will invoke Bun's module-loader fetch hook again rather than rejecting immediately from the cache, so anything that relied on the cached rejection (tests, error identity) may see different behavior. JSModuleLoader::getRegisteredMayBeNull is also moved from private to public.

• 905a225671 — [API] wtf/UniStdExtras.h is now wrapped in #if OS(UNIX), so setCloseOnExec/unsetCloseOnExec/dupCloseOnExec/closeWithRetry/setNonBlock are no longer declared on Windows (done to keep the Windows Swift C++ importer happy). Only matters if the embedder includes that header on Windows; Bun's bindings do not reference it.

• 76b474b322 — [API] Refactors JSC::Wasm::TypeKind: the type-section forms Func, Struct, Array, Rec, Sub, Subfinal are removed from TypeKind and moved to a new generated Wasm::DefinedTypeKind enum (with isValidDefinedTypeKind / makeString(DefinedTypeKind)), and the section parser dispatches on that. Pure cleanup that removes dummy switch cases; no behavior change. Bun does not reference these enumerators, so nothing to update.

• 218421554b — [PERF] [API] JSON.parse now buffers array elements on a MarkedArgumentBuffer element stack and allocates each JSArray once at its final length and indexing type (Int32/Double/Contiguous) instead of growing the butterfly via putDirectIndex per element; also skips two Structure loads for outOfLineCapacity when a property offset is still inline. Drive-by change to the inlined MarkedVector::append fast path (stays inline once heap-allocated and registered with a mark set, rather than calling slowAppend on every append) and an additive MarkedVector::shrink(size_t) — both are inlined into Bun's many MarkedArgumentBuffer users, but no signature changes. Also speeds up Bun's native JSONParse/JSONParseWithException callers (JSON module loading, .json(), SQL client, etc.).

• 6446fdc8e0 — WebCore ISO-BMFF box serialization work; the only engine touch is JSC::DataView::get<T>() and DataView::read<T>() in runtime/DataView.h becoming const member functions. [API] Source-compatible (header-only inline templates, only adds const), so no embedder action needed.

• 38027ff0ec — Removes the @newPromiseCapability private builtin/link-time constant from JSC (builtins/BuiltinNames.h, bytecode/LinkTimeConstant.h, host function in runtime/JSGlobalObject.cpp), since upstream builtins now use @newPromise + @resolvePromiseWithFirstResolvingFunctionCallCheck/@rejectPromiseWithFirstResolvingFunctionCallCheck (no tuple object allocation, no property lookups). [API] After this upgrade @newPromiseCapability no longer resolves as a private name. Bun's bundled modules called $newPromiseCapability(Promise) in src/js/node/dgram.ts, events.ts, _http_server.ts (3 sites) and util.ts; the Bun PR rewrites them to $newPromise() plus the $resolvePromise/$rejectPromise family. Note the preceding upstream commit 7f38ebbabf had already deleted builtins/PromiseOperations.js (the JS implementation); the C++ JSPromise::createNewPromiseCapability() used by src/jsc/bindings/JSMockFunction.cpp is unaffected.

• 0b92c2bcd0 — [PERF] Deletes UnlinkedCodeBlock::m_jumpTargets (a per-label offset list that nothing in a shipping configuration read; DFG/liveness already recompute targets via computePreciseJumpTargets()), saving 4 bytes per label (~38 KB after loading typescript.js), shrinking UnlinkedFunctionCodeBlock from 216 to 208 bytes (GC cell 224 -> 208), and cutting the serialized bytecode cache by ~1.4%. [API] Removes CodeBlock::numberOfJumpTargets()/jumpTarget(), UnlinkedCodeBlock::numberOfJumpTargets()/jumpTarget()/lastJumpTarget(), UnlinkedCodeBlockGenerator::addJumpTarget() etc., and recomputePreciseJumpTargets(), adding a computePreciseJumpTargets(UnlinkedCodeBlock*, ...) overload — Bun's bindings use none of these. The CachedCodeBlock layout changes (field dropped from runtime/CachedTypes.cpp), but bun build --bytecode output is already keyed to the build via computeJSCBytecodeCacheVersion(), so old caches are rejected rather than misread.

• 3d0e6c14b1 — [PERF][API] Memory: moves m_features, m_lexicallyScopedFeatures, m_hasCapturedVariables, m_lineCount, m_endColumn and the sourceURL/sourceMappingURL directive pointers from UnlinkedCodeBlock down to UnlinkedGlobalCodeBlock (only Program/Eval/Module code uses them), shrinking UnlinkedFunctionCodeBlock from 216 to 192 bytes (cell 224 -> 192; ~53 KB saved after loading typescript.js). The accessors codeFeatures(), allowDirectEvalCache(), lexicallyScopedFeatures(), hasCapturedVariables(), lineCount(), endColumn(), sourceURLDirective(), sourceMappingURLDirective() and recordParse() are removed from UnlinkedCodeBlock and now exist only on UnlinkedGlobalCodeBlock; UnlinkedCodeBlock::usesImportMeta() is deleted outright (Bun's bindings use none of these; Bun's sourceURLDirective() calls are on SourceProvider). The serialized CachedCodeBlock layout for the bytecode cache also changes (split into CachedCodeBlock + CachedGlobalCodeBlock), which is covered by Bun keying the cache version on BUN_WEBKIT_VERSION.

• 0bbbac7b52 — [BEHAVIOR] [API] Wasm memory64 now works together with multi-memory: the WasmSectionParser check that rejected any module combining a 64-bit memory with multiple memories ("if using memory64 then multiple memories are illegal for now") is removed, so such modules now validate/compile/run instead of failing with CompileError. IPInt decides whether to zero-extend an i32 address per accessed memory using a new WTF::BitSet<Wasm::maxMemories> (JSWebAssemblyInstance::m_memoryIsMemory64Bits) instead of a single memory-0 flag. JSWebAssemblyInstance::cachedMemory0IsMemory64() and offsetOfCachedMemory0IsMemory64() are removed (replaced by offsetOfMemoryIsMemory64Bits()); Bun does not reference them.

• 71144530c1 — [API] Bumps the vendored wtf/simdutf single-header from 8.2.0 to 9.0.0 (now requires C++17): simdutf::to_string(encoding_type) and implementation::name()/description() return std::string_view instead of std::string, full_result gains a padding_error field and the base64 decoders now report the = position as the error location for padding errors, the SIMDUTF_FEATURE_* macros become #ifndef-overridable, and the icelake (AVX-512) simdutf::find now masks its tail load so searching for NUL no longer false-matches past the end of the input. error_code values, struct result, and every function Bun's src/simdutf_sys shim (bun-simdutf.cpp, simdutf.rs Status constants) calls are unchanged, and Bun falls back to its scalar decoder on any base64 error rather than reading the error offset, so no Bun-side change is needed.

• ee4b208267 — [PERF] [API] Generator/async function bodies whose wrapper has no parameters no longer allocate a 64-byte UnlinkedFunctionExecutable::RareData just to hold an empty parameter-name list (every async () => {...}, async function f() {}, function* g() {} paid this; ~6.4 MB saved per 100k such functions). UnlinkedFunctionExecutable::create and the BytecodeGenerator now take Vector<Identifier>&& instead of std::optional<Vector<Identifier>>&&; Bun does not call UnlinkedFunctionExecutable::create directly, so no action needed.

• b1701b3489 — [BEHAVIOR] [API] Uint8Array.prototype.setFromBase64 on a zero-length target now returns { read: 0, written: 0 } without inspecting the input at all (even an invalid base64 string is accepted), matching step 3 of the proposal spec; Uint8Array.fromBase64 is unchanged. WTF::fromBase64() gains a required fifth parameter OutputSizeIsMaxLength (new enum in wtf/text/Base64.h); Bun does not call WTF::fromBase64 directly, so no source change is needed.

• 870de4ab77 — WTF fix in wtf/text/TextBreakIterator.{h,cpp}: NonSharedCharacterBreakIterator and NonSharedSentenceBreakIterator leaked their ICU UBreakIterator when setTextForIterator() failed (reachable via a null StringView), and the 8-bit path skipped utext_close() on ubrk_setUText() failure. Ownership is now expressed with a new WTF::UBreakIteratorPtr (std::unique_ptr<UBreakIterator, ICUDeleter<ubrk_close>>) and m_iterator becomes that smart pointer; the public operator UBreakIterator*() is unchanged. [API] Only the private member type and the file-static helpers changed, so this is source-compatible for embedders, and Bun does not use these classes at all (JSC only references them from the offline CharacterPropertyDataGenerator tool), so it is a no-op for Bun in practice.

Behavior changes

• 3b9afb2b4f — [BEHAVIOR] Wasm correctness fix in BBQ and OMG (B3 lowering): ref.cast/ref.test on a nullable reference now only elides the explicit null check when Options::useWasmFaultSignalHandler() is on, so configurations running without the fault handler (e.g. Bun's Linux ASAN builds, where Options.cpp turns it off unless ASAN_OPTIONS contains allow_user_segv_handler=1) get a proper Wasm trap instead of dereferencing null. In signaling-memory mode, the decision to emit an explicit bounds check for large constant offsets now uses the last accessed byte (offset + size - 1) rather than the base offset; the old computation was slightly off but always still trapped via the PROT_NONE redzone.

• b74760b182 — [BEHAVIOR] The non-ARM64 WTF::roundeven/roundevenf polyfill returned +0.0 for the tie that rounds to zero (roundeven(-0.5) gave +0.0 instead of -0.0); the result is now wrapped in copysign. In JSC this feeds BBQ's constant folding of Wasm f32.nearest/f64.nearest, so on x86_64 a constant -0.5 operand folded to the wrong sign of zero; ARM64 uses __builtin_roundeven (frintn) and was already correct.

• 3c0f403d81 — [PERF] [BEHAVIOR] WasmGC array.fill / array.copy are reworked in BBQ and OMG: null and bounds checks are now emitted inline in JIT code, the runtime call is skipped entirely when size == 0 (observed to be very common), non-ref array.copy uses B3 MemoryCopy, and non-ref array.fill uses MemoryFill or new operationWasmArrayFill{2B,4B,8B,16B} (memset_pattern* on Darwin, std::ranges::fill elsewhere), while ref-typed arrays keep GC-safe loops (operationWasmArrayFillRefs / operationWasmArrayCopyRefs via gcSafeMemmove). Observable change: the trap message for a null array in these ops becomes the generic "access to a null reference" instead of "array.fill to a null reference" / "array.copy to a null reference" (the NullArrayFill / NullArrayCopy enumerators were removed from the internal Wasm::ExceptionType enum, which Bun does not reference). Old operationWasmArrayFill{,Vector} / operationWasmArrayCopy JIT operations are removed.

• 2165451fd3 — [BEHAVIOR] Correctness fix in the YARR interpreter's tryConsumeBackReference: in Forward direction it speculatively advanced the input by matchSize before comparing, and when the captured character was non-BMP and the input at that offset was not a valid surrogate pair, the early errorCodePoint return only restored the position for Backward, so a failed greedy iteration consumed input. Fixes wrong results like /(\u{1F601})\1*$/u.exec("\u{1F601}ab") matching instead of returning null, and /(\u{1F601})(\1*)?/u splitting a surrogate pair; the check now falls through to the common mismatch path which restores the position in both directions. Only affects patterns that run in the interpreter (authored by Sosuke Suzuki from Bun).

• e88b92e29f — [BEHAVIOR] (bug fix) Fixes a BBQ-tier miscompile of Wasm i64.mul_wide_s/i64.mul_wide_u on x86_64: the 128-bit product comes back in rdx:rax, and if the register allocator handed out rax/rdx as the result or scratch registers the halves were clobbered, producing wrong results. Now uses the same PREPARE_FOR_MOD_OR_DIV pattern as div/mod (clobber + lock rax/rdx). Only reachable when Options::useWasmWideArithmetic is on (default off, Bun does not enable it), so this matters only for users opting in via BUN_JSC_useWasmWideArithmetic=1.

• 5cfff9fe44 — [BEHAVIOR] In JSC's Wasm ESM integration (WebAssemblyModuleRecord), immutable exported globals are now exposed in the module namespace as plain JS values instead of WebAssembly.Global wrappers, per the esm-integration spec/WPT; v128 and exnref globals stay TDZ, Instance.exports is unchanged, and wasm-to-wasm ESM imports fall back to the Instance.exports wrapper when the namespace binding is empty. No Bun-visible change today because Bun's .wasm loader (src/runtime/jsc_hooks.rs, L::Wasm arm) returns a file path / wasi-runner instead of creating a JSC Wasm module record; it would matter if Bun ever adopts JSC's native Wasm ESM path.

• b7afce9416 — [BEHAVIOR] When several Wasm functions fail validation during concurrent compilation, the WebAssembly.CompileError message now deterministically reports the lowest-index failing function instead of whichever worker thread finished first; non-function failures (OOM/parse/cancel) still take precedence. Adds protected Plan::failAtFunction / EntryPlan::failFunctionCompilation and an m_errorFunctionIndex field; error messages become stable across runs (useful for snapshot tests).

• 010e57fb4b — [BEHAVIOR] WebAssembly.Module.imports() / WebAssembly.Module.exports() descriptors no longer include the non-standard js-types-proposal type field unless Options::useWasmJSTypes() is enabled (default false, and Bun does not set it). At the merge base this field was emitted unconditionally and could throw for unrepresentable ref types; descriptors now have the spec shape {module, name, kind} / {name, kind}, matching V8/Node. Also tweaks the WasmJSTypesEnabled description in UnifiedWebPreferences.yaml.

• 20c0bd7d62 — [BEHAVIOR] Wasm JS API spec fix: re-exporting an imported immutable WebAssembly.Global now yields the same JS object that was imported (instance.exports.g === importedGlobal), matching the WPT constructor-caching expectations; previously a fresh wrapper was created each time (mutable globals already preserved identity). JSWebAssemblyInstance gains an m_importedGlobalWrappers map (new setImportedGlobalWrapper/importedGlobalWrapper methods, visited by GC). Plain-number global imports still get a new wrapper.

• 39de2d4eea — [BEHAVIOR] Wasm: importing a WebAssembly.Tag and re-exporting it now yields the same JS object (previously a fresh JSWebAssemblyTag wrapper was created on every export, so === identity failed), and locally defined tags are cached on first export so two export names share one wrapper. Implemented via a new m_tagWrappers map on JSWebAssemblyInstance that is visited by GC; no embedder-facing API change.

• 7f38ebbabf — [BEHAVIOR] Promise.try follows the updated spec (Normative: make Promise.try use PromiseResolve in non-error case tc39/ecma262#3883): the result comes from PromiseResolve(C, value) / PromiseReject(C, error) instead of NewPromiseCapability(C), so Promise.try(() => p) now returns p itself when p is a native Promise, and a subclass constructor is invoked after the callback runs rather than before. builtins/PromiseOperations.js is deleted (@newPromiseCapabilitySlow gone) and @newPromiseCapability becomes a C++ link-time constant wrapping JSPromise::createNewPromiseCapability. Heads-up: follow-up upstream commit 38027ff0ec (also in this range) removes @newPromiseCapability entirely; see that entry under "API and ABI changes" for the Bun $newPromiseCapability(Promise) call sites that must be rewritten.

Performance

• 958a13ecad — [PERF] Wasm BBQ emitIndirectCall computed the CallProfile address with addPtr(TrustedImm32, ...), which on large offsets (functions with many call profiles) silently spills through scratchRegister, clobbering the profile value loaded just before; it now does move + register addPtr. No observable behavior change, but affected call_indirect sites were left permanently un-optimized (polymorphic-callee detection never kicked in), so this restores expected tiering for large wasm functions.

• 01f04c4fb4 — [PERF] YARR JIT now compiles backreferences inside lookbehinds (e.g. /(?<=(a)\1)b/); previously any such pattern forced the entire regex to the interpreter. The backward match compares the capture from its end down to its start, with checkNotEnoughInput becoming index >= length in Backward mode and case-insensitive, duplicate-named-group and surrogate-pair handling reused with the index direction flipped; forward codegen is unchanged. ~10.8x faster on the new regexp-lookbehind-backreference microbenchmark, no intended change in match results (authored by Sosuke Suzuki from Bun).

• 7ef4708559 — [PERF] Parser: when parseFunctionInfo has already computed a function's free-variable list for the SourceProviderCache entry, that span is now handed to popScope, so Scope::collectFreeVariablesFrom (renamed from collectFreeVariables, internal to parser/Parser.h) no longer re-derives it by re-walking used/declared/lexical sets. Pure parse-time speedup for cacheable (>=16/8 byte) function bodies; SourceProviderCacheItemCreationParameters gains a freeVariableCount field and freeVariables() accessor. No behavior change.

• 0ca8f08b89 — [PERF] Lexer::shift drops the 14-year-old "unconditionally zero m_current then overwrite" micro-optimization in favor of a plain if/else, which measures faster on current hardware. Semantics are identical; lexer hot-path only.

• 24a6944b57 — [PERF] In Parser::parseMemberExpression, when the TreeBuilder is SyntaxChecker (the pre-parse/syntax-only pass), the new token start positions are now tracked by a counting placeholder instead of a Vector<JSTextPosition, 4>, since SyntaxChecker::createNewExpr ignores them anyway. Saves allocation/copy work for nested new chains during syntax checking; no behavior change.

• a5fa580c84 — [PERF] B3 LICM (hoistLoopInvariantValues) can now hoist trapping loads (plain Load*, WasmStructGet, WasmArrayLength without fences) and control-dependent values out of loops that contain side exits, as long as no earlier "trap barrier" (write/fence/side-exit) precedes the value on the path from the loop header. Previously any side exit in the loop disabled hoisting of control-dependent values entirely; mainly benefits Wasm OMG and FTL code with bounds/null checks in loops. Adds Effects::isWrite()/isTrapBarrier().

• 6fbae40455 — [PERF] FTL switch on a string that is an unresolved concatenation rope now calls a new noexcept operation (operationSwitchStringResolveRopeAndGetCharacters8) to resolve the rope, and if the result is 8-bit uses the inline binary-search StringSwitch on the resolved characters instead of falling back to the generic slow path. Resolution uses tryGetValue() so an OOM falls through to the slow path rather than throwing from the JIT operation.

• de9231d86e — [PERF] RegExp::m_ovector and RegExp::RareData::m_captureGroupNames switch from Vector to FixedVector, shrinking the RegExp GC cell from 96 to 80 bytes and allocating exactly offsetVectorSize ints instead of Vector::resize's 16-element minimum capacity (64 bytes). Upstream measured per-RegExp cell+ovector going from 160 to 96 bytes and max RSS with 200k live RegExps dropping from 137.5 MB to 115.0 MB; estimatedSize now reports the exact ovector byteSize(). Authored by a Bun contributor.

• 1c2c282d06 — [PERF] Options::computeNumberOfWorkerThreads now caps its result at 32 on non-Darwin platforms; in practice this only affects the default numberOfWasmCompilerThreads (previously cores - 1 with no cap; other callers already pass caps of 3 or 8), limiting it to 31 on Linux/Windows machines with more than 32 cores. Motivated by Wasm compilation OOMs on high-core-count, low-memory hosts; Bun does not override this option (it only sets numberOfGCMarkers), so large Linux servers will see fewer Wasm compiler threads and lower peak memory.

• ce878e190f — [PERF] Map.prototype.forEach/Set.prototype.forEach get inline DFG and FTL lowering for MapIterationNext/MapIterationEntry/MapIterationEntryKey/MapIterationEntryValue, scanning the ordered hash table directly instead of making four C++ operation calls per element (the for-of MapIterator* nodes already did this and now share loadMapEntryData). Upstream microbenchmarks show 1.23x-1.65x speedups on forEach-heavy loops; the now-unreachable operationMap/SetIterationEntry* JIT operations are removed and the remaining operationMap/SetIterationNext become noexcept and only handle obsolete tables. Internal DFG operations only, no embedder-facing API or JS-visible behavior change (new stress tests cover mutation during iteration).

• c823243598 — [PERF] The bytecode cache (generateUnlinkedCodeBlockForFunctions in CodeCache.cpp) now emits CodeForConstruct instead of CodeForCall for class constructors, so cached programs no longer reparse every class constructor body (and its nested functions) on the first new C(); upstream measured 253 -> 4 parses constructing 182 three.js classes and 133 -> 9 parses for babylon.js startup. Cache output grows by the previously missing constructor bodies (three.js +10.8%, a 50 MB bundle +0.5%), which is relevant to Bun's --bytecode builds and node:vm cached-data paths that use generateProgramBytecode/generateModuleBytecode. No API or JS behavior change.

• 9516ed8a4f — [PERF] DFG/FTL switch on strings now handles 8-bit substring ropes inline by reading the base string's buffer at the substring offset, instead of bailing to the slow operationSwitchString call (which resolves the rope). Previously only flat 8-bit strings took the inline binary-switch path, so JIT'd code doing switch (s.slice(...)) / switch (s.substring(...)) gets faster. Internal-only signature rename in DFGSpeculativeJIT.h; no public API change.

• a7a9e233ce — [PERF] The JSON.parse lexer accumulates the int32 value while scanning the digit run instead of re-walking the digits a second time in lexNumber; micro-optimization for integer-heavy JSON. No API or behavior change.

• 6b13bfa7ba — [PERF] TypedArray.prototype.sort() without a comparator now uses an LSD radix sort (8-bit digits, stable passes, skipping digits with a single bucket) for 2/4/8-byte element types above measured thresholds (128 / 512 / 8192 elements), with a SIMD already-sorted pre-scan and a sampled few-distinct-values check that falls back to std::sort; upstream reports 2.3-4.6x on large Int16/Uint16/Int32/Uint32/Float32/Float64 arrays and 6.7x on presorted Int32 (geomean 1.5x). It temporarily allocates an O(n) scratch buffer (plus a snapshot copy for shared buffers) and falls back to std::sort on allocation failure; results are unchanged (NaN canonicalization matches the old sortFloat path). Also adds WTF::SIMD::bitXor/bitXor2 helpers to SIMDHelpers.h.

• db2d849cbe — [PERF] Replaces heap-registering MarkedArgumentBuffer with a stack std::array<EncodedJSValue, N> wrapped in ArgList at every call site where the argument count is statically known (37 files: Promise resolve/reject/then/finally and microtask jobs, VM::callPromiseRejectionCallback, Proxy traps, JSON toJSON/reviver, RegExp/String Symbol.* protocol, iterator protocol, typed-array callbacks, Map/Set/WeakMap constructors, DFG slow paths). This trims per-call overhead and removes the never-hit hasOverflowed()/OOM checks whenever the engine calls back into JS from C++. No public API or JS-visible behavior change; the only signature change (SyntheticModuleRecord::tryCreateWithExportNamesAndValues now takes ArgList) is a private method Bun does not call.

• eb44b6cfaa — [PERF] WTF::URLParser now SIMD-scans the path, opaque-path, query, and fragment states (via SIMD::find from wtf/SIMDHelpers.h) for the first delimiter, encode-set member, control, or non-ASCII code point and consumes the whole preceding run at once (skipped for canonical input, bulk-appended when building the output buffer) instead of looping per code point; upstream measures ~1.33x on 82k real-world URLs and 3-4x on ~100-char components. This directly speeds up every WTF::URL parse in Bun (new URL(), URLPattern, Request/fetch URL handling, module URL resolution). Additive-only header changes: CodePointIterator::span()/advanceBy() and a private URLParser::appendToASCIIBuffer(std::span<const char16_t>) overload; a consteval static_assert verifies each stop-character set covers its percent-encode set, so no parsing behavior changes.

• 70eb5015ae — [PERF] Memory: the buffered-structures set, its lock and bufferingCountdown move from the PropertyInlineCache base class into RepatchingPropertyInlineCache, since handler ICs never buffer; sizeof(HandlerPropertyInlineCache) drops 112 -> 88 bytes per IC site in Baseline/DFG JITData (about -1.27 MB on Octane typescript). Side effect: handler ICs that fail to cache a structure now retry tryCache on the next few visits instead of skipping them; repatching ICs are unchanged. Internal JIT data structure only, not referenced by Bun.

• 1969cf2d9e — [PERF] StringImpl::replace(char16_t, char16_t) (behind String::replace(char, char)) now finds the first occurrence with SIMD WTF::find() instead of a scalar byte-at-a-time loop, for both 8-bit and 16-bit strings; same fix already applied to makeStringByReplacingAll. No behavior change.

• 2d0855229c — [PERF] WTF::copyElements (used throughout string building/concatenation) now handles 2..32-byte copies with inlined overlapping unaligned loads/stores instead of calling libc memcpy, whose size dispatch costs more than the copy itself for short runs. The B3 operationMemoryCopy fast path is hoisted into new WTF helpers copySmallMemory<min,max>(), copyOverlappingEnds, copyOverlappingEndPairs, WidestUnalignedUnit and maxSmallCopySize in wtf/UnalignedAccess.h, available for Bun's own C++ to use; no behavior change.

• 7375405d8e — [PERF] base64EncodeInternal()/base64DecodeInternal() in WTF bound the chosen lookup table with auto, copying the whole 64-byte encode map or 128-byte decode map onto the stack on every call; now auto& references the constexpr table directly. Affects Bun's uses of WTF::base64Decode/base64URLDecode/base64URLEncode (WebCrypto JWK import/export in src/jsc/bindings/webcrypto/CryptoKey*.cpp); no behavior change.

Wasm

• ce60d5d618 — WasmGC concurrent-GC correctness fix in the BBQ tier: struct.new/struct.new_default skipped the mutator fence when every stored field was a constant, but a struct with reference fields still needs the store-store fence before the new object is published to the concurrent marker. BBQ now emits emitMutatorFence() whenever the struct type has ref fields, matching IPInt/OMG; the fence is a no-op on x86_64, so this matters on ARM64.

• c25fbbd346 — Debug-only: fixes a copy-paste typo in an ASSERT in Wasm BBQ emitModOrDiv (x64) that tested lhsLocation twice instead of rhsLocation != edx. No release-build or behavior impact.

• 4cc12fa76b — Debug-build-only fix: assertCalleeIsReferenced in WasmOperations.cpp now returns early when the frame's callee is not a NativeCallee, which happens when a stack overflow during a JS↔Wasm transition reaches operationWasmToJSException with a JS callee still in the frame. Fixes a spurious asNativeCallee() crash under ASSERT_ENABLED; no release behavior change.

• 3400ff6aa7 — Wasm: ModuleInformation now stores the importedStringConstants / qualifiedBuiltinSetNames compile options as UTF-8 byte vectors (Wasm::Name) instead of isolatedCopy()'d WTF::Strings, so no StringImpl is ever shared between the main thread and Wasm compiler threads (not all StringImpl fields are atomic). Import-name matching now compares raw bytes directly, dropping a makeString per import. Internal importedStringConstantsEquals()/builtinSetsInclude() signatures change to const Name& (Bun does not call them); only affects modules compiled with JS string builtins / importedStringConstants options.

• 20d622b6d6 — Build fix: Wasm::CalleeGroup::BBQCalleeReference::operator= is replaced with a named set() method so clang 18's -Wthread-safety-precise analyzer can see the WTF_REQUIRES_LOCK requirement. No runtime behavior change; internal type only.

Other JSC

• 9d03f48340 — Removes the dead CallLinkInfo::m_slowPathCount field (plus offsetOfSlowPathCount()/slowPathCount()) and its increments in the LLInt and JIT virtual-call thunks; CallLinkStatus::computeFromCallLinkInfo already bailed via takesSlowPath() for any m_clearedByVirtual site, so the reads always saw zero. Minor: one fewer memory increment per virtual call and 4 bytes less in CallLinkInfo. Internal-only, not used by Bun.

• 3ddc7045b7 — DFG OSR-exit correctness fix: SpeculativeJIT::emitSwitchChar's StringUse path called op1.use() before speculateString(), so the operand's death preceded the BadType exit and baseline re-executed op_switch_char on a dead/poisoned scrutinee value when the speculation failed (e.g. a switch with single-character string cases later fed a non-string). Now speculates before releasing the operand, matching emitSwitchString; fixes a potential crash/miscompile in optimized code, no API change.

• bdb7246737 — Adds an opt-in DFG/FTL "global inlining planner" (Options::useGlobalInliningPlanner, default false) that surveys and ranks all inlining candidates of a compilation up front (weighted by callee tier and inline depth) and spends a single compilation-wide budget, instead of deciding per call site in bytecode order. Adds nine new Options knobs (globalInliningPlanBudgetForDFG/FTL, maximumGlobalInliningPlanSites, inliningPlanTierBonus*, inliningPlanDepthPenalty). No effect unless enabled; upstream notes the current budget is high enough that it barely changes inlining decisions yet.

WTF and bmalloc

• 386c27f080 — Build-only tweak: the ALWAYS_INLINE fast path of WTFCrashWithInfo (Darwin/PlayStation on x86_64/ARM64) is additionally disabled when compiling under the clang static analyzer (__clang_analyzer__) so the analyzer sees the out-of-line no-return version. No effect on normal Bun builds.

• 390e2c91dc — Only engine-side change is a one-line #import → #include of <wtf/Platform.h> in wtf/MachSendRightAnnotated.h (a Cocoa-only header); the rest is WebKit modulemap hygiene for Swift/Windows. No effect on Bun's JSCOnly build.

• 1f7ab2fec8 — Fixes WTF::symbolize() in wtf/StackTrace.cpp under USE(LIBBACKTRACE): consults the symbol table (mangled names) before DWARF so clang debug builds get fully-qualified frame names, initializes the symbol pointer (previously read uninitialized on lookup miss), and passes a non-null error callback (libbacktrace always invokes it, so null crashed on the first failed lookup). No effect on Bun: USE_LIBBACKTRACE defaults to OFF for the JSCOnly port and Bun's build does not enable it.

• f0148cf5ab — Changes Source/WTF/wtf/module.modulemap so the WTF Core clang module declares requires cplusplus23 instead of cplusplus, and bumps the module-cache touch count to force a rebuild. Only affects builds that consume WTF as a clang module (-fmodules, Apple/Swift-interop builds); Bun's build already uses -std=c++23 and does not enable clang modules, so no effect on Bun.

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

Thanks — 6281729 fixes the Android PlatformJSCOnly.cmake entry (now builds linux/HighPriorityThreads.cpp), and this pass found no further issues.

Given the scope — a 387-commit upstream merge with hand-resolved conflicts across YarrJIT, URLParser, Atomics.wait termination, the module loader, CodeCache/CachedTypes, and ThreadingPOSIX — a human review of the conflict resolutions is still warranted.

What was reviewed:

• Confirmed the ANDROID branch of PlatformJSCOnly.cmake now lists HighPriorityThreads.cpp and RealTimeThreads.cpp is gone from the tree.
• Re-checked the other fork-only build lists for stale references to files this merge deletes/renames — none found.
• Spot-checked the recordParseFromUnlinkedCodeBlock follow-up (d7ff6be) against the UnlinkedGlobalCodeBlock split from 3d0e6c14b1.

Extended reasoning...

Overview

This PR merges upstream WebKit baf4a9a7ec0b (387 commits, 82 touching JSC/WTF/bmalloc) into the Bun fork. Beyond the mechanical merge, it includes hand-resolved conflicts in yarr/YarrJIT.cpp, WTF/URLParser.{cpp,h}, WaiterListManager::waitSyncImpl (Atomics.wait termination, reconciling upstream 03e836de2f with the fork's #432), JSModuleLoader/JSMicrotask (dropping the fork's #262 in favor of upstream's f324cca020), CodeCache.cpp, CachedTypes.cpp (bitfield layout across the new CachedGlobalCodeBlock split), SyntheticModuleRecord, and ThreadingPOSIX.cpp (opting out of upstream's new Linux sched_setattr policy under USE(BUN_JSC_ADDITIONS)). It also removes @newPromiseCapability, requiring coordinated changes on the Bun side. Two follow-up commits landed after the merge: d7ff6bea27 (adapting recordParseFromUnlinkedCodeBlock to the UnlinkedGlobalCodeBlock split) and 6281729b4e (the Android CMake fix from my previous review).

Previous review resolved

My prior review flagged that the fork-only elseif (ANDROID) branch in Source/WTF/wtf/PlatformJSCOnly.cmake still listed the deleted linux/RealTimeThreads.cpp. Commit 6281729b4e renames it to linux/HighPriorityThreads.cpp, which I've verified at HEAD (line 127). The bug hunting system found no further issues this pass.

Security risks

No new attack surface is introduced by the merge mechanics themselves; the upstream commits are already public and reviewed. The hand-resolved conflicts do touch security-adjacent code (Yarr JIT codegen, CachedTypes serialized layout, module loader error handling), where a mis-merge could introduce memory-safety or cache-poisoning issues — which is precisely why these resolutions need human eyes rather than automated sign-off.

Level of scrutiny

High. This is not a mechanical change: each conflict resolution in the description encodes a judgment call (keep fork, take upstream, or blend), several of which the description explicitly flags for the reviewer ("Drop that hunk if following upstream is preferred" for the ThreadingPOSIX scheduling opt-out; the #262 drop with a repro-based justification). The bytecode cache layout change (CachedCodeBlock/CachedGlobalCodeBlock split with the fork's MSVC-portable bitfields) and the WaiterListManager reconciliation are correctness-critical and non-obvious.

Other factors

The author reports a debug+ASAN build passes, the new upstream regexp tests pass in both JIT and interpreter mode, and Bun links against the tree — good signal, but not a substitute for reviewing the conflict hunks. The PR description is unusually thorough and makes a human review tractable; it also documents an explicit policy question (Linux thread scheduling opt-out) that a maintainer should decide on. Given all of this, deferring to a human reviewer is the right call even with zero automated findings.

[github-actions]

Preview Builds

Commit	Release	Date
d0fae3b3	autobuild-preview-pr-488-d0fae3b3	2026-08-23 09:46:56 UTC
6281729b	autobuild-preview-pr-488-6281729b	2026-08-22 06:16:30 UTC

[claude]

Thanks for the fix in 6281729 — the ANDROID branch of PlatformJSCOnly.cmake now lists linux/HighPriorityThreads.cpp, so the Android CI configure will succeed. I re-reviewed after that commit and the origin/main merge and didn't find further issues. Given the scope — a 387-commit upstream merge with hand-resolved conflicts in YarrJIT, Atomics.wait termination, the module loader, CachedTypes layout, and Linux thread scheduling — a human pass over the conflict resolutions is still worthwhile.

Checked on this pass: the ThreadingPOSIX.cpp USE(BUN_JSC_ADDITIONS) guard around updateSchedulingAttributes is intact; the waitSyncImpl merge keeps the fork's under-lock termination delivery with upstream's throwTerminationExceptionIfNeeded() at the callers; the CachedCodeBlock bitfield-width changes for #141 portable layout are preserved after fields moved to CachedGlobalCodeBlock; and recordParseFromUnlinkedCodeBlock's signature change to UnlinkedGlobalCodeBlock* is consistent with the moved accessors.

Extended reasoning...

Overview

This PR merges upstream WebKit baf4a9a7ec0b (387 commits, 82 touching JSC/WTF/bmalloc) into Bun's fork, plus a follow-up merge of origin/main (d0fae3b) to pick up #330, #450, #491. It touches 300+ files across JSC runtime, DFG/FTL, Yarr JIT, Wasm, WTF threading, the module loader, bytecode cache serialization, and a large volume of tests/LayoutTests. The PR description documents each conflict resolution and per-commit API/behavior notes in detail.

The one issue flagged in my previous review — the fork-only elseif (ANDROID) branch in PlatformJSCOnly.cmake still listing the deleted linux/RealTimeThreads.cpp — was fixed in 6281729 and verified at HEAD (line 127 now reads linux/HighPriorityThreads.cpp). That inline thread is resolved.

Security risks

Several conflict-resolved areas are security-relevant: yarr/YarrJIT.cpp (regex JIT codegen, kept at the fork's version per #299 policy), CachedTypes.cpp (bytecode cache deserialization layout), Wasm bounds-check/signal-handler changes, and AtomicsObject termination handling. These are upstream-authored changes plus fork-side merge resolutions; nothing in the diff or the bug-hunt pass surfaced a concrete issue, but the attack surface is exactly the kind that merits a human maintainer confirming the resolutions match intent.

Level of scrutiny

High. This is not a mechanical change: it is a large upstream merge with ~10 hand-resolved conflicts in core engine paths (JIT, GC-adjacent cache invalidation, module loader semantics, thread scheduling policy), several of which the PR author explicitly flags as judgment calls (e.g., the Linux sched_setattr no-op under USE(BUN_JSC_ADDITIONS), dropping the fork's #262 in favor of upstream's fetch-failure eviction). An automated review cannot substitute for a maintainer signing off on those policy choices.

Other factors

The PR description includes verification (debug+ASAN build, 928 regexp/string/yarr stress runs, Bun link + test suites, Atomics.wait worker-terminate check), and CI preview builds were published for 6281729. The author addressed my prior finding promptly. No outstanding unaddressed reviewer comments. Still, per the approval guidelines — large, complex, touches critical code paths, contains design/policy decisions — this should not be auto-approved.

[robobun]

Superseded by #503, which merges the fork's current main (including the bytecode cache rework in #490, #493, #494, #497) with this PR's head d0fae3b3c9 and then upstream 8c4fd56347. The conflict resolutions and the upstream review from this PR are carried over there.

[robobun]

Superseded by #501. That PR merges this branch's head (d0fae3b, with its conflict resolutions and review fixes) and then upstream main at 55d9d90 on top of the fork's current main. This branch conflicts with main since the bytecode cache work (#490, #493, #494, #497) landed; the CachedTypes.cpp resolution is described in #501. Closing as a duplicate.